Commit graph

1,464,522 commits

Author SHA1 Message Date
Linus Torvalds
dee65f7936 lsm/stable-6.19 PR 20260202
-----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCgAyFiEES0KozwfymdVUl37v6iDy2pc3iXMFAmmA0HcUHHBhdWxAcGF1
 bC1tb29yZS5jb20ACgkQ6iDy2pc3iXMPrg/7BPDOeAatY8n+me4BahevlI9MkGBp
 KFwbq2iKObO9lMyp6uJUYz0OpBdUZ7DcTAoaxqbnEKF0qix5IgFJS3Gs3QrG94JN
 kQwJeKkBJDIJum86tQ+ewoLYutGqxraklflbZKJ5c56733MgSJB9S0u/fJrDVOMV
 7HOKnyFFc+o3G2mmc3EW1EWpC33FK/e0ocOTFDXQNYeyo/jTenoxloyG6F+TS3kT
 BTj3KF+25KiX2Isl8SfV/Os8m50AyTUDkMLk3sawt0v1xT5nxGwKFoHa1tftvFpx
 A2LrI6YeZvkD57XXISiFJV1FSjAsMSEbJYmx1HPxQrjXZwxqAaJEnJMqysWuXP/Q
 1smImPcaYIv9kmCDNBLkXtNhjH/P4QCHcwxBfzPm7cLtKg1n8HP/AWn2KbXiyPfO
 hArNp/besQA900FXNHRb0eY1appPoXKK2W0JKmOiY+zS5ASjadNNqJFC7RxoJTeN
 3vdr7lVXHwrpaOtsoWp0RdTbfCdiG2mjsM36DZgTsVt1EvdFM6l6HGSVNjrmQF7q
 zaYVgvqCpulKFOcV6Y0etK8bnYdE3JTskDVWzmMHEidae3zHzVVMKh5BuTnOYBqs
 ZcfiSU/cdnpLzkK6WzEvDClHC4y4i8aII9DR595AZTbSty9h3kAy9Y5qLBObUrIH
 Ai6q0Xp9zFDhzl4=
 =2qEz
 -----END PGP SIGNATURE-----

Merge tag 'lsm-pr-20260202' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm

Pull lsm fix from Paul Moore:
 "A small patch to address a regression found in the v6.19-rcX releases
  where the /proc/sys/vm/mmap_min_addr tunable disappeared when
  CONFIG_SECURITY was not selected.

  Long term we plan to work with the MM folks to get the core parts of
  this moved over to the MM subsystem, but in the meantime we need to
  fix this regression prior to the v6.19 release"

* tag 'lsm-pr-20260202' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm:
  lsm: preserve /proc/sys/vm/mmap_min_addr when !CONFIG_SECURITY
2026-02-02 09:48:23 -08:00
Chaitanya Kumar Borah
f89dbe14a0 drm/xe/guc: Fix kernel-doc warning in GuC scheduler ABI header
The GuC scheduler ABI header contains a file-level comment that is not
intended to document a kernel-doc symbol. Using kernel-doc comment
syntax (/** */) triggers kernel-doc warnings.

With "-Werror", this causes the build to fail. Convert the comment to a
regular block comment.

HDRTEST drivers/gpu/drm/xe/abi/guc_scheduler_abi.h
Warning: drivers/gpu/drm/xe/abi/guc_scheduler_abi.h:11 This comment starts with '/**', but isn't a kernel-doc comment. Refer to Documentation/doc-guide/kernel-doc.rst
 * Generic defines required for registration with and submissions to the GuC
1 warnings as errors
make[6]: *** [drivers/gpu/drm/xe/Makefile:377: drivers/gpu/drm/xe/abi/guc_scheduler_abi.hdrtest] Error 3
make[5]: *** [scripts/Makefile.build:544: drivers/gpu/drm/xe] Error 2
make[4]: *** [scripts/Makefile.build:544: drivers/gpu/drm] Error 2
make[3]: *** [scripts/Makefile.build:544: drivers/gpu] Error 2
make[2]: *** [scripts/Makefile.build:544: drivers] Error 2
make[1]: *** [/home/kbuild2/kernel/Makefile:2088: .] Error 2
make: *** [Makefile:248: __sub-make] Error 2

v2:
 - Add Fixes tag (Daniele)

Fixes: b0c5cf4f59 ("drm/gt/guc: extract scheduler-related defines from guc_fwif.h")
Signed-off-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com>
Reviewed-by: Shuicheng Lin <shuicheng.lin@intel.com>
Reviewed-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
Link: https://patch.msgid.link/20260130135210.2659200-1-chaitanya.kumar.borah@intel.com
2026-02-02 09:13:31 -08:00
Daniele Ceraolo Spurio
dd8ea2f2ab drm/xe/guc: Fix CFI violation in debugfs access.
xe_guc_print_info is void-returning, but the function pointer it is
assigned to expects an int-returning function, leading to the following
CFI error:

[  206.873690] CFI failure at guc_debugfs_show+0xa1/0xf0 [xe]
(target: xe_guc_print_info+0x0/0x370 [xe]; expected type: 0xbe3bc66a)

Fix this by updating xe_guc_print_info to return an integer.

Fixes: e15826bb3c ("drm/xe/guc: Refactor GuC debugfs initialization")
Signed-off-by: Daniele Ceraolo Spurio <daniele.ceraolospurio@intel.com>
Cc: Michal Wajdeczko <michal.wajdeczko@intel.com>
Cc: George D Sworo <george.d.sworo@intel.com>
Reviewed-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Link: https://patch.msgid.link/20260129182547.32899-2-daniele.ceraolospurio@intel.com
2026-02-02 09:12:56 -08:00
Dmitry Antipov
0a83293322 doc: development-process: add notice on testing
Add testing notice to "Before creating patches" section.

Suggested-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Acked-by: Randy Dunlap <rdunlap@infradead.org>
Acked-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260123071523.1392729-1-dmantipov@yandex.ru>
2026-02-02 10:02:05 -07:00
Gabor Juhos
52fb36a5f9 hwmon: (gpio-fan) Allow to stop FANs when CONFIG_PM is disabled
When CONFIG_PM is disabled, the GPIO controlled FANs can't be stopped by
using the sysfs attributes since commit 0d01110e63 ("hwmon: (gpio-fan)
Add regulator support").

Using either the 'pwm1' or the 'fan1_target' attribute fails the same way:

  $ echo 0 > /sys/class/hwmon/hwmon1/pwm1
  ash: write error: Function not implemented
  $ echo 0 > /sys/class/hwmon/hwmon1/fan1_target
  ash: write error: Function not implemented

Both commands were working flawlessly before the mentioned commit.

The issue happens because pm_runtime_put_sync() returns with -ENOSYS
when CONFIG_PM is disabled, and the set_fan_speed() function handles
this as an error.

In order to restore the previous behaviour, change the error check in
the set_fan_speed() function to ignore the -ENOSYS error code.

Cc: stable@vger.kernel.org
Fixes: 0d01110e63 ("hwmon: (gpio-fan) Add regulator support")
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
Link: https://lore.kernel.org/r/20260202-gpio-fan-stop-fix-v1-1-c7853183d93d@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-02-02 09:00:28 -08:00
Gabor Juhos
f5c092787c hwmon: (gpio-fan) Fix set_rpm() return value
The set_rpm function is used as a 'store' callback of a device attribute,
and as such it should return with the number of bytes consumed. However
since commit 0d01110e63 ("hwmon: (gpio-fan) Add regulator support"),
the function returns with zero on success.

Due to this, the function gets called again and again whenever the user
tries to change the FAN speed by writing the desired RPM value into the
'fan1_target' sysfs attribute.

The broken behaviour can be reproduced easily. For example, the following
command never returns unless it gets terminated:

  $ echo 500 > /sys/class/hwmon/hwmon1/fan1_target
  ^C
  $

Change the code to return with the same value as the 'count' parameter
on success to indicate that all bytes from the input buffer are consumed.
The function behaved the same way prior to the offending change.

Cc: stable@vger.kernel.org
Fixes: 0d01110e63 ("hwmon: (gpio-fan) Add regulator support")
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
Link: https://lore.kernel.org/r/20260201-gpio-fan-set_rpm-retval-fix-v1-1-dc39bc7693ca@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-02-02 09:00:12 -08:00
David Howells
91db696ade pkcs7: Allow authenticatedAttributes for ML-DSA
Allow the rejection of authenticatedAttributes in PKCS#7 (signedAttrs in
CMS) to be waived in the kernel config for ML-DSA when used for module
signing.  This reflects the issue that openssl < 4.0 cannot do this and
openssl-4 has not yet been released.

This does not permit RSA, ECDSA or ECRDSA to be so waived (behaviour
unchanged).

Signed-off-by: David Howells <dhowells@redhat.com>
cc: Lukas Wunner <lukas@wunner.de>
cc: Ignat Korchagin <ignat@cloudflare.com>
cc: Jarkko Sakkinen <jarkko@kernel.org>
cc: Stephan Mueller <smueller@chronox.de>
cc: Eric Biggers <ebiggers@kernel.org>
cc: Herbert Xu <herbert@gondor.apana.org.au>
cc: keyrings@vger.kernel.org
cc: linux-crypto@vger.kernel.org
2026-02-02 16:58:21 +00:00
Mauro Carvalho Chehab
64e4882c82 tools: sphinx-build-wrapper: improve its help message
Besides the parameters that are passed via command line arguments,
the wrapper's behavior is affected by several environment variables.

Document that. While here, use __doc__ for its description.

Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <e0ccee75f7e7fb499e0f59d5b84469f4b6a21627.1769500383.git.mchehab+huawei@kernel.org>
2026-02-02 09:57:46 -07:00
Mauro Carvalho Chehab
b09cc1ddde docs: sphinx-build-wrapper: allow -v override -q
Documentation builds were using "-q" for a long time, but sometimes
it is nice to see the Sphinx progress, without increasing build
verbosity - which would also turn on kernel-doc verbosity.

Instead of doing that, let's parse the sphinx-build already-existing
-v: each time it is used, it increases the verbosity level.

With that, if the default is to use -q, a single -v will disable
quiet mode. Passing more -v will keep increasing its verbosity.

Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <38b24e97a3cbd2def418359a8e69b1b087a945ad.1769500383.git.mchehab+huawei@kernel.org>
2026-02-02 09:57:46 -07:00
Mauro Carvalho Chehab
98f51c466a docs: kdoc: Fix pdfdocs build for tools
the "\1" inside a docstring requires proper scaping to not be
considered a hex character and break the build.

Reported-by: Akira Yokosawa <akiyks@gmail.com>
Closes: https://lore.kernel.org/linux-doc/63e99049-cc72-4156-83af-414fdde34312@gmail.com/
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <2fff8ef1d0d64e8b68f15f5c07613f302d773855.1769500383.git.mchehab+huawei@kernel.org>
2026-02-02 09:57:46 -07:00
David Howells
0ad9a71933 modsign: Enable ML-DSA module signing
Allow ML-DSA module signing to be enabled.

Note that OpenSSL's CMS_*() function suite does not, as of OpenSSL-3.6,
support the use of CMS_NOATTR with ML-DSA, so the prohibition against using
signedAttrs with module signing has to be removed.  The selected digest
then applies only to the algorithm used to calculate the digest stored in
the messageDigest attribute.  The OpenSSL development branch has patches
applied that fix this[1], but it appears that that will only be available
in OpenSSL-4.

[1] https://github.com/openssl/openssl/pull/28923

sign-file won't set CMS_NOATTR if openssl is earlier than v4, resulting in
the use of signed attributes.

The ML-DSA algorithm takes the raw data to be signed without regard to what
digest algorithm is specified in the CMS message.  The CMS specified digest
algorithm is ignored unless signedAttrs are used; in such a case, only
SHA512 is permitted.

Signed-off-by: David Howells <dhowells@redhat.com>
cc: Jarkko Sakkinen <jarkko@kernel.org>
cc: Eric Biggers <ebiggers@kernel.org>
cc: Lukas Wunner <lukas@wunner.de>
cc: Ignat Korchagin <ignat@cloudflare.com>
cc: Stephan Mueller <smueller@chronox.de>
cc: Herbert Xu <herbert@gondor.apana.org.au>
cc: keyrings@vger.kernel.org
cc: linux-crypto@vger.kernel.org
2026-02-02 16:57:39 +00:00
Akiyoshi Kurita
12ea2cff02 docs: ja_JP: process: translate 'Obtain a current source tree'
Translate the "Obtain a current source tree" section in
Documentation/translations/ja_JP/process/submitting-patches.rst.

Signed-off-by: Akiyoshi Kurita <weibu@redadmin.org>
Reviewed-by: Akira Yokosawa <akiyks@gmail.com>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260127130155.16935-1-weibu@redadmin.org>
2026-02-02 09:55:54 -07:00
Johannes Berg
19dd0cc36a ath.git patches for v6.20/v7.0 (#3)
A set of small features and cleanups for the next merge window.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQ/mtSHzPUi16IfDEksFbugiYzLewUCaYC1fQAKCRAsFbugiYzL
 ewYLAQDbVliEG5O2mVij/CIwUwfkvuYim9xolxec+TzfwShPsAD+NM4qAuHTFKOp
 bK0hF4v+Bxy03SE/5QuhPZsC1RsQTgE=
 =1LW5
 -----END PGP SIGNATURE-----

Merge tag 'ath-next-20260202' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath

Jeff Johnson says:
==================
ath.git patches for v6.20/v7.0 (#3)

A set of small features and cleanups for the next merge window.
==================

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-02-02 17:55:23 +01:00
Rhys Tumelty
78a00cac1e docs: fix 're-use' -> 'reuse' in documentation
Signed-off-by: Rhys Tumelty <rhys@tumelty.co.uk>
Acked-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260128220233.179439-1-rhys@tumelty.co.uk>
2026-02-02 09:54:15 -07:00
Gabriel Whigham
1482f61ccd docs: ioctl-number: fix a typo in ioctl-number.rst
"userspace" was misspelled as "userpace".

Signed-off-by: Gabriel Whigham <gabewhigham@gmail.com>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260130042131.51975-1-gabewhigham@gmail.com>
2026-02-02 09:52:48 -07:00
Thomas Böhler
c0f612f8bc docs: filesystems: ensure proc pid substitutable is complete
The entry in proc.rst for 3.14 is missing the closing ">" of the "pid"
field for the ksm_stat file. Add this for both the table of contents and
the actual header for the "ksm_stat" file.

Acked-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Thomas Böhler <witcher@wiredspace.de>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260131-ksm_stat-v2-1-a8fea12d604e@wiredspace.de>
2026-02-02 09:49:03 -07:00
Robin Murphy
5c323ea948 drm/panel-edp: Move FriendlyELEC HD702E
FriendlyELEC's HD702E module is an eDP panel (in as much as it's some
LVDS LCD behind a Chrontel CH7511B eDP bridge), so move its data over
to the eDP driver, also resolving the warning about the missing bpc
value in the process.

The unfortunate combination of HPD not being wired up and the RK3399 eDP
controller's behaviour seems to result in the EDID not being readable
over DP-AUX without probing the panel first, thus the hard-coded mode is
still needed to get things going.

Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://patch.msgid.link/a00a59dcef3693efb02a8ee942848fbeaeaf05ba.1769191673.git.robin.murphy@arm.com
2026-02-02 08:48:44 -08:00
Robin Murphy
e2242223b7 dt-bindings: display: panel: Move FriendlyElec HD702E to eDP
The "E" alludes to the fact that FriendlyElec's HD702E is actually an
eDP panel - move its compatible to the appropriate binding doc.

Cc: devicetree@vger.kernel.org
Acked-by: Rob Herring (Arm) <robh@kernel.org>
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://patch.msgid.link/c7f6f75d55a4801eab63a0dc81d14ae27866aca9.1769191673.git.robin.murphy@arm.com
2026-02-02 08:48:20 -08:00
Dave Jiang
0da3050bdd Merge branch 'for-7.0/cxl-aer-prep' into cxl-for-next
Fixup and refactor downstream port enumeration to prepare for CXL port
protocol error handling. Main motivation is to move endpoint
component register mapping to a port object.

cxl/port: Unify endpoint and switch port lookup
cxl/port: Move endpoint component register management to cxl_port
cxl/port: Map Port RAS registers
cxl/port: Move dport RAS setup to dport add time
cxl/port: Move dport probe operations to a driver event
cxl/port: Move decoder setup before dport creation
cxl/port: Cleanup dport removal with a devres group
cxl/port: Reduce number of @dport variables in cxl_port_add_dport()
cxl/port: Cleanup handling of the nr_dports 0 -> 1 transition
2026-02-02 09:39:41 -07:00
Caio Ishikawa
3c55330aac drm/panel: boe-th101mb31ig002: Remove use of deprecated mipi_dsi_dcs_nop()
Replace calls to deprecated mipi_dsi_dcs_nop() with
mipi_dsi_dcs_nop_multi(). No intended functional changes.

Signed-off-by: Caio Ishikawa <caio.ishikawa@proton.me>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://patch.msgid.link/20260124124959.196051-3-caio.ishikawa@proton.me
2026-02-02 08:18:08 -08:00
ChenXiaoSong
67b3da8d30 smb/client: fix memory leak in SendReceive()
Reproducer:

  1. server: supports SMB1, directories are exported read-only
  2. client: mount -t cifs -o vers=1.0 //${server_ip}/export /mnt
  3. client: dd if=/dev/zero of=/mnt/file bs=512 count=1000 oflag=direct
  4. client: umount /mnt
  5. client: sleep 1
  6. client: modprobe -r cifs

The error message is as follows:

  =============================================================================
  BUG cifs_small_rq (Not tainted): Objects remaining on __kmem_cache_shutdown()
  -----------------------------------------------------------------------------

  Object 0x00000000d34491e6 @offset=896
  Object 0x00000000bde9fab3 @offset=4480
  Object 0x00000000104a1f70 @offset=6272
  Object 0x0000000092a51bb5 @offset=7616
  Object 0x000000006714a7db @offset=13440
  ...
  WARNING: mm/slub.c:1251 at __kmem_cache_shutdown+0x379/0x3f0, CPU#7: modprobe/712
  ...
  Call Trace:
   <TASK>
   kmem_cache_destroy+0x69/0x160
   cifs_destroy_request_bufs+0x39/0x40 [cifs]
   cleanup_module+0x43/0xfc0 [cifs]
   __se_sys_delete_module+0x1d5/0x300
   __x64_sys_delete_module+0x1a/0x30
   x64_sys_call+0x2299/0x2ff0
   do_syscall_64+0x6e/0x270
   entry_SYSCALL_64_after_hwframe+0x76/0x7e
  ...
  kmem_cache_destroy cifs_small_rq: Slab cache still has objects when called from cifs_destroy_request_bufs+0x39/0x40 [cifs]
  WARNING: mm/slab_common.c:532 at kmem_cache_destroy+0x142/0x160, CPU#7: modprobe/712

Link: https://lore.kernel.org/linux-cifs/9751f02d-d1df-4265-a7d6-b19761b21834@linux.dev/T/#mf14808c144448b715f711ce5f0477a071f08eaf6
Fixes: 6be09580df ("cifs: Make smb1's SendReceive() wrap cifs_send_recv()")
Reported-by: Paulo Alcantara <pc@manguebit.org>
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Reviewed-by: David Howells <dhowells@redhat.com>
Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Signed-off-by: Steve French <stfrench@microsoft.com>
2026-02-02 10:13:57 -06:00
ChenXiaoSong
e3a4363302 smb/client: fix memory leak in smb2_open_file()
Reproducer:

  1. server: directories are exported read-only
  2. client: mount -t cifs //${server_ip}/export /mnt
  3. client: dd if=/dev/zero of=/mnt/file bs=512 count=1000 oflag=direct
  4. client: umount /mnt
  5. client: sleep 1
  6. client: modprobe -r cifs

The error message is as follows:

  =============================================================================
  BUG cifs_small_rq (Not tainted): Objects remaining on __kmem_cache_shutdown()
  -----------------------------------------------------------------------------

  Object 0x00000000d47521be @offset=14336
  ...
  WARNING: mm/slub.c:1251 at __kmem_cache_shutdown+0x34e/0x440, CPU#0: modprobe/1577
  ...
  Call Trace:
   <TASK>
   kmem_cache_destroy+0x94/0x190
   cifs_destroy_request_bufs+0x3e/0x50 [cifs]
   cleanup_module+0x4e/0x540 [cifs]
   __se_sys_delete_module+0x278/0x400
   __x64_sys_delete_module+0x5f/0x70
   x64_sys_call+0x2299/0x2ff0
   do_syscall_64+0x89/0x350
   entry_SYSCALL_64_after_hwframe+0x76/0x7e
  ...
  kmem_cache_destroy cifs_small_rq: Slab cache still has objects when called from cifs_destroy_request_bufs+0x3e/0x50 [cifs]
  WARNING: mm/slab_common.c:532 at kmem_cache_destroy+0x16b/0x190, CPU#0: modprobe/1577

Link: https://lore.kernel.org/linux-cifs/9751f02d-d1df-4265-a7d6-b19761b21834@linux.dev/T/#mf14808c144448b715f711ce5f0477a071f08eaf6
Fixes: e255612b5e ("cifs: Add fallback for SMB2 CREATE without FILE_READ_ATTRIBUTES")
Reported-by: Paulo Alcantara <pc@manguebit.org>
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Signed-off-by: ChenXiaoSong <chenxiaosong@kylinos.cn>
Reviewed-by: Pali Rohár <pali@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
2026-02-02 10:13:57 -06:00
Ming Lei
b84bb7bd91 nvme: fix admin queue leak on controller reset
When nvme_alloc_admin_tag_set() is called during a controller reset,
a previous admin queue may still exist. Release it properly before
allocating a new one to avoid orphaning the old queue.

This fixes a regression introduced by commit 03b3bcd319 ("nvme: fix
admin request_queue lifetime").

Cc: Keith Busch <kbusch@kernel.org>
Fixes: 03b3bcd319 ("nvme: fix admin request_queue lifetime").
Reported-and-tested-by: Yi Zhang <yi.zhang@redhat.com>
Closes: https://lore.kernel.org/linux-block/CAHj4cs9wv3SdPo+N01Fw2SHBYDs9tj2M_e1-GdQOkRy=DsBB1w@mail.gmail.com/
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
2026-02-02 08:09:29 -08:00
Greg Kroah-Hartman
9991bbc6d5 IIO: New device support, features and cleanup for the 6.20/7.0 cycle.
Slightly messier than normal unfortunately due to some conflicts
 and build config bugs related to I3C drivers.
 
 One last minute Kconfig fix right at the top after a linux-next report.
 I've simplified the Kconfig and made it match other instances in the kernel
 so that should be safe enough despite short soak time in front of build bots.
 
 Merge of an immutable branch from I3C to get some stubs that were missing
 and caused build issues with dual I2C / I3C drivers. This also brought in a
 drop of some deprecated interfaces so there is also one patch to update a
 new driver to not use those.
 
 We are having another go at using cleanup.h magic with the IIO mode claim
 functions after backing out last try at this. This time we have wrappers
 around the new ACQUIRE() and ACQUIRE_ERR() macros.
 Having been burnt once, we will be taking it a bit more slowly this time
 wrt to wide adoption of these! Thanks in particular to Kurt for taking
 on this core IIO work.
 
 New Device Support
 ==================
 
 adi,ad18113
 - New driver to support the AD18113 amplifier - an interesting device due
   to the external bypass paths where we need to describe what gain those
   paths have in DT. Longer term it will be interesting to see if this
   simplistic description is enough for real deployments.
 adi,ad4062
 - New driver for the AD4060 and AD4052 SAR ADCs including trigger, event
   and GPIO controller support.  Follow up patch replaced use of some
   deprecated I3C interfaces prior to the I3C immutable branch merge as
   that includes dropping them.
 adi,ad4134
 - New driver for the AD4134 24bit 4 channel simultaneous sampling ADC.
 adi,ad7768-1,
 - Add support for the ADAQ767-1, ADAQ7768-1 and ADAQ7769-1 ADCs after some
   rework to enable the driver to support multiple device types.
 adi,ad9467
 - Add support for the similar ad9211 ADC to this existing driver.
 - Make the selection of 2s comp mode explicit for normal operation and
   switch to offset binary when entering calibration mode.
 honeywell,abp2
 - New driver to support this huge family (100+) of board mount pressure and
   temperature sensors.
 maxim,max22007
 - New drier for this 4 channel DAC.
 memsic,mmc5633
 - New driver for this I2C/I3C magnetometer. Follow on patches fixed up
   issues related to single driver supporting both bus types.
 microchip,mcp747feb02
 - New driver for the Microchip MCP47F(E/V)B(0/1/2)1,
   MCP47F(E/V)B(0/1/2)2, MCP47F(E/V)B(0/1/2)4 and MCP47F(E/V)B(0/1/2)8
   buffered voltage output DACs.
 nxp,sar-adc
 - New driver support ADCs found on s32g2 and s32g3 platforms.
 ti,ads1018
 - New drier for the ADS1018 and ADS1118 SPI ADCs.
 ti,ads131m02
 - New driver supporting ADS131M(02/03/04/06/08)24-bit simultaneous sampling
   ADCs.
 
 Features
 ========
 
 iio-core
 - New IIO_DEV_ACQUIRE_DIRECT_MODE() / IIO_DEV_ACQUIRE_FAILED() +
   equivalents for the much rarer case where the mode needs pinning
   whether or not it is in direct mode.  These use the ACQUIRE()
   / ACQUIRE_ERR() infrastructure underneath to provide both simple
   checks on whether we got the requested mode and to provide scope
   based release. Applied in a few initial drivers.
 adi,ad9467
 - Support calibbias control
 adi,adf4377
 - Add support to act as a clock provider.
 adi,adxl380
 - Support low power 1KHz sampling frequency mode. Required rework of
   how events and filters were configured, plus applying of constraints
   when in this mode.
 rf-digital,rfd77402
 - Add interrupt support as alternative to polling for completion.
 st,lsm6dsx
 - Tap event detection (after considerable driver rework)
 
 Cleanup and Minor Fixes
 =======================
 
 More minor cleanup such as typos, white space etc not called out except
 where they were applied to a lot of drivers.
 
 Various drivers.
 - Use of dev_err_probe() to cleanup error handling.
 - Introduce local struct device and struct device_node variables to
   reduce duplication of getting them from containing structs.
 - Ensure uses of iio_trigger_generic_data_rdy_poll() set IRQF_NO_THREAD
   as that function calls non threaded child interrupt handlers.
 - Replace IRQF_ONESHOT in not thread interrupt handlers with
   IRQF_NO_THREAD to ensure they run as intended. Drop one unnecessary case.
 iio-sw-device/trigger.
 - Constify configs_group_operations structures.
 iio-buffer-dma / buffer-dma-engine
 - Use lockdep_assert_held() to replace WARN_ON() to check lock is
   correctly held.
 - Make use of cleanup.h magic to simplify various code paths.
 - Make iio_dma_buffer_init() return void rather than always success.
 
 adi,ad7766
 - Replace custom interrupt handler with iio_trigger_generic_data_rdy_poll()
 adi,ad9832
 - Drop legacy platform_data support.
 adi,ade9000
 - Add a maintainer entry.
 adi,adt7316
 - Move to EXPORT_GPL_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() so the compiler
   can cleanly drop unused pm structures and callbacks.
 adi,adxl345
 - Relax build constraint vs the driver that is in input so both may be
   built as modules and selection made at runtime.
 adi,adxl380
 - Make sure we don't read tail entries in the hardware fifo if a partial
   new scan has been written.
 - Move to a single larger regmap_noinc_read() to read the hardware fifo.
 aspeed,ast2600
 - Add missing interrupts property to DT binding.
 bosch,bmi270_i2c
 - Add missing MODULE_DEVICE_TABLE() macros so auto probing of modules can
   work.
 bosch,smi330
 - Drop duplicate assignment of IIO_TYPE in smi330_read_avail()
 - Use new common field_get() and field_prep() helpers to replace local
   version.
 honeywell,mprls0025pa
   Fixes delayed to merge window as late in cycle and we didn't want to delay
   the rest of the series.
 - Allow Kconfig selection of specific bus sub-drivers rather than tying that
   to the buses themselves being supported.
 - Zero spi_transfer structure to avoid chance of unintentionally set fields
   effecting transfer.
 - Fix a potential timing violation wrt to the chip select to first clock
   edge timing.
 - As recent driver, take risk inherent in dropping interrupt direction from
   driver as that should be set by firmware.
 - Fix wrong reported number of data bits for channel.
 - Fix a pressure channel calculation bug.
 - Rework to allow embedding the tx buffer in the iio_priv() structure rather
   than requiring separate allocation.
 - Move the buffer clearing to the shared core bringing it into affect for
   SPI as well as I2C.
 - Stricter checks for status byte.
 - Greatly simplify the measurement sequence.
 - Add a copyright entry to reflect Petre's continued work on this driver.
 intersil,isl29018
 - Switch from spritnf to sysfs_emit_at() to make it clear overflow can't
   occur.
 invensense,icm42600
 - Allow sysfs access to temperature when buffered capture in use as it
   does not impact other sensor data paths.
 invensense,itg3200
 - Check unused return value in read_raw() callback.
 men,z188
 - Drop now duplicated module alias.
 rf-digital,rfd77402
 - Add DT binding doc and explicit of_device_id table.
 - Poll for timeout with times as on datasheet, then replace opencoded
   version with read_poll_timeout().
 sensiron,scd4x
 - Add missing timestamp channel. The code to push it to the buffer was there
   but there was no way to turn it on.
 vti,sca3000
 - Fix resource leak if iio_device_register() fails.
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAvFiEEbilms4eEBlKRJoGxVIU0mcT0FogFAml/hWARHGppYzIzQGtl
 cm5lbC5vcmcACgkQVIU0mcT0Foi51A/47f463/jhe68XY6wQEmB2q3FinSCor/3A
 tjhisUQd4EwNwkY007b9m7QILogsDJsVDrwpIT84mSoRd6RggyqEpWq/lyLM5AW2
 pq7zSf8D06ne/xPa5PL6Sy/L7edkeXLfU/NMfcLKhzhrm+kfFSKAKzfPzgXDBVZv
 TtFZkk7AaVc5rk4DQfnaSI1Nr1DQqI/rbCLj6dvD/Iq2Ozs1A4Q5GgClbU4sw4nR
 5iQryb9y7nesPoCKHb+qhHoUJMSv1uejTqMhwUecfNc/d47nxeqLmIwlI02YmFu+
 JKSZ5ptYAc2CrV4HTdfjLlfnZfkRCK5DeIalj2jE6hHN1lwqjUBvsP/J+/4RMK1S
 nth2wPRlW24hWjR51AcFhSMOM4nhwj3Tcxrb7w+uqEapbDhNJi7PT7LNalkFPIET
 qdxGCEm02OMBHjggyto/MhoXZj9IiqkvIKtuZ2M10Zq/6eP9TsPlhkRysdcok4f1
 VRmn23uTwJDGc3eAos1HBYLClZznG/kOgo7fyjJxEe7f9Kb2TwculY3yO3thYR2S
 XWFWZzw/Mr3yj0U3qKq7qXQvgME1P8KAFCiG82ZvjvixQpf8+Koe+WWuFVcdYvJi
 29yFbKHVnu58ttcPMvfegLy/iUjc1ZrhRNTJ4dRGa2xjc0eJqKqFs9OYVWKVfh2i
 MMHfMtVIhQ==
 =2IKe
 -----END PGP SIGNATURE-----

Merge tag 'iio-for-7.0a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next

Jonathan writes:

IIO: New device support, features and cleanup for the 6.20/7.0 cycle.

Slightly messier than normal unfortunately due to some conflicts
and build config bugs related to I3C drivers.

One last minute Kconfig fix right at the top after a linux-next report.
I've simplified the Kconfig and made it match other instances in the kernel
so that should be safe enough despite short soak time in front of build bots.

Merge of an immutable branch from I3C to get some stubs that were missing
and caused build issues with dual I2C / I3C drivers. This also brought in a
drop of some deprecated interfaces so there is also one patch to update a
new driver to not use those.

We are having another go at using cleanup.h magic with the IIO mode claim
functions after backing out last try at this. This time we have wrappers
around the new ACQUIRE() and ACQUIRE_ERR() macros.
Having been burnt once, we will be taking it a bit more slowly this time
wrt to wide adoption of these! Thanks in particular to Kurt for taking
on this core IIO work.

New Device Support
==================

adi,ad18113
- New driver to support the AD18113 amplifier - an interesting device due
  to the external bypass paths where we need to describe what gain those
  paths have in DT. Longer term it will be interesting to see if this
  simplistic description is enough for real deployments.
adi,ad4062
- New driver for the AD4060 and AD4052 SAR ADCs including trigger, event
  and GPIO controller support.  Follow up patch replaced use of some
  deprecated I3C interfaces prior to the I3C immutable branch merge as
  that includes dropping them.
adi,ad4134
- New driver for the AD4134 24bit 4 channel simultaneous sampling ADC.
adi,ad7768-1,
- Add support for the ADAQ767-1, ADAQ7768-1 and ADAQ7769-1 ADCs after some
  rework to enable the driver to support multiple device types.
adi,ad9467
- Add support for the similar ad9211 ADC to this existing driver.
- Make the selection of 2s comp mode explicit for normal operation and
  switch to offset binary when entering calibration mode.
honeywell,abp2
- New driver to support this huge family (100+) of board mount pressure and
  temperature sensors.
maxim,max22007
- New drier for this 4 channel DAC.
memsic,mmc5633
- New driver for this I2C/I3C magnetometer. Follow on patches fixed up
  issues related to single driver supporting both bus types.
microchip,mcp747feb02
- New driver for the Microchip MCP47F(E/V)B(0/1/2)1,
  MCP47F(E/V)B(0/1/2)2, MCP47F(E/V)B(0/1/2)4 and MCP47F(E/V)B(0/1/2)8
  buffered voltage output DACs.
nxp,sar-adc
- New driver support ADCs found on s32g2 and s32g3 platforms.
ti,ads1018
- New drier for the ADS1018 and ADS1118 SPI ADCs.
ti,ads131m02
- New driver supporting ADS131M(02/03/04/06/08)24-bit simultaneous sampling
  ADCs.

Features
========

iio-core
- New IIO_DEV_ACQUIRE_DIRECT_MODE() / IIO_DEV_ACQUIRE_FAILED() +
  equivalents for the much rarer case where the mode needs pinning
  whether or not it is in direct mode.  These use the ACQUIRE()
  / ACQUIRE_ERR() infrastructure underneath to provide both simple
  checks on whether we got the requested mode and to provide scope
  based release. Applied in a few initial drivers.
adi,ad9467
- Support calibbias control
adi,adf4377
- Add support to act as a clock provider.
adi,adxl380
- Support low power 1KHz sampling frequency mode. Required rework of
  how events and filters were configured, plus applying of constraints
  when in this mode.
rf-digital,rfd77402
- Add interrupt support as alternative to polling for completion.
st,lsm6dsx
- Tap event detection (after considerable driver rework)

Cleanup and Minor Fixes
=======================

More minor cleanup such as typos, white space etc not called out except
where they were applied to a lot of drivers.

Various drivers.
- Use of dev_err_probe() to cleanup error handling.
- Introduce local struct device and struct device_node variables to
  reduce duplication of getting them from containing structs.
- Ensure uses of iio_trigger_generic_data_rdy_poll() set IRQF_NO_THREAD
  as that function calls non threaded child interrupt handlers.
- Replace IRQF_ONESHOT in not thread interrupt handlers with
  IRQF_NO_THREAD to ensure they run as intended. Drop one unnecessary case.
iio-sw-device/trigger.
- Constify configs_group_operations structures.
iio-buffer-dma / buffer-dma-engine
- Use lockdep_assert_held() to replace WARN_ON() to check lock is
  correctly held.
- Make use of cleanup.h magic to simplify various code paths.
- Make iio_dma_buffer_init() return void rather than always success.

adi,ad7766
- Replace custom interrupt handler with iio_trigger_generic_data_rdy_poll()
adi,ad9832
- Drop legacy platform_data support.
adi,ade9000
- Add a maintainer entry.
adi,adt7316
- Move to EXPORT_GPL_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr() so the compiler
  can cleanly drop unused pm structures and callbacks.
adi,adxl345
- Relax build constraint vs the driver that is in input so both may be
  built as modules and selection made at runtime.
adi,adxl380
- Make sure we don't read tail entries in the hardware fifo if a partial
  new scan has been written.
- Move to a single larger regmap_noinc_read() to read the hardware fifo.
aspeed,ast2600
- Add missing interrupts property to DT binding.
bosch,bmi270_i2c
- Add missing MODULE_DEVICE_TABLE() macros so auto probing of modules can
  work.
bosch,smi330
- Drop duplicate assignment of IIO_TYPE in smi330_read_avail()
- Use new common field_get() and field_prep() helpers to replace local
  version.
honeywell,mprls0025pa
  Fixes delayed to merge window as late in cycle and we didn't want to delay
  the rest of the series.
- Allow Kconfig selection of specific bus sub-drivers rather than tying that
  to the buses themselves being supported.
- Zero spi_transfer structure to avoid chance of unintentionally set fields
  effecting transfer.
- Fix a potential timing violation wrt to the chip select to first clock
  edge timing.
- As recent driver, take risk inherent in dropping interrupt direction from
  driver as that should be set by firmware.
- Fix wrong reported number of data bits for channel.
- Fix a pressure channel calculation bug.
- Rework to allow embedding the tx buffer in the iio_priv() structure rather
  than requiring separate allocation.
- Move the buffer clearing to the shared core bringing it into affect for
  SPI as well as I2C.
- Stricter checks for status byte.
- Greatly simplify the measurement sequence.
- Add a copyright entry to reflect Petre's continued work on this driver.
intersil,isl29018
- Switch from spritnf to sysfs_emit_at() to make it clear overflow can't
  occur.
invensense,icm42600
- Allow sysfs access to temperature when buffered capture in use as it
  does not impact other sensor data paths.
invensense,itg3200
- Check unused return value in read_raw() callback.
men,z188
- Drop now duplicated module alias.
rf-digital,rfd77402
- Add DT binding doc and explicit of_device_id table.
- Poll for timeout with times as on datasheet, then replace opencoded
  version with read_poll_timeout().
sensiron,scd4x
- Add missing timestamp channel. The code to push it to the buffer was there
  but there was no way to turn it on.
vti,sca3000
- Fix resource leak if iio_device_register() fails.

* tag 'iio-for-7.0a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (144 commits)
  iio: magn: mmc5633: Fix Kconfig for combination of I3C as module and driver builtin
  iio: sca3000: Fix a resource leak in sca3000_probe()
  iio: proximity: rfd77402: Add interrupt handling support
  iio: proximity: rfd77402: Document device private data structure
  iio: proximity: rfd77402: Use devm-managed mutex initialization
  iio: proximity: rfd77402: Use kernel helper for result polling
  iio: proximity: rfd77402: Align polling timeout with datasheet
  iio: cros_ec: Allow enabling/disabling calibration mode
  iio: frequency: ad9523: correct kernel-doc bad line warning
  iio: buffer: buffer_impl.h: fix kernel-doc warnings
  iio: gyro: itg3200: Fix unchecked return value in read_raw
  MAINTAINERS: add entry for ADE9000 driver
  iio: accel: sca3000: remove unused last_timestamp field
  iio: accel: adxl372: remove unused int2_bitmask field
  iio: adc: ad7766: Use iio_trigger_generic_data_rdy_poll()
  iio: magnetometer: Remove IRQF_ONESHOT
  iio: Replace IRQF_ONESHOT with IRQF_NO_THREAD
  iio: Use IRQF_NO_THREAD
  iio: dac: Add MAX22007 DAC driver support
  dt-bindings: iio: dac: Add max22007
  ...
2026-02-02 17:08:30 +01:00
Daniel Hodges
0a1fc2f301 nvme-fabrics: use kfree_sensitive() for DHCHAP secrets
The DHCHAP secrets (dhchap_secret and dhchap_ctrl_secret) contain
authentication key material for NVMe-oF. Use kfree_sensitive() instead
of kfree() in nvmf_free_options() to ensure secrets are zeroed before
the memory is freed, preventing recovery from freed pages.

Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Daniel Hodges <hodgesd@meta.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
2026-02-02 08:06:33 -08:00
Chen Ridong
99a2ef5009 cgroup/dmem: avoid pool UAF
An UAF issue was observed:

BUG: KASAN: slab-use-after-free in page_counter_uncharge+0x65/0x150
Write of size 8 at addr ffff888106715440 by task insmod/527

CPU: 4 UID: 0 PID: 527 Comm: insmod    6.19.0-rc7-next-20260129+ #11
Tainted: [O]=OOT_MODULE
Call Trace:
<TASK>
dump_stack_lvl+0x82/0xd0
kasan_report+0xca/0x100
kasan_check_range+0x39/0x1c0
page_counter_uncharge+0x65/0x150
dmem_cgroup_uncharge+0x1f/0x260

Allocated by task 527:

Freed by task 0:

The buggy address belongs to the object at ffff888106715400
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 64 bytes inside of
freed 512-byte region [ffff888106715400, ffff888106715600)

The buggy address belongs to the physical page:

Memory state around the buggy address:
ffff888106715300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888106715380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888106715400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
				     ^
ffff888106715480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888106715500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb

The issue occurs because a pool can still be held by a caller after its
associated memory region is unregistered. The current implementation frees
the pool even if users still hold references to it (e.g., before uncharge
operations complete).

This patch adds a reference counter to each pool, ensuring that a pool is
only freed when its reference count drops to zero.

Fixes: b168ed458d ("kernel/cgroup: Add "dmem" memory accounting cgroup")
Cc: stable@vger.kernel.org # v6.14+
Signed-off-by: Chen Ridong <chenridong@huawei.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-02-02 06:04:13 -10:00
Chen Ridong
592a68212c cgroup/dmem: avoid rcu warning when unregister region
A warnning was detected:

 WARNING: suspicious RCU usage
 6.19.0-rc7-next-20260129+ #1101 Tainted: G           O
 kernel/cgroup/dmem.c:456 suspicious rcu_dereference_check() usage!

 other info that might help us debug this:

 rcu_scheduler_active = 2, debug_locks = 1
 1 lock held by insmod/532:
  #0: ffffffff85e78b38 (dmemcg_lock){+.+.}-dmem_cgroup_unregister_region+

 stack backtrace:
 CPU: 2 UID: 0 PID: 532 Comm: insmod Tainted: 6.19.0-rc7-next-
 Tainted: [O]=OOT_MODULE
 Call Trace:
  <TASK>
  dump_stack_lvl+0xb0/0xd0
  lockdep_rcu_suspicious+0x151/0x1c0
  dmem_cgroup_unregister_region+0x1e2/0x380
  ? __pfx_dmem_test_init+0x10/0x10 [dmem_uaf]
  dmem_test_init+0x65/0xff0 [dmem_uaf]
  do_one_initcall+0xbb/0x3a0

The macro list_for_each_rcu() must be used within an RCU read-side critical
section (between rcu_read_lock() and rcu_read_unlock()). Using it outside
that context, as seen in dmem_cgroup_unregister_region(), triggers the
lockdep warning because the RCU protection is not guaranteed.

Replace list_for_each_rcu() with list_for_each_entry_safe(), which is
appropriate for traversal under spinlock protection where nodes may be
deleted.

Fixes: b168ed458d ("kernel/cgroup: Add "dmem" memory accounting cgroup")
Cc: stable@vger.kernel.org # v6.14+
Signed-off-by: Chen Ridong <chenridong@huawei.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-02-02 06:03:28 -10:00
Chen Ridong
43151f8128 cgroup/dmem: fix NULL pointer dereference when setting max
An issue was triggered:

 BUG: kernel NULL pointer dereference, address: 0000000000000000
 #PF: supervisor read access in kernel mode
 #PF: error_code(0x0000) - not-present page
 PGD 0 P4D 0
 Oops: Oops: 0000 [#1] SMP NOPTI
 CPU: 15 UID: 0 PID: 658 Comm: bash Tainted: 6.19.0-rc6-next-2026012
 Tainted: [O]=OOT_MODULE
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
 RIP: 0010:strcmp+0x10/0x30
 RSP: 0018:ffffc900017f7dc0 EFLAGS: 00000246
 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff888107cd4358
 RDX: 0000000019f73907 RSI: ffffffff82cc381a RDI: 0000000000000000
 RBP: ffff8881016bef0d R08: 000000006c0e7145 R09: 0000000056c0e714
 R10: 0000000000000001 R11: ffff888107cd4358 R12: 0007ffffffffffff
 R13: ffff888101399200 R14: ffff888100fcb360 R15: 0007ffffffffffff
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 0000000000000000 CR3: 0000000105c79000 CR4: 00000000000006f0
 Call Trace:
  <TASK>
  dmemcg_limit_write.constprop.0+0x16d/0x390
  ? __pfx_set_resource_max+0x10/0x10
  kernfs_fop_write_iter+0x14e/0x200
  vfs_write+0x367/0x510
  ksys_write+0x66/0xe0
  do_syscall_64+0x6b/0x390
  entry_SYSCALL_64_after_hwframe+0x76/0x7e
 RIP: 0033:0x7f42697e1887

It was trriggered setting max without limitation, the command is like:
"echo test/region0 > dmem.max". To fix this issue, add check whether
options is valid after parsing the region_name.

Fixes: b168ed458d ("kernel/cgroup: Add "dmem" memory accounting cgroup")
Cc: stable@vger.kernel.org # v6.14+
Signed-off-by: Chen Ridong <chenridong@huawei.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-02-02 06:02:42 -10:00
Jiri Olsa
6b95cc562d ftrace: Fix direct_functions leak in update_ftrace_direct_del
Alexei reported memory leak in update_ftrace_direct_del.
We miss cleanup of the replaced direct_functions in the
success path in update_ftrace_direct_del, adding that.

Fixes: 8d2c1233f3 ("ftrace: Add update_ftrace_direct_del function")
Reported-by: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Closes: https://lore.kernel.org/bpf/aX_BxG5EJTJdCMT9@krava/T/#m7c13f5a95f862ed7ab78e905fbb678d635306a0c
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Link: https://lore.kernel.org/r/20260202075849.1684369-1-jolsa@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-02-02 07:56:20 -08:00
Emil Tsalapatis
2e06d54ea9 tools/sched_ext: Fix data header access during free in scx_sdt
Fix a pointer arithmetic error in scx_sdt during freeing that
causes the allocator to use the wrong memory address for the
allocation's data header.

Fixes: 36929ebd17 ("tools/sched_ext: add arena based scheduler")
Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com>
Acked-by: Andrea Righi <arighi@nvidia.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
2026-02-02 05:50:14 -10:00
Felix Gu
41d9a6795b
spi: tegra: Fix a memory leak in tegra_slink_probe()
In tegra_slink_probe(), when platform_get_irq() fails, it directly
returns from the function with an error code, which causes a memory leak.

Replace it with a goto label to ensure proper cleanup.

Fixes: eb9913b511 ("spi: tegra: Fix missing IRQ check in tegra_slink_probe()")
Signed-off-by: Felix Gu <ustc.gu@gmail.com>
Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
Link: https://patch.msgid.link/20260202-slink-v1-1-eac50433a6f9@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-02-02 15:47:07 +00:00
Dan Williams
2d2b3fe002 cxl/port: Unify endpoint and switch port lookup
In support of generic CXL protocol error handling across various 'struct
cxl_port' types, update find_cxl_port_by_uport() to retrieve endpoint CXL
port companions from endpoint PCIe device instances.

The end result is that upstream switch ports and endpoint ports can share
error handling and eventually delete the misplaced cxl_error_handlers from
the cxl_pci class driver.

Reviewed-by: Terry Bowman <terry.bowman@amd.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Tested-by: Terry Bowman <terry.bowman@amd.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Link: https://patch.msgid.link/20260131000403.2135324-10-dan.j.williams@intel.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-02-02 08:46:33 -07:00
Dan Williams
dab7162d0a cxl/port: Move endpoint component register management to cxl_port
In preparation for generic protocol error handling across CXL endpoints,
whether they be memory expander class devices or accelerators, drop the
endpoint component management from cxl_dev_state.

Organize all CXL port component management through the common cxl_port
driver.

Note that the end game is that drivers/cxl/core/ras.c loses all
dependencies on a 'struct cxl_dev_state' parameter and operates only on
port resources. The removal of component register mapping from cxl_pci is
an incremental step towards that.

Reviewed-by: Terry Bowman <terry.bowman@amd.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Tested-by: Terry Bowman <terry.bowman@amd.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Link: https://patch.msgid.link/20260131000403.2135324-9-dan.j.williams@intel.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-02-02 08:46:17 -07:00
Terry Bowman
ef1df6cf69 cxl/port: Map Port RAS registers
In preparation for CXL VH (Virtual Host) topology protocol error handling,
add RAS capability registered mapping for all ports in a CXL VH topology.
This includes the RAS capabilities of Switch Upstream Ports, Switch
Downstream Ports, Host Bridge Ports ("upstream"), and Root Ports
("downstream")

Update cxl_port_add_dport() to map the upstream RAS capability on first
'dport' attach.

Signed-off-by: Terry Bowman <terry.bowman@amd.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Co-developed-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Tested-by: Terry Bowman <terry.bowman@amd.com>
Link: https://patch.msgid.link/20260131000403.2135324-8-dan.j.williams@intel.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-02-02 08:45:57 -07:00
Dan Williams
7f5ff740ce cxl/port: Move dport RAS setup to dport add time
Towards the end goal of making all CXL RAS capability handling uniform
across host bridge ports, upstream switch ports, and endpoint ports, move
dport RAS setup. Move it to cxl_switch_port_probe() context for switch / VH
dports (via cxl_port_add_dport()) and cxl_endpoint_port_probe() context for
an RCH dport. Rename the RAS setup helper to devm_cxl_dport_ras_setup() for
symmetry with devm_cxl_switch_port_decoders_setup().

Only the RCH version needs to be exported and the cxl_test mocking can be
deleted with a dev_is_pci() check on the dport_dev.

Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Tested-by: Terry Bowman <terry.bowman@amd.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Link: https://patch.msgid.link/20260131000403.2135324-7-dan.j.williams@intel.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-02-02 08:44:51 -07:00
Fuad Tabba
0c4762e268 KVM: arm64: nv: Avoid NV stage-2 code when NV is not supported
The NV stage-2 manipulation functions kvm_nested_s2_unmap(),
kvm_nested_s2_wp(), and others, are being called for any stage-2
manipulation regardless of whether nested virtualization is supported or
enabled for the VM.

For protected KVM (pKVM), `struct kvm_pgtable` uses the
`pkvm_mappings` member of the union. This member aliases `ia_bits`,
which is used by the non-protected NV code paths. Attempting to
read `pgt->ia_bits` in these functions results in treating
protected mapping pointers or state values as bit-shift amounts.
This triggers a UBSAN shift-out-of-bounds error:

    UBSAN: shift-out-of-bounds in arch/arm64/kvm/nested.c:1127:34
    shift exponent 174565952 is too large for 64-bit type 'unsigned long'
    Call trace:
     __ubsan_handle_shift_out_of_bounds+0x28c/0x2c0
     kvm_nested_s2_unmap+0x228/0x248
     kvm_arch_flush_shadow_memslot+0x98/0xc0
     kvm_set_memslot+0x248/0xce0

Since pKVM and NV are mutually exclusive, prevent entry into these
NV handling functions if the VM has not allocated any nested MMUs
(i.e., `kvm->arch.nested_mmus_size` is 0).

Fixes: 7270cc9157 ("KVM: arm64: nv: Handle VNCR_EL2 invalidation from MMU notifiers")
Suggested-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Fuad Tabba <tabba@google.com>
Link: https://patch.msgid.link/20260202152310.113467-1-tabba@google.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-02-02 15:44:39 +00:00
Dan Williams
3864cb60da cxl/port: Move dport probe operations to a driver event
In preparation for adding more register setup to the cxl_port_add_dport()
path (for RAS register mapping), move the dport creation event to a driver
callback. This achieves two goals, it puts driver operations logically
where they belong, in a driver, and it obviates the gymnastics of
DECLARE_TESTABLE() which just makes a mess of grepping for CXL symbols.

In other words, a driver callback is less of an ongoing maintenance burden
than this DECLARE_TESTABLE arrangement that does not scale and diminishes
the grep-ability of the codebase.

cxl_port_add_dport() moves mostly unmodified from drivers/cxl/core/port.c.
The only deliberate change is that it now assumes that the device_lock is
held on entry and the driver is attached (just like cxl_port_probe()).

Reviewed-by: Terry Bowman <terry.bowman@amd.com>
Tested-by: Terry Bowman <terry.bowman@amd.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Link: https://patch.msgid.link/20260131000403.2135324-6-dan.j.williams@intel.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-02-02 08:41:29 -07:00
Dan Williams
86e756715d cxl/port: Move decoder setup before dport creation
There are port setup actions that run on first dport arrival, and there are
setup actions that run per dport.

RAS register setup is a future additional setup action to run per-port
(once the first dport arrives), and each dport also has RAS registers to
map.

Before adding that, flip the order of "first dport" and "per-dport"
actions. This makes allocation symmetric with teardown, "first dport"
actions unwind after last dport removed. It also allows for using a devres
group to collect the unrelated decoder, RAS, and dport setup actions into
one group release action.

The new cxl_port_open_group() collects "first dport" and "per-dport" into
one group that can be released on any failure. This group's lifetime only
needs to span the short duration of cxl_port_add_dport() to cleanup all
potential damage from failing to add a dport. Contrast that to the "dport"
devres group that is called upon to destruct fully formed dport objects.

Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Tested-by: Terry Bowman <terry.bowman@amd.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Link: https://patch.msgid.link/20260131000403.2135324-5-dan.j.williams@intel.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-02-02 08:41:29 -07:00
Dan Williams
afa2bdba1e cxl/port: Cleanup dport removal with a devres group
In preparation for adding more setup actions like RAS register mapping,
introduce a devres group to collect all the dport creation / registration
actions. This replaces the maintenance tedium of open coding several
devm_release_action() calls in del_dport().

Tested-by: Terry Bowman <terry.bowman@amd.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Link: https://patch.msgid.link/20260131000403.2135324-4-dan.j.williams@intel.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-02-02 08:41:29 -07:00
Dan Williams
83ccbaf1a1 cxl/port: Reduce number of @dport variables in cxl_port_add_dport()
In preparation for refactoring cxl_port_add_dport() to add RAS register
setup, cleanup the number of dport variables with a dport_exists() helper.

Kill the @dport needed to check for duplicates, rename @new_dport to
@dport.

Reported-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Closes: http://lore.kernel.org/20260116150119.00003bbd@huawei.com
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Tested-by: Terry Bowman <terry.bowman@amd.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Link: https://patch.msgid.link/20260131000403.2135324-3-dan.j.williams@intel.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-02-02 08:41:29 -07:00
Dan Williams
47fec713d9 cxl/port: Cleanup handling of the nr_dports 0 -> 1 transition
There are multiple setup actions that can occur for a switch port after it
is known that it has at least one active downstream link. That work is
currently split between __devm_cxl_add_dport(), the add_dport() helper, and
cxl_port_add_dport() where decoder setup occurs.

Clean this up by moving all @dport object setup responsibilities into
add_dport() and all port effects into cxl_port_add_dport().

add_dport() handles taking a reference on @dport->dport_dev, and
cxl_port_add_dport() grows the awareness to setup the port component
registers. This removes an awkward open-coded xa_erase() from the middle of
__devm_cxl_add_dport() and instead tasks cxl_port_add_dport() with calling
the common @dport destruction path if anything goes wrong.

After this @port->nr_dports is always the count of @dports in the
@port->dports xarray, and cxl_dport_remove() is symmetric with add_dport().
With ->nr_dports now reliably tracking the number of dports the use of
ida_is_empty() can be dropped. Recall that the ida is only cleared on
"release" of decoder objects, and release can be arbitrarily delayed past
unregistration.

Lastly port->component_reg_phys is no longer reset to CXL_RESOURCE_NONE
post setup, no reason is seen to carry that forward.

Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Tested-by: Terry Bowman <terry.bowman@amd.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Link: https://patch.msgid.link/20260131000403.2135324-2-dan.j.williams@intel.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-02-02 08:41:29 -07:00
Marco Elver
bb0c99e08a arm64: Fix non-atomic __READ_ONCE() with CONFIG_LTO=y
The implementation of __READ_ONCE() under CONFIG_LTO=y incorrectly
qualified the fallback "once" access for types larger than 8 bytes,
which are not atomic but should still happen "once" and suppress common
compiler optimizations.

The cast `volatile typeof(__x)` applied the volatile qualifier to the
pointer type itself rather than the pointee. This created a volatile
pointer to a non-volatile type, which violated __READ_ONCE() semantics.

Fix this by casting to `volatile typeof(*__x) *`.

With a defconfig + LTO + debug options build, we see the following
functions to be affected:

	xen_manage_runstate_time (884 -> 944 bytes)
	xen_steal_clock (248 -> 340 bytes)
	  ^-- use __READ_ONCE() to load vcpu_runstate_info structs

Fixes: e35123d83e ("arm64: lto: Strengthen READ_ONCE() to acquire when CONFIG_LTO=y")
Cc: stable@vger.kernel.org
Reviewed-by: Boqun Feng <boqun@kernel.org>
Signed-off-by: Marco Elver <elver@google.com>
Tested-by: David Laight <david.laight.linux@gmail.com>
Signed-off-by: Will Deacon <will@kernel.org>
2026-02-02 15:40:54 +00:00
Gustavo A. R. Silva
2c3a0b7300 dlm: Avoid -Wflex-array-member-not-at-end warning
-Wflex-array-member-not-at-end was introduced in GCC-14, and we are
getting ready to enable it, globally.

Move the conflicting declaration to the end of the corresponding
structure. Notice that `struct dlm_message` is a flexible
structure, this is a structure that contains a flexible-array
member.

Fix the following warning:

fs/dlm/dlm_internal.h:609:33: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]

Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: David Teigland <teigland@redhat.com>
2026-02-02 09:40:41 -06:00
Pavel Begunkov
af07330e28 io_uring/zcrx: fix rq flush locking
zcrx needs to keep the rq lock for uref manipulations, for now move all
zcrx_return_buffers() under the lock.

Fixes: 475eb39b00 ("io_uring/zcrx: add sync refill queue flushing")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-02 08:19:43 -07:00
Pavel Begunkov
0ae91d8ab7 io_uring/zcrx: fix page array leak
d9f595b9a6 ("io_uring/zcrx: fix leaking pages on sg init fail") fixed
a page leakage but didn't free the page array, release it as well.

Fixes: b84621d96e ("io_uring/zcrx: allocate sgtable for umem areas")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-02 08:19:35 -07:00
Li Chen
9121466148 io_uring: allow io-wq workers to exit when unused
io_uring keeps a per-task io-wq around, even when the task no longer has
any io_uring instances.

If the task previously used io_uring for file I/O, this can leave an
unrelated iou-wrk-* worker thread behind after the last io_uring
instance is gone.

When the last io_uring ctx is removed from the task context, mark the
io-wq exit-on-idle so workers can go away. Clear the flag on subsequent
io_uring usage.

Signed-off-by: Li Chen <me@linux.beauty>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-02 08:11:42 -07:00
Li Chen
38aa434ab9 io_uring/io-wq: add exit-on-idle state
io-wq uses an idle timeout to shrink the pool, but keeps the last worker
around indefinitely to avoid churn.

For tasks that used io_uring for file I/O and then stop using io_uring,
this can leave an iou-wrk-* thread behind even after all io_uring
instances are gone. This is unnecessary overhead and also gets in the
way of process checkpoint/restore.

Add an exit-on-idle state that makes all io-wq workers exit as soon as
they become idle, and provide io_wq_set_exit_on_idle() to toggle it.

Signed-off-by: Li Chen <me@linux.beauty>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-02 08:10:23 -07:00
Yu Kuai
65d466b629 blk-mq-debugfs: warn about possible deadlock
Creating new debugfs entries can trigger fs reclaim, hence we can't do
this with queue frozen, meanwhile, other locks that can be held while
queue is frozen should not be held as well.

Signed-off-by: Yu Kuai <yukuai@fnnas.com>
Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-02 07:05:19 -07:00
Yu Kuai
9d20fd6ce1 blk-mq-debugfs: add missing debugfs_mutex in blk_mq_debugfs_register_hctxs()
In blk_mq_update_nr_hw_queues(), debugfs_mutex is not held while
creating debugfs entries for hctxs. Hence add debugfs_mutex there,
it's safe because queue is not frozen.

Signed-off-by: Yu Kuai <yukuai@fnnas.com>
Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-02 07:05:19 -07:00
Yu Kuai
5ae4b12ee6 blk-mq-debugfs: remove blk_mq_debugfs_unregister_rqos()
Because this helper is only used by iocost and iolatency, while they
don't have debugfs entries.

Signed-off-by: Yu Kuai <yukuai@fnnas.com>
Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-02 07:05:19 -07:00