kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity
1,463,873 commits 117 branches 5,827 tags 6.3 GiB
Commit graph

176,462 commits

Author SHA1 Message Date
Shivank Garg
3dd5a633a0 mm/migrate: use migrate_info field instead of private 
Add an unsigned long migrate_info member to the struct folio union and use
it to store migration state (anon_vma pointer and FOLIO_WAS_* markers)
instead of using folio->private.  While at it, switch to bitwise OR.

No functional change.

[rdunlap@infradead.org: add missing kernel-doc for @migrate_info]
  Link: https://lore.kernel.org/20260717022146.1290242-1-rdunlap@infradead.org
Link: https://lore.kernel.org/20260701-migrate-cleanups-prep-v2-3-d9e8f17130b1@amd.com
Signed-off-by: Shivank Garg <shivankg@amd.com>
Suggested-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Jonathan Cameron <jic23@kernel.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Huang Ying <ying.huang@linux.alibaba.com>
Acked-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: SJ Park <sj@kernel.org>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Alistair Popple <apopple@nvidia.com>
Cc: Byungchul Park <byungchul@sk.com>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Gregory Price <gourry@gourry.net>
Cc: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-07-28 21:11:53 -07:00
Ye Liu
c95dc0a84b mm: use enum migrate_reason instead of int for migration reason parameters 
Replace all 'int reason' function parameters that carry migrate_reason
values with the proper 'enum migrate_reason' type.  This makes the intent
explicit and leverages compiler type checking.  The affected subsystems
are:

  - page_owner: __folio_set_owner_migrate_reason(),
                folio_set_owner_migrate_reason()
  - migrate: migrate_pages(), migrate_pages_sync(),
             migrate_pages_batch(), migrate_folios_move(),
             migrate_hugetlbs(), unmap_and_move_huge_page()
  - hugetlb: move_hugetlb_state(), htlb_allow_alloc_fallback()
  - trace: mm_migrate_pages and mm_migrate_pages_start events

The 'short last_migrate_reason' struct field and internal helper parameter
in page_owner are intentionally left as 'short' since they store per-page
metadata where size matters.

No functional change.

Link: https://lore.kernel.org/20260714015117.78351-4-ye.liu@linux.dev
Signed-off-by: Ye Liu <ye.liu@linux.dev>
Reviewed-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Reviewed-by: Lorenzo Stoakes <ljs@kernel.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Cc: Brendan Jackman <jackmanb@google.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-07-28 21:11:50 -07:00
Ye Liu
7eeed888c9 mm/page_owner: add MR_NEVER to enum migrate_reason and use it for last_migrate_reason 
The last_migrate_reason field uses -1 as a sentinel value to mean "no
migration has happened".  Replace the four bare -1 occurrences by adding a
proper MR_NEVER member to enum migrate_reason, defining a corresponding
"never_migrated" string in the MIGRATE_REASON trace macro, and updating
the GDB page_owner script to use MR_NEVER instead of the hardcoded -1 so
that lx-dump-page-owner does not incorrectly report unmigrated pages as
migrated.

No functional change.

Link: https://lore.kernel.org/20260714015117.78351-3-ye.liu@linux.dev
Signed-off-by: Ye Liu <ye.liu@linux.dev>
Reviewed-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Cc: Brendan Jackman <jackmanb@google.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: David Hildenbrand (Arm) <david@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-07-28 21:11:50 -07:00
Ethan Nelson-Moore
aa38f2454b mm: hugetlb: correct CONFIG_CGROUP_HUGETLB macro name in comment 
A comment in <linux/hugetlb_cgroup.h> incorrectly refers to
CONFIG_MEM_RES_CTLR_HUGETLB, which has never existed in the kernel,
instead of CONFIG_CGROUP_HUGETLB.  Correct it.

Discovered while searching for CONFIG_* symbols referenced in code but not
defined in any Kconfig file.

Link: https://lore.kernel.org/20260616000135.62815-1-enelsonmoore@gmail.com
Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Reviewed-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Lorenzo Stoakes <ljs@kernel.org>
Cc: Anthony Yznaga <anthony.yznaga@oracle.com>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Pedro Falcato <pfalcato@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-07-28 21:11:48 -07:00
Kefeng Wang
a35d8872da mm: remove PageTransCompound() 
Remove the last user of PageTransCompound() in ksm and get rid of
PageTransCompound().

Link: https://lore.kernel.org/20260618113523.3913307-1-wangkefeng.wang@huawei.com
Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Xu Xin <xu.xin16@zte.com.cn>
Tested-by: Xu Xin <xu.xin16@zte.com.cn>
Acked-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: SeongJae Park <sj@kernel.org>
Cc: Chengming Zhou <chengming.zhou@linux.dev>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-07-28 21:11:47 -07:00
Kaitao Cheng
dec068de6d mm/vmalloc: honor GFP constraints in pcpu_get_vm_areas() 
Patch series "mm/percpu: Fix possible NOFS/NOIO reclaim recursion", v4.

Commit 9a5b183941 ("mm, percpu: do not consider sleepable allocations
atomic") allowed GFP_NOFS and GFP_NOIO percpu allocations to use
pcpu_alloc_mutex and the chunk creation slow path.  This restored the
allocation capability that was lost when those constrained allocations
were treated as atomic, but it also makes the percpu slow path visible to
callers from constrained reclaim contexts.

There are two related problems.

First, the create and populate slow paths do not fully preserve the
caller's allocation constraints.  pcpu_alloc_noprof() derives pcpu_gfp
from the caller supplied GFP mask and passes it down to the percpu backing
page allocator.  However, chunk creation calls pcpu_get_vm_areas(), and
chunk population can allocate temporary metadata or vmalloc page tables
while mapping backing pages.  Those internal allocations can still use
GFP_KERNEL, so a caller using GFP_NOFS or GFP_NOIO can enter unconstrained
FS or IO reclaim while holding pcpu_alloc_mutex.

One possible case is blk-cgroup after commit 5d726c4dbe ("blk-cgroup:
fix possible deadlock while configuring policy").  blkg_conf_prep() now
serializes against blkcg_deactivate_policy() with q->blkcg_mutex, and
blkg_alloc() uses GFP_NOIO because queue freeze and IO reclaim
dependencies can otherwise deadlock.  If the percpu slow path loses that
GFP_NOIO context, direct reclaim or writeback can issue IO to a frozen
queue while q->blkcg_mutex is held.

Second, allowing sleepable GFP_NOFS/GFP_NOIO allocations to take
pcpu_alloc_mutex means that unconstrained backing allocations made under
the mutex can create an FS/IO reclaim dependency against a constrained
caller which already holds an FS or IO lock and then waits for
pcpu_alloc_mutex.

This series fixes those issues in three steps:

  - pass the caller supplied GFP mask into pcpu_get_vm_areas() and use it
    for vmalloc metadata and KASAN shadow allocations;
  - pass the GFP mask through the chunk population path, including the
    temporary pages array and vmalloc page table allocation scope;
  - restrict percpu backing allocations performed while holding
    pcpu_alloc_mutex to GFP_NOIO, so they cannot recurse into IO or FS
    reclaim.

This keeps sleepable GFP_NOFS/GFP_NOIO percpu allocations working, while
avoiding the reclaim recursion risks introduced by making those
allocations eligible for the mutex-protected slow path.


This patch (of 4):

pcpu_alloc_noprof() derives pcpu_gfp from the caller supplied GFP mask and
passes it down to the backing percpu allocator.  However, when the percpu
vmalloc allocator has to create a new chunk, pcpu_create_chunk() calls
pcpu_get_vm_areas() to allocate the corresponding vmalloc areas.

pcpu_get_vm_areas() currently performs its internal allocations with
GFP_KERNEL, including vmap area metadata, vm_struct metadata and KASAN
vmalloc shadow population.  This means that a caller which deliberately
uses GFP_NOFS or GFP_NOIO can still enter FS or IO reclaim while creating
the vmalloc areas for a new percpu chunk.

One possible case is blk-cgroup after commit 5d726c4dbe ("blk-cgroup:
fix possible deadlock while configuring policy").  blkg_conf_prep() now
serializes against blkcg_deactivate_policy() with q->blkcg_mutex, and
blkg_alloc() was changed to GFP_NOIO for that reason:

  CPU0: blkg_conf_prep()
    mutex_lock(q->blkcg_mutex)
    blkg_alloc(..., GFP_NOIO)
      alloc_percpu_gfp(..., GFP_NOIO)
        pcpu_alloc_noprof(..., GFP_NOIO)
	  pcpu_create_chunk(GFP_NOIO)
	    pcpu_get_vm_areas()
              -> if percpu chunks are exhausted, chunk create may do
                 internal GFP_KERNEL allocations
              -> direct reclaim / writeback can issue IO to this queue
              -> IO waits because the queue is frozen

  CPU1: blkcg_deactivate_policy()
    blk_mq_freeze_queue(q)
    mutex_lock(q->blkcg_mutex)
      -> waits for CPU0
    ... unfreeze only happens after q->blkcg_mutex is acquired/released

So the concern is that the caller deliberately uses GFP_NOIO because it
may hold a lock which can be acquired after queue freeze, but the percpu
slow path can temporarily lose that allocation context.

Pass the caller supplied GFP mask from pcpu_create_chunk() to
pcpu_get_vm_areas(), and use it for the internal vmalloc metadata and
KASAN shadow allocations.

Link: https://lore.kernel.org/20260618130414.96383-1-kaitao.cheng@linux.dev
Link: https://lore.kernel.org/20260618130414.96383-2-kaitao.cheng@linux.dev
Fixes: 9a5b183941 ("mm, percpu: do not consider sleepable allocations atomic")
Signed-off-by: Kaitao Cheng <chengkaitao@kylinos.cn>
Reviewed-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
Reviewed-by: Shivam Kalra <shivamkalra98@zohomail.in>
Acked-by: Dennis Zhou <dennis@kernel.org>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Christoph Lameter <cl@gentwo.org>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Tejun Heo <tj@kernel.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-07-28 21:11:46 -07:00
Thomas Huth
5339ec29f9 mm: replace __ASSEMBLY__ with __ASSEMBLER__ in memory management header files 
While the GCC and Clang compilers already define __ASSEMBLER__
automatically when compiling assembly code, __ASSEMBLY__ is a macro that
only gets defined by the Makefiles in the kernel.  This can be very
confusing when switching between userspace and kernelspace coding, or when
dealing with uapi headers that rather should use __ASSEMBLER__ instead. 
So let's standardize now on the __ASSEMBLER__ macro that is provided by
the compilers.

This is a completely mechanical patch (done with a simple "sed -i"
statement).

Link: https://lore.kernel.org/20260619131830.229804-1-thuth@redhat.com
Signed-off-by: Thomas Huth <thuth@redhat.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Barry Song <baohua@kernel.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: Kairui Song <kasong@tencent.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Wei Xu <weixugc@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-07-28 21:11:46 -07:00
JP Kobryn
094470f3f4 mm/lruvec: trace LRU add drains and drain-all requests 
LRU add batches can be drained before they reach capacity.  This can be a
source of LRU lock contention, but it is not currently possible to
attribute these drains to callers with existing tracepoints.

Add mm_lru_add_drain to report the CPU and lru_add batch count when an
lru_add batch is drained.  This allows tracing to distinguish full drains
from partial drains and attribute them to the calling stack.

Add mm_lru_add_drain_all to capture callers of __lru_add_drain_all and
whether they set the force flag for all CPUs.  The tracepoint resembles
the signature of the enclosing function, but is needed because of
potential inlining.

Note that DECLARE_TRACE() is used for these new trace hooks to avoid
creating a new trace event ABI.

Link: https://lore.kernel.org/20260622185127.24579-1-jp.kobryn@linux.dev
Signed-off-by: JP Kobryn <jp.kobryn@linux.dev>
Reviewed-by: Barry Song <baohua@kernel.org>
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Baoquan He <baoquan.he@linux.dev>
Cc: Chris Li <chrisl@kernel.org>
Cc: Kairui Song <kasong@tencent.com>
Cc: Kemeng Shi <shikemeng@huaweicloud.com>
Cc: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Nhat Pham <nphamcs@gmail.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Wei Xu <weixugc@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-07-28 21:11:45 -07:00
Linus Torvalds
62cc902415 13 hotfixes. All are cc:stable. 11 are for MM. All are singletons - 
please see the changelogs for details.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCamfLHAAKCRDdBJ7gKXxA
 jrrMAQDQHf+VGi/lZaxtgfLv0OThODhzzckRI2dcTGG66YX/DQD/V4aTndWFUUpM
 j1aSODTTWeKi3Ija4E3dA7SIaZkqSAI=
 =s/6H
 -----END PGP SIGNATURE-----

Merge tag 'mm-hotfixes-stable-2026-07-27-14-18' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull misc fixes from Andrew Morton:
 "13 hotfixes. All are cc:stable. 11 are for MM. All are singletons -
  please see the changelogs for details"

* tag 'mm-hotfixes-stable-2026-07-27-14-18' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
  fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes
  mm/hugetlb: fix list corruption in allocate_file_region_entries()
  mm: mglru: fix stale batch updates after memcg reparenting
  selftest: fix headers in fclog.c
  ocfs2: fix boundary check in ocfs2_check_dir_entry() to use buffer offset
  mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()
  mm/util: don't read __page_2 for order-1 folios in snapshot_page()
  mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()
  mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE
  fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes
  userfaultfd: wait on source PMD during UFFDIO_MOVE
  lib: test_hmm: use device devt for coherent device range selection
  mm/vmstat: fold stranded per-cpu node stats when a node comes online
 2026-07-27 14:36:26 -07:00
Linus Torvalds
4235cb24ec vfs-7.2-rc5.fixes 
Please consider pulling these changes from the signed vfs-7.2-rc5.fixes tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCamYljAAKCRCRxhvAZXjc
 ogWyAPwORZDIIsRiAQbnPs+OkYszuWCY29OeUrTf+m3z+tBTLwD+NUFtpH5XIcYJ
 3jHtGXPoHjEaOVsNyIdxwnOxWfo+6ws=
 =VNq0
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.2-rc5.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull vfs fixes from Christian Brauner:

 - vfs: Preserve the ACL_DONT_CACHE state in forget_cached_acl().

   ACL_DONT_CACHE is meant to be a permanent opt-out from ACL caching
   which FUSE relies on for servers that don't negotiate FUSE_POSIX_ACL.
   The helper replaced it with ACL_NOT_CACHED, silently re-enabling the
   cache, and as fuse doesn't invalidate the cache for such servers a
   properly timed get_acl() returned stale ACLs. Comes with a fuse
   selftest reproducing this.

 - pidfs:

     - Preserve PIDFD_THREAD when a thread pidfd is reopened via
       open_by_handle_at(). PIDFD_THREAD shares the O_EXCL bit which
       do_dentry_open() strips after the flags have been validated, so
       the reopened pidfd silently became a process pidfd. Comes with a
       selftest.

     - Add a pidfs_dentry_open() helper so the regular pidfd allocation
       path and the file handle path share the code that forces O_RDWR
       and reapplies the pidfd flags that do_dentry_open() strips.

     - Handle FS_IOC32_GETVERSION in the compat ioctl path.

     - Make pidfs_ino_lock static.

 - iomap:

     - Fix the block range calculation in ifs_clear_range_dirty() so a
       partial clear doesn't drop the dirty state of blocks the range
       only partially covers.

     - Support invalidating partial folios so a partial truncate or hole
       punch with blocksize < foliosize doesn't leave stale dirty bits
       behind.

     - Only set did_zero when iomap_zero_iter() actually zeroed
       something.

     - Guard ifs_set_range_dirty() and ifs_set_range_uptodate() against
       zero-length ranges where the unsigned last-block calculation
       underflows and bitmap_set() writes far beyond the ifs->state
       allocation.

     - Don't merge ioends with different io_private values as the merge
       could leak or corrupt the private data of the individual ioends.

 - exec:

     - Raise bprm->have_execfd only once the binfmt_misc interpreter has
       actually been opened. The flag was set as soon as a matching 'O'
       or 'C' entry was found. If the interpreter open failed with
       ENOEXEC the exec fell through to the next binary format with
       have_execfd raised but no executable staged and begin_new_exec()
       NULL derefed past the point of no return.

     - Fix an unsigned loop counter wrap in transfer_args_to_stack() on
       nommu. An overlong argument or environment string pushes bprm->p
       below PAGE_SIZE, the stop index becomes zero, and the loop never
       terminates, wrapping its counter and copying garbage from in
       front of the page array into the new process stack.

     - Make binfmt_elf_fdpic only honour the first PT_INTERP like
       binfmt_elf does. Each additional PT_INTERP overwrote the previous
       interpreter, leaking the name allocation and the interpreter file
       reference together with the write denial open_exec() took,
       leaving the file unwritable for as long as the system runs.

 - overlayfs:

     - Compare the full escaped xattr prefix including the trailing dot.
       An xattr like "trusted.overlay.overlayfoo" was misclassified as
       an escaped overlay xattr.

     - Check read access to the copy_file_range() source with the
       source's mounter credentials.

 - super: Thawing a filesystem whose block device was frozen with
   bdev_freeze() deadlocked. Dropping the last block layer freeze
   reference from under s_umount ends up in fs_bdev_thaw() which
   reacquires s_umount on the same task. Pin the superblock with an
   active reference instead and call bdev_thaw() without holding
   s_umount.

 - procfs: Return EACCES instead of success when the ptrace access check
   for namespace links fails.

 - afs: Use afs_dir_get_block() rather than afs_dir_find_block() for
   block 0 in afs_edit_dir_remove(), matching afs_edit_dir_add().

 - Push the memcg gating of ->nr_cached_objects() down into the btrfs
   and shmem callbacks instead of skipping every callback during
   non-root memcg reclaim. The blanket check short-circuited XFS whose
   inode reclaim hook is intentionally driven from per-memcg contexts to
   free memcg-charged slab.

 - eventpoll: Pin files while checking reverse paths.

   Since struct file became SLAB_TYPESAFE_BY_RCU a concurrent close
   could free and recycle the file under the check which then took and
   dropped the f_lock of whatever live file now occupies that slot.

* tag 'vfs-7.2-rc5.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (24 commits)
  super: fix emergency thaw deadlock on frozen block devices
  pidfs: make pidfs_ino_lock static
  eventpoll: pin files while checking reverse paths
  fs: push nr_cached_objects memcg gating into individual filesystems
  afs: Fix afs_edit_dir_remove() to get, not find, block 0
  iomap: prevent ioend merge when io_private differs
  iomap: add comments for ifs_clear/set_range_dirty()
  iomap: fix out-of-bounds bitmap_set() with zero-length range
  iomap: fix incorrect did_zero setting in iomap_zero_iter()
  iomap: support invalidating partial folios
  iomap: correct the range of a partial dirty clear
  fs/super: fix emergency thaw double-unlock of s_umount
  pidfs: handle FS_IOC32_GETVERSION in compat ioctl
  ovl: check access to copy_file_range source with src mounter creds
  proc: Fix broken error paths for namespace links
  pidfs: add pidfs_dentry_open() helper
  selftests/pidfd: check PIDFD_THREAD survives open_by_handle_at()
  pidfs: preserve thread pidfds reopened by file handle
  ovl: fix trusted xattr escape prefix matching
  selftests/fuse: add ACL_DONT_CACHE regression test
  ...
 2026-07-26 12:22:57 -07:00
Linus Torvalds
09b2124a47 Char/Misc driver fixes for 7.2-rc5 
Here are a number of small char/misc/etc. driver fixes for 7.2-rc5 that
 resolve a bunch of different reported issues.  Included in here are:
   - rust_binder error message reporting fix
   - stratix10-svc firmware driver fixes
   - mei driver fix
   - intel_th hardware tracing driver fix
   - comedi driver fix
   - uio_hv_generic driver fix
   - ntsync selftest fix
   - nsm misc driver fix
   - some MAINTAINER file updates
 
 All of these have been in linux-next for over a week with no reported
 issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCamYCHg8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ymTpwCgyyS6niRHf2Y0qx/o+i8s87h+ipoAoJeaOzb7
 RWX/ZYiUEoQCtfbxmXZF
 =cRG6
 -----END PGP SIGNATURE-----

Merge tag 'char-misc-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

Pull char/misc driver fixes from Greg KH:
 "Here are a number of small char/misc/etc driver fixes for 7.2-rc5 that
  resolve a bunch of different reported issues. Included in here are:

   - rust_binder error message reporting fix

   - stratix10-svc firmware driver fixes

   - mei driver fix

   - intel_th hardware tracing driver fix

   - comedi driver fix

   - uio_hv_generic driver fix

   - ntsync selftest fix

   - nsm misc driver fix

   - some MAINTAINER file updates

  All of these have been in linux-next for over a week with no reported
  issues"

* tag 'char-misc-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  MAINTAINERS: Update wine-devel list address
  rust_binder: only print failure if error has source
  intel_th: fix MSC output device reference leak
  misc: nsm: pin the module while the device is open
  mei: bus: access mei_device under device_lock on cleanup
  misc: nsm: only unlock nsm_dev on post-lock error paths
  selftests: ntsync: correct CONFIG_NTSYNC name
  comedi: comedi_parport: deal with premature interrupt
  uio_hv_generic: Bind to FCopy device by default
  MAINTAINERS: Add Greg Kroah-Hartman to GPIB
  firmware: stratix10-svc: fix teardown order in remove to prevent race
  firmware: stratix10-svc: handle NO_RESPONSE in async poll
  firmware: stratix10-svc: fix FCS SMC call kernel-doc
  firmware: stratix10-svc: fix memory leaks and list corruption bugs
 2026-07-26 10:47:58 -07:00
Linus Torvalds
73387b89d9 io_uring-7.2-20260724 
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmpkDfYQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpgJgEACAoCs3hC/reUovTYQB8+68AyyBmF5xeJMI
 uxYKcVEZGjOo6gTjSm2GYEBa6P85kQtbWEKEfuxXxV2gT1S/3yulV+uy8NfI/lO7
 NsKYRHszaa/AFr2RbeZeYLU9TN/qFbZinfxukpW1zWrfwg83IhGGe6QN53G1XB2v
 +pO0bqSZ/qKkJ4IXGubLxSxUnDWg6bav4XUeEkjSlE6mzp1+BgpesLLOsZNvvLST
 5QTGt5EfWFBgo9LdYHz/ky7MnJjkioFDY+c10sLp2+6ghtyMTZcACB1W4gSSyJG+
 QsLYJ6Z25f7zo7WIci42pCDDDhYWQgDFc7r9+uJ1ISFKXLGnEyONnBaxmk2LTWdX
 g9V03+pI17vTOQNU0XlkpajUykOmMCkhZWA8jwlOAFJXtz+pdV1vSKeSZt9tEB4j
 aEd6IjoBUrPLsv7WIlomf/h9quHfdjMogA6eyaXc4227XzKWo63XlGe4HxBC6yQQ
 4Lq8QH8dta6BOm+5APQXNQ5g/EB0OVLDkgh8EzSTDChgoJd4hVwoHnGbGidZSAcR
 mgSl4SG/XdXMIwhqAH5iiI+7YZ71ALnoRkLujED90c+lGHrrY0T7H99XaHprp6xa
 NOUbz5CAZf+bWPfXbLpJG+QTh/evh9zxfJ30VprHByl99EJFxjK7rW3BJvOAokjs
 1O635JJo7A==
 =pQDU
 -----END PGP SIGNATURE-----

Merge tag 'io_uring-7.2-20260724' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull io_uring fixes from Jens Axboe:

 - Fix a missing ERESTARTSYS conversion in the read paths, which got
   messed up back when some code consolidation was done for read
   multishot support

 - zcrx UAPI rename, dropping the abbreviated "notif" naming in favor of
   "event" for consistency and to be less ambiguous for users. This was
   added for 7.2, so let's rename it while we still can. No functional
   or code changes, just a strict rename

* tag 'io_uring-7.2-20260724' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring/zcrx: rename notif to event
  io_uring/zcrx: rename ZCRX_NOTIF_NO_BUFFERS
  io_uring/zcrx: drop "notif" from stats struct names
  io_uring/rw: fix missing ERESTARTSYS conversion in read paths
 2026-07-24 19:58:03 -07:00
Linus Torvalds
e2a936998a drm fixes for 7.2-rc5 
MAINTAINERS:
 - update address
 
 ttm:
 - backup pages using correct order
 
 gpusvm:
 - fix mm leak on eviction
 - properly zero page array in mm scanning
 
 tests:
 - fix dma mask errors in tests
 
 panel:
 - fix dependency issues
 - ilitek-ili9881c - fix probing
 
 i915:
 - Remove DP_EDP_BACKLIGHT_AUX_ENABLE_CAP check for DPCD backlight
 
 xe:
 - Skip invalidation for purgeable state updates
 - Add drm_dev guards when detaching CCS read / write buffers
 - Alloc per domain unique i2c id
 - Fix SVM leak on resv obj alloc failure in xe_vm_create
 
 amdgpu:
 - Fix a backport mistake for dm_gpureset_toggle_interrupts()
 - Fix a failure on flip-done timeouts for mode1 reset
 
 appletbdrm:
 - fix issue in damage handling
 
 amdxdna:
 - fix command timeout race
 
 imagination:
 - fix gpu vm locking
 
 vc4:
 - prevent trusted bo from being mapped again
 - prevent timer rearm on shutdown
 
 v3d:
 - fix NULL deref in unbind
 - idle AXI before clock disable on suspend
 - use proper GMP access for newer hw
 
 vmwgfx:
 - validate shader array size
 
 ethosu:
 - fix length calculations
 - handle internal chaining buffers
 
 gma500:
 - return errors from HDMI i2c reads
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmpj0ckACgkQDHTzWXnE
 hr7ExBAAo7QeJH9InKxqEv4Yt+JDcmGM4HhGhMoBkRp3YwgS0JDnUsTZeb2jGSbb
 XgbgfrYa1E8tUYSUUoMRQoHBQffuAXCovsaKxL0WOBaT5S/pIfKYsHyQLEMIFaLs
 /cTH0VZ49VVOrlNyiQp4tUwJTAalRhB4RS+hfDLQMsG2wHdK4jObmamdpNh71vsZ
 K7vPUvhRqyim2r9nVa6pv/LXpjRbtf+tq8cQF0ywW4eybB1zfdk+t8QQlAqkhoph
 FW6Wz8o6d/wFezOyFaItOfJyJS+RPeUIEwWnmqtUM1Qp26DpLmPlH9HPJMl7yjZm
 vrxuCH9B5RBE75PvJX3p9lVgh7ZENtVYboh+YhMSFjqKtirJf4Nm+XoUHwq2bycp
 q5Re9IRlfPacrKe33eetOREmw7nnAtg8mw4VTuZLuYM1MlwZqSRfxVvcBCy1QMOP
 FNcHg63uGogrRj4vdbmDyqmf0hsK1ZeBMH6OKdCe3ABjytFIZ0TxTseytvx7tug1
 ymt0t8W/lFrdZipN8oF36k2VQGLs5k3qAvV90b7RaEL7zpbZHu3H7FNsACk2vOcv
 E5XpvsnVxlgbFUQMDrtV7YxyCrn4+ln9CrAI7St9fIAHNNS7BsmQWe06Co9Kjy+c
 9/aOw4tsZ0GUaPodKQxvvQrTmExzqXMu5iYnm4JTXO2zuSAjFpk=
 =iIeO
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2026-07-25' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "Weekly drm pull request, small and scattered seems to be the new
  normal, the ttm change is probably the largest, with xe being the
  most. Alex was out this week so amdgpu is smaller and only has some
  urgent fixes.

  MAINTAINERS:
   - update mailmap address

  ttm:
   - backup pages using correct order

  gpusvm:
   - fix mm leak on eviction
   - properly zero page array in mm scanning

  tests:
   - fix dma mask errors in tests

  panel:
   - fix dependency issues
   - ilitek-ili9881c - fix probing

  i915:
   - Remove DP_EDP_BACKLIGHT_AUX_ENABLE_CAP check for DPCD backlight

  xe:
   - Skip invalidation for purgeable state updates
   - Add drm_dev guards when detaching CCS read / write buffers
   - Alloc per domain unique i2c id
   - Fix SVM leak on resv obj alloc failure in xe_vm_create

  amdgpu:
   - Fix a backport mistake for dm_gpureset_toggle_interrupts()
   - Fix a failure on flip-done timeouts for mode1 reset

  appletbdrm:
   - fix issue in damage handling

  amdxdna:
   - fix command timeout race

  imagination:
   - fix gpu vm locking

  vc4:
   - prevent trusted bo from being mapped again
   - prevent timer rearm on shutdown

  v3d:
   - fix NULL deref in unbind
   - idle AXI before clock disable on suspend
   - use proper GMP access for newer hw

  vmwgfx:
   - validate shader array size

  ethosu:
   - fix length calculations
   - handle internal chaining buffers

  gma500:
   - return errors from HDMI i2c reads"

* tag 'drm-fixes-2026-07-25' of https://gitlab.freedesktop.org/drm/kernel: (31 commits)
  drm/amd/display: Fix missing DCE check in dm_gpureset_toggle_interrupts()
  drm/amd/display: Fix flip-done timeouts on mode1 reset
  Revert "drm/pagemap: Guard HPAGE_PMD_ORDER use with CONFIG_ARCH_ENABLE_THP_MIGRATION"
  drm/vc4: Shut down BO cache timer before teardown
  drm/tests: shmem: Set DMA mask to 64-bit in drm_gem_shmem
  drm/xe/vm: Fix SVM leak on resv obj alloc failure in xe_vm_create()
  drm/xe/i2c: Allow per domain unique id
  drm/gma500: return errors from Oaktrail HDMI I2C reads
  drm/vc4: hvs/v3d: Fix null dereference in unbind
  drm/panel: fix unmet dependency bug for DRM_PANEL_HIMAX_HX83121A
  drm/panel: s6e3ha8: fix unmet dependency on DRM_DISPLAY_HELPER
  drm/panel: ilitek-ili9882t: fix unmet dependency for DRM_PANEL_ILITEK_ILI9882T
  drm/panel: ilitek-ili9881c: do not fail probe if iovcc is absent
  drm/v3d: Idle AXI transactions before disabling the clock on suspend
  drm/v3d: Reach the GMP through the hub registers on V3D 7.x
  mailmap: Update Maíra Canal's email address
  drm/pagemap: Guard HPAGE_PMD_ORDER use with CONFIG_ARCH_ENABLE_THP_MIGRATION
  drm/pagemap: Clear driver-provided PFNs from migration PFN array
  drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers
  accel: ethosu: Handle U85 internal chaining buffer
  ...
 2026-07-24 14:11:53 -07:00
Linus Torvalds
981f4a2baa fscrypt fixes for v7.2-rc5 
A couple fixes for AI-detected bugs.
 -----BEGIN PGP SIGNATURE-----
 
 iIkEABYIADIWIQSacvsUNc7UX4ntmEPzXCl4vpKOKwUCamPDWBQcZWJpZ2dlcnNA
 a2VybmVsLm9yZwAKCRDzXCl4vpKOK4C8APjY2sD4jMa1oX05SiLL7iUulkTXivOb
 n14nFabjqF25AP9MZImv0oS5eQWt/QPLHfNlB6olRd9Q0GqVOYYdKQ/6DA==
 =pStx
 -----END PGP SIGNATURE-----

Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux

Pull fscrypt fixes from Eric Biggers:
 "A couple fixes for AI-detected bugs"

* tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux:
  fscrypt: Avoid dynamic allocation in fscrypt_get_devices()
  fscrypt: Add missing superblock check in find_or_insert_direct_key()
 2026-07-24 13:12:43 -07:00
Linus Torvalds
86ba24c41a slab fixes for 7.2-rc4 
-----BEGIN PGP SIGNATURE-----
 
 iQFPBAABCAA5FiEEe7vIQRWZI0iWSE3xu+CwddJFiJoFAmpjWAEbFIAAAAAABAAO
 bWFudTIsMi41KzEuMTIsMiwyAAoJELvgsHXSRYia05cH/RmNDT1xgDYobPcl1fDI
 3FkFG4n/cARfh1wWFbV/niNi6q63fq9KyHjNPzkANzDM3CpvdIHzUvF9EzTnj+bW
 6tsdO2qlNMzdB2xAKpGtRqKIuGb1JeG5OtWc/+sHrt8ASdMdQCuufxVe6cKtNCMl
 Xa3JfqNldG4ZSaT+I4OJBkbOVuHtSO/VCX6RTItqXc3NH5CjyMZR+V+3FK/TwvNn
 TAo+MFhTI9tDSge4rDrJSD9Pxddi3UIhvlPxEqlOT0tPUp2PJYCeoOMtPVR/c2LW
 Cz03EwLZWbDg9qTC6cy/ZZu8/7+84VgrQwkNlLkpnPTPaTJ2s04Lg+FIjDCv/LcG
 +Cc=
 =MKn/
 -----END PGP SIGNATURE-----

Merge tag 'slab-for-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab

Pull slab fixes from Vlastimil Babka:

 - Prevent unbounded recursion in free path with memory allocation
   profiling, which has caused a stack overflow on a Meta production
   host due to a 125-deep __free_slab<->kfree recursion (Harry Yoo)

 - Fix type-based partitioning confusing sparse which does not know
   __builtin_infer_alloc_token() (Marco Elver)

 - Fix a potential memory leak in bulk freeing path on NUMA machines
   (Shengming Hu)

* tag 'slab-for-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab:
  slab: silence sparse warning with type-based partitioning
  mm/slab: prevent unbounded recursion in free path with new kmalloc type
  lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled()
  mm/slab: decouple SLAB_NO_SHEAVES from SLAB_NO_OBJ_EXT
  mm/slab: fix a memory leak due to bootstrapping sheaves twice
  mm/slub: fix lost local objects when bulk remote free batch fills
 2026-07-24 07:28:35 -07:00
Dave Airlie
e24b02df4e drm-misc-fixes for v7.2-rc5: 
- Improve damage handling in appletbdrm.
 - Fix harmful fragmenting of MM by backing up TTM pages at native
   page order.
 - Fix timeout handling in amdxdna.
 - Fix imagination locking for map/unmap operations.
 - Fix mm leak in gpusvm eviction.
 - Properly zero page array in gpusvm mm scanning.
 - Prevent trusted shader bo's from being mapped again in vc4.
 - Validate shader array size in vmwgfx.
 - Fix length calculation bugs in ethosu.
 - Better error handling during pagemap migration.
 - Improve v3d suspend.
 - Kconfig updates for some panels.
 - Handle missing iovcc in ili9881c panel.
 - Fix vc4 unbind.
 - Add i2c error handling in gma500.
 - Fix kunit tests on pp64le and s390x.
 - Prevent rearming vc4 timer on shutdown.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEuXvWqAysSYEJGuVH/lWMcqZwE8MFAmpjDjgACgkQ/lWMcqZw
 E8NoIQ/+PaoFa25I+9e+RgtgjYWLKpYoRdDHi7u7zUPzr5Z7XzAGPUYG0lYc6Gxw
 zQicvLcMCiBW8+mwTBytLESIXn5SfjFP0KPYhCnyXSnDRdHiWj+nlXD1A0mG5YQ+
 cFDYyyXS2Ka1TsdPbXr6f3zyNDSuhmRJbo6qGvEYR+KimyHMU8zqXPD6F4GazHd2
 ocQrGzOP3608oJHRiGA5zs5IfupbO5uvQE9oJJ/mpdYxhd4B5hIK7t+8BfkqGJ16
 4v1A5Bb6Gjw9tWZvzEcyIZ/wECrJ7Wgj5Jf87aTWh23Ufdmno3k884ezkYYyTAof
 CJEQ6Rr1kuhbDDGfekzW+5/Z55OJfWDhwhBh9I1897Y9JWPGAArB6zJj1iRaGRJ2
 ictGAWqpQXq8rXqnYsKPmI610Ck1f1aQrC8KEEPHLqW/EfwzLz68YsS9qAnll1Z8
 1rgstWDAFouBeBoW1YNVrM5CtlKzLTrCUa2PVeqaFbxtPEoMzXPZfuP9bUr0AJG7
 uXbPpxoWtzL4BnsDoi1lpZbr02APcuwXC2n76JDj0wRZj+l6RWWWhDlEDHXMwb5s
 OTdtxSgYjiHCargTaL7i0gOFcHScZ901OcSdeLcUnwNDG6T4yLK1EhnX2SKE2lak
 xi0U5oDsnYdJ+WnHmlb1CIbUKRQWZjNENdRSKd48/OhLDaT4YQU=
 =cog2
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-fixes-2026-07-24' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes

drm-misc-fixes for v7.2-rc5:
- Improve damage handling in appletbdrm.
- Fix harmful fragmenting of MM by backing up TTM pages at native
  page order.
- Fix timeout handling in amdxdna.
- Fix imagination locking for map/unmap operations.
- Fix mm leak in gpusvm eviction.
- Properly zero page array in gpusvm mm scanning.
- Prevent trusted shader bo's from being mapped again in vc4.
- Validate shader array size in vmwgfx.
- Fix length calculation bugs in ethosu.
- Better error handling during pagemap migration.
- Improve v3d suspend.
- Kconfig updates for some panels.
- Handle missing iovcc in ili9881c panel.
- Fix vc4 unbind.
- Add i2c error handling in gma500.
- Fix kunit tests on pp64le and s390x.
- Prevent rearming vc4 timer on shutdown.

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Link: https://patch.msgid.link/07284633-6b9b-40f9-8949-b1516a42a34c@linux.intel.com
 2026-07-24 18:30:29 +10:00
Linus Torvalds
d326f83e81 Lots of fixes, double the count even for the "new normal". 
Largely due to my time off followed by a networking conference
 which distracted most maintainers (less so the AI generators).
 
 Including fixes from Bluetooth and WiFi.
 
 Current release - regressions:
 
  - wifi: mt76: fix MAC address for non OF pcie cards
 
 Current release - new code bugs:
 
  - mptcp: fix BUILD_BUG_ON on legacy ARM config
 
  - wifi: cfg80211: guard optional PMSR nominal time
 
 Previous releases - regressions:
 
  - qrtr: ns: raise node count limit to 512, we arbitrarily picked
    256 as a limit, turns out it was too low for real world deployments
 
  - vhost-net: fix TX stall when vhost owns virtio-net header
 
  - eth: amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN
 
  - wifi: ath12k: fix low MLO RX throughput on WCN7850
 
 Previous releases - always broken:
 
  - number of random AI fixes for SCTP, RDS and TIPC protocols
 
  - more AI-looking fixes for WiFi drivers
 
  - number of fixes for missing pointer reloading after skb pull
 
  - reject BPF redirect use from qdisc qevent block
 
  - tcp: initialize standalone TCP-AO response padding
 
  - vsock/virtio: collapse receive queue under memory pressure to avoid
    client OOMing the host with tiny messages
 
  - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup,
    make sure the ICMP response routing follows the routing policy
 
  - gro: fix double aggregation of flush-marked skbs
 
  - ovpn: fix various refcount bugs
 
  - tls: device: push pending open record on splice EOF
 
  - eth: mlx5:
   - use sender devcom for MPV master-up
   - fix MCIA register buffer overflow on 32 dword reads
 
 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE6jPA+I1ugmIBA4hXMUZtbf5SIrsFAmpiX68ACgkQMUZtbf5S
 IrvYsRAAkuMhUpz0Ss9aF7rBY8iTp4SofSvFeVe06ywraUfqPuflGlak07t1Lz/i
 G4MuKXN0q8m+B0EZddfMeYw6rCGd0SCtFAkxUI3dd+pu4hssgioaCPL193drSsfC
 /lYeacjVL45jNrQvAWwKsRaAs3xdwzxWf0ddIXWvVWbdDsVfIf/mYahSS3TvniWw
 MQtEbWPnFwPvOrHzb+1ChLELCtig/yvK+3xS9JrwOkjUF4BczOUgqrYlG5MWerXP
 f/JDLsegPcoZaTycW5F5fshY05umeRQza/zCFqMKQNcQux49fjREnYxBuyTacVCo
 0cxhsNbKOhvBpBFNsHA6TjUbDxuiyL8L/g3e7VOlQFxI4hX3IMsnsP+UrSdE2zyG
 lgFAQ6HIcelgFnzFcwp9YEGsiZ5nDoJKe5aBcgftzTFPx3Plh1UeCrNjYtJawcjk
 1POovopI+G6eszwluVOoucUdDD3wf0jPgDqvdOcI9P9FVTsFmvRESsfen7NbdjG0
 v5mk9+sasWL1dns6mre6nt5is4QWSg7PDjufQUhuPKSSEnld+csEgmyxmUm0/FgL
 krUZLHdx0Yj9yIOAIYAvz8QoW9jHIyK05Mr7CoL4a/9RJ4rtxjb+3CT9qebeyd49
 jK5uzYX6tPHvILFK4CgZwcE/z9S+DoxCAuDEp6LhfstKsJW4KIM=
 =DIF8
 -----END PGP SIGNATURE-----

Merge tag 'net-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Jakub Kicinski:
 "Lots of fixes, double the count even for the 'new normal'. Largely due
  to my time off followed by a networking conference which distracted
  most maintainers (less so the AI generators).

  Including fixes from Bluetooth and WiFi.

  Current release - regressions:

   - wifi: mt76: fix MAC address for non OF pcie cards

  Current release - new code bugs:

   - mptcp: fix BUILD_BUG_ON on legacy ARM config

   - wifi: cfg80211: guard optional PMSR nominal time

  Previous releases - regressions:

   - qrtr: ns: raise node count limit to 512, we arbitrarily picked
     256 as a limit, turns out it was too low for real world deployments

   - vhost-net: fix TX stall when vhost owns virtio-net header

   - eth: amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN

   - wifi: ath12k: fix low MLO RX throughput on WCN7850

  Previous releases - always broken:

   - number of random AI fixes for SCTP, RDS and TIPC protocols

   - more AI-looking fixes for WiFi drivers

   - number of fixes for missing pointer reloading after skb pull

   - reject BPF redirect use from qdisc qevent block

   - tcp: initialize standalone TCP-AO response padding

   - vsock/virtio: collapse receive queue under memory pressure to avoid
     client OOMing the host with tiny messages

   - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup,
     make sure the ICMP response routing follows the routing policy

   - gro: fix double aggregation of flush-marked skbs

   - ovpn: fix various refcount bugs

   - tls: device: push pending open record on splice EOF

   - eth: mlx5:
      - use sender devcom for MPV master-up
      - fix MCIA register buffer overflow on 32 dword reads"

* tag 'net-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (234 commits)
  drop_monitor: perform u64_stats updates under IRQ-disabled section
  drop_monitor: fix size calculations for 64-bit attributes
  net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD
  mptcp: fix BUILD_BUG_ON on legacy ARM config
  selftests: mptcp: userspace_pm: fix undefined variable port
  mptcp: fix stale skb->sk reference on subflow close
  mptcp: pm: userspace: fix use-after-free in get_local_id
  mptcp: decrement subflows counter on failed passive join
  mac802154: hold an interface reference across the scan worker
  sctp: don't free the ASCONF's own transport in DEL-IP processing
  phonet: check register_netdevice_notifier() error in phonet_device_init()
  phonet: pep: fix use-after-free in pep_get_sb()
  bnge/bng_re: fix ring ID widths
  tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()
  net: airoha: fix ETS channel derivation in airoha_tc_setup_qdisc_ets()
  mctp: check register_netdevice_notifier() error in mctp_device_init()
  ptp: netc: explicitly clear TMR_OFF during initialization
  rds: tcp: unregister sysctl before tearing down listen socket
  ipv6: Change allocation flags to match rcu_read_lock section requirements
  net: slip: serialize receive against buffer reallocation
  ...
 2026-07-23 12:58:08 -07:00
Vikas Gupta
b9e558976b bnge/bng_re: fix ring ID widths 
Firmware requires more than 16 bits to address TX ring IDs for its
internal QP management. Widen the associated HSI ring ID fields to
32 bits. The values firmware assigns remain within 24 bits, bounded
by the hardware doorbell XID field.

The fw_ring_id field belongs to bnge_ring_struct, a common struct
shared by all ring types, so widening it to u32 applies uniformly
across TX, RX, CP, and NQ rings but firmware assigns values within
16-bit range for all ring types except TX, which requires the wider
field.

Note that, Thor Ultra hardware has not yet been deployed and no
firmware has been released to field, so backward compatibility
is not a concern.

Fixes: 42d1c54d62 ("bnge/bng_re: Add a new HSI")
Signed-off-by: Vikas Gupta <vikas.gupta@broadcom.com>
Reviewed-by: Siva Reddy Kallam <siva.kallam@broadcom.com>
Reviewed-by: Dharmender Garg <dharmender.garg@broadcom.com>
Reviewed-by: Yendapally Reddy Dhananjaya Reddy <yendapally.reddy@broadcom.com>
Link: https://patch.msgid.link/20260721063731.2622500-1-vikas.gupta@broadcom.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2026-07-23 10:24:12 -07:00
Yuxiang Yang
a28c4fcbf7 tcp: challenge ACK for non-exact RST in SYN-RECEIVED 
The SYN-RECEIVED request-socket path in tcp_check_req() accepts an
in-window RST without requiring SEG.SEQ to exactly match RCV.NXT.  A
non-exact RST therefore removes the request instead of eliciting a
challenge ACK.

RFC 9293 section 3.10.7.4 applies the RFC 5961 reset check in
SYN-RECEIVED: an exact RST resets the connection, while a non-exact
in-window RST must trigger a challenge ACK and be dropped.

Apply that check before the ACK-field validation, following the RFC
sequence-number, RST, then ACK processing order.  Factor the per-netns
challenge ACK quota out of tcp_send_challenge_ack() so request sockets
can share it.  Use the request socket's send_ack() callback and its own
out-of-window ACK timestamp to send and rate-limit the response.

Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Reported-by: Ao Wang <wangao@seu.edu.cn>
Reported-by: Xuewei Feng <fengxw06@126.com>
Reported-by: Qi Li <qli01@tsinghua.edu.cn>
Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
Fixes: 282f23c6ee ("tcp: implement RFC 5961 3.2")
Cc: stable@vger.kernel.org
Signed-off-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260717081443.809393-2-yangyx22@mails.tsinghua.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2026-07-23 08:27:22 -07:00
Gal Pressman
11c057d234 net/mlx5: Fix MCIA register buffer overflow on 32 dword reads 
The MCIA register can return up to 32 dwords (128 bytes) when the device
advertises the mcia_32dwords capability, but struct
mlx5_ifc_mcia_reg_bits only defines dword_0..11, leaving room for just
12 dwords (48 bytes) of data.

mlx5_query_mcia() clamps the read size to mlx5_mcia_max_bytes() and then
memcpy()s that many bytes out of the register, potentially reading past
the end of the 'out' buffer. On kernels built with FORTIFY_SOURCE this
is caught as a buffer overflow while reading the module EEPROM via
ethtool:

  detected buffer overflow in memcpy
  kernel BUG at lib/string_helpers.c:1048!
  RIP: 0010:fortify_panic+0x13/0x20
  Call Trace:
   mlx5_query_mcia.isra.0+0x200/0x210 [mlx5_core]
   mlx5_query_module_eeprom_by_page+0x4a/0xa0 [mlx5_core]
   mlx5e_get_module_eeprom_by_page+0xbb/0x120 [mlx5_core]
   eeprom_prepare_data+0xf3/0x170
   ethnl_default_doit+0xf1/0x3b0

Extend the mcia_reg layout to 32 dwords.

Fixes: 271907ee2f ("net/mlx5: Query the maximum MCIA register read size from firmware")
Signed-off-by: Gal Pressman <gal@nvidia.com>
Reviewed-by: Alex Lazar <alazar@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20260717072338.1240582-1-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2026-07-23 08:19:29 -07:00
Usama Arif
0ef8faff49 fs: push nr_cached_objects memcg gating into individual filesystems 
Commit 0baad6f9b9 ("fs/super: skip non-memcg-aware nr_cached_objects
in memcg slab shrink") added a check in fs/super.c that skipped every
->nr_cached_objects() hook whenever the shrinker was invoked for a
non-root memcg, on the assumption that none of them honour sc->memcg.

That assumption is wrong for XFS, whose inode-reclaim hook is
intentionally driven from per-memcg contexts to free memcg-charged
slab. Encoding a blanket "never memcg-aware" policy in fs/super.c
short-circuits that path.

Push the check down into the callbacks whose counters really are
irrelevant to per-memcg reclaim - btrfs_nr_cached_objects() and
shmem_unused_huge_count() - and drop the fs/super.c gate. Each
filesystem can now lift the restriction independently if its counter
later grows memcg awareness, without touching fs/super.c.

Introduce mem_cgroup_shrink_is_root() in <linux/memcontrol.h> so the
callbacks don't open-code "sc->memcg is NULL or root".

Fixes: 0baad6f9b9 ("fs/super: skip non-memcg-aware nr_cached_objects in memcg slab shrink")
Acked-by: Qi Zheng <qi.zheng@linux.dev>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Shakeel Butt <shakeel.butt@linux.dev>
Signed-off-by: Usama Arif <usama.arif@linux.dev>
Link: https://patch.msgid.link/20260715103516.2410175-1-usama.arif@linux.dev
Acked-by: David Sterba <dsterba@suse.com>
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
 2026-07-23 11:35:02 +02:00
Jakub Kicinski
9a67bbfe48 bluetooth pull request for net: 
- hci_sync: Protect UUID list traversal
  - RFCOMM: Fix session UAF in set_termios
  - btusb: validate Realtek vendor event length
 -----BEGIN PGP SIGNATURE-----
 
 iQJNBAABCgA3FiEE7E6oRXp8w05ovYr/9JCA4xAyCykFAmpfl74ZHGx1aXoudm9u
 LmRlbnR6QGludGVsLmNvbQAKCRD0kIDjEDILKZFrD/9Rz76Gvy+aZyGh2+UuESoJ
 vHf9SVxbrm9x2wEYE2rAoAQJuJu8ZgqDQdcYfJV83DHgNoiPrhSCRd+4jtPo685S
 8GCgzoqNU/xBiKGoFZ8ZGxp0RvmfuUmsxfB72Zv8mUY1wknyl8d+Paro2xkz2N72
 aqD20OKjhbqoe9tUwY901Oshct2IQlalaIuc5GjabGH7dGM7c4MALrj+0noBYWEJ
 XIgdcKe6cum2wnUL+ENEUi1Fg4T2u3b1L3aK8YY8Uz6Afx95vSRFLGThmNblDP4k
 X1QgPYRuRTZhFVCJdVcsJY/3gGl8pOYQAYZyAvxkJaxmKQSx7tAIMW3iuU6Bn6HX
 tzgQQ0gXHKbzMx1pEYnxzC5x5UHri4LNjoUhmkcy2J7/LT83pRw021OVyi7j6ll2
 dslrATixXFD6qQsVib+N+J07bSSuD6vSy6ys0tEUeWvxLvkocoGv8nsqQf9b+G6Y
 dbD6REScKk2U9meiEYfoIRFMzEFvZAsjieKoG/GFs9rNJjRfKsKopWxBAxg6Q2+K
 D2YYlrAc4kIbjE7iPBTMwJD98M7wywY93NQ/AR1+Ba1PNToJcGJp0XQ2LMq+nVte
 z8C8/0Yud6UVS58aJTHMN9hEuVCmyeE4OYNNfispH8QNi/vNZX5GSgYmnoqcrFaP
 uG5sKL8odHeNPAUh4xyBbQ==
 =Au1d
 -----END PGP SIGNATURE-----

Merge tag 'for-net-2026-07-21' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth

Luiz Augusto von Dentz says:

====================
bluetooth pull request for net:

 - hci_sync: Protect UUID list traversal
 - RFCOMM: Fix session UAF in set_termios
 - btusb: validate Realtek vendor event length

* tag 'for-net-2026-07-21' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:
  Bluetooth: btusb: validate Realtek vendor event length
  Bluetooth: RFCOMM: Fix session UAF in set_termios
  Bluetooth: hci_sync: Protect UUID list traversal
====================

Link: https://patch.msgid.link/20260721160240.884274-1-luiz.dentz@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2026-07-22 10:18:59 -07:00
Pavel Begunkov
e366c15e16 io_uring/zcrx: rename notif to event 
"Notification" is too long and the abbreviated version is used in
several places, which is inconsistent and more ambiguous for users.
Rename it to event, which is easier to keep consistent. To keep the
change small, only change uapi/ + do necessary fix ups, and the rest of
internals can be adjusted in the next release.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://patch.msgid.link/f95ca6717da3c8d3649a1a7f0d883a563f545052.1784726895.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
 2026-07-22 09:48:42 -06:00
Pavel Begunkov
201e308102 io_uring/zcrx: rename ZCRX_NOTIF_NO_BUFFERS 
ZCRX_NOTIF_NO_BUFFERS tells when page pool fails to allocate memory from
zcrx. "No buffers" could be more confusing, rename it to
ZCRX_NOTIF_ALLOC_FAIL.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://patch.msgid.link/29bd4fc069bc89691868beba0627ffbe570c2722.1784726895.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
 2026-07-22 09:48:42 -06:00
Pavel Begunkov
af78c00204 io_uring/zcrx: drop "notif" from stats struct names 
Keep zcrx statistics generic and don't stick "notif" to its uapi
definitions. Stats dosn't need to be bound to notification details,
it makes it cleaner and more readable.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://patch.msgid.link/6a39676b6f71b67d3f89c6ebab7a3739873834a3.1784726895.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
 2026-07-22 09:48:41 -06:00
Linus Torvalds
51f247c4b2 for-7.2-rc4-tag 
-----BEGIN PGP SIGNATURE-----
 
 iQJPBAABCgA5FiEE8rQSAMVO+zA4DBdWxWXV+ddtWDsFAmpdukAbFIAAAAAABAAO
 bWFudTIsMi41KzEuMTIsMiwyAAoJEMVl1fnXbVg70hwQAJ78AUVnvTSwMi2w6TEx
 KFYZSMPdBi9TwGC3lDCcTA/U5PqGTkKACWBLf5z+9YXAcb3By7OiSAQeko7sib0X
 k0jz5SmJjMHrHe1qGQvaztLin9/Ow9K8/QUQW0qhunwF6FbmgkfWdXw4au5+zV5R
 rwdyDt74nlhf3pCOpJb1JL2BFy23PXbfQIty9I+2qKUMPSgqhC6l7CBYsWZoG5ub
 QC2+Go5Ygz61iKDpAZ3TKjULI58+7K3FBq+76Jr9UajPVD75637Wze3zsrgcb2LV
 THxITsWTxx5CwiQF1Sf0JGo/rU+V0wU5oJqwmn4FrGeZXhnGXXcnXmG70VzvAJYX
 4so+p0aejefqQnwcFbQE0+dFjrEuD+Dl8PVzlDSMygz/y1xpSlxVz+83kQFH+MV6
 1bxrOJNS6sLwvqtwRa8INjqvMfk443Ub5sFUS+bav0ZUlOg3BmitkEP0H0NlQ+5p
 CAMCXFSfb/1UDXMrMHAcZn3LZtDLNaVVkneCz97A72D5C6Ae4rL3/FeHvmDk1KUh
 StO3ReF4JXeN3FYTzWpMIw07jGxR9ZuFVn78DAW9Gwjk658wsXBqcGPgg/GAsy6R
 bvrFRkWiJGSSdUeipNwxjfTeM8NwkA7fv+DnLbp6HzpOLDKIC8pID1Eoh1nwTlas
 R073SeoNHO0sC6Lz+2NcvVMb
 =1jNx
 -----END PGP SIGNATURE-----

Merge tag 'for-7.2-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux

Pull btrfs fixes from David Sterba:
 "I'm catching up with the fix backlog in the development branch, so
  here's a number of them and will probably send one more for this or
  the next rc:

   - relocation fixes:
     - skip attempting compression on reloc inodes
     - exclude inline extents from file extent offset checks
     - fix minor memory leak after error when adding reloc root
     - fix root cleanup after inserting and merging

   - fix clearing folio tags after writeback

   - clear logging flag of extent map before splitting

   - fix unsigned 32/64 type conversions when accounting dirty metadata,
     leading to continually exceeding threshold

   - fix regression in 32bit compat ioctl for subvolume info

   - fix type of SEARCH_TREE ioctl buffer in UAPI header

   - fix expression in ASSERT expression which can be unconditionally
     evaluated on some compilers

   - only account delalloc bytes for regular inodes"

* tag 'for-7.2-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
  btrfs: fix GET_SUBVOL_INFO after compat refactor
  btrfs: free mapping node on duplicate reloc root insert
  btrfs: fix a regression where PAGECACHE_TAG_DIRTY is never cleared
  btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps
  btrfs: fix u32 to s64 type conversion in dirty_metadata_bytes accounting
  btrfs: fix NULL pointer deref during assertion in btrfs_backref_free_node()
  btrfs: only account delalloc bytes for regular file inodes in btrfs_getattr()
  btrfs: reject inline file extents item in get_new_location()
  btrfs: do not try compression for data reloc inodes
  btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8
  btrfs: fix reloc root cleanup in merge_reloc_roots()
  btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol()
 2026-07-21 08:06:24 -07:00
Marco Elver
5ff172f6c9 slab: silence sparse warning with type-based partitioning 
Sparse does not know __builtin_infer_alloc_token() and complains:

	sparse: sparse: undefined identifier '__builtin_infer_alloc_token'

Fix it by using a dummy variant of __kmalloc_token() if __CHECKER__ is
defined.

Fixes: feb662d916 ("slab: support for compiler-assisted type-based slab cache partitioning")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202607110912.nZTqfCrH-lkp@intel.com/
Signed-off-by: Marco Elver <elver@google.com>
Link: https://patch.msgid.link/20260721092005.1986693-1-elver@google.com
Acked-by: Harry Yoo (Oracle) <harry@kernel.org>
Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
 2026-07-21 11:28:21 +02:00
Jamal Hadi Salim
ec48b3be2c net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains 
When a TC filter attached to a qdisc filter chain returns
TC_ACT_REDIRECT (ex: via an eBPF program calling bpf_redirect() or an
act_bpf action), the redirect was silently lost i.e no qdisc classify
function handled TC_ACT_REDIRECT, so the packet fell through the
switch and was enqueued normally instead of being redirected.

This has been broken since bpf_redirect() was introduced for TC in
commit 27b29f6305 ("bpf: add bpf_redirect() helper"). We got lucky
for a long time because bpf_net_context was a per-CPU variable that
was always available.

commit 401cb7dae8 ("net: Reference bpf_redirect_info via task_struct
on PREEMPT_RT.") turned bpf_net_context into a task_struct member that
is only set up by explicit callers. Without a caller setting it up,
bpf_redirect() itself crashes with a NULL pointer dereference in
bpf_net_ctx_get_ri(). However, even with bpf_net_context available,
TC_ACT_REDIRECT from qdisc filter chains cannot be honored without
adding skb_do_redirect() calls to every qdisc classify function, which
would require changes across net/sched/. Isolate it to ebpf core where
it belongs.

Instead, add a tcf_classify_qdisc() inline helper in pkt_cls.h, as a
wrapper around tcf_classify() for use by qdisc classify functions and
tcf_qevent_handle(). When the classify verdict is TC_ACT_REDIRECT,
the wrapper converts it to TC_ACT_SHOT, dropping the packet rather
than letting it continue silently. Dropping is preferred over
letting the packet through because the user immediately sees packet
loss. Silently passing the packet through would hide the problem and
leave the user wondering why their redirect is not working.

The clsact fast path, tc_run() continues to call tcf_classify() directly
and is unaffected: TC_ACT_REDIRECT is returned as-is and handled by
sch_handle_egress/ingress() calling skb_do_redirect() as before.

Fixes: 27b29f6305 ("bpf: add bpf_redirect() helper")
Fixes: 401cb7dae8 ("net: Reference bpf_redirect_info via task_struct on PREEMPT_RT.")
Tested-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://patch.msgid.link/20260706185609.330006-3-daniel@iogearbox.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2026-07-20 18:16:43 -07:00
Qi Zheng
de4660898b mm: mglru: fix stale batch updates after memcg reparenting 
The mglru page table walker batches per-generation size deltas in
walk->nr_pages while walking page tables without holding the lruvec lock. 
The reset_batch_size() later folds those deltas into walk->lruvec under
the lruvec lock.

The page table walker can run concurrently with the memcg reparenting path
as follows:

CPU0                           CPU1
====                           ====

walk_mm
--> walk_page_range
    --> update_batch_size
        --> walk->nr_pages += delta

                              mem_cgroup_css_offline
                              --> memcg_reparent_objcgs
                                  --> lock lruvec
                                      lru_gen_reparent_memcg
                                      --> reparent child folios to parent
                                      unlock lruvec

    lock lruvec
    reset_batch_size
    --> child lrugen->nr_pages += delta

This will trigger the following warning in lru_gen_exit_memcg():

	VM_WARN_ON_ONCE(memchr_inv(lruvec->lrugen.nr_pages, 0,
				   sizeof(lruvec->lrugen.nr_pages)));

And the user-visible impact of underestimated nr_pages in MGLRU was
premature OOMs because MGLRU does not try to reclaim memory when nr_pages
reaches zero, but there are still more pages.

To fix it, make reset_batch_size() check CSS_DYING under RCU before
flushing the pending batch.  A non-dying memcg keeps the original lruvec
stable against RCU-delayed offlining; a dying memcg redirects the deltas
to the first non-dying ancestor.

Link: https://lore.kernel.org/20260710154318.75388-1-qi.zheng@linux.dev
Fixes: f304652609 ("mm: vmscan: prepare for reparenting MGLRU folios")
Signed-off-by: Qi Zheng <zhengqi.arch@bytedance.com>
Reported-by: Peiyang He <peiyang_he@smail.nju.edu.cn>
Closes: https://lore.kernel.org/all/5A9E929D82717101+12fcf643-efb8-4b9a-a53a-1e28cc894f0b@smail.nju.edu.cn
Reviewed-by: Harry Yoo (Oracle) <harry@kernel.org>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Barry Song <baohua@kernel.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: Kairui Song <kasong@tencent.com>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Wei Xu <weixugc@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-07-20 17:41:28 -07:00
Chengfeng Ye
c783399efc Bluetooth: RFCOMM: Fix session UAF in set_termios 
rfcomm_tty_set_termios() tests dlc->session without rfcomm_mutex and
later passes the pointer to rfcomm_send_rpn(). The latter dereferences
both session->initiator and session->sock. Meanwhile, krfcommd can
unlink the DLC and free the session while holding rfcomm_mutex.

The race can proceed as follows:

  TTY ioctl task                 krfcommd
  --------------                 --------
  load dlc->session
  enter rfcomm_send_rpn()
                                 lock rfcomm_mutex
                                 clear dlc->session
                                 free session
                                 unlock rfcomm_mutex
  read session->initiator

KASAN reported:

  BUG: KASAN: slab-use-after-free in rfcomm_send_rpn+0x297/0x2a0
  Read of size 4 at addr ffff88810012a850 by task poc/92

  Call Trace:
   rfcomm_send_rpn+0x297/0x2a0
   rfcomm_tty_set_termios+0x50d/0x850
   tty_set_termios+0x596/0x950
   set_termios+0x46a/0x6e0
   tty_mode_ioctl+0x152/0xbd0
   tty_ioctl+0x915/0x1240
   __x64_sys_ioctl+0x134/0x1c0

  Allocated by task 92:
   rfcomm_session_add+0x9e/0x2e0
   rfcomm_dlc_open+0x8b1/0xe00
   rfcomm_dev_activate+0x85/0x1a0
   rfcomm_tty_open+0x90/0x280

  Freed by task 68:
   kfree+0x131/0x3c0
   rfcomm_session_del+0x119/0x180
   rfcomm_run+0x737/0x4710

Add rfcomm_dlc_send_rpn(), which holds rfcomm_mutex while it verifies
that the DLC is still attached and sends the RPN frame. Have the TTY
path use the helper and drop its unlocked session check. This keeps the
session valid through both the frame construction and socket send.

Fixes: 3a5e903c09 ("[Bluetooth]: Implement RFCOMM remote port negotiation")
Cc: stable@vger.kernel.org
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
 2026-07-20 17:41:07 -04:00
Linus Torvalds
b95f03f04d 12 hotfixes. 8 are cc:stable and the remainder address post-7.1 issues or 
aren't considered appropriate for backporting.  10 are for MM.
 
 All are singletons - please see the relevant changelogs for details.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCal5rBQAKCRDdBJ7gKXxA
 jtgtAQCuWNUTCR7u+MzAuO3Nh46DxHXeb27OTHZL8JcazQTEQgD+NZfwqVYnNNX/
 4CVqqZvrXJQDg0aiWtIP4VdLirNh/Ac=
 =Gslp
 -----END PGP SIGNATURE-----

Merge tag 'mm-hotfixes-stable-2026-07-20-11-37' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull misc fixes from Andrew Morton:
 "12 hotfixes. 8 are cc:stable and the remainder address post-7.1 issues
  or aren't considered appropriate for backporting. 10 are for MM.

  All are singletons - please see the relevant changelogs for details"

* tag 'mm-hotfixes-stable-2026-07-20-11-37' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
  mm/memory-failure: trace: change memory_failure_event to ras subsystem
  mm: page_reporting: allow driver to set batch capacity
  mm/kmemleak: fix checksum computation for per-cpu objects
  mm/damon/core: disallow overlapping input ranges for damon_set_regions()
  MAINTAINERS: add Usama as a THP reviewer
  fat: avoid stack overflow warning
  mm/damon/core: validate ranges in damon_set_regions()
  m68k: avoid -Wunused-but-set-parameter in clear_user_page()
  mm/huge_memory: set PG_has_hwpoisoned only after new folio head is established
  mm/page_vma_mapped: fix device-private PMD handling
  MAINTAINERS: s/SeongJae/SJ/
  userfaultfd: prevent registration of special VMAs
 2026-07-20 13:04:47 -07:00
Eric Biggers
6fe4e4b825 fscrypt: Avoid dynamic allocation in fscrypt_get_devices() 
When a blk_crypto_key starts being used or is evicted, fs/crypto/ calls
fscrypt_get_devices() to get the filesystem's list of block devices,
then iterates over them and calls blk_crypto_config_supported(),
blk_crypto_start_using_key(), or blk_crypto_evict_key() on each one.

Currently, the block device pointers are placed in a dynamically
allocated array.  This dynamic allocation is problematic because:

- It can fail, especially at the fscrypt_destroy_inline_crypt_key() call
  site when it's invoked for inode eviction under direct reclaim.

- fscrypt_destroy_inline_crypt_key() doesn't handle the failure.  It
  just zeroizes and frees the blk_crypto_key without calling
  blk_crypto_evict_key().  That causes a use-after-free.

For now, let's fix this in the straightforward and easily-backportable
way by switching to an on-stack array.  Currently the fscrypt
multi-device functionality is used only by f2fs, which has a hardcoded
limit of 8 block devices.  An on-stack array works fine for that.

(Of course, this solution won't scale up to large number of block
devices.  For that we'd need a different solution, like moving the block
device iteration into the filesystem.  Or in the case of btrfs, which
will only support blk-crypto-fallback, we should make it just call
blk-crypto-fallback directly, so the block devices won't be needed.)

Fixes: 22e9947a4b ("fscrypt: stop holding extra request_queue references")
Cc: stable@vger.kernel.org
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260713023708.9245-1-ebiggers%40kernel.org
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20260719055602.78828-1-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
 2026-07-20 10:39:24 -07:00
Linus Torvalds
f2ec6312bf SCSI fixes on 20260718 
The biggest core change is the reliable wake fix for scsi_schedule_eh
 which is used by both libata and libsas which could otherwise cause
 error handler hangs due to rare races.  All other fixes are in drivers
 (well except the export symbol removal) the next biggest being the
 target PR-OUT transportid parsing fix.
 
 Signed-off-by: James E.J. Bottomley <James.Bottomley@HansenPartnership.com>
 -----BEGIN PGP SIGNATURE-----
 
 iLgEABMIAGAWIQTnYEDbdso9F2cI+arnQslM7pishQUCalvAVRsUgAAAAAAEAA5t
 YW51MiwyLjUrMS4xMiwyLDImHGphbWVzLmJvdHRvbWxleUBoYW5zZW5wYXJ0bmVy
 c2hpcC5jb20ACgkQ50LJTO6YrIUI/QD+Kr/rBo60RkNJfsdC6vmHj0+pkkSpQNkM
 XGTZXjPz+poBAL7ybOwWvQWYoJ2LLDg10F9dSb68DxE2FJAS3lzM0IGf
 =dhtX
 -----END PGP SIGNATURE-----

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
 "The biggest core change is the reliable wake fix for scsi_schedule_eh
  which is used by both libata and libsas which could otherwise cause
  error handler hangs due to rare races.

  All other fixes are in drivers (well except the export symbol removal)
  the next biggest being the target PR-OUT transportid parsing fix"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path
  scsi: elx: efct: Fix refcount leak in efct_hw_io_abort()
  scsi: elx: efct: Fix I/O leak on unsupported additional CDB
  scsi: core: wake eh reliably when using scsi_schedule_eh
  scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
  scsi: target: Bound PR-OUT TransportID parsing to the received buffer
  scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup()
  scsi: sg: Report request-table problems when any status is set
  scsi: ufs: core: tracing: Do not dereference pointers in TP_printk()
  scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block()
  scsi: xen: scsiback: Free the command tag on the TMR submit-failure path
  scsi: xen: scsiback: Free unsubmitted command instead of double-putting it
  scsi: core: Remove export for scsi_device_from_queue()
 2026-07-18 12:36:19 -07:00
Linus Torvalds
7d6ca51a44 drm fixes for 7.2-rc4 
ttm:
 - Handle NULL pages and backup handles in ttm_pool_backup() correctly.
 
 gpusvm:
 - Improve unmap and error handling on gpusvm.
 
 udmabuf:
 - Always synchronize for CPU in begin_cpu_udmabuf.
 
 xe:
 - Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOCK
 - Hold a dma-buf reference for imported BOs
 - Fix writable override for CRI
 - Fix VF CCS attach/detach race with in-flight BO moves
 - Fix WOPCM size for LNL+
 - Reset current_op in xe_pt_update_ops_init
 - Keep scheduler timeline name alive
 - Hold device ref until queue teardown completes
 - Disable display in admin only PF mode
 
 i915:
 - NV12 display fix for bigjoiner
 - clear watermark on plane disable
 - GT selftest fixes
 
 host1x:
 - Fix UAF
 
 amdxdna
 - Fix UAF
 - Reject more invalid amdxdna command submissions.
 
 ivpu:
 - Fix wrong read
 - Handle invalid firmware log in ivpu.
 
 panthor:
 - Fix error handling
 
 virtio:
 - Fix virtio deadlock
 - Fix invalid gem detach.
 
 amdgpu:
 - DCN 4.2 fixes
 - NUTMEG fixes
 - 8K panel fix
 - Backlight fixes
 - UserQ fix
 - Fix bo->pin leaking in amdgpu_bo_create_reserved()
 - VFCT fixes
 - devcoredump fixes
 - Display fixes
 - SMU7 DPM fix
 - AC/DC fixes for SMU7 and SI
 - Queue reset fix
 - PCIe DPM fix
 - XHCI/GPU resume ordering fix
 - Pageflip timeout fix
 
 amdkfd:
 - Fix potential overflow in CWSR size calculation
 - DQM error clean up fixes
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmpauCwACgkQDHTzWXnE
 hr4xMw/+LIYBn7zptNvi0VK8YmgJpyEhpHSVbdCA2syFuhcFYoqs7YEQMQN5I5NR
 Dk6HofKEAQkzZWucLDmCeRSe7f1dfq6zCZE6l/Mgmwxt3EpTMT2MrbzLUCJkKi6W
 63q6F9T238Q8x0ceXnJJOxFS3BkDgyHy0UkxUcicMo5tLw4p7rsn+h18bMmBIj+x
 0ekxJ444ZHBChhjEGYA575KOaOAuFT4V+GCRdw2BriEgWcoKCQkuWH+nbSkrB/p2
 C+Yf2ruK0onLQu5nhmkumc0hPjS+qctOFSPYNUVa/73RtWzEKZxLmMamEf+zZOGU
 UuLE2aoGQ4HDqnxZdXiv+J+1HS42XoM3tCpKnUHXgY2y7aoB91M5A7thPk3oem/C
 lrQlPyoS5sZbl7OdJO6DzD2G6Nr/9eHzzS8HoYrJc4TE6p9rnSMThIeXXaryTSCz
 CYo3lasMJaZ+HM3wUz6vxUykdmoic09siqGV9T4j7IOcb9r6fg7tJIARjx8tVyRy
 4C55z3J9fKV5OJpPDondCY8/pRLqhyoZXOBMk8vzG1gjnVSbSplVjcb4iAjn6/vQ
 blV4EMhkMVa3f2cVE5+jaCxe8jEVEQsBkLeKUxl/x6XJ0YLTFPZUqom33S3dkwCI
 pFt2XRNs/fgBuVuf4ZSgaSX4Smrv5OY2gxC6jGqdyteI9fAbNZk=
 =SJsq
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2026-07-18-1' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Daie Airlie:
 "Weekly drm fixes, there is amdgpu, xe and i915 and then a lot of
  scattered fixes.

  Looks about the right level for the new right.

  ttm:
   - Handle NULL pages and backup handles in ttm_pool_backup() correctly

  gpusvm:
   - Improve unmap and error handling on gpusvm

  udmabuf:
   - Always synchronize for CPU in begin_cpu_udmabuf

  xe:
   - Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOCK
   - Hold a dma-buf reference for imported BOs
   - Fix writable override for CRI
   - Fix VF CCS attach/detach race with in-flight BO moves
   - Fix WOPCM size for LNL+
   - Reset current_op in xe_pt_update_ops_init
   - Keep scheduler timeline name alive
   - Hold device ref until queue teardown completes
   - Disable display in admin only PF mode

  i915:
   - NV12 display fix for bigjoiner
   - clear watermark on plane disable
   - GT selftest fixes

  host1x:
   - Fix UAF

  amdxdna
   - Fix UAF
   - Reject more invalid amdxdna command submissions

  ivpu:
   - Fix wrong read
   - Handle invalid firmware log in ivpu

  panthor:
   - Fix error handling

  virtio:
   - Fix virtio deadlock
   - Fix invalid gem detach

  amdgpu:
   - DCN 4.2 fixes
   - NUTMEG fixes
   - 8K panel fix
   - Backlight fixes
   - UserQ fix
   - Fix bo->pin leaking in amdgpu_bo_create_reserved()
   - VFCT fixes
   - devcoredump fixes
   - Display fixes
   - SMU7 DPM fix
   - AC/DC fixes for SMU7 and SI
   - Queue reset fix
   - PCIe DPM fix
   - XHCI/GPU resume ordering fix
   - Pageflip timeout fix

  amdkfd:
   - Fix potential overflow in CWSR size calculation
   - DQM error clean up fixes

* tag 'drm-fixes-2026-07-18-1' of https://gitlab.freedesktop.org/drm/kernel: (61 commits)
  Revert "drm/amd/display: Restore 5s vbl offdelay for NV3x+ DGPUs"
  drm/amd/display: check GRPH_FLIP status before sending event
  drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock
  drm/amd: Create a device link between APU display and XHCI devices
  drm/amd/display: wire DCN42B mcache programming callback
  drm/amd/display: set new_stream to NULL after release
  drm/amd/display: Force PWM backlight on Lenovo Legion 5 15ARH05
  drm/amdkfd: free MQD managers on DQM init failures
  drm/amdgpu/ttm: Consider concurrent VM flushes for buffer entities
  drm/amd/pm/smu7: Fix AC/DC switch notification
  drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge
  drm/amdgpu: always emit the job vm fence
  drm/amd/pm/si: Fix AC/DC switch notification
  drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized
  drm/amd/display: dce100: skip non-DP stream encoders for DP MST
  drm/amd/display: Set native cursor mode for disabled CRTCs
  drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X)
  drm/amd/display: fix __udivdi3 link error
  drm/amdgpu: Reserve space for IB contents in devcoredumps
  drm/amdgpu: Print vmid, pasid and more task info in devcoredump
  ...
 2026-07-17 16:56:55 -07:00
Alessandro Rinaldi
bad177fa75 drm/amd/display: Force PWM backlight on Lenovo Legion 5 15ARH05 
The Lenovo Legion 5 15ARH05 (Renoir) ships a BOE 0x08DF eDP panel that
advertises AUX/DPCD backlight control, so amdgpu's automatic detection
(amdgpu_backlight == -1) selects AUX. On this panel the AUX backlight
path has no effect: brightness writes are accepted but the panel level
never changes, the display is stuck at a fixed brightness and
max_brightness is reported as a bogus 511000. As a result neither the
desktop brightness slider nor the brightness hotkeys do anything.

Forcing PWM backlight (amdgpu.backlight=0) restores working control:
max_brightness becomes 65535 and the level tracks writes. This has long
been applied by users as a manual kernel-parameter workaround.

Extend the generic panel backlight quirk with a force_pwm flag, add an
entry for the Legion 5 15ARH05 / BOE 0x08DF panel, and have amdgpu
disable AUX backlight (use PWM) when the quirk matches and the user
lets the driver auto-select the backlight type.

Signed-off-by: Alessandro Rinaldi <ale@alerinaldi.it>
Tested-by: Alessandro Rinaldi <ale@alerinaldi.it>
Reviewed-by: George Zhang <george.zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 81b39f43e7)
Cc: stable@vger.kernel.org
 2026-07-17 17:41:15 -04:00
Linus Torvalds
94515f3a7d BPF fixes: 
- Fix a UAF in socket clone early bailout paths (Matt Bobrowski)
 
 - Reject unhashed UDP sockets on sockmap update to prevent refcount leaks
   (Michal Luczaj)
 
 - Account for receive queue data in FIONREAD on sockmap sockets without a
   verdict program (Mattia Meleleo)
 
 - Reject negative constant offsets for verifier buffer pointers (Sun Jian)
 
 - Fix for tracing of kfuncs with implicit arguments (Ihor Solodrai)
 
 Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQR0/74CM8h5+1E9pgtHLTd7Y1QvgwUCalp3/AAKCRBHLTd7Y1Qv
 g9J/AQCJzidAmStp1i074sZC7sC1uq+aYIvwycpMTp6hVgyP+AEAw7oKcnGkPGXs
 jeEDctaLtxBnPMXGAR5UaeqdNqu9ywQ=
 =zQgn
 -----END PGP SIGNATURE-----

Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Pull bpf fixes from Kumar Kartikeya Dwivedi:

 - Fix a UAF in socket clone early bailout paths (Matt Bobrowski)

 - Reject unhashed UDP sockets on sockmap update to prevent refcount
   leaks (Michal Luczaj)

 - Account for receive queue data in FIONREAD on sockmap sockets without
   a verdict program (Mattia Meleleo)

 - Reject negative constant offsets for verifier buffer pointers (Sun
   Jian)

 - Fix for tracing of kfuncs with implicit arguments (Ihor Solodrai)

* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
  selftests/bpf: Cover tracing implicit kfunc args
  bpf: Fix tracing of kfuncs with implicit args
  selftests/bpf: Cover negative buffer pointer offsets
  bpf: Reject negative const offsets for buffer pointers
  selftests/bpf: Test FIONREAD on a sockmap socket without a verdict program
  bpf, sockmap: Account for receive queue in FIONREAD without a verdict program
  selftests/bpf: Fail unbound UDP on sockmap update
  selftests/bpf: Adapt sockmap update error handling
  bpf, sockmap: Reject unhashed UDP sockets on sockmap update
  selftests/bpf: Ensure UDP sockets are bound
  bpf: Fix UAF in sock clone early bailouts
 2026-07-17 12:55:24 -07:00
Linus Torvalds
e13caf1c26 Including fixes from Wireless, IPsec, Netfilter and Bluetooth. 
Current release - new code bugs:
 
   - netfilter: flowtable: use correct direction to set up tunnel route
 
 Previous releases - regressions:
 
   - wifi:
     - mac80211:
       - free AP_VLAN bc_buf SKBs outside IRQ lock
       - defer link RX stats percpu free to RCU
       - fix double free on alloc failure
     - cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock
 
   - ipv4: free fib_alias with kfree_rcu() on insert error path
 
   - sched: act_tunnel_key: Defer dst_release to RCU callback
 
   - xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
 
   - bluetooth: fix locking in unpair_device/disconnect_sync
 
   - can: add locking for raw flags bitfield
 
   - openvswitch: reject oversized nested action attrs
 
   - eth: bnxt_en: handle partially initialized auxiliary devices
 
   - eth: ppp: defer channel free to an RCU grace period to fix UAF
 
 Previous releases - always broken:
 
   -  netfilter: xt_nat: reject unsupported target families
 
   -  wifi:
      - brcmfmac: fix heap overflow on a short auth frame
      - cfg80211: add missing FTM API validation
 
   - xfrm:
     - reject optional IPTFS templates in outbound policies
     - policy: preallocate inexact bins before xfrm_hash_rebuild reinsert
 
   - bluetooth: revalidate LOAD_CONN_PARAM queued update
 
   - can: fix lockless bound/ifindex race and silent RX_SETUP failure
 
   - eth: mlx5: free mlx5_st_idx_data on final dealloc
 
 Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCgAwFiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmpaK6YSHHBhYmVuaUBy
 ZWRoYXQuY29tAAoJECkkeY3MjxOks1UQAIHudLSXUxTTf+MktIkdEHkJFAaokN6s
 haDwhoi5rxQqigZ883Y6V4AShPnV2HawMaNhGa9biqJ9N4QP9ahPsQbT5mrBNrGx
 Vse9y73L69/6pT2wbpBHKmmiGRR/0BxGICFHPUlmX2Zdzc+nwlArt+5Zlhmzbg/q
 +eSuRylnGv8Y82oQOSxMjf5WZyAsW55tLYLBRpOUeNY6GTWpkecPqCUTCAj3Sn6t
 IQHkFbNVDM6i0oFr117J94a/Q5pSrO17W+GxwS0b5t9Ly1txJYAtfiSGjXToS7aJ
 TXnsGbqUZ1bqc87Z5ZBucw9LGpnyZ6ui8Z0+oAS24RxFf6eJUTo8+ULbGBBYCyIH
 Xk5wQbAz1bms37s01VRsGyUyC1VCiYjSpUT5AZf3vWJfhFNBpVQTMj0IVQsoktZO
 ryxypbYgRUB7DQe9GXyheSoEuLkH5XECQ5GyQ4t6gcMtJrBu6XtPU/EUlf6GLT2s
 kW3VKn4Oc2t3hpEDxs2y2pE93QezdTFQU5ecs2hWSUMn00DMLoj100uODCBwIu/L
 9f50TWA+koAMKyTNu36Zd0QdsrMLRzux+lSScBgIb1WxXWq9aXemV/vZNnmjdtlJ
 CIWFM9AIxhXkL9t9l/8o9tBEaKb0WBQJY4TiCRxs3AwKzKK59ZB+PJ4DZt47YUyC
 i56jtKMYTAT4
 =KH/H
 -----END PGP SIGNATURE-----

Merge tag 'net-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Paolo Abeni:
 "Including fixes from Wireless, IPsec, Netfilter and Bluetooth.

  Current release - new code bugs:

    - netfilter: flowtable: use correct direction to set up tunnel route

  Previous releases - regressions:

    - wifi:
       - mac80211:
          - free AP_VLAN bc_buf SKBs outside IRQ lock
          - defer link RX stats percpu free to RCU
          - fix double free on alloc failure
       - cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock

    - ipv4: free fib_alias with kfree_rcu() on insert error path

    - sched: act_tunnel_key: Defer dst_release to RCU callback

    - xfrm: fix sk_dst_cache double-free in xfrm_user_policy()

    - bluetooth: fix locking in unpair_device/disconnect_sync

    - can: add locking for raw flags bitfield

    - openvswitch: reject oversized nested action attrs

    - eth:
       - bnxt_en: handle partially initialized auxiliary devices
       - ppp: defer channel free to an RCU grace period to fix UAF

  Previous releases - always broken:

    -  netfilter: xt_nat: reject unsupported target families

    -  wifi:
        - brcmfmac: fix heap overflow on a short auth frame
        - cfg80211: add missing FTM API validation

    - xfrm:
       - reject optional IPTFS templates in outbound policies
       - policy: preallocate inexact bins before xfrm_hash_rebuild reinsert

    - bluetooth: revalidate LOAD_CONN_PARAM queued update

    - can: fix lockless bound/ifindex race and silent RX_SETUP failure

    - eth: mlx5: free mlx5_st_idx_data on final dealloc"

* tag 'net-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (108 commits)
  mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n
  llc: fix SAP refcount leak when creating incoming sockets
  selftests: netconsole: only restore MAC when it changed on resume
  bnxt_en: Handle partially initialized auxiliary devices
  sctp: fix auth_hmacs array size in struct sctp_cookie
  net/sched: act_tunnel_key: Defer dst_release to RCU callback
  dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync()
  tcp: fix TIME_WAIT socket reference leak on PSP policy failure
  net/mlx5: free mlx5_st_idx_data on final dealloc
  can: isotp: serialize TX state transitions under so->rx_lock
  can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER
  can: isotp: use unconditional synchronize_rcu() in isotp_release()
  can: bcm: track a single source interface for ANYDEV timeout/throttle ops
  can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()
  can: bcm: fix stale rx/tx ops after device removal
  can: bcm: add missing device refcount for CAN filter removal
  can: bcm: validate frame length in bcm_rx_setup() for RTR replies
  can: bcm: extend bcm_tx_lock usage for data and timer updates
  can: bcm: add missing rcu list annotations and operations
  can: bcm: fix CAN frame rx/tx statistics
  ...
 2026-07-17 10:25:13 -07:00
Matthew Brost
a3fdf74ffa drm/ttm/pool: back up at native page order 
ttm_pool_split_for_swap() unconditionally splits high-order pool pages
into order-0 pages before backup, so every compound the shrinker
touches is shattered even when the rest of the system would prefer it
stay intact. Under sustained kswapd pressure this fragments memory
enough to drive other parts of MM into recovery loops.

Back up each compound at its native order instead. In
ttm_pool_backup(), hand the full compound to the new
ttm_backup_backup_folio(), which backs up subpages to a contiguous
range of shmem indices and returns the base handle plus the number of
subpages actually backed up (@nr_backed). On full success, free the
compound once at its native order -- no split_page(), no per-4K
refcount juggling.

A per-folio backup can't be made fully atomic under memory pressure:
ttm_backup_backup_folio() must allocate shmem folios before source
subpages can be released, so under true OOM any subpage may fail
while the rest of the compound is still live. Two mechanisms handle
this without regressing reclaim behaviour:

  - alloc_gfp gets __GFP_NOMEMALLOC whenever order > 0 (cleared again
    for order-0), so a high-order backup fails fast with -ENOMEM
    instead of draining kernel reserves, leaving them for other
    allocations under the same pressure.

  - If ttm_backup_backup_folio() still returns a short @nr_backed with
    a valid handle for the successfully-backed prefix, split the
    source compound with ttm_pool_split_for_swap(), free the prefix as
    order-0 pages (already safely in shmem), and retry the remaining
    subpages at order 0, where __GFP_NOMEMALLOC is cleared and
    reserves may be used as a last resort.

This preserves the original split-on-OOM fallback while keeping the
common case fragmentation-free, and preserves the "partial backup is
allowed" contract (shrunken is incremented per subpage backed up).

The restore-side leftover-page split in ttm_pool_restore_commit() is
left as-is: it's unreachable in practice and not worth complicating
the restore state machine to avoid.

Testing: the existing backup_fault_inject point only truncated
tt->num_pages, which never exercised the reactive split path above
since it never left a compound partially backed up. Wire fault
injection into ttm_backup_backup_folio() itself: past the first
subpage of a compound, synthesize a -ENOMEM in place of
shmem_read_folio_gfp() when should_fail() trips, producing the same
short @nr_pages_backed a real failure would and forcing
ttm_pool_backup() through the split-and-retry path. The fault_attr
stays private to ttm_pool.c; ttm_backup.c reaches it through
ttm_backup_fault_inject_folio(), declared in ttm_pool_internal.h.

While converting the writeback branch to operate on the whole folio,
the unlock condition after shmem_writeout() also changed from `if
(ret)` to `if (ret == AOP_WRITEPAGE_ACTIVATE)`, matching the actual
contract: shmem_writeout()/swap_writeout() only leave the folio locked
when returning AOP_WRITEPAGE_ACTIVATE; any other return (including a
hard error from arch_prepare_to_swap()) means the folio was already
unlocked internally. The old `if (ret)` check would have double-
unlocked in that hard-error case.

Cc: Christian Koenig <christian.koenig@amd.com>
Cc: Huang Rui <ray.huang@amd.com>
Cc: Matthew Auld <matthew.auld@intel.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: David Airlie <airlied@gmail.com>
Cc: Simona Vetter <simona@ffwll.ch>
Cc: dri-devel@lists.freedesktop.org
Cc: linux-kernel@vger.kernel.org
Cc: stable@vger.kernel.org
Fixes: b63d715b80 ("drm/ttm/pool, drm/ttm/tt: Provide a helper to shrink pages")
Suggested-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Link: https://patch.msgid.link/20260716201358.4086085-1-matthew.brost@intel.com
 2026-07-17 09:09:27 -07:00
Linus Torvalds
111e7b23e5 SoC fixes for 7.2 
There are only three devicetree fixes this time: one critical memory
 corruption fix for Renesas and three minor corrections for Tegra.
 
 The MAINTAINERS file is updated for a new maintainer of the CIX platform
 and two address changes.
 
 The rest is all driver fixes, mostly firmware:
 
  - multiple runtime issues in ARM SCMI and FF-A firmware code, dealing
    with error handling for corner cases in firmware.
 
  - multiple fixes for reset drivers, dealing with individual platform
    specific mistakes and more error handling
 
  - minor build and runtime fixes for the Tegra SoC drivers
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmpaP90ACgkQmmx57+YA
 GNlLkBAAiObAyuy5l4MxvbKmYz60DpPLigpJdHJxBk3xr4cB3+QO8hFxVQ9mJvJD
 bfSTq3c0fjHdoBBl20/YjAwimkDvgzSkIDVNMRpOeK32ME7QbsTA5lpoGiDDiFfS
 VtZ/RWTH2TyejKU0gUwBZhH7UogFBPmUleefOLc2aPGG+1tZSmbQFmK0eFXt+fvP
 Wo0aPrDg0hs+KBq2UK2jN/ir9F50qIvYGDnz3m6t0aZzXfbWM0JQ8t59WlVl8cbq
 FOLpqE7CjEXu+sUW0xRvJ88D25JtL7sa5oFI4cELzJKnrnb/hPHZ5TN484AeGMGO
 pDb+4jT04xV6YdCowNSYf6FHYXD2yJAGU1N39DKZkPRRh9nkcjxsQKl8uGtgV8sO
 YI+Wj5sGKaLDNWDQc75ew0s17S75/WsIijGfp04XsLRxDoup6NiENiOvsZL+ERc+
 5BHzJ/KUF58sLK097vKYhX6DWFqKX5O44i7kB5HqZUKC8SbekQ5ZwqsEFGKneNYW
 Nu73fzgDeKQRMyJ+Y6hYnDXdWjTZPLQMcMniJm3FXUvPdJNPSgJd6W3Vej+Ww4gN
 vF/t7/qPJl333HIK0hmKD8xh4Vkk3JvmAPMStjfRkW3yAWY2MpTbnJkLyoIDiuoM
 F0vSvAg4RLbC2SWqC+IeEY9rRMgMOVisrnuJIM09l5DwAiPof/k=
 =BN00
 -----END PGP SIGNATURE-----

Merge tag 'soc-fixes-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

Pull SoC fixes from Arnd Bergmann:
 "There are only three devicetree fixes this time: one critical memory
  corruption fix for Renesas and three minor corrections for Tegra.

  The MAINTAINERS file is updated for a new maintainer of the CIX
  platform and two address changes.

  The rest is all driver fixes, mostly firmware:

   - multiple runtime issues in ARM SCMI and FF-A firmware code, dealing
     with error handling for corner cases in firmware.

   - multiple fixes for reset drivers, dealing with individual platform
     specific mistakes and more error handling

   - minor build and runtime fixes for the Tegra SoC drivers"

* tag 'soc-fixes-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
  arm64: dts: renesas: ironhide: Describe inline ECC carveouts
  MAINTAINERS: Update maintainer and git tree for CIX SoC
  ARM: Don't let ARMv5 platforms select USE_OF
  MAINTAINERS: Update SpacemiT SoC git tree repository
  firmware: arm_scmi: Rate-limit queue-full warnings in IRQ context
  firmware: arm_scmi: Use 64-bit division for clock rate rounding
  reset: imx7: Correct polarity of MIPI CSI resets on i.MX8MQ
  reset: sunxi: fix memory region leak on ioremap failure
  dt-bindings: reset: altr: add COMBOPHY_RESET for Agilex5
  reset: spacemit: k3: fix USB2 ahb reset
  firmware: arm_scmi: Grammar s/may needed/may be needed/
  firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()
  firmware: arm_ffa: Respect firmware advertised RX/TX buffer size limits
  arm64: tegra: Fix CPU1 node unit-address on Tegra264
  arm64: tegra: Fix CPU compatible string to cortex-a78ae on Tegra234
  MAINTAINERS: .mailmap: update Jens Wiklander's email address
  soc/tegra: fuse: Fix spurious straps warning on SMCCC platforms
  soc/tegra: pmc: fix #ifdef block in header
  drm/tegra: Fix a strange error handling path
  arm64: tegra: Remove fallback compatible for GPCDMA
 2026-07-17 08:52:09 -07:00
Greg Kroah-Hartman
48ca706b8f firmware: stratix10-svc: fixes for v7.2 
- Fix a memory leak by explicitly using kfree() to match the list-managed lifetime
 - Fix FCS SMC call documentation
 - Add proper handling of a no response from the SDM
 - Fix teardown order of service driver
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEoHhMeiyk5VmwVMwNGZQEC4GjKPQFAmpWtbsACgkQGZQEC4Gj
 KPQK1w/5AQ/6CZdKEdxd/PiajG8vdp0LaBoDoQxbOlRbj+W9BBrAGHM1Ehv1zhQv
 oK7ZGMqIjgvcnFPe2oqqwp4RO9T50vf+HrrY7cxWMkyb7uxSWftLR87o1m46Nm7c
 7kL9P5oSXybSLSuoQz5/KdeFcmlTrBi+fqAfCLb0UhLMOTBLo4nkmfQCr9mYAE2E
 KHkJWRigjH9I/netKfe9HJUIZaD7f4kG12uqo7BJK+KuA2rzJiGjlZGXIwTJh4xL
 obMfGSLwhSNQovxIqGvbD5tKqNxJ1luhrPPfTQkanna9keoLwUndAm4l6bX0rrTT
 Uz9E+G8rJ/TWeHqjTplJ4+QphdCnXz4XQvq8X8LFPnqPhL+LKysmLHzoO2sLBF+F
 pwD9qv4sl334kn0u+jnfjY1ry2PaidwcVubG7He4uW7le95lFap2tvyDY1yhRGxH
 76uq3jm+bb5lZE4xyhvJzWU1P0e5oBPaQSglh+xukM2ghAVRgHV59HNMTJOUldKG
 LlXh/5k76ETBXcIH0QyBZ0jMEpzZH8HnH3/j3CQ0OTTeH59f93h5obU2GWt7Tkac
 ZzAtbtmbi7GLwl517g8AuWHV97fLYE26C4Nqlz1sUbRiWSHcEIV6RbP1vRwsGfZT
 bCiZUHEzOUFwP595U3lbEJ6lqCGqS0Zo0WYuoxa84f3Np5m4Ajo=
 =Yzbe
 -----END PGP SIGNATURE-----

Merge tag 'svc_fixes_for_v7.2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into char-misc-linus

Dinh writes:

firmware: stratix10-svc: fixes for v7.2
- Fix a memory leak by explicitly using kfree() to match the list-managed lifetime
- Fix FCS SMC call documentation
- Add proper handling of a no response from the SDM
- Fix teardown order of service driver

* tag 'svc_fixes_for_v7.2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux:
  firmware: stratix10-svc: fix teardown order in remove to prevent race
  firmware: stratix10-svc: handle NO_RESPONSE in async poll
  firmware: stratix10-svc: fix FCS SMC call kernel-doc
  firmware: stratix10-svc: fix memory leaks and list corruption bugs
 2026-07-17 14:26:33 +02:00
Xin Long
e0b5252a59 sctp: fix auth_hmacs array size in struct sctp_cookie 
The auth_hmacs array in struct sctp_cookie is supposed to store a complete
SCTP_AUTH_HMAC_ALGO parameter, which consists of a struct sctp_paramhdr
followed by N HMAC identifiers.

However, the array size was calculated using an extra 2 bytes instead of
sizeof(struct sctp_paramhdr), which is 4 bytes. When four HMAC identifiers
are configured, the HMAC-ALGO parameter stored in the endpoint is larger
than the auth_hmacs buffer in the cookie.

As a result, sctp_association_init() copies beyond the end of auth_hmacs
when initializing the association, corrupting the adjacent auth_chunks
field. This can lead to an invalid HMAC identifier being accepted and later
cause an out-of-bounds read in sctp_auth_get_hmac().

Fix the array size calculation by including the full SCTP parameter header
size.

Fixes: 1f485649f5 ("[SCTP]: Implement SCTP-AUTH internals")
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Xin Liu <dstsmallbird@foxmail.com>
Reported-by: Zihan Xi <xizh2024@lzu.edu.cn>
Reported-by: Ren Wei <enjou1224z@gmail.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/634a0de0d5de29532915e6d47c92a0cbc206e03f.1783707155.git.lucien.xin@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 2026-07-17 12:27:53 +02:00
Paolo Abeni
892d3087c4 linux-can-fixes-for-7.2-20260716 
-----BEGIN PGP SIGNATURE-----
 
 iIkEABYKADEWIQSl+MghEFFAdY3pYJLMOmT6rpmt0gUCaljFDxMcbWtsQHBlbmd1
 dHJvbml4LmRlAAoJEMw6ZPquma3ScvEBAMN4/7N+Es+yBfeHYu2A+6b+5qeW+4Px
 WtxSffc9OxxtAP9H/UhgxnZdzgCalXipwZGjwSKgm87vPU8H1GDKlX3LBw==
 =EJTl
 -----END PGP SIGNATURE-----

Merge tag 'linux-can-fixes-for-7.2-20260716' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can

Marc Kleine-Budde says:

====================
pull-request: can 2026-07-16

this is a pull request of 19 patches for net/main.

The first patch is by Alexander Hölzl and fixes the Kconfig
description of the vxcan driver.

Next patch by Fan Wu fixes the tear down order in the esd_usb driver.

Followed by a patch by Oliver Hartkopp that adds missing locking for
the raw flags in the CAN_RAW protocol.

Shuhao Fu's patch for the j1939 protocol fix lockless
local-destination check.

Stéphane Grosjean updates their email address.

The next 11 patches all target the CAM Broadcast Manager protocol. One
contributed by Lee Jones the remaining ones by Oliver Hartkopp. They
fix several concurrency and locking issues found by various bots.

The last 3 patches are also by Oliver Hartkopp fixing concurrency and
locking issues found by various bots in the CAN ISO Transport
Protocol.

linux-can-fixes-for-7.2-20260716

* tag 'linux-can-fixes-for-7.2-20260716' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can:
  can: isotp: serialize TX state transitions under so->rx_lock
  can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER
  can: isotp: use unconditional synchronize_rcu() in isotp_release()
  can: bcm: track a single source interface for ANYDEV timeout/throttle ops
  can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler()
  can: bcm: fix stale rx/tx ops after device removal
  can: bcm: add missing device refcount for CAN filter removal
  can: bcm: validate frame length in bcm_rx_setup() for RTR replies
  can: bcm: extend bcm_tx_lock usage for data and timer updates
  can: bcm: add missing rcu list annotations and operations
  can: bcm: fix CAN frame rx/tx statistics
  can: bcm: add locking when updating filter and timer values
  can: bcm: fix lockless bound/ifindex race and silent RX_SETUP failure
  can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF
  can: peak: Modification of references to email accounts being deleted
  can: j1939: fix lockless local-destination check
  can: raw: add locking for raw flags bitfield
  can: esd_usb: kill anchored URBs before freeing netdevs
  can: vxcan: Kconfig: fix description stating no local echo provided
====================

Link: https://patch.msgid.link/20260716155528.809908-1-mkl@pengutronix.de
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 2026-07-17 11:38:27 +02:00
Ihor Solodrai
3917b1012e bpf: Fix tracing of kfuncs with implicit args 
A kfunc marked with KF_IMPLICIT_ARGS flag takes implicit arguments
(such as bpf_prog_aux) that the verifier injects at load time.
resolve_btfids strips those from the kfunc's BTF-visible prototype and
keeps the real kernel ABI in a counterpart _impl prototype [1].

fentry/fexit/fmod_ret/fsession programs may attach to the BPF kernel
functions, including those with implicit args. However
bpf_check_attach_target() and bpf_check_attach_btf_id_multi() extract
the struct btf_func_model from the wrong BTF prototype of the
kfunc. The btf_func_model is later read to construct the trampoline,
which then causes the injected implicit argument to be clobbered and
the kfunc dereferencing garbage.

Add btf_attach_func_proto() to resolve the real ABI prototype of the
kfunc the way the call site does: by looking up the _impl prototype
for a KF_IMPLICIT_ARGS kfunc. Use it at both attach-target model
construction sites.

To enable this, make two supporting changes:
  * pass bpf_verifier_log instead of bpf_verifier_env to
    find_kfunc_impl_proto(), so it can be reused from the attach path
  * add btf_kfunc_check_flag() to test a flag across all of a kfunc's
    hook sets, because a program attaching to a kfunc is not in the
    kfunc's call-set

KF_IMPLICIT_ARGS must be consistent across the sets, so
btf_kfunc_check_flag() returns -EINVAL on inconsistency.

btf_kfunc_check_flag() reads the kfunc's flags from the target's
kfunc_set_tab. For a module BTF that table is stable only after the
module is live, so take a module reference around the read, mirroring
how the kfunc call path gates the same lookup with btf_try_get_module().

The remaining call sites of btf_distill_func_proto() are safe as
is. The BPF_TRACE_ITER case distills a registered iterator's
prototype, and bpf_struct_ops_desc_init() distills the
function-pointer members of a struct_ops type. Neither is a kfunc, and
so can't have implicit arguments.

[1] https://lore.kernel.org/all/20260120222638.3976562-1-ihor.solodrai@linux.dev/

Fixes: 64e1360524 ("bpf: Verifier support for KF_IMPLICIT_ARGS")
Reported-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
Link: https://github.com/sched-ext/scx/issues/3687#issuecomment-4906694106
Link: https://patch.msgid.link/20260713235223.1639022-2-ihor.solodrai@linux.dev
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
 2026-07-16 16:11:29 -07:00
Linus Torvalds
4302c3503c pmdomain providers: 
- imx: Assign child domains for imx93 to prevent power off when in use
  - imx: Fix i.MX8MP power up sequences
  - mediatek: Fix possible nullptr in HWV cleanup/on-check
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmpY0fEQHHVsZmhAa2Vy
 bmVsLm9yZwAKCRD+JoQlc1iMKZtVD/9E1rSTcAK/tHKIt2Ng8hLPZgWib8z8JjDj
 OU8i5kmMJHnymEcnWYllMFkAjJicVauo3kbNyMZqtU+TxDTqrZgUjWzO9Pu7OGMy
 ZA4YBBGnDQP7faRrfTDB31EVuwxziTq9kcctpqkYEiSWnN1+ZOpAF2vqfHvOEek0
 v82Wu6fSorZXeXYjH49sEEAW8qiel8u3gA6ctHv2MFXD7fqK6POTTWpHdvnBI0rp
 CRP4imWH6tTKC2FVMw5rLel+JzHU6y658Qg/gd2AVtG+8nQH/LX7gu0M2tg0E/Sq
 TTMbRSnS93+rlTyWSkJgIyQnlSGkYddHJEGDFxaUxfln2LiLCNeXgbPcJvAQIEji
 GH5AeJEoz6XtkVBsv4Aga+EG1O154YKQ8/jnGGM2q+cFrBItfeiNcSwhexHoNMnw
 hIcKW7lvmEUM/N/GS3wsBBJBftAz8bmeSITEqrVzscIZRVjWlElYrtAuG+cmKagc
 jamfwQDJ2WfzJz9lolSMbKobo6bJEzmxqvP6cN1iVgHkdm22BxE29q2/XACilzH4
 ASMHbkxd3gAR2P4HrzhxX6jn0SI7YxJCfrI1aYD6yKKp7MA2sdWBm3IVTREHZhP2
 5FiArPQced3tjdtlDfbXLan1AmEiZ49o31fEUssylA4D7Z1G8qKB7RXXphDayRM/
 ATNSav1EzQ==
 =tWH8
 -----END PGP SIGNATURE-----

Merge tag 'pmdomain-v7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm

Pull pmdomain fixes from Ulf Hansson:
 "imx:
   - Assign child domains for imx93 to prevent power off when in use
   - Fix i.MX8MP power up sequences

  mediatek:
   - Fix possible nullptr in HWV cleanup/on-check"

* tag 'pmdomain-v7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm:
  pmdomain: mediatek: Fix possible nullptr KP in HWV cleanup/on-check
  pmdomain: imx: Fix i.MX8MP VC8000E power up sequence
  pmdomain: imx: Fix i.MX8MP power notifier
  pmdomain: imx93-blk-ctrl: Extract PHY as shared domain for DSI/CSI
  dt-bindings: power: imx93: Add MIPI PHY power domain
 2026-07-16 08:46:20 -07:00
Stéphane Grosjean
d83762005c can: peak: Modification of references to email accounts being deleted 
Following the sale of PEAK-System France by HMS-Networks, this update is
intended to change all my @hms-networks.com email addresses to my new
@peak-system.fr address.

Signed-off-by: Stéphane Grosjean <s.grosjean@peak-system.fr>
Link: https://patch.msgid.link/20260410124251.40506-1-stephane.grosjean@free.fr
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
 2026-07-16 09:12:24 +02:00
Paolo Bonzini
15f8ba7806 KVM/arm64 fixes for 7.2, take #2 
- Move locking for kvm_io_bus_get_dev() into the caller, ensuring
   race-free checks that the returned object is of the correct type
 
 - Fix initialisation of the page-table walk level when relaxing
   permissions
 
 - Correctly update the XN attribute when relaxing permissions
 
 - Fix the sign extension of loads from emulated MMIO regions
 
 - Assorted collection of fixes for pKVM's FFA proxy, together with a
   couple of FFA driver adjustments
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEn9UcU+C1Yxj9lZw9I9DQutE9ekMFAmpOLOIACgkQI9DQutE9
 ekPH5Q//VrbqIVfJekxRoI0B8zWpnG52q9ILdZBEhTL+xHEP+Z8WawzbpfHzv9LQ
 tt7rUk8gmkGBvMXdY3fZaLkaQRDGvg51SKclxIaoNdmrav7Sscz/sar7P8QWUuIb
 d0EQ3hqV+2hvNFqUVy0cTAFoog0U00KDpdBV136ePTYgT7/N0B8fiFStdHzVP80H
 0WbeWnB0LB15mnkCkO0QY4QmEozfnjKYPrhv52fZFSmnc0BLY3muSR0y+lZ1FtN0
 c2aUiYH/iyIkmmpEZyMYzzhwnMkPwwTIof1OgQ93//JUPkmEUtun5SNQ9YaQw/cd
 /IKDo5xhEn/3jH6Zo2th8oKhH4q5mSOxBd8WH/hkwnTpZYbUZ5Q0647QHHEtWWEp
 mEdQFroaORrPXtHfKSeltkr5JKWK9vweARwbTcLmNwbGfLqZGgJe8/FgOw8Q3lXB
 wZcmNc5TqGe4QWiatH7qKTdqulWdQMrRE2XRAinfrfOfZMg69cnNizWAdNPVhPfw
 B5yewkPrPwZNNXGksZOXfbFN7TnIM2M8j7uwXl5D3rGi/ebDp5ByuVKkP5ZNLnz3
 D666cORhX1zdCfqbLx4mhPs+vcqmL8HHMASlaJg+hH1se/veLbkEZ9GIrjw8Y0iO
 SMUJvwJ5Z2SZpvCKGsC85Wdm/pIBLLh5ISIW8wDIIw+7BoMrXFY=
 =RmEk
 -----END PGP SIGNATURE-----

Merge tag 'kvmarm-fixes-7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD

KVM/arm64 fixes for 7.2, take #2

- Move locking for kvm_io_bus_get_dev() into the caller, ensuring
  race-free checks that the returned object is of the correct type

- Fix initialisation of the page-table walk level when relaxing
  permissions

- Correctly update the XN attribute when relaxing permissions

- Fix the sign extension of loads from emulated MMIO regions

- Assorted collection of fixes for pKVM's FFA proxy, together with a
  couple of FFA driver adjustments
 2026-07-15 12:13:30 +02:00
Mattia Meleleo
04af4efde5
 		bpf, sockmap: Account for receive queue in FIONREAD without a verdict program 
tcp_bpf_ioctl() answers SIOCINQ from psock->msg_tot_len, which only
counts bytes in ingress_msg. Without a stream/skb verdict program
nothing is diverted there: data stays in sk_receive_queue, so FIONREAD
returns 0 even though read() returns data.

Add tcp_inq() to the reported value when the psock has no verdict
program. The two queues are disjoint, so bytes redirected into
ingress_msg from other sockets stay correctly accounted through
msg_tot_len.

Remove unused sk_psock_msg_inq().

Fixes: 929e30f931 ("bpf, sockmap: Fix FIONREAD for sockmap")
Signed-off-by: Mattia Meleleo <mattia.meleleo@coralogix.com>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Reviewed-by: John Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/bpf/20260708-fionread-no-verdict-v3-1-b4ee31b3af53@coralogix.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
 2026-07-15 11:10:14 +02:00
Adrian Ng Ho Yin
9e1dc434ca firmware: stratix10-svc: handle NO_RESPONSE in async poll 
Define INTEL_SIP_SMC_STATUS_NO_RESPONSE (0x3) and handle it in
stratix10_svc_async_poll() the same way as INTEL_SIP_SMC_STATUS_BUSY,
returning -EAGAIN so callers can retry instead of treating the poll as
a hard failure.

When the Secure Device Manager has not yet produced a response for an
asynchronous transaction, ATF is expected to return
INTEL_SIP_SMC_STATUS_NO_RESPONSE. Without this handling, the service
layer maps the status to -EINVAL and async clients cannot distinguish
"not ready yet" from a real error.

Fixes: bcb9f4f070 ("firmware: stratix10-svc: Add support for async communication")
Cc: stable@vger.kernel.org
Signed-off-by: Adrian Ng Ho Yin <adrian.ho.yin.ng@altera.com>
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
 2026-07-14 16:33:21 -05:00
Harry Yoo (Oracle)
d9e6a76239 mm/slab: prevent unbounded recursion in free path with new kmalloc type 
Commit 280ea9c315 ("mm/slab: avoid allocating slabobj_ext array from
its own slab") avoided recursive allocation of obj_exts from kmalloc
caches of the same size, by bumping the obj_exts array's allocation
size whenever the array size equals the size of the object being
allocated.

However, as reported by Danielle Costantino and Shakeel Butt,
even slabs from kmalloc caches of different sizes can form a cycle
by allocating obj_exts arrays from each other [1]:

  What happened: a KMALLOC_NORMAL slab's obj_exts array (used by
  allocation profiling / memcg accounting) is itself kmalloc()'d from a
  KMALLOC_NORMAL cache, so the "slab holds another slab's obj_exts array"
  relation can form cycles. With sizeof(struct slabobj_ext) == 16 and
  the host's geometry:

  - kmalloc-512 has 64 objects/slab -> array is 64*16 == 1024 bytes,
    served from kmalloc-1k;
  - kmalloc-1k  has 32 objects/slab -> array is 32*16 ==  512 bytes,
    served from kmalloc-512.

  A kmalloc-512 slab and a kmalloc-1k slab therefore hold each other's
  obj_exts array.  Discarding one frees the other's array, which empties
  and discards that slab, which frees the first's array, and so on:
  __free_slab() -> free_slab_obj_exts() -> kfree() -> discard_slab() ->
  __free_slab() recurses along the cycle until the stack is exhausted.

With memory allocation profiling, this allows unbounded recursion
in the free path and led to a stack overflow on a production host in
the Meta fleet [1]:

  BUG: TASK stack guard page was hit
  Oops: stack guard page
  RIP: 0010:kfree+0x8/0x5d0
  Call Trace:
   __free_slab+0x66/0xc0
   kfree+0x3f0/0x5d0
   ... ( ~125x __free_slab <-> kfree ) ...
   <kernel driver freeing a resource>
   do_syscall_64

It is proposed [1] to resolve this issue by always serving the obj_exts
array allocation from kmalloc caches (or large kmalloc) of sizes larger
than the object size. However, as pointed out by Vlastimil Babka [2],
this can waste an excessive amount of memory as slabs from large
kmalloc sizes (e.g. kmalloc-8k) generally need obj_exts arrays much
smaller than the object size.

Therefore, rather than bumping the size, let us take a different
approach; disallow formation of cycles between kmalloc types when
allocating obj_exts arrays. Currently, all obj_exts arrays are served
from normal kmalloc caches. Cycles cannot be created if obj_exts arrays
of normal kmalloc caches are served from a special kmalloc type that can
never have obj_exts arrays.

To achieve this, create a new kmalloc type called KMALLOC_NO_OBJ_EXT.
KMALLOC_NO_OBJ_EXT caches are created with SLAB_NO_OBJ_EXT flag when
either 1) memory allocation profiling is not permanently disabled,
or 2) kmalloc types with a priority higher than KMALLOC_CGROUP are
aliased with KMALLOC_NORMAL.

Sheaf bootstrapping for KMALLOC_NO_OBJ_EXT caches now must be deferred
because allocation of a barn can trigger obj_exts array allocation of
normal kmalloc caches when the KMALLOC_NO_OBJ_EXT cache for that size
is not ready yet. For simplicity, perform bootstrapping of sheaves for
all kmalloc caches later.

Introduce a new slab alloc flag, SLAB_ALLOC_NO_OBJ_EXT, to prevent
allocation of obj_exts arrays, and let kmalloc_slab() override the type
to KMALLOC_NO_OBJ_EXT when specified. Note that kmalloc_type() remains
unchanged because kmalloc_flags() bypasses the kmalloc fastpath.

Do not pass SLAB_ALLOC_NO_RECURSE to kmalloc_flags() in
alloc_slab_obj_exts() and instead use SLAB_ALLOC_NO_OBJ_EXT only when
the objects are allocated from normal kmalloc caches. While this
prevents unbounded recursive allocation of obj_exts, it allows
KMALLOC_NO_OBJ_EXT caches to have sheaves.

Since sheaf allocations specify SLAB_ALLOC_NO_RECURSE that prevents
allocation of both sheaves and obj_exts arrays, the recursion depth
is bounded.

obj_exts arrays for non-kmalloc-normal caches can now have a valid tag.
Do not call mark_obj_codetag_empty() when freeing an obj_exts array to
avoid false warnings. KMALLOC_NO_OBJ_EXT don't need this as they never
allocate those arrays.

Reported-by: Danielle Costantino <dcostantino@meta.com>
Reported-by: Shakeel Butt <shakeel.butt@linux.dev>
Closes: https://lore.kernel.org/linux-mm/20260625230029.703750-1-shakeel.butt@linux.dev [1]
Fixes: 4b87369646 ("mm/slab: add allocation accounting into slab allocation and free paths")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/linux-mm/c5c4208d-a6f0-413e-bad9-49be12f12d55@kernel.org [2]
Signed-off-by: Harry Yoo (Oracle) <harry@kernel.org>
Reviewed-by: Suren Baghdasaryan <surenb@google.com>
Link: https://patch.msgid.link/20260713-kmalloc-no-objext-v3-4-47c7bd138de7@kernel.org
Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
 2026-07-14 17:22:40 +02:00
Harry Yoo (Oracle)
a37b0066a1 lib/alloc_tag: introduce mem_alloc_profiling_permanently_disabled() 
mem_alloc_profiling_enabled() tells whether memalloc profiling is
currently enabled. However, even when this function returns false,
it can be enabled later.

However, this is not enough. Some optimizations can be applied only when
memalloc profiling is permanently disabled. For example, to skip the
creation of KMALLOC_NO_OBJ_EXT caches at boot time, mem_profiling must
be set to "never", "0" w/ debugging on, or have been shutdown so that
it can no longer be enabled.

Introduce mem_alloc_profiling_permanently_disabled() for this purpose.

Signed-off-by: Harry Yoo (Oracle) <harry@kernel.org>
Acked-by: Suren Baghdasaryan <surenb@google.com>
Link: https://patch.msgid.link/20260713-kmalloc-no-objext-v3-3-47c7bd138de7@kernel.org
Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
 2026-07-14 16:44:40 +02:00