summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2026-02-04mm/slab: abstract slabobj_ext access via new slab_obj_ext() helperHarry Yoo3-32/+79
Currently, the slab allocator assumes that slab->obj_exts is a pointer to an array of struct slabobj_ext objects. However, to support storage methods where struct slabobj_ext is embedded within objects, the slab allocator should not make this assumption. Instead of directly dereferencing the slabobj_exts array, abstract access to struct slabobj_ext via helper functions. Introduce a new API slabobj_ext metadata access: slab_obj_ext(slab, obj_exts, index) - returns the pointer to struct slabobj_ext element at the given index. Directly dereferencing the return value of slab_obj_exts() is no longer allowed. Instead, slab_obj_ext() must always be used to access individual struct slabobj_ext objects. Convert all users to use these APIs. No functional changes intended. Signed-off-by: Harry Yoo <harry.yoo@oracle.com> Link: https://patch.msgid.link/20260113061845.159790-5-harry.yoo@oracle.com Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
2026-02-04ext4: specify the free pointer offset for ext4_inode_cacheHarry Yoo1-6/+13
Convert ext4_inode_cache to use the kmem_cache_args interface and specify a free pointer offset. Since ext4_inode_cache uses a constructor, the free pointer would be placed after the object to prevent overwriting fields used by the constructor. However, some fields such as ->i_flags are not used by the constructor and can safely be repurposed for the free pointer. Specify the free pointer offset at i_flags to reduce the object size. Signed-off-by: Harry Yoo <harry.yoo@oracle.com> Link: https://patch.msgid.link/20260113061845.159790-4-harry.yoo@oracle.com Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
2026-02-04mm/slab: allow specifying free pointer offset when using constructorHarry Yoo3-17/+21
When a slab cache has a constructor, the free pointer is placed after the object because certain fields must not be overwritten even after the object is freed. However, some fields that the constructor does not initialize can safely be overwritten after free. Allow specifying the free pointer offset within the object, reducing the overall object size when some fields can be reused for the free pointer. Adjust the document accordingly. Signed-off-by: Harry Yoo <harry.yoo@oracle.com> Link: https://patch.msgid.link/20260113061845.159790-3-harry.yoo@oracle.com Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
2026-02-04mm/slab: use unsigned long for orig_size to ensure proper metadata alignHarry Yoo1-7/+7
When both KASAN and SLAB_STORE_USER are enabled, accesses to struct kasan_alloc_meta fields can be misaligned on 64-bit architectures. This occurs because orig_size is currently defined as unsigned int, which only guarantees 4-byte alignment. When struct kasan_alloc_meta is placed after orig_size, it may end up at a 4-byte boundary rather than the required 8-byte boundary on 64-bit systems. Note that 64-bit architectures without HAVE_EFFICIENT_UNALIGNED_ACCESS are assumed to require 64-bit accesses to be 64-bit aligned. See HAVE_64BIT_ALIGNED_ACCESS and commit adab66b71abf ("Revert: "ring-buffer: Remove HAVE_64BIT_ALIGNED_ACCESS"") for more details. Change orig_size from unsigned int to unsigned long to ensure proper alignment for any subsequent metadata. This should not waste additional memory because kmalloc objects are already aligned to at least ARCH_KMALLOC_MINALIGN. Closes: https://lore.kernel.org/all/aPrLF0OUK651M4dk@hyeyoo Suggested-by: Andrey Ryabinin <ryabinin.a.a@gmail.com> Cc: stable@vger.kernel.org Fixes: 6edf2576a6cc ("mm/slub: enable debugging memory wasting of kmalloc") Signed-off-by: Harry Yoo <harry.yoo@oracle.com> Closes: https://lore.kernel.org/all/aPrLF0OUK651M4dk@hyeyoo/ Link: https://patch.msgid.link/20260113061845.159790-2-harry.yoo@oracle.com Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
2026-02-04slub: clarify object field layout commentsHao Li1-33/+49
The comments above check_pad_bytes() document the field layout of a single object. Rewrite them to improve clarity and precision. Also update an outdated comment in calculate_sizes(). Suggested-by: Harry Yoo <harry.yoo@oracle.com> Acked-by: Harry Yoo <harry.yoo@oracle.com> Signed-off-by: Hao Li <hao.li@linux.dev> Link: https://patch.msgid.link/20251229122415.192377-1-hao.li@linux.dev Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
2026-02-04mm/slab: avoid allocating slabobj_ext array from its own slabHarry Yoo1-7/+53
When allocating slabobj_ext array in alloc_slab_obj_exts(), the array can be allocated from the same slab we're allocating the array for. This led to obj_exts_in_slab() incorrectly returning true [1], although the array is not allocated from wasted space of the slab. Vlastimil Babka observed that this problem should be fixed even when ignoring its incompatibility with obj_exts_in_slab(), because it creates slabs that are never freed as there is always at least one allocated object. To avoid this, use the next kmalloc size or large kmalloc when the array can be allocated from the same cache we're allocating the array for. In case of random kmalloc caches, there are multiple kmalloc caches for the same size and the cache is selected based on the caller address. Because it is fragile to ensure the same caller address is passed to kmalloc_slab(), kmalloc_noprof(), and kmalloc_node_noprof(), bump the size to (s->object_size + 1) when the sizes are equal, instead of directly comparing the kmem_cache pointers. Note that this doesn't happen when memory allocation profiling is disabled, as when the allocation of the array is triggered by memory cgroup (KMALLOC_CGROUP), the array is allocated from KMALLOC_NORMAL. Reported-by: kernel test robot <oliver.sang@intel.com> Closes: https://lore.kernel.org/oe-lkp/202601231457.f7b31e09-lkp@intel.com [1] Cc: stable@vger.kernel.org Fixes: 4b8736964640 ("mm/slab: add allocation accounting into slab allocation and free paths") Signed-off-by: Harry Yoo <harry.yoo@oracle.com> Link: https://patch.msgid.link/20260126125714.88008-1-harry.yoo@oracle.com Reviewed-by: Hao Li <hao.li@linux.dev> Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
2026-01-27mm/slab: factor out slab_args_unmergeable()Harry Yoo1-10/+18
slab_mergeable() determines whether a slab cache can be merged, but it should not be used when the cache is not fully created yet. Extract the pre-cache-creation mergeability checks into slab_args_unmergeable(), which evaluates kmem_cache_args, slab flags, and slab_nomerge to determine if a cache will be mergeable before it is created. Signed-off-by: Harry Yoo <harry.yoo@oracle.com> Link: https://patch.msgid.link/20260127103151.21883-2-harry.yoo@oracle.com Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
2026-01-27mm/slab: make caches with sheaves mergeableVlastimil Babka1-6/+7
Before enabling sheaves for all caches (with automatically determined capacity), their enablement should no longer prevent merging of caches. Limit this merge prevention only to caches that were created with a specific sheaf capacity, by adding the SLAB_NO_MERGE flag to them. Reviewed-by: Harry Yoo <harry.yoo@oracle.com> Reviewed-by: Liam R. Howlett <Liam.Howlett@oracle.com> Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
2026-01-27mm/slab: move and refactor __kmem_cache_alias()Vlastimil Babka3-41/+41
Move __kmem_cache_alias() to slab_common.c since it's called by __kmem_cache_create_args() and calls find_mergeable() that both are in this file. We can remove two slab.h declarations and make them static. Instead declare sysfs_slab_alias() from slub.c so that __kmem_cache_alias() can keep calling it. Add args parameter to __kmem_cache_alias() and find_mergeable() instead of align and ctor. With that we can also move the checks for usersize and sheaf_capacity there from __kmem_cache_create_args() and make the result more symmetric with slab_unmergeable(). No functional changes intended. Reviewed-by: Harry Yoo <harry.yoo@oracle.com> Reviewed-by: Suren Baghdasaryan <surenb@google.com> Reviewed-by: Liam R. Howlett <Liam.Howlett@oracle.com> Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
2026-01-27slab: add SLAB_CONSISTENCY_CHECKS to SLAB_NEVER_MERGEVlastimil Babka1-3/+2
All the debug flags prevent merging, except SLAB_CONSISTENCY_CHECKS. This is suboptimal because this flag (like any debug flags) prevents the usage of any fastpaths, and thus affect performance of any aliased cache. Also the objects from an aliased cache than the one specified for debugging could also interfere with the debugging efforts. Fix this by adding the whole SLAB_DEBUG_FLAGS collection to SLAB_NEVER_MERGE instead of individual debug flags, so it now also includes SLAB_CONSISTENCY_CHECKS. Reviewed-by: Suren Baghdasaryan <surenb@google.com> Reviewed-by: Harry Yoo <harry.yoo@oracle.com> Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
2026-01-27mm/slab: fix false lockdep warning in __kfree_rcu_sheaf()Harry Yoo1-0/+20
kvfree_call_rcu() can be called while holding a raw_spinlock_t. Since __kfree_rcu_sheaf() may acquire a spinlock_t (which becomes a sleeping lock on PREEMPT_RT) and violate lock nesting rules, kvfree_call_rcu() bypasses the sheaves layer entirely on PREEMPT_RT. However, lockdep still complains about acquiring spinlock_t while holding raw_spinlock_t, even on !PREEMPT_RT where spinlock_t is a spinning lock. This causes a false lockdep warning [1]: ============================= [ BUG: Invalid wait context ] 6.19.0-rc6-next-20260120 #21508 Not tainted ----------------------------- migration/1/23 is trying to lock: ffff8afd01054e98 (&barn->lock){..-.}-{3:3}, at: barn_get_empty_sheaf+0x1d/0xb0 other info that might help us debug this: context-{5:5} 3 locks held by migration/1/23: #0: ffff8afd01fd89a8 (&p->pi_lock){-.-.}-{2:2}, at: __balance_push_cpu_stop+0x3f/0x200 #1: ffffffff9f15c5c8 (rcu_read_lock){....}-{1:3}, at: cpuset_cpus_allowed_fallback+0x27/0x250 #2: ffff8afd1f470be0 ((local_lock_t *)&pcs->lock){+.+.}-{3:3}, at: __kfree_rcu_sheaf+0x52/0x3d0 stack backtrace: CPU: 1 UID: 0 PID: 23 Comm: migration/1 Not tainted 6.19.0-rc6-next-20260120 #21508 PREEMPTLAZY Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Stopper: __balance_push_cpu_stop+0x0/0x200 <- balance_push+0x118/0x170 Call Trace: <TASK> __dump_stack+0x22/0x30 dump_stack_lvl+0x60/0x80 dump_stack+0x19/0x24 __lock_acquire+0xd3a/0x28e0 ? __lock_acquire+0x5a9/0x28e0 ? __lock_acquire+0x5a9/0x28e0 ? barn_get_empty_sheaf+0x1d/0xb0 lock_acquire+0xc3/0x270 ? barn_get_empty_sheaf+0x1d/0xb0 ? __kfree_rcu_sheaf+0x52/0x3d0 _raw_spin_lock_irqsave+0x47/0x70 ? barn_get_empty_sheaf+0x1d/0xb0 barn_get_empty_sheaf+0x1d/0xb0 ? __kfree_rcu_sheaf+0x52/0x3d0 __kfree_rcu_sheaf+0x19f/0x3d0 kvfree_call_rcu+0xaf/0x390 set_cpus_allowed_force+0xc8/0xf0 [...] </TASK> This wasn't triggered until sheaves were enabled for all slab caches, since kfree_rcu() wasn't being called with a raw spinlock held for caches with sheaves (vma, maple node). As suggested by Vlastimil Babka, fix this by using a lockdep map with LD_WAIT_CONFIG wait type to tell lockdep that acquiring spinlock_t is valid in this case, as those spinlocks won't be used on PREEMPT_RT. Note that kfree_rcu_sheaf_map should be acquired using _try() variant, otherwise the acquisition of the lockdep map itself will trigger an invalid wait context warning. Reported-by: Paul E. McKenney <paulmck@kernel.org> Closes: https://lore.kernel.org/linux-mm/c858b9af-2510-448b-9ab3-058f7b80dd42@paulmck-laptop [1] Fixes: ec66e0d59952 ("slab: add sheaf support for batching kfree_rcu() operations") Suggested-by: Vlastimil Babka <vbabka@suse.cz> Signed-off-by: Harry Yoo <harry.yoo@oracle.com> Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
2026-01-27mm/slab: add rcu_barrier() to kvfree_rcu_barrier_on_cache()Vlastimil Babka1-1/+4
After we submit the rcu_free sheaves to call_rcu() we need to make sure the rcu callbacks complete. kvfree_rcu_barrier() does that via flush_all_rcu_sheaves() but kvfree_rcu_barrier_on_cache() doesn't. Fix that. This currently causes no issues because the caches with sheaves we have are never destroyed. The problem flagged by kernel test robot was reported for a patch that enables sheaves for (almost) all caches, and occurred only with CONFIG_KASAN. Harry Yoo found the root cause [1]: It turns out the object freed by sheaf_flush_unused() was in KASAN percpu quarantine list (confirmed by dumping the list) by the time __kmem_cache_shutdown() returns an error. Quarantined objects are supposed to be flushed by kasan_cache_shutdown(), but things go wrong if the rcu callback (rcu_free_sheaf_nobarn()) is processed after kasan_cache_shutdown() finishes. That's why rcu_barrier() in __kmem_cache_shutdown() didn't help, because it's called after kasan_cache_shutdown(). Calling rcu_barrier() in kvfree_rcu_barrier_on_cache() guarantees that it'll be added to the quarantine list before kasan_cache_shutdown() is called. So it's a valid fix! [1] https://lore.kernel.org/all/aWd6f3jERlrB5yeF@hyeyoo/ Reported-by: kernel test robot <oliver.sang@intel.com> Closes: https://lore.kernel.org/oe-lkp/202601121442.c530bed3-lkp@intel.com Fixes: 0f35040de593 ("mm/slab: introduce kvfree_rcu_barrier_on_cache() for cache destruction") Cc: stable@vger.kernel.org Reviewed-by: Harry Yoo <harry.yoo@oracle.com> Tested-by: Harry Yoo <harry.yoo@oracle.com> Reviewed-by: Suren Baghdasaryan <surenb@google.com> Reviewed-by: Liam R. Howlett <Liam.Howlett@oracle.com> Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
2026-01-27slab: replace cache_from_obj() with inline checksVlastimil Babka1-23/+33
Eric Dumazet has noticed cache_from_obj() is not inlined with clang and suggested splitting it into two functions, where the smaller inlined one assumes the fastpath is !CONFIG_SLAB_FREELIST_HARDENED. However most distros enable it these days and so this would likely add a function call to the object free fastpaths. Instead take a step back and consider that cache_from_obj() is a relict from when memcgs created their separate kmem_cache copies, as the outdated comment in build_detached_freelist() reminds us. Meanwhile hardening/debugging had reused cache_from_obj() to validate that the freed object really belongs to a slab from the cache we think we are freeing from. In build_detached_freelist() simply remove this, because it did not handle the NULL result from cache_from_obj() failure properly, nor validate objects (for the NULL slab->slab_cache pointer) when called via kfree_bulk(). If anyone is motivated to implement it properly, it should be possible in a similar way to kmem_cache_free(). In kmem_cache_free(), do the hardening/debugging checks directly so they are inlined by definition and virt_to_slab(obj) is performed just once. In case they failed, call a newly introduced warn_free_bad_obj() that performs the warnings outside of the fastpath, and leak the object. As an intentional change, leak the object when slab->slab_cache differs from the cache given to kmem_cache_free(). Previously we would only leak when the object is not in a valid slab page or the slab->slab_cache pointer is NULL, and otherwise trust the slab->slab_cache over the kmem_cache_free() argument. But if those differ, it means something went wrong enough that it's best not to continue freeing. As a result the fastpath should be inlined in all configs and the warnings are moved away. Reported-by: Eric Dumazet <edumazet@google.com> Closes: https://lore.kernel.org/all/20260115130642.3419324-1-edumazet@google.com/ Reviewed-by: Harry Yoo <harry.yoo@oracle.com> Reviewed-by: Hao Li <hao.li@linux.dev> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
2026-01-21slab: fix kmalloc_nolock() context check for PREEMPT_RTSwaraj Gaikwad1-2/+6
On PREEMPT_RT kernels, local_lock becomes a sleeping lock. The current check in kmalloc_nolock() only verifies we're not in NMI or hard IRQ context, but misses the case where preemption is disabled. When a BPF program runs from a tracepoint with preemption disabled (preempt_count > 0), kmalloc_nolock() proceeds to call local_lock_irqsave() which attempts to acquire a sleeping lock, triggering: BUG: sleeping function called from invalid context in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 6128 preempt_count: 2, expected: 0 Fix this by checking !preemptible() on PREEMPT_RT, which directly expresses the constraint that we cannot take a sleeping lock when preemption is disabled. This encompasses the previous checks for NMI and hard IRQ contexts while also catching cases where preemption is disabled. Fixes: af92793e52c3 ("slab: Introduce kmalloc_nolock() and kfree_nolock().") Reported-by: syzbot+b1546ad4a95331b2101e@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b1546ad4a95331b2101e Signed-off-by: Swaraj Gaikwad <swarajgaikwad1925@gmail.com> Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Acked-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Harry Yoo <harry.yoo@oracle.com> Link: https://patch.msgid.link/20260113150639.48407-1-swarajgaikwad1925@gmail.co Cc: <stable@vger.kernel.org> Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
2026-01-12Linux 6.19-rc5v6.19-rc5Linus Torvalds1-1/+1
2026-01-12Merge tag 'libcrypto-for-linus' of ↵Linus Torvalds4-4/+5
git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library fixes from Eric Biggers: - A couple more fixes for the lib/crypto KUnit tests - Fix missing MMU protection for the AES S-box * tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: lib/crypto: aes: Fix missing MMU protection for AES S-box MAINTAINERS: add test vector generation scripts to "CRYPTO LIBRARY" lib/crypto: tests: Fix syntax error for old python versions lib/crypto: tests: polyval_kunit: Increase iterations for preparekey in IRQs
2026-01-11Merge tag 'char-misc-6.19-rc5' of ↵Linus Torvalds5-11/+19
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are some small char/misc driver fixes for some reported issues. Included in here is: - much reported rust_binder fix - counter driver fixes - new device ids for the mei driver All of these have been in linux-next for a while with no reported issues" * tag 'char-misc-6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: rust_binder: remove spin_lock() in rust_shrink_free_page() mei: me: add nova lake point S DID counter: 104-quad-8: Fix incorrect return value in IRQ handler counter: interrupt-cnt: Drop IRQF_NO_THREAD flag
2026-01-11Merge tag 'x86-urgent-2026-01-11' of ↵Linus Torvalds1-0/+2
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Ingo Molnar: "Disable GCOV instrumentation in the SEV noinstr.c collection of SEV noinstr methods, to further robustify the code" * tag 'x86-urgent-2026-01-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/sev: Disable GCOV on noinstr object
2026-01-11Merge tag 'sched-urgent-2026-01-11' of ↵Linus Torvalds1-2/+3
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fix from Ingo Molnar: "Fix a crash in sched_mm_cid_after_execve()" * tag 'sched-urgent-2026-01-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/mm_cid: Prevent NULL mm dereference in sched_mm_cid_after_execve()
2026-01-11Merge tag 'perf-urgent-2026-01-11' of ↵Linus Torvalds1-0/+6
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf event fix from Ingo Molnar: "Fix perf swevent hrtimer deinit regression" * tag 'perf-urgent-2026-01-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf: Ensure swevent hrtimer is properly destroyed
2026-01-11Merge tag 'irq-urgent-2026-01-11' of ↵Linus Torvalds3-4/+10
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull misc irqchip fixes from Ingo Molnar: - Fix an endianness bug in the gic-v5 irqchip driver - Revert a broken commit from the riscv-imsic irqchip driver * tag 'irq-urgent-2026-01-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: Revert "irqchip/riscv-imsic: Embed the vector array in lpriv" irqchip/gic-v5: Fix gicv5_its_map_event() ITTE read endianness
2026-01-11treewide: Update email addressThomas Gleixner63-82/+83
In a vain attempt to consolidate the email zoo switch everything to the kernel.org account. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2026-01-11Merge tag 'riscv-for-linus-6.19-rc5' of ↵Linus Torvalds12-35/+26
git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: "Notable changes include a fix to close one common microarchitectural attack vector for out-of-order cores. Another patch exposed an omission in my boot test coverage, which is currently missing relocatable kernels. Otherwise, the fixes seem to be settling down for us. - Fix CONFIG_RELOCATABLE=y boots by building Image files from vmlinux, rather than vmlinux.unstripped, now that the .modinfo section is included in vmlinux.unstripped - Prevent branch predictor poisoning microarchitectural attacks that use the syscall index as a vector by using array_index_nospec() to clamp the index after the bounds check (as x86 and ARM64 already do) - Fix a crash in test_kprobes when building with Clang - Fix a deadlock possible when tracing is enabled for SBI ecalls - Fix the definition of the Zk standard RISC-V ISA extension bundle, which was missing the Zknh extension - A few other miscellaneous non-functional cleanups, removing unused macros, fixing an out-of-date path in code comments, resolving a compile-time warning for a type mismatch in a pr_crit(), and removing an unnecessary header file inclusion" * tag 'riscv-for-linus-6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: trace: fix snapshot deadlock with sbi ecall riscv: remove irqflags.h inclusion in asm/bitops.h riscv: cpu_ops_sbi: smp_processor_id() returns int, not unsigned int riscv: configs: Clean up references to non-existing configs riscv: kexec_image: Fix dead link to boot-image-header.rst riscv: pgtable: Cleanup useless VA_USER_XXX definitions riscv: cpufeature: Fix Zk bundled extension missing Zknh riscv: fix KUnit test_kprobes crash when building with Clang riscv: Sanitize syscall table indexing under speculation riscv: boot: Always make Image from vmlinux, not vmlinux.unstripped
2026-01-11Merge tag 'driver-core-6.19-rc5' of ↵Linus Torvalds6-17/+19
git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core Pull driver core fixes from Danilo Krummrich: - Fix swapped example values for the `family` and `machine` attributes in the sysfs SoC bus ABI documentation - Fix Rust build and intra-doc issues when optional subsystems (CONFIG_PCI, CONFIG_AUXILIARY_BUS, CONFIG_PRINTK) are disabled - Fix typos and incorrect safety comments in Rust PCI, DMA, and device ID documentation * tag 'driver-core-6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: rust: device: Remove explicit import of CStrExt rust: pci: fix typos in Bar struct's comments rust: device: fix broken intra-doc links rust: dma: fix broken intra-doc links rust: driver: fix broken intra-doc links to example driver types rust: device_id: replace incorrect word in safety documentation rust: dma: remove incorrect safety documentation docs: ABI: sysfs-devices-soc: Fix swapped sample values
2026-01-11Merge tag 'linux_kselftest-fixes-6.19-rc5' of ↵Linus Torvalds1-1/+17
git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest fix from Shuah Khan: "Fix tracing test_multiple_writes stalls when buffer_size_kb is less than 12KB" * tag 'linux_kselftest-fixes-6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests/tracing: Fix test_multiple_writes stall
2026-01-10Merge tag 'iommu-fixes-v6.19-rc4' of ↵Linus Torvalds3-4/+5
git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull iomu fixes from Joerg Roedel: - several Kconfig-related build fixes - fix for when gcc 8.5 on PPC refuses to inline a function from a header file * tag 'iommu-fixes-v6.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: iommupt: Make pt_feature() always_inline iommufd/selftest: Prevent module/builtin conflicts in kconfig iommufd/selftest: Add missing kconfig for DMA_SHARED_BUFFER iommupt: Fix the kunit building
2026-01-10erofs: fix file-backed mounts no longer working on EROFS partitionsGao Xiang1-1/+2
Sheng Yong reported [1] that Android APEX images didn't work with commit 072a7c7cdbea ("erofs: don't bother with s_stack_depth increasing for now") because "EROFS-formatted APEX file images can be stored within an EROFS-formatted Android system partition." In response, I sent a quick fat-fingered [PATCH v3] to address the report. Unfortunately, the updated condition was incorrect: if (erofs_is_fileio_mode(sbi)) { - sb->s_stack_depth = - file_inode(sbi->dif0.file)->i_sb->s_stack_depth + 1; - if (sb->s_stack_depth > FILESYSTEM_MAX_STACK_DEPTH) { - erofs_err(sb, "maximum fs stacking depth exceeded"); + inode = file_inode(sbi->dif0.file); + if ((inode->i_sb->s_op == &erofs_sops && !sb->s_bdev) || + inode->i_sb->s_stack_depth) { The condition `!sb->s_bdev` is always true for all file-backed EROFS mounts, making the check effectively a no-op. The real fix tested and confirmed by Sheng Yong [2] at that time was [PATCH v3 RESEND], which correctly ensures the following EROFS^2 setup works: EROFS (on a block device) + EROFS (file-backed mount) But sadly I screwed it up again by upstreaming the outdated [PATCH v3]. This patch applies the same logic as the delta between the upstream [PATCH v3] and the real fix [PATCH v3 RESEND]. Reported-by: Sheng Yong <shengyong1@xiaomi.com> Closes: https://lore.kernel.org/r/3acec686-4020-4609-aee4-5dae7b9b0093@gmail.com [1] Fixes: 072a7c7cdbea ("erofs: don't bother with s_stack_depth increasing for now") Link: https://lore.kernel.org/r/243f57b8-246f-47e7-9fb1-27a771e8e9e8@gmail.com [2] Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2026-01-10iommupt: Make pt_feature() always_inlineJason Gunthorpe1-2/+2
gcc 8.5 on powerpc does not automatically inline these functions even though they evaluate to constants in key cases. Since the constant propagation is essential for some code elimination and built-time checks this causes a build failure: ERROR: modpost: "__pt_no_sw_bit" [drivers/iommu/generic_pt/fmt/iommu_amdv1.ko] undefined! Caused by this: if (pts_feature(&pts, PT_FEAT_DMA_INCOHERENT) && !pt_test_sw_bit_acquire(&pts, SW_BIT_CACHE_FLUSH_DONE)) flush_writes_item(&pts); Where pts_feature() evaluates to a constant false. Mark them as __always_inline to force it to evaluate to a constant and trigger the code elimination. Fixes: 7c5b184db714 ("genpt: Generic Page Table base API") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202512230720.9y9DtWIo-lkp@intel.com/ Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-01-10iommufd/selftest: Prevent module/builtin conflicts in kconfigJason Gunthorpe1-1/+1
The selftest now depends on the AMDv1 page table, however the selftest kconfig itself is just an sub-option of the main IOMMUFD module kconfig. This means it cannot be modular and so kconfig allowed a modular IOMMU_PT_AMDV1 with a built in IOMMUFD. This causes link failures: ld: vmlinux.o: in function `mock_domain_alloc_pgtable.isra.0': selftest.c:(.text+0x12e8ad3): undefined reference to `pt_iommu_amdv1_init' ld: vmlinux.o: in function `BSWAP_SHUFB_CTL': sha1-avx2-asm.o:(.rodata+0xaa36a8): undefined reference to `pt_iommu_amdv1_read_and_clear_dirty' ld: sha1-avx2-asm.o:(.rodata+0xaa36f0): undefined reference to `pt_iommu_amdv1_map_pages' ld: sha1-avx2-asm.o:(.rodata+0xaa36f8): undefined reference to `pt_iommu_amdv1_unmap_pages' ld: sha1-avx2-asm.o:(.rodata+0xaa3720): undefined reference to `pt_iommu_amdv1_iova_to_phys' Adjust the kconfig to disable IOMMUFD_TEST if IOMMU_PT_AMDV1 is incompatible. Fixes: e93d5945ed5b ("iommufd: Change the selftest to use iommupt instead of xarray") Suggested-by: Arnd Bergmann <arnd@arndb.de> Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202512210135.freQWpxa-lkp@intel.com/ Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-01-10iommufd/selftest: Add missing kconfig for DMA_SHARED_BUFFERJason Gunthorpe1-0/+1
The test doesn't build without it, dma-buf.h does not provide stub functions if it is not enabled. Compilation can fail with: ERROR:root:ld: vmlinux.o: in function `iommufd_test': (.text+0x3b1cdd): undefined reference to `dma_buf_get' ld: (.text+0x3b1d08): undefined reference to `dma_buf_put' ld: (.text+0x3b2105): undefined reference to `dma_buf_export' ld: (.text+0x3b211f): undefined reference to `dma_buf_fd' ld: (.text+0x3b2e47): undefined reference to `dma_buf_move_notify' Add the missing select. Fixes: d2041f1f11dd ("iommufd/selftest: Add some tests for the dmabuf flow") Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-01-10iommupt: Fix the kunit buildingJason Gunthorpe1-1/+1
The kunit doesn't work since the below commit made GENERIC_PT unselectable: $ make ARCH=x86_64 O=build_kunit_x86_64 olddefconfig ERROR:root:Not all Kconfig options selected in kunitconfig were in the generated .config. This is probably due to unsatisfied dependencies. Missing: CONFIG_DEBUG_GENERIC_PT=y, CONFIG_IOMMUFD_TEST=y, CONFIG_IOMMU_PT_X86_64=y, CONFIG_GENERIC_PT=y, CONFIG_IOMMU_PT_AMDV1=y, CONFIG_IOMMU_PT_VTDSS=y, CONFIG_IOMMU_PT=y, CONFIG_IOMMU_PT_KUNIT_TEST=y Also remove the unneeded CONFIG_IOMMUFD_TEST reference as the iommupt kunit doesn't interact with iommufd, and it doesn't currently build for the kunit due problems with DMA_SHARED buffer either. Fixes: 01569c216dde ("genpt: Make GENERIC_PT invisible") Fixes: 1dd4187f53c3 ("iommupt: Add a kunit test for Generic Page Table") Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Reviewed-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com> Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
2026-01-10Merge tag 'erofs-for-6.19-rc5-fixes' of ↵Linus Torvalds1-6/+12
git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs fix from Gao Xiang: - Don't increase s_stack_depth which caused regressions in some composefs mount setups (EROFS + ovl^2) Instead just allow one extra unaccounted fs stacking level for straightforward cases. * tag 'erofs-for-6.19-rc5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: don't bother with s_stack_depth increasing for now
2026-01-10erofs: don't bother with s_stack_depth increasing for nowGao Xiang1-6/+12
Previously, commit d53cd891f0e4 ("erofs: limit the level of fs stacking for file-backed mounts") bumped `s_stack_depth` by one to avoid kernel stack overflow when stacking an unlimited number of EROFS on top of each other. This fix breaks composefs mounts, which need EROFS+ovl^2 sometimes (and such setups are already used in production for quite a long time). One way to fix this regression is to bump FILESYSTEM_MAX_STACK_DEPTH from 2 to 3, but proving that this is safe in general is a high bar. After a long discussion on GitHub issues [1] about possible solutions, one conclusion is that there is no need to support nesting file-backed EROFS mounts on stacked filesystems, because there is always the option to use loopback devices as a fallback. As a quick fix for the composefs regression for this cycle, instead of bumping `s_stack_depth` for file backed EROFS mounts, we disallow nesting file-backed EROFS over EROFS and over filesystems with `s_stack_depth` > 0. This works for all known file-backed mount use cases (composefs, containerd, and Android APEX for some Android vendors), and the fix is self-contained. Essentially, we are allowing one extra unaccounted fs stacking level of EROFS below stacking filesystems, but EROFS can only be used in the read path (i.e. overlayfs lower layers), which typically has much lower stack usage than the write path. We can consider increasing FILESYSTEM_MAX_STACK_DEPTH later, after more stack usage analysis or using alternative approaches, such as splitting the `s_stack_depth` limitation according to different combinations of stacking. Fixes: d53cd891f0e4 ("erofs: limit the level of fs stacking for file-backed mounts") Reported-and-tested-by: Dusty Mabe <dusty@dustymabe.com> Reported-by: Timothée Ravier <tim@siosm.fr> Closes: https://github.com/coreos/fedora-coreos-tracker/issues/2087 [1] Reported-by: "Alekséi Naidénov" <an@digitaltide.io> Closes: https://lore.kernel.org/r/CAFHtUiYv4+=+JP_-JjARWjo6OwcvBj1wtYN=z0QXwCpec9sXtg@mail.gmail.com Acked-by: Amir Goldstein <amir73il@gmail.com> Acked-by: Alexander Larsson <alexl@redhat.com> Reviewed-and-tested-by: Sheng Yong <shengyong1@xiaomi.com> Reviewed-by: Zhiguo Niu <zhiguo.niu@unisoc.com> Reviewed-by: Chao Yu <chao@kernel.org> Cc: Christian Brauner <brauner@kernel.org> Cc: Miklos Szeredi <mszeredi@redhat.com> Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
2026-01-10Merge tag 'block-6.19-20260109' of ↵Linus Torvalds5-50/+83
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - Kill unlikely checks for blk-rq-qos. These checks are really all-or-nothing, either the branch is taken all the time, or it's not. Depending on the configuration, either one of those cases may be true. Just remove the annotation - Fix for merging bios with different app tags set - Fix for a recently introduced slowdown due to RCU synchronization - Fix for a status change on loop while it's in use, and then a later fix for that fix - Fix for the async partition scanning in ublk * tag 'block-6.19-20260109' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: ublk: fix use-after-free in ublk_partition_scan_work blk-mq: avoid stall during boot due to synchronize_rcu_expedited loop: add missing bd_abort_claiming in loop_set_status block: don't merge bios with different app_tags blk-rq-qos: Remove unlikely() hints from QoS checks loop: don't change loop device under exclusive opener in loop_set_status
2026-01-10Merge tag 'io_uring-6.19-20260109' of ↵Linus Torvalds1-7/+4
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: "A single fix for a regression introduced in 6.15, where a failure to wake up idle io-wq workers at ring exit will wait for the timeout to expire. This isn't normally noticeable, as the exit is async. But if a parent task created a thread that sets up a ring and uses requests that cause io-wq threads to be created, and the parent task then waits for the thread to exit, then it can take 5 seconds for that pthread_join() to succeed as the child thread is waiting for its children to exit. On top of that, just a basic cleanup as well" * tag 'io_uring-6.19-20260109' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/io-wq: remove io_wq_for_each_worker() return value io_uring/io-wq: fix incorrect io_wq_for_each_worker() termination logic
2026-01-10Merge tag 'arm64-fixes' of ↵Linus Torvalds5-7/+18
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: - Do not return false if !preemptible() in current_in_efi(). EFI runtime services can now run with preemption enabled - Fix uninitialised variable in the arm MPAM driver, reported by sparse - Fix partial kasan_reset_tag() use in change_memory_common() when calculating page indices or comparing ranges - Save/restore TCR2_EL1 during suspend/resume, otherwise the E0POE bit is lost * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: Fix cleared E0POE bit after cpu_suspend()/resume() arm64: mm: Fix incomplete tag reset in change_memory_common() arm_mpam: Stop using uninitialized variables in __ris_msmon_read() arm64/efi: Don't fail check current_in_efi() if preemptible
2026-01-10Merge tag 'soc-fixes-6.19' of ↵Linus Torvalds34-150/+111
git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC fixes from Arnd Bergmann: "The main code change is a revert of the Raspberry Pi RP1 overlay support that was decided to not be ready. The other fixes are all for devicetree sources: - ethernet configuration on ixp42x-actiontec-mi424wr is board revision specific - validation warning fixes for imx27/imx51/imx6, hikey960 and k3 - Minor corrections across imx8 boards, addressing all types of issues with interrups, dma, ethernet and clock settings, all simple one-line changes" * tag 'soc-fixes-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (25 commits) arm64: dts: hisilicon: hikey960: Drop "snps,gctl-reset-quirk" and "snps,tx_de_emphasis*" properties Documentation/process: maintainer-soc: Mark 'make' as commands Documentation/process: maintainer-soc: Be more explicit about defconfig arm64: dts: mba8mx: Fix Ethernet PHY IRQ support arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM arm64: dts: freescale: tx8p-ml81: fix eqos nvmem-cells arm64: dts: freescale: moduline-display: fix compatible dt-bindings: arm: fsl: moduline-display: fix compatible ARM: dts: imx6q-ba16: fix RTC interrupt level arm64: dts: freescale: imx95-toradex-smarc: fix SMARC_SDIO_WP label position arm64: dts: freescale: imx95-toradex-smarc: use edge trigger for ethphy1 interrupt arm64: dts: add off-on-delay-us for usdhc2 regulator arm64: dts: imx8qm-mek: correct the light sensor interrupt type to low level ARM: dts: nxp: imx: Fix mc13xxx LED node names arm64: dts: imx95: correct I3C2 pclk to IMX95_CLK_BUSWAKEUP MAINTAINERS: Fix a linusw mail address arm64: dts: broadcom: rp1: drop RP1 overlay arm64: dts: broadcom: bcm2712: fix RP1 endpoint PCI topology misc: rp1: drop overlay support ...
2026-01-10Merge tag 'ceph-for-6.19-rc5' of https://github.com/ceph/ceph-clientLinus Torvalds5-14/+34
Pull ceph fixes from Ilya Dryomov: "A bunch of libceph fixes split evenly between memory safety and implementation correctness issues (all marked for stable) and a change in maintainers for CephFS: Slava and Alex have formally taken over Xiubo's role" * tag 'ceph-for-6.19-rc5' of https://github.com/ceph/ceph-client: libceph: make calc_target() set t->paused, not just clear it libceph: reset sparse-read state in osd_fault() libceph: return the handler error from mon_handle_auth_done() libceph: make free_choose_arg_map() resilient to partial allocation ceph: update co-maintainers list in MAINTAINERS libceph: replace overzealous BUG_ON in osdmap_apply_incremental() libceph: prevent potential out-of-bounds reads in handle_auth_done()
2026-01-10selftests/tracing: Fix test_multiple_writes stallFushuai Wang1-1/+17
When /sys/kernel/tracing/buffer_size_kb is less than 12KB, the test_multiple_writes test will stall and wait for more input due to insufficient buffer space. Check current buffer_size_kb value before the test. If it is less than 12KB, it temporarily increase the buffer to 12KB, and restore the original value after the tests are completed. Link: https://lore.kernel.org/r/20260109033620.25727-1-fushuai.wang@linux.dev Fixes: 37f46601383a ("selftests/tracing: Add basic test for trace_marker_raw file") Suggested-by: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Fushuai Wang <wangfushuai@baidu.com> Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2026-01-09Merge tag 'for-6.19-rc4-tag' of ↵Linus Torvalds4-17/+39
git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - fix potential NULL pointer dereference when replaying tree log after an error - release path before initializing extent tree to avoid potential deadlock when allocating new inode - on filesystems with block size > page size - fix potential read out of bounds during encoded read of an inline extent - only enforce free space tree if v1 cache is required - print correct tree id in error message * tag 'for-6.19-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: show correct warning if can't read data reloc tree btrfs: fix NULL pointer dereference in do_abort_log_replay() btrfs: force free space tree for bs > ps cases btrfs: only enforce free space tree if v1 cache is required for bs < ps cases btrfs: release path before initializing extent tree in btrfs_read_locked_inode() btrfs: avoid access-beyond-folio for bs > ps encoded writes
2026-01-09Merge tag 'pci-v6.19-fixes-2' of ↵Linus Torvalds3-36/+30
git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull PCI fixes from Bjorn Helgaas: - Remove ASPM L0s support for MSM8996 SoC since we now enable L0s when advertised, and it caused random hangs on this device (Manivannan Sadhasivam) - Fix meson-pcie to report that the link is up while in ASPM L0s or L1, since those are active states from the software point of view, and treating the link as down caused config access failures (Bjorn Helgaas) - Fix up sparc DTS BAR descriptions that are above 4GB but not marked as prefetchable, which caused resource assignment and driver probe failures after we converted from the SPARC pcibios_enable_device() to the generic version (Ilpo Järvinen) * tag 'pci-v6.19-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: sparc/PCI: Correct 64-bit non-pref -> pref BAR resources PCI: meson: Report that link is up while in ASPM L0s and L1 states PCI: qcom: Remove ASPM L0s support for MSM8996 SoC
2026-01-09Merge tag 'acpi-6.19-rc5' of ↵Linus Torvalds4-29/+44
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI support fix from Rafael Wysocki: "This fixes the ACPI/PCI legacy interrupts (INTx) parsing in the case when the ACPI Global System Interrupt (GSI) value is a 32-bit one with the MSB set. That was interpreted as a negative integer and caused acpi_pci_link_allocate_irq() to fail and acpi_irq_get_penalty() to trigger an out-of-bounds array dereference (Lorenzo Pieralisi)" * tag 'acpi-6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: PCI: IRQ: Fix INTx GSIs signedness
2026-01-09Merge tag 'pm-6.19-rc5' of ↵Linus Torvalds1-4/+10
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fix from Rafael Wysocki: "This fixes a crash in the hibernation image saving code that can be triggered when the given compression algorithm is unavailable (Malaya Kumar Rout)" * tag 'pm-6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PM: hibernate: Fix crash when freeing invalid crypto compressor
2026-01-09Merge tag 'gpio-fixes-for-v6.19-rc5' of ↵Linus Torvalds7-138/+300
git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: "There are several ordinary driver fixes and a fix to a race between the registration of two chips that causes a crash in GPIO core. The bulk of the changed lines however, concerns the management of shared GPIOs that landed in v6.19-rc1. Enabling it for ARCH_QCOM enabled it in defconfig which effectively enabled it for all arm64 platforms and exposed the code to quite a lot of testing (which is good, right? :)). As a resukt, I received a number of bug reports, which I progressively fixed over the course of last weeks. This explains the number of lines higher than what I normally aim for at this stage. - balance superio enter/exit calls in error path in gpio-it87 - fix a race where we try to take the SRCU read lock of the GPIO device before it's been initialized causing a NULL-pointer dereference - fix handling of short-pulse interrupts in gpio-pca053x - fix a reference leak in error path in gpio-mpsse - mark the GPIO controller as sleeping (it calls sleeping functions) in gpio-rockchip - fix several issues in management of shared GPIOs" * tag 'gpio-fixes-for-v6.19-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: shared: fix a false-positive sharing detection with reset-gpios gpiolib: fix lookup table matching gpio: shared: don't allocate the lookup table until we really need it gpio: shared: fix a race condition gpio: shared: assign the correct firmware node for reset-gpio use-case gpio: rockchip: mark the GPIO controller as sleeping gpio: mpsse: fix reference leak in gpio_mpsse_probe() error paths gpio: pca953x: handle short interrupt pulses on PCAL devices gpiolib: fix race condition for gdev->srcu gpio: shared: allow sharing a reset-gpios pin between reset-gpio and gpiolib gpio: shared: verify con_id when adding proxy lookup gpiolib: allow multiple lookup tables per consumer gpio: it87: balance superio enter/exit calls in error path
2026-01-09Merge tag 'drm-fixes-2026-01-09' of https://gitlab.freedesktop.org/drm/kernelLinus Torvalds41-813/+724
Pull drm fixes from Dave Airlie: "I missed the drm-rust fixes tree for last week, so this catches up on that, along with amdgpu, and then some misc fixes across a few drivers. I hadn't got an xe pull by the time I sent this, I suspect one will arrive 10 mins after, but I don't think there is anything that can't wait for next week. Things seem to have picked up a little with people coming back from holidays, MAINTAINERS: - Fix Nova GPU driver git links - Fix typo in TYR driver entry preventing correct behavior of scripts/get_maintainer.pl - Exclude TYR driver from DRM MISC nova-core: - Correctly select RUST_FW_LOADER_ABSTRACTIONS to prevent build errors - Regenerate nova-core bindgen bindings with '--explicit-padding' to avoid uninitialized bytes - Fix length of received GSP messages, due to miscalculated message payload size - Regenerate bindings to derive MaybeZeroable - Use a bindings alias to derive the firmware version exynos: - hdmi: replace system_wq with system_percpu_wq pl111: - Fix error handling in probe mediatek/atomic/tidss: - Fix tidss in another way and revert reordering of pre-enable and post-disable operations, as it breaks other bridge drivers nouveau: - Fix regression from fwsec s/r fix pci/vga: - Fix multiple gpu's being reported a 'boot_display' fb-helper: - Fix vblank timeout during suspend/reset amdgpu: - Clang fixes - Navi1x PCIe DPM fixes - Ring reset fixes - ISP suspend fix - Analog DC fixes - VPE fixes - Mode1 reset fix radeon: - Variable sized array fix" * tag 'drm-fixes-2026-01-09' of https://gitlab.freedesktop.org/drm/kernel: (32 commits) Reapply "Revert "drm/amd: Skip power ungate during suspend for VPE"" drm/amd/display: Check NULL before calling dac_load_detection drm/amd/pm: Disable MMIO access during SMU Mode 1 reset drm/exynos: hdmi: replace use of system_wq with system_percpu_wq drm/fb-helper: Fix vblank timeout during suspend/reset PCI/VGA: Don't assume the only VGA device on a system is `boot_vga` drm/amdgpu: Fix query for VPE block_type and ip_count drm/amd/display: Add missing encoder setup to DACnEncoderControl drm/amd/display: Correct color depth for SelectCRTC_Source drm/amd/amdgpu: Fix SMU warning during isp suspend-resume drm/amdgpu: always backup and reemit fences drm/amdgpu: don't reemit ring contents more than once drm/amd/pm: force send pcie parmater on navi1x drm/amd/pm: fix wrong pcie parameter on navi1x drm/radeon: Remove __counted_by from ClockInfoArray.clockInfo[] drm/amd/display: Reduce number of arguments of dcn30's CalculateWatermarksAndDRAMSpeedChangeSupport() drm/amd/display: Reduce number of arguments of dcn30's CalculatePrefetchSchedule() drm/amd/display: Apply e4479aecf658 to dml nouveau: don't attempt fwsec on sb on newer platforms drm/tidss: Fix enable/disable order ...
2026-01-09Merge tag 'vfs-6.19-rc5.fixes' of ↵Linus Torvalds16-97/+196
gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - Remove incorrect __user annotation from struct xattr_args::value - Documentation fix: Add missing kernel-doc description for the @isnew parameter in ilookup5_nowait() to silence Sphinx warnings - Documentation fix: Fix kernel-doc comment for __start_dirop() - the function name in the comment was wrong and the @state parameter was undocumented - Replace dynamic folio_batch allocation with stack allocation in iomap_zero_range(). The dynamic allocation was problematic for ext4-on-iomap work (didn't handle allocation failure properly) and triggered lockdep complaints. Uses a flag instead to control batch usage - Re-add #ifdef guards around PIDFD_GET_<ns-type>_NAMESPACE ioctls. When a namespace type is disabled, ns->ops is NULL, causes crashes during inode eviction when closing the fd. The ifdefs were removed in a recent simplification but are still needed - Fixe a race where a folio could be unlocked before the trailing zeros (for EOF within the page) were written - Split out a dedicated lease_dispose_list() helper since lease code paths always know they're disposing of leases. Removes unnecessary runtime flag checks and prepares for upcoming lease_manager enhancements - Fix userland delegation requests succeeding despite conflicting opens. Previously, FL_LAYOUT and FL_DELEG leases bypassed conflict checks (a hack for nfsd). Adds new ->lm_open_conflict() lease_manager operation so userland delegations get proper conflict checking while nfsd can continue its own conflict handling - Fix LOOKUP_CACHED path lookups incorrectly falling through to the slow path. After legitimize_links() calls were conditionally elided, the routine would always fail with LOOKUP_CACHED regardless of whether there were any links. Now the flag is checked at the two callsites before calling legitimize_links() - Fix bug in media fd allocation in media_request_alloc() - Fix mismatched API calls in ecryptfs_mknod(): was calling end_removing() instead of end_creating() after ecryptfs_start_creating_dentry() - Fix dentry reference count leak in ecryptfs_mkdir(): a dget() of the lower parent dir was added but never dput()'d, causing BUG during lower filesystem unmount due to the still-in-use dentry * tag 'vfs-6.19-rc5.fixes' of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs: pidfs: protect PIDFD_GET_* ioctls() via ifdef ecryptfs: Release lower parent dentry after creating dir ecryptfs: Fix improper mknod pairing of start_creating()/end_removing() get rid of bogus __user in struct xattr_args::value VFS: fix __start_dirop() kernel-doc warnings fs: Describe @isnew parameter in ilookup5_nowait() fs: make sure to fail try_to_unlazy() and try_to_unlazy() for LOOKUP_CACHED netfs: Fix early read unlock of page with EOF in middle filelock: allow lease_managers to dictate what qualifies as a conflict filelock: add lease_dispose_list() helper iomap: replace folio_batch allocation with stack allocation media: mc: fix potential use-after-free in media_request_alloc()
2026-01-09Merge tag 'v6.19-p3' of ↵Linus Torvalds1-2/+0
git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fix from Herbert Xu: - Fix duplicate restart messages in qat * tag 'v6.19-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: qat - fix duplicate restarting msg during AER error
2026-01-09Revert "irqchip/riscv-imsic: Embed the vector array in lpriv"Anup Patel2-3/+9
The __alloc_percpu() fails when the number of IDs are greater than 959 because size parameter of __alloc_percpu() must be less than 32768 (aka PCPU_MIN_UNIT_SIZE). This failure is observed with KVMTOOL when AIA is trap-n-emulated by in-kernel KVM because in this case KVM guest has 2047 interrupt IDs. To address this issue, don't embed vector array in struct imsic_local_priv until __alloc_percpu() support size parameter greater than 32768. This reverts commit 79eaabc61dfb ("irqchip/riscv-imsic: Embed the vector array in lpriv"). Signed-off-by: Anup Patel <anup.patel@oss.qualcomm.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20251223143544.1504217-1-anup.patel@oss.qualcomm.com
2026-01-09irqchip/gic-v5: Fix gicv5_its_map_event() ITTE read endiannessLorenzo Pieralisi1-1/+1
Kbuild bot (through sparse) reported that the ITTE read to carry out a valid check in gicv5_its_map_event() lacks proper endianness handling. Add the missing endianess conversion. Fixes: 57d72196dfc8 ("irqchip/gic-v5: Add GICv5 ITS support") Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Acked-by: Marc Zyngier <maz@kernel.org> Link: https://patch.msgid.link/20251222102250.435460-1-lpieralisi@kernel.org Closes: https://lore.kernel.org/oe-kbuild-all/202512131849.30ZRTBeR-lkp@intel.com/
2026-01-09ublk: fix use-after-free in ublk_partition_scan_workMing Lei1-15/+22
A race condition exists between the async partition scan work and device teardown that can lead to a use-after-free of ub->ub_disk: 1. ublk_ctrl_start_dev() schedules partition_scan_work after add_disk() 2. ublk_stop_dev() calls ublk_stop_dev_unlocked() which does: - del_gendisk(ub->ub_disk) - ublk_detach_disk() sets ub->ub_disk = NULL - put_disk() which may free the disk 3. The worker ublk_partition_scan_work() then dereferences ub->ub_disk leading to UAF Fix this by using ublk_get_disk()/ublk_put_disk() in the worker to hold a reference to the disk during the partition scan. The spinlock in ublk_get_disk() synchronizes with ublk_detach_disk() ensuring the worker either gets a valid reference or sees NULL and exits early. Also change flush_work() to cancel_work_sync() to avoid running the partition scan work unnecessarily when the disk is already detached. Fixes: 7fc4da6a304b ("ublk: scan partition in async way") Reported-by: Ruikai Peng <ruikai@pwno.io> Signed-off-by: Ming Lei <ming.lei@redhat.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
generated by cgit v1.2.3 (git 2.39.0) at 2026-05-02 16:24:39 +0300