11257 Commits
Author SHA1 Message Date
Linus Torvalds 89d2d7bf06 Merge tag 'efi-next-for-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi
Pull EFI updates from Ard Biesheuvel:

 - Set the LoaderDevicePartUUID EFI variable from the stub to help
   systemd discover the file system layout when booting straight into
   Linux without GRUB or systemd-boot (Vincent Mailhol)

 - Some GUID deduplication work from Vincent

 - Remove pointless UTF16->UTF8 and vice versa conversions from the stub

 - Some kmap() -> kmap_local_page() conversions in the capsule loader

 - Add a runtime control to en/disable EFI runtime services so that
   PREEMPT_RT systems can enable them as needed

 - Add a 'nostatfs' mount option to efivarfs so that the cost of
   querying the EFI variable store (which is already rate limited) can
   be avoided entirely on systems where it is disproportionately costly

 - Rework the EFI libstub Makefile to align x86 with other
   architectures, and inherit/adapt the global CFLAGS variable rather
   than reconstruct it from scratch

 - Constify attributes of statically allocated sysfs nodes

 - Avoid register x18 when building the arm64 EFI stub, in order to
   comply with the UEFI spec, and to permit it to execute in a context
   where x18 is special

 - Preserve the physical addresses of all EFI config tables that may be
   of interest to an incoming kexec kernel

 - Add some LKDTM tests for EFI runtime crashes where the faulting
   address is inside a EFI memory region

 - Other minor bug fixes and cosmetic cleanups

* tag 'efi-next-for-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: (35 commits)
  lkdtm: Add more EFI runtime tests
  efi: Initialize all configuration table addresses to EFI_INVALID_TABLE_ADDR
  efi: Retain the address of the LINUX_EFI_MEMRESERVE table
  efi/libstub: Don't replace an existing LINUX_EFI_MEMRESERVE table
  efi/runtime-wrappers: Don't park the worker after a recovered firmware fault
  efi: Use sysfs_emit() not sprintf() to generate sysfs file contents
  efi: Constify sysfs attributes
  efi/libstub: Disable kernel stack erasing in the common flags
  efi/libstub: Build the x86 stub from KBUILD_CFLAGS
  efi/libstub: Declare the x86 stub's assembly entry points
  efi/libstub: arm64: Don't use the platform register x18
  efi/libstub: Free cmdline_ptr in efi_pe_entry
  efi/riscv: libstub: Don't set image_size in handle_kernel_image()
  efi/libstub: Fix error unwind freeing fdt in allocate_new_fdt_and_exit_boot()
  efivarfs: add nostatfs mount option to skip QueryVariableInfo()
  efi/libstub: add initial Boot Loader Interface support
  efi/libstub: Add efi_snprintf() to construct wide strings
  efi/libstub: Add support for printing human readable GUIDs
  efi/libstub: Output UTF-16 directly from vsnprintf()
  efi/libstub: Avoid efi_puts() for compile time constant strings
  ...
2026-10-24 20:07:00 -10:00
Linus Torvalds 0dfc0090b9 Merge tag 'fbdev-for-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev
Pull fbdev updates from Helge Deller:
 "A whole lot of small fixes all over many drivers, but the majority of
  changes are related to code cleanups regarding the cursor handling in
  vt and fbcon.

  Fixes:
   - core: initialize modelist in framebuffer_alloc()
   - core: bitblit: fix glyph clipping when fbcon pans
   - fbcon: restore font geometry if font rotation fails
   - sh_mobile_lcdcfb: restore the per-overlay sysfs attributes
   - udlfb: don't rebuild the mode list while the framebuffer is in use
   - atmel_lcdfb: prevent FIFO work after removal

  Cleanups:
   - vt, fbcon, vgacon: cursor code rework & cleanups
   - MAINTAINERS: name the deller/linux-fbdev for-next branch
   - drop unused FB_IOMEM_HELPERS_DEFERRED Kconfig option
   - acornfb: remove unused code
   - atafb: fix sparse warnings and avoid casts
   - sstfb: use managed PCI device enable
   - gxt4500, kyro, nvidia: release write-combining handle on probe failure
   - various drivers: typo fixes in comments
   - various drivers: fix error path on fb_deferred_io_init() failure
   - various drivers: use FB blanking constants instead of VESA constants"

* tag 'fbdev-for-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: (53 commits)
  fbdev: xilinxfb: Use FB blanking constants
  fbdev: platinumfb: Use FB blanking constants
  fbdev: sa1100fb: Remove comment on VESA DPMS modes
  fbdev: i810fb: Use FB blanking constants
  fbdev: au1100fb: Use FB blanking constants
  fbcon: Retry rotated font allocation after failure
  fbcon: Rebuild rotated font buffer on font change
  fbcon: Include font geometry in the rotated font cache
  fbdev: bitblit: Fix glyph clipping when fbcon pans
  fbcon: Replace fbcon_fill_cursor_mask() with fbcon_cursor_glyph()
  lib/fonts: Add font_glyph_cursor() helper
  vgacon: Use vt_cursor_{start,end}()
  vgacon: Remove trailing whitespaces
  vt: Add cursor-size helpers
  MAINTAINERS: name the deller/linux-fbdev for-next branch
  fbdev: atafb: avoid cast when assigning buffer address pointer
  fbdev: atafb: fix sparse warnings
  fbdev: atyfb_base: fix typos in comments
  fbdev: aty128fb: fix typos in comments
  fbdev: mach64: fix typos in comments
  ...
2026-10-24 19:11:27 -10:00
Linus Torvalds 55fbedcec6 Merge tag 'bpf-next-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next
Pull bpf updates from Alexei Starovoitov:
 "Major changes:

   - Introduce scalar evolution (SCEV) analysis in the verifier.

     It infers how registers and stack slots change in a loop and lets
     the verifier check bounded loops with induction variables as ranges
     instead of walking every iteration. The number of processed insns
     drops ten fold in programs with loops (Eduard Zingerman)

   - Add 'callx' instruction: indirect call of a static BPF subprogram.

     The address is taken with ld_imm64 or loaded from read-only data.
     Supported by x86-64, arm64 and riscv64 JITs (Alexei Starovoitov, Pu
     Lehui)

   - Add unwind_goto and unwind_exit instructions, so that Rust panic or
     C++ exception can run destructors of every frame it passes through.
     The normal path is free of unwind code. Supported by x86-64 and
     arm64 JITs (Alexei Starovoitov)

   - Support programs compiled by rust-bpf: treat load and store through
     a number as arena access with BPF_F_ARENA_SCALAR, accept rust names
     in BTF (Alexei Starovoitov)

   - Raise BPF program stack size from 512 bytes to 2 KiB on x86-64 and
     arm64 (Kumar Kartikeya Dwivedi)

   - Support struct, union and __int128 up to 16 bytes passed and
     returned by value in BPF subprograms and kfuncs, and fix x86-64 and
     arm64 trampolines for such arguments (Yonghong Song)

   - Introduce a common way to attach struct_ops to a cgroup via
     bpf_link. bpf_tcp_ops is the first user and mirrors TCP sock_ops
     callbacks (Martin KaFai Lau, Amery Hung)

   - Describe inlined functions in BTF. New kinds tell where the inline
     sites are and how to fetch the arguments there.

     CONFIG_DEBUG_INFO_BTF_INLINE keeps it apart from the main BTF in
     .BTF.inline section or in btf_vmlinux_inline.ko (Alan Maguire)

   - Fix many memory safety, lifetime and locking bugs in BPF core,
     verifier, iterators, local storage, dynptr, devmap, cpumap and
     seg6local (Josef Bacik, Alexei Starovoitov)

   - Diff stat is dominated by selftests and by removal of
     lib/test_bpf.c. Its 16k lines of instruction tests were converted
     to BPF selftests that BPF CI runs on every architecture it covers
     (Daniel Borkmann)

  Other features and fixes:

   - Add KASAN checks to memory accesses of JITed programs on x86-64
     (Alexis Lothoré)

   - Complete unification of helper, kfunc and subprog argument checks
     in the verifier (Amery Hung)

   - Add bpf_copy_from_user_mm[_str]() kfuncs (Anastasios Papagiannis)

   - Various features and fixes (Daniel Borkmann):
       - Add .bpf keyring for program signature verification, modelled
         after dm-verity keyring, and support ML-DSA in signing tools
       - Emit shorter and faster code in x86-64 JIT for patterns that
         LLVM generates
       - Fix various issues in gotox handling

   - Let BPF LSM set xattrs at inode creation with bpf_inode_init_xattr()
     (David Windsor, Daniel Borkmann)

   - Use sleepable page allocation in sleepable arena paths. Fix races
     between arena free, allocation and user page fault (Emil Tsalapatis)

   - Switch BPF crypto from lskcipher to AES-CBC and AES-ECB libraries
     (Eric Biggers)

   - Add bpf_proactive_reclaim() kfunc (Hui Zhu)

   - Render decl_tags in libbpf btf_dump and add tests for bpftool C
     dump (Ihor Solodrai)

   - Speed up tracing_multi attach on x86 (Jiri Olsa)

   - Various features and fixes (Kumar Kartikeya Dwivedi):
       - Add BPF_PROG_STREAM_OPEN command to read BPF streams through a
         file descriptor with poll support
       - Let kernel structs publish arena pointers with __arena type tag
       - Fix __uninit kfunc output buffers and fastcall rewrite with
         indirect stack accesses
       - Refuse CO-RE relocations for signed programs

   - Add enqueue_rcvq and dequeue_rcvq hooks to bpf_tcp_ops to adjust
     sk_rcvlowat and avoid unnecessary wakeups (Kuniyuki Iwashima)

   - Add bpf_ksock_sendto() kfunc and allow ksock connect and send from
     bpf_wq (Mahe Tardy)

   - Fix racy plt target update in arm64 bpf_arch_text_poke()
     (Matthew Wood)

   - Restructure BPF selftests Makefile as a layered build
     (Mykola Lysenko)

   - Speed up hash map lookups for u32 and u64 keys (Mykyta Yatsenko)

   - Add signed div/mod, movsx, bswap and gotol to MIPS JITs, signed
     div/mod to parisc JITs (Nicholas Dudar, Johan Almbladh)

   - Fix stack overflow in build ID parser on 32-bit (Nickolai
     Zeldovich)

   - Add stack arguments, signed arena loads and gotox to riscv64 JIT.
     Pu Lehui is now co-maintainer of riscv BPF JITs (Pu Lehui, Chen
     Pei, Feng Jiang)

   - Add bpf_call_rcu() and bpf_call_rcu_tasks_trace() kfuncs. Support
     fetching and/or/xor atomics in arena on x86-64 (Puranjay Mohan)

   - Fix flaky selftests, selftests with clang 23 and bpf-gcc
     (Qiliang Yuan, KaFai Wan, Vineet Gupta)

   - Fix builds broken by fatal resolve_btfids warnings, BTF generation
     on ARC, and define arch_cmpxchg_local() on arc, hexagon and
     openrisc (Sasha Levin)

   - Reduce memory use of hash maps by up to 50% per element
     (T.J. Mercier)

   - Mark pointer fields of sched_ext ops arguments as trusted (Tejun
     Heo)

   - Remove legacy bpf_asm, bpf_dbg and bpf_jit_disasm tools (Xia Yan)

   - Fix index overflow in queue and stack maps, arena range tree after
     allocation failure, tail call loop after freplace detach, lost
     signal in bpf_send_signal() (Yuan Chen)

   - Many more fixes and cleanups"

* tag 'bpf-next-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (660 commits)
  selftests/bpf: Time tc_edt from its first packet with data
  selftests/bpf: Test unwind_exit of an exception callback
  selftests/bpf: Tests for 32-bit scalar evolution bounds computation
  bpf: Reject unwind_goto and unwind_exit in offloaded progs
  bpf: Support 32-bit linear scalar evolution
  bpf: Make unwind_exit of an exception callback exit in JITs
  selftests/bpf: Test forbidden bpf_ksock_sendto() LSM attach
  selftests/bpf: Test ksock sendto()
  bpf: Add bpf_ksock_sendto() kfunc
  selftests/bpf: Test unwinding from R0: R2 subprog
  selftests/bpf: Add a C++ prog with exceptions
  selftests/bpf: Add tests for unwind_goto and unwind_exit
  bpf, arm64: Support unwind_goto and unwind_exit
  bpf, x86: Support unwind_goto and unwind_exit
  bpf: Add unwind_goto and unwind_exit insns
  tools/bpf: Remove legacy BPF tools
  bpf: Annotate data races on bpf_lru_node type
  selftests/bpf: Add arena allocation race tests
  bpf: Fix arena race between page free and alloc leading to incoherency
  bpf: Revalidate faulted arena pages before installing user mappings
  ...
2026-10-23 13:08:49 -10:00
Linus Torvalds 90b754d401 Merge tag 'bootconfig-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull bootconfig updates from Masami Hiramatsu:
 "Parser robustness and validation improvements:

   - Skip printing early params to cmdline from bootconfig

     Suppress early_param keys from /proc/cmdline and warn the user,
     since bootconfig does not invoke early_param handlers and silently
     ignoring them is misleading

   - Reject unexpected data after null character

     Detect and reject non-null data following an intermediate null
     character in the bootconfig buffer, preventing silently ignored
     configuration after an early termination

  Code cleanups:

   - Merge _xbc_exit() into xbc_exit()

     Since memblock_free() now handles late freeing and NULL addresses,
     the separate _xbc_exit() helper and its early argument are
     unnecessary. Inline it into xbc_exit()

   - Remove redundant assignment in xbc_parse_array()

     The node->child = 0 assignment after the loop duplicates what
     xbc_init_node() already did

   - Skip internal tree sanity checks in kernel

     Move the node index bounds loop from xbc_verify_tree() into a
     userspace-only xbc_sanity_check_tree() to reduce boot-time
     overhead, since out-of-bounds indices cannot be produced by
     malformed input

   - Move BOOTCONFIG_FOOTER_SIZE to include/linux/bootconfig.h

     Share the footer size constant between kernel and user-space tools,
     replacing the hardcoded (BOOTCONFIG_MAGIC_LEN + 8) expression in
     init/main.c

  Tooling improvements:

   - Remove unused PAGE_SIZE macro from the bootconfig tool

   - Consolidate xbc_init() to error message wrapper

     Use init_xbc_with_error() for all bootconfig initialization paths
     in the tool for simpler and more consistent error handling"

* tag 'bootconfig-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  bootconfig: Move BOOTCONFIG_FOOTER_SIZE to include/linux/bootconfig.h
  bootconfig: Skip internal tree sanity checks in kernel
  tools/bootconfig: Consolidate xbc_init() to error message wrapper
  bootconfig: Reject unexpected data after null character
  bootconfig: Skip printing early params to cmdline from bootconfig
  tools/bootconfig: remove unused PAGE_SIZE macro
  bootconfig: remove redundant assignment in xbc_parse_array()
  bootconfig: merge _xbc_exit() into xbc_exit()
2026-10-23 12:20:54 -10:00
Linus Torvalds 5b212610d0 Merge tag 'printk-for-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux
Pull printk updates from Petr Mladek:

 - John Ogness became PRINTK co-maintainer

 - Unregister boot consoles when any proper console is registered at the
   end of the boot phase. Before they were removed only when the
   so-called preferred console, usually set via the last 'console='
   parameter, got registered

 - Fix computation for increasing the printk ringbuffer on systems with
   many CPUs and possibly long backtraces from all CPUs

 - Cleaned up irq_works handling for deferred printk operations

 - Use acquire/release semantic for filled_random_ptr_key

 - Allow to use ':' in console options

 - More code clean up

* tag 'printk-for-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux:
  MAINTAINERS: Make John PRINTK co-maintainer
  lib/vsprintf: Use EXPORT_SYMBOL_IF_KUNIT() to export symbols
  printk: Remove console options before decoding the name
  printk: increase the ring buffer for more than 16 CPUs by default
  printk_ringbuffer: Avoid needless read of prb_desc
  printk: Use two irq_works instead per-CPU
  lib/vsprintf: Use acquire/release for ptr_key publication
  printk: Remove remaining boot consoles when a real console exists
2026-10-23 09:44:53 -10:00
Linus Torvalds 845f394e46 Merge tag 'sysctl-7.04-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl
Pull sysctl updates from Joel Granados:

 - Disallow partial vector updates

   Stage sysctl vector writes before updating. Removes the chance of
   leaving a sysctl vector partially updated due to erroneous input.
   This is not an atomic write; a concurrent reader can still see a
   partially updated vector.

 - Remove redundant sysctl config guards

   Remove locations where (CONFIG_SYSCTL && CONFIG_PROC_FS) was checked.
   They are superfluous as CONFIG_SYSCTL now depends directly on
   CONFIG_PROC_FS.

 - Rewrite selftests using KTAP helpers

   Each test now reports its own KTAP result and runs in a subshell.
   Test suite continues after failure.

 - Misc

   Fix a use-after-free in the selftests test_sysctl module. Quiet an
   unused variable warning in fs/proc/proc_sysctl.c:init_header(). Add
   tests for partial vector updates and the int jiffies converters.

* tag 'sysctl-7.04-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl:
  selftests: sysctl: Check the sign of a negative jiffies read
  sysctl: Add jiffies converter entries to the test module
  sysctl: quiet unused variable warning in fs/proc/proc_sysctl.c:init_header()
  sysctl: unregister tables before freeing bitmap
  sysctl: Rewrite selftests on top of KTAP helpers
  sysctl: remove redundant CONFIG_PROC_FS checks
  sysctl: consolidate CONFIG_SYSCTL into a single block in kernel/sysctl.c
  sysctl: collapse redundant CONFIG_SYSCTL nesting in kernel/sysctl.c
  sysctl: Add 0013 to test partially updated vectors
  sysctl: Disallow partial updates for erroneous sysctl vectors
  sysctl: Reject uint arrays before calling the general proc_vec
  sysctl: Split data conversion and file position handling
2026-10-23 09:37:09 -10:00
Linus Torvalds c0e8d30137 Merge tag 'modules-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux
Pull module updates from Petr Pavlu:

 - Ignore local labels and mapping symbols during module load

   These symbols were already ignored during kallsyms address-to-symbol
   lookups. Filter them out earlier during module loading to reduce
   lookup overhead and prevent them from appearing in /proc/kallsyms.

 - Fix potentially incorrect access of SetOnce<T> when setting Rust
   module parameters.

 - Fix a potential read of an uninitialized count when printing taint
   information for unloaded modules.

 - Allocate the kmod argument array using kmalloc_array() in preparation
   for conversion to type-aware allocators.

 - Clean up includes in linux/kmod.h

   Add explicit includes of linux/umh.h to files that use usermode
   helpers. Then clean up the #include list in linux/kmod.h, notably
   removing the compatibility linux/umh.h include.

 - Remove the error-injection.h include from linux/module.h

   Add explicit includes of linux/error-injection.h to files that use
   the ALLOW_ERROR_INJECTION() macro and currently rely on it being
   provided indirectly via linux/module.h. Then remove the unnecessary
   linux/error-injection.h include from linux/module.h.

 - Replace __MODULE_STRING() with __stringify() in various drivers in
   preparation for removing the former macro.

* tag 'modules-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux:
  drivers: Replace __MODULE_STRING() with __stringify()
  module: Fix uninitialized count read of unloaded taint tracking record
  rust: module_param: Fix potentially incorrect access of `SetOnce<T>`
  module: Remove the error-injection.h include from linux/module.h
  drm/xe: Include error-injection.h for ALLOW_ERROR_INJECTION()
  drm/i915: Include error-injection.h for ALLOW_ERROR_INJECTION()
  syscalls: Include error-injection.h for ALLOW_ERROR_INJECTION()
  net: Include error-injection.h for ALLOW_ERROR_INJECTION()
  block: Include error-injection.h for ALLOW_ERROR_INJECTION()
  module: Bring includes in linux/kmod.h up to date
  time/jiffies: Include linux/sysctl.h for proc_int_u2k_conv_uop(), ...
  umh, treewide: Explicitly include linux/umh.h where needed
  modules/kmod: Allocate argv with kmalloc_array()
  module/kallsyms: Ignore local labels and mapping symbols during module load
  module/kallsyms: Refactor current symbol filtering into is_core_symbol()
  module/kallsyms: Rename is_mapping_symbol() to is_ignored_kernel_symbol()
2026-10-23 09:32:44 -10:00
Linus Torvalds c5fd5e67c7 Merge tag 'mm-stable-2026-10-19-21-33' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull MM updates from Andrew Morton:

 - "selftests/mm: improve khugepaged coverage" (Kiryl Shutsemau):

   Give khugepaged a proper workout. Extend the tests to all supported
   mTHP orders, check exactly which windows collapsed, and make scan
   completion deterministic. Race collapse against faults, pinning, fork
   and remap; verify that the contents survive.

   Add coverage for whole-page-table zaps and memory pressure too.

 - "selftests/mm: separate GUP microbenchmarking from functional testing"
   (Sarthak Sharma):

   Untangle GUP benchmarking from correctness testing. Move the
   benchmark into tools/mm, add a standalone harness-based GUP selftest,
   and move shared helpers into tools/lib/mm. Give each tool one job
   instead of mixing timing measurements with correctness checks.

   Cover the mapping, pinning and batch-size combinations explicitly.

 - "mm: Switch device DAX to section-based vmemmap optimization" (Muchun
   Song):

   Apply section-based vmemmap optimization to device DAX. Rework the
   backing metadata layout to save memory while preserving the handling
   of device memory hotplug and its different alignment and lifetime
   requirements.

 - "mm: Introduce section-based vmemmap optimization for HugeTLB"
   (Muchun Song):

   Cut the memory consumed by HugeTLB's struct page array with
   section-based vmemmap optimization. Arrange the metadata so large
   huge pages need fewer backing pages, while keeping initialization,
   teardown and the various hugepage configurations straight.

 - "mm/huge_memory: clean up and decouple the anon and file split
   helpers" (Kairui Song):

   Separate anonymous and file-backed folio splitting, which have rather
   different locking and bookkeeping requirements. Move the work into
   separate helpers, drop dead checks and tidy swap-cache handling. Fix
   error paths, including one that could leave a folio frozen.

   Keep the swap cache cases separate from file-cache splitting.

 - "mm: Unconditional per-VMA locks and cleanups" (Dave Hansen):

   Make per-VMA locking unconditional and clean up the old conditional
   code around it. This removes configuration-dependent plumbing and
   lets callers depend on one locking model rather than carrying both
   cases along.

 - "memcg: remove the v1 soft limit" (Shakeel Butt):

   Remove the old cgroup v1 memory soft-limit machinery. This has long
   since been superseded by the newer memory-control interfaces; hauling
   around a separate reclaim scheme for it no longer buys us much.

 - "read proc/pid/smaps_rollup under per-vma lock" (Suren Baghdasaryan):

   Read /proc/PID/smaps_rollup using per-VMA locks where possible,
   rather than holding mmap_lock across the entire walk. Retain the
   contention fallback and add tearing tests. This considerably reduces
   latency when another thread is busy changing its mappings.

 - "mm/damon: introduce data access-as-a-data attribute" (SJ Park):

   Teach DAMON to expose memory access observations as data attributes,
   making them available to the probe and filtering machinery. Extend
   the interfaces, documentation and tests so the new information can be
   used rather than merely collected.

 - "Remove PG_private by using page/folio->private checks instead" (Zi
   Yan):

   Get rid of PG_private and use the folio's private pointer to say
   whether private data is attached. Convert the filesystem users,
   including erofs, f2fs and md, and clean up the old accessors and
   flags. There are a few special cases, notably swapcache and hugetlb,
   which need explicit care.

 - "mm: make userland page table freeing RCU-safe" (Lorenzo Stoakes):

   Make freeing userspace page tables safe against RCU readers. Sort out
   the page-table lifetime and locking rules so walkers cannot stumble
   over freed tables while mappings are being torn down.

 - "make unused huge shrinker memcg aware" (Qi Zheng):

   Make shmem's unused-huge-folio shrinker aware of memory cgroups, so
   reclaim can find those folios under the right memcg. Wire up the
   per-memcg tracking and its lifetime rules, and give the shrinklist
   its own lockdep class to avoid spurious dependency reports.

 - "mm: Drop pxd_ERROR()" (Anshuman Khandual):

   Remove the old pxd_ERROR() page-table checks and their
   architecture-specific baggage. Simplify the common page-table
   interfaces and callers now that these checks no longer serve a
   useful purpose.

 - "memcg: group struct fields by access pattern" (Shakeel Butt):

   Rearrange memcg's hot and cold fields according to how they're
   actually accessed. Keep frequently updated counters and their
   neighboring state from fighting over cachelines and reduce needless
   cacheline traffic.

 - "mm/damon/core: fix the size charged for a filter-trimmed region"
   (Donggeun Yoo):

   Fix DAMOS quota accounting when a filter trims a monitoring region.
   Charge only the part left after filtering, not the original region,
   and add KUnit coverage. Previously the excluded memory could eat into
   the quota and make schemes run more slowly than requested.

 - "mm/damon: add kunit and selftests for probes and probe weights" (SJ
   Park):

   Add more tests for DAMON probes and their weights, including
   validation and the results reported to userspace. This is mostly
   about catching regressions in the newer probe infrastructure before
   they become harder to diagnose.

 - "mm: memcontrol: constify the read side of the read side of the memcg
   API" (Tal Zussman):

   Mark the read-only parts of the memcg interface const, from folio and
   lruvec accessors to counters and swap helpers. Most of this is
   mechanical, but it makes the contracts clearer and lets the compiler
   catch accidental writes.

 - "mm/damon/vaddr: support {prep,apply}_probes" (SJ Park):

   Support the new prepare/apply probe operations in DAMON's
   virtual-address backend. This brings vaddr monitoring into line with
   the probe infrastructure and makes the added probe types useful there
   too.

 - "mm/mglru: clean up folio counters and flag usage" (Kairui Song):

   Simplify MGLRU's folio counters and flag handling. Remove redundant
   accounting paths and make the state transitions easier to follow
   without changing the intended reclaim policy.

 - "arch, mm/execmem: resolve confusion about set_direct_map_valid_noflush()"
   (Mike Rapoport (Microsoft)):

   Clarify and straighten out the set_direct_map_valid_noflush()
   interface across architectures and execmem. Make the requested
   mapping changes and the callers' expectations agree, rather than
   relying on subtly different architecture behavior.

 - "mm: zswap: free cold writeback folios promptly" (Alexandre Ghiti):

   Free zswap writeback folios as soon as their disk write completes.
   They are cold temporary buffers, so putting them on the LRU only
   makes reclaim rediscover them later. Extend swap-cache dropbehind and
   let zswap keep these folios off the LRU altogether.

 - "mm: gup: cleanup gup_fast call chain" (Aristeu Rozanski):

   Clean up the GUP-fast call chain and simplify how the fast-path
   helpers pass their arguments and results around. Keep the page-pin
   behavior the same while making the call sequence easier to maintain.

 - "mm: optimize zone-device memmap initialization" (Li Zhe):

   Speed up initialization of zone-device struct pages. Avoid redundant
   work when setting up large device-memory ranges, where touching every
   descriptor can get expensive.

 - "mm/zswap: shrink zswap_entry via a pool id" (Jianyue Wu):

   Reduce the size of zswap_entry by storing a compact pool identifier
   instead of a full pointer. Keep the pool lookup and lifetime handling
   correct while saving per-entry metadata.

 - "mm/damon: support access monitoring of hugetlb-backed memory"
   (Krishna Iyer):

   Let DAMON monitor hugetlb-backed memory too. Extend the relevant
   access checks and add coverage so those mappings no longer fall
   through a hole in the monitoring machinery.

 - "mm/execmem: fixes and cleanups for the ROX cache" (Mike Rapoport):

   Tidy execmem's read-only-executable cache and fix its handling of the
   awkward allocation and release cases. The aim is to make the cache's
   ownership and permission transitions more predictable.

 - "zsmallc: remove old object read API" (Sergey Senozhatsky):

   Drop zsmalloc's old object-read API and move its remaining users to
   the supported access mechanism. This removes a duplicate interface
   which we no longer need.

 - "mm/mempolicy: stop copying state in the interleave paths" (Gregory
   Price):

   Stop copying mempolicy state in the interleave paths when a reference
   to the existing policy will do. This avoids extra work and makes the
   ownership rules less obscure.

 - "mm/mglru: speed up inc_min_seq() and fix cold/hot inversions" (Barry
   Song):

   Make MGLRU's generation advancement cheaper and fix cases where cold
   and hot folios end up in the wrong order. Adjust the counter and list
   handling so reclaim doesn't keep passing over the better eviction
   candidates.

 - "mm: Fix MF_DELAYED handling on memory failure" (Lisa Wang):

   Treat MF_DELAYED as a partially completed memory-failure operation,
   not an outright failure. Propagate that result correctly through
   shmem and the generic handler, fix the extra-reference accounting,
   and add tests for the resulting SIGBUS behavior.

 - "tools/mm/page_owner_sort: fix --sort, add module filter, improve
   usage" (Ye Liu):

   Fix page_owner_sort's --sort handling, add module-based filtering and
   make the usage output more helpful. This makes the tool less
   frustrating when tracking down who is holding on to pages.

 - "mm/damon: move damos filter range arguments validation to core" (SJ
   Park):

   Move DAMOS filter range validation into the core, where all callers
   can share it. Also close the sysfs read-twice races which could pass
   inconsistent ranges, and add tests for invalid input.

 - "mm/damon: misc cleanups" (Zenghui Yu):

   Clean up a collection of small DAMON rough edges in the core,
   interfaces and tests. No large behavior change here, just simpler
   code and fewer opportunities for confusion.

 - "mm/damon: cleanup code, add test cases, and update guidances in
   docs" (SJ Park):

   Clean up DAMON's core and interfaces, add missing test cases and
   bring the documentation into line with the code. These changes should
   make the newer facilities easier to understand and maintain.

 - "mm/damon: introduce hugepage_size probe filter" (SJ Park):

   Add a DAMON probe filter for hugepage size. Let users select a range
   of folio sizes through sysfs, validate the range and document the new
   interface, so monitoring can concentrate on memory backed by the
   desired hugepage sizes.

 - "selftests/mm: pagemap_ioctl test fixes and cleanups" (Zenghui Yu):

   Fix some pagemap ioctl test assumptions and clean up their setup and
   reporting. Make failures point to the operation that went wrong
   rather than to test harness bookkeeping.

 - "mm: avoid large folio splits when swap is unavailable" (Johannes
   Weiner):

   Avoid splitting large folios merely to attempt swap when no swap
   space is available. There is little point paying for an expensive
   split when reclaim cannot actually swap the resulting pages out.

 - "mm: workingset: fix the shadow node budget under MGLRU" (Hui Zhu):

   Fix the workingset shadow-node budget with MGLRU enabled. Keep the
   shadow entries within the intended limits so refault tracking does
   not quietly consume more metadata than it should.

 - "selftests/mm: TAP output and global-state fixes" (Song Hu):

   Fix selftests which produce misleading TAP output or fail to restore
   global settings after a run. A test ought to leave the system as it
   found it, particularly when a whole suite follows behind.

 - "mm: remove page_swap_entry()" (Tal Zussman):

   Remove page_swap_entry() and convert its remaining users to the folio
   and swap-entry helpers. Lose an old page-level interface and make the
   swap paths a little more consistent.

 - "mm: refactor zonelist constructors and iterators" (Gregory Price):

   Refactor the zonelist construction and walk helpers to reduce
   duplicated logic. Keep the allocation ordering rules intact while
   making it clearer how zones are selected.

 - "mm: kmemleak: batch the struct page scan" (Breno Leitao):

   Scan adjacent struct pages in batches instead of taking kmemleak_lock
   once for every single page. This preserves scan coverage and the
   lock-hold bound, while cutting overhead substantially on debug
   kernels.

 - "mm/damon: misc improvements in tests and documents" (Zenghui Yu):

   Fix some DAMON selftests which leave kdamond running or fail under
   Python safe-path mode, and improve the KUnit coverage and
   documentation. Nothing especially glamorous, but these are worth
   doing.

 - "mm/damon: introduce probe_hits_wsum DAMOS core filter" (SJ Park):

   Add a DAMOS core filter using weighted probe-hit counts. This gives
   schemes another way to select regions based on what the monitoring
   probes observed.

 - "mm/mglru: fix ineffective memory protection for non-kswapd reclaim"
   (Ridong Chen):

   Fix MGLRU's memory protection handling for reclaim outside kswapd.
   The protection settings weren't having the intended effect in these
   paths, leaving protected memory more exposed than requested.

 - "mm/damon: improve readability, clarity and test coverage" (SJ Park):

   Simplify a handful of DAMON core helpers, clarify their behavior and
   expand test coverage. There are no intended userspace-visible changes
   in this batch.

 - "mm: replace PF_KCOMPACTD/PF_KSWAPD with kthread_func()" (Kefeng
   Wang):

   Stop identifying reclaim and compaction workers through the PF_KSWAPD
   and PF_KCOMPACTD task flags. Use their kthread functions instead and
   remove the redundant flag plumbing.

 - "mm/hugetlb: fix surplus accounting and availability checks during
   demotion" (Longlong Xia):

   Fix HugeTLB surplus accounting and availability checks when demoting
   huge pages. Keep the counters and reservation decisions consistent as
   one huge page turns into several smaller ones.

 - "mm/damon: add kunit tests for probe_hits handling and probe params
   validation" (Jason Angelov):

   Add KUnit tests for DAMON probe-hit handling and invalid probe
   parameters. These cover edge cases that were too easy to miss in
   ordinary monitoring tests.

 - "mm/damon: fix misc bugs in kunit, quota goals and sysfs refresh_ms"
   (SJ Park):

   Fix a few DAMON bugs in KUnit tests, quota-goal handling and the
   sysfs refresh interval. Small fixes, but the incorrect results and
   control behavior were real.

 - "mm: zswap: optimize zswap invalidate and store" (Kefeng Wang):

   Simplify zswap's invalidate and store paths to avoid avoidable
   lookups and work. Keep the entry lifetime rules intact while making
   those frequent operations cheaper.

 - "mm: replace custom ratelimiting logic" (Pedro Falcato):

   Replace hand-rolled MM rate limiting with the common kernel helpers.
   There is no need to maintain another local version of the same
   mechanism.

 - "mm/vmalloc: minor cleanups" (Ye Liu):

   Tidy some vmalloc initialization and reporting code, and pull
   duplicated vmap-area insertion work into a helper. No functional
   changes are intended.

 - "mm/mglru: clean up isolate_folios for readability and clarity"
   (Ridong Chen):

   Clean up MGLRU's isolate_folios() so the decisions are easier to read
   and verify. Keep reclaim behavior unchanged while removing
   unnecessary twists in the control flow.

 - "Catch automatic storage in IDA and Maple Tree definitions" (Yury
   Norov):

   Catch IDA and maple-tree definitions placed in automatic storage
   where the lifetime rules are wrong or easy to get wrong. Add checks
   so such mistakes are harder to slip through unnoticed.

 - "mm, swap: some random fixes and cleanups" (Kemeng Shi):

   Fix and simplify a few unrelated swap paths, removing redundant work
   and tidying up error handling. A small collection of things which
   were better fixed than left lying around.

 - "mm/page_io: folio conversion cleanups" (Tal Zussman):

   Finish some page-to-folio conversions in swap I/O, removing obsolete
   wrappers and using folio operations consistently. The I/O behavior is
   intended to remain the same.

 - "mm/swap: skip empty clusters in the swapoff scan" (Youngjun Park):

   Skip empty swap clusters during swapoff instead of walking slots
   which have nothing to release. This avoids pointless work on sparsely
   used swap devices.

 - "mm: trace: decode architecture-specific VMA flags" (Meijing Zhao):

   Teach the VMA trace output to decode architecture-specific flags,
   rather than leaving them as unexplained bits. That should make
   tracing a good deal more useful when debugging unusual mappings.

 - "mm, swap: don't spin on a bad swap entry" (Breno Leitao):

   Stop repeatedly retrying a swap entry which is already known to be
   bad. Make the error path terminate cleanly instead of wasting CPU
   chasing an entry that cannot be used.

 - "mm/page_isolation: fix UBSAN shift-out-of-bounds in
   isolate_single_pageblock" (Qi Xi):

   Fix an out-of-range shift in isolate_single_pageblock() and tighten
   its associated boundary handling. UBSAN found the issue; the result
   should be more robust pageblock isolation.

 - "mm: khugepaged: fix tracepoint UAF" (Vernon Yang):

   Fix a use-after-free in khugepaged tracepoint handling. Make sure the
   information recorded by tracing stays valid for as long as the trace
   event needs it.

 - "mm/damon: fix DAMOS bugs in core, paddr and vaddr" (SJ Park):

   Fix several DAMOS problems across the core and physical- and
   virtual-address backends. The changes close error cases and bring the
   implementations back into agreement.

 - "mm/hugetlb_cgroup: move the per-node usage along with the folio"
   (Hongfu Li):

   Move HugeTLB per-node usage accounting when folios migrate between
   nodes or are reparented to another cgroup. Otherwise numa_stat can
   retain stale charges and even underflow when the folio is freed.

 - "docs/core-api: memory-allocation: add k[mz]alloc_obj() and clarify
   kmalloc" (Mike Rapoport):

   Document the typed k[mz]alloc_obj() allocation helpers and clear up
   some kmalloc guidance. Make it easier for callers to choose the right
   interface.

 - "selftests/mm: Validate selections and scope memfd_secret setup"
   (Tianyi Chen):

   Check selftest selections before running and confine memfd_secret
   setup to the cases that actually need it. Avoid confusing failures
   caused by the test harness itself.

 - "mm/damon: move zero damos quota target_value handling to the core
   layer" (SJ Park):

   Handle a zero DAMOS quota goal target in the core rather than making
   each user of the interface invent its own rule. Keep quota decisions
   consistent across callers.

 - "mm/damon: Introduce a huge page collapsing mechanism using auto
   tuning" (Asier Gutierrez):

   Add an auto-tuned DAMON mechanism for collapsing huge pages. Use
   monitoring feedback to decide when collapse is worthwhile rather than
   forcing one fixed policy onto every workload.

 - "kmemleak: fix stale documentation and raise the verbose default"
   (Breno Leitao):

   Bring the kmemleak documentation up to date and require a third
   confirming scan before verbose kernels print a suspected leak. The
   extra scan helps suppress transient false positives in noisy debug
   builds.

 - "mm/memory: improve insert_pages() error handling" (Avi Weiss):

   Tighten insert_pages() error handling so partial failures are
   reported and cleaned up consistently. The caller should not have to
   guess how far the operation got.

 - "mm/damon: allow NULL or unstarted damon_ctx parameter for
   damon_call()" (SJ Park):

   Make damon_call() handle NULL and not-yet-started contexts safely.
   Simplify the rules for callers and avoid an indefinite wait on an
   invalid state.

 - "mm/damon: introduce pgidle_set probe filter type" (SJ Park):

   Add a pgidle_set DAMON probe filter, giving monitoring users another
   way to select pages by their idle-tracking state. Wire it through the
   filter interfaces and tests.

 - "mm/damon/core: remove unused helper functions" (Cheng-Han Wu):

   Remove DAMON core helpers which no longer have callers. Keep the API
   surface smaller rather than retaining dead code just in case.

 - "mm: stop calling pmd_folio() on special PMDs" (Gregory Price):

   Avoid calling pmd_folio() on special PMD mappings that have no struct
   page. The old assumption could fault in procfs walkers; use the
   normal-folio checks and handle those mappings properly.

 - "mm: remove three unused helpers from mm.h" (Tal Zussman):

   Remove three unused helpers from mm.h. Fewer obsolete interfaces for
   the next person to stumble over.

 - "mm/damon: improvements in efficiency, error handling, documents"
   (Liew Rui Yan):

   Skip needless DAMOS quota work once the quota is full, propagate a
   missing sysfs error and tidy a couple of comments. The ignored error
   could make a monitoring-start request appear successful when it
   wasn't.

 - "docs/mm/damon/design: add explanation of nr_snapshots" (Liew Rui
   Yan):

   Explain DAMON's nr_snapshots accounting in the design documentation
   and straighten out the associated terminology. Make it clearer what
   users should expect from that counter.

 - "selftests/cgroup: fixes for test_zswap on single core VM" (Wilson
   Felipe Pereira):

   Fix two test_zswap failures on single-CPU VMs. Wait for the exiting
   child's cgroup to become unpopulated before reconfiguring it, and
   avoid another test assumption which breaks under constrained
   scheduling.

 - "docs/ksm: fix advisor documentation and comment" (Jinjiang Tu):

   Correct the KSM advisor documentation and a misleading code comment.
   Keep the description aligned with how the advisor actually works.

 - "Fix bugs in HugeTLB allocation when mem_cgroup_charge_hugetlb()
   fails" (Ackerley Tng):

   Fix HugeTLB allocation cleanup when the memcg charge fails. Make sure
   failure exits undo what was allocated rather than leaving stale
   accounting or resources behind.

 - "mm, memcg: fix memory.peak reset clobbering other fds' watermark"
   (Ridong Chen):

   Fix memory.peak reset handling so resetting one file descriptor
   doesn't overwrite the watermark kept for another. Keep those per-open
   measurements independent as intended.

 - "mm: reject zone device folios in more folio walkers" (Gregory
   Price):

   Reject zone-device folios in page walkers that cannot safely handle
   them. Extend the existing checks rather than assuming every folio has
   ordinary system-memory backing.

 - "percpu: remove code with no effect" (Sang-Heon Jeon):

   Remove a few pieces of percpu code which no longer do anything. There
   is no reason to keep maintaining dead paths.

* tag 'mm-stable-2026-10-19-21-33' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (539 commits)
  mm: shmem: assign a lock class to the unused huge shrinklist
  mm: vmscan: put rotation-missed folios at the LRU tail
  mm: kmemleak: scan the struct page array in MAX_SCAN_SIZE batches
  mm: kmemleak: move the struct page scan into a helper
  mm/damon: document that a zero sample_interval is accepted
  mm/damon: fix typos in comments
  mm/damon/sysfs: propagate damon_call() error in turn_damon_on
  mm/damon/core: skip quota score setup when the quota is full
  mm/damon/tests/core-kunit: test the size charged for a filter-trimmed region
  mm/damon/core: charge only the part of a region the filter left
  mm: disallow raw PFN mappings of huge/shared zeropage
  selftests/mm: zap whole PTE tables in the khugepaged race harness
  selftests/mm: add memory-pressure threads to the khugepaged race harness
  selftests/mm: race the collapse of windows with holes
  selftests/mm: add khugepaged race harness
  selftests/mm: check that one khugepaged pass collapses one window
  selftests/mm: run every supported collapse order by default
  selftests/mm: cover a shared-source collapse write race
  selftests/mm: parameterize the mixed-source collapse case by source order
  selftests/mm: add order-parameterized khugepaged collapse cases
  ...
2026-10-23 07:42:11 -10:00
Linus Torvalds 734bef548a Merge tag 'net-next-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next
Pull networking updates from Paolo Abeni:
 "This includes a significant number of low-priority fixes - especially
  in the NIC drivers area - that we deferred from the last few RCs in
  the previous cycle, which can't be easily outlined in the synopsis
  below.

  Core & protocols:

   - Continue the work on removing rtnl_lock dependencies:
      - per-netns ARP and ND neighbour tables, with the default settings
        now configurable per netns (inheritance from init_net is
        controlled by the new net.core.neigh_inherit_init_net sysctl)
      - RCU-protected configuration and rtnl_lock-less fill_info() for
        hsr, netkit, sit, vlan and vxlan devices
      - per-netns device unregistration for ip tunnel and gre devices
      - use the netdev instance lock instead of rtnl_lock when reading
        speed and duplex via sysfs
      - batch the flushing of uncached routes at device unregistration
        time, relieving rtnl_lock contention on netns dismantle.

   - Add hardware pacing offload support, admin-controlled via a new
     rtnetlink attribute, with sch_fq integration (implemented in idpf).

   - Re-segment BIG TCP GSO packets into GSO packets fitting the egress
     device limits instead of plain MSS-sized segments, improving
     throughput for mixed BIG TCP / non-BIG TCP paths by up to 70%.

   - Generate RSS keys that spread flows over all the RX queues; the
     previous random keys could leave some queues unused.

   - Optimize the bridge VLAN forwarding paths: cache the port-VLAN in
     fdb entries and consider only VLAN members when flooding, for ~10%
     more Mpps in the fdb forwarding path.

   - A few TCP/IP performance improvements aimed at efficient cache
     usage and reducing contention.

   - Add the TCP ROCCET congestion control, a CUBIC variant aimed at
     avoiding bufferbloat in cellular networks.

   - Continue the conversion of getsockopt callbacks to sockopt_t.

   - Add an ethtool command to list the front-facing ports of an
     interface, including SFP cages and modules, using the phy_port
     representation.

   - Enable BIG TCP support for bareudp tunnels.

   - Remove the IPV6_ADDRFORM socket option and disallow buggy TCP state
     transitions (listen() + shutdown() + connect() and connect() +
     connect(AF_UNSPEC) + listen()).

   - Remove most BUG_ON()s from core packet processing, replacing them
     with error paths.

  Wireless:

   - Latency improvements, including lockless station get/dump and
     beacon updates, plus RTNL reduction and locking cleanups.

   - Infrastructure for non-station TX/RX with MLO.

   - NAN (Wi-Fi Aware) Instant Communication support and other NAN
     improvements.

   - Control frame Integrity Protocol (CIP) and protected TWT support.

   - Improvements for AP regulatory checks.

  Netfilter:

   - Disable br_netfilter in user namespaces and schedule it for removal
     in 2027.

   - Restrict the raw table in nft_compat to the specific family, hook
     and priority.

   - Prepare the flowtable for mixed IPv4-over-IPv6 tunneling (and vice
     versa).

   - Use GFP_KERNEL_ACCOUNT for most netfilter allocations, for better
     integration with memcg.

   - Allow discovering conntrack zone filtering support in ctnetlink
     dumps, and fix nfnetlink_hook handling of large dumps.

  Deletions:

   - Move the LLC type 2 sockets out of tree. There are no known users
     and the code attracts a never-ending stream of LLM-driven fixes.

  Device drivers:

   - New drivers:
      - Meta Platforms NIC (mpnic), the second-generation NIC from Meta
      - initial skeleton of the Nebula-matrix NICs driver (nbl)
      - X-Powers AC200/AC300 Fast Ethernet PHYs

   - Ethernet high-speed NICs:
      - Intel:
         - i40e: XDP metadata support for RX hash and VLAN tag
         - ice: expose the E825 TSPLL state via the DPLL subsystem
      - nVidia/Mellanox:
         - move the data direct infrastructure from IB to core, in
           preparation for netdev support.
         - reduce the memory used per offloaded TC rule
      - Meta (fbnic):
         - support large io_uring zero-copy RX buffers
      - Microsoft vNIC (mana):
         - add BQL support

   - Ethernet NICs consumer, and embedded:
      - Airoha:
         - LRO offload support
      - Cadence (macb):
         - context swapping for ringparam and MTU changes, avoiding
           buffer loss under memory pressure
      - Mucse (rnpgbe):
         - TX/RX and link status support
      - NXP (enetc):
         - SR-IOV improvements and VF support for ENETC v4
      - Qualcomm (ppe):
         - IPQ5424 support
      - Realtek PCI (r8169):
         - phylink support
         - RSS support for RTL8127
      - Renesas (ravb):
         - gPTP support for R-Car Gen4
      - Synopsys (stmmac):
         - XDP multi-buffer support on the TX side
         - tc mqprio hw queue priority offload
         - support for RK3568 SGMII, Allwinner H616 EMAC1, UltraRISC
           DP1000 and Qualcomm sa8255p

   - Ethernet switches:
      - Mediatek (mt7530):
         - fast age and change conduit support
      - Microchip (ksz):
         - support for KSZ8995XA/KS8995XA
      - Microchip (lan966x):
         - PCIe FDMA support, ~20x throughput increase in PCIe endpoint
      - Microchip (sparx5):
         - Time Aware Shaper (taprio) offload
      - Motorcomm (yt921x):
         - LED and SerDes PCS support
      - Realtek (rtl8365mb):
         - EEE support

   - Ethernet PHYs:
      - Broadcom:
         - enable jumbo frames on BCM54xx
      - Realtek:
         - support for RTL8261CE_CG and RTL8261D_VM
         - MDIO support for RTL838x and RTL839x

   - WiFi drivers:
      - Broadcom (brcmfmac):
         - FT/OKC roaming offload
      - Intel (iwlwifi):
         - UHR sniffer support
         - support for newer UEFI/BIOS tables
      - MediaTek (mt76):
         - mt7925 NAN improvements
         - offchannel/scan improvements and MLO fixes
      - Morse Micro (mm81x):
         - monitor mode support
      - Qualcomm (ath12k):
         - IPQ5332 platform infrastructure
      - Realtek (rtw88):
         - RTL8723BS support
         - SDIO TX performance improvements
      - Realtek (rtw89):
         - P2P_DEVICE support
         - BT-coex updates for RTL8922D

   - Bluetooth:
      - move H:4 reassembly into the Bluetooth core
      - add generic support for vendor packets
      - MGMT: add security level changed event

   - Bluetooth drivers:
      - btusb: support Bulk Serialization Mode
      - Intel: support Draco and Titan Lake, allow unsigned firmware
      - Mediatek: MT7928 support
      - Qualcomm: QCC2072 support
      - Broadcom: Synaptics 4384 support"

* tag 'net-next-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (2126 commits)
  Bluetooth: btusb: disable by default Qualcomm multi-subsystem
  tipc: fix broadcast sender hang on last acker departure
  tipc: fix use-after-free of broadcast reception link at node release
  r8169: clear TX LPI on RTL8168h at link up after phylink conversion
  tun: Require CAP_NET_ADMIN to attach to an ownerless device
  net/sched/sch_cake: drop dead nla_nest_end() error check
  net/sched/sch_cake: widen buffer_used to u64
  net/sched/sch_cake: reduce parent backlog when clearing a tin
  net/sched/sch_cake: serialize reconfiguration with the datapath
  tg3: Add Datto SIRIS 5 1U Server to restart AER quirk table
  net/mlx5e: Stop asserting for RTNL when closing channels
  net: shrink the payload-only part of skb dataref to one bit
  net: wwan: iosm: validate msg_head before indexing msg_ring
  net: bgmac: rate limit RX error messages
  selftests: net: veth: test XDP_TX to a peer with GRO enabled
  veth: schedule the peer's NAPI after XDP_TX when only GRO is enabled
  pppoe: delete session hash entries by pointer match
  net: lan969x: don't disable hardirqs in fdma tx clear
  net: sparx5/lan969x: do not clobber the PSFP cycle timer update period
  net: lan969x: fix DSM calendar for empty taxis
  ...
2026-10-22 15:58:00 -10:00
Linus Torvalds 864c07de0c Merge tag 'hardening-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
Pull hardening updates from Kees Cook:

 - Provide kmalloc_obj*-style API for devm_kmalloc()

 - Improve seq_buf API for saner C String handling with several bug
   fixes along the way (Kees Cook, Bill Wendling)

 - Overflow helper readability improvements (Bill Wendling)

 - Unexport native_write_cr4() (Dennis Chen)

 - um: fix CONFIG_GCOV for built-in code (Johannes Berg)

 - Improve stackinit test coverage (Justin Stitt)

 - KMSAN: fix memset() when using fortify-source, again (Arnd Bergmann)

 - lkdtm: use kmalloc() instead of __get_free_page (Mahad Ibrahim)

 - signalfd: don't dequeue the forced fatal signals (Oleg Nesterov)

 - Fix randstruct to recognize new container_of() behavior

 - coccinelle: kmalloc_obj: Convert multi-byte integral allocations too

 - Fix a couple remaining allocation return type mismatches

* tag 'hardening-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: (29 commits)
  overflow: Match arithmetic in both parts of __builtin_choose_expr
  lkdtm: Make UNSET_SMEP built-in-only and unexport native_write_cr4()
  extcon: realtek: Remove const from type_c_cfg allocation type
  coresight: cti: Add const to con_groups allocation type
  docs: core-api: Document the seq_buf API
  nvdimm: ndtest: Return the string length from flags_show()
  powerpc/papr_scm: Return the string length from the sysfs show functions
  seq_buf: Add seq_buf_init_append()
  bpf: Remove dead newline stripping from format_disasm_line()
  seq_buf: Add seq_buf_terminate()
  seq_buf: Add seq_buf_strlen()
  seq_buf: Clear what a writer did not claim when a seq_buf overflows
  seq_buf: Copy what fits when seq_buf_puts() and seq_buf_putmem() overflow
  scsi: lpfc: Print rx monitor records straight into the seq_buf
  seq_buf: Do not pop from an overflowed seq_buf
  seq_buf: Do not print an empty line from an overflowed seq_buf_do_printk()
  .get_maintainer.ignore: Add Kees Cook
  devres: Provide kmalloc_obj*-style API for devm_kmalloc
  mm: Move default_gfp() into gfp_types.h
  kunit/stackinit: Clean up XFAIL under instrumentation
  ...
2026-10-22 15:01:57 -10:00
Linus Torvalds bf23250845 Merge tag 'v7.4-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
Pull crypto updates from Herbert Xu:
 "API:
   - Fix algif_skcipher source SG overrun
   - Allow hmac(sha512) for non-root users

  Algorithms:
   - Add wrapper for zeroing AES key context
   - Avoid redundant stream initialisations in zstd

  Drivers:
   - Remove hisilicon/sec.
   - Handle digest-only authenc requests in atmel
   - Handle zero-length skcipher requests in mxs-dcp
   - Lower the default priority of caam/qi2

  Others:
   - Optimise key comparison in rhashtable lookup that uses constant
     parameters"

* tag 'v7.4-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (146 commits)
  crypto: atmel-tdes - consolidate error paths in atmel_tdes_dma_init()
  crypto: atmel-tdes - reuse fast in atmel_tdes_crypt_start()
  crypto: atmel-tdes - use separate DMA scatterlists
  MAINTAINERS: delete entry for John Allen
  hwrng: amd - use PMBASE_OFFSET consistently
  hwrng: cctrng - simplify cctrng_probe()
  hwrng: intel - simplify intel_rng_mod_init()
  crypto: qat - fix use of destroyed vf2pf_lock on VF restart
  crypto: qat - initialise state_lock on every path in adf_devmgr_add_dev()
  hwrng: imx-rngc - Use optional clock
  crypto: talitos - init tasklets before requesting IRQs
  crypto: algif_skcipher - rewind rounded output bytes
  crypto: algif_hash - Allow hmac(sha512) for unpriviledged users
  crypto: sa2ul - Remove unused fields
  hwrng: stm32 - use devm_platform_ioremap_resource() in stm32_rng_probe()
  hwrng: stm32 - drop redundant initializations
  hwrng: amd - simplify control flow in amd_rng_mod_init()
  hwrng: stm32 - reuse clock rate in stm32_rng_clock_freq_restrain()
  hwrng: stm32 - use swap() in stm32_rng_probe()
  hwrng: cctrng - drop redundant initializations
  ...
2026-10-22 09:36:46 -10:00
Linus Torvalds 2a08195e4d Merge tag 'linux_kselftest-kunit-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest
Pull kunit update from Shuah Khan:
 "A single fix to kunit_run_all_tests() to return void since callers
  don't check the return value and the integer return type is a remnant
  from when the function was executed as initcall which is no longer the
  case"

* tag 'linux_kselftest-kunit-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
  kunit: Return void from kunit_run_all_tests()
2026-10-22 08:23:28 -10:00
Linus Torvalds 7cd80b8168 Merge tag 'uml-for-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux
Pull UML updates from Johannes Berg:

 - NOMMU support, mostly for mm/ testing

   The only bigger change, we added support for building with
   !CONFIG_MMU, mostly for testing, e.g. via kunit. Some new
   selftests targetted to NOMMU are moving elsewhere, but are
   runnable on ARCH=um without MMU.

 - Tighter page permissions

   Tighten page permissions to catch more bugs (ARCH=um is,
   after all, often used for testing), and also mark __init
   memory inaccessible for the same reason.

 - Various maintenance/cleanups

   Fix build on really old hosts, fix leaks, make the code a
   bit more robust, header cleanups, typo fixes, the usual.

* tag 'uml-for-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux: (38 commits)
  um: place large BSS inputs in an output section
  um: fix shutdown __inittext access
  um: time-travel: fix sched_yield() behaviour
  um: require MMU for UML PCI support
  um: vector: avoid NULL queue dereference in legacy RX mode
  um: use %pB to print functions in stack traces
  um: mprotect() __init memory
  um: move init text between __init_begin/end
  um: improve checking for --no-warn-rwx-segments
  um: make stub compilation more robust
  um: link .lbss/.ldata/.lrodata correctly
  um: add perf-event support
  x86/um: remove unused <asm/required-features.h> header
  um: fix typo "hander" in comment
  um: Add definition of __NR_close_range for older host OSs
  um: virtio_uml: switch to dynamic root device
  um: Tighten exec permissions on page mappings
  Documentation: um: document nommu UML
  um: allow deselecting CONFIG_MMU
  um: nommu: add userspace runner processes
  ...
2026-10-22 08:12:31 -10:00
Linus Torvalds 2e51c645fe Merge tag 'soc-drivers-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
Pull SoC driver updates from Arnd Bergmann:
 "There are lots of minor updates for driver subsystems managed through
  the soc tree (turris-omnia platform, cache driver, tee drivers,
  arm-cci, bus, memory) as well as soc vendor specific drivers
  (starfive, xilinx, microchip, nxp, amlogic, imx, renesas, samsung, ti,
  nvidia).

  The more notable changes are:

   - Larger updates for Qualcomm SoCs including support for SM8950
     (Maili) SM8975 (Hawi), Glymur, Shikra, and IPQ5424

   - Added SoC support for Exynos5515, Tegra264, Tegra410, R8A774A3, and
     MT8167 in existing drivers

   - Arm SCMI firmware driver support for ACPI PCC transport and module
     autoloading of protocol specific drivers

   - Apple crash log support for CrgA embedded controller"

* tag 'soc-drivers-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (176 commits)
  platform: cznic: turris-omnia-mcu: stop button emulation producers
  cache: Make cpu_cache_invalidate_memregion() error out if there are no handlers
  soc: mpfs: use kref cleanup on probe failure
  arm64: enable HAVE_SHARED_GPIOS for all ARM64 platforms
  bus: arm-cci: Drop cci-control-port node reference in __cci_ace_get_port()
  bus: arm-cci: Drop CPU node reference in cci_ace_init_ports()
  soc: fsl: dpio: Free the IRQ before releasing the I/O object
  soc: fsl: dpio: Fix cleanup on IRQ registration failure
  bus: fsl-mc: Annotate fsl_mc_io.portal_virt_addr with __counted_by_ptr
  bus: fsl-mc: drop the fwnode links of the dpmacs nodes
  soc: fsl: cpm1: tsa: Fix clock leak in tsa_of_parse_tdms()
  soc: qcom: geni-se: Drop unused icc_ddr parameter from geni_icc_get()
  firmware: qcom: scm: Allow QSEECOM on ThinkPad T14s Gen 7
  dt-bindings: mailbox: qcom: Document Maili CPUCP mailbox controller
  dt-bindings: spmi: glymur-spmi-pmic-arb: Add compatible for Qualcomm Maili SoC
  soc: qcom: pmic_pdcharger_ulog: prevent work requeue during remove
  ASoC: dt-bindings: qcom,apr: Add modem_apps GLINK channel for shikra
  firmware: qcom: tzmem: disable SHM bridge for SM7125 platform
  soc: qcom: ubwc: Add Kalambo UBWC config
  firmware: qcom: scm: Allow QSEECOM on Kalambo CRD
  ...
2026-10-22 07:52:50 -10:00
Petr Mladek 046d687e58 Merge branch 'for-7.4' into for-linus 2026-10-22 10:21:06 +02:00
Linus Torvalds 7be4bc52fd Merge tag 'driver-core-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core
Pull driver core updates from Danilo Krummrich:
 "Core:

   - Add TAINT_FORCED_BIND to taint the kernel and driver module before
     manual sysfs bind/unbind operations; make add_taint_module()
     available to driver core and update taint decoding tools and
     documentation

   - Constify device_show/store_*() attribute parameters and adapt x86
     MCE and perf users to prepare for const dev_ext_attribute instances

   - Fix UAF in NUMA access node registration failure handling by
     dropping the device reference with put_device() instead of directly
     freeing the node

  debugfs:

   - Make debugfs_create_str() read-only to eliminate double-free races
     between concurrent writers; reject writable modes; convert
     interconnect and SoundWire users to local file operations with
     mutex-protected strings

  kobject:

   - Fix out-of-bounds access in kobject_action_type() when parsing
     action strings containing embedded NUL bytes

   - Fix the kobject_set_name() reference in kset_register() kernel-doc

  Rust:

   - DMA:

      - Tie Coherent, CoherentBox and CoherentHandle to the device's
        bound lifetime to prevent retaining DMA allocations beyond
        driver unbind; propagate the lifetime through nova-core and the
        DMA sample driver

   - I/O:

      - Require explicit base types for registers and replace relative
        registers with typed subregion projections; reimplement
        register!() as a proc macro, support registers using existing
        types without inline bitfields, and convert nova-core, Tyr and
        the PCI sample; add AsRepr/AsReprMut and transmute helpers with
        deferred size checks for representation conversions

      - Wrap ResourceSize in a transparent newtype with explicit
        conversions, including checked conversion to usize

   - PCI:

      - Add typed PCIe extended capability lookup and SR-IOV accessors
        for the First VF Offset and decoded VF BAR addresses and widths,
        keeping raw SR-IOV registers private to preserve PCI core
        ownership of their state

   - scatterlist:

      - Honor the device's maximum segment size as well as the DMA
        mapping limit when constructing SG tables

      - Return u32 from SGEntry::dma_len() to match the C segment length
        type

   - misc:

      - Validate auxiliary DeviceId name length explicitly to improve
        compile-time diagnostics for oversized device ID table entries

      - Drop unnecessary 'static bounds from debugfs ScopedDir file
        creation methods to support data containing non-'static
        references, including DMA buffers

  Misc:

   - Add Johan Hovold as driver core maintainer

   - Simplify platform_device_alloc() by returning early on allocation
     failure

   - Fix typos in driver core and kernfs comments"

* tag 'driver-core-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: (41 commits)
  rust: pci: add extended capability and SR-IOV support
  kobject: Fix the kobj_set_name reference in kset_register() kernel-doc
  rust: io: convert ResourceSize into a transparent newtype
  rust: scatterlist: return u32 from SGEntry::dma_len()
  MAINTAINERS: add myself as driver core maintainer
  debugfs: make debugfs_create_str() read-only
  soundwire: debugfs: replace writable string helper
  interconnect: debugfs: replace writable string helper
  docs: admin-guide: Handle TAINT_FORCED_BIND when parsing /proc/sys/kernel/tainted
  driver core: platform: Simplify platform_device_alloc()
  kobject: fix out-of-bounds access in kobject_action_type()
  rust: scatterlist: honor the device's maximum segment size
  driver core: add TAINT_FORCED_BIND for when userspace manually messes with devices and drivers
  module: fix up documentation for add_taint() and add_taint_module()
  module: pull out add_taint_module() to be public
  driver core: Constify the signature of device_show/store_*()
  drivers: perf: Use __DEVICE_ATTR() macro to initialize dev_ext_attribute
  x86/mce: Use __DEVICE_ATTR() macro to initialize dev_ext_attribute
  rust: auxiliary: validate DeviceId name length
  driver core: fix typos in comments
  ...
2026-10-21 18:53:14 -10:00
Linus Torvalds ccc4d9f891 Merge tag 'timers-vdso-2026-10-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull VDSO updates from Thomas Gleixner:
 "Updates for the VDSO subsystem:

   - Ensure that the CLOCK_AUX base calculations are properly scaled
     against the base timekeeper. The update function failed to take the
     fractional nanosecond part into account, which results in a
     rounding error.

   - Cleanup and consolidate the vsyscall headers to get rid of
     pointless copies all over the architectures.

   - Replace a runtime conditional in the time getter function for
     namespaced clocks by simple pointer arithmetic which speeds up the
     read function"

* tag 'timers-vdso-2026-10-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  vdso/vsyscall: Keep the CLOCK_AUX base scaled
  vdso/math64: Add and use __iter_div64_u64_rem()
  vdso/math64: Use OPTIMIZER_HIDE_VAR() in __iter_div_u64_rem()
  vdso/gettimeofday: Avoid runtime conditional in do_hres_timens()
  vdso: Remove __ASSEMBLER__ guards from vsyscall.h
  vdso: Add asm-generic/vdso/vsyscall.h
  vdso: Remove unnecessary vdso/vsyscall.h includes
  riscv/hwprobe: Include vdso/datapage.h
  arm64/vdso: Delete asm/vdso/vsyscall.h inclusions
  x86/vdso: Delete asm/vdso/vsyscall.h inclusions
  sparc/vdso: Delete asm/vdso/vsyscall.h inclusion
  s390/vdso: Delete asm/vdso/vsyscall.h inclusions
  sparc/vdso: Move __VDSO_PAGES to asm/vdso.h
  x86/vdso: Move vDSO page definitions to asm/vdso.h
  vdso: Delete asm-generic/vdso/vsyscall.h
  vdso/vsyscall: Define fallback time synchronization functions in vsyscall.c
  vdso/getrandom: Define fallback __arch_get_vdso_u_rng_data() in getrandom.c
  vdso/gettimeofday: Define fallback __arch_get_vdso_u_time_data() in gettimeofday.c
  vdso: Move the kernel-side time update helpers to a new header
2026-10-21 11:33:33 -10:00
Linus Torvalds a56a18c14a Merge tag 'csd-lock.2026.10.12a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu
Pull CSD lock updates from Paul McKenney:
 "Report CSD-lock stall recovery time:

   - Refactor to simplify csd_lock_wait_toolong() function prototype

   - Report time required to recover from a CSD-lock stall

   - Add a test of this reporting"

* tag 'csd-lock.2026.10.12a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu:
  lib/test_csd_lock: Add a module to stall a CPU on a CSD lock
  locking/csd-lock: Report how long a stuck CSD lock took to recover
  locking/csd-lock: Pack csd_lock_wait_toolong() state into a struct
2026-10-21 11:03:28 -10:00
Linus Torvalds 9ba46df344 Merge tag 'bitmap-for-v7.4-rc1' of https://github.com/norov/linux
Pull bitmap updates from Yury Norov:
 "This includes __MAKE_OP() macro removal from me with the follow-up
  from Mark, cleanups for bitmaps parser from Shashank and a couple Rust
  docs fixes from Georgios"

* tag 'bitmap-for-v7.4-rc1' of https://github.com/norov/linux:
  rust: bitmap: document panics in `next_bit` and `next_zero_bit`
  rust: id_pool: document panics in `find_unused_id` and `release_id`
  bitmap: test bitmap_parselist() with a group size close to UINT_MAX
  bitmap: bitmap_parselist(): don't wrap around on a huge group size
  bitmap: test bitmap_parselist() with text after the group size
  bitmap: bitmap_parselist(): reject trailing characters after group size
  bitmap: test bitmap_parse() with an illegal character before 8 hex digits
  bitmap: bitmap_parse(): reject non-hex character before 8 digits
  bitfield: Restore be16_replace_bits()
  bitfield: get rid of __MAKE_OP machinery
2026-10-21 09:49:47 -10:00
Linus Torvalds 95615dd9ff Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux
Pull crypto library updates from Eric Biggers:

 - Migrate the x86 and riscv optimized implementations of various AES
   modes (ECB, CBC, CBC-CTS, CTR, XCTR, XTS) into lib/crypto/.

   This makes the library APIs be properly accelerated on these
   architectures, while still accelerating crypto_skcipher as well.

   It removes a lot of redundant glue code, since the crypto API
   boilerplate no longer needs to be duplicated for these architectures.

   It also fixes the longstanding issue where optimizations for these
   AES modes were disabled by default on these architectures.

 - Optimize AES-XTS on SPARC64 using the SPARC crypto opcodes

 - Move the SipHash code into lib/crypto/

 - Update the ChaCha and Poly1305 functions to take size_t lengths,
   resolving issues where lengths over INT_MAX were mishandled

 - Make frame pointer unwinding work properly in some of the x86
   assembly functions, by following the standard %rbp convention

 - Add helper functions for zeroizing structs

 - Make a few documentation improvements

* tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: (49 commits)
  lib/crypto: md5: remove unused header
  lib/crypto: mips/chacha: Handle lengths of 2 GiB or more
  lib/crypto: arm/chacha: Handle lengths of 2 GiB or more in scalar code
  lib/crypto: chacha: Use size_t length
  lib/crypto: poly1305: Use size_t length
  lib/crypto: x86/sha512: Follow the normal %rbp convention
  lib/crypto: x86/sha256: Follow the normal %rbp convention
  lib/crypto: x86/sha1: Follow the normal %rbp convention
  lib/crypto: chacha20poly1305: zeroize state in __chacha20poly1305_decrypt
  lib/crypto: sparc/aes-xts: Add optimization using the AES opcodes
  lib: Move SipHash into lib/crypto/
  lib/crypto: x86/aes-ctr: Remove some unreachable code
  crypto: x86/aesni-intel - Add transitional selections
  crypto: aes - Boost priority of encryption modes further
  lib/crypto: x86/aes: Set RNDKEY in aes_cbc_encrypt_aesni()
  lib/crypto: riscv/aes-xts: Migrate optimized code into library
  lib/crypto: riscv/aes-ctr: Migrate optimized code into library
  lib/crypto: riscv/aes-cbc: Migrate optimized code into library
  lib/crypto: riscv/aes-ecb: Migrate optimized code into library
  lib/crypto: riscv/aes: Pass key struct to assembly code
  ...
2026-10-20 15:38:53 -10:00
Linus Torvalds 6303381334 Merge tag 'cmpxchg-emu.2026.10.12b' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu
Pull two-byte cmpxchg emulation from Paul McKenney:
 "These commits add a cmpxchg_emu_u16() function that emulates two-byte
  cmpxchg() in terms of four-byte cmpxchg() for architectures not having
  native instructions for this purpose. They also make use of this
  cmpxchg_emu_u16() function in those architectures, namely sh, arc,
  csky, and xtensa. This permits use of two-byte cmpxchg() in common
  code.

  However, it sadly does not permit easy implementation of all
  algorithms needing on two-byte atomic operations because there are
  some systems still supported by Linux that do not have native two-byte
  store instructions.

  There is reason to believe that these systems will soon no longer be
  supported by Linux [1]"

Link: https://lore.kernel.org/all/20260908152808.3928630-4-arnd@kernel.org/ [1]

* tag 'cmpxchg-emu.2026.10.12b' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu:
  xtensa: Emulate two-byte cmpxchg
  csky: Emulate two-byte cmpxchg
  ARC: Emulate two-byte cmpxchg
  sh: Emulate two-byte cmpxchg
  lib: Add two-byte cmpxchg emulation function
2026-10-20 14:53:33 -10:00
Linus Torvalds 776bb6df3f Merge tag 'locking-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull locking updates from Ingo Molnar:

 - In the refcount checking code, BUG() on UAF related errors if
   CONFIG_BUG_ON_DATA_CORRUPTION=y (Jann Horn)

 - Add {over,under}flow detection for local_interrupt_{enable,disable}()
   (Boqun Feng)

 - Add kunit test case for max local_interrupt_disable() nesting level
   (Boqun Feng)

 - Clarify comment (Boqun Feng)

* tag 'locking-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  irq: Add max local_interrupt_disable() nesting level kunit test case
  irq: Explain better on NMI_MASK overflow condition
  irq: Add {over,under}flow detection for local_interrupt_{enable,disable}
  refcount: Use CONFIG_BUG_ON_DATA_CORRUPTION for UAF-related errors
2026-10-20 12:43:05 -10:00
Linus Torvalds cb95904b47 Merge tag 'sched-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull scheduler updates from Ingo Molnar:
 "Kconfig updates:

   - Simplify PREEMPT_DYNAMIC (Mark Rutland)

  Fair scheduler updates:

   - Remove redundant RUN_TO_PARITY check (Elif Topuz)

   - Declare augmented callbacks per field, fix
     rb_add_augmented_cached() descent (Yiwei Lin, Peter Zijlstra)

   - Restart fair hrtick after same-task repicks (Shubhang Kaushik)

   - Improve the scheduling latency of short slice tasks (Vincent
     Guittot)

  Deadline/RT scheduler updates:

   - Check start_dl_timer expiry with ktime_before() (Liang Hao)

   - irq_work: CPU-hotplug improvements on PREEMPT_RT (Sebastian Andrzej
     Siewior)

  Energy-aware scheduling updates:

   - Implement the steal_governor, introduce preferred CPUs and
     steal-driven vCPU backoff (Shrikanth Hegde)

  Multi-processor load-balancing updates:

   - Enable preferred SMT siblings on NVIDIA Olympus (Andrea Righi)

   - Randomize equally shallow idle CPU picks (Christian Loehle)

   - Remove redundant core_sched_seq (Hui Su)

  Cache-aware scheduling updates:

   - Avoid publishing partial LLC utilization (Jemmy Wong)

  NUMA-balancing updates:

   - Reset NUMA fault locality after scan period update (Eric Kim)

  Proxy execution updates:

   - Ongoing work to implement sleeping owner handling for proxy
     execution (John Stultz, Vasily Gorbik)

   - Preparatory steps to make sched_ext compatible with proxy execution
     (Andrea Righi)

  Scheduler infrastructure updates & fixes:

   - Remove the RCU wait from PSI trigger destruction (Shakeel Butt)

   - Avoid modifying wait-entry on failed priority registration
     (Hui Su)

   - Use the new static key API for sched_feat (Hongyan Xia)

   - Convert paravirt_steal to new static key APIs (Hongyan Xia)

   - cputime: Don't account idle time twice after dyntick-idle
     (Stian Halseth)

  Scheduler debugging updates:

   - Set TIF_NEED_RESCHED before calling __trace_set_need_resched()
     (Sechang Lim)

   - Fix context analysis errors in non-preferred CPU push (Shrikanth
     Hegde)

  Misc cleanups and fixes by Christian Loehle, Shubhang Kaushik,
  Thomas Huth and Vladimir Zapolskiy"

* tag 'sched-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (64 commits)
  sched: Replace nr_iowait_cpu() with a bool accessor
  Revert "sched/fair: Remove dead code on enqueue_task_fair()"
  sched/cache: Avoid publishing partial LLC utilization
  sched/cputime: Don't account idle time twice after dyntick-idle
  sched/psi: Remove the RCU wait from trigger destruction
  sched/eevdf: Remove redundant RUN_TO_PARITY check
  sched/wait: Avoid modifying entry on failed priority registration
  rbtree_test: Use rb_add_augmented_cached() for the cached augmented test
  rbtree: Update augmented data on the way down in rb_add_augmented_cached()
  rbtree: Declare augmented callbacks per field with RB_AUG()
  rbtree_test: Use rb_add() and rb_add_cached() for the basic tests
  smpboot: Don't park the thread if work is pending
  irq_work: Flush lazy work CPU down on PREEMPT_RT
  irq_work: Update a comment regarding CPU hotplug invocation
  sched/topology: Add asymmetric SMT packing override
  sched/fair: Honor asymmetric SMT priority in idle selection
  sched: Set TIF_NEED_RESCHED before calling __trace_set_need_resched()
  sched/core: Fix context analysis errors in non-preferred CPU push
  virt/steal_governor: Enable the driver
  virt/steal_governor: Implement steal_governor policy loop
  ...
2026-10-20 12:35:35 -10:00
Linus Torvalds dd8845db6d Merge tag 'x86_fpu_for_v7.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 FPU state updates from Borislav Petkov:

 - Document and cleanup the signal frame handling with the goal to allow
   process migration between CPUs with different FPU capabilities but
   which use only a common set of FPU features, i.e., think
   checkpoint/restore (Andrei Vagin)

 - Consolidate how XSTATE features are checked by doing them once during
   boot with the intent of removing cpu_has_xfeatures(). Latter will
   happen in the next cycle (Eric Biggers)

 - Other cleanups

* tag 'x86_fpu_for_v7.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/fpu: Remove additional remnants of math emulation
  x86/fpu: Remove unnecessary checks for X86_FEATURE_FPU
  selftests/x86: Add tests for signal frame FPU portability
  x86/fpu: Pre-fault only required size of xstate buffer
  x86/fpu: Fix potential underflow in xstate_calculate_size()
  x86/fpu: Document reasoning of FX-only fallback
  x86/fpu: Extract restore_from_ia32_fxstate() and clean up fpu__restore_sig()
  x86/fpu: Clean up and rename variables in signal frame handling
  x86/fpu: Document signal frame layout and portability
  xor: Add AVX-512 optimized xor_gen()
  xor: Remove redundant X86_FEATURE_OSXSAVE check
  lib/crc: x86: Stop using cpu_has_xfeatures()
  lib/crypto: x86: Stop using cpu_has_xfeatures()
  crypto: x86 - Stop using cpu_has_xfeatures()
  um: Check for missing AVX and AVX-512 xstate bits
  x86/fpu: Check for missing AVX and AVX-512 xstate bits
2026-10-20 11:03:51 -10:00
Thomas Zimmermann a88cef9206 lib/fonts: Add font_glyph_cursor() helper
The new helper font_glyph_cursor() fills a glyph with a cursor pattern.
As with the font_glyph_rotate_*() helpers, the caller has to provide the
output memory.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
2026-10-19 13:56:01 +02:00
Nickolai Zeldovich 0007654a7b lib/buildid: reject file offsets that do not fit in pgoff_t
On a 32-bit kernel, parsing the build ID of a crafted ELF file can copy
far more than the intended bytes into a 64-byte on-stack buffer in
__build_id_parse(), corrupting the stack of whatever context fetches the
build ID.  This might be reachable without privilege: perf records a build ID
for PERF_RECORD_MMAP2 on the no-fault path when a process mmaps its own file
(build_id_parse_nofault() from perf_event_mmap()), and BPF build-id stack
maps do the same.

freader_get_folio() turns a 64-bit file offset into a page cache index
with file_off >> PAGE_SHIFT and passes it to filemap_get_folio().
pgoff_t is unsigned long, 32-bit on a 32-bit kernel, so an ELF64 e_phoff
of 2^44 + k * PAGE_SIZE truncates to index k.  filemap_get_folio()
returns the cached folio at index k, whose folio_pos() is far below the
requested file_off.  In freader_fetch() the folio does not contain
file_off, so the "crossing folio boundaries" path computes
part_sz = folio_off + folio_sz - file_off as a large u64 (file_off is
much larger), and the following memcpy() truncates it to size_t and
copies a page into the 64-byte buffer.  On a 64-bit kernel the index is
not truncated, the folio is not cached and the fetch returns -EFAULT, so
only 32-bit kernels are affected.

Reject a file offset that cannot be represented as a page cache index
before the lookup, so such a file fails the build ID parse cleanly as it
already does on 64-bit.

Reproduced on i386 under QEMU with CONFIG_STACKPROTECTOR_STRONG: mmapping
a crafted ELF (ELFCLASS64, e_phoff = 2^44) while a perf event with
attr.build_id is open panics with "stack-protector: Kernel stack is
corrupted in: __build_id_parse"; with this patch the parse returns
-EFAULT and the mmap completes cleanly.  Built for i386 with W=1, no new
warnings.

Fixes: de3ec364c3 ("lib/buildid: add single folio-based file reader abstraction")
Assisted-by: LLM
Cc: stable@vger.kernel.org
Signed-off-by: Nickolai Zeldovich <nickolai@csail.mit.edu>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
2026-10-18 12:40:10 -07:00
Arnd Bergmann 655e6054ac Merge tag 'cache-for-v7.4' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/drivers
standalone cache drivers for v7.4

Three low-priority bugfixes for issues in the hisi hha and sifive ccache
drivers as well as the core code.

Signed-off-by: Conor Dooley <conor.dooley@microchip.com>

* tag 'cache-for-v7.4' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux:
  cache: Make cpu_cache_invalidate_memregion() error out if there are no handlers
  cache: sifive_ccache: Remove redundant dev_err_probe()
  cache: hisi_soc_hha: use named initializers for acpi_device_id

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-10-16 18:44:27 +02:00
Mohamad Raizudeen 20ec6916d8 lib/crypto: md5: remove unused header
The `<linux/unaligned.h>` header is included but never actually used.
The code handles memory accesses using memcpy() instead of the unaligned
helpers.

Remove this unused header to avoid false dependencies.

Signed-off-by: Mohamad Raizudeen <raizudeen.kerneldev@gmail.com>
Link: https://patch.msgid.link/20261016023558.8797-1-raizudeen.kerneldev@gmail.com
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-10-16 00:28:55 -07:00
Vladimir Kukharenko ff2d72f2bf lib/crypto: mips/chacha: Handle lengths of 2 GiB or more
The MIPS ChaCha assembly, which is chacha_crypt_arch() itself, tests
the remaining length with signed branches, so for 2 GiB + 64 bytes or
more it takes the final partial block path too early and processes less
than requested.  It is only used on 32-bit kernels, where size_t is 32
bits, so declaring the length as size_t does not avoid this.  No
in-tree caller passes such lengths.

The partial block code also keeps the remaining length as a negative
value, so instead of changing the assembly, rename it to
chacha_crypt_mips() and add a C chacha_crypt_arch() that passes it at
most 1 GiB per call.

Tested in QEMU user mode: with a length of 0xfffff045 the assembly
processed about 4 KiB and advanced the block counter by 64; with the
same 1 GiB loop in C, a 1.25 GiB + 4101 byte buffer matches a C
reference.  An LLM review of this code found the bug.

Assisted-by: LLM
Signed-off-by: Vladimir Kukharenko <vladimir@genproof.com>
Link: https://patch.msgid.link/20261014-libcrypto-chacha-32bit-2gib-v1-2-e0719ca0be89@genproof.com
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-10-15 23:17:16 -07:00
Vladimir Kukharenko f92159895b lib/crypto: arm/chacha: Handle lengths of 2 GiB or more in scalar code
chacha_doarm() compares the remaining length with signed conditions
(blt, movle/movgt, bgt), and DIV_ROUND_UP(bytes, CHACHA_BLOCK_SIZE) in
chacha_crypt_arch() wraps above 0xffffffc0, so lengths of 2 GiB or
more are mishandled.  size_t is 32 bits on arm, so declaring the length
as size_t does not avoid this.  On a Cortex-A7, an in-place
chacha20_crypt() of 2 GiB + 4101 bytes changed only one byte.

Use unsigned conditions (blo, movls/movhi, bhi) and
DIV_ROUND_UP_POW2().

This affects the scalar code, which is used when NEON isn't usable and
always on Cortex-A5 and Cortex-A7.  No in-tree caller passes such
lengths.  Tested in QEMU on a Cortex-A7 with CONFIG_VMSPLIT_1G.  An LLM
review of this code found the bug.

Assisted-by: LLM
Signed-off-by: Vladimir Kukharenko <vladimir@genproof.com>
Link: https://patch.msgid.link/20261014-libcrypto-chacha-32bit-2gib-v1-1-e0719ca0be89@genproof.com
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-10-15 23:17:16 -07:00
Eric Biggers e42003dba6 lib/crypto: chacha: Use size_t length
Upgrade the ChaCha functions from 32-bit lengths to size_t.

'size_t' is the best practice for buffer lengths, and it's what the rest
of the crypto library uses.

Moreover, all the 64-bit ChaCha assembly functions actually already
treated the length as 64-bit, despite it being declared as 32-bit in C
on arm64, ppc64, and x86_64.  For arm64 and x86_64, this caused
unspecified behavior due to the high 32 bits of the corresponding
register having an unspecified value in those architectures' ABIs.
However, in practice these bits are always zero and no issue occurred.

(ppc64 was fine too, since there the ABI zero-extends 32-bit arguments.)

These issues date to the original introduction of the ChaCha code.
However, as noted above, they don't have any real-world impact
currently; so this is an API robustness improvement only.

Reported-by: Vladimir Kukharenko <vladimir@genproof.com>
Closes: https://lore.kernel.org/r/20261012-libcrypto-4gib-lengths-v1-0-ea566c129a2e@genproof.com
Tested-by: Vladimir Kukharenko <vladimir@genproof.com>
Link: https://patch.msgid.link/20261014152604.323310-3-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-10-15 23:16:46 -07:00
Eric Biggers 0b58c136c2 lib/crypto: poly1305: Use size_t length
Upgrade the Poly1305 functions from 32-bit lengths to size_t.

'size_t' is the best practice for buffer lengths, and it's what the rest
of the crypto library uses.

Moreover, all the 64-bit Poly1305 assembly functions actually already
treated the length as 64-bit, despite it being declared as 32-bit in C
on arm64, mips64, ppc64, and riscv64:

- On arm64, this caused unspecified behavior due to the high 32 bits
  having an unspecified value in that architecture's ABI.  However, in
  practice these bits are always zero and no issue occurred.  (ppc64 was
  fine too, since there the ABI zero-extends 32-bit arguments.)

- On mips64 and riscv64, this caused incorrect behavior on lengths above
  S32_MAX, due to the sign extension done by those architectures' ABIs.
  Note that no current callers pass lengths over S32_MAX.

Also, the expression 'desc->buflen + nbytes >= POLY1305_BLOCK_SIZE' in
poly1305_update() could overflow if nbytes was in [UINT_MAX - 14,
UINT_MAX].  Note that again, no current callers pass lengths this large.

These issues date to the original introduction of the Poly1305 code.
However, as noted above, they don't have any real-world impact
currently; so this is an API robustness improvement only.

Reported-by: Vladimir Kukharenko <vladimir@genproof.com>
Closes: https://lore.kernel.org/r/20261012-libcrypto-4gib-lengths-v1-0-ea566c129a2e@genproof.com
Tested-by: Vladimir Kukharenko <vladimir@genproof.com>
Link: https://patch.msgid.link/20261014152604.323310-2-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-10-15 23:09:15 -07:00
Jakub Kicinski f5e575a787 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Cross-merge networking fixes after downstream PR (net-7.3-rc8).

No conflicts. Adjacent changes:

drivers/net/ethernet/microchip/lan865x/lan865x.c
  2a3f6d2a9a ("microchip: lan865x: move setting of netops to fix crash")
  15358c2c3d ("net: ethernet: oa_tc6: return ERR_PTR from oa_tc6_init()")

Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-15 09:24:47 -07:00
Thomas Weißschuh 5062889371 vdso/gettimeofday: Avoid runtime conditional in do_hres_timens()
Currently the derivation of the non-namespaced clock from its namespaced
sibling uses a runtime conditional. This conditional mirrors the
VDSO_RAW check in __cvdso_clock_gettime_common(), in a non-obvious way.

Replace the runtime conditional with unconditional pointer arithmetic,
which removes the duplication of logic and also is smaller and faster.
Also get rid of the weird double use of the 'vc' variable, pointing both
to the array of clocks and later to one specific one.

This saves 31 bytes of .text on x86_64.

Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260921-vdso-timens-conditional-v1-1-eac173f8bd92@weissschuh.net
2026-10-15 17:33:20 +02:00
Thomas Weißschuh d6df494a01 vdso: Remove unnecessary vdso/vsyscall.h includes
None of these files uses anything from the header.

Remove the inclusion.

Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260909-vdso-asm-generic-vsyscall-h-v1-13-63ae856cc659@linutronix.de
2026-10-15 17:33:20 +02:00
Thomas Weißschuh ca0da001d3 vdso/getrandom: Define fallback __arch_get_vdso_u_rng_data() in getrandom.c
__arch_get_vdso_u_rng_data() is only used in getrandom.c. vsyscall.h
has become a dumping ground for different kinds of fallbacks.

Move the fallback function definition into getrandom.c,
similar to other fallbacks.

Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260909-vdso-asm-generic-vsyscall-h-v1-3-63ae856cc659@linutronix.de
2026-10-15 17:33:19 +02:00
Thomas Weißschuh 4fba7bb3e7 vdso/gettimeofday: Define fallback __arch_get_vdso_u_time_data() in gettimeofday.c
__arch_get_vdso_u_time_data() is only used in gettimeofday.c. vsyscall.h
has become a dumping ground for different kinds of fallbacks.

Move the fallback function definition into gettimeofday.c,
similar to other fallbacks.

Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260909-vdso-asm-generic-vsyscall-h-v1-2-63ae856cc659@linutronix.de
2026-10-15 17:33:19 +02:00
Daniel Borkmann 4532e525b2 selftests/bpf: Remove the old test_bpf module
The instruction tests of the test_bpf module live in the BPF selftests
now, as the jit_insns test of test_progs, which BPF CI runs on every
architecture it covers, and its skb_segment tests have a KUnit successor
in net/core/net_test.c.

Remove the module together with its Kconfig entry, the test_kmod.sh and
test_bpf.sh wrappers of the bpf and net selftests, the config fragments
and defconfigs that enabled it, as well as all other references to it and
symbol exports in core kernel.

For archs wanting to support BPF JITs, it's time they move over to the BPF
selftests for proper coverage.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20261013171230.523677-19-daniel@iogearbox.net
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-10-15 02:40:13 +02:00
Linus Torvalds 0fcb05b723 Merge tag 'libcrypto-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux
Pull crypto library fixes from Eric Biggers:
 "Fix two Poly1305 bugs including a lost carry bit, and add a regression
  test"

* tag 'libcrypto-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux:
  lib/crypto: tests: Add Poly1305 split-update carry regression test
  lib/crypto: arm64: Fix lost Poly1305 carry when resuming NEON state
  lib/crypto: poly1305: Use memzero_explicit() in poly1305_final()
2026-10-14 08:23:37 -07:00
Andy Shevchenko a75d9cc33d lib/vsprintf: Use EXPORT_SYMBOL_IF_KUNIT() to export symbols
Replace EXPORT_SYMBOL_FOR_MODULES() with EXPORT_SYMBOL_IF_KUNIT()
to mark the symbols as visible only if CONFIG_KUNIT is enabled.

Kunit test should import the namespace EXPORTED_FOR_KUNIT_TESTING to
use these marked symbols. This is the standard way for all KUnit
tests.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Acked-by: Tamir Duberstein <tamird@kernel.org>
Link: https://patch.msgid.link/20260714122143.743227-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Petr Mladek <pmladek@suse.com>
2026-10-14 11:12:16 +02:00
Bence Csokas b2f3a170ae cache: Make cpu_cache_invalidate_memregion() error out if there are no handlers
Currently, if there are no registered handlers,
cpu_cache_invalidate_memregion() returns 0. Callers are expected to check
cpu_cache_has_invalidate_memregion() and return -ENXIO themselves, instead
of calling this function. If a caller forgets to do this, they may
erroneously think the operation succeeded. This is in contrast to x86,
where cpu_cache_invalidate_memregion() itself checks if the operation is
supported, and returns -ENXIO if it is not.

Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
Signed-off-by: Bence Csokas <bence.csokas@arm.com>
Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
2026-10-13 15:43:48 +01:00
Eric Biggers 40f47fa10a lib/crypto: x86/sha512: Follow the normal %rbp convention
The SHA-512 assembly functions push callee-save GPRs to the stack
*before* they set up the frame pointer (%rbp).  (They are leaf
functions, but they need to set up a frame pointer anyway because they
allocate a 32-byte-aligned buffer on the stack.)

As a result, during these functions, 8(%rbp) doesn't contain a return
address like it is supposed to.

This differs from the convention used by C code, and it interferes with
the frame pointer unwinder (CONFIG_UNWINDER_FRAME_POINTER=y).
Specifically, if a call trace is dumped in these functions, then all
entries are populated purely from the fallback scan of the entire stack:

    RIP: 0010:sha512_transform_rorx+0x673/0xdf0
    [...]
    Call Trace:
     <TASK>
     ? sha512_blocks_avx2+0x37/0x60
     ? __sha512_update+0x80/0x230
     ? sha512+0x31/0x190
     ? sha512+0x114/0x190
     [...]
     ? do_syscall_64+0x6f/0x3e0

With this fix to follow the normal %rbp convention, the call trace is
generated reliably:

    RIP: 0010:sha512_transform_rorx+0x90c/0xdf0
    [...]
    Call Trace:
     <TASK>
     sha512_blocks_avx2+0x37/0x60
     __sha512_update+0x80/0x230
     sha512+0x114/0x190
     [...]
     do_syscall_64+0x6f/0x3e0

Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://patch.msgid.link/20261011134843.166585-4-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-10-13 15:41:39 +02:00
Eric Biggers cc76c9b82b lib/crypto: x86/sha256: Follow the normal %rbp convention
Some of the SHA-256 assembly functions push callee-save GPRs to the
stack *before* they set up the frame pointer (%rbp).  (They are leaf
functions, but they need to set up a frame pointer anyway because they
allocate a 16- or 32-byte-aligned buffer on the stack.)

As a result, during these functions, 8(%rbp) doesn't contain a return
address like it is supposed to.

This differs from the convention used by C code, and it interferes with
the frame pointer unwinder (CONFIG_UNWINDER_FRAME_POINTER=y).
Specifically, if a call trace is dumped in these functions, then all
entries are populated purely from the fallback scan of the entire stack:

    RIP: 0010:sha256_transform_rorx+0xd78/0x1120
    [...]
    Call Trace:
     <TASK>
     ? sha256_blocks_avx2+0x37/0x70
     ? __sha256_update+0x77/0x220
     ? sha256+0x9d/0x110
     [...]
     ? do_syscall_64+0x6f/0x3e0

With this fix to follow the normal %rbp convention, the call trace is
generated reliably:

    RIP: 0010:sha256_transform_rorx+0xdae/0x1120
    [...]
    Call Trace:
     <TASK>
     sha256_blocks_avx2+0x37/0x70
     __sha256_update+0x77/0x220
     sha256+0x9d/0x110
     [...]
     do_syscall_64+0x6f/0x3e0

Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://patch.msgid.link/20261011134843.166585-3-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-10-13 15:41:39 +02:00
Eric Biggers 0b173877fb lib/crypto: x86/sha1: Follow the normal %rbp convention
Some of the SHA-1 assembly functions push callee-save GPRs to the stack
*before* they set up the frame pointer (%rbp).  (They are leaf
functions, but they need to set up a frame pointer anyway because they
allocate a 16- or 32-byte-aligned buffer on the stack.)

As a result, during these functions, 8(%rbp) doesn't contain a return
address like it is supposed to.

This differs from the convention used by C code, and it interferes with
the frame pointer unwinder (CONFIG_UNWINDER_FRAME_POINTER=y).
Specifically, if a call trace is dumped in these functions, then all
entries are populated purely from the fallback scan of the entire stack:

    RIP: 0010:sha1_transform_avx2+0x1921/0x1ea0
    [...]
    Call Trace:
     <TASK>
     ? sha1_transform_avx+0x2a9/0xc90
     ? sha1_blocks_avx2+0x78/0x140
     ? kernel_fpu_end+0x2d/0x40
     ? sha1_blocks_avx2+0x52/0x140
     ? sha1_update+0x77/0x220
     [...]
     ? do_syscall_64+0x6f/0x3e0

With this fix to follow the normal %rbp convention, the call trace is
generated reliably:

    RIP: 0010:sha1_transform_avx2+0x66e/0x1ea0
    [...]
    Call Trace:
     <TASK>
     sha1_blocks_avx2+0x78/0x140
     sha1_update+0x77/0x220
     [...]
     do_syscall_64+0x6f/0x3e0

Reviewed-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://patch.msgid.link/20261011134843.166585-2-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-10-13 15:41:38 +02:00
Yiwei Lin cc459ecd93 rbtree_test: Use rb_add_augmented_cached() for the cached augmented test
insert_augmented_cached() open-codes the descent that the generic
rb_add_augmented_cached() helper provides.  Use the helper instead,
so that rbtree_test covers it: it is what sched/eevdf relies on and
nothing in lib/ exercises it today.

Signed-off-by: Yiwei Lin <s921975628@gmail.com>
Assisted-by: LLM
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20261005093236.62702-5-s921975628@gmail.com
2026-10-13 13:51:28 +02:00
Yiwei Lin 9fc91ae685 rbtree_test: Use rb_add() and rb_add_cached() for the basic tests
insert() and insert_cached() open-code exactly what the generic
rb_add() and rb_add_cached() helpers do.  Use the helpers instead.

Besides removing duplicated code, this makes rbtree_test cover the
helpers themselves, which is what most in-tree rbtree users call
nowadays.

Signed-off-by: Yiwei Lin <s921975628@gmail.com>
Assisted-by: LLM
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20261005093236.62702-2-s921975628@gmail.com
2026-10-13 13:51:27 +02:00
Peter Zijlstra 840e23085b Merge branch 'tip/sched/urgent'
Pickup dependencies; notably the RB-tree fix.

Signed-off-by: Peter Zijlstra <peterz@infradead.org>
2026-10-13 13:51:24 +02:00
Dan Carpenter b599253012 mm/hmm/test: reject overflowing page counts
The number of pages comes directly from userspace.  Shifting a value
larger than ULONG_MAX >> PAGE_SHIFT discards its high bits before the
existing end-address check.  A request for a huge number of pages can
therefore be accepted and processed as a much smaller request.

Reject page counts that cannot be represented as a byte size before
performing the shift.

So far as ChatGPT and I can tell this doesn't cause an issue in practice
but preventing this integer overflow is the correct thing to do.

Link: https://lore.kernel.org/6f0d39089e938d4f53dc72632eb84aca34de7015.1789457465.git.error27@gmail.com
Fixes: b2ef9f5a5c ("mm/hmm/test: add selftest driver for HMM")
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Alistair Popple <apopple@nvidia.com>
Assisted-by: ChatGPT:gpt-5
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Jerome Glisse <jglisse@redhat.com>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Ralph Campbell <rcampbell@nvidia.com>
Cc: Wei Yongjun <weiyongjun1@huawei.com>
2026-10-12 21:26:13 -07:00
Kees Cook e3f8dfafd7 docs: core-api: Document the seq_buf API
The kernel-doc in include/linux/seq_buf.h and lib/seq_buf.c documents
the seq_buf interface, but no .rst file pulls either of them in, so none
of it reaches the generated documentation.

Add the missing kernel-doc for seq_buf_clear() and seq_buf_init(), and a
Sequence Buffers section to the kernel API documentation. The static
internal helper seq_buf_can_fit() is left out. Additionally fix
seq_buf_hex_dump() indentation to avoid the reported Sphinx error:

  ERROR: Unexpected indentation.
  WARNING: Block quote ends without a blank line; unexpected unindent.

Verified with "make SPHINXDIRS=core-api htmldocs", which rendered
happily into core-api/kernel-api.html.

Assisted-by: LLM
Co-developed-by: Bill Wendling <morbo@google.com>
Signed-off-by: Bill Wendling <morbo@google.com>
Tested-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Randy Dunlap <rdunlap@infradead.org>
Link: https://patch.msgid.link/20261005155708.1471260-12-kees@kernel.org
Signed-off-by: Kees Cook <kees@kernel.org>
2026-10-11 21:57:30 -07:00
Bill Wendling 61ef3f1490 seq_buf: Add seq_buf_init_append()
Several strlcat() call sites being converted to seq_buf need behavior
seq_buf doesn't currently provide. The normal seq_buf_init() always
empties the buffer (sets its "len" to 0) via seq_buf_clear(). Code
migrating from strlcat(buf, ...), which appends to whatever buf already
contains, can't use seq_buf_init() without discarding that existing
content. Add seq_buf_init_append(), which preserves the existing
contents and positions the seq_buf to append after it. A buffer with
no NUL within its size starts out overflowed, as strlcat() treats it
as already truncated. Add KUnit tests for behavior coverage.

Tests passed under qemu on ARCH=x86_64 with GCC 16.2.0 and CONFIG_KASAN=y,
and on big-endian ARCH=s390 with GCC s390x-linux-gnu 16.2.0.

Assisted-by: LLM
Signed-off-by: Bill Wendling <morbo@google.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Co-developed-by: Kees Cook <kees@kernel.org>
Link: https://patch.msgid.link/20261005155708.1471260-9-kees@kernel.org
Signed-off-by: Kees Cook <kees@kernel.org>
2026-10-11 21:57:30 -07:00