kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity
1,447,079 commits 117 branches 5,827 tags 6.3 GiB
Commit graph

1,447,079 commits

This branch
This branch
All branches
Author SHA1 Message Date
ZhengYuan Huang
7a308f6d29 btrfs: balance: fix potential bg lookup failure in chunk_usage_range_filter() 
[BUG]
Running btrfs balance with a usage range filter (-dusage=min..max) can
trigger a null-ptr-deref when metadata corruption causes a chunk to have
no corresponding block group in the in-memory cache:

  KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077]
  RIP: 0010:chunk_usage_range_filter fs/btrfs/volumes.c:3845 [inline]
  RIP: 0010:should_balance_chunk fs/btrfs/volumes.c:4031 [inline]
  RIP: 0010:__btrfs_balance fs/btrfs/volumes.c:4182 [inline]
  RIP: 0010:btrfs_balance+0x249e/0x4320 fs/btrfs/volumes.c:4618
  ...
  Call Trace:
    btrfs_ioctl_balance fs/btrfs/ioctl.c:3577 [inline]
    btrfs_ioctl+0x25cf/0x5b90 fs/btrfs/ioctl.c:5313
    vfs_ioctl fs/ioctl.c:51 [inline]
    ...

The bug is reproducible on recent development branch.

[CAUSE]
Two separate data structures are involved:

1. The on-disk chunk tree, which records every chunk (logical address
   space region) and is iterated by __btrfs_balance().

2. The in-memory block group cache (fs_info->block_group_cache_tree),
   which is built at mount time by btrfs_read_block_groups() and holds
   a struct btrfs_block_group for each chunk. This cache is what the
   usage range filter queries.

On a well-formed filesystem, these two are kept in 1:1 correspondence.
However, btrfs_read_block_groups() builds the cache from block group
items in the extent tree, not directly from the chunk tree. A corrupted
image can therefore contain a chunk item in the chunk tree whose
corresponding block group item is absent from the extent tree; that
chunk's block group is then never inserted into the in-memory cache.

When balance iterates the chunk tree and reaches such an orphaned chunk,
should_balance_chunk() calls chunk_usage_range_filter(), which queries
the block group cache:

  cache = btrfs_lookup_block_group(fs_info, chunk_offset);
  chunk_used = cache->used;   /* cache may be NULL */

btrfs_lookup_block_group() returns NULL silently when no cached entry
covers chunk_offset. chunk_usage_range_filter() does not check the return
value, so the immediately following dereference of cache->used triggers
the crash.

[FIX]
Add a NULL check after btrfs_lookup_block_group() in
chunk_usage_range_filter(). When the lookup fails, emit a btrfs_err()
message identifying the affected bytenr and return -EUCLEAN to indicate
filesystem corruption.

Since chunk_usage_range_filter() now has an error path, change its
return type from bool to error pointer, return 0 if the chunk matches
the usage range, and 1 if it should be filtered out.

Signed-off-by: ZhengYuan Huang <gality369@gmail.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
 2026-06-08 15:53:30 +02:00
ZhengYuan Huang
6dde5221f6 btrfs: balance: fix potential bg lookup failure in chunk_usage_filter() 
[BUG]
Running btrfs balance with a usage filter (-dusage=N) can trigger a
null-ptr-deref when metadata corruption causes a chunk to have no
corresponding block group in the in-memory cache:

  KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077]
  RIP: 0010:chunk_usage_filter fs/btrfs/volumes.c:3874 [inline]
  RIP: 0010:should_balance_chunk fs/btrfs/volumes.c:4018 [inline]
  RIP: 0010:__btrfs_balance fs/btrfs/volumes.c:4172 [inline]
  RIP: 0010:btrfs_balance+0x2024/0x42b0 fs/btrfs/volumes.c:4604
  ...
  Call Trace:
    btrfs_ioctl_balance fs/btrfs/ioctl.c:3577 [inline]
    btrfs_ioctl+0x25cf/0x5b90 fs/btrfs/ioctl.c:5313
    vfs_ioctl fs/ioctl.c:51 [inline]
    ...

The bug is reproducible on current development branch.

[CAUSE]
Two separate data structures are involved:

1. The on-disk chunk tree, which records every chunk (logical address
   space region) and is iterated by __btrfs_balance().

2. The in-memory block group cache (fs_info->block_group_cache_tree),
   which is built at mount time by btrfs_read_block_groups() and holds
   a struct btrfs_block_group for each chunk. This cache is what the
   usage filter queries.

On a well-formed filesystem, these two are kept in 1:1 correspondence.
However, btrfs_read_block_groups() builds the cache from block group
items in the extent tree, not directly from the chunk tree. A corrupted
image can therefore contain a chunk item in the chunk tree whose
corresponding block group item is absent from the extent tree; that
chunk's block group is then never inserted into the in-memory cache.

When balance iterates the chunk tree and reaches such an orphaned chunk,
should_balance_chunk() calls chunk_usage_filter(), which queries the block
group cache:

  cache = btrfs_lookup_block_group(fs_info, chunk_offset);
  chunk_used = cache->used;   /* cache may be NULL */

btrfs_lookup_block_group() returns NULL silently when no cached entry
covers chunk_offset. chunk_usage_filter() does not check the return value,
so the immediately following dereference of cache->used triggers the crash.

[FIX]
Add a NULL check after btrfs_lookup_block_group() in chunk_usage_filter().
When the lookup fails, emit a btrfs_err() message identifying the
affected bytenr and return -EUCLEAN to indicate filesystem corruption.

Since chunk_usage_filter() now has an error path, change its return type
from bool to error pointer and 0 if the chunk passes the usage filter,
and 1 if it should be skipped.

Update should_balance_chunk() accordingly to propagate negative errors
from the usage filter.

Signed-off-by: ZhengYuan Huang <gality369@gmail.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
 2026-06-08 15:53:30 +02:00
Mark Harmstone
c6153ed23e btrfs: add ioctl GET_CSUMS to read raw checksums from file range 
Add a new unprivileged BTRFS_IOC_GET_CSUMS ioctl, which can be used to
query the on-disk csums for a file range.

The ioctl is deliberately per-file rather than exposing raw csum tree
lookups, to avoid leaking information to users about files they may not
have access to.

This is done by userspace passing a struct btrfs_ioctl_get_csums_args to
the kernel, which details the offset and length we're interested in, and
a buffer for the kernel to write its results into. The kernel writes a
struct btrfs_ioctl_get_csums_entry into the buffer, followed by the
csums if available. The maximum size of the user buffer is capped to
16MiB.

If the extent is an uncompressed, non-NODATASUM extent, the kernel sets
the entry type to BTRFS_GET_CSUMS_HAS_CSUMS and follows it with the
csums. If it is sparse, preallocated, or beyond the EOF, it sets the
type to BTRFS_GET_CSUMS_ZEROED - this is so userspace knows it can use
the precomputed hash of the zero sector. Otherwise, it sets the type to
BTRFS_GET_CSUMS_NODATASUM, BTRFS_GET_CSUMS_COMPRESSED,
BTRFS_GET_CSUM_ENCRYPTED, or BTRFS_GET_CSUM_INLINE.

For example, a file with a [0, 4K) hole and [4K, 12K) data extent would
produce the following output buffer:

  | [0, 4K) ZEROED | [4K, 12K) HAS_CSUMS | csum data |

We do store the csums of compressed extents, but we deliberately don't
return them here: they're calculated over the compressed data, not the
uncompressed data that's returned to userspace. Similarly for encrypted
data, once encryption is supported, in which the csums will be on the
ciphertext.

The main use case for this is for speeding up mkfs.btrfs --rootdir. For
the case when the source FS is btrfs and using the same csum algorithm,
we can avoid having to recalculate the csums - in my synthetic
benchmarks (16GB file on a spinning-rust drive), this resulted in a ~11%
speed-up (218s to 196s).

When using the --reflink option added in btrfs-progs v6.16.1, we can forgo
reading the data entirely, resulting a ~2200% speed-up on the same test
(128s to 6s).

    # mkdir rootdir
    # dd if=/dev/urandom of=rootdir/file bs=4096 count=4194304

    (without ioctl)
    # echo 3 > /proc/sys/vm/drop_caches
    # time mkfs.btrfs --rootdir rootdir testimg
    ...
    real    3m37.965s
    user    0m5.496s
    sys     0m6.125s

    # echo 3 > /proc/sys/vm/drop_caches
    # time mkfs.btrfs --rootdir rootdir --reflink testimg
    ...
    real    2m8.342s
    user    0m5.472s
    sys     0m1.667s

    (with ioctl)
    # echo 3 > /proc/sys/vm/drop_caches
    # time mkfs.btrfs --rootdir rootdir testimg
    ...
    real    3m15.865s
    user    0m4.258s
    sys     0m6.261s

    # echo 3 > /proc/sys/vm/drop_caches
    # time mkfs.btrfs --rootdir rootdir --reflink testimg
    ...
    real    0m5.847s
    user    0m2.899s
    sys     0m0.097s

Another notable use case is for deduplication, where reading the
checksums may serve as a hint instead of reading the whole file data.

Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Mark Harmstone <mark@harmstone.com>
Signed-off-by: David Sterba <dsterba@suse.com>
 2026-06-08 15:53:29 +02:00
Qu Wenruo
95ee223189 btrfs: check and set EXTENT_DELALLOC_NEW before clearing EXTENT_DELALLOC 
[WARNING]
When running test cases with injected errors or shutdown, e.g.
generic/388 or generic/475, there is a chance that the following kernel
warning is triggered:

  BTRFS info (device dm-2): first mount of filesystem d8a19a28-3232-4809-b0df-38df83e71bff
  BTRFS info (device dm-2): using crc32c checksum algorithm
  BTRFS info (device dm-2): checking UUID tree
  BTRFS info (device dm-2): turning on async discard
  BTRFS info (device dm-2): enabling free space tree
  BTRFS critical (device dm-2 state E): emergency shutdown
  ------------[ cut here ]------------
  WARNING: extent_io.c:1742 at extent_writepage_io+0x437/0x520 [btrfs], CPU#2: kworker/u43:2/651591
  CPU: 2 UID: 0 PID: 651591 Comm: kworker/u43:2 Tainted: G        W  OE       7.0.0-rc6-custom+ #365 PREEMPT(full)  5804053f02137e627472d94b5128cc9fcb110e88
  RIP: 0010:extent_writepage_io+0x437/0x520 [btrfs]
  Call Trace:
   <TASK>
   extent_write_cache_pages+0x2a5/0x820 [btrfs 70299925d0856939e93b17d480651713b3cbba58]
   btrfs_writepages+0x74/0x130 [btrfs 70299925d0856939e93b17d480651713b3cbba58]
   do_writepages+0xd0/0x160
   __writeback_single_inode+0x42/0x340
   writeback_sb_inodes+0x22d/0x580
   wb_writeback+0xc6/0x360
   wb_workfn+0xbd/0x470
   process_one_work+0x198/0x3b0
   worker_thread+0x1c8/0x330
   kthread+0xee/0x120
   ret_from_fork+0x2a6/0x330
   ret_from_fork_asm+0x11/0x20
   </TASK>
  ---[ end trace 0000000000000000 ]---
  BTRFS error (device dm-2 state E): root 5 ino 259 folio 1323008 is marked dirty without notifying the fs
  BTRFS error (device dm-2 state E): failed to submit blocks, root=5 inode=259 folio=1323008 submit_bitmap=0: -117
  BTRFS info (device dm-2 state E): last unmount of filesystem d8a19a28-3232-4809-b0df-38df83e71bff

[CAUSE]
Inside btrfs we have the following pattern in several locations, for
example inside btrfs_dirty_folio():

	btrfs_clear_extent_bit(&inode->io_tree, start_pos, end_of_last_block,
			       EXTENT_DELALLOC | EXTENT_DO_ACCOUNTING | EXTENT_DEFRAG,
			       cached);

	ret = btrfs_set_extent_delalloc(inode, start_pos, end_of_last_block,
					extra_bits, cached);
	if (ret)
		return ret;

However btrfs_set_extent_delalloc() can return IO errors other than -ENOMEM
through the following callchain:

 btrfs_set_extent_delalloc()
 \- btrfs_find_new_delalloc_bytes()
    \- btrfs_get_extent()
       \- btrfs_lookup_file_extent()
          \- btrfs_search_slot()

When such IO error happened, the previous btrfs_clear_extent_bit() has
cleared the EXTENT_DELALLOC for the range, and we're expecting
btrfs_set_extent_delalloc() to re-set EXTENT_DELALLOC.

But since btrfs_set_extent_delalloc() failed before
btrfs_set_extent_bit(), EXTENT_DELALLOC flag is no longer present.

And if the folio range is dirty before entering
btrfs_set_extent_delalloc(), we got a dirty folio but no EXTENT_DELALLOC
flag now.

Then we hit the folio writeback:

  extent_writepage()
  |- writepage_delalloc()
  |  No ordered extent is created, as there is no EXTENT_DELALLOC set
  |  for the folio range.
  |  This also means the folio has no ordered flag set.
  |
  |- extent_writepage_io()
     \- if (unlikely(!folio_test_ordered(folio))
        Now we hit the warning.

[FIX]
Introduce a new helper, btrfs_reset_extent_delalloc() to replace the
currently open-coded btrfs_clear_extent_bit() +
btrfs_set_extent_delalloc() combination.

Instead of calling btrfs_clear_extent_bit() first, update
EXTENT_DELALLOC_NEW first, as that part can fail due to metadata IO,
meanwhile btrfs_clear_extent_bit() and btrfs_set_extent_bit() won't
return any error but retry memory allocation until succeeded.

This allows us to fail early without clearing EXTENT_DELALLOC bit, so
even if that new btrfs_reset_extent_delalloc() failed before touching
EXTENT_DELALLOC, the existing dirty range will still have their old
EXTENT_DELALLOC flag present, thus avoid the warning.

CC: stable@vger.kernel.org # 6.1+
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
 2026-06-08 15:53:29 +02:00
Filipe Manana
4b01341133 btrfs: remove unnecessary ctl argument from write_cache_extent_entries() 
There is no need to pass the free space control structure as an argument
because we can grab it from the given block group.

Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
 2026-06-08 15:53:29 +02:00
Filipe Manana
5580c972e5 btrfs: remove unnecessary ctl argument from __btrfs_write_out_cache() 
We can get the free space control structure from the given block group,
so there is no need to pass it as an argument.

Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
 2026-06-08 15:53:29 +02:00
Filipe Manana
81b86e6afe btrfs: remove block group argument from copy_free_space_cache() 
It's not necessary since we can get the block group from the given
free space control structure.

Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
 2026-06-08 15:53:29 +02:00
Filipe Manana
2a1ed20f0d btrfs: remove op field from struct btrfs_free_space_ctl 
The op field always points to the same use_bitmap function, the only
exception is during self tests where we make it temporarily point to a
different function. So just because of this op pointer field we are
increasing the structure size by 8 bytes.

Instead of storing a pointer to a use_bitmap function in struct
btrfs_free_space_ctl, move the pointer to struct btrfs_info, make
insert_into_bitmap() use that pointer if we are running the self tests
and initialize that pointer to the current, default use_bitmap function
(now exported for the tests as btrfs_use_bitmap). This way we reduce
the size of struct btrfs_free_space_ctl from 136 to 128 bytes and can
now fit 32 structures in a 4K page instead of 30. This also avoids the
cost of the indirection of a function pointer call when we are not
running the self tests.

Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
 2026-06-08 15:53:29 +02:00
Filipe Manana
08d9e2162c btrfs: reduce size of struct btrfs_free_space_ctl 
We have a 4 bytes hole in the structure, reorder some fields so that we
eliminate the hole and reduce the structure size from 144 bytes down to
136 bytes. This way on a 4K page system, we can fit 30 structures per
page instead of 28.

Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
 2026-06-08 15:53:29 +02:00
Filipe Manana
acef2bf43a btrfs: remove unit field from struct btrfs_free_space_ctl 
The unit field always has a value matching the sector size, and since we
have a block group pointer in the structure, we can access the block group
and then its fs_info field to get to the sector size. So remove the field,
which will allow us later to shrink the structure size.

Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
 2026-06-08 15:53:29 +02:00
Filipe Manana
5e4b57f77c btrfs: remove start field from struct btrfs_free_space_ctl 
There's no need for the start field, we can take it from the block group.
This reduces the structure size from 152 bytes down to 144 bytes, so on
a 4K page system we can now fit 28 structures instead of 26.

Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
 2026-06-08 15:53:29 +02:00
Filipe Manana
66fd877b13 btrfs: use a kmem_cache for free space control structures 
We are currently allocating the free space control structures for block
groups using the generic slabs, and given that the size of the
btrfs_free_space_ctl structure is 152 bytes (on a release kernel), we end
up using the kmalloc-192 slab and therefore waste quite some memory since
on a 4K page system we can only fit 21 free space control structures per
page. These structures are allocated and delallocated every time we create
and remove block groups.

So use a kmem_cache for free space control structures, this way on a 4K
page system we can fit 26 structures instead of 21.

Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
 2026-06-08 15:53:29 +02:00
Filipe Manana
a8d1f0b539 btrfs: reduce size of struct btrfs_block_group 
We currently have several holes in the structure:

  struct btrfs_block_group {
        struct btrfs_fs_info *     fs_info;              /*     0     8 */
        struct btrfs_inode *       inode;                /*     8     8 */
        spinlock_t                 lock __attribute__((__aligned__(4))); /*    16     4 */

        /* XXX 4 bytes hole, try to pack */

        u64                        start;                /*    24     8 */
        u64                        length;               /*    32     8 */
        u64                        pinned;               /*    40     8 */
        u64                        reserved;             /*    48     8 */
        u64                        used;                 /*    56     8 */
        /* --- cacheline 1 boundary (64 bytes) --- */
        u64                        delalloc_bytes;       /*    64     8 */
        u64                        bytes_super;          /*    72     8 */
        u64                        flags;                /*    80     8 */
        u64                        cache_generation;     /*    88     8 */
        u64                        global_root_id;       /*    96     8 */
        u64                        remap_bytes;          /*   104     8 */
        u32                        identity_remap_count; /*   112     4 */

        /* XXX 4 bytes hole, try to pack */

        u64                        last_used;            /*   120     8 */
        /* --- cacheline 2 boundary (128 bytes) --- */
        u64                        last_remap_bytes;     /*   128     8 */
        u32                        last_identity_remap_count; /*   136     4 */

        /* XXX 4 bytes hole, try to pack */

        u64                        last_flags;           /*   144     8 */
        u32                        bitmap_high_thresh;   /*   152     4 */
        u32                        bitmap_low_thresh;    /*   156     4 */
        struct rw_semaphore        data_rwsem __attribute__((__aligned__(8))); /*   160    40 */
        /* --- cacheline 3 boundary (192 bytes) was 8 bytes ago --- */
        long unsigned int          full_stripe_len;      /*   200     8 */
        long unsigned int          runtime_flags;        /*   208     8 */
        unsigned int               ro;                   /*   216     4 */
        int                        disk_cache_state;     /*   220     4 */
        int                        cached;               /*   224     4 */

        /* XXX 4 bytes hole, try to pack */

       struct btrfs_caching_control * caching_ctl;      /*   232     8 */
        struct btrfs_space_info *  space_info;           /*   240     8 */
        struct btrfs_free_space_ctl * free_space_ctl;    /*   248     8 */
        /* --- cacheline 4 boundary (256 bytes) --- */
        struct rb_node             cache_node __attribute__((__aligned__(8))); /*   256    24 */
        struct list_head           list;                 /*   280    16 */
        refcount_t                 refs __attribute__((__aligned__(4))); /*   296     4 */

        /* XXX 4 bytes hole, try to pack */

        struct list_head           cluster_list;         /*   304    16 */
        /* --- cacheline 5 boundary (320 bytes) --- */
        struct list_head           bg_list;              /*   320    16 */
        struct list_head           ro_list;              /*   336    16 */
        atomic_t                   frozen __attribute__((__aligned__(4))); /*   352     4 */

        /* XXX 4 bytes hole, try to pack */

        struct list_head           discard_list;         /*   360    16 */
        int                        discard_index;        /*   376     4 */

        /* XXX 4 bytes hole, try to pack */

        /* --- cacheline 6 boundary (384 bytes) --- */
        u64                        discard_eligible_time; /*   384     8 */
        u64                        discard_cursor;       /*   392     8 */
        enum btrfs_discard_state   discard_state;        /*   400     4 */

        /* XXX 4 bytes hole, try to pack */

        struct list_head           dirty_list;           /*   408    16 */
        struct list_head           io_list;              /*   424    16 */
        struct btrfs_io_ctl        io_ctl;               /*   440    72 */
        /* --- cacheline 8 boundary (512 bytes) --- */
        atomic_t                   reservations __attribute__((__aligned__(4))); /*   512     4 */
        atomic_t                   nocow_writers __attribute__((__aligned__(4))); /*   516     4 */
        struct mutex               free_space_lock __attribute__((__aligned__(8))); /*   520    32 */
        bool                       using_free_space_bitmaps; /*   552     1 */
        bool                       using_free_space_bitmaps_cached; /*   553     1 */

       /* XXX 2 bytes hole, try to pack */

        int                        swap_extents;         /*   556     4 */
        u64                        alloc_offset;         /*   560     8 */
        u64                        zone_unusable;        /*   568     8 */
        /* --- cacheline 9 boundary (576 bytes) --- */
        u64                        zone_capacity;        /*   576     8 */
        u64                        meta_write_pointer;   /*   584     8 */
        struct btrfs_chunk_map *   physical_map;         /*   592     8 */
        struct list_head           active_bg_list;       /*   600    16 */
        struct work_struct         zone_finish_work;     /*   616    32 */
        /* --- cacheline 10 boundary (640 bytes) was 8 bytes ago --- */
        struct extent_buffer *     last_eb;              /*   648     8 */
        enum btrfs_block_group_size_class size_class;    /*   656     4 */

        /* XXX 4 bytes hole, try to pack */

        u64                        reclaim_mark;         /*   664     8 */

        /* size: 672, cachelines: 11, members: 61 */
        /* sum members: 634, holes: 10, sum holes: 38 */
        /* forced alignments: 8 */
        /* last cacheline: 32 bytes */
  } __attribute__((__aligned__(8)));

Reorder some fields to eliminate the holes while keeping closely related
or frequently accessed fields together. After the reordering the size of
the structure is reduced down to 632 bytes and the number of cache lines
decreases from 11 to 10. We can still only pack 6 block groups per 4K page
but on a 64K page system we will now be able to pack 103 block groups
instead of 97. The new structure layout, on a release kernel, is the
following:

  struct btrfs_block_group {
        struct btrfs_fs_info *     fs_info;              /*     0     8 */
        struct btrfs_inode *       inode;                /*     8     8 */
        spinlock_t                 lock __attribute__((__aligned__(4))); /*    16     4 */
        unsigned int               ro;                   /*    20     4 */
        u64                        start;                /*    24     8 */
        u64                        length;               /*    32     8 */
        u64                        pinned;               /*    40     8 */
        u64                        reserved;             /*    48     8 */
        u64                        used;                 /*    56     8 */
        /* --- cacheline 1 boundary (64 bytes) --- */
        u64                        delalloc_bytes;       /*    64     8 */
        u64                        bytes_super;          /*    72     8 */
        u64                        flags;                /*    80     8 */
        u64                        cache_generation;     /*    88     8 */
        u64                        global_root_id;       /*    96     8 */
        u64                        remap_bytes;          /*   104     8 */
        u32                        identity_remap_count; /*   112     4 */
        u32                        last_identity_remap_count; /*   116     4 */
        u64                        last_used;            /*   120     8 */
        /* --- cacheline 2 boundary (128 bytes) --- */
        u64                        last_remap_bytes;     /*   128     8 */
        u64                        last_flags;           /*   136     8 */
        u32                        bitmap_high_thresh;   /*   144     4 */
        u32                        bitmap_low_thresh;    /*   148     4 */
        struct rw_semaphore        data_rwsem __attribute__((__aligned__(8))); /*   152    40 */
        /* --- cacheline 3 boundary (192 bytes) --- */
        long unsigned int          full_stripe_len;      /*   192     8 */
        long unsigned int          runtime_flags;        /*   200     8 */
        int                        disk_cache_state;     /*   208     4 */
        int                        cached;               /*   212     4 */
        struct btrfs_caching_control * caching_ctl;      /*   216     8 */
        struct btrfs_space_info *  space_info;           /*   224     8 */
        struct btrfs_free_space_ctl * free_space_ctl;    /*   232     8 */
        struct rb_node             cache_node __attribute__((__aligned__(8))); /*   240    24 */
        /* --- cacheline 4 boundary (256 bytes) was 8 bytes ago --- */
        struct list_head           list;                 /*   264    16 */
        refcount_t                 refs __attribute__((__aligned__(4))); /*   280     4 */
        atomic_t                   frozen __attribute__((__aligned__(4))); /*   284     4 */
        struct list_head           cluster_list;         /*   288    16 */
        struct list_head           bg_list;              /*   304    16 */
        /* --- cacheline 5 boundary (320 bytes) --- */
        struct list_head           ro_list;              /*   320    16 */
        struct list_head           discard_list;         /*   336    16 */
        int                        discard_index;        /*   352     4 */
        enum btrfs_discard_state   discard_state;        /*   356     4 */
        u64                        discard_eligible_time; /*   360     8 */
        u64                        discard_cursor;       /*   368     8 */
        struct list_head           dirty_list;           /*   376    16 */
        /* --- cacheline 6 boundary (384 bytes) was 8 bytes ago --- */
        struct list_head           io_list;              /*   392    16 */
        struct btrfs_io_ctl        io_ctl;               /*   408    72 */
        /* --- cacheline 7 boundary (448 bytes) was 32 bytes ago --- */
        atomic_t                   reservations __attribute__((__aligned__(4))); /*   480     4 */
        atomic_t                   nocow_writers __attribute__((__aligned__(4))); /*   484     4 */
        struct mutex               free_space_lock __attribute__((__aligned__(8))); /*   488    32 */
        /* --- cacheline 8 boundary (512 bytes) was 8 bytes ago --- */
        bool                       using_free_space_bitmaps; /*   520     1 */
        bool                       using_free_space_bitmaps_cached; /*   521     1 */

        /* XXX 2 bytes hole, try to pack */
        /* Bitfield combined with previous fields */

        static enum btrfs_block_group_size_class size_class; /*     0: 0  0 */
        int                        swap_extents;         /*   524     4 */
        u64                        alloc_offset;         /*   528     8 */
        u64                        zone_unusable;        /*   536     8 */
        u64                        zone_capacity;        /*   544     8 */
        u64                        meta_write_pointer;   /*   552     8 */
        struct btrfs_chunk_map *   physical_map;         /*   560     8 */
        struct list_head           active_bg_list;       /*   568    16 */
        /* --- cacheline 9 boundary (576 bytes) was 8 bytes ago --- */
        struct work_struct         zone_finish_work;     /*   584    32 */
        struct extent_buffer *     last_eb;              /*   616     8 */
        u64                        reclaim_mark;         /*   624     8 */

        /* size: 632, cachelines: 10, members: 60, static members: 1 */
        /* sum members: 630, holes: 1, sum holes: 2 */
        /* sum bitfield members: 8 bits (1 bytes) */
        /* forced alignments: 8 */
        /* last cacheline: 56 bytes */
  } __attribute__((__aligned__(8)));

Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
 2026-06-08 15:53:28 +02:00
Filipe Manana
d293344c22 btrfs: use a kmem_cache for block groups 
We are currently allocating block groups using the generic slabs, and
given that the size of btrfs_block_group structure is 672 bytes (on a
release kernel), we end up using the kmalloc-1024 slab and therefore
waste quite some memory since on a 4K page system we can only fit 4
block groups per page. The block groups are also allocated and
delallocated with some frequency, specially if we have auto reclaim
enabled.

So use a kmem_cache for block groups, this way on a 4K page system we
can fit 6 block groups per page instead of 4.

Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
 2026-06-08 15:53:28 +02:00
David Sterba
3fc0803f1c btrfs: make more ASSERTs verbose, part 3 
We have support for optional string to be printed in ASSERT() (added in
19468a623a ("btrfs: enhance ASSERT() to take optional format
string")), it's not yet everywhere it could be so add a few more files.

Try to finish what was left after 1c094e6cce ("btrfs: make a few
more ASSERTs verbose").

Signed-off-by: David Sterba <dsterba@suse.com>
 2026-06-08 15:53:28 +02:00
David Sterba
b1db292ee3 btrfs: convert ioctl handlers to AUTO_KFREE 
Many ioctl handlers are suitable for the AUTO_KFREE conversions as the
data are temporary and short lived. The conversions are trivial or the
collateral changes are straightforward.

A kfree() preceding mnt_drop_write_file() is slightly more efficient but
in the reverse order (i.e. the automatic kfree) does not cause any
significant change as the write drop does only a few simple operations.

Note: __free() handles also error pointers, so this is safe for the
memdup_user() errors too.

Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
 2026-06-08 15:53:28 +02:00
David Sterba
37f1f51fba btrfs: convert kmalloc_array to kmalloc_objs in btrfs_calc_avail_data_space() 
There's one use of kmalloc_array() that can be transformed to
kmalloc_objs() in the same way as suggested in commit 69050f8d6d
("treewide: Replace kmalloc with kmalloc_obj for non-scalar types"),
swap the arguments and drop GFP flags. All the other cases of
kmalloc_array() do not use a simple type so this is the only one.

Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: David Sterba <dsterba@suse.com>
 2026-06-08 15:53:28 +02:00
David Sterba
9f4ab0787e btrfs: do more kmalloc_obj()/kmalloc_objs() conversions 
Do a few more (trivial) conversions that started in commit 69050f8d6d
("treewide: Replace kmalloc with kmalloc_obj for non-scalar types").

Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: David Sterba <dsterba@suse.com>
 2026-06-08 15:53:28 +02:00
David Sterba
54ce0b1d59 btrfs: lift assertions to beginning of insert_delayed_ref() 
There are only two possible types of the delayed ref action, this can be
verified at the beginning for the whole function and not just one block.
Replace the assertion with a debugging warning just in case.

Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: David Sterba <dsterba@suse.com>
 2026-06-08 15:53:28 +02:00
David Sterba
1a69592502 btrfs: replace open coded DEBUG_WARN in extent_writepage() 
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: David Sterba <dsterba@suse.com>
 2026-06-08 15:53:28 +02:00
David Sterba
cf384a2ab8 btrfs: move condition to WARN_ON in btrfs_set_delalloc_extent() 
For a simple if + WARN_ON we should use the condition directly in the
macro.

Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: David Sterba <dsterba@suse.com>
 2026-06-08 15:53:28 +02:00
Qu Wenruo
115421e29b btrfs: remove folio checked subpage bitmap tracking 
The folio checked flag is only utilized by the COW fixup mechanism
inside btrfs.

Since the COW fixup is already removed from non-experimental builds,
there is no need to keep the checked subpage bitmap.

This will saves us some space for large folios, for example for a single
256K sized large folio on 4K page sized systems:

 Old bitmap size = 6 * (256K / 4K / 8) = 48 bytes
 New bitmap size = 5 * (256K / 4K / 8) = 40 bytes

This will be more obvious when we're going to support huge folios (order
= 9).

Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
 2026-06-08 15:53:28 +02:00
Qu Wenruo
b2a9f217ad btrfs: remove the COW fixup mechanism 
[BACKGROUND]
Btrfs has a special mechanism called COW fixup, which detects dirty
pages without an ordered extent (folio ordered flag).

Normally a dirty folio must go through delayed allocation (delalloc)
before it can be submitted, and delalloc will create an ordered extent
for it and mark the range with ordered flag.

However in older kernels, there are bugs related to get_user_pages()
which can lead to some page marked dirty but without notifying the fs to
properly prepare them for writeback.

In that case without an ordered extent btrfs is unable to properly
submit such dirty folios, thus the COW fixup mechanism is introduced,
which do the extra space reservation so that they can be written back
properly.

[MODERN SOLUTIONS]
The MM layer has solved it properly now with the introduction of
pin_user_pages*(), so we're handling cases that are no longer valid.

So commit 7ca3e84980 ("btrfs: reject out-of-band dirty folios during
writeback") is introduced to change the behavior from going through
COW fixup to rejecting them directly for experimental builds.

So far it works fine, but when errors are injected into the IO path, we
have random failures triggering the new warnings.

It looks like we have error path that cleared the ordered flag but
leaves the folio dirty flag, which later triggers the warning.

[REMOVAL OF COW FIXUP]
Although I hope to fix all those known warnings cases, I just can not
figure out the root cause yet.

But on the other hand, if we remove the ordered and checked flags in the
future, and purely rely on the dirty flags and ordered extent search, we
can get a much cleaner handling.

Considering it's no longer hitting the COW fixup for normal IO paths, I
think it's finally the time to remove the COW fixup completely.

Furthermore, the function name "btrfs_writepage_cow_fixup()" is no
longer meaningful, and since it's pretty small, only a folio flag check
with error message, there is no need to put it as a dedicated helper,
just open code it inside extent_writepage_io().

Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
 2026-06-08 15:53:27 +02:00
Qu Wenruo
79a15639bf btrfs: pass a valid btrfs_tree_parent_check when possible 
Commit 6e181cfe2409 ("btrfs: revalidate cached tree blocks on the
uptodate path") introduced the @check parameter for
btrfs_buffer_uptodate() to allow re-validation of a cached extent
buffer.

But there are still call sites that don't utilize this parameter, which
exposes them to possible corrupted tree blocks, e.g. an empty child leaf
of a parent node, which should be rejected by btrfs_verify_level_key()
but if @check is NULL such check will be skipped and cause problems.

Thankfully for a lot of cases there is already an existing @check
structure around and we can pass it directly to btrfs_buffer_uptodate().

Reviewed-by: Boris Burkov <boris@bur.io>
Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
 2026-06-08 15:53:27 +02:00
Linus Torvalds
4549871118 Linux 7.1-rc7 v7.1-rc7 2026-06-07 15:37:58 -07:00
Linus Torvalds
c68691dc1d Miscellaneous x86 fixes: 
- Add more AMD Zen6 models (Pratik Vishwakarma)
 
  - Avoid confusing bootup message by the Intel resctl enumeration
    code when running on certain AMD systems (Tony Luck)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmok/S0RHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1iOHw//Q2lG+XKJAG5wPgvkyp7EcQDgerj22LQS
 ybapgg4u0scz4+24yt1vbzSRdvp+wTowSpviw7IH3rbemhWTkB7WZisjaKwPiPzo
 gSYC3EtdcJvhaC2jqyhx1JSeR8I+d2U+tzE3OeOOxTvgOK4m3cvZhCsQIttPaO7I
 DPW3ctqDYQc8/T4UQWMEyOhsKEGSplxrk8AdvzSG2QP+OOZ0gDBMh2s5ywREjSMq
 OFf/tW6QdZm0CuxIYMV1PsdsYFZPI+v8MEtfGyjNw+NmkUEO/VYqQ80J0UC0rbbt
 6MUT32vyLkDz0JN+IWW9YQn4OccuFfI+IZStmuZJr9jOFICpMogmIW77oobwN9ai
 QeEXEvqvazmVlqMukzaDSlr42yV5nknr6bF+mlTbGIMUkCV2w40OkciyeI30LzNm
 cCs/KsJeGb384ArsqH7+5coTHILvacAN9LWjf5E96APCp/2mzXwWT1bMvr7VM7Q/
 65C1scpoQ5KgIewf+nijWOn+5FEN6cKVPgW1y06GpI55KDUUGIMgSyb+V5pwwVNa
 fRa3qPbASopfyCni/mxPnNqSDVodFks9pDqSrg0WvmQLDdlaAzfwPf5l4F47YNGr
 CmnZ7GJb00SZC/M9Pkecy0zXBZv+dfiwjiVnXBDjqYwIC1wOnlj4JTeVuaC7cFuu
 688Dr2YMEEk=
 =PMk2
 -----END PGP SIGNATURE-----

Merge tag 'x86-urgent-2026-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86 fixes from Ingo Molnar:

 - Add more AMD Zen6 models (Pratik Vishwakarma)

 - Avoid confusing bootup message by the Intel resctl enumeration
   code when running on certain AMD systems (Tony Luck)

* tag 'x86-urgent-2026-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/resctrl: Only check Intel systems for SNC
  x86/CPU/AMD: Add more Zen6 models
 2026-06-07 13:12:29 -07:00
Linus Torvalds
09feffa073 Miscellaneous timer fixes: 
- Fix the arch_inlined_clockevent_set_next_coupled() prototype
    in the !CONFIG_GENERIC_CLOCKEVENTS_MIN_ADJUST case
    (Naveen Kumar Chaudhary)
 
  - Fix an off-by-1 bug in the sys_settimeofday() usecs validation
    code (Naveen Kumar Chaudhary)
 
  - Mark vdso_k_*_data pointers as __ro_after_init
    (Thomas Weißschuh)
 
  - Fix livelock race in tmigr_handle_remote_up()
    (Amit Matityahu)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmok/CQRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1hpFw//US/OxvhU9WBdRsaULcezejwAkq+bUMHe
 hrmGtdHSztO+6SsSMaRei9IaJz3YsZCNOYX2bMO3TwMBTtFBAmq5NVGWT6tYcnam
 uHpH7qkt8n2HAsRHprBKzyM4Vo9ecYqVKXwd/lLyZyhs04q6iqmu8A99tIHb4e4C
 tsNFxWJfhT+bjR/gwvU7uGSkQ1FUqlVNeRtN939/sPlXsRLKBOCHXTSnZ4JOTfL0
 +QLae7LemYDxMT9M4fej3fJjoDGNQM0gb7K7FkOjwOHB8tHw2NJ9lRnD5MMh/oFx
 Mq2BDfEQMum+LHjS3A/QhiymQQzbghnb6CVf4ae/hcBEdC7athoxJ1AzRDoqsD/N
 EfFMaFVEaD3IZkNvU1u4BYDjQpNnnoK/TnYxa5fDoSD/VjVTknlr7gbfkUsJpwR5
 cZ4EPk/zmilOJ8xWYlCJi9NHGMc+zsWT3FNdsOXiBt/GGOcu3lTQr8sjHBjm5cFi
 coCbokGi6TRj9PA//oEds2JWTYIqXMADte7bleC0qmTfWPsJSHKECn+uOnUOyvg+
 rlI8pRIo8uWo20MPjpwF+P4Dc5XGiR3TpvJ8iuXJvQNObItAjfBnJxbgo5fAM13d
 VxfzZV2F++6ua/hsd8luAuMcdrFILTaiOEuXT9uyOPoMoBtORE+0CEQKTOgU0Z4e
 rvoO+R992e8=
 =Sp9X
 -----END PGP SIGNATURE-----

Merge tag 'timers-urgent-2026-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull timer fixes from Ingo Molnar:

 - Fix the arch_inlined_clockevent_set_next_coupled() prototype in the
   !CONFIG_GENERIC_CLOCKEVENTS_MIN_ADJUST case (Naveen Kumar Chaudhary)

 - Fix an off-by-1 bug in the sys_settimeofday() usecs validation code
   (Naveen Kumar Chaudhary)

 - Mark vdso_k_*_data pointers as __ro_after_init (Thomas Weißschuh)

 - Fix livelock race in tmigr_handle_remote_up() (Amit Matityahu)

* tag 'timers-urgent-2026-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  timers/migration: Fix livelock in tmigr_handle_remote_up()
  vdso/datastore: Mark vdso_k_*_data pointers as __ro_after_init
  time: Fix off-by-one in settimeofday() usec validation
  clockevents: Fix duplicate type specifier in stub function parameter
 2026-06-07 13:02:02 -07:00
Linus Torvalds
77e8e6861b - Fix uninitialized stack variable in rseq_exit_user_update() 
(Qing Wang)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmok+EARHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1jeMQ/9FaW8MLhxkd3r8ZULiAiYkF8j0/NZOSe1
 EK+oBQm7SiBySiEngvrytAH3fZt3+lRpkxrP38n8BeFviaAbgSGvorVjg2Ac/LAb
 M42YLmtjNgOkPT/hrNtbWdKLBoqM7phBFtN9zLkVjDascNbLc2odBq25FhTKWhET
 7hXXOf+Gv23kD4kWWh9S6VYbenOpIMPgwvcdyXK/bKRLLqplc7ZDoiahn1QpVAYg
 KTGeAAovuryKlxFTq3+FFjP8NXy2Ex8isu2K3tYylHRpHG6SSBTp5yGZV/886GIR
 rz46ojcbfOADCGOsEn2xaymmB7+NScXjYyvrzfnrE41WlenNYNVkEK6h2wvmHtn/
 djUyUOJ+g+W4cyuZcf4lFZuq/0xO80Fll9ykmKvcEi7s0mpxEtngQ+V0kFNSj7XX
 N1lrd5LqIMxME1pkfWSc5m+RHsb33d1PDfpZkIxf107HGKhMWsF42t+c7yvk22HS
 4jhdzUOKFL2ko3eyoFn6NCQvojI3YVmkVjUKrP+GBHSfMZV8g46i+sp9ux6erRG3
 PkodV6tAcfaiLXLB0E3R5b0aes9LfZHGaAD6PtZ51Ujib95tr3Y1gvRpMmsJ1for
 GcJRIdcYE4U9/5vof69bkeNIfVQyCY3rM0rg7ALjOmjXSDBo5Ksi96pcYW2nqGyt
 mBUbd/yK69M=
 =AbXB
 -----END PGP SIGNATURE-----

Merge tag 'sched-urgent-2026-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull rseq fix from Ingo Molnar:

 - Fix uninitialized stack variable in rseq_exit_user_update() (Qing
   Wang)

* tag 'sched-urgent-2026-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  rseq: Fix using an uninitialized stack variable in rseq_exit_user_update()
 2026-06-07 12:54:37 -07:00
Linus Torvalds
96c1ddbc16 Misc locking fixes: 
- Fix a NULL pointer dereference bug in the FUTEX_CMP_REQUEUE_PI
    code (Ji'an Zhou)
 
  - Fix a NULL pointer dereference bug in the rtmutex code
    (Davidlohr Bueso)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmok97sRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1hq8A//YmVZmkJVV/5AFYZTJEHQmTpHYR4oyIKE
 7u0glsuWfgO+m70RQLQK6FHFC8LRUVmn692fbTrXRb3sEmQvZwpvLjy0JfM2HgFm
 Sv/1C0KKGQOE6UVcMIaiJIr+/uNXz6iC1zlln5rbdJOWfQdobNENTC1QDnzUPsWp
 810up6kwkG/fgivaemsL29JH7HM5y7dWg8x9RmRmzRMsAVuX2NNeZWr3UVSB1ThA
 n9DGR7rhZa2MSb0lDgmzEPn1mn3/8wvMDEaore9qAgXqwQ6wIxKc+9YQoi/CcpH3
 Ar7/gsDXpgy1CS5qtwYBajFgwEhqLwtrN90bR4nW7CKFrFxRLZz/G7kS/iV2vjWd
 CtlBYMINTNhXA2omuIaTSykt76Y44iV9tul/+m7XCTDocl2gKU/SYSn6+MoEnW+G
 Nu3m8clJHQc5SavDJJL/LvIceemeiBUvOwRHYS6jrNcnaUbdwqXrRDYJNYVTIpYX
 bdI3moWI25q8nC+rOSXDO9FxY+znJ5ZOEvd/j2W8nl2d7Io+NcJdC6Ec/vKsjIzq
 3dORTAevrrqNi37VVRum2ht4QnFXRverFGrpLmgGHbufsBeFCQ7p4n6ovj2AjIg2
 jpzwGrkDNZKnjFQrUi5vh70bKkrDlijLGvPGvTfu/7Ah7EYFqTLzNszor8B3XIkd
 7eIAsWVGbIk=
 =a6/Z
 -----END PGP SIGNATURE-----

Merge tag 'locking-urgent-2026-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull locking fixes from Ingo Molnar:

 - Fix a NULL pointer dereference bug in the FUTEX_CMP_REQUEUE_PI
   code (Ji'an Zhou)

 - Fix a NULL pointer dereference bug in the rtmutex code (Davidlohr
   Bueso)

* tag 'locking-urgent-2026-06-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
  futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock
 2026-06-07 12:43:21 -07:00
Linus Torvalds
e2264c52e1 regulator: Fix for v7.1 
Arnd's randconfig testing turned up a missing selection of
 CONFIG_IRQ_DOMAIN which was causing build breaks.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmolTPsACgkQJNaLcl1U
 h9Bl/Qf8Dnbw3XoVw2UwJShpXGwPy5QJm0DTDcWOsiiRBge1qLpef+N+7oVf8yxJ
 O+03DLHEfTe27YU49M76TIzpYakLvR0QVMK5Zg01ffQOCXT1CMTOR6KFeEaP1AOE
 Fm2LU50IrQtor4WtuWxVzOu/jBZkli2l+0qeElJwsReWCigBFC6crx+wtSxc9YI4
 U1H/iEcH+Yu2syLHMH0uAa+2OFsgVQEdz2wZn0unkkB9JcqjCB/dtNntrqxsGLX1
 Xq3Xs/KhHMpOS6+zaPHR8qgzf3q2znsnUfW4gitKGHaQwP9o9JxKfNMm47H8eFAm
 8XqW+ktte4lazvfvpwZKSJ04AVy1aA==
 =AwZI
 -----END PGP SIGNATURE-----

Merge tag 'regulator-fix-v7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator

Pull regulator fix from Mark Brown:
 "Arnd's randconfig testing turned up a missing selection of
  CONFIG_IRQ_DOMAIN which was causing build breaks"

* tag 'regulator-fix-v7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
  regulator: mt6363: select CONFIG_IRQ_DOMAIN
 2026-06-07 12:39:36 -07:00
Linus Torvalds
33d8d8ec31 Input updates for v7.1-rc6 
- two quirks for atkbd to deal with laptops that can not handle
   "deactivate" command on the keyboard PS/2 port.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCaiT7xAAKCRBAj56VGEWX
 nIomAQDJ9sUO/BpoilRA48fsZr+BMOBmnAvtm6MlpnWkrJKFwAD8D7SmCEwY+blM
 cmBR5dHgGzb5PD1smow4kGTW7HV20wA=
 =9ZkJ
 -----END PGP SIGNATURE-----

Merge tag 'input-for-v7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

Pull input fixes from Dmitry Torokhov:

 - two quirks for atkbd to deal with laptops that can not handle
   "deactivate" command on the keyboard PS/2 port

* tag 'input-for-v7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard
  Input: atkbd - add DMI quirk for Lenovo Yoga Air 14 (83QK)
 2026-06-07 08:40:53 -07:00
Nathan Chancellor
979c294509 cfi: Include uaccess.h for get_kernel_nofault() 
After commit 0652a3daa7 ("tracing: Fix CFI violation in probestub
being called by tprobes"), there are many build errors when building
ARCH=arm multi_v7_defconfig + CONFIG_CFI=y like:

  In file included from drivers/base/devres.c:17:
  In file included from drivers/base/trace.h:16:
  In file included from include/linux/tracepoint.h:23:
  include/linux/cfi.h:44:6: error: call to undeclared function 'get_kernel_nofault'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
     44 |         if (get_kernel_nofault(hash, func - cfi_get_offset()))
        |             ^
  1 error generated.

get_kernel_nofault() is called in the generic version of
cfi_get_func_hash() but nothing ensures uaccess.h is always included for
a proper expansion and prototype.  Include uaccess.h in cfi.h to clear
up the errors.

Cc: stable@vger.kernel.org
Fixes: 0652a3daa7 ("tracing: Fix CFI violation in probestub being called by tprobes")
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Reviewed-by: Sami Tolvanen <samitolvanen@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 2026-06-06 15:08:36 -07:00
Cryolitia PukNgae
fb402386af Input: atkbd - skip deactivate for HONOR BCC-N's internal keyboard 
After commit 9cf6e24c9f ("Input: atkbd -
do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID"), HONOR
BCC-N, aka HONOR MagicBook 14 2026's internal keyboard stops
working. Adding the atkbd_deactivate_fixup quirk fixes it.

DMI: HONOR BCC-N/BCC-N-PCB, BIOS 1.04 04/07/2026

Fixes: 9cf6e24c9f ("Input: atkbd - do not skip atkbd_deactivate() when skipping ATKBD_CMD_GETID")
Reported-by: Hongfei Ren <lcrhf@outlook.com>
Link: https://github.com/colorcube/Linux-on-Honor-Magicbook-14-Pro/issues/1#issuecomment-4562679891
Tested-by: Hongfei Ren <lcrhf@outlook.com>
Cc: stable@kernel.org
Signed-off-by: Cryolitia PukNgae <cryolitia.pukngae@linux.dev>
Link: https://patch.msgid.link/20260605-honor-v1-1-78e05e491193@linux.dev
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
 2026-06-06 12:57:41 -07:00
Linus Torvalds
6086121dc4 sound fixes for 7.1-rc7 
It's getting calmer, but we cam up with still a handful small fixes,
 including two core fixes.  All look sane and safe.
 
 * Core:
 - Fix wait queue list corruption in snd_pcm_drain() on linked streams
 - Fix UMP event stack overread in seq dummy driver
 
 * USB-audio:
 - Add quirk for AB13X USB Audio
 - Fix the regression with sticky mixer volumes in 7.1-rc
 
 * ASoC:
 - Fix 32-slot TDM breakage on Freescale SAI
 - Varioud DMI quirks for AMD ACP
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmokRfcOHHRpd2FpQHN1
 c2UuZGUACgkQLtJE4w1nLE9uuw/9Fjp6ZQOfGXWzrn4UFiCPE2mzVNbclSIYIIUI
 iPRAM7+66Rj5IjPaY/a+csAjRAAodqYoTtZgA8rFfjpv4T4nEUbSfEFWnV252vzM
 JAHZxq4uuxEqUoy7iXPp4k3k9MzEY7AlOYm2F+3CY9cSwn3hwedD03Uq+2qzupmK
 GrVbYhsJD672rFWM9wmGS4hxarEbXjdtxXJ0i9m10/ydJ8bafURcAO62/74ly/JC
 YpF4EJpM1oYlDXrsDvWz226MTiu1o/NuIWU5cHEHeMejX5HXKpdR54mVcR9T/CO4
 KCw2M2nddn92zInm4yRM05MS2dvlcVxixITTclnRS6bFi0N53wWuX2B1UHYiI+Ko
 aKM9Ph3GCaWP+4LwEXM0qG5AscRmpJ5aDx22SLB0ObdjjA4boYIrkLSQeocyWrP3
 9JucaBD36IEYfwbYN4rK1iEBktzoPzTR57GGqVav0+B4b6D688mlgGjo4WtFowc1
 F7AFrwmVozbKyAkq2gqF/6ufIrEY8RB+bRr41MtaG89gu6EiEyNE7V52Jg0WDr7L
 yw/XtZtN4H2t2TO+0hKTV0sLR1HPC/PoCNb5ayHq/8jpcKJ8uC0KfyxVsgpaC0AZ
 3CmtQ4J3hWAFx0Hrl0YKH33taQyAD9M/iOa8WV068YoaxamrkmC3wpIV6C86wL8C
 FbUW4Uk=
 =HHlm
 -----END PGP SIGNATURE-----

Merge tag 'sound-7.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "It's getting calmer, but we still came up with a handful of small
  fixes, including two core fixes. All look sane and safe.

  Core:
   - Fix wait queue list corruption in snd_pcm_drain() on linked streams
   - Fix UMP event stack overread in seq dummy driver

  USB-audio:
   - Add quirk for AB13X USB Audio
   - Fix the regression with sticky mixer volumes in 7.1-rc

  ASoC:
   - Fix 32-slot TDM breakage on Freescale SAI
   - Varioud DMI quirks for AMD ACP"

* tag 'sound-7.1-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: seq: dummy: fix UMP event stack overread
  ALSA: usb-audio: Add iface reset and delay quirk for AB13X USB Audio
  ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams
  ASoC: amd: acp70: add standalone RT721 SoundWire machine
  ASoC: amd: yc: Add MSI Raider A18 HX A9WJG to quirk table
  ASoC: fsl_sai: Fix 32 slots TDM broken by integer shift UB in xMR write
  ASoC: amd: yc: Enable internal mic on MSI Bravo 17 C7VF
  ASoC: amd: acp: Add DMI quirk for Lenovo Yoga Pro 7 15ASH11
  ALSA: usb-audio: Set the value of potential sticky mixers to maximum
 2026-06-06 09:49:16 -07:00
Linus Torvalds
d054796f8b Rust fixes for v7.1 (2nd) 
Toolchain and infrastructure:
 
  - Fix 'rustc-option' (the Makefile one) when cross-compiling that leads
    to build or boot failures in certain configs.
 
  - Work around a Rust compiler bug (already fixed for Rust 1.98.0) thats
    lead to boot failures in certain configs due to missing 'uwtable'
    LLVM module flags.
 
  - Support a Rust compiler change (starting with Rust 1.98.0) in the
    unstable target specification JSON files.
 
  - Forbid Rust + arm + KASAN configs, which do not build.
 
 'kernel' crate:
 
  - Fix NOMMU build by adding a missing helper.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEPjU5OPd5QIZ9jqqOGXyLc2htIW0FAmokBWQACgkQGXyLc2ht
 IW02uw//a6zLSwQh3c6wevbyfogCtFXA9zfEmS0VIgaFQ7rtBIMPGCIujXrg7mtM
 uc0ZKg27dUyZQfrsKufjkP7ziQbwNaVowuR1/EVeFkF3bWH6BsaJic0/ewFAqbET
 lua0IORlqIjxgCCYW4y93NdzzUAwM1ClENzxWsNBd1HdY0t3ZZqpySie6q2sbjws
 MVr49Ghne5Q+HOeAgL3vK0ZblPx0Ujd+NcCBDVTzfliwNziGnVW5cS4QKdcYpEdc
 nHIHUCpkV2oBivalLSXHPiZBVKRRRq8cNL0iS+6fZdukDER87HJ81EPESfndQFen
 xdU5Qj7VHbr/PRR56P6dUpFdqcKCY3/HyoTBbr3GVGnH6pz0hs2605YoMsJI3Js8
 IBkVNIAm2P3ud+oTDdA9+2vW/mBFCunfIdogqVPqb5DrPzjSl5uCgAOgX4J2yLLF
 FfytH8kSqplLDdCuFq6bFNdZMgEK9qzZR99OqChh2N4xBxFeTuF1Ng+OPGJRSOxz
 vlLXCav/j92ckoocqPzMG0V5AjxnrdRfql6lYZqrw7D6lrmMzwJuO7SaXiX+OkL4
 hn6GB9FgWX+D6kKHotoMa51UjaDvCHOm3c2K/ROLQ5uuidFsK/585cQDg72/sq+3
 nvAAjleYK9VESnlJ8h5BJWdgdWY5CRW/wwh3rprcc1gfXz1jtkA=
 =7GFy
 -----END PGP SIGNATURE-----

Merge tag 'rust-fixes-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux

Pull Rust fixes from Miguel Ojeda:
 "Toolchain and infrastructure:

   - Fix 'rustc-option' (the Makefile one) when cross-compiling that
     leads to build or boot failures in certain configs

   - Work around a Rust compiler bug (already fixed for Rust 1.98.0)
     thats lead to boot failures in certain configs due to missing
     'uwtable' LLVM module flags

   - Support a Rust compiler change (starting with Rust 1.98.0) in the
     unstable target specification JSON files

   - Forbid Rust + arm + KASAN configs, which do not build

  'kernel' crate:

   - Fix NOMMU build by adding a missing helper"

* tag 'rust-fixes-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:
  rust: x86: support Rust >= 1.98.0 target spec
  rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES
  rust: helpers: add is_vmalloc_addr wrapper for NOMMU builds
  rust: kasan/kbuild: fix rustc-option when cross-compiling
  ARM: Do not select HAVE_RUST when KASAN is enabled
 2026-06-06 09:44:42 -07:00
Linus Torvalds
76351effa5 vfs-7.1-rc7.fixes 
Please consider pulling these changes from the signed vfs-7.1-rc7.fixes tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCaiQb2wAKCRCRxhvAZXjc
 ol4fAP46Ta2gcT8uzJRHaXo3HMWJYY02dK1pXQ4zZDdiQMMSTgEAuaj/mOvx0VeX
 prloV/t7TBri6GAiWeE7Wu54d9rJZQ4=
 =clMX
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.1-rc7.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull vfs fixes from Christian Brauner:

 - Fix error handling in ovl_cache_get()

 - Tighten access checks for exited tasks in pidfd_getfd()

 - Fix selftests leak in __wait_for_test()

 - Limit FUSE_NOTIFY_RETRIEVE to uptodate folios

 - Reject fuse_notify() pagecache ops on directories

 - Clear JOBCTL_PENDING_MASK for caller in zap_other_threads()

 - Fix failure to unlock in nfsd4_create_file()

 - Fix pointer arithmetic in qnx6 directory iteration

 - Fix UAF due to unlocked ->mnt_ns read in may_decode_fh()

 - Avoid potential null folio->mapping deref during iomap error
   reporting

* tag 'vfs-7.1-rc7.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  iomap: avoid potential null folio->mapping deref during error reporting
  fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh()
  fs/qnx6: fix pointer arithmetic in directory iteration
  VFS: fix possible failure to unlock in nfsd4_create_file()
  signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
  fuse: reject fuse_notify() pagecache ops on directories
  fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios
  selftests: harness: fix pidfd leak in __wait_for_test
  pidfd: refuse access to tasks that have started exiting harder
  ovl: keep err zero after successful ovl_cache_get()
 2026-06-06 07:28:59 -07:00
Linus Torvalds
8e65320d91 drm fixes for 7.2-rc6 
core:
 - disable the gem change handle ioctl for security reasons
   (plan to fix it on list later with proper test coverage)
 
 dumb-buffer:
 - remove strict limits on buffer geometry
 
 amdgpu:
 - BT.2020 fix for DCE
 - DC bounds checking fixes
 - SDMA 7.1 fix
 - UserQ fixes
 - SI fix
 - SMU 13 fixes
 - SMU 14 fixes
 - GC 12.1 fix
 - Userptr fix
 - GC 10.1 fix
 - GART fix for non-4K pages
 
 amdkfd:
 - UAF race fix
 - Fix a potential NULL pointer dereference
 - GC 11 buffer overflow fix for SDMA
 
 xe:
 - Revert removing support for unpublished NVL-S GuC
 - Suspend fixes related to multi-queue
 
 i915:
 - Fix color blob reference handling in intel_plane_state
 - Revert "drm/i915/backlight: Remove try_vesa_interface"
 
 ethosu:
 - reject unsupported NPU_OP_RESIZE
 - fix index of IFM region
 - fix weight index
 - fix overflows in DMA-size calculations
 - reject DMA commands with uninitialized length
 - fix OOB write in ethosu_gem_cmdstream_copy_and_validate
 
 imx:
 - fix kernel-doc warnings
 
 ivpu:
 - add overflow checks in firmware handling and get_info_ioctl
 
 v3d:
 - wait for pending L2T flush before cleaning caches
 - fix leak of vaddr
 - skip CSD when it has zeroed workgroups
 - fix ref counting in performance monitoring
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmojVuUACgkQDHTzWXnE
 hr4uYxAAlYQS0NuQoNrXkLG/4jIwD8aG+83bnUWCEYn59Qurk7ojH4frwDSkxSi/
 Klqzk1zdbsIC6LOjI1gevhBY1Z1ASgzBAr7G44lpofeGI7zdxiSAZ6lEu9ClUVLI
 I6dO73xLtGve5/0pgTrxsSz5p8ZKJhLSHhBf0oCyaKxGEsrirWR3ofV5RqWMy4HS
 +Y/wouBG69pe8B3OK8SZhXQhJxvhnws6i8p4+pMSAhfICIsMh5aTLsNEwRxdIGzh
 xXaOsE+mrhWOd6vmwK4qX4HprSocNTJyoRW7hkIFeWLwn0ZIJAmKwgWxmMAgebBe
 RRHB5dBAm0Krn3RDc1od8dqwZ6YxWRDi1rROJmV93u+qKoYdAIoxpofTW6eB4p4q
 lphLjTM0EQvreF4XShydMPWta5tiEYIUFL4OWf1eUR8C9Ejd0G8CeKZpDT/gLwWO
 lxozV9+EZdLAkaGLoBxeghCZPBlsmkYWZ8M++8jLaJQWx1QeCSBCulMEyDEO2MN6
 4kM+awVZJ3Ou28Pjux23jSXxRgzRC/Bk373MEijX9FnB2lEYmgFDs9+kMNX1dmsj
 BcRi8+XSoUh9m1PoLuM+t+/Q+0neUdIfAX/6hqwbWp3knXtM7lQmUpgSo1hcpmop
 vMIbWZT3/ZjoFrwJSv1HuvYzpiF7YTCzv/BpVZU938FLMyBcOlk=
 =mrV8
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2026-06-06' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "Weekly drm fixes, not contributing to things settling down
  unfortunately. Lots of driver fixes for various bounds checks, leaks
  and UAF type things, i915/xe probably the most sane, amdgpu has a mix
  of fixes all over, then ethosu has lots of small fixes.

  The problem of fixing thing in private has really hit us with the
  change handle ioctl, and "Sima was right" and we should have disabled
  the ioctl, since it was only introduced a couple of kernels ago and
  failed to upstream it's tests in time.

  The patch here fixes the problems Sima identified, but disables the
  ioctl as well, with a list of known problems in it and a request for
  proper tests to be written and upstreamed. It's a niche user ioctl
  designed for CRIU with AMD ROCm, so I think it's fine to just disable
  it.

  Maybe this week will settle down.

  core:
   - disable the gem change handle ioctl for security reasons (plan to
     fix it on list later with proper test coverage)

  dumb-buffer:
   - remove strict limits on buffer geometry

  amdgpu:
   - BT.2020 fix for DCE
   - DC bounds checking fixes
   - SDMA 7.1 fix
   - UserQ fixes
   - SI fix
   - SMU 13 fixes
   - SMU 14 fixes
   - GC 12.1 fix
   - Userptr fix
   - GC 10.1 fix
   - GART fix for non-4K pages

  amdkfd:
   - UAF race fix
   - Fix a potential NULL pointer dereference
   - GC 11 buffer overflow fix for SDMA

  xe:
   - Revert removing support for unpublished NVL-S GuC
   - Suspend fixes related to multi-queue

  i915:
   - Fix color blob reference handling in intel_plane_state
   - Revert "drm/i915/backlight: Remove try_vesa_interface"

  ethosu:
   - reject unsupported NPU_OP_RESIZE
   - fix index of IFM region
   - fix weight index
   - fix overflows in DMA-size calculations
   - reject DMA commands with uninitialized length
   - fix OOB write in ethosu_gem_cmdstream_copy_and_validate

  imx:
   - fix kernel-doc warnings

  ivpu:
   - add overflow checks in firmware handling and get_info_ioctl

  v3d:
   - wait for pending L2T flush before cleaning caches
   - fix leak of vaddr
   - skip CSD when it has zeroed workgroups
   - fix ref counting in performance monitoring"

* tag 'drm-fixes-2026-06-06' of https://gitlab.freedesktop.org/drm/kernel: (50 commits)
  drm/gem: Try to fix change_handle ioctl, attempt 4
  Revert "drm/i915/backlight: Remove try_vesa_interface"
  accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate()
  accel/ethosu: reject DMA commands with uninitialized length
  accel/ethosu: fix arithmetic issues in dma_length()
  accel/ethosu: fix wrong weight index in NPU_SET_SCALE1_LENGTH on U85
  accel/ethosu: reject NPU_OP_RESIZE commands from userspace
  accel/ethosu: fix IFM region index out-of-bounds in command stream parser
  drm/v3d: Fix global performance monitor reference counting
  drm/xe/multi_queue: skip submit when primary queue is suspended
  drm/xe: Clear pending_disable before signaling suspend fence
  Revert "drm/xe: Skip exec queue schedule toggle if queue is idle during suspend"
  drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range
  drm/amdgpu: Fix incorrect VRAM GART mappings on non-4K page size systems
  drm/amdgpu/userq: move wptr_obj cleanup in mqd_destroy
  drm/amdgpu: improve the userq seq BO free bit lookup
  drm/amdgpu/userq: remove the vital queue unmap logging
  drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11
  drm/amdkfd: fix NULL dereference in get_queue_ids()
  drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14)
  ...
 2026-06-05 18:02:23 -07:00
Simona Vetter
1a4f03d22f drm/gem: Try to fix change_handle ioctl, attempt 4 
[airlied: just added some comments on how to reenable]
On-list because the cat is out of the bag and we're clearly not good
enough to figure this out in private. The story thus far:

5e28b7b944 ("drm: Set old handle to NULL before prime swap in
change_handle") tried to fix a race condition between the gem_close and
gem_change_handle ioctls, but got a few things wrong:

- There's a confusion with the local variable handle, which is actually
  the new handle, and so the two-stage trick was actually applied to the
  wrong idr slot. 7164d78559 ("drm/gem: fix race between
  change_handle and handle_delete") tried to fix that by adding yet
  another code block, but forgot to add the error handling. Which meant
  we now have two paths, both kinda wrong.

- dc366607c4 ("drm: Replace old pointer to new idr") tried to apply
  another fix, but inconsistently, again because of the handle confusion
  - this would be the right fix (kinda, somewhat, it's a mess) if we'd
  do the two-stage approach for the new handle. Except that wasn't the
  intent of the original fix.

We also didn't have an igt merged for the original ioctl, which is a big
no-go. This was attempted to address off-list in the original bugfix,
and amd QA people claimed the bug was fixed now. Very clearly that's not
the case. Here's my attempt to sort this out:

- Rename the local variable to new_handle, the old aliasing with
  args->handle is just too dangerously confusing.

- Merge the gem obj lookup with the two-stage idr_replace so that we
  avoid getting ourselves confused there.

- This means we don't have a surplus temporary reference anymore, only
  an inherited from the idr. A concurrent gem_close on the new_handle
  could steal that. Fix that with the same two-stage approach
  create_tail uses. This is a bit overkill as documented in the comment,
  but I also don't trust my ability to understand this all correctly, so
  go with the established pattern we have from other ioctls instead for
  maximum paranoia.

- Adjust error paths. I've tried to make the error and success paths
  common, because they are identical except for which handle is removed
  and on which we call idr_replace to (re)install the object again. But
  that made things messier to read, so I've left it at the more verbose
  version, which unfortunately hides the symmetry in the entire code
  flow a bit.

- While at it, also replace the 7 space indent with 1 tab.

And finally, because I flat out don't trust my abilities here at all
anymore:

- Disable the ioctl until we have the igt situation and everything else
  sorted out on-list and with full consensus.

v2:

Sashiko noticed that I didn't handle the error path for idr_replace
correctly, it must be checked with IS_ERR_OR_NULL like in
gem_handle_delete. So yeah, definitely should just the existing paths
1:1 because this is endless amounts of tricky.

Also add the Fixes: line for the original ioctl, I forgot that too.

Reported-by: DARKNAVY (@DarkNavyOrg) <vr@darknavy.com>
Signed-off-by: Simona Vetter <simona.vetter@ffwll.ch>
Fixes: dc366607c4 ("drm: Replace old pointer to new idr")
Cc: syzbot+d7c9eed171647e421013@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Cc: Edward Adam Davis <eadavis@qq.com>
Cc: Dave Airlie <airlied@redhat.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: 5e28b7b944 ("drm: Set old handle to NULL before prime swap in change_handle")
Cc: David Francis <David.Francis@amd.com>
Cc: Puttimet Thammasaeng <pwn8official@gmail.com>
Cc: Christian Koenig <Christian.Koenig@amd.com>
Fixes: 7164d78559 ("drm/gem: fix race between change_handle and handle_delete")
Cc: Zhenghang Xiao <kipreyyy@gmail.com>
Fixes: 5e28b7b944 ("drm: Set old handle to NULL before prime swap in change_handle")
Reviewed-by: David Francis <David.Francis@amd.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Link: https://patch.msgid.link/20260604194437.1725314-1-simona.vetter@ffwll.ch
 2026-06-06 08:54:55 +10:00
Dave Airlie
8ff3adc8c3 Merge tag 'drm-intel-fixes-2026-06-05' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes 
- Fix color blob reference handling in intel_plane_state (Chaitanya Kumar Borah)
- Revert "drm/i915/backlight: Remove try_vesa_interface" [backlight] (Suraj Kandpal)

Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Tvrtko Ursulin <tursulin@igalia.com>
Link: https://patch.msgid.link/aiKgmwz7VGOaFXIv@linux
 2026-06-06 08:42:15 +10:00
Dave Airlie
f80cbe57ec Short summary of fixes pull: 
dumb-buffer:
 - remove strict limits on buffer geometry
 
 ethosu:
 - reject unsupported NPU_OP_RESIZE
 - fix index of IFM region
 - fix weight index
 - fix overflows in DMA-size calculations
 - reject DMA commands with uninitialized length
 - fix OOB write in ethosu_gem_cmdstream_copy_and_validate
 
 imx:
 - fix kernel-doc warnings
 
 ivpu:
 - add overflow checks in firmware handling and get_info_ioctl
 
 v3d:
 - wait for pending L2T flush before cleaning caches
 - fix leak of vaddr
 - skip CSD when it has zeroed workgroups
 - fix ref counting in performance monitoring
 -----BEGIN PGP SIGNATURE-----
 
 iQFPBAABCgA5FiEEchf7rIzpz2NEoWjlaA3BHVMLeiMFAmoiedAbFIAAAAAABAAO
 bWFudTIsMi41KzEuMTIsMiwyAAoJEGgNwR1TC3ojlPgH/3dtzYxSDc/66kxFEdYw
 RUOemMjs+EbT8+NU9k0H4rI3IWur8IzOEBXvlVSGwe4J2RusqWDnKpbJij34VgZq
 524oSLk92Me+VmO3L3QE07OaZ233tOKYKV44CZraBcBVAl4NSnnmf2pV3yrddsBQ
 8vKJPmSCRMiQprkFYcyQc6YEbix/MVXMLRUxS0lNZzCtH5594Ft2ugD+4VMl1Bkd
 sMi8dMYQrsv2qsgRJhvZHOjT7E1mJuH6DLEn7jgvx3oO4ONZWb4kJ7clgozsLcZn
 hLFgtQMh8AR+lJaDshRVj5P+xlzgoGkM7eLEjSTQWv1VQ9EMw4/orOWpm55U9v17
 4gY=
 =lxiE
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-fixes-2026-06-05' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes

Short summary of fixes pull:

dumb-buffer:
- remove strict limits on buffer geometry

ethosu:
- reject unsupported NPU_OP_RESIZE
- fix index of IFM region
- fix weight index
- fix overflows in DMA-size calculations
- reject DMA commands with uninitialized length
- fix OOB write in ethosu_gem_cmdstream_copy_and_validate

imx:
- fix kernel-doc warnings

ivpu:
- add overflow checks in firmware handling and get_info_ioctl

v3d:
- wait for pending L2T flush before cleaning caches
- fix leak of vaddr
- skip CSD when it has zeroed workgroups
- fix ref counting in performance monitoring

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patch.msgid.link/20260605072602.GA268798@linux.fritz.box
 2026-06-06 08:38:26 +10:00
Linus Torvalds
c10130c234 io_uring-7.1-20260605 
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmojJQ0QHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgppGsD/0d9CxOz1SLooS0ufvmb0+Jm1d8tHe+NeNv
 ALINBbvytrEppGNh4M+u25ZcWzevKHZTCIM9++nBNJOlTHLvP+E8dIdUuZvct2GU
 y1jK28y/K9iM11MMAN2ey7OI8J20ABQGoCfXXwmBbqw3eM27gap74GpLwQ6vDG7E
 xCnzS8M9R7MUxO2Y2ZfQkfgMUuViNMe3V9r4zz0Dgjn1Ao8cWduJ4BsZBN3sRMtA
 D9EqU2kd4SscnwYSb8guPlshf3u0oY1GBTFozgUiqPw9bz6EAPk90ikr8gUgsWyk
 UxgEWQLgIcwkpM+ym5kBGYcy4htA3bYM0XkYN5CaTzFg47roaQW9XVe+w14IAtKR
 iSVpVGjDv/zZRJjDadN95GEXtVy5ZYZrIt2+2qwns9lTqGwAzHfVlnjNx2tqq4VS
 LVhqgM6UzXHXun0CpBJVZ66j6kKjDyme8j0RjgZ/Gt2QhnrFIBfUiXjac5UgiZjp
 +4s9VWdNViomho24lgxgtpGwRPXfdZjbl8LPS2O3tywOQOikUGBpVM7Nja82N/0b
 mV2szmMl6nCu0wHfqQ54nP7maZa0TtLU6K1ozSd5spOrY5ZDsrleLiciRSCbNR2R
 jRKEUsReZe7CZ/4h/atZws2/eVCpYh2PMnSFMb1w8v5gnQk94ryPd9KKYbK8dsGk
 zU0OdJxJ2A==
 =OdYU
 -----END PGP SIGNATURE-----

Merge tag 'io_uring-7.1-20260605' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull io_uring fix from Jens Axboe:
 "A single fix for a missing flag mask when multishot is used with
  an incrementally consumed buffer ring, potentially leading to
  application confusion because of lack of IORING_CQE_F_BUF_MORE
  consistency"

* tag 'io_uring-7.1-20260605' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries
 2026-06-05 13:52:15 -07:00
Linus Torvalds
06121e12c2 Third round for Kbuild fixes for 7.1 
- kconfig: Fix repeated include selftest expectation
 
     Fixes the currently broken kconfig tests
 
 Cc: Nathan Chancellor <nathan@kernel.org>
 Cc: Zhou Yuhang <zhouyuhang1010@163.com>
 Cc: Zhou Yuhang <zhouyuhang@kylinos.cn>
 Cc: linux-kbuild@vger.kernel.org
 Cc: linux-kernel@vger.kernel.org
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEh0E3p4c3JKeBvsLGB1IKcBYmEmkFAmojB54ACgkQB1IKcBYm
 EmkQZBAAuCoL7X6Ol7zDXUzhUiuwKiUBL6kVnW7HKG5iAANk/+1LFW8nCoA2Tu6q
 uJbZgrlNi/xiq4Wjbr5/MpjmM/vlscLjoacs7hiypOD8UTylcgk2SXMXiUoubns8
 tvjBXmnYs2U0J276lwP5hfeWUbnMo7kTWfE7u4GQVEQk8NLPiMnc2/ptqNZ/a02b
 jJ3ahuQ1P4DFflUkpgxCXuSRGJat8Y3uzzRO1eNvvZ8EJgg7r8I2QD00aUwuYNSb
 ro+UZDdwgVfdD0dwtGgGempQd7qHrS98iKs9fRz6r4TxrHr27Ops9P/PkFP8QtEB
 lLQhA0TYSjy4MRfARJHzwfj+fBf5AlXvzKIvxm8pFLq5RMP1b27HP+k7CrsFZceJ
 p0mZu6h6CxCgA8g67II6uqhMYzfdbj/jbYBhZjQGafiCT4BH8Qi955BZFTeuQsLc
 EcIpoe8w2yUjCRVK2Hp1nkG/C//Irj7BNwyVPd5yHE5ld3gnRfrvpvghfLXvFrHt
 1OFihS0jiIrnojcMa/xvw4ZC44/MOktHWgfb9G5KaJWzMRT/1PFwJ2wbS1f5HVQn
 htHwJ3CIn2gRbK/oTH7O/Js4MgpcQLO7LrQD5J5fnR+Gmvx+G85QZWa3OiWdrN/8
 p9Y7m9hgmx/oApcQzHtOQxaPDrVRINBR6A+wcbCGmGoHUFq53k4=
 =Ve6e
 -----END PGP SIGNATURE-----

Merge tag 'kbuild-fixes-7.1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux

Pull Kbuild fix from Nicolas Schier:
 "A single simple commit that fixes the currently broken kconfig
  selftests"

* tag 'kbuild-fixes-7.1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux:
  kconfig: Fix repeated include selftest expectation
 2026-06-05 11:16:15 -07:00
Linus Torvalds
95b78879a8 Arm: 
- Correctly drop the ITS translation cache reference when it actually
   gets invalidated
 
 - Take the SRCU lock for SW page table walks
 
 - Restore POR_EL0 access to host EL0, avoiding POR_EL0 becoming
   inaccessible from EL0 after running a guest
 
 - Reassign nested_mmus array behind mmu_lock, ensuring that vcpu init
   and MMU notifiers are mutually exclusive
 
 - Correctly handle FEAT_XNX at stage-2
 
 s390:
 
 - More fixes for the new page table management and nested virtualization
 
 x86:
 
 - More fixes for GHCB issues
 
   - Read start/end indices of page size change requests exactly one per vmexit
 
   - Unmap and unpin the GHCB as needed on vCPU free
 -----BEGIN PGP SIGNATURE-----
 
 iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmoi/4cUHHBib256aW5p
 QHJlZGhhdC5jb20ACgkQv/vSX3jHroOhbQgAryMnK/ik3rzTO/FW6LlHzkQRMN/J
 WUE/LB7X9DNynWb5MDfE4dDPrH+jxb8YHeX82vMs3vXi5FXqvdBUTR96O0p9PWuE
 pvjiICmpIqYn63vCZiIh0UwvbvaF8ADGr6moCvUfzoxanvnhZBFCzFEDdrKTIw3B
 RimdLJ61zEGc8Sjly8GIT8IB3bDmS/GqdKk61fAYGXsDf8QJ2dESuM4/+hed7Yyq
 NbT6ar4mrMjZKD2tcPx9ZgrCnqCJFnXmir3EEU2OMxxdXgbpz3cf2YOmA1fwBoQ0
 E9qjNybNwnYJnhBn94vZdPSxOADzTKjRmhJ7LSxpvaq3HaZg3ZG1/bshCg==
 =tJp+
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull kvm fixes from Paolo Bonzini:
 "arm64:
   - Correctly drop the ITS translation cache reference when it actually
     gets invalidated

   - Take the SRCU lock for SW page table walks

   - Restore POR_EL0 access to host EL0, avoiding POR_EL0 becoming
     inaccessible from EL0 after running a guest

   - Reassign nested_mmus array behind mmu_lock, ensuring that vcpu init
     and MMU notifiers are mutually exclusive

   - Correctly handle FEAT_XNX at stage-2

  s390:
   - More fixes for the new page table management and nested
     virtualization

  x86:
   - More fixes for GHCB issues:
      - Read start/end indices of page size change requests exactly once
        per vmexit
      - Unmap and unpin the GHCB as needed on vCPU free"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (23 commits)
  KVM: arm64: Correctly identify executable PTEs at stage-2
  KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX
  KVM: arm64: Reassign nested_mmus array behind mmu_lock
  KVM: arm64: Restore POR_EL0 access to host EL0
  KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation
  KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry
  KVM: SEV: Unmap and unpin the GHCB as needed on vCPU free
  KVM: SEV: Decouple the need to sync the GHCB SA from the need to free the SA
  KVM: SEV: Move sev_free_vcpu() down below sev_es_unmap_ghcb()
  KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying
  KVM: SEV: Read start/end indices of PSC requests exactly once per #VMGEXIT
  KVM: SEV: Add an anonymous "psc" struct to track current PSC metadata
  KVM: SEV: Make it more obvious when KVM is writing back the current PSC index
  KVM: s390: Remove ptep_zap_softleaf_entry()
  KVM: s390: Fix possible reference leak in fault-in code
  KVM: s390: Prevent memslots outside the ASCE range
  KVM: s390: Lock pte when making page secure
  KVM: s390: Fix fault-in code
  KVM: s390: vsie: Fix rmap handling in _do_shadow_crste()
  KVM: s390: Fix guest / virtual address confusion in _essa_clear_cbrl()
  ...
 2026-06-05 10:38:45 -07:00
Linus Torvalds
d1b0937f0e Probes fixes for v7.1-rc6 
- tracing/probes: Point the error offset correctly for eprobe argument error
   Fix the eprobe event parser to point error position correctly.
 -----BEGIN PGP SIGNATURE-----
 
 iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmoi0xkbHG1hc2FtaS5o
 aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8b5awIAL8sYmBb+0dZO9uPvAwS
 Ar0IlPGd/lnfLNUF5nmin+fSyAr4TIqLIuKjHZ2MxFGxtyITzWQDbXIBT7Wan5vy
 3adAJTVgby+jz2k+MvTU1hU1wBt4E4nGvJQJf9Ohk7NuqiUYSDjbkPa2yA3fGFFY
 HGvvRlj0OF6eYbyiGIUTk5S4AYeBOFB6/qB9MbMTUHPXiM0LgzBVuR+Rimo1iFNO
 wdqJ9atrj8r4hdvAQLPeKXAfhahhHXlviGVDjtgGa9Gt7jESPw8fDdh5PWKWr7Vy
 6Mr/o/16V13bFx4zWRacSwgSFsJsZukDS+bdD5HnEGhb8AYZxOYvy79H6URT3S4e
 rws=
 =rQ/U
 -----END PGP SIGNATURE-----

Merge tag 'probes-fixes-v7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull tracing/probes fix from Masami Hiramatsu:
 "Fix the eprobe event parser to point error position correctly"

* tag 'probes-fixes-v7.1-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  tracing/probes: Point the error offset correctly for eprobe argument error
 2026-06-05 10:33:32 -07:00
Zhou Yuhang
65b09bfa8a
 		kconfig: Fix repeated include selftest expectation 
The err_repeated_inc test was added with an expected stderr fixture
that does not match the diagnostic printed by kconfig.

Running "make testconfig" currently fails in that test even though the
parser reports the duplicated include correctly:

  [stderr]
  Kconfig.inc1:4: error: repeated inclusion of Kconfig.inc3
  Kconfig.inc2:3: note: location of first inclusion of Kconfig.inc3

The fixture expects "Repeated" and "Location" with capital letters, but
the diagnostic emitted by scripts/kconfig/util.c uses lowercase words.
Update the fixture to match the real message.

Fixes: 102d712ded ("kconfig: Error out on duplicated kconfig inclusion")
Signed-off-by: Zhou Yuhang <zhouyuhang@kylinos.cn>
Tested-by: Nicolas Schier <nsc@kernel.org>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Link: https://patch.msgid.link/20260520070800.2265479-1-zhouyuhang1010@163.com
Signed-off-by: Nicolas Schier <nsc@kernel.org>
 2026-06-05 19:24:49 +02:00
Paolo Bonzini
7ec0360122 KVM/arm64 fixes for 7.1, take #5 
- Correctly drop the ITS translation cache reference when it actually
   gets invalidated
 
 - Take the SRCU lock for SW page table walks
 
 - Restore POR_EL0 access to host EL0, avoiding POR_EL0 becoming
   inaccessible from EL0 after running a guest
 
 - Reassign nested_mmus array behind mmu_lock, ensuring that vcpu init
   and MMU notifiers are mutually exclusive
 
 - Correctly handle FEAT_XNX at stage-2
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEn9UcU+C1Yxj9lZw9I9DQutE9ekMFAmoi9m8ACgkQI9DQutE9
 ekMOqRAAwCXKfCTXWTbWVrzyPvkHHktQUnUANY262VxFmOzvIlxONu0zQK/Saagl
 YMJ/nfLbwI4Cz2sLeBplxcyh8dVoc6EglDbB+d+7gXIJWVxA5ToM3yt1Yn+g4hpc
 4LTIapANeIDlQ+Z8PyR2WdEdo9a89j9qs+goBgscjHF85N2Qh10G3wioeCGQVTYw
 Z1woVhyx4VlcUOPWYS3Ws3yqbICousxe5zsKLXb2v5nybauBS7fjh7ACbX2pBlmi
 X4Pip4vIyfv0hyq5rdvcb/m8pjXgXrrdaZ2pJpvm2ioa5MAQ1SvvHo+HDsOPuoCl
 p0TlDARd9JpMZdNko5/3qmAmMlE2ap9Qqh7zaAlxt/THoI/0G/7NOaKBclGcp/nw
 +KjDEFriws2Yeqce+Tl8pF0/MBCmNV61BVSa91xGG3pRdxThV/NCxD4oRWLCDMRJ
 3UEAwNVV6FZW7rAbdzlG/spjmloMGPzWq4Mg+iu6BunfOBI6RlabHlRqhaU8SZ/O
 dX82lzfCpouikgETSJNi7Ta/aCBDWLeuM01TuZ05RO5vCfTdB50SFlmXMRO5zjR0
 tVCKg5roKkVd2D81g/kssehpGgOsiBqqiNK7LMYhxzEMC0aySobrtbbq6KT0RVez
 fbQsrLvFFVGUAMp3k84s2BF+K7EXUh98GgqLerwbg2mp7UhqpW0=
 =8bS2
 -----END PGP SIGNATURE-----

Merge tag 'kvmarm-fixes-7.1-5' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD

KVM/arm64 fixes for 7.1, take #5

- Correctly drop the ITS translation cache reference when it actually
  gets invalidated

- Take the SRCU lock for SW page table walks

- Restore POR_EL0 access to host EL0, avoiding POR_EL0 becoming
  inaccessible from EL0 after running a guest

- Reassign nested_mmus array behind mmu_lock, ensuring that vcpu init
  and MMU notifiers are mutually exclusive

- Correctly handle FEAT_XNX at stage-2
 2026-06-05 18:54:37 +02:00
Linus Torvalds
a8dc5f60d1 NFS client bugfix for Linux 7.1 
Bugfixes:
 - Fix a use after free in nfs_write_completion
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQR8xgHcVzJNfOYElJo6EXfx2a6V0QUCaiLziAAKCRA6EXfx2a6V
 0fX1AP0VI3hJgrOufhJZNFh5/yYTKNtuNIsVzObrbKDirhZjMwEAgQEXgXeB8tN4
 IxCq3qi8eK600iLKqn7PwjAvHMrZiwY=
 =qHOO
 -----END PGP SIGNATURE-----

Merge tag 'nfs-for-7.1-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs

Pull NFS client fix from Trond Myklebust:

 - Fix a use after free in nfs_write_completion

* tag 'nfs-for-7.1-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
  NFS: write_completion: dereference loop-local req, not hdr->req
 2026-06-05 09:34:14 -07:00
Linus Torvalds
6a5358410a xfs: fixes for v7.1-rc7 
Signed-off-by: Carlos Maiolino <cem@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iJUEABMJAB0WIQSmtYVZ/MfVMGUq1GNcsMJ8RxYuYwUCaiKcdwAKCRBcsMJ8RxYu
 Y4d+AX9CjmcF5yEZVe+7YCc0ktUUvm0EQwXmGDMCm8UzT1kcWVRDF2eIxu/cYKjo
 a1AfN9gBgMA/yJNYWyUluSiF+vTD2y2iuCX08k2p/8qplUEuEINRjooEp6bgJ6bN
 BYeFp1mXSw==
 =Kpi8
 -----END PGP SIGNATURE-----

Merge tag 'xfs-fixes-7.1-rc7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux

Pull xfs fixes from Carlos Maiolino:
 "A collection of fixes mostly for the RT device, including a small
  refactor that has no functional change"

* tag 'xfs-fixes-7.1-rc7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
  xfs: Remove mention of PageWriteback
  xfs: abort mount if xfs_fs_reserve_ag_blocks fails
  xfs: factor rtgroup geom write pointer reporting into a helper
  xfs: drop the RTG reference later in xfs_ioc_rtgroup_geometry
  xfs: fix rtgroup cleanup in CoW fork repair
  xfs: fix error returns in CoW fork repair
  xfs: fix overlapping extents returned for pNFS LAYOUTGET
  xfs: fix use of uninitialized imap in xfs_fs_map_blocks error path
  xfs: handle racing deletions in xfs_zone_gc_iter_irec
 2026-06-05 08:34:32 -07:00
Linus Torvalds
2b389a573b Changes since last update: 
- Fix a UAF of sbi->sync_decompress when compressed I/Os
    race with unmount
 
  - Fix a regression introduced this development cycle that
    incorrectly rejects multiple-algorithm images
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEQ0A6bDUS9Y+83NPFUXZn5Zlu5qoFAmoiGEoRHHhpYW5nQGtl
 cm5lbC5vcmcACgkQUXZn5Zlu5qrkCQ/9HTsNbR3k+xFvSd7wNtV3s2pKRX2ctEVn
 KWiOk5ZNRWUWImL7a0gEwjGtkGPDg4yXWHQnm0hPO6bBqXOXoPuDomsSDC5EzvQ+
 ID2dxkc+nJeg9MkiKEY3W78yTkOI8Xrn8ZYi02U30Vk0vzWiiEnJG9pKp6XTheAi
 zRA2iqoiE00wTbAZCW3xqyHcw2djBRuaBYPYycHJCw3D+sVcnuVrLUeeFNKXsar1
 p2FG+9tzPgMhMFJgTkiD7SA0dmRp4PoJsY1d1P1uuqBJ/PFWmWTbnCmNvUZUQFcR
 d2rT0jxlW4oA+lzP/RT0lDmvR3howEy4F+gLlsh8jYO5RmtLyAv5gVzxqugN0Jc4
 ZSRX6qgVYhsHe/DzbPIbZFjcWUNs7Q1gS6NwUhjlZ9r4CJ2Yh/n43koPWwJB/xTt
 HmkSuaOatu5zDHvohlbX2AAoxALDs+fO9lu9C9cgCAx/dS01zdgUyCWYIH43+OAp
 BveL+jmzdzLnMakCs3ImsrgTZXxqrmCe0HgsCVjqGsmDCk8y3CDmMhG1EYn0bOgA
 OnbkGj2Q/MmXJbrgsogOgc6oIg+sFf1GzMiNFeUTm7nSHgmoqI2f+aTMz9qNmKZu
 9XPvyzfPFF/0NPxF9c0e7bwiMyaZLXaHn1wG2eXbubSQbIxRBmnid8XiA/SaOHUq
 kY6gkXUB+4k=
 =CHHg
 -----END PGP SIGNATURE-----

Merge tag 'erofs-for-7.1-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs

Pull erofs fixes from Gao Xiang:

 - Fix a UAF of sbi->sync_decompress when compressed I/Os
   race with unmount

 - Fix a regression introduced this development cycle that
   incorrectly rejects multiple-algorithm images

* tag 'erofs-for-7.1-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:
  erofs: fix EFSCORRUPTED on multi-algorithm images in z_erofs_map_sanity_check()
  erofs: fix use-after-free on sbi->sync_decompress
 2026-06-05 08:28:10 -07:00
Linus Torvalds
e4a9638a0b three ksmbd server fixes 
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmoh6iQACgkQiiy9cAdy
 T1HZagv+PVKZ5Djru4YzKQH19sYHkiav7FLzwZZy+bTmGlApWci6m/7aBojZOeac
 t5vaFURjrrGSAY5QQGjtr7rFgsQsQkU6AuSo8BnaGXRdzf9HoMkI0TI/OOGfuELX
 BCD10yoX8m8SwnrXIPaqHoyfn0uhUHRZk8okWPtPzv19VZK3t84XkQjLjR+IYHwb
 UZWhmGanjqw2yS5kTuWr6M3+POLnDqrdEzNj8R1ugcQ5aH/s1vfVEUi1vXKnGSBa
 ZPldxXRUpbEUMwrk1PyXd4Hb/OKpQrAoj3kl6sBXLNvLHtiw4i8+NkpGDg00eXYE
 xOqAdADNFpWx1lIJVJ845Enn5twaGM8y7KlXr+lEGfVU7iCKahs4d0RkjQON5aTo
 1HTx+nov4cP0nojvnPONU0li576E66ryqWzpBqsfEN93ROi+x7snuT9vB6QCjGHH
 lDv0UgsGF9TGWw2sBBQXhgYBXiFs2e1YSvdfT6KAd2x2SEJOIZ8yM6+ZNLzS1zTP
 XGjnnZ7S
 =7kge
 -----END PGP SIGNATURE-----

Merge tag 'v7.1-rc7-ksmbd-server-fixes' of git://git.samba.org/ksmbd

Pull smb server fixes from Steve French:

 - Fix use after free in SMB2_CANCEL

 - Fix race in ksmbd_reopen_durable_fd

 - Fix oplock and lease break potential NULL-dref

* tag 'v7.1-rc7-ksmbd-server-fixes' of git://git.samba.org/ksmbd:
  ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL
  ksmbd: fix durable reconnect double-bind race in ksmbd_reopen_durable_fd
  ksmbd: fix NULL-deref of opinfo->conn in oplock/lease break notifiers
 2026-06-05 08:23:02 -07:00