averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-09-22 09:34:56 +02:00
Code Issues Packages Projects Releases Wiki Activity
1,463,851 Commits 116 Branches 5,777 Tags
5d10d4e19e6daa487f0cd0ea6cba472325de92f9
Commit Graph
1463851 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Breno Leitao 5d10d4e19e mm/kmemleak: avoid soft lockup when scanning task stacks 
Patch series "mm/kmemleak: avoid soft lockup when scanning task", v3.

kmemleak_scan() scans every task stack under one rcu_read_lock() with no
reschedule point, which can trip the soft lockup watchdog on hosts with
very many threads.

That prints the following message, depending on the workload+host
configuration:

      watchdog: BUG: soft lockup - CPU#35 stuck for 22s! [kmemleak:537]
       scan_block
       kmemleak_scan
       kmemleak_scan_thread
       kthread

Patch 1 walks the tasks with find_ge_pid() so the scan reschedules between
tasks

Patches 2-3 let the scan loops stop early once a scan is interrupted.


This patch (of 3):

kmemleak_scan() walks every thread and scans its kernel stack under a
single rcu_read_lock() with no reschedule point.  On a host with very many
threads -- amplified by KASAN/lockdep in debug builds -- this loop can hog
a CPU long enough to trip the soft lockup watchdog:

  watchdog: BUG: soft lockup - CPU#35 stuck for 22s! [kmemleak:537]
   scan_block
   kmemleak_scan
   kmemleak_scan_thread
   kthread

A cond_resched() cannot be added directly: the loop runs inside an RCU
read-side critical section.

Walk the tasks one PID at a time with find_ge_pid(), taking the RCU read
lock only to look up and pin each task.  The stack is then scanned with no
lock held, so cond_resched() runs between tasks and the scan stops early
on scan_should_stop().  This follows the next_tgid()/task_seq_get_next()
iteration pattern and keeps each RCU critical section short.

Link: https://lore.kernel.org/20260615-kmemleak-stack-resched-v3-0-acecd7d7fd92@debian.org
Link: https://lore.kernel.org/20260615-kmemleak-stack-resched-v3-1-acecd7d7fd92@debian.org
Fixes: c4b28963fd ("mm/kmemleak: rely on rcu for task stack scanning")
Signed-off-by: Breno Leitao <leitao@debian.org>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Reviewed-by: Davidlohr Bueso <dave@stgolabs.net>
Reviewed-by: Lance Yang <lance.yang@linux.dev>
Reviewed-by: Oleg Nesterov <oleg@redhat.com>
Cc: Qian Cai <cai@lca.pw>
Cc: SeongJae Park <sj@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-07-28 21:11:49 -07:00
Ethan Nelson-Moore aa38f2454b mm: hugetlb: correct CONFIG_CGROUP_HUGETLB macro name in comment 
A comment in <linux/hugetlb_cgroup.h> incorrectly refers to
CONFIG_MEM_RES_CTLR_HUGETLB, which has never existed in the kernel,
instead of CONFIG_CGROUP_HUGETLB.  Correct it.

Discovered while searching for CONFIG_* symbols referenced in code but not
defined in any Kconfig file.

Link: https://lore.kernel.org/20260616000135.62815-1-enelsonmoore@gmail.com
Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Reviewed-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Lorenzo Stoakes <ljs@kernel.org>
Cc: Anthony Yznaga <anthony.yznaga@oracle.com>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Pedro Falcato <pfalcato@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-07-28 21:11:48 -07:00
Markus Elfring 24e9b62985 mm/vmalloc: use more common error handling code in pcpu_get_vm_areas() 
Use an existing label once more so that a bit of exception handling can be
better reused at the end of this function implementation.

This issue was detected by using the Coccinelle software.

Link: https://lore.kernel.org/453375c4-c3ca-4e6f-8880-0e6ff3c74ee3@web.de
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Reviewed-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Daniel Axtens <dja@axtens.net>
Cc: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-07-28 21:11:48 -07:00
Sang-Heon Jeon 73e28dccd0 arch_numa: remove redundant nodemask clears in numa_init() 
numa_init() clears numa_nodes_parsed, node_possible_map and
node_online_map, then calls numa_memblks_init(), which clears the same
nodemasks.  Nothing uses them in between.

These clears have been redundant since commit 767507654c ("arch_numa:
switch over to numa_memblks") made numa_init() use numa_memblks_init().

No functional change.

Link: https://lore.kernel.org/20260617163919.2544899-1-ekffu200098@gmail.com
Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Reviewed-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Cc: Danilo Krummrich <dakr@kernel.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: "Rafael J. Wysocki" <rafael@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-07-28 21:11:48 -07:00
Andrew Morton d623ed9ba0 csky: implement flush_cache_vmap() in C 
To avoid getting an unused-var warning from

	unsigned long start = something;
	...
	flush_cache_vmap(start, ...);

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202606291606.9h8aGniQ-lkp@intel.com/
Reviewed-by: Guo Ren <guoren@kernel.org>
Reviewed-by: Barry Song <baohua@kernel.org>
Cc: Andrew Donnellan <ajd@linux.ibm.com>
Cc: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Leo Yan <leo.yan@arm.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Uladzislau Rezki <urezki@gmail.com>
Cc: Wen Jiang <jiangwen6@xiaomi.com>
Cc: Wen Jiang <jiangwenxiaomi@gmail.com>
Cc: Will Deacon <will@kernel.org>
Cc: Xueyuan Chen <xueyuan.chen21@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-07-28 21:11:48 -07:00
Ben Dooks cdea9364e4 mm/page_alloc: don't build vm_numa_stat_key if CONFIG_NUMA=n 
vm_numa_stat_key is only exported if CONFIG_NUMA is set, so avoid the
following warning by guarding it in an #ifdef on CONFIG_NUMA:

mm/page_alloc.c:165:1: warning: symbol 'vm_numa_stat_key' was not declared. Should it be static?

Link: https://lore.kernel.org/20260618100614.1321950-1-ben.dooks@codethink.co.uk
Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Reviewed-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: SeongJae Park <sj@kernel.org>
Cc: Brendan Jackman <jackmanb@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-07-28 21:11:47 -07:00
Kefeng Wang a35d8872da mm: remove PageTransCompound() 
Remove the last user of PageTransCompound() in ksm and get rid of
PageTransCompound().

Link: https://lore.kernel.org/20260618113523.3913307-1-wangkefeng.wang@huawei.com
Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Xu Xin <xu.xin16@zte.com.cn>
Tested-by: Xu Xin <xu.xin16@zte.com.cn>
Acked-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: SeongJae Park <sj@kernel.org>
Cc: Chengming Zhou <chengming.zhou@linux.dev>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-07-28 21:11:47 -07:00
Kaitao Cheng 8725ae13f0 mm/percpu: avoid IO/FS reclaim in backing allocations 
Commit 9a5b183941 ("mm, percpu: do not consider sleepable allocations
atomic") allows sleepable GFP_NOIO and GFP_NOFS percpu allocations to take
pcpu_alloc_mutex.  This avoids premature allocation failures, but it also
makes the mutex visible to callers from constrained IO/FS contexts.

Thread A calls pcpu_alloc_noprof() with GFP_KERNEL and takes
pcpu_alloc_mutex.  Since the internal allocation is not constrained by
NOFS, it may enter FS reclaim while still holding pcpu_alloc_mutex,
creating a dependency like: pcpu_alloc_mutex -> fs_reclaim -> FS lock

At the same time, Thread B may already hold an FS lock and then call
pcpu_alloc_noprof() with GFP_NOFS.  It will try to acquire
pcpu_alloc_mutex and block, creating the reverse dependency: FS lock ->
pcpu_alloc_mutex

This can still form a potential deadlock cycle.

Avoid the dependency by restricting percpu backing allocations to
GFP_NOIO.  The public allocation still uses the caller's GFP context to
decide whether it may block, but the internal memory allocations performed
while pcpu_alloc_mutex is held cannot recurse into IO or FS reclaim.

Link: https://lore.kernel.org/20260618130414.96383-5-kaitao.cheng@linux.dev
Fixes: 9a5b183941 ("mm, percpu: do not consider sleepable allocations atomic")
Signed-off-by: Kaitao Cheng <chengkaitao@kylinos.cn>
Cc: Christoph Lameter <cl@gentwo.org>
Cc: Dennis Zhou <dennis@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Shivam Kalra <shivamkalra98@zohomail.in>
Cc: Tejun Heo <tj@kernel.org>
Cc: Uladzislau Rezki (Sony) <urezki@gmail.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-07-28 21:11:47 -07:00
Kaitao Cheng 17fcdd8699 mm/percpu: make cached pages lookup explicit 
pcpu_depopulate_chunk() only needs the temporary pages array that was
already allocated by an earlier successful population attempt.  Passing
GFP_KERNEL to pcpu_get_pages() in this path is misleading because the
depopulation path is not expected to allocate the array.

Teach pcpu_get_pages() to treat a zero gfp mask as a cached-only lookup
and add pcpu_get_pages_cached() for that use case.  This keeps allocation
on the populate path tied to the caller supplied GFP mask while making the
depopulate path's dependency on the cached array explicit.

Link: https://lore.kernel.org/20260618130414.96383-4-kaitao.cheng@linux.dev
Signed-off-by: Kaitao Cheng <chengkaitao@kylinos.cn>
Suggested-by: Dennis Zhou <dennis@kernel.org>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Christoph Lameter <cl@gentwo.org>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Shivam Kalra <shivamkalra98@zohomail.in>
Cc: Tejun Heo <tj@kernel.org>
Cc: Uladzislau Rezki (Sony) <urezki@gmail.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-07-28 21:11:47 -07:00
Kaitao Cheng 881adc51b2 mm/percpu: honor GFP constraints when populating chunks 
pcpu_alloc_noprof() derives pcpu_gfp from the caller supplied GFP mask and
passes it down to pcpu_populate_chunk().  pcpu_alloc_pages() already uses
that mask for backing page allocation.

However, the populate slow path still has internal allocations and page
table allocations which can lose the caller's allocation context.  The
temporary pages array is allocated by pcpu_get_pages() with GFP_KERNEL,
and pcpu_map_pages() maps the backing pages through
vmap_pages_range_noflush() using GFP_KERNEL.  The latter can allocate
vmalloc page tables implicitly, so a caller which deliberately uses
GFP_NOFS or GFP_NOIO can still enter FS or IO reclaim while populating a
percpu chunk.

This has the same concern as chunk creation: callers such as blk-cgroup
may use GFP_NOIO because they hold locks which can be involved in queue
freeze or IO reclaim dependencies.  If an allocation reaches the percpu
slow path and needs to populate previously unbacked pages, the internal
GFP_KERNEL allocations can defeat that context.

One possible case is blk-cgroup after commit 5d726c4dbe ("blk-cgroup:
fix possible deadlock while configuring policy").  blkg_conf_prep() now
serializes against blkcg_deactivate_policy() with q->blkcg_mutex, and
blkg_alloc() was changed to GFP_NOIO for that reason:

  CPU0: blkg_conf_prep()
    mutex_lock(q->blkcg_mutex)
    blkg_alloc(..., GFP_NOIO)
      alloc_percpu_gfp(..., GFP_NOIO)
        pcpu_alloc_noprof(..., GFP_NOIO)
          pcpu_populate_chunk(GFP_NOIO)
            pcpu_get_pages()
	    pcpu_map_pages()
              -> if the selected percpu chunk has unpopulated pages,
	         chunk population may do internal GFP_KERNEL allocations
              -> direct reclaim / writeback can issue IO to this queue
              -> IO waits because the queue is frozen

  CPU1: blkcg_deactivate_policy()
    blk_mq_freeze_queue(q)
    mutex_lock(q->blkcg_mutex)
      -> waits for CPU0
    ... unfreeze only happens after q->blkcg_mutex is acquired/released

So the concern is that the caller deliberately uses GFP_NOIO because it
may hold a lock which can be acquired after queue freeze, but the percpu
slow path can temporarily lose that allocation context.

Pass pcpu_gfp through pcpu_get_pages(), pcpu_map_pages() and
__pcpu_map_pages().  Apply the corresponding memalloc scope around
vmap_pages_range_noflush(), because vmalloc page table allocation does not
pass the GFP mask down explicitly.  Keep the first chunk setup path using
GFP_KERNEL, matching the previous early-init behavior.

Link: https://lore.kernel.org/20260618130414.96383-3-kaitao.cheng@linux.dev
Fixes: 9a5b183941 ("mm, percpu: do not consider sleepable allocations atomic")
Signed-off-by: Kaitao Cheng <chengkaitao@kylinos.cn>
Acked-by: Dennis Zhou <dennis@kernel.org>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Christoph Lameter <cl@gentwo.org>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Shivam Kalra <shivamkalra98@zohomail.in>
Cc: Tejun Heo <tj@kernel.org>
Cc: Uladzislau Rezki (Sony) <urezki@gmail.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-07-28 21:11:46 -07:00
Kaitao Cheng dec068de6d mm/vmalloc: honor GFP constraints in pcpu_get_vm_areas() 
Patch series "mm/percpu: Fix possible NOFS/NOIO reclaim recursion", v4.

Commit 9a5b183941 ("mm, percpu: do not consider sleepable allocations
atomic") allowed GFP_NOFS and GFP_NOIO percpu allocations to use
pcpu_alloc_mutex and the chunk creation slow path.  This restored the
allocation capability that was lost when those constrained allocations
were treated as atomic, but it also makes the percpu slow path visible to
callers from constrained reclaim contexts.

There are two related problems.

First, the create and populate slow paths do not fully preserve the
caller's allocation constraints.  pcpu_alloc_noprof() derives pcpu_gfp
from the caller supplied GFP mask and passes it down to the percpu backing
page allocator.  However, chunk creation calls pcpu_get_vm_areas(), and
chunk population can allocate temporary metadata or vmalloc page tables
while mapping backing pages.  Those internal allocations can still use
GFP_KERNEL, so a caller using GFP_NOFS or GFP_NOIO can enter unconstrained
FS or IO reclaim while holding pcpu_alloc_mutex.

One possible case is blk-cgroup after commit 5d726c4dbe ("blk-cgroup:
fix possible deadlock while configuring policy").  blkg_conf_prep() now
serializes against blkcg_deactivate_policy() with q->blkcg_mutex, and
blkg_alloc() uses GFP_NOIO because queue freeze and IO reclaim
dependencies can otherwise deadlock.  If the percpu slow path loses that
GFP_NOIO context, direct reclaim or writeback can issue IO to a frozen
queue while q->blkcg_mutex is held.

Second, allowing sleepable GFP_NOFS/GFP_NOIO allocations to take
pcpu_alloc_mutex means that unconstrained backing allocations made under
the mutex can create an FS/IO reclaim dependency against a constrained
caller which already holds an FS or IO lock and then waits for
pcpu_alloc_mutex.

This series fixes those issues in three steps:

  - pass the caller supplied GFP mask into pcpu_get_vm_areas() and use it
    for vmalloc metadata and KASAN shadow allocations;
  - pass the GFP mask through the chunk population path, including the
    temporary pages array and vmalloc page table allocation scope;
  - restrict percpu backing allocations performed while holding
    pcpu_alloc_mutex to GFP_NOIO, so they cannot recurse into IO or FS
    reclaim.

This keeps sleepable GFP_NOFS/GFP_NOIO percpu allocations working, while
avoiding the reclaim recursion risks introduced by making those
allocations eligible for the mutex-protected slow path.


This patch (of 4):

pcpu_alloc_noprof() derives pcpu_gfp from the caller supplied GFP mask and
passes it down to the backing percpu allocator.  However, when the percpu
vmalloc allocator has to create a new chunk, pcpu_create_chunk() calls
pcpu_get_vm_areas() to allocate the corresponding vmalloc areas.

pcpu_get_vm_areas() currently performs its internal allocations with
GFP_KERNEL, including vmap area metadata, vm_struct metadata and KASAN
vmalloc shadow population.  This means that a caller which deliberately
uses GFP_NOFS or GFP_NOIO can still enter FS or IO reclaim while creating
the vmalloc areas for a new percpu chunk.

One possible case is blk-cgroup after commit 5d726c4dbe ("blk-cgroup:
fix possible deadlock while configuring policy").  blkg_conf_prep() now
serializes against blkcg_deactivate_policy() with q->blkcg_mutex, and
blkg_alloc() was changed to GFP_NOIO for that reason:

  CPU0: blkg_conf_prep()
    mutex_lock(q->blkcg_mutex)
    blkg_alloc(..., GFP_NOIO)
      alloc_percpu_gfp(..., GFP_NOIO)
        pcpu_alloc_noprof(..., GFP_NOIO)
	  pcpu_create_chunk(GFP_NOIO)
	    pcpu_get_vm_areas()
              -> if percpu chunks are exhausted, chunk create may do
                 internal GFP_KERNEL allocations
              -> direct reclaim / writeback can issue IO to this queue
              -> IO waits because the queue is frozen

  CPU1: blkcg_deactivate_policy()
    blk_mq_freeze_queue(q)
    mutex_lock(q->blkcg_mutex)
      -> waits for CPU0
    ... unfreeze only happens after q->blkcg_mutex is acquired/released

So the concern is that the caller deliberately uses GFP_NOIO because it
may hold a lock which can be acquired after queue freeze, but the percpu
slow path can temporarily lose that allocation context.

Pass the caller supplied GFP mask from pcpu_create_chunk() to
pcpu_get_vm_areas(), and use it for the internal vmalloc metadata and
KASAN shadow allocations.

Link: https://lore.kernel.org/20260618130414.96383-1-kaitao.cheng@linux.dev
Link: https://lore.kernel.org/20260618130414.96383-2-kaitao.cheng@linux.dev
Fixes: 9a5b183941 ("mm, percpu: do not consider sleepable allocations atomic")
Signed-off-by: Kaitao Cheng <chengkaitao@kylinos.cn>
Reviewed-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
Reviewed-by: Shivam Kalra <shivamkalra98@zohomail.in>
Acked-by: Dennis Zhou <dennis@kernel.org>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Christoph Lameter <cl@gentwo.org>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Tejun Heo <tj@kernel.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-07-28 21:11:46 -07:00
Thomas Huth 5339ec29f9 mm: replace __ASSEMBLY__ with __ASSEMBLER__ in memory management header files 
While the GCC and Clang compilers already define __ASSEMBLER__
automatically when compiling assembly code, __ASSEMBLY__ is a macro that
only gets defined by the Makefiles in the kernel.  This can be very
confusing when switching between userspace and kernelspace coding, or when
dealing with uapi headers that rather should use __ASSEMBLER__ instead. 
So let's standardize now on the __ASSEMBLER__ macro that is provided by
the compilers.

This is a completely mechanical patch (done with a simple "sed -i"
statement).

Link: https://lore.kernel.org/20260619131830.229804-1-thuth@redhat.com
Signed-off-by: Thomas Huth <thuth@redhat.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Barry Song <baohua@kernel.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: Kairui Song <kasong@tencent.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Wei Xu <weixugc@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-07-28 21:11:46 -07:00
Chi Zhiling 32cd1afeca mm/filemap: reduce unnecessary xarray lookups in filemap_get_folios_contig() 
Apply the same optimization used in filemap_get_read_batch() by moving the
boundary check from the loop condition to before xas_next(), avoiding an
unnecessary xarray lookup and reducing branches in the fast path.

Link: https://lore.kernel.org/20260620062446.351475-3-chizhiling@163.com
Signed-off-by: Chi Zhiling <chizhiling@kylinos.cn>
Reviewed-by: Jan Kara <jack@suse.cz>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-07-28 21:11:45 -07:00
Chi Zhiling e1c345582c mm/filemap: reduce unnecessary xarray lookups when read cached pages 
Patch series "mm/filemap: reduce unnecessary xarray lookups".

This series optimizes xarray lookups in filemap by avoiding redundant
iterations after obtaining the last needed folio.  The boundary check is
moved to before advancing the xarray iterator, eliminating unnecessary
lookups and branches in the fast path.  This reduces the overhead of
filemap_get_read_batch() from 2.91% to 2.53% in 4k read tests.


This patch (of 2):

When reading small amounts of data from the page cache, only a single
folio is typically returned from filemap_read_get_batch().  In this case,
calling xas_advance() or xas_next() after adding the folio to the batch is
unnecessary and only introduces extra branches.

The same issue exists for large reads, where one additional xarray walk is
always performed before termination.

Quit the loop once we get the last folio in the range, so the final
redundant xarray advancement can be avoided.

The xas_next() does not update xa_index when xas->xa_node is set to
XAS_RESTART, so the put and retry path would not update xa_index, hence
the warning should therefore never trigger.

During the 4k reads test, the overhead of this function dropped from 2.91%
to 2.53%.

Link: https://lore.kernel.org/20260620062446.351475-2-chizhiling@163.com
Signed-off-by: Chi Zhiling <chizhiling@kylinos.cn>
Suggested-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Reviewed-by: Jan Kara <jack@suse.cz>
Cc: Chi Zhiling <chizhiling@kylinos.cn>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-07-28 21:11:45 -07:00
JP Kobryn 094470f3f4 mm/lruvec: trace LRU add drains and drain-all requests 
LRU add batches can be drained before they reach capacity.  This can be a
source of LRU lock contention, but it is not currently possible to
attribute these drains to callers with existing tracepoints.

Add mm_lru_add_drain to report the CPU and lru_add batch count when an
lru_add batch is drained.  This allows tracing to distinguish full drains
from partial drains and attribute them to the calling stack.

Add mm_lru_add_drain_all to capture callers of __lru_add_drain_all and
whether they set the force flag for all CPUs.  The tracepoint resembles
the signature of the enclosing function, but is needed because of
potential inlining.

Note that DECLARE_TRACE() is used for these new trace hooks to avoid
creating a new trace event ABI.

Link: https://lore.kernel.org/20260622185127.24579-1-jp.kobryn@linux.dev
Signed-off-by: JP Kobryn <jp.kobryn@linux.dev>
Reviewed-by: Barry Song <baohua@kernel.org>
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Baoquan He <baoquan.he@linux.dev>
Cc: Chris Li <chrisl@kernel.org>
Cc: Kairui Song <kasong@tencent.com>
Cc: Kemeng Shi <shikemeng@huaweicloud.com>
Cc: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Nhat Pham <nphamcs@gmail.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Wei Xu <weixugc@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-07-28 21:11:45 -07:00
Guopeng Zhang 4ac732c370 mm: memcg: remove stray text from obj_stock_pcp comment 
A patch filename was accidentally inserted into the comment describing
the nr_bytes field of struct obj_stock_pcp. Remove it.

No functional change.

Link: https://lore.kernel.org/20260623082614.81621-1-guopeng.zhang@linux.dev
Signed-off-by: Guopeng Zhang <zhangguopeng@kylinos.cn>
Acked-by: Harry Yoo (Oracle) <harry@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-07-28 21:11:45 -07:00
Igor Putko 253ed912fe mm/memory-failure: remove redundant initialization for hw_memory_failure 
The static variable 'hw_memory_failure' is implicitly initialized to
false.  Remove the explicit initialization to follow the Linux kernel
coding style.

Link: https://lore.kernel.org/20260623114743.4565-3-igorpetindev@gmail.com
Signed-off-by: Igor Putko <igorpetindev@gmail.com>
Reviewed-by: SeongJae Park <sj@kernel.org>
Reviewed-by: Lance Yang <lance.yang@linux.dev>
Acked-by: Miaohe Lin <linmiaohe@huawei.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Konovalov <andreyknvl@gmail.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Naoya Horiguchi <nao.horiguchi@gmail.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-07-28 21:11:44 -07:00
Igor Putko 731a624641 mm/kasan: remove redundant initialization for kasan_flag_write_only 
Patch series "mm: remove redundant static variable initializations".

This series removes explicit initializations of static bool variables to
false within the mm/ subsystem.  In C, static variables without explicit
initialization are implicitly placed in the .bss section and initialized
to zero/false by default.  Removing these explicit initializations follows
the Linux kernel coding style and avoids cluttering the data section.


This patch (of 2):

The static variable 'kasan_flag_write_only' is implicitly initialized to
false.  Remove the explicit initialization to follow the Linux kernel
coding style.

Link: https://lore.kernel.org/20260623114743.4565-1-igorpetindev@gmail.com
Link: https://lore.kernel.org/20260623114743.4565-2-igorpetindev@gmail.com
Signed-off-by: Igor Putko <igorpetindev@gmail.com>
Reviewed-by: SeongJae Park <sj@kernel.org>
Reviewed-by: Lance Yang <lance.yang@linux.dev>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Konovalov <andreyknvl@gmail.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Naoya Horiguchi <nao.horiguchi@gmail.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-07-28 21:11:44 -07:00
Dev Jain 8a28b50d6f mm/mprotect: drop 'sub' from batching context 
Shorten the name of page_anon_exclusive_sub_batch by dropping the
"sub-batch" context - the function itself doesn't need this context. 
Similarly, drop "sub" from sub_batch_idx, it is unnecessary and the usage
is clear enough.

Link: https://lore.kernel.org/20260623125723.2503832-3-dev.jain@arm.com
Signed-off-by: Dev Jain <dev.jain@arm.com>
Reviewed-by: Lance Yang <lance.yang@linux.dev>
Reviewed-by: Pedro Falcato <pfalcato@suse.de>
Reviewed-by: Lorenzo Stoakes <ljs@kernel.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Barry Song <baohua@kernel.org>
Cc: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: Baoquan He <baoquan.he@linux.dev>
Cc: Chris Li <chrisl@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Kairui Song <kasong@tencent.com>
Cc: Kemeng Shi <shikemeng@huaweicloud.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Nhat Pham <nphamcs@gmail.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-07-28 21:11:44 -07:00
Dev Jain 3ade884239 mm/swap: rename subpage->page in folio_dup_swap/folio_put_swap 
Patch series "mm: drop "sub" prefix from various places".

Patch 1 converts subpage->page : folios have pages, not subpages.

Patch 2 drops "sub" from a function and a variable because the context
is clear enough.


This patch (of 2):

Folios have pages, not subpages. Rename 'subpage' parameters to 'page'.

Link: https://lore.kernel.org/20260623125723.2503832-1-dev.jain@arm.com
Link: https://lore.kernel.org/20260623125723.2503832-2-dev.jain@arm.com
Signed-off-by: Dev Jain <dev.jain@arm.com>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Lance Yang <lance.yang@linux.dev>
Acked-by: Pedro Falcato <pfalcato@suse.de>
Reviewed-by: Lorenzo Stoakes <ljs@kernel.org>
Reviewed-by: Nhat Pham <nphamcs@gmail.com>
Reviewed-by: Kairui Song <kasong@tencent.com>
Reviewed-by: Barry Song <baohua@kernel.org>
Cc: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: Baoquan He <baoquan.he@linux.dev>
Cc: Chris Li <chrisl@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Kemeng Shi <shikemeng@huaweicloud.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-07-28 21:11:44 -07:00
Zenghui Yu 7698d52e33 tools/mm: add thp_swap_allocator_test binary to .gitignore 
Tell git to ignore the generated binary for thp_swap_allocator_test.c.

Link: https://lore.kernel.org/20260624150642.19749-1-zenghui.yu@linux.dev
Signed-off-by: Zenghui Yu <zenghui.yu@linux.dev>
Reviewed-by: SeongJae Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-07-28 21:11:43 -07:00
Joshua Hahn ac0f3be693 mm/memcontrol: remove unused for_each_mem_cgroup macro and cleanup 
Commit 7e1c0d6f58 ("memcg: switch lruvec stats to rstat") removed the
last caller of for_each_mem_cgroup back in 2021, and there have not been
any new callers since.  Remove the macro.

A comment in mem_cgroup_css_online has also been out of date since 2021,
when 2bfd36374e ("mm: vmscan: consolidate shrinker_maps handling code")
open-coded the for_each_mem_cgroup iterator.  Update the comment.

Finally, 99430ab8b8 ("mm: introduce BPF kfuncs to access memcg
statistics and events") added a second declaration for memcg_events to
include/linux/memcontrol.h, duplicating the one in mm/memcontrol-v1.h. 
Let's clean that up too.

No functional changes intended.

Link: https://lore.kernel.org/20260624183700.1152742-1-joshua.hahnjy@gmail.com
Signed-off-by: Joshua Hahn <joshua.hahnjy@gmail.com>
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
Reviewed-by: SeongJae Park <sj@kernel.org>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
 2026-07-28 21:11:43 -07:00
Linus Torvalds 62cc902415 Merge tag 'mm-hotfixes-stable-2026-07-27-14-18' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm 
Pull misc fixes from Andrew Morton:
 "13 hotfixes. All are cc:stable. 11 are for MM. All are singletons -
  please see the changelogs for details"

* tag 'mm-hotfixes-stable-2026-07-27-14-18' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
  fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes
  mm/hugetlb: fix list corruption in allocate_file_region_entries()
  mm: mglru: fix stale batch updates after memcg reparenting
  selftest: fix headers in fclog.c
  ocfs2: fix boundary check in ocfs2_check_dir_entry() to use buffer offset
  mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk()
  mm/util: don't read __page_2 for order-1 folios in snapshot_page()
  mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork()
  mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE
  fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes
  userfaultfd: wait on source PMD during UFFDIO_MOVE
  lib: test_hmm: use device devt for coherent device range selection
  mm/vmstat: fold stranded per-cpu node stats when a node comes online
 2026-07-27 14:36:26 -07:00
Linus Torvalds aa6fc3defb Merge tag 'for-next-keys-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd 
Pull keys fixes from Jarkko Sakkinen:

 - An unprivileged keyring whose keys collide through the
   description-chunk path can drive assoc_array node splitting
   into an out-of-bounds slot write. Fix it.

 - Fix the DCP trusted keys backend

* tag 'for-next-keys-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:
  assoc_array: trim the final shortcut word using the current chunk end
  keys: make keyring key-chunk byte order agree with keyring_diff_objects()
  keys: fix out-of-bounds read in keyring_get_key_chunk()
  KEYS: trusted: dcp: fix key_len validation and calc_blob_len() return type
 2026-07-27 14:14:11 -07:00
Linus Torvalds e895a6fc20 Merge tag 'erofs-for-7.2-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs 
Pull erofs fixes from Gao Xiang:
 "Fix a regression in page cache sharing which can cause a NULL pointer
  dereference, and limit LZMA stream memory usage on systems with many
  CPUs.

   - Keep a valid f_path for page cache sharing to fix a recent
     mincore() NULL pointer dereference

   - Limit LZMA stream pool size when too many processors are available

   - Sync up with Hongbo Li's latest email address"

* tag 'erofs-for-7.2-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs:
  erofs: cap LZMA stream pool size
  erofs: ensure valid f_path for page cache sharing
  MAINTAINERS: update Hongbo Li's email address
 2026-07-27 09:31:44 -07:00
Linus Torvalds e63c75f72f Merge tag 'pinctrl-v7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl 
Pull pin control fixes from Linus Walleij:
 "The most interesting commit is the S4 fix for AMD, which probably is
  helpful to a whole bunch of important machines.

   - Wakeup nits on the Qualcomm SC8280XP

   - Double-free issues on the device tree parsing error path

   - Fixup of the S4 sleep state handling on AMD pin control

   - Missing Kconfig select REGMAP_MMIO for the Microchip driver leading
     to compile stalls

   - Missing Kconfig select GENERIC_PINCONF for the Bitmain BM1880
     leading to compile stalls"

* tag 'pinctrl-v7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
  pinctrl: bm1880: add missing select GENERIC_PINCONF
  pinctrl-amd: Don't clear S4 wake bits at probe
  pinctrl: microchip-sgpio: add missing select REGMAP_MMIO
  pinctrl: devicetree: don't free uninitialized dev_name on error path
  pinctrl: qcom: sc8280xp: Add missing wakeup entries for GPIO143/151
  pinctrl: qcom: Unconditionally mark gpio as wakeup enable
 2026-07-27 08:48:48 -07:00
Michael Bommarito c9b47e6b23 erofs: cap LZMA stream pool size 
fs/erofs/decompressor_lzma.c sizes the module-global MicroLZMA stream
pool from num_possible_cpus() when the lzma_streams module parameter is
unset, then z_erofs_load_lzma_config() preallocates one image-supplied
dictionary per stream, accepting dictionaries up to 8 MiB.  On high-CPU
systems, a small EROFS image can pin hundreds of MiB of vmalloc-backed
decoder state until the erofs module is unloaded.

Impact: An EROFS image mounted by the system can pin up to 8 MiB of
vmalloc memory per LZMA stream, either as intended or unexpectedly.

Bound the default stream count by a new
CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS option, default 16, so the
worst-case default preallocation is 128 MiB if the number of CPUs is no
less than 16 while preserving the existing per-image dictionary limit.
An explicit lzma_streams module parameter is still honoured as-is, so
administrators who deliberately size the pool are not affected.

Fixes: 622ceaddb7 ("erofs: lzma compression support")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
 2026-07-27 12:31:11 +08:00
Gao Xiang 96b2dbbe58 erofs: ensure valid f_path for page cache sharing 
Previously, backing files for page cache sharing were set up with
f_path left as NULL (only f_inode was valid).  It worked, but a recent
mincore fix relies on f_path.mnt and crashes (found by "erofs/028" on
7.2-rc4):

 BUG: kernel NULL pointer dereference, address: 0000000000000018
 #PF: supervisor read access in kernel mode
 #PF: error_code(0x0000) - not-present page
 PGD 0 P4D 0
 Oops: Oops: 0000 [#1] SMP PTI
 CPU: 3 UID: 0 PID: 675528 Comm: fincore Not tainted 7.2.0-rc4-00002-g[]-dirty #1 PREEMPT(lazy)
 Hardware name: Red Hat KVM, BIOS 1.16.0-4.al8 04/01/2014
 RIP: 0010:__do_sys_mincore+0xc0/0x2c0
 ...

Specify valid paths using valid disconnected dentries together with
erofs_ishare_mnt instead of leaving f_path empty, so they are more
like real backing files in a pseudo filesystem and standard
backing_file_open() can be used directly.

Fixes: e187bc02f8 ("mm: do file ownership checks with the proper mount idmap")
Acked-by: Hongbo Li <hongbohbli@tencent.com>
Signed-off-by: Gao Xiang <xiang@kernel.org>
 2026-07-27 12:31:02 +08:00
Linus Torvalds f5098b6bae Linux 7.2-rc5 v7.2-rc5 2026-07-26 14:45:48 -07:00
Linus Torvalds 4235cb24ec Merge tag 'vfs-7.2-rc5.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs 
Pull vfs fixes from Christian Brauner:

 - vfs: Preserve the ACL_DONT_CACHE state in forget_cached_acl().

   ACL_DONT_CACHE is meant to be a permanent opt-out from ACL caching
   which FUSE relies on for servers that don't negotiate FUSE_POSIX_ACL.
   The helper replaced it with ACL_NOT_CACHED, silently re-enabling the
   cache, and as fuse doesn't invalidate the cache for such servers a
   properly timed get_acl() returned stale ACLs. Comes with a fuse
   selftest reproducing this.

 - pidfs:

     - Preserve PIDFD_THREAD when a thread pidfd is reopened via
       open_by_handle_at(). PIDFD_THREAD shares the O_EXCL bit which
       do_dentry_open() strips after the flags have been validated, so
       the reopened pidfd silently became a process pidfd. Comes with a
       selftest.

     - Add a pidfs_dentry_open() helper so the regular pidfd allocation
       path and the file handle path share the code that forces O_RDWR
       and reapplies the pidfd flags that do_dentry_open() strips.

     - Handle FS_IOC32_GETVERSION in the compat ioctl path.

     - Make pidfs_ino_lock static.

 - iomap:

     - Fix the block range calculation in ifs_clear_range_dirty() so a
       partial clear doesn't drop the dirty state of blocks the range
       only partially covers.

     - Support invalidating partial folios so a partial truncate or hole
       punch with blocksize < foliosize doesn't leave stale dirty bits
       behind.

     - Only set did_zero when iomap_zero_iter() actually zeroed
       something.

     - Guard ifs_set_range_dirty() and ifs_set_range_uptodate() against
       zero-length ranges where the unsigned last-block calculation
       underflows and bitmap_set() writes far beyond the ifs->state
       allocation.

     - Don't merge ioends with different io_private values as the merge
       could leak or corrupt the private data of the individual ioends.

 - exec:

     - Raise bprm->have_execfd only once the binfmt_misc interpreter has
       actually been opened. The flag was set as soon as a matching 'O'
       or 'C' entry was found. If the interpreter open failed with
       ENOEXEC the exec fell through to the next binary format with
       have_execfd raised but no executable staged and begin_new_exec()
       NULL derefed past the point of no return.

     - Fix an unsigned loop counter wrap in transfer_args_to_stack() on
       nommu. An overlong argument or environment string pushes bprm->p
       below PAGE_SIZE, the stop index becomes zero, and the loop never
       terminates, wrapping its counter and copying garbage from in
       front of the page array into the new process stack.

     - Make binfmt_elf_fdpic only honour the first PT_INTERP like
       binfmt_elf does. Each additional PT_INTERP overwrote the previous
       interpreter, leaking the name allocation and the interpreter file
       reference together with the write denial open_exec() took,
       leaving the file unwritable for as long as the system runs.

 - overlayfs:

     - Compare the full escaped xattr prefix including the trailing dot.
       An xattr like "trusted.overlay.overlayfoo" was misclassified as
       an escaped overlay xattr.

     - Check read access to the copy_file_range() source with the
       source's mounter credentials.

 - super: Thawing a filesystem whose block device was frozen with
   bdev_freeze() deadlocked. Dropping the last block layer freeze
   reference from under s_umount ends up in fs_bdev_thaw() which
   reacquires s_umount on the same task. Pin the superblock with an
   active reference instead and call bdev_thaw() without holding
   s_umount.

 - procfs: Return EACCES instead of success when the ptrace access check
   for namespace links fails.

 - afs: Use afs_dir_get_block() rather than afs_dir_find_block() for
   block 0 in afs_edit_dir_remove(), matching afs_edit_dir_add().

 - Push the memcg gating of ->nr_cached_objects() down into the btrfs
   and shmem callbacks instead of skipping every callback during
   non-root memcg reclaim. The blanket check short-circuited XFS whose
   inode reclaim hook is intentionally driven from per-memcg contexts to
   free memcg-charged slab.

 - eventpoll: Pin files while checking reverse paths.

   Since struct file became SLAB_TYPESAFE_BY_RCU a concurrent close
   could free and recycle the file under the check which then took and
   dropped the f_lock of whatever live file now occupies that slot.

* tag 'vfs-7.2-rc5.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (24 commits)
  super: fix emergency thaw deadlock on frozen block devices
  pidfs: make pidfs_ino_lock static
  eventpoll: pin files while checking reverse paths
  fs: push nr_cached_objects memcg gating into individual filesystems
  afs: Fix afs_edit_dir_remove() to get, not find, block 0
  iomap: prevent ioend merge when io_private differs
  iomap: add comments for ifs_clear/set_range_dirty()
  iomap: fix out-of-bounds bitmap_set() with zero-length range
  iomap: fix incorrect did_zero setting in iomap_zero_iter()
  iomap: support invalidating partial folios
  iomap: correct the range of a partial dirty clear
  fs/super: fix emergency thaw double-unlock of s_umount
  pidfs: handle FS_IOC32_GETVERSION in compat ioctl
  ovl: check access to copy_file_range source with src mounter creds
  proc: Fix broken error paths for namespace links
  pidfs: add pidfs_dentry_open() helper
  selftests/pidfd: check PIDFD_THREAD survives open_by_handle_at()
  pidfs: preserve thread pidfds reopened by file handle
  ovl: fix trusted xattr escape prefix matching
  selftests/fuse: add ACL_DONT_CACHE regression test
  ...
 2026-07-26 12:22:57 -07:00
Linus Torvalds 72841e8e83 Merge tag 'spi-fix-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi 
Pull spi fixes from Mark Brown:
 "Just a couple of small bits for the SpacemiT driver - one small fix,
  and a new compatible in the DT binding"

* tag 'spi-fix-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: dt-bindings: spacemit: add K3 SPI compatible
  spi: spacemit: Correct TX FIFO slot calculation
 2026-07-26 12:13:42 -07:00
Linus Torvalds e6bfeebfe1 Merge tag 'regulator-fix-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator 
Pull regulator fixes from Mark Brown:
 "One driver specific fix where one of the MediaTek drivers duplicated
  some core code buggily, and a core fix for an ordering issue on
  startup where we could end up configuring a voltage outside of
  constraints due to the order in which we applied constraints"

* tag 'regulator-fix-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
  regulator: core: clamp voltage constraints before applying apply_uV
  regulator: mt6358: use regmap helper to read fixed LDO calibration
 2026-07-26 11:52:30 -07:00
Linus Torvalds 09b2124a47 Merge tag 'char-misc-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc 
Pull char/misc driver fixes from Greg KH:
 "Here are a number of small char/misc/etc driver fixes for 7.2-rc5 that
  resolve a bunch of different reported issues. Included in here are:

   - rust_binder error message reporting fix

   - stratix10-svc firmware driver fixes

   - mei driver fix

   - intel_th hardware tracing driver fix

   - comedi driver fix

   - uio_hv_generic driver fix

   - ntsync selftest fix

   - nsm misc driver fix

   - some MAINTAINER file updates

  All of these have been in linux-next for over a week with no reported
  issues"

* tag 'char-misc-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  MAINTAINERS: Update wine-devel list address
  rust_binder: only print failure if error has source
  intel_th: fix MSC output device reference leak
  misc: nsm: pin the module while the device is open
  mei: bus: access mei_device under device_lock on cleanup
  misc: nsm: only unlock nsm_dev on post-lock error paths
  selftests: ntsync: correct CONFIG_NTSYNC name
  comedi: comedi_parport: deal with premature interrupt
  uio_hv_generic: Bind to FCopy device by default
  MAINTAINERS: Add Greg Kroah-Hartman to GPIB
  firmware: stratix10-svc: fix teardown order in remove to prevent race
  firmware: stratix10-svc: handle NO_RESPONSE in async poll
  firmware: stratix10-svc: fix FCS SMC call kernel-doc
  firmware: stratix10-svc: fix memory leaks and list corruption bugs
 2026-07-26 10:47:58 -07:00
Linus Torvalds 516e2cb010 Merge tag 'staging-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging 
Pull staging driver fixes from Greg KH:
 "Here are two small staging driver fixes for 7.2-rc5. They both resolve
  some reported bugs in the rtl8723bs staging driver and have been in
  linux-next for over a week with no reported issues"

* tag 'staging-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie()
  staging: rtl8723bs: fix inverted HT40 secondary channel offset
 2026-07-26 10:30:37 -07:00
Linus Torvalds 3d0a01cad2 Merge tag 'tty-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty 
Pull serial driver fixes from Greg KH:
 "Here are two small serial driver fixes for 7.2-rc5.  They are:

   - sc16is7xx get_direction() callback fix, which resolves a
     user-triggerable warning in the driver

   - NULL pointer dereference on some platforms using the 8250_mid
     serial driver

  Both have been in linux-next for over a week with no reported issues"

* tag 'tty-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  serial: sc16is7xx: implement gpio get_direction() callback
  serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms
 2026-07-26 10:25:14 -07:00
Linus Torvalds 79ba9db003 Merge tag 'usb-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb 
Pull USB fixes from Greg KH:
 "Here are some small USB fixes and new device quirks and ids:

   - usb storage quirk added

   - new usb serial device ids added

   - usb-serial device name leak and other bug fixes

   - small xhci driver fixes

   - normal batch of typec driver fixes for reported issues

   - usb-atm much-reported-by-syzbot fix for firmware download races

   - sysfs BOS device removal race fix

   - lots of usb gadget driver fixes for reported issues

   - other small USB driver fixes for other reported problems

  All of these have been in linux-next this past week, many of them much
  longer"

* tag 'usb-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (30 commits)
  usb: typec: ucsi: Correct teardown ordering in ucsi_init() error path
  USB: serial: io_edgeport: cap received transmit credits
  USB: serial: option: add TDTECH MT5710-CN
  USB: serial: io_ti: reject oversized boot-mode firmware
  USB: serial: mxuport: validate firmware header size
  usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect
  usb: typec: ucsi: yoga_c630: Remove redundant duplicate altmode handling
  usb: typec: ucsi: Add duplicate detection to nvidia registration path
  usb: typec: ucsi: Detect and skip duplicate altmodes from buggy firmware
  usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback
  usb: chipidea: fix usage_count leak when autosuspend_delay is negative
  usb: core: sysfs: add lock to bos_descriptors_read()
  usb: musb: omap2430: Do not put borrowed of_node in probe
  usb: core: port: Deattach Type-C connector on component unbind
  USB: storage: add NO_ATA_1X quirk for Longmai USB Key
  USB: serial: ftdi_sio: add support for E+H FXA291
  USB: serial: keyspan_pda: fix data loss on receive throttling
  usb: gadget: printer: fix infinite loop in printer_read()
  usb: gadget: f_midi: cancel pending IN work before freeing the midi object
  usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown
  ...
 2026-07-26 09:25:57 -07:00
Linus Torvalds 864be1277d Merge tag 'trace-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace 
Pull tracing fixes from Steven Rostedt:

 - Move rb_desc->nr_page_va before updating dynamic array

   The rb_descr->page_va is a dynamic array counted by nr_page_va. But
   the updating of the page_va[] is done before the nr_page_va is
   incremented causing a build with CONFIG_UBSAN_BOUNDS to flag it as an
   overflow.

   Move the increment of the counted by value before the array element
   is updated.

 - Propagate errors from remote event bulk updates

   The return value of trace_remote_enable_event() was not being checked
   by remote_events_dir_enable_write() where it would silently fail.
   Have it check the return value and propagate that back up to user
   space.

 - Fix resource leak on mmiotrace trace_pipe close

   The mmiotrace tracer was created in 2008 before the trace_pipe had a
   close callback to allow tracers to do clean up from trace_pipe open.
   The trace_pipe close cleanup callback was added in 2009 but the
   mmiotrace tracer was not updated. It had a hack to do the cleanup in
   the read call, where it may leak if user space did not read the
   entire buffer.

   Add a callback to mmiotrace trace_pipe close do to the cleanup
   properly.

 - Fix a possible NULL pointer dereference in the mmiotrace tracer

   If the mmio_pipe_open() fails to find a PCI device, it will set the
   hiter->dev pointer to NULL. The read function will blindly
   dereference that pointer. Fix the read call to check to see if that
   pointer is populated before dereferencing it.

 - Fix union collision of module and refcnt for dynamic events

   In 'struct trace_event_call', the 'module' pointer and the 'refcnt'
   atomic variable share the same memory space in a union. The filter on
   module logic only checked if the 'module' was set to determine if the
   event belonged to the module. As dynamic events are always builtin,
   it doesn't need the 'module' field of the structure and used a
   refcount. But the module filtering logic would then mistaken these
   dynamic events as a module and call module_name(event->module) on it.

   Add a check to see if the event is a dynamic event and if so, do not
   check it for being part of the given module.

 - Reset the top level buffer in selftests before running instances

   The ftracetest selftest initializes each instance before executing
   the tests. But it does not reset the top level buffer. Dynamic events
   are only added and removed by the top level so any left over dynamic
   events will not be removed by the reset in the instances.

   Left over dynamic events can cause the tests to incorrectly fail.
   Reset the top level buffer before running the instances.

 - Make the context_switch counter 64 bit

   The code to read user space for a system call trace event or for a
   trace_marker will disable migration, enable preemption, read user
   space into a per CPU buffer, disable preemption and enable migration
   again. It checks if the per CPU context switch counter to see if it
   changed, and if it did not, it would know that the per CPU buffer was
   not touched by another task.

   But the save counter was 32 bit and it would compare it to the 64 bit
   context_switch variable. A long running system could have the
   context_switch variable greater that 1<<32 in which case the compare
   will always fail. The compare will promote the 32 bit int saved value
   to 64 bit and compare it to the full 64 bit counter. Since the top 32
   bits of the saved value was zero, it would never match.

 - Fix a use-after-free of the event_enable trigger

   The event_enable trigger allows for enabling one event when another
   event is triggered. When the trigger is removed, it must go through a
   synchronization phase to make sure it is not triggered again. The
   trigger itself is delayed by the "bulk delay" logic that was recently
   added. But the code that frees the event_enable data used to rely on
   the trigger code to do the synchronization. Now that the code uses
   the call RCU functions (and a workqueue), that delay no longer is
   there.

   Add a callback private_data_free() function that allows triggers to
   clean up data after the synchronization phase has completed.

 - Move the module_ref counter into the delay callback

   Since an event of the event_enable trigger can enable an event for a
   module, it ups the module ref count for that event's module. This
   prevents the event from trying to enable an event that no longer
   exists and cause a use-after-free bug.

   The ref counter was set back down when the trigger was removed but
   not after thy synchronization phase. This could lead to the module
   data being accessed after module was unloaded.

   Move the module ref decrement into the private_data_free() callback
   of the event_enable trigger.

 - Add mutex to protect parser in ftrace filtering

   The set_ftrace_filter file uses a parsing descriptor that is
   allocated at open and modified by writes. If multiple threads were to
   write to the descriptor at the same time, it can corrupt the parser.

   Add a mutex around the modifications of the parser descriptor.

 - Fix possible corruption in perf syscall tracing

   The perf system call trace events can now read user space. To do so,
   the reads of user space enable preemption and disables it again.
   During this time that preemption is enabled, the task can migrate.
   The perf event list head is assigned via a per CPU pointer. It is
   done before the user space part is called. If the user space reading
   migrates the task to another CPU, then the head pointer is no longer
   valid.

   Re-assign the head pointer after the reading of user space to keep it
   using the correct data.

* tag 'trace-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  tracing: perf: Fix stale head for perf syscall tracing
  ftrace: Add global mutex to serialize trace_parser access
  tracing: Delay module ref count for "enable_event" trigger
  tracing: Fix use-after-free freeing trigger private data
  tracing: Fix context switch counter truncation
  selftests/ftrace: Reset triggers at top level before instance loop
  tracing: Fix union collision of module and refcnt for dynamic events
  tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev
  tracing: Fix resource leak on mmiotrace trace_pipe close
  tracing: Propagate errors from remote event bulk updates
  tracing/remotes: Fix page_va[] access before counter update in trace_remote_alloc_buffer()
 2026-07-26 09:15:59 -07:00
Linus Torvalds 86d1022b2c Merge tag 'm68knommu-fixes-on-top-off-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu 
Pull m68knommu fix from Greg Ungerer:

 - fix broken local SoC IO accesses for ColdFire

* tag 'm68knommu-fixes-on-top-off-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu:
  m68k: coldfire: fix breakage of missed IO access update
 2026-07-26 08:59:55 -07:00
Linus Torvalds 3f97818796 Merge tag 'x86-urgent-2026-07-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 
Pull x86 fix from Ingo Molnar:

 - Disable jump/lookup tables in the x86 boot decompressor code
   a bit more widely, because newer versions of LLVM started
   optimizing it a bit better and introduced run-time relocations
   in PIE code (Nathan Chancellor)

* tag 'x86-urgent-2026-07-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/boot/compressed: Disable jump tables
 2026-07-26 08:52:38 -07:00
Linus Torvalds a6671109d6 Merge tag 'smp-urgent-2026-07-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 
Pull SMP debug fixes from Ingo Molnar:

 - SMP-call fixes when CSD lock debugging is enabled (Chuyi Zhou)

* tag 'smp-urgent-2026-07-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  smp: Make CSD lock acquisition atomic for debug mode
  smp: Avoid invalid per-CPU CSD lookup with CSD lock debug
 2026-07-26 08:47:01 -07:00
Christian Brauner 749d7aa037 super: fix emergency thaw deadlock on frozen block devices 
do_thaw_all_callback() calls bdev_thaw() while holding sb->s_umount
exclusively. If the block device was frozen via bdev_freeze() dropping
the last block layer freeze reference calls fs_bdev_thaw() which
reacquires s_umount:

  do_thaw_all_callback(sb)
    super_lock_excl(sb)                     # holds sb->s_umount
    bdev_thaw(sb->s_bdev)
      mutex_lock(&bdev->bd_fsfreeze_mutex)
      # bd_fsfreeze_count drops 1 -> 0
      bd_holder_ops->thaw == fs_bdev_thaw
        get_bdev_super(bdev)
          bdev_super_lock(bdev, true)
            super_lock(sb, true)
              down_write(&sb->s_umount)     # same task: deadlock

The emergency thaw worker deadlocks against itself holding both
s_umount and bd_fsfreeze_mutex. That fscks any subsequent unmount,
freeze, or thaw of that filesystem and block device.

  [   81.878470] sysrq: Show Blocked State
  [   81.880140] task:kworker/0:1     state:D stack:0     pid:11    tgid:11    ppid:2      task_flags:0x4208060 flags:0x00080000
  [   81.884876] Workqueue: events do_thaw_all
  [   81.886656] Call Trace:
  [   81.887759]  <TASK>
  [   81.888763]  __schedule+0x579/0x1420
  [   81.890372]  schedule+0x3a/0x100
  [   81.891794]  schedule_preempt_disabled+0x15/0x30
  [   81.893848]  rwsem_down_write_slowpath+0x1ea/0x900
  [   81.895191]  ? __pfx_do_thaw_all_callback+0x10/0x10
  [   81.896528]  down_write+0xbd/0xc0
  [   81.897505]  super_lock+0x91/0x180
  [   81.898457]  ? __mutex_lock+0xa99/0x1140
  [   81.900748]  ? __mutex_unlock_slowpath+0x1f/0x400
  [   81.902069]  bdev_super_lock+0x5b/0x150
  [   81.903132]  get_bdev_super+0x10/0x60
  [   81.904042]  fs_bdev_thaw+0x23/0xf0
  [   81.904755]  bdev_thaw+0x82/0x100
  [   81.905484]  do_thaw_all_callback+0x2c/0x50
  [   81.906298]  __iterate_supers+0x5d/0x130
  [   81.907067]  do_thaw_all+0x20/0x40
  [   81.907739]  process_one_work+0x206/0x5e0
  [   81.908545]  worker_thread+0x1e2/0x3c0
  [   81.909339]  ? __pfx_worker_thread+0x10/0x10
  [   81.910171]  kthread+0xf4/0x130
  [   81.910799]  ? __pfx_kthread+0x10/0x10
  [   81.911528]  ret_from_fork+0x2e2/0x3b0
  [   81.912259]  ? __pfx_kthread+0x10/0x10
  [   81.913010]  ret_from_fork_asm+0x1a/0x30
  [   81.913806]  </TASK>

bdev_super_lock() even documents the violated requirement with
lockdep_assert_not_held(&sb->s_umount).

Acquiring bd_fsfreeze_mutex under s_umount also inverts the
bd_fsfreeze_mutex vs. s_umount ordering established by
bdev_{freeze,thaw}() and can thus ABBA against a concurrent block-layer
freeze even when the recursive path isn't hit.

Fix this by not holding s_umount around the bdev_thaw() loop at all. Pin
the superblock with an active reference instead as
filesystems_freeze_callback() does. The active reference keeps the
superblock from being shut down and so ->s_bdev stays valid without
holding s_umount. The block-layer-held freeze is dropped by
fs_bdev_thaw() with FREEZE_MAY_NEST | FREEZE_HOLDER_USERSPACE exactly as
a regular unfreeze would and thaw_super_locked() handles
filesystem-level freezes as before.

The emergency thaw path has deadlocked like this in one form or
another for a long long time but the current exclusively-held
shape dates back to commit [1] where thaw_bdev() already ended in
thaw_super() with s_umount held by do_thaw_all_callback().

Fixes: 08fdc8a013 ("buffer.c: call thaw_super during emergency thaw") [1]
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260723-work-super-emergency_thaw-v1-1-7c315c600245@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
 2026-07-26 17:08:52 +02:00
Linus Torvalds 3dab139d47 Merge tag 'rust-fixes-7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux 
Pull rust fixes from Miguel Ojeda:
 "Toolchain and infrastructure:

   - 'zerocopy' crates: update to v0.8.54 to fix a modpost error under
     'CONFIG_CC_OPTIMIZE_FOR_SIZE=y'.

     There are actually two updates in the PR: the one to v0.8.52 is
     fairly large and was originally not intended for a fixes PR, but the
     actual fix landed in the v0.8.54 one. Thus I included both here.

     The v0.8.52 update includes two things upstream added for us:
     '--cfg no_fp_fmt_parse' to avoid a local workaround, and the new
     'most_traits' feature.

     The good news is that, after these updates, the delta with upstream
     is now trivial: only an identifier prefix change and the SPDX
     parentheses.

   - Fix an objtool warning by adding one more 'noreturn' function for
     Rust 1.99.0 (expected 2026-10-01).

   - Clean up new 'semicolon_in_expressions_from_macros' lint errors for
     Rust 1.99.0 (expected 2026-10-01). The lint can be allowed, but it
     will be a hard error at some point in the future anyway, so clean it
     up now.

   - Locally allow new 'suspicious_runtime_symbol_definitions' lint for
     Rust 1.98.0 (expected 2026-08-20).

   - Globally allow 'clippy::unwrap_or_default' lint since it relies on
     optimizations -- under 'CONFIG_CC_OPTIMIZE_FOR_SIZE=y' it does not
     work well.

  'kernel' crate:

   - 'time' module: fix 'Delta::as_micros_ceil()' to round negative values
     correctly"

* tag 'rust-fixes-7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:
  rust: time: fix as_micros_ceil() to round correctly for negative Delta
  rust: device: avoid trailing ; in printing macros
  objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0
  rust: zerocopy: update to v0.8.54
  rust: zerocopy: update to v0.8.52
  rust: allow `clippy::unwrap_or_default` globally
  rust: allow `suspicious_runtime_symbol_definitions` lint for Rust >= 1.98
 2026-07-25 10:15:23 -07:00
Linus Torvalds ef9ce800df Merge tag 'perf-tools-fixes-for-v7.2-1-2026-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools 
Pull perf tools fixes from Arnaldo Carvalho de Melo:

 - Update header copies of kernel headers, including const.h, fs.h,
   perf_event.h, gfp_types.h, kvm.h, cpufeatures.h, rtnetlink.hp,
   msr-index.h, drm.h and socket.h

 - Add some build files related to BPF skels to .gitignore

* tag 'perf-tools-fixes-for-v7.2-1-2026-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools:
  tools headers: Sync KVM headers with the kernel sources
  tools headers: Sync UAPI linux/fs.h with the kernel sources
  perf beauty: Update copy of linux/socket.h with the kernel sources
  tools headers: Sync UAPI drm/drm.h with kernel sources
  tools arch x86: Sync the msr-index.h copy with the kernel sources
  tools headers x86 cpufeatures: Sync with the kernel sources
  tools headers: Sync linux/gfp_types.h with the kernel sources
  tools headers UAPI: Sync linux/rtnetlink.h with the kernel sources
  tools headers UAPI: Sync linux/const.h with the kernel sources
  perf bench bpf: Add missing .gitignore file
 2026-07-25 09:05:02 -07:00
Linus Torvalds d99d2a953a Merge tag 'firewire-fixes-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 
Pull firewire fix from Takashi Sakamoto:
 "Fix a bug in unit driver for RFC 2734 IPv4 over IEEE 1394.

  The driver failed to reassemble a complete datagram when it was stored
  across multiple buffer ranges in the list. Ruoyu Wang reported and
  fixed it"

* tag 'firewire-fixes-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394:
  firewire: net: Fix fragmented datagram reassembly
 2026-07-25 08:14:13 -07:00
Linus Torvalds 3fb11702e4 Merge tag 'loongarch-fixes-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson 
Pull LoongArch fixes from Huacai Chen:

 - fix build warnings and errors

 - move jump_label_init() before parse_early_param()

 - retrieve CPU package ID from PPTT when available

 - fix some bugs kgdb, BPF JIT and laptop platform driver bugs

* tag 'loongarch-fixes-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson:
  platform/loongarch: laptop: Explicitly reset bl_powered state when suspend
  platform/loongarch: laptop: Stop setting acpi_device_class()
  LoongArch: BPF: Fix memory leak in bpf_jit_free()
  LoongArch: BPF: Zero-extend signed ALU32 div/mod results
  LoongArch: Fix oops during single-step debugging
  LoongArch: Fix address space mismatch in kexec command line lookup
  LoongArch: Retrieve CPU package ID from PPTT when available
  LoongArch: Move jump_label_init() before parse_early_param()
  LoongArch: Fix build errors due to wrong instructions for 32BIT
  LoongArch: Increase TASK_STRUCT_OFFSET up to 2040 for 32BIT
 2026-07-25 08:10:13 -07:00
Benjamin Boortz dad6e107b3 pinctrl: bm1880: add missing select GENERIC_PINCONF 
drivers/pinctrl/pinctrl-bm1880.c initialises its pinconf_ops with
.is_generic = true, but that field is only present when
CONFIG_GENERIC_PINCONF is enabled (guarded by #ifdef in pinconf.h).
The Kconfig entry for PINCTRL_BM1880 never selects GENERIC_PINCONF,
so any config that enables CONFIG_PINCTRL_BM1880=y without
CONFIG_GENERIC_PINCONF=y fails to compile:

  drivers/pinctrl/pinctrl-bm1880.c:1288:10: error: 'const struct pinconf_ops' has no member named 'is_generic'

Found by randconfig testing on arm64; tinyconfig reproducer below.
Add the missing select to fix the build.

Fixes: 49bd61ebce ("pinctrl: Add pinconf support for BM1880 SoC")
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Boortz <bennib@mailbox.org>
Signed-off-by: Linus Walleij <linusw@kernel.org>
 2026-07-25 11:33:32 +02:00
Mario Limonciello ffe8a0c6b5 pinctrl-amd: Don't clear S4 wake bits at probe 
commit 6bc3462a0f ("pinctrl: amd: Mask wake bits on probe again")
introduced a regression where Wake-on-LAN no longer works after suspend
or shutdown on some AMD platforms.

Firmware-programmed S4 wake bits for devices like PCIe NICs using PCI
PME are cleared at probe, but nothing restores them. Unlike S0i3/S3 wake
sources that use enable_irq_wake() -> amd_gpio_irq_set_wake(), PCIe PME
does not use GPIO IRQ infrastructure and relies on firmware configuration.

The original intent of commit 6bc3462a0f ("pinctrl: amd: Mask wake
bits on probe again") was to clear spurious wake bits left by firmware
to prevent unwanted wakeups. However, S4 wake bits are used for
hardware-level wake sources like WoL that bypass the kernel's IRQ wake
API.

Fix by preserving S4 wake bits at probe and only clearing S0i3/S3 bits:
- Firmware-configured S4 wake sources (WoL) continue working
- Kernel maintains control of S3/S0i3 wake policy via set_wake()
- S3-only wake sources work correctly per commit f31f33dbb3 ("pinctrl:
  amd: Take suspend type into consideration which pins are non-wake")

The trade-off is that firmware-programmed spurious S4 wake bits remain
set, but this is less problematic than breaking WoL.

Fixes: 6bc3462a0f ("pinctrl: amd: Mask wake bits on probe again")
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
 2026-07-25 11:32:03 +02:00
Benjamin Boortz 25cb6e9a13 pinctrl: microchip-sgpio: add missing select REGMAP_MMIO 
The driver calls ocelot_regmap_from_resource() via <linux/mfd/ocelot.h>,
which internally uses devm_regmap_init_mmio() and requires REGMAP_MMIO.
The Kconfig entry does not select REGMAP_MMIO, causing a build failure
when no other driver in the config happens to pull in REGMAP_MMIO:

  include/linux/mfd/ocelot.h:34:24: error: implicit declaration of function 'devm_regmap_init_mmio'

Found by randconfig testing on arm64; tinyconfig reproducer below.

Fixes: 2afbbab45c ("pinctrl: microchip-sgpio: update to support regmap")
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Boortz <bennib@mailbox.org>
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Linus Walleij <linusw@kernel.org>
 2026-07-25 11:21:28 +02:00
Karl Mehltretter 015b5bcbcb pinctrl: devicetree: don't free uninitialized dev_name on error path 
dt_remember_or_free_map() duplicates dev_name for each map entry. If
kstrdup_const() fails, dt_free_map() frees dev_name in all num_maps
entries, including entries that have not been initialized.

Some pinctrl drivers, including pinctrl-imx, allocate the map with
kmalloc() and leave dev_name for the core to initialize. The untouched
entries therefore contain uninitialized data which is passed to
kfree_const().

Reproduced on qemu's mcimx6ul-evk (pinctrl-imx) with failslab injection
while binding the pinctrl-consuming device, under KASAN:

  BUG: KASAN: double-free in dt_free_map+0x34/0xa4
  Free of addr c425a900 by task init/1
   kfree from dt_free_map+0x34/0xa4
   dt_free_map from dt_remember_or_free_map+0x184/0x198
   dt_remember_or_free_map from pinctrl_dt_to_map+0x33c/0x4c8
   pinctrl_dt_to_map from create_pinctrl+0x9c/0x5c0

Initialize all dev_name fields to NULL before duplicating the device
name, making the full-map cleanup safe after a partial failure.

Fixes: be4c60b563 ("pinctrl: devicetree: Avoid taking direct reference to device name string")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
 2026-07-25 11:17:23 +02:00
Linus Torvalds 0ce37745d4 Merge tag 'block-7.2-20260724' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux 
Pull block fixes from Jens Axboe:

 - Fix a ublk recovery hang, where END_USER_RECOVERY without a
   successful START_USER_RECOVERY could be satisfied by a stale
   completion latch

 - Fix a stack out-of-bounds read in the CDROMVOLCTRL ioctl

 - MAINTAINERS email address update for Roger Pau Monne

* tag 'block-7.2-20260724' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  MAINTAINERS: update my email address
  cdrom: fix stack out-of-bounds read in CDROMVOLCTRL
  ublk: wait on ublk_dev_ready() instead of ub->completion
 2026-07-24 20:02:58 -07:00