kernel/linux.git/drivers/nvdimm, branch v6.19.11

nvdimm/bus: Fix potential use after free in asynchronous initialization

2026-03-25T10:13:15+00:00

commit a8aec14230322ed8f1e8042b6d656c1631d41163 upstream. Dingisoul with KASAN reports a use after free if device_add() fails in nd_async_device_register(). Commit b6eae0f61db2 ("libnvdimm: Hold reference on parent while scheduling async init") correctly added a reference on the parent device to be held until asynchronous initialization was complete. However, if device_add() results in an allocation failure the ref count of the device drops to 0 prior to the parent pointer being accessed. Thus resulting in use after free. The bug bot AI correctly identified the fix. Save a reference to the parent pointer to be used to drop the parent reference regardless of the outcome of device_add(). Reported-by: Dingisoul Closes: http://lore.kernel.org/8855544b-be9e-4153-aa55-0bc328b13733@gmail.com Fixes: b6eae0f61db2 ("libnvdimm: Hold reference on parent while scheduling async init") Cc: stable@vger.kernel.org Reviewed-by: Dave Jiang Link: https://patch.msgid.link/20260306-fix-uaf-async-init-v1-1-a28fd7526723@intel.com Signed-off-by: Ira Weiny Signed-off-by: Greg Kroah-Hartman

nvdimm: virtio_pmem: serialize flush requests

2026-02-26T23:01:19+00:00

[ Upstream commit a9ba6733c7f1096c4506bf4e34a546e07242df74 ] Under heavy concurrent flush traffic, virtio-pmem can overflow its request virtqueue (req_vq): virtqueue_add_sgs() starts returning -ENOSPC and the driver logs "no free slots in the virtqueue". Shortly after that the device enters VIRTIO_CONFIG_S_NEEDS_RESET and flush requests fail with "virtio pmem device needs a reset". Serialize virtio_pmem_flush() with a per-device mutex so only one flush request is in-flight at a time. This prevents req_vq descriptor overflow under high concurrency. Reproducer (guest with virtio-pmem): - mkfs.ext4 -F /dev/pmem0 - mount -t ext4 -o dax,noatime /dev/pmem0 /mnt/bench - fio: ioengine=io_uring rw=randwrite bs=4k iodepth=64 numjobs=64 direct=1 fsync=1 runtime=30s time_based=1 - dmesg: "no free slots in the virtqueue" "virtio pmem device needs a reset" Fixes: 6e84200c0a29 ("virtio-pmem: Add virtio pmem driver") Signed-off-by: Li Chen Acked-by: Pankaj Gupta Acked-by: Michael S. Tsirkin Link: https://patch.msgid.link/20260203021353.121091-1-me@linux.beauty Signed-off-by: Ira Weiny Signed-off-by: Sasha Levin

Merge tag 'libnvdimm-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm

2025-12-06T17:32:25+00:00

Pull nvdimm updates from Ira Weiny: "These are mainly bug fixes and code updates. There is a new feature to divide up memmap= carve outs and a fix caught in linux-next for that patch. Managing memmap memory on the fly for multiple VM's was proving difficult and Mike provided a driver which allows for the memory to be better manged. Summary: - Allow exposing RAM carveouts as NVDIMM DIMM devices - Prevent integer overflow in ramdax_get_config_data() - Replace use of system_wq with system_percpu_wq - Documentation: btt: Unwrap bit 31-30 nested table - tools/testing/nvdimm: Use per-DIMM device handle" * tag 'libnvdimm-for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: nvdimm: Prevent integer overflow in ramdax_get_config_data() Documentation: btt: Unwrap bit 31-30 nested table nvdimm: replace use of system_wq with system_percpu_wq tools/testing/nvdimm: Use per-DIMM device handle nvdimm: allow exposing RAM carveouts as NVDIMM DIMM devices

Merge tag 'cache-for-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/drivers-late

2025-11-27T22:00:45+00:00

standalone cache drivers for v6.19 ccache: Add a compatible for the pic64gx SoC. No driver change needed, as it falls back to the PolarFire SoC. hisi hha/generic cpu cache maintenance: Add support for a non-architectural mechanism for invalidating memory regions, needed for some cxl implementations on arm64 (and probably elsewhere in the future). The HiSilicon Hydra Home Agent is the first driver to provide this support. Signed-off-by: Conor Dooley * tag 'cache-for-v6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux: MAINTAINERS: refer to intended file in STANDALONE CACHE CONTROLLER DRIVERS cache: Support cache maintenance for HiSilicon SoC Hydra Home Agent cache: Make top level Kconfig menu a boolean dependent on RISCV MAINTAINERS: Add Jonathan Cameron to drivers/cache and add lib/cache_maint.c + header arm64: Select GENERIC_CPU_CACHE_MAINTENANCE lib: Support ARCH_HAS_CPU_CACHE_INVALIDATE_MEMREGION memregion: Support fine grained invalidate by cpu_cache_invalidate_memregion() memregion: Drop unused IORES_DESC_* parameter from cpu_cache_invalidate_memregion() dt-bindings: cache: sifive,ccache0: add a pic64gx compatible Signed-off-by: Arnd Bergmann

nvdimm: Prevent integer overflow in ramdax_get_config_data()

2025-11-26T16:58:23+00:00

The "cmd->in_offset" variable comes from the user via the __nd_ioctl() function. The problem is that the "cmd->in_offset + cmd->in_length" addition could have an integer wrapping issue if cmd->in_offset is close to UINT_MAX . Both "cmd->in_offset" and "cmd->in_length" are u32 variables. Fixes: 43bc0aa19a21 ("nvdimm: allow exposing RAM carveouts as NVDIMM DIMM devices") Signed-off-by: Dan Carpenter Acked-by: Mike Rapoport (Microsoft) Link: https://patch.msgid.link/aSbuiYCznEIZDa02@stanley.mountain Signed-off-by: Ira Weiny

memregion: Support fine grained invalidate by cpu_cache_invalidate_memregion()

2025-11-17T23:45:45+00:00

Extend cpu_cache_invalidate_memregion() to support invalidating a particular range of memory by introducing start and length parameters. Control of types of invalidation is left for when use cases turn up. For now everything is Clean and Invalidate. Where the range is unknown, use the provided cpu_cache_invalidate_all() helper to act as documentation of intent in a fashion that is clearer than passing (0, -1) to cpu_cache_invalidate_memregion(). Signed-off-by: Yicong Yang Reviewed-by: Dan Williams Acked-by: Davidlohr Bueso Signed-off-by: Jonathan Cameron Signed-off-by: Conor Dooley

memregion: Drop unused IORES_DESC_* parameter from cpu_cache_invalidate_memregion()

2025-11-17T23:45:45+00:00

The res_desc parameter was originally introduced for documentation purposes and with the idea that with HDM-DB CXL invalidation could be triggered from the device. That has not come to pass and the continued existence of the option is confusing when we add a range in the following patch which might not be a strict subset of the res_desc. So avoid that confusion by dropping the parameter. Link: https://lore.kernel.org/linux-mm/686eedb25ed02_24471002e@dwillia2-xfh.jf.intel.com.notmuch/ Reviewed-by: Dan Williams Suggested-by: Dan Williams Signed-off-by: Jonathan Cameron Signed-off-by: Conor Dooley

nvdimm: replace use of system_wq with system_percpu_wq

2025-11-05T21:48:11+00:00

Currently if a user enqueues a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistency cannot be addressed without refactoring the API. This patch continues the effort to refactor worqueue APIs, which has begun with the change introducing new workqueues and a new alloc_workqueue flag: commit 128ea9f6ccfb ("workqueue: Add system_percpu_wq and system_dfl_wq") commit 930c2ea566af ("workqueue: Add new WQ_PERCPU flag") Replace system_wq with system_percpu_wq, keeping the same old behavior. The old wq (system_wq) will be kept for a few release cycles. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Reviewed-by: Dave Jiang > --- Link: https://patch.msgid.link/20251105150826.248673-1-marco.crivellari@suse.com Signed-off-by: Ira Weiny

nvdimm: allow exposing RAM carveouts as NVDIMM DIMM devices

2025-11-03T20:50:42+00:00

There are use cases, for example virtual machine hosts, that create "persistent" memory regions using memmap= option on x86 or dummy pmem-region device tree nodes on DT based systems. Both these options are inflexible because they create static regions and the layout of the "persistent" memory cannot be adjusted without reboot and sometimes they even require firmware update. Add a ramdax driver that allows creation of DIMM devices on top of E820_TYPE_PRAM regions and devicetree pmem-region nodes. The DIMMs support label space management on the "device" and provide a flexible way to access RAM using fsdax and devdax. Signed-off-by: Mike Rapoport (Microsoft) Reviewed-by: Dan Williams Link: https://patch.msgid.link/20251026153841.752061-2-rppt@kernel.org Signed-off-by: Ira Weiny

Merge tag 'libnvdimm-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm

2025-10-06T18:17:18+00:00

Pull libnvdimm updates from Ira Weiny: "Primarily bug fixes. Dave introduced the usage of cleanup.h a bit late in the cycle to help with the new label work required within CXL [1] nvdimm: - Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() - Clean up __nd_ioctl() and remove gotos - Remove duplicate linux/slab.h header - Introduce guard() for nvdimm_bus_lock - Use str_plural() to simplify the code ACPI: - NFIT: Fix incorrect ndr_desc being reportedin dev_err message" Link: https://lore.kernel.org/all/20250917134116.1623730-1-s.neeraj@samsung.com/ [1] * tag 'libnvdimm-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: nvdimm: Remove duplicate linux/slab.h header nvdimm: ndtest: Return -ENOMEM if devm_kcalloc() fails in ndtest_probe() nvdimm: Clean up __nd_ioctl() and remove gotos nvdimm: Introduce guard() for nvdimm_bus_lock ACPI: NFIT: Fix incorrect ndr_desc being reportedin dev_err message nvdimm: Use str_plural() to simplify the code