mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-10 20:48:12 +00:00
1,463,831 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Amit Machhiwal
|
884ea0283f |
KVM: PPC: Book3S HV: Validate arch_compat against host compatibility mode
On IBM POWER systems, newer processor generations can operate in compatibility modes corresponding to earlier generations. This becomes relevant for nested virtualization, where nested KVM guests may need to run with a specific processor compatibility level. Currently, when running a nested KVM guest (L2) inside a Power11 pSeries logical partition (L1) booted in Power10 compatibility mode, the guest fails to boot while setting 'arch_compat'. This happens because the CPU class is derived from the hardware PVR (via mfspr()), which reflects the physical processor generation (Power11), rather than the effective compatibility mode (Power10). As a result, userspace may request a Power11 arch_compat for the L2 guest. However, the L1 partition, running in Power10 compatibility, has only negotiated support up to Power10 with the Power Hypervisor (L0). When H_GUEST_SET_STATE is invoked with a Power11 Logical PVR, the hypervisor rejects the request, leading to a late guest boot failure: KVM-NESTEDv2: couldn't set guest wide elements [..KVM reg dump..] This situation should be detected earlier and rejected by KVM. Without proper validation, if userspace ignores the error, the guest may continue to boot in Power11 raw mode on a Power10 compatibility host, which should not be allowed. Introduce a validation mechanism that detects unsupported arch_compat values early in the guest initialization path. When an unsupported arch_compat is requested (e.g., Power11 on a Power10 compatibility mode host), kvmppc_set_arch_compat() uses cpu_has_feature(CPU_FTR_P11_PVR) to detect the mismatch and sets arch_compat to PVR_ARCH_INVALID (0xffffffff). This sentinel value is architecturally safe: PAPR specifies that valid logical PVR values must have 0x0f as the first byte, ensuring 0xffffffff lies permanently outside the specification-defined range. Setting this value triggers kvmppc_sanity_check() to mark the vCPU as invalid by setting vcpu->arch.sane to false. On the next vCPU run, kvmppc_vcpu_run_hv() checks this flag and returns -EINVAL, preventing the guest from running with an invalid processor compatibility configuration. With this, when a Power11 arch_compat is requested on a Power10 compatibility mode host, the guest fails early during boot with: error: kvm run failed Invalid argument This provides a much clearer failure mode compared to the previous behavior where the guest could boot in Power11 raw mode (if userspace ignored the error) or fail late during H_GUEST_SET_STATE. Suggested-by: Vaibhav Jain <vaibhav@linux.ibm.com> Reviewed-by: Vaibhav Jain <vaibhav@linux.ibm.com> Tested-by: Anushree Mathur <anushree.mathur@linux.ibm.com> Acked-by: Gautam Menghani <gautam@linux.ibm.com> Cc: stable@vger.kernel.org # v6.13+ Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com> Reviewed-by: Mukesh Kumar Chaurasiya (IBM) <mkchauras@gmail.com> Signed-off-by: Amit Machhiwal <amachhiw@linux.ibm.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260714175432.86388-1-amachhiw@linux.ibm.com |
||
Gou Hao
|
5aabc19270 |
powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass
smp_muxed_ipi_message_pass() calls smp_ops->cause_ipi() without
checking whether it has been set.
On platforms using muxed IPI (e.g. powernv/pseries), smp_ops->cause_ipi
is initialized to NULL in the static smp_ops and only assigned during
the platform smp_probe() handler. If the IPI subsystem fails to
initialize -- for example when xive_init_ipis() fails and
xive_smp_probe() returns an error -- the probe handler returns early
and cause_ipi is never set. Any subsequent IPI send (e.g.
arch_smp_send_reschedule()) would dereference the NULL pointer.
Add a NULL check to avoid the crash in that situation.
Fixes:
|
||
|
Gou Hao
|
37d401c9c4 |
powerpc/xive: defer setting cause_ipi until IPI init succeeds
xive_smp_probe() currently assigns smp_ops->cause_ipi = xive_cause_ipi before calling xive_init_ipis() and xive_setup_cpu_ipi(). If either call fails, the platform probe handler returns early but cause_ipi remains pointing to xive_cause_ipi -- which accesses per-cpu IPI data (xc->ipi_data) that was never properly initialized, leading to a WARN and a crash. Move the cause_ipi assignment to after both calls succeed, so that smp_ops->cause_ipi is only set when the IPI subsystem is fully initialized. Signed-off-by: Gou Hao <gouhao@uniontech.com> Suggested-by: Cédric Le Goater <clg@kaod.org> Reviewed-by: jiazhenyuan <jiazhenyuan@uniontech.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260727104215.184786-5-gouhao@uniontech.com |
||
|
Gou Hao
|
411a3c016e |
powerpc/xive: propagate IPI init errors to prevent use-after-free
When xive_init_ipis() fails (e.g. irq_domain_alloc_irqs() fails), the error path frees the global xive_ipis array. However, xive_smp_probe() previously ignored this failure and proceeded to call xive_setup_cpu_ipi(), which dereferences the already-freed xive_ipis pointer -- a use-after-free. Now that xive_smp_probe() returns int (previous patch), propagate the error from xive_init_ipis() and xive_setup_cpu_ipi() through xive_smp_probe(). Check the return value in both pnv_smp_probe() and pSeries_smp_probe() so that IPI setup is aborted cleanly on failure, avoiding the use-after-free. Fixes: |
||
|
Gou Hao
|
ab5ae5dceb |
powerpc/xive: add error return value to xive_smp_probe()
xive_smp_probe() calls xive_init_ipis() which can fail, but its return value is currently ignored. Change xive_smp_probe() to return int so that errors can be propagated to callers. This is a preparatory patch for the next one. No functional change yet; the return value is always 0 at this point. Signed-off-by: Gou Hao <gouhao@uniontech.com> Reviewed-by: Wentao Guan <guanwentao@uniontech.com> Reviewed-by: jiazhenyuan <jiazhenyuan@uniontech.com> Reviewed-by: Cédric Le Goater <clg@kaod.org> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260727104215.184786-3-gouhao@uniontech.com |
||
|
Gou Hao
|
f068fca7e8 |
powerpc/xive: make xive IPI allocation NULL-safe
__GFP_NOFAIL should not be used in new code [1]. xive_init_ipis()
allocates the xive_ipis array with __GFP_NOFAIL, which makes the
subsequent NULL check unreachable dead code.
Remove __GFP_NOFAIL so the allocation can fail, and make all xive_ipis
access paths NULL-safe:
- Return XIVE_BAD_IRQ from xive_ipi_cpu_to_irq() when xive_ipis is NULL.
- Set xive_ipis to NULL after kfree() in the error path to prevent
use-after-free.
- Guard xive_setup_cpu_ipi() and xive_cleanup_cpu_ipi() against
xive_ipi_irq == XIVE_BAD_IRQ to avoid dereferencing an uninitialized
or already-freed xive_ipis array.
No functional change when allocation succeeds.
Link: https://lore.kernel.org/all/20260725202632.dcb325658896a470df91cf57@linux-foundation.org/ [1]
Fixes:
|
||
Jinjie Ruan
|
fa40f9dbdd |
powerpc/kexec_file: Prevent kexec range truncation
Sashiko AI review pointed out the following issue.
The __merge_memory_ranges() function incorrectly handles overlapping
memory ranges when merging them. Although sort_memory_ranges() sorts all
ranges by their start address in ascending order beforehand, the merge
logic remains defective in two ways:
1. It compares the current range's start against the previous element (i-1)
instead of the running target index (idx)
2. It unconditionally overwrites 'ranges[idx].end' with 'ranges[i].end'.
This logic flaw leads to critical memory truncation when a larger memory
range completely subsumes subsequent smaller ranges.
For example, consider a sorted input array with three ranges:
Range A (idx=0): [0x1000 - 0x9000]
Range B (i=1): [0x2000 - 0x5000] (completely inside Range A)
Range C (i=2): [0x6000 - 0x8000] (completely inside Range A)
1. When i=1 (Range B):
ranges[1].start (0x2000) <= ranges[0].end + 1 (0x9001) is TRUE.
The code executes: ranges[0].end = ranges[1].end, which erroneously
shrinks Range A's end from 0x9000 down to 0x5000.
2. When i=2 (Range C):
ranges[2].start (0x6000) <= ranges[1].end + 1 (0x5001) is FALSE.
The code falls into the else block, creating a broken new range.
As a result, valid memory fragments [0x5001 - 0x5fff] and [0x8001 - 0x9000]
are completely lost from the kexec exclude lists, potentially allowing
the crash kernel to overwrite active memory, causing data corruption
or crashes.
Fix this by ensuring the start of the current range is compared against the
end of the active merged range (idx), and use max() to safely prevent the
outer boundary from being truncated.
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Jinjie Ruan
|
761eda315a |
powerpc/kexec_file: Fix null-ptr-def in extra size calculation
A static Sashiko AI review identified a potential NULL pointer
dereference in kexec_extra_fdt_size_ppc64().
On platforms without any reserved memory regions,
get_reserved_memory_ranges() can return 0 while leaving 'rmem'
unallocated as NULL. Passing it directly leads to a kernel panic when
evaluating 'rmem->nr_ranges'.
Add a NULL check for 'rmem' to prevent this crash.
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Jinjie Ruan
|
4cc4b58600 |
powerpc/crash: Fix possible memory leak in update_crash_elfcorehdr()
In get_crash_memory_ranges(), if crash_exclude_mem_range() failed
after realloc_mem_ranges() has successfully allocated the cmem
memory, it just returns an error but leaves cmem pointing to
the allocated memory, nor is it freed in the caller
update_crash_elfcorehdr(), which cause a memory leak, goto out
to free the cmem.
Fixes:
|
||
Rosen Penev
|
b9254d222d |
powerpc/44x: Set GPIO chip parent
The PPC4xx GPIO driver stopped assigning an explicit parent
to the gpio_chip when it moved away from of_mm_gpiochip_add_data().
Restore that association from the platform device so OF GPIO lookup
can match phandles to the registered gpiochip.
Tested on: Cisco MX60W. No more probe deferral.
Assisted-by: Codex:GPT-5.5
Fixes:
|
||
Christophe Leroy (CS GROUP)
|
ca16219e9b |
powerpc: implement get_direction() in cpm2
The lack of get_direction() callback in this driver causes GPIOLIB to
emit a warning. Implement it.
Fixes:
|
||
Thorsten Blum
|
be57ed7694 |
powerpc/serial: Use generic BASE_BAUD in asm/serial.h
Include asm-generic/serial.h and use the generic BASE_BAUD definition instead of redefining it. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Reviewed-by: Amit Machhiwal <amachhiw@linux.ibm.com> Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260729223807.570178-3-thorsten.blum@linux.dev |
||
|
Thorsten Blum
|
3b232a0cce |
powerpc/boot: Remove unused sprintf()
There have been no sprintf() callers in the boot wrapper since commit
|
||
|
Thorsten Blum
|
903cc6e454 |
powerpc/pseries: Avoid strlen() in do_{remove,update}_property()
Check only the first byte instead of scanning the entire string with strlen(). Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260721155346.121975-4-thorsten.blum@linux.dev |
||
|
Thorsten Blum
|
86bb4d74da |
powerpc/powernv: Avoid strlen() in pnv_restart()
Check only the first byte instead of scanning the entire string with strlen(). Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260721155346.121975-3-thorsten.blum@linux.dev |
||
|
Thorsten Blum
|
a2144b13a6 |
powerpc/powermac: Simplify bootx_scan_dt_build_struct()
Assign the empty string directly instead of NULL checking namep again. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260720231453.117271-2-thorsten.blum@linux.dev |
||
|
Thorsten Blum
|
6050e3196d |
powerpc/ps3: Use cpu_relax() in ps3_create_spu()
Use cpu_relax() to wait for the execution status SPE_EX_STATE_EXECUTED. Drop the comments while at it. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260720231153.116827-2-thorsten.blum@linux.dev |
||
|
Thorsten Blum
|
b6cfbfd6b2 |
powerpc/dt_cpu_ftrs: Avoid separate strlen() in scan_callback()
Check only the first byte instead of scanning the entire string with strlen(). While at it, keep dt_cpu_name static, but move it into dt_cpu_ftrs_scan_callback(), where it is assigned. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260701114428.818748-3-thorsten.blum@linux.dev |
||
|
Thorsten Blum
|
351496d6ae |
powerpc/pseries/ras: Use struct_size() to simplify fwnmi_get_errinfo()
Now that struct rtas_error_log uses a flexible array member for the extended log buffer, use struct_size() to calculate the total RTAS error log size and avoid using the hard-coded header size of 8 bytes. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260627104730.276858-4-thorsten.blum@linux.dev |
||
|
Thorsten Blum
|
6a7f74525a |
powerpc/rtasd: Use struct_size() to simplify log_rtas_len()
Now that struct rtas_error_log uses a flexible array member for the extended log buffer, use struct_size() to calculate the total RTAS error log size and avoid using the hard-coded header size of 8 bytes. Use min() to replace the open-coded implementation while at it. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260627104730.276858-3-thorsten.blum@linux.dev |
||
|
Thorsten Blum
|
7cc3d3fdc9 |
powerpc/pseries: Simplify attribute description check in papr_init()
Check only the first byte instead of scanning the entire string with strnlen(). Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260626110718.4367-2-thorsten.blum@linux.dev |
||
|
Thorsten Blum
|
c7b7cea42c |
powerpc: rtas: use get_user to simplify manage_flash_write
Drop the local 10-byte buffer. The old code copied at most 9 bytes from the user buffer, but only the first byte was used to select the RTAS operation. Use get_user() to read the command byte instead and compare it directly with '0' and '1'. Drop the explicit user buffer check, since get_user() will fail on a NULL pointer and correctly return -EFAULT instead of -EINVAL. Remove the now-obsolete string constants as well as any strncmp() and strlen() calls. Return the original count instead of a potentially capped value, since the full user write has been consumed once the command is accepted. Use unsigned int op to better match the manage_flash() interface. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260528201226.1599977-3-thorsten.blum@linux.dev |
||
|
Thorsten Blum
|
73dca15a3b |
powerpc/boot: drop redundant assignment in serial_edit_cmdline
Drop the redundant buffer assignment in serial_edit_cmdline() since the cp pointer is immediately overwritten. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260528082357.1397611-3-thorsten.blum@linux.dev |
||
|
Thorsten Blum
|
dd6c80abf4 |
powerpc/kexec_file: use snprintf to simplify setup_kdump_cmdline
Replace the manual string length accounting, memcpy(), and NUL termination with a single snprintf() call to prepend the elfcorehdr= address and to detect string truncation at the same time. Use kmalloc() to avoid unnecessarily zeroing the memory. While at it, also use "prepending" instead of "appending" in the error message. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260527000105.1081651-3-thorsten.blum@linux.dev |
||
Shrikanth Hegde
|
c2c8844316 |
powerpc: enable to run posix cpu timers in task context
Now that all kvm entry to guest paths handle the task work using the generic framework, enable HAVE_POSIX_CPU_TIMERS_TASK_WORK which allows running posix cpu timers in task context instead of running them in hardirq. This would is a necessary step towards enabling PREEMPT_RT on powerNV systems. Signed-off-by: Shrikanth Hegde <sshegde@linux.ibm.com> Signed-off-by: Vishal Chourasia <vishalc@linux.ibm.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260709092140.1753715-5-vishalc@linux.ibm.com |
||
Vishal Chourasia
|
12013e3d46 |
KVM: powerpc: Use generic xfer to guest work function
Since commit
|
||
Mukesh Kumar Chaurasiya (IBM)
|
bc87cbdb95 |
powerpc: Enable Rust for ppc64le
Enabling rust support for ppc64le. Tested on pseries Power11: ╰─❯ dmesg | grep rust [ 0.225728] Initialise system trusted keyrings [ 0.270961] rust_minimal: Rust minimal sample (init) [ 0.270968] rust_minimal: Am I built-in? true [ 0.270974] rust_minimal: test_parameter: 1 [ 0.270983] rust_misc_device: Initialising Rust Misc Device Sample [ 0.271012] rust_print: Rust printing macros sample (init) [ 0.271019] rust_print: Emergency message (level 0) without args [ 0.271023] rust_print: Alert message (level 1) without args [ 0.271026] rust_print: Critical message (level 2) without args [ 0.271030] rust_print: Error message (level 3) without args [ 0.271033] rust_print: Warning message (level 4) without args [ 0.271037] rust_print: Notice message (level 5) without args [ 0.271040] rust_print: Info message (level 6) without args [ 0.271043] rust_print: A line that is continued without args [ 0.271054] rust_print: Emergency message (level 0) with args [ 0.271064] rust_print: Alert message (level 1) with args [ 0.271072] rust_print: Critical message (level 2) with args [ 0.271077] rust_print: Error message (level 3) with args [ 0.271083] rust_print: Warning message (level 4) with args [ 0.271091] rust_print: Notice message (level 5) with args [ 0.271097] rust_print: Info message (level 6) with args [ 0.271102] rust_print: A line that is continued with args [ 0.271110] rust_print: 1 [ 0.271113] rust_print: "hello, world" [ 0.271121] rust_print: [samples/rust/rust_print_main.rs:35:5] c = "hello, world" [ 0.271129] rust_print: Arc<dyn Display> says 42 [ 0.271130] rust_print: Arc<dyn Display> says hello, world [ 0.271136] rust_print: "hello, world" [ 0.271198] usbcore: registered new interface driver rust_driver_usb [ 0.271207] rust_faux_driver: Initialising Rust Faux Device Sample [ 0.271227] faux_driver rust-faux-sample-device: Hello from faux device! [ 0.271297] rust_configfs: Rust configfs sample (init) Reviewed-by: Link Mauve <linkmauve@linkmauve.fr> Tested-by: Link Mauve <linkmauve@linkmauve.fr> Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org> Tested-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com> Link: https://github.com/Rust-for-Linux/linux/issues/105 Link: https://github.com/linuxppc/issues/issues/451 Acked-by: Gary Guo <gary@garyguo.net> Link: https://github.com/rust-lang/compiler-team/issues/987 Link: https://github.com/rust-lang/compiler-team/issues/988 Signed-off-by: Mukesh Kumar Chaurasiya (IBM) <mkchauras@gmail.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260708082454.1254320-8-mkchauras@gmail.com |
||
Link Mauve
|
73b741adb2 |
rust: Add PowerPC support
For now only Big Endian 32-bit PowerPC is supported, as that is the only hardware I have. This has been tested on the Nintendo Wii so far, but I plan on also using it on the GameCube, Wii U and Apple G4. These changes aren’t the only ones required to get the kernel to compile and link on PowerPC, libcore will also have to be changed to not use integer division to format u64, u128 and core::time::Duration, otherwise __udivdi3() and __umoddi3() will have to be added. I have tested this change by replacing the three implementations with unimplemented!() and it linked just fine. Signed-off-by: Link Mauve <linkmauve@linkmauve.fr> Link: https://github.com/Rust-for-Linux/linux/issues/105 Link: https://github.com/linuxppc/issues/issues/451 Acked-by: Gary Guo <gary@garyguo.net> Link: https://github.com/rust-lang/compiler-team/issues/986 Signed-off-by: Mukesh Kumar Chaurasiya (IBM) <mkchauras@gmail.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260708082454.1254320-7-mkchauras@gmail.com |
||
|
Link Mauve
|
c93c194e4e |
rust: Make __udivdi3() and __umoddi3() panic
The core crate currently depends on these two functions for i64/u64/ i128/u128/core::time::Duration formatting, but we shouldn’t use that in the kernel so let’s panic if they are ever called. This doesn’t yet fix drm_panic_qr.rs, which also uses __udivdi3 when CONFIG_CC_OPTIMIZE_FOR_SIZE=y, but at least makes the rest of the kernel build on PPC32. Signed-off-by: Link Mauve <linkmauve@linkmauve.fr> Signed-off-by: Mukesh Kumar Chaurasiya (IBM) <mkchauras@gmail.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260708082454.1254320-6-mkchauras@gmail.com |
||
|
Mukesh Kumar Chaurasiya (IBM)
|
e299147cdc |
rust/powerpc: Set min rustc version for powerpc
Minimum `rustc` version required for powerpc is 1.95 as some critical features required for compiling rust code for kernel are not there. For example Stable inline asm support which got merged in 1.95. Link: https://github.com/rust-lang/rust/pull/147996 Signed-off-by: Mukesh Kumar Chaurasiya (IBM) <mkchauras@gmail.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260708082454.1254320-5-mkchauras@gmail.com |
||
|
Mukesh Kumar Chaurasiya (IBM)
|
13244c0a40 |
powerpc/jump_label: adjust inline asm to be consistent
Added support for a new macro ARCH_STATIC_BRANCH_ASM in powerpc
to avoid duplication of inline asm between C and Rust. This is
inline with 'commit
|
||
|
Mukesh Kumar Chaurasiya (IBM)
|
be809b60cb |
dma-resv: Fix undefined symbol when CONFIG_DMA_SHARED_BUFFER is disabled
When building with LLVM=1 for architectures like powerpc where
CONFIG_DMA_SHARED_BUFFER is not enabled, the build fails with:
ld.lld: error: undefined symbol: dma_resv_reset_max_fences
>>> referenced by helpers.c
>>> rust/helpers/helpers.o:(rust_helper_dma_resv_unlock)
The issue occurs because:
1. CONFIG_DEBUG_MUTEXES=y is enabled
2. CONFIG_DMA_SHARED_BUFFER is not enabled
3. dma_resv_reset_max_fences() is declared in the header when
CONFIG_DEBUG_MUTEXES is set
4. But the function is only compiled in drivers/dma-buf/dma-resv.c,
which is only built when CONFIG_DMA_SHARED_BUFFER is enabled
5. Rust helpers call dma_resv_unlock() which calls
dma_resv_reset_max_fences(), causing an undefined symbol
Fix this by compiling `dma-resv.c` file only when CONFIG_DMA_SHARED_BUFFER
is enabled.
Fixes:
|
||
|
Mukesh Kumar Chaurasiya (IBM)
|
00cdfd072c |
rust: Fix "multiple candidates for rmeta dependency core" error
When building Rust code for powerpc64le with LLVM=1 and -j1, rustc encounters an error: "multiple candidates for `rmeta` dependency `core` found", with two candidates: 1. The host's standard library from the rustup toolchain 2. The kernel's custom libcore.rmeta in the rust/ directory This occurs because the build system uses `-L$(objtree)/rust` for host library builds (proc_macro2, quote, syn), which causes rustc to search the rust/ directory. During this search, rustc finds both the kernel's custom libcore.rmeta and gains access to the host's standard library, creating a conflict. The solution is to separate host libraries into a dedicated rust/host/ subdirectory and use `-L$(objtree)/rust/host` for host builds instead of `-L$(objtree)/rust`. This ensures that: 1. Host library builds (proc_macro2, quote, syn) only search rust/host/ and never encounter the kernel's libcore.rmeta 2. Proc macro builds use `-L$(objtree)/rust/host` to find their dependencies Special handling is added for rustdoc-pin_init, which is a host build (to access the alloc crate) but depends on proc macros from the main rust/ directory. It uses explicit `--extern` paths to reference the proc macros without adding `-L$(objtree)/rust`, which would reintroduce the conflict. The rust/host/ directory is added to clean-files to ensure it's removed during `make clean`. Link: https://github.com/Rust-for-Linux/linux/issues/105 Link: https://github.com/linuxppc/issues/issues/451 Signed-off-by: Mukesh Kumar Chaurasiya (IBM) <mkchauras@gmail.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260708082454.1254320-2-mkchauras@gmail.com |
||
Linus Torvalds
|
f5098b6bae | Linux 7.2-rc5 v7.2-rc5 | ||
|
Linus Torvalds
|
4235cb24ec |
vfs-7.2-rc5.fixes
Please consider pulling these changes from the signed vfs-7.2-rc5.fixes tag.
Thanks!
Christian
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCamYljAAKCRCRxhvAZXjc
ogWyAPwORZDIIsRiAQbnPs+OkYszuWCY29OeUrTf+m3z+tBTLwD+NUFtpH5XIcYJ
3jHtGXPoHjEaOVsNyIdxwnOxWfo+6ws=
=VNq0
-----END PGP SIGNATURE-----
Merge tag 'vfs-7.2-rc5.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull vfs fixes from Christian Brauner:
- vfs: Preserve the ACL_DONT_CACHE state in forget_cached_acl().
ACL_DONT_CACHE is meant to be a permanent opt-out from ACL caching
which FUSE relies on for servers that don't negotiate FUSE_POSIX_ACL.
The helper replaced it with ACL_NOT_CACHED, silently re-enabling the
cache, and as fuse doesn't invalidate the cache for such servers a
properly timed get_acl() returned stale ACLs. Comes with a fuse
selftest reproducing this.
- pidfs:
- Preserve PIDFD_THREAD when a thread pidfd is reopened via
open_by_handle_at(). PIDFD_THREAD shares the O_EXCL bit which
do_dentry_open() strips after the flags have been validated, so
the reopened pidfd silently became a process pidfd. Comes with a
selftest.
- Add a pidfs_dentry_open() helper so the regular pidfd allocation
path and the file handle path share the code that forces O_RDWR
and reapplies the pidfd flags that do_dentry_open() strips.
- Handle FS_IOC32_GETVERSION in the compat ioctl path.
- Make pidfs_ino_lock static.
- iomap:
- Fix the block range calculation in ifs_clear_range_dirty() so a
partial clear doesn't drop the dirty state of blocks the range
only partially covers.
- Support invalidating partial folios so a partial truncate or hole
punch with blocksize < foliosize doesn't leave stale dirty bits
behind.
- Only set did_zero when iomap_zero_iter() actually zeroed
something.
- Guard ifs_set_range_dirty() and ifs_set_range_uptodate() against
zero-length ranges where the unsigned last-block calculation
underflows and bitmap_set() writes far beyond the ifs->state
allocation.
- Don't merge ioends with different io_private values as the merge
could leak or corrupt the private data of the individual ioends.
- exec:
- Raise bprm->have_execfd only once the binfmt_misc interpreter has
actually been opened. The flag was set as soon as a matching 'O'
or 'C' entry was found. If the interpreter open failed with
ENOEXEC the exec fell through to the next binary format with
have_execfd raised but no executable staged and begin_new_exec()
NULL derefed past the point of no return.
- Fix an unsigned loop counter wrap in transfer_args_to_stack() on
nommu. An overlong argument or environment string pushes bprm->p
below PAGE_SIZE, the stop index becomes zero, and the loop never
terminates, wrapping its counter and copying garbage from in
front of the page array into the new process stack.
- Make binfmt_elf_fdpic only honour the first PT_INTERP like
binfmt_elf does. Each additional PT_INTERP overwrote the previous
interpreter, leaking the name allocation and the interpreter file
reference together with the write denial open_exec() took,
leaving the file unwritable for as long as the system runs.
- overlayfs:
- Compare the full escaped xattr prefix including the trailing dot.
An xattr like "trusted.overlay.overlayfoo" was misclassified as
an escaped overlay xattr.
- Check read access to the copy_file_range() source with the
source's mounter credentials.
- super: Thawing a filesystem whose block device was frozen with
bdev_freeze() deadlocked. Dropping the last block layer freeze
reference from under s_umount ends up in fs_bdev_thaw() which
reacquires s_umount on the same task. Pin the superblock with an
active reference instead and call bdev_thaw() without holding
s_umount.
- procfs: Return EACCES instead of success when the ptrace access check
for namespace links fails.
- afs: Use afs_dir_get_block() rather than afs_dir_find_block() for
block 0 in afs_edit_dir_remove(), matching afs_edit_dir_add().
- Push the memcg gating of ->nr_cached_objects() down into the btrfs
and shmem callbacks instead of skipping every callback during
non-root memcg reclaim. The blanket check short-circuited XFS whose
inode reclaim hook is intentionally driven from per-memcg contexts to
free memcg-charged slab.
- eventpoll: Pin files while checking reverse paths.
Since struct file became SLAB_TYPESAFE_BY_RCU a concurrent close
could free and recycle the file under the check which then took and
dropped the f_lock of whatever live file now occupies that slot.
* tag 'vfs-7.2-rc5.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (24 commits)
super: fix emergency thaw deadlock on frozen block devices
pidfs: make pidfs_ino_lock static
eventpoll: pin files while checking reverse paths
fs: push nr_cached_objects memcg gating into individual filesystems
afs: Fix afs_edit_dir_remove() to get, not find, block 0
iomap: prevent ioend merge when io_private differs
iomap: add comments for ifs_clear/set_range_dirty()
iomap: fix out-of-bounds bitmap_set() with zero-length range
iomap: fix incorrect did_zero setting in iomap_zero_iter()
iomap: support invalidating partial folios
iomap: correct the range of a partial dirty clear
fs/super: fix emergency thaw double-unlock of s_umount
pidfs: handle FS_IOC32_GETVERSION in compat ioctl
ovl: check access to copy_file_range source with src mounter creds
proc: Fix broken error paths for namespace links
pidfs: add pidfs_dentry_open() helper
selftests/pidfd: check PIDFD_THREAD survives open_by_handle_at()
pidfs: preserve thread pidfds reopened by file handle
ovl: fix trusted xattr escape prefix matching
selftests/fuse: add ACL_DONT_CACHE regression test
...
|
||
|
Linus Torvalds
|
72841e8e83 |
spi: Fixes for v7.2
Just a couple of small bits for the SpacemiT driver - one small fix, and a new compatible in the DT binding. -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmpmL3sACgkQJNaLcl1U h9CDnwgAggPOeUHMrQWYES7f74oTVl/kt0B1TBV6g91r8a4p0yyy7Kn6C1njBQ7n N5bgSL2EkpQRjj2d5akh42Apwb5EQZMdqICo68XElWnk0AxH6Y1PdRkfcruU9PnS t7KJEeBxdsZAJhx5ZEWZrIwjY/rbEvI+rfePgdm8kVeUUVs4ur6Zg1DNk/LgolOP xr60E5DWHIczjJ3Ae+svL5mmJ8FICFOThAYjMzGyRACB4c3znMBhzKVoNrUR6sl5 7qSf1x3WBXIYwd0RRs9YhTF6vQhlnfKfu8rPfb2S6v8rE7JmmokLr3kVFzgpph1K o893VMecWe5al0ZuE2qdf44w2Ohv0Q== =2PTr -----END PGP SIGNATURE----- Merge tag 'spi-fix-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "Just a couple of small bits for the SpacemiT driver - one small fix, and a new compatible in the DT binding" * tag 'spi-fix-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: dt-bindings: spacemit: add K3 SPI compatible spi: spacemit: Correct TX FIFO slot calculation |
||
|
Linus Torvalds
|
e6bfeebfe1 |
regulator: Fixes for v7.2
One driver specific fix where one of the MediaTek drivers duplicated some core code buggily, and a core fix for an ordering issue on startup where we could end up configuring a voltage outside of constraints due to the order in which we applied constraints. -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmpmMC4ACgkQJNaLcl1U h9DoiAf/V64CUAFspev+AtzWpx1Su9zZoSzoMM5Gj0WBuMoo4G5hZj804DQ/n8al sai+f0loMEVcblfpZNOlYagSkDgvvIc/1SQrAQ1oIxMbpotE1vn4htzGsJJuwwgL lh5GC4CsrXOSRX3VG6pJeBR6RTb9VEbkAhLoxKAJyPlcynk2KdBPwR9B1ZlCgpe6 MP2WrurEVexvuDlZdE8THYth4FXCms0uH5VLo+Q3G4r1Ayt9YpvbvG91fzJSJGti NAzAWma2GFGwQkka5sgMYHyP6rwM1vJ71mz+Bq9G5fUe6DyEp85jv993D5lq2vbH 69GO6ZTZmruCqOkDEELIKA4EpKYzZA== =3XbV -----END PGP SIGNATURE----- Merge tag 'regulator-fix-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "One driver specific fix where one of the MediaTek drivers duplicated some core code buggily, and a core fix for an ordering issue on startup where we could end up configuring a voltage outside of constraints due to the order in which we applied constraints" * tag 'regulator-fix-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: core: clamp voltage constraints before applying apply_uV regulator: mt6358: use regmap helper to read fixed LDO calibration |
||
|
Linus Torvalds
|
09b2124a47 |
Char/Misc driver fixes for 7.2-rc5
Here are a number of small char/misc/etc. driver fixes for 7.2-rc5 that resolve a bunch of different reported issues. Included in here are: - rust_binder error message reporting fix - stratix10-svc firmware driver fixes - mei driver fix - intel_th hardware tracing driver fix - comedi driver fix - uio_hv_generic driver fix - ntsync selftest fix - nsm misc driver fix - some MAINTAINER file updates All of these have been in linux-next for over a week with no reported issues. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -----BEGIN PGP SIGNATURE----- iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCamYCHg8cZ3JlZ0Brcm9h aC5jb20ACgkQMUfUDdst+ymTpwCgyyS6niRHf2Y0qx/o+i8s87h+ipoAoJeaOzb7 RWX/ZYiUEoQCtfbxmXZF =cRG6 -----END PGP SIGNATURE----- Merge tag 'char-misc-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are a number of small char/misc/etc driver fixes for 7.2-rc5 that resolve a bunch of different reported issues. Included in here are: - rust_binder error message reporting fix - stratix10-svc firmware driver fixes - mei driver fix - intel_th hardware tracing driver fix - comedi driver fix - uio_hv_generic driver fix - ntsync selftest fix - nsm misc driver fix - some MAINTAINER file updates All of these have been in linux-next for over a week with no reported issues" * tag 'char-misc-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: MAINTAINERS: Update wine-devel list address rust_binder: only print failure if error has source intel_th: fix MSC output device reference leak misc: nsm: pin the module while the device is open mei: bus: access mei_device under device_lock on cleanup misc: nsm: only unlock nsm_dev on post-lock error paths selftests: ntsync: correct CONFIG_NTSYNC name comedi: comedi_parport: deal with premature interrupt uio_hv_generic: Bind to FCopy device by default MAINTAINERS: Add Greg Kroah-Hartman to GPIB firmware: stratix10-svc: fix teardown order in remove to prevent race firmware: stratix10-svc: handle NO_RESPONSE in async poll firmware: stratix10-svc: fix FCS SMC call kernel-doc firmware: stratix10-svc: fix memory leaks and list corruption bugs |
||
|
Linus Torvalds
|
516e2cb010 |
Staging driver fixes for 7.2-rc5
Here are two small staging driver fixes for 7.2-rc5. They both resolve some reported bugs in the rtl8723bs staging driver and have been in linux-next for over a week with no reported issues. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -----BEGIN PGP SIGNATURE----- iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCamYAxA8cZ3JlZ0Brcm9h aC5jb20ACgkQMUfUDdst+ylfoQCghy7Exq7vpWMlhR8LwQucWqABsxsAnjzK86WN 8VZ68CMngObWMPH31Dx7 =sWD7 -----END PGP SIGNATURE----- Merge tag 'staging-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging driver fixes from Greg KH: "Here are two small staging driver fixes for 7.2-rc5. They both resolve some reported bugs in the rtl8723bs staging driver and have been in linux-next for over a week with no reported issues" * tag 'staging-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() staging: rtl8723bs: fix inverted HT40 secondary channel offset |
||
|
Linus Torvalds
|
3d0a01cad2 |
Serial driver fixes for 7.2-rc5
Here are two small serial driver fixes for 7.2-rc5. They are:
- sc16is7xx get_direction() callback fix, which resolves a
user-triggerable warning in the driver
- NULL pointer dereference on some platforms using the 8250_mid serial
driver
Both have been in linux-next for over a week with no reported issues.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCamYBZA8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+ykMjACgpSS04QGbBIWmMHnxBWHnDT+Z8qoAn210DRbo
l5E84oG0BSJg1i9c3mnj
=WB87
-----END PGP SIGNATURE-----
Merge tag 'tty-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
Pull serial driver fixes from Greg KH:
"Here are two small serial driver fixes for 7.2-rc5. They are:
- sc16is7xx get_direction() callback fix, which resolves a
user-triggerable warning in the driver
- NULL pointer dereference on some platforms using the 8250_mid
serial driver
Both have been in linux-next for over a week with no reported issues"
* tag 'tty-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
serial: sc16is7xx: implement gpio get_direction() callback
serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms
|
||
|
Linus Torvalds
|
79ba9db003 |
USB fixes for 7.2-rc5
Here are some small USB fixes and new device quirks and ids for 7.2-rc5. Included in here are: - usb storage quirk added - new usb serial device ids added - usb-serial device name leak and other bug fixes - small xhci driver fixes - normal batch of typec driver fixes for reported issues - usb-atm much-reported-by-syzbot fix for firmware download races - sysfs BOS device removal race fix - lots of usb gadget driver fixes for reported issues - other small USB driver fixes for other reported problems. All of these have been in linux-next this past week, many of them much longer. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -----BEGIN PGP SIGNATURE----- iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCamYE0A8cZ3JlZ0Brcm9h aC5jb20ACgkQMUfUDdst+yk0twCdFi0ivPtWtEzmP7lUNRCzmyT3MvoAoI7o6lJm E5+ID/c4mWfX/DjoPFhU =uUBv -----END PGP SIGNATURE----- Merge tag 'usb-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some small USB fixes and new device quirks and ids: - usb storage quirk added - new usb serial device ids added - usb-serial device name leak and other bug fixes - small xhci driver fixes - normal batch of typec driver fixes for reported issues - usb-atm much-reported-by-syzbot fix for firmware download races - sysfs BOS device removal race fix - lots of usb gadget driver fixes for reported issues - other small USB driver fixes for other reported problems All of these have been in linux-next this past week, many of them much longer" * tag 'usb-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (30 commits) usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path USB: serial: io_edgeport: cap received transmit credits USB: serial: option: add TDTECH MT5710-CN USB: serial: io_ti: reject oversized boot-mode firmware USB: serial: mxuport: validate firmware header size usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect usb: typec: ucsi: yoga_c630: Remove redundant duplicate altmode handling usb: typec: ucsi: Add duplicate detection to nvidia registration path usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback usb: chipidea: fix usage_count leak when autosuspend_delay is negative usb: core: sysfs: add lock to bos_descriptors_read() usb: musb: omap2430: Do not put borrowed of_node in probe usb: core: port: Deattach Type-C connector on component unbind USB: storage: add NO_ATA_1X quirk for Longmai USB Key USB: serial: ftdi_sio: add support for E+H FXA291 USB: serial: keyspan_pda: fix data loss on receive throttling usb: gadget: printer: fix infinite loop in printer_read() usb: gadget: f_midi: cancel pending IN work before freeing the midi object usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown ... |
||
|
Linus Torvalds
|
864be1277d |
tracing fix for 7.2:
- Move rb_desc->nr_page_va before updating dynamic array The rb_descr->page_va is a dynamic array counted by nr_page_va. But the updating of the page_va[] is done before the nr_page_va is incremented causing a build with CONFIG_UBSAN_BOUNDS to flag it as an overflow. Move the increment of the counted by value before the array element is updated. - Propagate errors from remote event bulk updates The return value of trace_remote_enable_event() was not being checked by remote_events_dir_enable_write() where it would silently fail. Have it check the return value and propagate that back up to user space. - Fix resource leak on mmiotrace trace_pipe close The mmiotrace tracer was created in 2008 before the trace_pipe had a close callback to allow tracers to do clean up from trace_pipe open. The trace_pipe close cleanup callback was added in 2009 but the mmiotrace tracer was not updated. It had a hack to do the cleanup in the read call, where it may leak if user space did not read the entire buffer. Add a callback to mmiotrace trace_pipe close do to the cleanup properly. - Fix a possible NULL pointer dereference in the mmiotrace tracer If the mmio_pipe_open() fails to find a PCI device, it will set the hiter->dev pointer to NULL. The read function will blindly dereference that pointer. Fix the read call to check to see if that pointer is populated before dereferencing it. - Fix union collision of module and refcnt for dynamic events In 'struct trace_event_call', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. The filter on module logic only checked if the 'module' was set to determine if the event belonged to the module. As dynamic events are always builtin, it doesn't need the 'module' field of the structure and used a refcount. But the module filtering logic would then mistaken these dynamic events as a module and call module_name(event->module) on it. Add a check to see if the event is a dynamic event and if so, do not check it for being part of the given module. - Reset the top level buffer in selftests before running instances The ftracetest selftest initializes each instance before executing the tests. But it does not reset the top level buffer. Dynamic events are only added and removed by the top level so any left over dynamic events will not be removed by the reset in the instances. Left over dynamic events can cause the tests to incorrectly fail. Reset the top level buffer before running the instances. - Make the context_switch counter 64 bit The code to read user space for a system call trace event or for a trace_marker will disable migration, enable preemption, read user space into a per CPU buffer, disable preemption and enable migration again. It checks if the per CPU context switch counter to see if it changed, and if it did not, it would know that the per CPU buffer was not touched by another task. But the save counter was 32 bit and it would compare it to the 64 bit context_switch variable. A long running system could have the context_switch variable greater that 1<<32 in which case the compare will always fail. The compare will promote the 32 bit int saved value to 64 bit and compare it to the full 64 bit counter. Since the top 32 bits of the saved value was zero, it would never match. - Fix a use-after-free of the event_enable trigger The event_enable trigger allows for enabling one event when another event is triggered. When the trigger is removed, it must go through a synchronization phase to make sure it is not triggered again. The trigger itself is delayed by the "bulk delay" logic that was recently added. But the code that frees the event_enable data used to rely on the trigger code to do the synchronization. Now that the code uses the call RCU functions (and a workqueue), that delay no longer is there. Add a callback private_data_free() function that allows triggers to clean up data after the synchronization phase has completed. - Move the module_ref counter into the delay callback Since an event of the event_enable trigger can enable an event for a module, it ups the module ref count for that event's module. This prevents the event from trying to enable an event that no longer exists and cause a use-after-free bug. The ref counter was set back down when the trigger was removed but not after thy synchronization phase. This could lead to the module data being accessed after module was unloaded. Move the module ref decrement into the private_data_free() callback of the event_enable trigger. - Add mutex to protect parser in ftrace filtering The set_ftrace_filter file uses a parsing descriptor that is allocated at open and modified by writes. If multiple threads were to write to the descriptor at the same time, it can corrupt the parser. Add a mutex around the modifications of the parser descriptor. - Fix possible corruption in perf syscall tracing The perf system call trace events can now read user space. To do so, the reads of user space enable preemption and disables it again. During this time that preemption is enabled, the task can migrate. The perf event list head is assigned via a per CPU pointer. It is done before the user space part is called. If the user space reading migrates the task to another CPU, then the head pointer is no longer valid. Re-assign the head pointer after the reading of user space to keep it using the correct data. -----BEGIN PGP SIGNATURE----- iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCamYDGhQccm9zdGVkdEBn b29kbWlzLm9yZwAKCRAp5XQQmuv6qkhYAP9G5wDTVQQzitl900iWp9rvQ2Qm5UWN JDnK2HO1elmj0AD8CRiHBI5W3O2yUmoO4bOFZ9YFXz+DqJ1jwkDs5FfqjAU= =EMD9 -----END PGP SIGNATURE----- Merge tag 'trace-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Move rb_desc->nr_page_va before updating dynamic array The rb_descr->page_va is a dynamic array counted by nr_page_va. But the updating of the page_va[] is done before the nr_page_va is incremented causing a build with CONFIG_UBSAN_BOUNDS to flag it as an overflow. Move the increment of the counted by value before the array element is updated. - Propagate errors from remote event bulk updates The return value of trace_remote_enable_event() was not being checked by remote_events_dir_enable_write() where it would silently fail. Have it check the return value and propagate that back up to user space. - Fix resource leak on mmiotrace trace_pipe close The mmiotrace tracer was created in 2008 before the trace_pipe had a close callback to allow tracers to do clean up from trace_pipe open. The trace_pipe close cleanup callback was added in 2009 but the mmiotrace tracer was not updated. It had a hack to do the cleanup in the read call, where it may leak if user space did not read the entire buffer. Add a callback to mmiotrace trace_pipe close do to the cleanup properly. - Fix a possible NULL pointer dereference in the mmiotrace tracer If the mmio_pipe_open() fails to find a PCI device, it will set the hiter->dev pointer to NULL. The read function will blindly dereference that pointer. Fix the read call to check to see if that pointer is populated before dereferencing it. - Fix union collision of module and refcnt for dynamic events In 'struct trace_event_call', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. The filter on module logic only checked if the 'module' was set to determine if the event belonged to the module. As dynamic events are always builtin, it doesn't need the 'module' field of the structure and used a refcount. But the module filtering logic would then mistaken these dynamic events as a module and call module_name(event->module) on it. Add a check to see if the event is a dynamic event and if so, do not check it for being part of the given module. - Reset the top level buffer in selftests before running instances The ftracetest selftest initializes each instance before executing the tests. But it does not reset the top level buffer. Dynamic events are only added and removed by the top level so any left over dynamic events will not be removed by the reset in the instances. Left over dynamic events can cause the tests to incorrectly fail. Reset the top level buffer before running the instances. - Make the context_switch counter 64 bit The code to read user space for a system call trace event or for a trace_marker will disable migration, enable preemption, read user space into a per CPU buffer, disable preemption and enable migration again. It checks if the per CPU context switch counter to see if it changed, and if it did not, it would know that the per CPU buffer was not touched by another task. But the save counter was 32 bit and it would compare it to the 64 bit context_switch variable. A long running system could have the context_switch variable greater that 1<<32 in which case the compare will always fail. The compare will promote the 32 bit int saved value to 64 bit and compare it to the full 64 bit counter. Since the top 32 bits of the saved value was zero, it would never match. - Fix a use-after-free of the event_enable trigger The event_enable trigger allows for enabling one event when another event is triggered. When the trigger is removed, it must go through a synchronization phase to make sure it is not triggered again. The trigger itself is delayed by the "bulk delay" logic that was recently added. But the code that frees the event_enable data used to rely on the trigger code to do the synchronization. Now that the code uses the call RCU functions (and a workqueue), that delay no longer is there. Add a callback private_data_free() function that allows triggers to clean up data after the synchronization phase has completed. - Move the module_ref counter into the delay callback Since an event of the event_enable trigger can enable an event for a module, it ups the module ref count for that event's module. This prevents the event from trying to enable an event that no longer exists and cause a use-after-free bug. The ref counter was set back down when the trigger was removed but not after thy synchronization phase. This could lead to the module data being accessed after module was unloaded. Move the module ref decrement into the private_data_free() callback of the event_enable trigger. - Add mutex to protect parser in ftrace filtering The set_ftrace_filter file uses a parsing descriptor that is allocated at open and modified by writes. If multiple threads were to write to the descriptor at the same time, it can corrupt the parser. Add a mutex around the modifications of the parser descriptor. - Fix possible corruption in perf syscall tracing The perf system call trace events can now read user space. To do so, the reads of user space enable preemption and disables it again. During this time that preemption is enabled, the task can migrate. The perf event list head is assigned via a per CPU pointer. It is done before the user space part is called. If the user space reading migrates the task to another CPU, then the head pointer is no longer valid. Re-assign the head pointer after the reading of user space to keep it using the correct data. * tag 'trace-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: perf: Fix stale head for perf syscall tracing ftrace: Add global mutex to serialize trace_parser access tracing: Delay module ref count for "enable_event" trigger tracing: Fix use-after-free freeing trigger private data tracing: Fix context switch counter truncation selftests/ftrace: Reset triggers at top level before instance loop tracing: Fix union collision of module and refcnt for dynamic events tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev tracing: Fix resource leak on mmiotrace trace_pipe close tracing: Propagate errors from remote event bulk updates tracing/remotes: Fix page_va[] access before counter update in trace_remote_alloc_buffer() |
||
|
Linus Torvalds
|
86d1022b2c |
m68knommu: fix on top off v7.2-rc4
. fix broken local SoC IO accesses for ColdFire -----BEGIN PGP SIGNATURE----- iQJEBAABCgAuFiEEmsfM6tQwfNjBOxr3TiQVqaG9L4AFAmpmCkEQHGdlcmdAa2Vy bmVsLm9yZwAKCRBOJBWpob0vgAfGEACdeDStzWowLpRvqHymL+KlOiPxkHFjaevD nlCybnL77KAu/bsY6gxKEadAplS/PCutNn4U4gtikdKPGklS8wIEMK9JttUzJhCl /Tv2sawYoTzyFj8leXi7slQowQjsj3GEhUpm0WMilRRVNENpQvpxRYos4qiScMdZ xsp9gmL8gK9UIbOYnNpPP95jOlnO9DblSllVBuPwXcsb8AX1uUj1c83720vVqfYO pH8nnhvOr1PHIbfEeDPuOGj/z0uTIgVJxa7wtvhEraLxgedTJHcKpI7HMmF3R1Yr 0yM3n3hI9XoC6FU3ySP+KQOLyrGhbd6p5uajxc8SgHoIF4QZj92IK04+z4psFfQC MNg1c3yoXY4BZX9lIsZ52JzC2dVacBIntuclYFwu0xeFHDdtp7wH38Y8pbOGwmVY ObR6fooPbv54wT53b4oiW0RvtTp1QMRbQywr1O1RRM6QUr/a9wgXcIZ+d75GBlCV NftNvvjlEvVcfHl/nuBtDj9zQpYkwL41u/L5eg9riqHllEY1JV2GPsLQWmWP3CVw OVygfxEe66dppbW+QuVK3Pl72P2yVLBqdERZFYnibMNFiy5jnGxhOZ9G0/W+ewna LsL0BbDQEBduxUrbVSkNbM34e48v5IRHVFO3PD47u3gaFvL3Z8WksacENBimT5hy btidRA+Tyg== =r9I3 -----END PGP SIGNATURE----- Merge tag 'm68knommu-fixes-on-top-off-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu Pull m68knommu fix from Greg Ungerer: - fix broken local SoC IO accesses for ColdFire * tag 'm68knommu-fixes-on-top-off-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu: m68k: coldfire: fix breakage of missed IO access update |
||
|
Linus Torvalds
|
3f97818796 |
- Disable jump/lookup tables in the x86 boot decompressor code
a bit more widely, because newer versions of LLVM started
optimizing it a bit better and introduced run-time relocations
in PIE code. (Nathan Chancellor)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmpl0uARHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1hmpxAAltRv2TwPA4MeZt10iYTG4BdwMp4OleR4
hDxqYL9T1OJev4wLujlri3/Vb1MVKG1S3YQjeG6hWAB0L+//hbx2e/nEU24uW5xb
j+0kAWSSZPUIP3KRc5Cy4mb1EXiumjk3GHnwXZpRV5XA4RRoTmpexd09J5v5KNvt
/q/c8ZzVMB8p8S1K98BdL/wMAyEHLg+iSywTdNsa8Zyw8qB8qAlRgLHTlhYjkcnO
E1+g3MY7QDEjMYDgHAMP1GHvtXTktXfp2Neo4s0WLmY/C6LEyWE/+HIDrMVuzjat
AU5IWbE0tDxGYdeyVvVoxRafFWmVg7mfnazkORp6iojbfJeVBB+IkNAVX0fbKEBT
Yx6Gcm/x0Xb2pf8zaUWE2q02Sz4WYpWrkcLZrLIVnCphyAK7K7V+I7ZkFP1reQR9
fr9RIsKC+6K5mWivFpOjkEzYp+D9Yp2OJyAgK0oE7F7Zd6u0+qpCWaM+VPHsYp41
wsVGTPgD5JP871o6ln38YskBct70E3BnzO5p10a5PbyRaaBCSBZC1XGCglIs7PS9
TmsZOI4Wc8dHzobUTXNdgOymfqXV/bQEITL8qRt9Ge2GUiUROFLp8IVzmJIADWKv
oqtoNo/vjthpFTXVZ3c4beACEaNu71bDbLjwjOdIb2W8NPY+Z+WeSkHDcg5Gt7qN
2cYWBUyhc3o=
=3e+9
-----END PGP SIGNATURE-----
Merge tag 'x86-urgent-2026-07-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fix from Ingo Molnar:
- Disable jump/lookup tables in the x86 boot decompressor code
a bit more widely, because newer versions of LLVM started
optimizing it a bit better and introduced run-time relocations
in PIE code (Nathan Chancellor)
* tag 'x86-urgent-2026-07-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/boot/compressed: Disable jump tables
|
||
|
Linus Torvalds
|
a6671109d6 |
- SMP-call fixes when CSD lock debugging is enabled (Chuyi Zhou)
Signed-off-by: Ingo Molnar <mingo@kernel.org> -----BEGIN PGP SIGNATURE----- iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmpl0OURHG1pbmdvQGtl cm5lbC5vcmcACgkQEnMQ0APhK1jnng/9HrimCemEFDFpbyfbqf5ucrV8FyrbIWIX HgxpXYKpOAobz2d0DYA0dn7y+HGVJr9rU7tLxeLpH+NSsT+nm/wva+2D0X4h8Lod VKNFXI1EeQ6GJ0bmRY/DBv2GKPrYfnb1gzn/HO6KE/GITWO79Uq48K/4GTE+mbR6 l++YilPqJfujYA6IlnxdexSJNZUkNbL8lDHsxBm0xM+TyG5JP+xpdHZLpU6Tf5fd l+DcTg6KriS1T+PqAWa+2BXhMhJg2BTEZmH3mU3uvqv8EDMyTUpP4X/f0JLVU/qi 24aFDCrd5zwDey58CXnOhybzpgH7Em8/1GMN5t+6eJBtPt4Hd48h7XVgJeGZje8t yxxtruQ/c5NiKYCoHPro0uMPYu6SWaz8k/h8U2dHqtg6nswVTv89V7jSno8UGsW0 W+vJcDpO3KlfHDRXLQg2E+/WRpQzD5bUeaV9/d0x/4BzokmSDNlafMNZ/bL0RUT+ I0ij4TI16RQNSMxUMTLRC9SP4n1YyH0VMGRn9goTEns2DBdl8Y+xHH+Cnk4RedwX 9MmTLvHyuKHh5VeytWlvNbQD7+L13neec/Hlhw7/sLH7+LMUJfeMM6y4roWQvDuG /5lIT/7P/ketFzgQSGVMtaUi3ZCgfT4ZCS6X6KyaSe3F654Jt0ZpdyUQ9t1Xc42U Z+QM5jJ/4gY= =6nVN -----END PGP SIGNATURE----- Merge tag 'smp-urgent-2026-07-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull SMP debug fixes from Ingo Molnar: - SMP-call fixes when CSD lock debugging is enabled (Chuyi Zhou) * tag 'smp-urgent-2026-07-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: smp: Make CSD lock acquisition atomic for debug mode smp: Avoid invalid per-CPU CSD lookup with CSD lock debug |
||
Christian Brauner
|
749d7aa037 |
super: fix emergency thaw deadlock on frozen block devices
do_thaw_all_callback() calls bdev_thaw() while holding sb->s_umount
exclusively. If the block device was frozen via bdev_freeze() dropping
the last block layer freeze reference calls fs_bdev_thaw() which
reacquires s_umount:
do_thaw_all_callback(sb)
super_lock_excl(sb) # holds sb->s_umount
bdev_thaw(sb->s_bdev)
mutex_lock(&bdev->bd_fsfreeze_mutex)
# bd_fsfreeze_count drops 1 -> 0
bd_holder_ops->thaw == fs_bdev_thaw
get_bdev_super(bdev)
bdev_super_lock(bdev, true)
super_lock(sb, true)
down_write(&sb->s_umount) # same task: deadlock
The emergency thaw worker deadlocks against itself holding both
s_umount and bd_fsfreeze_mutex. That fscks any subsequent unmount,
freeze, or thaw of that filesystem and block device.
[ 81.878470] sysrq: Show Blocked State
[ 81.880140] task:kworker/0:1 state:D stack:0 pid:11 tgid:11 ppid:2 task_flags:0x4208060 flags:0x00080000
[ 81.884876] Workqueue: events do_thaw_all
[ 81.886656] Call Trace:
[ 81.887759] <TASK>
[ 81.888763] __schedule+0x579/0x1420
[ 81.890372] schedule+0x3a/0x100
[ 81.891794] schedule_preempt_disabled+0x15/0x30
[ 81.893848] rwsem_down_write_slowpath+0x1ea/0x900
[ 81.895191] ? __pfx_do_thaw_all_callback+0x10/0x10
[ 81.896528] down_write+0xbd/0xc0
[ 81.897505] super_lock+0x91/0x180
[ 81.898457] ? __mutex_lock+0xa99/0x1140
[ 81.900748] ? __mutex_unlock_slowpath+0x1f/0x400
[ 81.902069] bdev_super_lock+0x5b/0x150
[ 81.903132] get_bdev_super+0x10/0x60
[ 81.904042] fs_bdev_thaw+0x23/0xf0
[ 81.904755] bdev_thaw+0x82/0x100
[ 81.905484] do_thaw_all_callback+0x2c/0x50
[ 81.906298] __iterate_supers+0x5d/0x130
[ 81.907067] do_thaw_all+0x20/0x40
[ 81.907739] process_one_work+0x206/0x5e0
[ 81.908545] worker_thread+0x1e2/0x3c0
[ 81.909339] ? __pfx_worker_thread+0x10/0x10
[ 81.910171] kthread+0xf4/0x130
[ 81.910799] ? __pfx_kthread+0x10/0x10
[ 81.911528] ret_from_fork+0x2e2/0x3b0
[ 81.912259] ? __pfx_kthread+0x10/0x10
[ 81.913010] ret_from_fork_asm+0x1a/0x30
[ 81.913806] </TASK>
bdev_super_lock() even documents the violated requirement with
lockdep_assert_not_held(&sb->s_umount).
Acquiring bd_fsfreeze_mutex under s_umount also inverts the
bd_fsfreeze_mutex vs. s_umount ordering established by
bdev_{freeze,thaw}() and can thus ABBA against a concurrent block-layer
freeze even when the recursive path isn't hit.
Fix this by not holding s_umount around the bdev_thaw() loop at all. Pin
the superblock with an active reference instead as
filesystems_freeze_callback() does. The active reference keeps the
superblock from being shut down and so ->s_bdev stays valid without
holding s_umount. The block-layer-held freeze is dropped by
fs_bdev_thaw() with FREEZE_MAY_NEST | FREEZE_HOLDER_USERSPACE exactly as
a regular unfreeze would and thaw_super_locked() handles
filesystem-level freezes as before.
The emergency thaw path has deadlocked like this in one form or
another for a long long time but the current exclusively-held
shape dates back to commit [1] where thaw_bdev() already ended in
thaw_super() with s_umount held by do_thaw_all_callback().
Fixes:
|
||
|
Linus Torvalds
|
3dab139d47 |
Rust fixes for v7.2 (2nd)
Toolchain and infrastructure:
- 'zerocopy' crates: update to v0.8.54 to fix a modpost error under
'CONFIG_CC_OPTIMIZE_FOR_SIZE=y'.
There are actually two updates in the PR: the one to v0.8.52 is
fairly large and was originally not intended for a fixes PR, but the
actual fix landed in the v0.8.54 one. Thus I included both here.
The v0.8.52 update includes two things upstream added for us:
'--cfg no_fp_fmt_parse' to avoid a local workaround, and the new
'most_traits' feature.
The good news is that, after these updates, the delta with upstream
is now trivial: only an identifier prefix change and the SPDX
parentheses.
- Fix an objtool warning by adding one more 'noreturn' function for
Rust 1.99.0 (expected 2026-10-01).
- Clean up new 'semicolon_in_expressions_from_macros' lint errors for
Rust 1.99.0 (expected 2026-10-01). The lint can be allowed, but it
will be a hard error at some point in the future anyway, so clean it
up now.
- Locally allow new 'suspicious_runtime_symbol_definitions' lint for
Rust 1.98.0 (expected 2026-08-20).
- Globally allow 'clippy::unwrap_or_default' lint since it relies on
optimizations -- under 'CONFIG_CC_OPTIMIZE_FOR_SIZE=y' it does not
work well.
'kernel' crate:
- 'time' module: fix 'Delta::as_micros_ceil()' to round negative values
correctly.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEPjU5OPd5QIZ9jqqOGXyLc2htIW0FAmpk6V4ACgkQGXyLc2ht
IW24OQ/7B2pQtg8IE/6fvkPO7I+EPGknkiutPczrh0HFJ2x0rSaC69NVjkV3d5nq
KWk1zOPPzxMoOeIEOR/e8iAMfo9B093mlohappwMKLZGju2x+K6JA+rn6HsvTLiv
fGgjM7hq3B7ExBCon7qDQLYh6cib9T90e9IJrE8rnitbJ8QkUSqXTwCqUbkN7pOt
U5GUX9yHxo9slc9XYy3AC8aifqaBNeUWzfn6a7DN7nLUNhm5AYiYyduvU6QZQ1kR
ezinZn3Jqv+VrpXcuM2x2iMMJCdFILzXdnrhPWoT8whc9GzNWVArkSIYFefvjgvK
Yb+gppVjEuKwsT81eoMwD9edD+wL/4MSU6lnW4eN0EhgECSy7HZs2Jjv1UIrPPSH
ZvVp6Bzn0nuXed4fh+mrqvwmltqnDpVK06c/q6M8u5mQ/HURwCsh43M7X7S4Sm0p
X8AutCjsWj+uP44ZnC/Y5p/r3tFl+HM55YT/favb54Xzq+SDrMtSQ7HFM7CZaDHd
g1B/SBlCTs1O1htqNDWqzew8HdoLfRueZf9tRnTCYSlvOgjSgBB9561m2wfgVE86
yrwPnaYZeipny2hVh+iCiZGDvrqKh+r4nMB8R8X61qjWC7/szjsxs3IiCUpPpMJB
3omYUm3nOxzZjYp9uK0E+YW+BITjC8VrP6XWUnzedfas1bds63k=
=4BpZ
-----END PGP SIGNATURE-----
Merge tag 'rust-fixes-7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux
Pull rust fixes from Miguel Ojeda:
"Toolchain and infrastructure:
- 'zerocopy' crates: update to v0.8.54 to fix a modpost error under
'CONFIG_CC_OPTIMIZE_FOR_SIZE=y'.
There are actually two updates in the PR: the one to v0.8.52 is
fairly large and was originally not intended for a fixes PR, but the
actual fix landed in the v0.8.54 one. Thus I included both here.
The v0.8.52 update includes two things upstream added for us:
'--cfg no_fp_fmt_parse' to avoid a local workaround, and the new
'most_traits' feature.
The good news is that, after these updates, the delta with upstream
is now trivial: only an identifier prefix change and the SPDX
parentheses.
- Fix an objtool warning by adding one more 'noreturn' function for
Rust 1.99.0 (expected 2026-10-01).
- Clean up new 'semicolon_in_expressions_from_macros' lint errors for
Rust 1.99.0 (expected 2026-10-01). The lint can be allowed, but it
will be a hard error at some point in the future anyway, so clean it
up now.
- Locally allow new 'suspicious_runtime_symbol_definitions' lint for
Rust 1.98.0 (expected 2026-08-20).
- Globally allow 'clippy::unwrap_or_default' lint since it relies on
optimizations -- under 'CONFIG_CC_OPTIMIZE_FOR_SIZE=y' it does not
work well.
'kernel' crate:
- 'time' module: fix 'Delta::as_micros_ceil()' to round negative values
correctly"
* tag 'rust-fixes-7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:
rust: time: fix as_micros_ceil() to round correctly for negative Delta
rust: device: avoid trailing ; in printing macros
objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0
rust: zerocopy: update to v0.8.54
rust: zerocopy: update to v0.8.52
rust: allow `clippy::unwrap_or_default` globally
rust: allow `suspicious_runtime_symbol_definitions` lint for Rust >= 1.98
|
||
|
Linus Torvalds
|
ef9ce800df |
perf tools fixes for v7.2.
- Update header copies of kernel headers, including const.h, fs.h, perf_event.h, gfp_types.h, kvm.h, cpufeatures.h, rtnetlink.hp, msr-index.h, drm.h and socket.h. - Add some build files related to BPF skels to .gitignore. Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQR2GiIUctdOfX2qHhGyPKLppCJ+JwUCamSrfQAKCRCyPKLppCJ+ J41WAQCqkEX7tpYp9F1f/lhzLjeeBc1dcvddAgrlzr/79E0Y8AD8ChH8SMc95ERH rOrpIKhflMUQw5EazDW/AczabIZfcQs= =2+4S -----END PGP SIGNATURE----- Merge tag 'perf-tools-fixes-for-v7.2-1-2026-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf tools fixes from Arnaldo Carvalho de Melo: - Update header copies of kernel headers, including const.h, fs.h, perf_event.h, gfp_types.h, kvm.h, cpufeatures.h, rtnetlink.hp, msr-index.h, drm.h and socket.h - Add some build files related to BPF skels to .gitignore * tag 'perf-tools-fixes-for-v7.2-1-2026-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: tools headers: Sync KVM headers with the kernel sources tools headers: Sync UAPI linux/fs.h with the kernel sources perf beauty: Update copy of linux/socket.h with the kernel sources tools headers: Sync UAPI drm/drm.h with kernel sources tools arch x86: Sync the msr-index.h copy with the kernel sources tools headers x86 cpufeatures: Sync with the kernel sources tools headers: Sync linux/gfp_types.h with the kernel sources tools headers UAPI: Sync linux/rtnetlink.h with the kernel sources tools headers UAPI: Sync linux/const.h with the kernel sources perf bench bpf: Add missing .gitignore file |
||
|
Linus Torvalds
|
d99d2a953a |
firewire fixes for 7.2-rc5
Fix a bug in unit driver for RFC 2734 IPv4 over IEEE 1394. The driver failed to reassemble a complete datagram when it was stored across multiple buffer ranges in the list. Ruoyu Wang reported and fixed it. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQQE66IEYNDXNBPeGKSsLtaWM8LwEwUCamSU6gAKCRCsLtaWM8Lw E/B8AQDAi36W7MJ/y+pcbYA0BQHE/hsr/BbVsx3LmuR2WrHKFwD/WXat4OwVtdVc ZkrO1gwRE263p3UGpqFEftZdS976xgw= =z/i1 -----END PGP SIGNATURE----- Merge tag 'firewire-fixes-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire fix from Takashi Sakamoto: "Fix a bug in unit driver for RFC 2734 IPv4 over IEEE 1394. The driver failed to reassemble a complete datagram when it was stored across multiple buffer ranges in the list. Ruoyu Wang reported and fixed it" * tag 'firewire-fixes-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: firewire: net: Fix fragmented datagram reassembly |
||
|
Linus Torvalds
|
3fb11702e4 |
LoongArch fixes for v7.2-rc5
-----BEGIN PGP SIGNATURE----- iQJKBAABCAA0FiEEzOlt8mkP+tbeiYy5AoYrw/LiJnoFAmpjKJIWHGNoZW5odWFj YWlAa2VybmVsLm9yZwAKCRAChivD8uImeulhD/9Oe/6FLvyuK4KYi+0DyacU4FZ4 NQjgFa3g2CBY+qiS6qSjzygbClFLZjkhbXsOaQekQjiYWNCKwTCJGg0m/y+qNS+S F1UWxuZxVor1ty4y6KSldCHtdI5ROSXf2Iq3UNw2JX2W8LK0r/asLvFpkIHGcDdJ kqMnD4aktxgs+RYZVs9rQrS0cR8mQom6KVu39/4KB/6QulEMEaH857txobexlaTo 7Jo/I3fcsxbcWxo+I6yZSdSkIBRI5H6eywbHgF0ug7cOmpQL70IGIx0S42XK7RUy A/A7BrPN1JMFTloDSHTX6b05lCh4UEhLBbFgX3ztVCNXt0j5v7/y5dqISwn4qlDP LkPEx/LQ1GsHQu9pqDN3gpD/G/RK+DvpA4p6+GpDrrQ7PQFMIKuzcil7LeZZ0C7H VNbt7QP+HgPHezNroOMp16/PeEBLp2tkO1bqjCf/gRc47OPqLQtOiPJOK0B9yFzw x4J8SRwxjqrg/TYYfP5lOhqafF0cp7ZE7LSlCMwylnZ6EYHaeEJh14ii5u36XJuj ohu83vsobIRa9fJ7StQ8Hf6nJSGSoWpkn6WIAxiL/+Ksz4gzfe+5TNEoBg1cGqjX XBS/qVj0ju06QVrg4H8X9gKEt7LQN+nIXBCg/OXSD75pdM/wlO08PANygU4FXUbE /Q3RTJykzBT4P1TETg== =BlSV -----END PGP SIGNATURE----- Merge tag 'loongarch-fixes-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: - fix build warnings and errors - move jump_label_init() before parse_early_param() - retrieve CPU package ID from PPTT when available - fix some bugs kgdb, BPF JIT and laptop platform driver bugs * tag 'loongarch-fixes-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: platform/loongarch: laptop: Explicitly reset bl_powered state when suspend platform/loongarch: laptop: Stop setting acpi_device_class() LoongArch: BPF: Fix memory leak in bpf_jit_free() LoongArch: BPF: Zero-extend signed ALU32 div/mod results LoongArch: Fix oops during single-step debugging LoongArch: Fix address space mismatch in kexec command line lookup LoongArch: Retrieve CPU package ID from PPTT when available LoongArch: Move jump_label_init() before parse_early_param() LoongArch: Fix build errors due to wrong instructions for 32BIT LoongArch: Increase TASK_STRUCT_OFFSET up to 2040 for 32BIT |