Commit Graph
1426000 Commits
Author SHA1 Message Date
Jens Axboe 0ed2e8bf61 io_uring: correct comment for IORING_SETUP_TASKRUN_FLAG
Sync with a recent liburing fix, which corrects the comment explaining
when the IORING_SETUP_TASKRUN_FLAG setup flag is valid to use. May be
use with COOP_TASKRUN or DEFER_TASKRUN, not useful without either of
this task_work mechanisms being used.

Link: https://github.com/axboe/liburing/pull/1543
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-28 04:56:20 -07:00
Jakub Kicinski 3d17d76d1f io_uring/zcrx: don't set rx_page_size when not requested
The rx_buf_len parameter was recently added to the Rx zero-copy
implementation. The expectation is that when not set system will
maintain previous behavior and use the default buffer size (PAGE_SIZE).

This works correctly at the iouring level, but we don't preserve
the same "zero means default" semantics when registering the memory
provider on the netdev. mp_param.rx_page_size is unconditionally
set to PAGE_SIZE. This causes __net_mp_open_rxq() to check for
QCFG_RX_PAGE_SIZE support in the driver, and return -EOPNOTSUPP
for drivers that don't advertise it -- even though the user never
asked for large buffers.

Only set mp_param.rx_page_size when rx_buf_len was explicitly provided,
so that the default page size path works on all zcrx-capable drivers.
mlx5 and fbnic only support 4kB pages in the current release.

Fixes: 795663b4d1 ("io_uring/zcrx: implement large rx buffer support")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-27 12:32:49 -07:00
Pavel Begunkov 85f6c439a6 io_uring/timeout: READ_ONCE sqe->addr
We should use READ_ONCE when reading from a SQE, make sure timeout gets
a stable timespec address.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-25 08:36:05 -07:00
Jens Axboe a46435537a io_uring/cmd_net: use READ_ONCE() for ->addr3 read
Any SQE read should use READ_ONCE(), to ensure the result is read once
and only once. Doesn't really matter for this case, but it's better to
keep these 100% consistent and always use READ_ONCE() for the prep side
of SQE handling.

Fixes: 5d24321e4c ("io_uring: Introduce getsockname io_uring cmd")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-24 11:38:34 -07:00
Govindarajulu Varadarajan ea129e55c9 io_uring: Add size check for sqe->cmd
For SQE128, sqe->cmd provides 80 bytes for uring_cmd. Add macro to
check if size of user struct does not exceed 80 bytes at compile time.
User doesn't have to track this manually during development.

Replace io_uring_sqe_cmd() inline func with macro and add
io_uring_sqe128_cmd() which checks struct
size for 16 bytes cmd and 80 bytes cmd respectively.

Signed-off-by: Govindarajulu Varadarajan <govind.varadar@gmail.com>
Reviewed-by: Caleb Sander Mateos <csander@purestorage.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-19 07:26:26 -07:00
Caleb Sander Mateos 42a6bd57ee io_uring: add IORING_OP_URING_CMD128 to opcode checks
io_should_commit(), io_uring_classic_poll(), and io_do_iopoll() compare
struct io_kiocb's opcode against IORING_OP_URING_CMD to implement
special treatment for uring_cmds. The recently added opcode
IORING_OP_URING_CMD128 is meant to be equivalent to IORING_OP_URING_CMD,
so treat it the same way in these functions.

Fixes: 1cba30bf9f ("io_uring: add support for IORING_SETUP_SQE_MIXED")
Signed-off-by: Caleb Sander Mateos <csander@purestorage.com>
Reviewed-by: Anuj Gupta <anuj20.g@samsung.com>
Reviewed-by: Kanchan Joshi <joshi.k@samsung.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-19 07:25:39 -07:00
Kai Aizen 003049b1c4 io_uring/zcrx: fix user_ref race between scrub and refill paths
The io_zcrx_put_niov_uref() function uses a non-atomic
check-then-decrement pattern (atomic_read followed by separate
atomic_dec) to manipulate user_refs. This is serialized against other
callers by rq_lock, but io_zcrx_scrub() modifies the same counter with
atomic_xchg() WITHOUT holding rq_lock.

On SMP systems, the following race exists:

  CPU0 (refill, holds rq_lock)          CPU1 (scrub, no rq_lock)
  put_niov_uref:
    atomic_read(uref) - 1
    // window opens
                                        atomic_xchg(uref, 0) - 1
                                        return_niov_freelist(niov) [PUSH #1]
    // window closes
    atomic_dec(uref) - wraps to -1
    returns true
    return_niov(niov)
    return_niov_freelist(niov)           [PUSH #2: DOUBLE-FREE]

The same niov is pushed to the freelist twice, causing free_count to
exceed nr_iovs. Subsequent freelist pushes then perform an out-of-bounds
write (a u32 value) past the kvmalloc'd freelist array into the adjacent
slab object.

Fix this by replacing the non-atomic read-then-dec in
io_zcrx_put_niov_uref() with an atomic_try_cmpxchg loop that atomically
tests and decrements user_refs. This makes the operation safe against
concurrent atomic_xchg from scrub without requiring scrub to acquire
rq_lock.

Fixes: 34a3e60821 ("io_uring/zcrx: implement zerocopy receive pp memory provider")
Cc: stable@vger.kernel.org
Signed-off-by: Kai Aizen <kai@snailsploit.com>
[pavel: removed a warning and a comment]
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-18 10:39:48 -07:00
Linus Torvalds 2961f841b0 Merge tag 'turbostat-2026.02.14' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux
Pull turbostat updates from Len Brown:

 - Add L2 statistics columns for recent Intel processors:
	L2MRPS = L2 Cache M-References Per Second
	L2%hit = L2 Cache Hit %

 - Sort work and output by cpu# rather than core#

 - Minor features and fixes

* tag 'turbostat-2026.02.14' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux: (23 commits)
  tools/power turbostat: version 2026.02.14
  tools/power turbostat: Fix and document --header_iterations
  tools/power turbostat: Use strtoul() for iteration parsing
  tools/power turbostat: Favor cpu# over core#
  tools/power turbostat: Expunge logical_cpu_id
  tools/power turbostat: Enhance HT enumeration
  tools/power turbostat: Simplify global core_id calculation
  tools/power turbostat: Unify even/odd/average counter referencing
  tools/power turbostat: Allocate average counters dynamically
  tools/power turbostat: Delete core_data.core_id
  tools/power turbostat: Rename physical_core_id to core_id
  tools/power turbostat: Cleanup package_id
  tools/power turbostat: Cleanup internal use of "base_cpu"
  tools/power turbostat: Add L2 cache statistics
  tools/power turbostat: Remove redundant newlines from err(3) strings
  tools/power turbostat: Allow more use of is_hybrid flag
  tools/power turbostat: Rename "LLCkRPS" column to "LLCMRPS"
  tools/power turbostat.8: Document the "--force" option
  tools/power turbostat: Harden against unexpected values
  tools/power turbostat: Dump hypervisor name
  ...
2026-02-17 15:51:14 -08:00
Linus Torvalds 75a452d31b Merge tag 'ntfs3_for_7.0' of https://github.com/Paragon-Software-Group/linux-ntfs3
Pull ntfs3 updates from Konstantin Komarov:
 "New code:
   - improve readahead for bitmap initialization and large directory scans
   - fsync files by syncing parent inodes
   - drop of preallocated clusters for sparse and compressed files
   - zero-fill folios beyond i_valid in ntfs_read_folio()
   - implement llseek SEEK_DATA/SEEK_HOLE by scanning data runs
   - implement iomap-based file operations
   - allow explicit boolean acl/prealloc mount options
   - fall-through between switch labels
   - delayed-allocation (delalloc) support

  Fixes:
   - check return value of indx_find to avoid infinite loop
   - initialize new folios before use
   - infinite loop in attr_load_runs_range on inconsistent metadata
   - infinite loop triggered by zero-sized ATTR_LIST
   - ntfs_mount_options leak in ntfs_fill_super()
   - deadlock in ni_read_folio_cmpr
   - circular locking dependency in run_unpack_ex
   - prevent infinite loops caused by the next valid being the same
   - restore NULL folio initialization in ntfs_writepages()
   - slab-out-of-bounds read in DeleteIndexEntryRoot

  Updates:
   - allow readdir() to finish after directory mutations without rewinddir()
   - handle attr_set_size() errors when truncating files
   - make ntfs_writeback_ops static
   - refactor duplicate kmemdup pattern in do_action()
   - avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra()

  Replaced:
   - use wait_on_buffer() directly
   - rename ni_readpage_cmpr into ni_read_folio_cmpr"

* tag 'ntfs3_for_7.0' of https://github.com/Paragon-Software-Group/linux-ntfs3: (26 commits)
  fs/ntfs3: add delayed-allocation (delalloc) support
  fs/ntfs3: avoid calling run_get_entry() when run == NULL in ntfs_read_run_nb_ra()
  fs/ntfs3: add fall-through between switch labels
  fs/ntfs3: allow explicit boolean acl/prealloc mount options
  fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot
  ntfs3: Restore NULL folio initialization in ntfs_writepages()
  ntfs3: Refactor duplicate kmemdup pattern in do_action()
  fs/ntfs3: prevent infinite loops caused by the next valid being the same
  fs/ntfs3: make ntfs_writeback_ops static
  ntfs3: fix circular locking dependency in run_unpack_ex
  fs/ntfs3: implement iomap-based file operations
  fs/ntfs3: fix deadlock in ni_read_folio_cmpr
  fs/ntfs3: implement llseek SEEK_DATA/SEEK_HOLE by scanning data runs
  fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio()
  fs/ntfs3: handle attr_set_size() errors when truncating files
  fs/ntfs3: drop preallocated clusters for sparse and compressed files
  fs/ntfs3: fsync files by syncing parent inodes
  fs/ntfs3: fix ntfs_mount_options leak in ntfs_fill_super()
  fs/ntfs3: allow readdir() to finish after directory mutations without rewinddir()
  fs/ntfs3: improve readahead for bitmap initialization and large directory scans
  ...
2026-02-17 15:37:06 -08:00
Linus Torvalds 87a367f1bf Merge tag 'ceph-for-7.0-rc1' of https://github.com/ceph/ceph-client
Pull ceph updates from Ilya Dryomov:
 "This adds support for the upcoming aes256k key type in CephX that is
  based on Kerberos 5 and brings a bunch of assorted CephFS fixes from
  Ethan and Sam. One of Sam's patches in particular undoes a change in
  the fscrypt area that had an inadvertent side effect of making CephFS
  behave as if mounted with wsize=4096 and leading to the corresponding
  degradation in performance, especially for sequential writes"

* tag 'ceph-for-7.0-rc1' of https://github.com/ceph/ceph-client:
  ceph: assert loop invariants in ceph_writepages_start()
  ceph: remove error return from ceph_process_folio_batch()
  ceph: fix write storm on fscrypted files
  ceph: do not propagate page array emplacement errors as batch errors
  ceph: supply snapshot context in ceph_uninline_data()
  ceph: supply snapshot context in ceph_zero_partial_object()
  libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing
  libceph: add support for CEPH_CRYPTO_AES256KRB5
  libceph: introduce ceph_crypto_key_prepare()
  libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen()
  libceph: define and enforce CEPH_MAX_KEY_LEN
2026-02-17 15:18:51 -08:00
Linus Torvalds 0ba83f0968 Merge tag 'ovl-update-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs
Pull overlayfs update from Amir Goldstein:
 "Relax the semantics of uuid=off to cater to a use case of overlayfs
  lower layers on btrfs clones, whose UUID are ephemeral and an upper
  layer on a different filesystem"

* tag 'ovl-update-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs:
  ovl: relax requirement for uuid=off,index=on
2026-02-17 15:08:24 -08:00
Linus Torvalds 1d22968feb Merge tag 'v7.0-rc-part2-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6
Pull smb client fixes from Steve French:

 - Fix three potential double free vulnerabilities

 - Fix data corruption due to racy lease checks

 - Enforce SMB1 signing verification checks

 - Fix invalid mount option parsing

 - Remove unneeded tracepoint

 - Various minor error code corrections

 - Minor cleanup

* tag 'v7.0-rc-part2-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
  smb: client: terminate session upon failed client required signing
  cifs: some missing initializations on replay
  cifs: remove unnecessary tracing after put tcon
  cifs: update internal module version number
  smb: client: fix data corruption due to racy lease checks
  smb/client: move NT_STATUS_MORE_ENTRIES
  smb/client: rename to NT_ERROR_INVALID_DATATYPE
  smb/client: rename to NT_STATUS_SOME_NOT_MAPPED
  smb/client: map NT_STATUS_PRIVILEGE_NOT_HELD
  smb/client: map NT_STATUS_MORE_PROCESSING_REQUIRED
  smb/client: map NT_STATUS_BUFFER_OVERFLOW
  smb/client: map NT_STATUS_NOTIFY_ENUM_DIR
  cifs: SMB1 split: Remove duplicate include of cifs_debug.h
  smb: client: fix regression with mount options parsing
2026-02-17 15:02:49 -08:00
Linus Torvalds e81dd54f62 Merge tag 'dmaengine-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine
Pull dmaengine updates from Vinod Koul:
 "Core:
   - Add Frank Li as susbstem reviewer to help with reviews

  New Support:
   - Mediatek support for Dimensity 6300 and 9200 controller
   - Qualcomm Kaanapali and Glymur GPI DMA engine
   - Synopsis DW AXI Agilex5
   - Renesas RZ/V2N SoC
   - Atmel microchip lan9691-dma
   - Tegra ADMA tegra264

  Updates:
   - sg_nents_for_dma() helper use in subsystem
   - pm_runtime_mark_last_busy() redundant call update for subsystem
   - Residue support for xilinx AXIDMA driver
   - Intel Max SGL Size Support and capabilities for DSA3.0
   - AXI dma larger than 32bits address support"

* tag 'dmaengine-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (64 commits)
  dmaengine: add Frank Li as reviewer
  dt-bindings: dma: qcom,gpi: Update max interrupts lines to 16
  dmaengine: fsl-edma: don't explicitly disable clocks in .remove()
  dmaengine: xilinx: xdma: use sg_nents_for_dma() helper
  dmaengine: sh: use sg_nents_for_dma() helper
  dmaengine: sa11x0: use sg_nents_for_dma() helper
  dmaengine: qcom: bam_dma: use sg_nents_for_dma() helper
  dmaengine: qcom: adm: use sg_nents_for_dma() helper
  dmaengine: pxa-dma: use sg_nents_for_dma() helper
  dmaengine: lgm: use sg_nents_for_dma() helper
  dmaengine: k3dma: use sg_nents_for_dma() helper
  dmaengine: dw-axi-dmac: use sg_nents_for_dma() helper
  dmaengine: bcm2835-dma: use sg_nents_for_dma() helper
  dmaengine: axi-dmac: use sg_nents_for_dma() helper
  dmaengine: altera-msgdma: use sg_nents_for_dma() helper
  scatterlist: introduce sg_nents_for_dma() helper
  dmaengine: idxd: Add Max SGL Size Support for DSA3.0
  dmaengine: idxd: Expose DSA3.0 capabilities through sysfs
  dmaengine: sh: rz-dmac: Make channel irq local
  dmaengine: pl08x: Fix comment stating the difference between PL080 and PL081
  ...
2026-02-17 11:47:17 -08:00
Linus Torvalds 9b725d5959 Merge tag 'phy-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy
Pull phy updates from Vinod Koul:
 "Core:

   - Add suuport for "rx-polarity" and "tx-polarity" device tree
     properties and phy common properties to manage this

  New Support:

   - Qualcomm Glymur PCIe Gen4 2-lanes PCIe phy, DP and edp phy, USB UNI
     PHY and SMB2370 eUSB2 repeater. SC8280xp QMP UFS PHY, Kaanapali
     PCIe phy and QMP PHY, QCS615 QMP USB3+DP PHY and driver support for
     that.

   - SpacemiT PCIe/combo PHY and K1 USB2 PHY driver.

   - HDMI 2.1 FRL configuration support and driver enabling for rockchip
     samsung-hdptx driver

   - TI TCAN1046 phy

   - Renesas RZ/V2H(P) and RZ/V2N usb3

   - Mediatek MT8188 hdmi-phy

   - Google Tensor SoC USB PHY driver

   - Apple Type-C PHY

  Updates:

   - Subsystem conversion for clock round_rate() to determine_rate()

   - TI USB3 DT schema conversion

   - Samsung ExynosAutov920 usb3, combo hsphy and ssphy support"

* tag 'phy-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: (143 commits)
  phy: ti: phy-j721e-wiz: convert from divider_round_rate() to divider_determine_rate()
  dt-bindings: phy: ti,control-phy-otghs: convert to DT schema
  dt-bindings: phy: ti,phy-usb3: convert to DT schema
  phy: tegra: xusb: Remove unused powered_on variable
  phy: renesas: rcar-gen3-usb2: add regulator dependency
  phy: GOOGLE_USB: add TYPEC dependency
  phy: enter drivers/phy/Makefile even without CONFIG_GENERIC_PHY
  phy: renesas: rcar-gen3-usb2: Use mux-state for phyrst management
  phy: renesas: rcar-gen3-usb2: Add regulator for OTG VBUS control
  phy: renesas: rcar-gen3-usb2: Use devm_pm_runtime_enable()
  phy: renesas: rcar-gen3-usb2: Factor out VBUS control logic
  dt-bindings: phy: renesas,usb2-phy: Document RZ/G3E SoC
  dt-bindings: phy: renesas,usb2-phy: Document mux-states property
  dt-bindings: phy: renesas,usb2-phy: Document USB VBUS regulator
  phy: rockchip: samsung-hdptx: Add HDMI 2.1 FRL support
  phy: rockchip: samsung-hdptx: Extend rk_hdptx_phy_verify_hdmi_config() helper
  phy: rockchip: samsung-hdptx: Switch to driver specific HDMI config
  phy: rockchip: samsung-hdptx: Drop hw_rate driver data
  phy: rockchip: samsung-hdptx: Compute clk rate from PLL config
  phy: rockchip: samsung-hdptx: Cleanup *_cmn_init_seq lists
  ...
2026-02-17 11:40:04 -08:00
Linus Torvalds 4e15e81971 Merge tag 'soundwire-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire
Pull soundwire updates from Vinod Koul:

 - support for Qualcomm v2.2.0 controllers

 - bus method updates for .probe(), .remove() and .shutdown()
   and remove function return value updates

 - Avell B.ON dmi-quirks mapping

 - mark cs42l45 codec as wake capable

* tag 'soundwire-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire:
  soundwire: intel_ace2x: add SND_HDA_CORE dependency
  dt-bindings: soundwire: qcom: Add SoundWire v2.2.0 compatible
  soundwire: Use bus methods for .probe(), .remove() and .shutdown()
  soundwire: Make remove function return no value
  soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15)
  soundwire: qcom: Use guard to avoid mixing cleanup and goto
  soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list
2026-02-17 10:07:13 -08:00
Linus Torvalds d295082ea6 Merge tag 'spdx-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx
Pull SPDX updates from Greg KH:
 "Here are two small changes that add some missing SPDX license lines to
  some core kernel files. These are:

   - adding SPDX license lines to kdb files

   - adding SPDX license lines to the remaining kernel/ files

  Both of these have been in linux-next for a while with no reported
  issues"

* tag 'spdx-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx:
  kernel: debug: Add SPDX license ids to kdb files
  kernel: add SPDX-License-Identifier lines
2026-02-17 09:46:03 -08:00
Linus Torvalds 17f8d20093 Merge tag 'usb-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Pull USB / Thunderbolt updates from Greg KH:
 "Here is the "big" set of USB and Thunderbolt driver updates for
  7.0-rc1. Overall more lines were removed than added, thanks to
  dropping the obsolete isp1362 USB host controller driver, always a
  nice change.

  Other than that, nothing major happening here, highlights are:

   - lots of dwc3 driver updates and new hardware support added

   - usb gadget function driver updates

   - usb phy driver updates

   - typec driver updates and additions

   - USB rust binding updates for syntax and formatting changes

   - more usb serial device ids added

   - other smaller USB core and driver updates and additions

  All of these have been in linux-next for a long time, with no reported
  problems"

* tag 'usb-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (77 commits)
  usb: typec: ucsi: Add Thunderbolt alternate mode support
  usb: typec: hd3ss3220: Check if regulator needs to be switched
  usb: phy: tegra: parametrize PORTSC1 register offset
  usb: phy: tegra: parametrize HSIC PTS value
  usb: phy: tegra: return error value from utmi_wait_register
  usb: phy: tegra: cosmetic fixes
  dt-bindings: usb: renesas,usbhs: Add RZ/G3E SoC support
  usb: dwc2: fix resume failure if dr_mode is host
  usb: cdns3: fix role switching during resume
  usb: dwc3: gadget: Move vbus draw to workqueue context
  USB: serial: option: add Telit FN920C04 RNDIS compositions
  usb: dwc3: Log dwc3 address in traces
  usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN
  usb: phy: tegra: add HSIC support
  usb: phy: tegra: use phy type directly
  usb: typec: ucsi: Enforce mode selection for cros_ec_ucsi
  usb: typec: ucsi: Support mode selection to activate altmodes
  usb: typec: Introduce mode_selection bit
  usb: typec: Implement mode selection
  usb: typec: Expose alternate mode priority via sysfs
  ...
2026-02-17 09:36:43 -08:00
Linus Torvalds 3ad7945754 Merge tag 'tty-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
Pull tty / serial driver updates from Greg KH:
 "Here is the small amount of tty and serial driver updates for 7.0-rc1.
  Nothing major in here at all, just some driver updates and minor
  tweaks and cleanups including:

   - sh-sci serial driver updates

   - 8250 driver updates

   - attempt to make the tty ports have their own workqueue, but was
     reverted after testing found it to have problems on some platforms.

     This will probably come back for 7.1 after it has been reworked and
     resubmitted

   - other tiny tty driver changes

  All of these have been in linux-next for a while with no reported
  problems"

* tag 'tty-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (49 commits)
  Revert "tty: tty_port: add workqueue to flip TTY buffer"
  tty: tty_port: add workqueue to flip TTY buffer
  serial: 8250_pci: Remove custom deprecated baud setting routine
  serial: 8250_omap: Remove custom deprecated baud setting routine
  dt-bindings: serial: renesas,scif: Document RZ/G3L SoC
  serial: 8250: omap: set out-of-band wakeup if wakeup pinctrl exists
  tty: hvc-iucv: Remove KMSG_COMPONENT macro
  dt-bindings: serial: google,goldfish-tty: Convert to DT schema
  dt-bindings: serial: sh-sci: Fold single-entry compatibles into enum
  serial: 8250: 8250_omap.c: Clear DMA RX running status only after DMA termination is done
  serial: 8250: 8250_omap.c: Add support for handling UART error conditions
  serial: SH_SCI: improve "DMA support" prompt
  serial: Kconfig: fix ordering of entries for menu display
  serial: 8250: fix ordering of entries for menu display
  serial: imx: change SERIAL_IMX_CONSOLE to bool
  8250_men_mcb: drop unneeded MODULE_ALIAS
  serial: men_z135_uart: drop unneeded MODULE_ALIAS
  dt-bindings: serial: renesas,rsci: Document RZ/V2H(P) and RZ/V2N SoCs
  serial: rsci: Convert to FIELD_MODIFY()
  dt-bindings: serial: 8250: add SpacemiT K3 UART compatible
  ...
2026-02-17 09:30:52 -08:00
Linus Torvalds a5f22b9b13 Merge tag 'staging-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
Pull staging driver updates from Greg KH:
 "Here is the big set of staging driver updates for 7.0-rc1. Well, not
  that big, just lots of tiny coding style cleanups primarily in one
  driver as everyone seems to have glomed onto it for some reason that
  escapes me (is there a tutorial out there somewhere pointing people at
  this?)

  Not much overall, the changes can be summarized as:

   - cleanups for the rtl8723bs driver, so many cleanups...

   - vme_user driver cleanups

   - sm750fb driver cleanups

   - tiny greybus driver cleanups

   - other really small staging driver cleanups

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'staging-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (119 commits)
  staging: rtl8723bs: refactor ODM_SetIQCbyRFpath to reduce duplication
  staging: rtl8723bs: rename CamelCase function Set_MSR to set_msr
  staging: rtl8723bs: remove unnecessary blank lines in rtw_io.c
  staging: rtl8723bs: remove stale TODO item regarding %pM
  staging: rtl8723bs: remove unused allocation wrapper functions
  staging: rtl8723bs: use standard skb allocation APIs
  staging: rtl8723bs: replace rtw_zmalloc() with kzalloc()
  staging: rtl8723bs: replace rtw_malloc() with kmalloc()
  staging: rtl8723bs: introduce kmemdup() where applicable
  staging: sm750fb: Clean up variable names
  staging: rtl8723bs: fix null dereference in find_network
  staging: rtl8723bs: use unaligned access macros in rtw_security.c
  staging: rtl8723bs: fix potential race in expire_timeout_chk
  staging: rtl8723bs: remove dead debugging code in rtw_mlme_ext.c
  staging: rtl8723bs: modernize hex output in rtw_report_sec_ie
  staging: rtl8723bs: fix spacing around operators
  staging: rtl8723bs: rename u1bTmp to val
  staging: rtl8723bs: remove unused private debug counters
  staging: rtl8723bs: remove thread wraper functions and add IS_ERR() check
  staging: rtl8723bs: fix firmware memory leak on error
  ...
2026-02-17 09:20:58 -08:00
Linus Torvalds 505d195b0f Merge tag 'char-misc-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull char/misc/IIO driver updates from Greg KH:
 "Here is the big set of char/misc/iio and other smaller driver
  subsystem changes for 7.0-rc1. Lots of little things in here,
  including:

   - Loads of iio driver changes and updates and additions

   - gpib driver updates

   - interconnect driver updates

   - i3c driver updates

   - hwtracing (coresight and intel) driver updates

   - deletion of the obsolete mwave driver

   - binder driver updates (rust and c versions)

   - mhi driver updates (causing a merge conflict, see below)

   - mei driver updates

   - fsi driver updates

   - eeprom driver updates

   - lots of other small char and misc driver updates and cleanups

  All of these have been in linux-next for a while, with no reported
  issues"

* tag 'char-misc-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (297 commits)
  mux: mmio: fix regmap leak on probe failure
  rust_binder: return p from rust_binder_transaction_target_node()
  drivers: android: binder: Update ARef imports from sync::aref
  rust_binder: fix needless borrow in context.rs
  iio: magn: mmc5633: Fix Kconfig for combination of I3C as module and driver builtin
  iio: sca3000: Fix a resource leak in sca3000_probe()
  iio: proximity: rfd77402: Add interrupt handling support
  iio: proximity: rfd77402: Document device private data structure
  iio: proximity: rfd77402: Use devm-managed mutex initialization
  iio: proximity: rfd77402: Use kernel helper for result polling
  iio: proximity: rfd77402: Align polling timeout with datasheet
  iio: cros_ec: Allow enabling/disabling calibration mode
  iio: frequency: ad9523: correct kernel-doc bad line warning
  iio: buffer: buffer_impl.h: fix kernel-doc warnings
  iio: gyro: itg3200: Fix unchecked return value in read_raw
  MAINTAINERS: add entry for ADE9000 driver
  iio: accel: sca3000: remove unused last_timestamp field
  iio: accel: adxl372: remove unused int2_bitmask field
  iio: adc: ad7766: Use iio_trigger_generic_data_rdy_poll()
  iio: magnetometer: Remove IRQF_ONESHOT
  ...
2026-02-17 09:11:04 -08:00
Linus Torvalds 99dfe2d4da Merge tag 'block-7.0-20260216' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull more block updates from Jens Axboe:

 - Fix partial IOVA mapping cleanup in error handling

 - Minor prep series ignoring discard return value, as
   the inline value is always known

 - Ensure BLK_FEAT_STABLE_WRITES is set for drbd

 - Fix leak of folio in bio_iov_iter_bounce_read()

 - Allow IOC_PR_READ_* for read-only open

 - Another debugfs deadlock fix

 - A few doc updates

* tag 'block-7.0-20260216' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  blk-mq: use NOIO context to prevent deadlock during debugfs creation
  blk-stat: convert struct blk_stat_callback to kernel-doc
  block: fix enum descriptions kernel-doc
  block: update docs for bio and bvec_iter
  block: change return type to void
  nvmet: ignore discard return value
  md: ignore discard return value
  block: fix partial IOVA mapping cleanup in blk_rq_dma_map_iova
  block: fix folio leak in bio_iov_iter_bounce_read()
  block: allow IOC_PR_READ_* ioctls with BLK_OPEN_READ
  drbd: always set BLK_FEAT_STABLE_WRITES
2026-02-17 08:48:45 -08:00
Linus Torvalds 7b751b01ad Merge tag 'io_uring-7.0-20260216' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull more io_uring updates from Jens Axboe:
 "This is a mix of cleanups and fixes. No major fixes in here, just a
  bunch of little fixes. Some of them marked for stable as it fixes
  behavioral issues

   - Fix an issue with SOCKET_URING_OP_SETSOCKOPT for netlink sockets,
     due to a too restrictive check on it having an ioctl handler

   - Remove a redundant SQPOLL check in ring creation

   - Kill dead accounting for zero-copy send, which doesn't use ->buf
     or ->len post the initial setup

   - Fix missing clamp of the allocation hint, which could cause
     allocations to fall outside of the range the application asked
     for. Still within the allowed limits.

   - Fix for IORING_OP_PIPE's handling of direct descriptors

   - Tweak to the API for the newly added BPF filters, making them
     more future proof in terms of how applications deal with them

   - A few fixes for zcrx, fixing a few error handling conditions

   - Fix for zcrx request flag checking

   - Add support for querying the zcrx page size

   - Improve the NO_SQARRAY static branch inc/dec, avoiding busy
     conditions causing too much traffic

   - Various little cleanups"

* tag 'io_uring-7.0-20260216' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring/bpf_filter: pass in expected filter payload size
  io_uring/bpf_filter: move filter size and populate helper into struct
  io_uring/cancel: de-unionize file and user_data in struct io_cancel_data
  io_uring/rsrc: improve regbuf iov validation
  io_uring: remove unneeded io_send_zc accounting
  io_uring/cmd_net: fix too strict requirement on ioctl
  io_uring: delay sqarray static branch disablement
  io_uring/query: add query.h copyright notice
  io_uring/query: return support for custom rx page size
  io_uring/zcrx: check unsupported flags on import
  io_uring/zcrx: fix post open error handling
  io_uring/zcrx: fix sgtable leak on mapping failures
  io_uring: use the right type for creds iteration
  io_uring/openclose: fix io_pipe_fixed() slot tracking for specific slots
  io_uring/filetable: clamp alloc_hint to the configured alloc range
  io_uring/rsrc: replace reg buffer bit field with flags
  io_uring/zcrx: improve types for size calculation
  io_uring/tctx: avoid modifying loop variable in io_ring_add_registered_file
  io_uring: simplify IORING_SETUP_DEFER_TASKRUN && !SQPOLL check
2026-02-17 08:33:49 -08:00
Jens Axboe be3573124e io_uring/bpf_filter: pass in expected filter payload size
It's quite possible that opcodes that have payloads attached to them,
like IORING_OP_OPENAT/OPENAT2 or IORING_OP_SOCKET, that these paylods
can change over time. For example, on the openat/openat2 side, the
struct open_how argument is extensible, and could be extended in the
future to allow further arguments to be passed in.

Allow registration of a cBPF filter to give the size of the filter as
seen by userspace. If that filter is for an opcode that takes extra
payload data, allow it if the application payload expectation is the
same size than the kernels. If that is the case, the kernel supports
filtering on the payload that the application expects. If the size
differs, the behavior depends on the IO_URING_BPF_FILTER_SZ_STRICT flag:

1) If IO_URING_BPF_FILTER_SZ_STRICT is set and the size expectation
   differs, fail the attempt to load the filter.

2) If IO_URING_BPF_FILTER_SZ_STRICT isn't set, allow the filter if
   the userspace pdu size is smaller than what the kernel offers.

3) Regardless if IO_URING_BPF_FILTER_SZ_STRICT, fail loading the filter
   if the userspace pdu size is bigger than what the kernel supports.

An attempt to load a filter due to sizing will error with -EMSGSIZE.
For that error, the registration struct will have filter->pdu_size
populated with the pdu size that the kernel uses.

Reported-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-16 15:56:31 -07:00
Jens Axboe d21c362182 io_uring/bpf_filter: move filter size and populate helper into struct
Rather than open-code this logic in io_uring_populate_bpf_ctx() with
a switch, move it to the issue side definitions. Outside of making this
easier to extend in the future, it's also a prep patch for using the
pdu size for a given opcode filter elsewhere.

Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-16 15:56:25 -07:00
Linus Torvalds 9702969978 Merge tag 'slab-for-7.0-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab
Pull more slab updates from Vlastimil Babka:

 - Two stable fixes for kmalloc_nolock() usage from NMI context (Harry
   Yoo)

 - Allow kmalloc_nolock() allocations to be freed with kfree() and thus
   also kfree_rcu() and simplify slabobj_ext handling - we no longer
   need to track how it was allocated to use the matching freeing
   function (Harry Yoo)

* tag 'slab-for-7.0-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab:
  mm/slab: drop the OBJEXTS_NOSPIN_ALLOC flag from enum objext_flags
  mm/slab: allow freeing kmalloc_nolock()'d objects using kfree[_rcu]()
  mm/slab: use prandom if !allow_spin
  mm/slab: do not access current->mems_allowed_seq if !allow_spin
2026-02-16 13:41:38 -08:00
Jens Axboe 22dbb0987b io_uring/cancel: de-unionize file and user_data in struct io_cancel_data
By having them share the same space in struct io_cancel_data, it ends up
disallowing IORING_ASYNC_CANCEL_FD|IORING_ASYNC_CANCEL_USERDATA from
working. Eg you cannot match on both a file and user_data for
cancelation purposes. This obviously isn't a common use case as nobody
has reported this, but it does result in -ENOENT potentially being
returned when trying to match on both, rather than actually doing what
the API says it would.

Fixes: 4bf94615b8 ("io_uring: allow IORING_OP_ASYNC_CANCEL with 'fd' key")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-16 14:16:27 -07:00
Linus Torvalds 45a43ac5ac Merge tag 'vfs-7.0-rc1.misc.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull more misc vfs updates from Christian Brauner:
 "Features:

   - Optimize close_range() from O(range size) to O(active FDs) by using
     find_next_bit() on the open_fds bitmap instead of linearly scanning
     the entire requested range. This is a significant improvement for
     large-range close operations on sparse file descriptor tables.

   - Add FS_XFLAG_VERITY file attribute for fs-verity files, retrievable
     via FS_IOC_FSGETXATTR and file_getattr(). The flag is read-only.
     Add tracepoints for fs-verity enable and verify operations,
     replacing the previously removed debug printk's.

   - Prevent nfsd from exporting special kernel filesystems like pidfs
     and nsfs. These filesystems have custom ->open() and ->permission()
     export methods that are designed for open_by_handle_at(2) only and
     are incompatible with nfsd. Update the exportfs documentation
     accordingly.

  Fixes:

   - Fix KMSAN uninit-value in ovl_fill_real() where strcmp() was used
     on a non-null-terminated decrypted directory entry name from
     fscrypt. This triggered on encrypted lower layers when the
     decrypted name buffer contained uninitialized tail data.

     The fix also adds VFS-level name_is_dot(), name_is_dotdot(), and
     name_is_dot_dotdot() helpers, replacing various open-coded "." and
     ".." checks across the tree.

   - Fix read-only fsflags not being reset together with xflags in
     vfs_fileattr_set(). Currently harmless since no read-only xflags
     overlap with flags, but this would cause inconsistencies for any
     future shared read-only flag

   - Return -EREMOTE instead of -ESRCH from PIDFD_GET_INFO when the
     target process is in a different pid namespace. This lets userspace
     distinguish "process exited" from "process in another namespace",
     matching glibc's pidfd_getpid() behavior

  Cleanups:

   - Use C-string literals in the Rust seq_file bindings, replacing the
     kernel::c_str!() macro (available since Rust 1.77)

   - Fix typo in d_walk_ret enum comment, add porting notes for the
     readlink_copy() calling convention change"

* tag 'vfs-7.0-rc1.misc.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  fs: add porting notes about readlink_copy()
  pidfs: return -EREMOTE when PIDFD_GET_INFO is called on another ns
  nfsd: do not allow exporting of special kernel filesystems
  exportfs: clarify the documentation of open()/permission() expotrfs ops
  fsverity: add tracepoints
  fs: add FS_XFLAG_VERITY for fs-verity files
  rust: seq_file: replace `kernel::c_str!` with C-Strings
  fs: dcache: fix typo in enum d_walk_ret comment
  ovl: use name_is_dot* helpers in readdir code
  fs: add helpers name_is_dot{,dot,_dotdot}
  ovl: Fix uninit-value in ovl_fill_real
  fs: reset read-only fsflags together with xflags
  fs/file: optimize close_range() complexity from O(N) to O(Sparse)
2026-02-16 13:00:36 -08:00
Linus Torvalds 543b9b6339 Merge tag 'kernel-7.0-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull pidfs updates from Christian Brauner:

 - pid: introduce task_ppid_vnr() helper

 - pidfs: convert rb-tree to rhashtable

   Mateusz reported performance penalties during task creation because
   pidfs uses pidmap_lock to add elements into the rbtree. Switch to an
   rhashtable to have separate fine-grained locking and to decouple from
   pidmap_lock moving all heavy manipulations outside of it

   Also move inode allocation outside of pidmap_lock. With this there's
   nothing happening for pidfs under pidmap_lock

 - pid: reorder fields in pid_namespace to reduce false sharing

 - Revert "pid: make __task_pid_nr_ns(ns => NULL) safe for zombie
   callers"

 - ipc: Add SPDX license id to mqueue.c

* tag 'kernel-7.0-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  pid: introduce task_ppid_vnr() helper
  pidfs: implement ino allocation without the pidmap lock
  Revert "pid: make __task_pid_nr_ns(ns => NULL) safe for zombie callers"
  pid: reorder fields in pid_namespace to reduce false sharing
  pidfs: convert rb-tree to rhashtable
  ipc: Add SPDX license id to mqueue.c
2026-02-16 12:37:13 -08:00
Linus Torvalds 57d76cecce Merge tag 'linux-watchdog-6.20-rc1' of git://www.linux-watchdog.org/linux-watchdog
Pull watchdog updates from Wim Van Sebroeck:

 - iTCO: Drop vendor support

 - s3c2410_wdt: Drop S3C2410 support

 - Convert mpc8xxx-wdt to YAML

 - Several small fixes and improvements

* tag 'linux-watchdog-6.20-rc1' of git://www.linux-watchdog.org/linux-watchdog:
  dt-bindings: watchdog: qcom-wdt: Document Glymur watchdog
  dt-bindings: watchdog: Convert mpc8xxx-wdt to YAML
  dt-bindings: watchdog: samsung-wdt: Split if:then: and constrain more
  dt-bindings: watchdog: samsung-wdt: Drop S3C2410
  watchdog: s3c2410_wdt: Drop S3C2410 support
  dt-bindings: watchdog: samsung-wdt: Define cluster constraints top-level
  watchdog: rzv2h_wdt: Discard pm_runtime_put() return value
  watchdog: rz: Discard pm_runtime_put() return values
  watchdog: Make API functions const correct
  watchdog: imx7ulp_wdt: handle the nowayout option
  watchdog: sbsa: Update the W_IIDR Implementer bit mask to 0xFFF
  watchdog: Always return time left until watchdog times out
  watchdog: iTCO: Drop vendor support
  watchdog: starfive-wdt: Fix PM reference leak in probe error path
  fix it87_wdt early reboot by reporting running timer
2026-02-16 12:21:22 -08:00
Linus Torvalds 2228d9cf7a Merge tag 'leds-next-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds
Pull LED updates from Lee Jones:
 "New Support & Features:

   - Add support for the TI LP5812 4x3 matrix RGB LED driver, including
     autonomous animation engine control and extensive scan multiplexing
     modes

   - Add a new driver for the ams Osram AS3668 4-channel I2C LED
     controller

   - Extend the is31fl32xx driver to support the is31fl3293 variant,
     which features 3 channels and 12-bit PWM resolution

  Improvements & Fixes:

   - Prevent the ExpressWire KTD2801 chip from entering an undefined
     state by disabling interrupts during time-sensitive communication

   - Ensure the Qualcomm LPG driver detects hardware write failures by
     checking the return value of regmap_bulk_write() during LUT
     programming

   - Fix kernel-doc warnings in the lm3692x driver by documenting
     missing struct members and standardizing the comment style

   - Update the ExpressWire library to use fsleep() and unexport
     internal-only functions

   - Improve the is31fl32xx driver by reordering code to eliminate
     unnecessary forward declarations

  Cleanups & Refactoring:

   - Simplify the LP55XX common LED driver by utilizing the
     for_each_available_child_of_node_scoped() macro for more concise
     node iteration

  Device Tree Bindings Updates:

   - Add new YAML bindings for the TI LP5860 and LP5812 LED controllers,
     and the ams Osram AS3668

   - Convert the TI LM3697 white LED driver binding to DT schema format

   - Allow multicolor LED nodes to be named with numeric suffixes (e.g.,
     multi-led-0) to handle multiple instances without unit addresses

   - Document support for the PMH0101 variant in the Qualcomm LPG PWM
     and SPMI Flash LED bindings

   - Add the issi,is31fl3293 compatible string to the is31fl32xx
     binding"

* tag 'leds-next-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds:
  dt-bindings: leds: Convert ti,lm3697 to DT schema
  leds: as3668: Driver for the ams Osram 4-channel i2c LED driver
  dt-bindings: leds: Add new as3668 support
  docs: leds: Document TI LP5812 LED driver
  leds: Add basic support for TI/National Semiconductor LP5812 LED Driver
  leds: qcom-lpg: Check the return value of regmap_bulk_write()
  dt-bindings: leds: qcom,spmi-flash-led: Add PMH0101 compatible
  dt-bindings: leds: leds-qcom-lpg: Add support for PMH0101 PWM
  dt-bindings: leds: Allow differently named multicolor LEDs
  leds: lp55xx: Simplify with scoped for each OF child loop
  dt-bindings: leds: add TI/National Semiconductor LP5812 LED Driver
  leds: is31f132xx: Add support for is31fl3293
  leds: is31f132xx: Re-order code to remove forward declarations
  dt-bindings: leds: Add issi,is31fl3293 to leds-is31fl32xx
  leds: expresswire: Fix chip state breakage
  dt-bindings: leds: Add LP5860 LED controller
  leds: lm3692x: Fix kernel-doc for struct lm3692x_led
2026-02-16 11:15:19 -08:00
Linus Torvalds 4bfa4a54b0 Merge tag 'backlight-next-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight
Pull backlight updates from Lee Jones:
 "New Support & Features:

   - Add a new driver for the Congatec Board Controller (CGBC)
     backlight, providing brightness control via the board controller's
     PWM interface

  Improvements & Fixes:

   - Resolve build failures in the Awinic AW99706 driver by switching to
     the correct GPIO consumer header

   - Extend the Qualcomm WLED driver to support the specific
     over-voltage protection (OVP) values required for the PMI8994 and
     PMI8950 variants

  Device Tree Bindings Updates:

   - Document the device-specific over-voltage protection (OVP)
     millivolt ranges and default values for Qualcomm PMI8994 and
     PMI8950 WLED controllers"

* tag 'backlight-next-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight:
  backlight: qcom-wled: Change PM8950 WLED configurations
  dt-bindings: backlight: qcom-wled: Document ovp values for PMI8950
  backlight: qcom-wled: Support ovp values for PMI8994
  dt-bindings: backlight: qcom-wled: Document ovp values for PMI8994
  backlight: aw99706: Fix build errors caused by wrong gpio header
  backlight: Add Congatec Board Controller (CGBC) backlight support
2026-02-16 11:10:33 -08:00
Linus Torvalds 4668c4831f Merge tag 'mfd-next-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd
Pull MFD updates from Lee Jones:
 "New Support & Features:
   - Add comprehensive support for the ROHM BD72720 PMIC, including core
     MFD, regulator, GPIO, clock gate, RTC, and power-supply drivers
   - Add support for the Rockchip RK801 PMIC, including core MFD and
     regulator drivers
   - Add support for the ROHM BD73900 PMIC by leveraging existing common
     drivers
   - Wire up RTC, hwmon, and input sub-devices for the Apple SMC
     (macsmc) driver
   - Add support for the Delta Networks TN48M switch CPLD via the
     simple-mfd-i2c driver
   - Add support for the TS133 variant to the QNAP MCU driver
   - Provide support for the sama7d65 XLCD controller in the Atmel HLCDC
     driver
   - Add backlight sub-device support to the Congatec Board Controller
     (cgbc)
   - Add Intel Nova Lake-S (NVL-S) PCI IDs to the Intel LPSS driver

  Improvements & Fixes:
   - Implement a "wrapper regmap" for the ROHM BD72720 to handle dual
     I2C slave addresses (0x4b and 0x4c) transparently for child devices
   - Introduce mutex locking around 'mfd_of_node_list' in the MFD core
     to ensure safe concurrent access
   - Fix a potential regulator resource leak in the Arizona core driver
     during boot sequence failures
   - Resolve child device duplication issues on driver rebind for
     Qualcomm PM8xxx and OMAP USB host drivers by using
     of_platform_depopulate()
   - Fix IRQ domain name duplication for the Samsung S2MPG10 by adding a
     unique domain suffix
   - Implement LOCK register handling for the TI TPS65214 variant to
     unlock registers at probe time
   - Fully convert the Loongson-2K BMC driver to use managed resources
     (pcim) and the standard PCI resource API
   - Ensure the Apple SMC mutex is correctly initialized during probe to
     prevent NULL pointer dereferences
   - Expand the ROHM BD71828 power-supply driver to support 9-bit
     register addresses
   - Simplify the Samsung S5M RTC driver by querying platform device IRQ
     resources directly
   - Revert an incorrect read-to-write mask change in the DA9052 SPI
     driver to restore default OTP behavior
   - Fix kernel-doc warnings in the TI TPS6105x driver

- Cleanups & Refactoring
   - Simplify the MFD core by utilizing the scoped
     for_each_child_of_node_scoped() macro and streamlining device_node
     storage
   - Rename ROHM BD71828 IC-specific entities to use consistent prefixes
     for better extensibility
   - Refactor ROHM BD71828 regmap definitions using the
     regmap_reg_range() macro
   - Update the ROHM BD71828 driver to use standard C-style comment
     headers
   - Remove the now unused 'irq_data' field from the Samsung SEC core
     structure
   - Drop unnecessary use of irqd_get_trigger_type() in the Maxim
     MAX77759 driver
   - Default MFD_SPACEMIT_P1 to 'm' if ARCH_SPACEMIT is selected
   - Add missing charger-related registers to the ROHM BD71828 core
     header and Type-C CC registers to the AXP717

  Device Tree Binding Updates:
   - Add new bindings for the ROHM BD72720 PMIC, Rockchip RK801 PMIC,
     Bitmain BM1880 System Controller, and NXP LPC32xx System Control
     Block
   - Clarify trickle-charge terminology and add properties for voltage
     drop (VDR) correction and upper charge limits to the generic
     battery binding
   - Document GPR syscon for NXP S32 SoCs and the smp-memram subnode for
     Aspeed SCU
   - Document numerous new Qualcomm SPMI PMIC compatibles (pmcx0102,
     pmh0101, pmk8850, etc)
   - Add compatibles for the sama7d65 XLCD (Atmel), LAN9691 Flexcom
     (Microchip), and various MediaTek SCPSYS and regulator components
   - Fix a dead link to the audio codec binding in the DA9055
     documentation"

* tag 'mfd-next-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (41 commits)
  dt-bindings: mfd: da9055: Fix dead link to codec binding
  mfd: cgbc: Add support for backlight
  dt-bindings: mfd: qcom,spmi-pmic: Document PMICs present on Glymur and Kaanapali
  dt-bindings: mfd: Document smp-memram subnode for aspeed,ast2x00-scu
  mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs
  mfd: ls2kbmc: Use PCI API instead of direct accesses
  mfd: ls2kbmc: Fully convert to use managed resources
  dt-bindings: mfd: mediatek: mt6397: Add missing MT6331 regulator compat
  dt-bindings: mfd: mediatek,mt8195-scpsys: Add mediatek,mt6795-scpsys
  dt-bindings: mfd: atmel,sama5d2-flexcom: Add microchip,lan9691-flexcom
  mfd: omap-usb-host: Fix OF populate on driver rebind
  mfd: qcom-pm8xxx: Fix OF populate on driver rebind
  dt-bindings: mfd: syscon: Allow syscon compatible for mediatek,mt7981-topmisc
  mfd: qnap-mcu: Add driver data for TS133 variant
  dt-bindings: mfd: qnap,ts433-mcu: Add qnap,ts133-mcu compatible
  mfd: sec: Fix IRQ domain names duplication
  mfd: simple-mfd-i2c: Add Delta TN48M CPLD support
  mfd: macsmc: Initialize mutex
  dt-bindings: mfd: nxp: Add NXP LPC32xx System Control Block
  mfd: Kconfig: Default MFD_SPACEMIT_P1 to 'm' if ARCH_SPACEMIT
  ...
2026-02-16 11:05:44 -08:00
Yu Kuai dfe48ea179 blk-mq: use NOIO context to prevent deadlock during debugfs creation
Creating debugfs entries can trigger fs reclaim, which can enter back
into the block layer request_queue. This can cause deadlock if the
queue is frozen.

Previously, a WARN_ON_ONCE check was used in debugfs_create_files()
to detect this condition, but it was racy since the queue can be frozen
from another context at any time.

Introduce blk_debugfs_lock()/blk_debugfs_unlock() helpers that combine
the debugfs_mutex with memalloc_noio_save()/restore() to prevent fs
reclaim from triggering block I/O. Also add blk_debugfs_lock_nomemsave()
and blk_debugfs_unlock_nomemrestore() variants for callers that don't
need NOIO protection (e.g., debugfs removal or read-only operations).

Replace all raw debugfs_mutex lock/unlock pairs with these helpers,
using the _nomemsave/_nomemrestore variants where appropriate.

Reported-by: Yi Zhang <yi.zhang@redhat.com>
Closes: https://lore.kernel.org/all/CAHj4cs9gNKEYAPagD9JADfO5UH+OiCr4P7OO2wjpfOYeM-RV=A@mail.gmail.com/
Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Closes: https://lore.kernel.org/all/aYWQR7CtYdk3K39g@shinmob/
Suggested-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-16 10:47:25 -07:00
Linus Torvalds 46a1daac56 Merge tag 'pinctrl-v7.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl
Pull pin control updates from Linus Walleij:
 "Core changes:

   - Drop the unused devm_pinctrl_unregister() function

   - Move pretended generic pin control functionality out of the core
     and into the Amlogic AM4 driver. We have something better coming
     (hopefully)

  New hardware support:

   - Spacemit K3 (RISC-V) pin control support

   - Atmel AT91 PIO4 (ARM32) SAMA7D65 pin control support

   - Exynos9610 (ARM64) pin control support

   - Qualcomm Mahua TLMM (ARM64) pin control support

   - Microchip Polarfire MSSIO (RISC-V) pin control support

   - Ocelot LAN9645XF (multiplatform) pin control support

  Improvements:

   - Using a few more guards for locking

   - Various nonurgent fixes and tweaks"

* tag 'pinctrl-v7.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (73 commits)
  pinctrl: generic: move function to amlogic-am4 driver
  pinctrl: intel: Align Copyright note with corporate guidelines
  pinctrl: mediatek: remove unused drv_offset field
  pinctrl: canaan: k230: Fix NULL pointer dereference when parsing devicetree
  pinctrl: single: fix refcount leak in pcs_add_gpio_func()
  pinctrl: meson: amlogic-a4: Fix device node reference leak in bank helpers
  pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition
  pinctrl: core: Remove duplicate error messages
  pinctrl: core: Simplify devm_pinctrl_*()
  pinctrl: core: Remove unused devm_pinctrl_unregister()
  dt-bindings: pinctrl: spacemit: fix drive-strength check warning
  pinctrl: fix kismet issues with GENERIC_PINCTRL
  pinctrl: tangier: Join tng_pinctrl_probe() into its wrapper
  pinctrl: tangier: Remove duplicate error messages
  pinctrl: lynxpoint: Remove duplicate error messages
  pinctrl: cherryview: Remove duplicate error messages
  pinctrl: baytrail: Remove duplicate error messages
  pinctrl: intel: Remove duplicate error messages
  pinctrl: equilibrium: Fix device node reference leak in pinbank_init()
  dt-bindings: pinctrl: pinctrl-microchip-sgpio: add LAN969x
  ...
2026-02-16 09:35:24 -08:00
Linus Torvalds 6086f349a3 Merge tag 'mips_7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux
Pull MIPS updates from Thomas Bogendoerfer:
 "Cleanups and fixes"

* tag 'mips_7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (28 commits)
  Revert "clk: microchip: core: allow driver to be compiled with COMPILE_TEST"
  Revert "clk: microchip: fix typo in reference to a config option"
  MIPS: Implement ARCH_HAS_CC_CAN_LINK
  MIPS: rb532: Fix MMIO UART resource registration
  MIPS: Work around LLVM bug when gp is used as global register variable
  MIPS: Loongson64: env: Fixup serial clock-frequency when using LEFI
  MIPS: Loongson2ef: Use pcibios_align_resource() to block io range
  MIPS: Loongson2ef: Register PCI controller in early stage
  clk: microchip: fix typo in reference to a config option
  MIPS: Loongson64: dts: fix phy-related definition of LS7A GMAC
  clk: microchip: core: allow driver to be compiled with COMPILE_TEST
  MIPS: drop unused pic32.h header
  watchdog: pic32-wdt: update include to use pic32.h from platform_data
  watchdog: pic32-dmt: update include to use pic32.h from platform_data
  serial: pic32_uart: update include to use pic32.h from platform_data
  rtc: pic32: update include to use pic32.h from platform_data
  pinctrl: pic32: update include to use pic32.h from platform_data
  mmc: sdhci-pic32: update include to use pic32.h from platform_data
  irqchip/irq-pic32-evic: update include to use pic32.h from platform_data
  clk: microchip: core: update include to use pic32.h from platform_data
  ...
2026-02-16 09:30:44 -08:00
Randy Dunlap 3678a334a5 blk-stat: convert struct blk_stat_callback to kernel-doc
Most of struct blk_stat_callback documentation is already in kernel-doc
format. Convert the remaining struct members to kernel-doc to avoid
kernel-doc warnings:

Warning: block/blk-stat.h:62 struct member 'list' not described
 in 'blk_stat_callback'
Warning: block/blk-stat.h:62 struct member 'timer_fn' not described
 in 'blk_stat_callback'
Warning: block/blk-stat.h:62 struct member 'rcu' not described
 in 'blk_stat_callback'
Warning: block/blk-stat.h:133 No description found for return value of
 'blk_stat_is_active'

Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-16 10:21:06 -07:00
Randy Dunlap 4c431a76a2 block: fix enum descriptions kernel-doc
Fix all kernel-doc warnings in blk_types.h:

Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_READ' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_WRITE' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_FLUSH' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_DISCARD' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_SECURE_ERASE' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_ZONE_APPEND' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_WRITE_ZEROES' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_ZONE_OPEN' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_ZONE_CLOSE' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_ZONE_FINISH' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_ZONE_RESET' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_ZONE_RESET_ALL' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_DRV_IN' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_DRV_OUT' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_LAST' not described in enum 'req_op'

Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-16 10:21:01 -07:00
Konstantin Komarov 10d7c95af0 fs/ntfs3: add delayed-allocation (delalloc) support
This patch implements delayed allocation (delalloc) in ntfs3 driver.

It introduces an in-memory delayed-runlist (run_da) and the helpers to
track, reserve and later convert those delayed reservations into real
clusters at writeback time. The change keeps on-disk formats untouched and
focuses on pagecache integration, correctness and safe interaction with
fallocate, truncate, and dio/iomap paths.

Key points:

- add run_da (delay-allocated run tree) and bookkeeping for delayed clusters.

- mark ranges as delalloc (DELALLOC_LCN) instead of immediately allocating.
  Actual allocation performed later (writeback / attr_set_size_ex / explicit
  flush paths).

- direct i/o / iomap paths updated to avoid dio collisions with
  delalloc: dio falls back or forces allocation of delayed blocks before
  proceeding.

- punch/collapse/truncate/fallocate check and cancel delay-alloc reservations.
  Sparse/compressed files handled specially.

- free-space checks updated (ntfs_check_free_space) to account for reserved
  delalloc clusters and MFT record budgeting.

- delayed allocations are committed on last writer (file release) and on
  explicit allocation flush paths.

Tested-by: syzbot@syzkaller.appspotmail.com
Reported-by: syzbot+2bd8e813c7f767aa9bb1@syzkaller.appspotmail.com
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
2026-02-16 17:23:51 +01:00
Pavel Begunkov 2e02f9efdb io_uring/rsrc: improve regbuf iov validation
Deduplicate io_buffer_validate() calls by moving the checks into
io_sqe_buffer_register(). Now we also don't need special handling in
io_buffer_validate() passing through buffer removal requests. I also
was using it as a cleanup before some other changes.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-16 08:15:38 -07:00
Dylan Yudaken 046fcc83ac io_uring: remove unneeded io_send_zc accounting
zc->len and zc->buf are not actually used once you get to the retry
stage. The buffer remains in kmsg->msg.msg_iter, which is setup in
io_send_setup.
Note: it still seems needed in io_send due to io_send_select_buffer
needing it (for the len parameter).

Signed-off-by: Dylan Yudaken <dyudaken@gmail.com>
Reviewed-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-16 08:10:46 -07:00
Asbjørn Sloth Tønnesen 600b665b90 io_uring/cmd_net: fix too strict requirement on ioctl
Attempting SOCKET_URING_OP_SETSOCKOPT on an AF_NETLINK socket resulted
in an -EOPNOTSUPP, as AF_NETLINK doesn't have an ioctl in its struct
proto, but only in struct proto_ops.

Prior to the blamed commit, io_uring_cmd_sock() only had two cmd_op
operations, both requiring ioctl, thus the check was warranted.

Since then, 4 new cmd_op operations have been added, none of which
depend on ioctl. This patch moves the ioctl check, so it only applies
to the original operations.

AFAICT, the ioctl requirement was unintentional, and it wasn't
visible in the blamed patch within 3 lines of context.

Cc: stable@vger.kernel.org
Fixes: a5d2f99aff ("io_uring/cmd: Introduce SOCKET_URING_OP_GETSOCKOPT")
Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.net>
Reviewed-by: Gabriel Krisman Bertazi <krisman@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-16 08:08:01 -07:00
Linus Torvalds 2d10a48871 Merge tag 'probes-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull kprobes updates from Masami Hiramatsu:

 - Use a dedicated kernel thread to optimize the kprobes instead of
   using workqueue thread. Since the kprobe optimizer waits a long time
   for synchronize_rcu_task(), it can block other workers in the same
   queue if it uses a workqueue.

 - kprobe-events: return immediately if no new probe events are
   specified on the kernel command line at boot time. This shortens
   the kernel boot time.

 - When a kprobe is fully removed from the kernel code, retry optimizing
   another kprobe which is blocked by that kprobe.

* tag 'probes-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  kprobes: Use dedicated kthread for kprobe optimizer
  tracing: kprobe-event: Return directly when trace kprobes is empty
  kprobes: retry blocked optprobe in do_free_cleaned_kprobes
2026-02-16 07:04:01 -08:00
Linus Torvalds 0f2acd3148 Merge tag 'm68knommu-for-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu
Pull m68knommu updates from Greg Ungerer:

 - defconfig cleanup

 - fix for legacy 68000 CPU memmove() of non-aligned pointers

 - replace strcpy() with strscpy() for ucsimm target

* tag 'm68knommu-for-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu:
  m68knommu: Replace deprecated strcpy with strscpy in init_ucsimm
  m68k: nommu: fix memmove() with differently aligned src and dest for 68000
  m68k: defconfig: Clean up references to non-existing configs
2026-02-15 19:45:00 -08:00
Aaditya Kansal dc96f01d54 smb: client: terminate session upon failed client required signing
Currently, when smb signature verification fails, the behaviour is to log
the failure without any action to terminate the session.

Call cifs_reconnect() when client required signature verification fails.
Otherwise, log the error without reconnecting.

Signed-off-by: Aaditya Kansal <aadityakansal390@gmail.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
2026-02-15 18:35:34 -06:00
Shyam Prasad N 14f66f4464 cifs: some missing initializations on replay
In several places in the code, we have a label to signify
the start of the code where a request can be replayed if
necessary. However, some of these places were missing the
necessary reinitializations of certain local variables
before replay.

This change makes sure that these variables get initialized
after the label.

Cc: stable@vger.kernel.org
Reported-by: Yuchan Nam <entropy1110@gmail.com>
Tested-by: Yuchan Nam <entropy1110@gmail.com>
Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
2026-02-15 18:32:39 -06:00
Pavel Begunkov 56112578c7 io_uring: delay sqarray static branch disablement
io_key_has_sqarray static branch can be easily switched on/off by the
user every time patching the kernel. That can be very disruptive as it
might require heavy synchronisation across all CPUs. Use deferred static
keys, which can rate-limit it by deferring, batching and potentially
effectively eliminating dec+inc pairs.

Fixes: 9b296c625a ("io_uring: static_key for !IORING_SETUP_NO_SQARRAY")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-15 15:12:54 -07:00
Pavel Begunkov 6b34f8edf8 io_uring/query: add query.h copyright notice
Add a copyright notice to io_uring's query uapi header.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-15 14:55:44 -07:00
Pavel Begunkov c29214677a io_uring/query: return support for custom rx page size
Add an ability to query if the zcrx rx page size setting is available.

Note, even when the API is supported by io_uring, the registration can
still get rejected for various reasons, e.g. when the NIC or the driver
doesn't support it, when the particular specified size is unsupported,
when the memory area doesn't satisfy all requirements, etc.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-15 14:55:37 -07:00
Pavel Begunkov 7496e658a7 io_uring/zcrx: check unsupported flags on import
The imoorted zcrx registration path checks for ZCRX_REG_IMPORT, as it
should, but doesn't reject any unsupported flags. Fix that.

Cc: stable@vger.kernel.org
Fixes: 00d9148127 ("io_uring/zcrx: share an ifq between rings")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-15 14:55:29 -07:00
Linus Torvalds 26a4cfaff8 Merge tag 'docs-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux
Pull documentation fixes from Jonathan Corbet:
 "A handful of small, late-arriving documentation fixes"

* tag 'docs-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux:
  docs: toshiba_haps: fix grammar error in SSD warning
  Docs/mm: fix typos and grammar in page_tables.rst
  Docs/core-api: fix typos in rbtree.rst
  docs: clarify wording in programming-language.rst
  docs: process: maintainer-pgp-guide: update kernel.org docs link
  docs: kdoc_parser: allow __exit in function prototypes
2026-02-15 10:47:59 -08:00