vmalloc_exec() was removed by commit 7a0e27b2a0 ("mm: remove
vmalloc_exec").
So drop it from the rules.
No functional change.
Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>
pci_pool_alloc() and pci_pool_zalloc() were removed by commit
88dee3b0ef ("PCI: Remove unused pci_pool wrappers").
So drop the pci_pool_alloc rules.
No functional change.
Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>
- kmem_alloc() was removed by commit f078d4ea82
("xfs: convert kmem_alloc() to kmalloc()")
- kmem_zalloc() was removed by commit 10634530f7
("xfs: convert kmem_zalloc() to kzalloc()")
So drop the kmem_alloc rules.
No functional change.
Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>
- pci_alloc_consistent() and pci_zalloc_consistent() were removed by
commit 7968778914
("PCI: Remove the deprecated "pci-dma-compat.h" API")
- kmem_alloc() was removed by commit f078d4ea82
("xfs: convert kmem_alloc() to kmalloc()")
- kmem_zalloc() was removed by commit 10634530f7
("xfs: convert kmem_zalloc() to kzalloc()")
- kmem_zone_alloc() and kmem_zone_zalloc() were removed by commit
bae633a4a2 ("xfs: remove xfs_zone_{alloc,zalloc} helpers")
So drop them from the rules.
No functional change.
Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>
pci_alloc_consistent() and pci_free_consistent() were removed by commit
7968778914 ("PCI: Remove the deprecated "pci-dma-compat.h" API").
So remove the obsolete script.
Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>
False positives could be introduced due to allocations using the new
_obj functions. Add these to the "safe" rule accordingly.
False positives could also be introduced when the same variable
name has two possible types. Incorporate type information to avoid
reporting this case This does lead to false negatives when no type
information is available.
Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>
Reported-by: Ricardo Ribalda <ribalda@chromium.org>
The outer parentheses and the single-branch disjunction don't matter when
just matching and reporting a line. Eliminating them reduces the
complexity of the pattern to match and gives a performance improvement in
the non-patch cases, like the previous minmax change.
Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>
The 'looped' rule collects the returns inside a for loop to
prevent 'err' from reporting them. It searches every for loop in
the file, and on files with large loop bodies the search explodes.
For example, kernel/bpf/verifier.c runs for over 200 seconds,
almost entirely in 'looped' according to --profile. Since the
kernel .cocciconfig sets a 200 second timeout, coccicheck silently
skips the file.
To avoid this, collect the candidate returns first, so that
'looped' checks only those positions. 'err' then excludes what
'looped' found.
Every return that 'err' can report is also a candidate, so the
same returns are excluded as before and the output does not change.
A report-mode run over every .c file in the tree produces identical
output.
So verifier.c now finishes well within the timeout, in a few
seconds.
Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>
A cast on a call to an allocation function that is the body of a macro can
be useful, as it ensures tha the macro is used for allocating objects of
the right type. Add two new rules to ignore the macro case.
Suggested-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>
The old Coccinelle project URL is no longer available. Replace it with
the current Coccinelle homepage already referenced by
Documentation/dev-tools/coccinelle.rst.
Signed-off-by: Akira Aiura <akira.aiura.bj@hitachi.com>
Signed-off-by: Julia Lawall <julia.lawall@inria.fr>
As done previously for the ternary command, check that a file contains
the min or max if pattern before applying the minif and maxif rules.
Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>
The outer parentheses don't matter when just matching an returning a line.
Eliminating them reduces the complexity of the pattern to match and
gives a small performance improvement in the non-patch cases.
Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>
The rules that report an opencoded min() or max() search every
function body, even when the file contains nothing to find.
To avoid this, collect the candidates first and run the search only
when one exists. A candidate is any conditional expression whose
condition is a comparison.
Every opencoded min() or max() is also a candidate, so the same
opportunities are reported as before and the output does not
change. A report-mode run over every .c file in the tree produces
identical output.
Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>
The 'balanced' rule collects the locks that are taken and released
under the same condition, to prevent them from being reported as a
double lock. It runs on every file that contains a lock call.
To avoid this, collect the double-lock candidates first, so that
'balanced' runs only when one exists. The report then excludes what
'balanced' found.
Every double lock that can be reported is also a candidate, so the
same reports are made as before and the output does not change. A
report-mode run over every .c file in the tree produces identical
output.
Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>
Pull parisc architecture updates from Helge Deller:
- Drop PER_HPUX personality from UAPI headers
- Infinite loop fix when parsing IRQ value in eisa code
- Switch to use asm-generic/serial.h
- Prevent possible unaligned asm code in head.S
* tag 'parisc-for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
parisc: eisa: Fix infinite loop when parsing invalid IRQ value
parisc: Fix alignment of asm statements in head.S
parisc: eisa_eeprom: Add missing MODULE_DESCRIPTION()
parisc: Use asm-generic/serial.h
parisc: sba_iommu: Remove dead DEBUG_DMB_TRAP code
UAPI: Drop PER_HPUX personality
parisc: superio: Spelling s/Peterson/Petersen/
Pull s390 updates from Vasily Gorbik:
- Add a cpuidle driver with polling and enabled wait states using the
existing CPU idle infrastructure and idle governor to improve latency
for frequent sleep/wakeup cycles. Remove the obsolete tick delay
heuristic and generic arch_needs_cpu() hook. Add the corresponding
driver entry to MAINTAINERS
- Add kCFI support using the generic support provided by Clang
- Enable Clang CONTEXT_ANALYSIS for various architecture code and for
char, PCI, CIO and virtio drivers. Add required lock annotations,
exclude unsupported mm helpers and remove conditional PCI locking
- Fix secure storage access exception handling and reintroduce
DCACHE_WORD_ACCESS previously removed as a workaround
- Fix cpum_cf perf crashes when CPUs are brought online while per-task
events are active. Allocate and remove per-CPU counter data from CPU
hotplug callbacks
- Fix a deadlock when an s390dbf debug area is unregistered while one
of its debugfs files is being written to
- Fix MVIY_PERCPU() with binutils older than 2.39, where an assembler
macro silently omitted an instruction needed to repair interrupted
operations after CPU migration
- Remove/replace cond_resched() calls which are no-ops with the
supported s390 preemption models
- Fix AP queue depth and maximum message length decoding according to
the architecture. Current hardware is not affected, but future
hardware could report values which were handled incorrectly
- Reflect the configured CPU state in cpu_enabled_mask so deconfigured
CPUs are not presented as available for onlining
- Restore the vDSO GNU_EH_FRAME program header which was lost when the
build switched to direct linker invocation, and mark it read-only
- Add SCLP action qualifiers used by Spyre for card initialization,
recoverable error and telemetry reporting
- Move KMSAN interrupt flag helpers out of line to fix
-Wstatic-in-inline build warnings
- Use level-specific page table entry accessors for hugetlb entries and
ptep_get() when accessing crashed kernel memory in kdump
- Make forced AP bus rescans killable so that a user process blocked
behind an ongoing scan can still be terminated with SIGKILL
- Rework pkey ioctl error paths to remove duplicated cleanup code and
avoid freeing error pointers
- Allow the protected guest SWIOTLB buffer to be allocated outside the
first 2GB. Also enable dynamic SWIOTLB growth and the coherent atomic
pool fallback to improve I/O behavior when the initial pool is
exhausted
- Add program check statistics and spinlock contention tracepoints.
Increase the lockdep chain capacity to keep lockdep enabled for
complex code paths such as btrfs
- Simplify IPL, trap and syscall code and remove the obsolete
unistd_32.h generation entry
* tag 's390-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (59 commits)
s390/percpu: Fix MVIY_PERCPU() with older binutils
s390/debug: Fix deadlock during unregister
s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks
s390: Enable CONTEXT_ANALYSIS for various directories
s390/mm: Add __context_unsafe() attribute to gmap helper functions
s390/mm: Add __context_unsafe() attribute to do_secure_storage_access()
s390/sysinfo: Add context analysis attributes
s390/irqflags: Add out-of-line definitions of arch_local_irq_*() for KMSAN
s390/virtio: Enable CONTEXT_ANALYSIS
s390/cio: Enable CONTEXT_ANALYSIS
s390/vfio_ccw: Add __must_hold() attribute to vfio_ccw_sch_quiesce()
s390/pci: Enable CONTEXT_ANALYSIS
s390/pci: Rework __zpci_event_availability() to remove conditional locking
s390/pci: Rework __zpci_event_error() to remove conditional locking
s390/char: Enable CONTEXT_ANALYSIS
s390/con3215: Add __must_hold() attribute to raw3215_make_room()
s390/ap: Fix MAPML computation
s390/cio: Remove cond_resched() calls
s390: Remove cond_resched() calls
KVM: s390: Remove cond_resched() calls
...
Pull EFI updates from Ard Biesheuvel:
- Set a timeout for EFI runtime service completions, and declare the
firmware wedged if it is exceeded. Note that this requires special
handling in case the firmware does return after all
- Rate limit the efivarfs statfs() handler as the QueryVariableInfo()
runtime service can be costly
- Sanity check the size of struct properties_header on Mac/x86
- Tweak the prototype of efi_guid_to_str()
* tag 'efi-next-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi:
efivarfs: Rate limit statfs() handler
efi: apple-properties: validate setup data header length
efi: make efi_guid_to_str() take a const GUID pointer
efi/runtime-wrappers: retire the worker if a wedged call ever returns
efi/runtime-wrappers: honour EFI_RUNTIME_SERVICES in the non-blocking paths
efi/runtime-wrappers: bound the wait for EFI runtime service calls
efi/runtime-wrappers: check EFI_RUNTIME_SERVICES before using efi_rts_work
efi/runtime-wrappers: handle queue_work() failure with goto exit
efi/runtime-wrappers: factor out efi_rts_park_worker()
efi: fix stale reference to efi_recover_from_page_fault()
Pull more liveupdate updates from Mike Rapoport:
"Make boot time huge page allocation work nicely with kexec handover.
Today allocation of gigantic pages in HugeTLB cannot work reliably
with kexec handover (KHO):
- HugeTLB allocates gigantic pages using memblock and autoscaling of
KHO scratch accounts for these allocations. When gigantic pages
occupy half of the memory of more, KHO fails to allocate its
scratch memory.
- After kexec handover, memblock allocations exclusively use KHO
scratch that is not supposed to contain preserved memory. This
essentially blocks preservation of HugeTLB with gigantic pages.
Extend early memory pools available for KHO kernel with areas that are
guaranteed not to contain preserved memory"
* tag 'liveupdate-v7.3-rc1-20260823' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux: (21 commits)
kho: exclude hugetlb memory from scratch size calculation
memblock: add memblock_reserved_hugetlb_size()
memblock: make HugeTLB bootmem allocation work with KHO
memblock: always include KHO headers
kho: extend scratch
mm/mm_init: don't rely on memblock to get KHO scratch migratetype
kho: initialize preserved memory map radix tree earlier
kho: initialize kho_scratch pointer earlier in boot
kho: expose kho_scratch_overlap() to kexec_handover.h
kho: add kho_radix_init_tree()
kho: allow destroying KHO radix tree
kho: allow early-boot usage of the KHO radix tree
kho: add data argument to radix walk callback
kho: add callback for table pages
kho: add a struct for radix callbacks
kho: move all memory retrieval logic to kho_mem_retrieve()
kho: store incoming radix tree in kho_in
kho: disallow wide keys in radix tree
kho: make radix max key width more obvious
kho: generalize radix tree APIs
...
Pull mtd updates from Miquel Raynal:
"Raw NAND changes:
- Sunxi: Support added for the H616 compatible
- Qcom: Support added for the MDM9607 compatible
- Support for the Toshiba TC58NVG1S3H part
- GPMI: New debugfs entry to expose the chip geometry
- PL353: Timing updates and software ECC support have been fixed
SPI NAND changes:
- fmsh: Support added for FM25G{01,02}B chips
- HeYangTek: Support added for HYF1GQ4UDACAE
Aside from these main changes, there is a high load of misc fixes and
hardening changes, and exceptionally no SPI NOR change"
* tag 'mtd/for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (30 commits)
mtd: rawnand: sunxi: fix H6/H616 controller timings
mtd: rawnand: sunxi: describe tADL and tWHR delays
mtd: rawnand: sunxi: group controller delay tables
mtd: maps: remove dead select of MTD_CFI_BE_BYTE_SWAP
mtd: rawnand: gpmi: add debugfs entry for BCH geometry
mtd: rawnand: validate ONFI extended parameter page sections
mtd: rawnand: sunxi: add H616 MBUS DMA support
mtd: spinand: fmsh: fix FM25G01B/FM25G02B Quad I/O read dummy cycles
mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()
mtd: mpc5121_nfc: use platform for irq and ioremap
mtd: mtdoops: free page bitmap when the backing MTD is removed
mtd: mtdswap: Avoid freeing registered blktrans device twice
mtd: afs: validate v2 image info bounds
mtd: intel-dg: Fix runtime PM error path in probe
mtd: nand-omap2: Move omap_nand_ids[] to raw nand driver
mtd: rawnand: add Toshiba TC58NVG1S3H
mtd: nand: realtek-ecc: add missing MODULE_DEVICE_TABLE()
mtd: rawnand: qcom: Add MDM9607 compatible
mtd: rawnand: qcom: Make has_onfi_read_op separate from qpic_version2
mtd: rawnand: qcom: Make "aon" clock optional
...
Pull smb server updates from Namjae Jeon:
"This contains server updates focused on SMB2 command sequencing, SMB3
request replay and encryption, Apple Time Machine interoperability,
protocol-compatibility fixes validated with smbtorture, security
hardening, SMB Direct transport support, connection reliability, and
other correctness improvements.
New features:
- Implement the SMB2 command sequence window
Enforce the credit-based MessageId range for each connection,
rejecting out-of-window, duplicate, and wrapped sequence numbers.
This prevents invalid requests and same-channel replays from being
processed
- Add SMB3 request replay support
SMB3 clients may resend requests with SMB2_FLAGS_REPLAY_OPERATION
after a channel disconnect when the original response was lost.
Track the required channel and open state to safely handle durable
CREATE replays and make oplock, lease, and lock replays idempotent,
avoiding duplicate state changes and improving multichannel
reconnect reliability
- Add opt-in Apple Time Machine support
Implement the AAPL negotiation and related Finder, stream,
COPYCHUNK, sparse-file, CHANGE_NOTIFY, and RPC compatibility
required for Time Machine shares, allowing macOS backupd to use
ksmbd for backups
- Add per-share SMB3 encryption support
Allow individual shares to require SMB3 encryption by advertising
SMB2_SHAREFLAG_ENCRYPT_DATA in TREE_CONNECT responses and rejecting
unencrypted tree connects and plaintext requests for protected
shares
- Add SMB Direct RDMA encryption support
Extend SMB Direct to support SMB3 encrypted payloads over RDMA,
with transform negotiation and encryption/decryption for RDMA
READ/WRITE
Other changes:
- Parse and retain AppInstanceVersion contexts, enforce version
ordering, close older active handles for newer takeovers, and
reject invalid or unversioned opens according to the SMB2 semantics
- Accept durable reconnect requests that omit VolatileFileId when the
persistent ID and reconnect context identify the handle, while
continuing to reject explicit volatile-ID mismatches
- Fix SMB2/SMB3 protocol validation and security issues, including
request offsets, file and object IDs, IPC responses, output buffer
sizes, SMB3.1.1 binding validation, signing-required handling,
durable handles, ACLs, maximal access, and security information
- Fix heap out-of-bounds accesses, use-after-free bugs, memory leaks,
invalid pointer dereferences, and sensitive-data lifetime issues in
authentication, Kerberos, preauthentication, sessions, connections,
and module teardown
- Correct alternate-data-stream and named-stream handling, COPYCHUNK
behavior, sparse-file and compression attributes, allocated-range
queries, file trimming, duplicate extents, DOS attributes,
snapshots, normalized names, and partial information responses
- Fix locking, lease, oplock, durable reconnect, async request, and
CHANGE_NOTIFY races, including deferred-lock rollback, parent
directory lease notifications, and connection teardown lifetime
bugs
- Fix SMB3 encryption handling for compressed requests, expired
encrypted sessions, interim responses, bound multichannel
connections, and decryption failures
- Fix SMB3 multichannel session lookup and session state transitions
so changes are scoped to the correct bound connections and cannot
revive connections that are already shutting down
- Fix DACL access checks so ACE walks are bounded by the declared
DACL size, preventing data beyond the DACL boundary from being
interpreted during access validation
- Fix session accounting and lifetime issues, including session
counter updates during publication and removal, session leaks on
registration failure, and procfs creation diagnostics
- Improve TCP connection reliability by enabling TCP keepalive for
accepted connections and preserving TCP timers for kernel sockets,
preventing silent peers from holding connections indefinitely
- Fix smbdirect RDMA cleanup ordering for completion queues, QPs,
child sockets, and listener locking
- Improve async response framing, multi-iovec signing, RPC pipe
status handling, and ksmbd procfs monitoring for server, share,
connection, session, and open-file state
- Remove the obsolete DES crypto header and Kconfig dependency now
that NTLMv1 support has been removed
- Update the ksmbd repository URL in MAINTAINERS and add an
additional KSMBD reviewer"
* tag 'ksmbd-for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb: (142 commits)
MAINTAINERS: update ksmbd repository URL
MAINTAINERS: add myself as KSMBD reviewer
smb: server: remove unused DES crypto header
smb: server: Remove obsolete "select CRYPTO_LIB_DES" from Kconfig file
ksmbd: keep TCP timers alive for kernel sockets
ksmbd: enable TCP keepalive for accepted connections
smb/server: fix session counter on session removal
smb/server: update session counter under sessions table lock
smb/server: fix session leak in ksmbd_session_register()
smb/server: warn if ksmbd_proc_create() fails
ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size
ksmbd: make RDMA encryption diagnostics conditional
ksmbd: add SMB Direct RDMA encryption transform
ksmbd: handle encrypted compressed requests
ksmbd: decrypt requests from expired encrypted sessions
ksmbd: disconnect on SMB3 decryption failure
ksmbd: encrypt interim responses to encrypted requests
ksmbd: scope session state changes to bound connections
ksmbd: fix encrypted request lookup on bound channels
ksmbd: add per-share SMB3 encryption enforcement
...
Add new entry pointing to the development branch so e.g. sashiko can
pick it as the baseline. The other entry is for linux-next and slightly
behind.
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Pull TPM update from Jarkko Sakkinen:
"Just a single bug fix"
* tag 'for-next-keys-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:
KEYS: trusted: Fix TPM teardown ordering
Pull non-MM updates from Andrew Morton:
- "ocfs2/dlm: bound peer-controlled lengths in the o2dlm" (Bryam
Vargas)
Validate and bound all input lengths and count fields in the o2dlm
migration and recovery receive handlers to prevent memory corruption
and kernel panics from malformed cluster messages
- "ocfs2: validate xattr entry bounds" (Cen Zhang)
Validate OCFS2 extended attribute entry name and value bounds during
metadata reads to prevent out-of-range memory accesses during
retrieval or listing operations.
- "taskstats: fix cgroupstats invalid fd handling and add selftests"
(Yiyang Chen)
Return -EBADF when cgroupstats receives an invalid file descriptor to
prevent caller hangs and misleading success ACKs. Add a kselftest to
validate valid cgroup v1 queries and verify proper error handling
across different Netlink flag combinations.
- "misc lib/raid/ improvements v2" (Christoph Hellwig)
Improve benchmark-based algorithm selection for the XOR and RAID6
libraries, add KUnit benchmark tests, and cleanup minor
implementation details.
- "ocfs2: cluster: o2hb_region_pin() fixes" (Joseph Qi)
Fix sleeping-in-atomic, lock order inversion and error-path cleanup
bugs in o2hb_region_pin() by releasing o2hb_live_lock across sleeping
configfs_depend_item() calls and using unlocked variants from
callback context. Ensure failed pin attempts properly decrement user
counts and unpin partially initialized heartbeat regions to prevent
memory leaks and unprotected states.
- "lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()"
(Vincent Mailhol)
Fix an off-by-one which could cause an out-of-bounds read.
- "ocfs2: harden heartbeat teardown races" (Cen Zhang)
Fix two OCFS2 heartbeat/o2net teardown races found by KASAN.
- "taskstats: tidy up the cpumask command path" *Bradley Morgan)
make two small cleanups in kernel/taskstats.c.
- "ocfs2: validate active orphan slots during inode read" (ZhengYuan
Huang)
Validate active ordinary and append-DIO orphan slots read from OCFS2
dinodes at the metadata boundary to prevent corrupted slot indices
from causing out-of-bounds array accesses.
- "ocfs2: bound-check both readdir re-validation scans" (Zhan Xusheng)
Enforce strict boundary checks on directory entry record lengths and
offset calculations during OCFS2 directory re-scans to prevent
out-of-bounds memory reads and directory position corruption.
* tag 'mm-nonmm-stable-2026-08-22-16-57' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (95 commits)
mailmap: fix bouncing address for Taniya Das
ocfs2: bound-check dir entries in the inline-data re-validation scan
ocfs2: bound-check dir entries in the readdir re-validation scan
squashfs: avoid thundering-herd cache wakeups
prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator
mailmap: update email address for Linfeng Sun
lib/interval_tree: fix allocation warning messages
checkpatch: add NOKPROBE_SYMBOL to the whitelist of lines that can occur immediately after functions
Squashfs: check block offset is not negative
signal: factor out the kernel reserved si_code check
ocfs2: fix readdir position truncation on 32-bit kernels
ocfs2: fix cached cluster count after suballocator reclaim
ocfs2: fix circular locking dependency in ocfs2_init_acl()
ocfs2: validate DIO orphan slot during inode read
ocfs2: validate orphan slot during inode read
selftests/prctl: fix non-anonymous VMA mapping in set-anon-vma-name test
MAINTAINERS: add IRC and patchwork for LTP
include/linux/list.h: mark list_add and __list_add as __always_inline
tools/mm: prevent page_owner_sort from truncating input
hung_task: update DETECT_HUNG_TASK_BLOCKER Kconfig help
...
* Raw NAND changes
- Sunxi: Support added for the H616 compatible
- Qcom: Support added for the MDM9607 compatible
- Support for the Toshiba TC58NVG1S3H part
- GPMI: New debugfs entry to expose the chip geometry
- PL353: Timing updates and software ECC support have been fixed
* SPI NAND changes
- fmsh: Support added for FM25G{01,02}B chips
- HeYangTek: Support added for HYF1GQ4UDACAE
Aside from these main changes, there is the usual load of misc fixes and
hardening changes.
Pull scheduler fixes from Ingo Molnar:
- Add missing cpus_read_lock locking to rebuild_sched_domains()
(Sebastian Andrzej Siewior)
- Fix division by zero bug in tg_cpus() that can be triggered with
empty cpusets (Jake Steinman)
* tag 'sched-urgent-2026-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
sched/fair: Floor tg_cpus() at 1
sched/topology: Add a cpus_read_lock to rebuild_sched_domains()
Pull futex fixes from Ingo Molnar:
- Enforce that the private futex owner shares the mm when attaching
(Kyle Zeng, Thomas Gleixner)
- Fix race on the initial mm->futex.phash.ref allocation (Hyunwoo Kim)
- Fix might_sleep() warning in futex_pivot_pending() (Peter Zijlstra)
* tag 'locking-urgent-2026-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
futex: Fix might_sleep() warning in futex_pivot_pending()
futex: Fix race on the initial mm->futex.phash.ref allocation
futex: Clean up the redundant exit/exec functions
futex/pi: Plug private futex exec() race
futex: Sanitize and document task_struct::futex::state transitions
futex/pi: Reject cross-mm private futex owners
Pull irqchip driver fixes from Ingo Molnar:
- Fix potential loss of interrupt in the renesas-rzg2l irqchip driver
(Biju Das)
- Fix a series of mostly corner case & error handling bugs in the
gic-v5 irqchip driver (Lorenzo Pieralisi)
- Fix hardware probing on the ast2700-intc irqchip driver (Michael
Pesa)
- Fix endianness bug on the Realtek Interrupt Controller (Rustam
Adilov)
- Fix incorrect sleeping allocation in critical section in the
ast2700-intc irqchip driver (Ryan Chen)
- Fix two bugs in the GICv5 irqchip driver: clear IRQ affinity properly
on teardown, and fix IRQ serialization bug on disabling the IRQ
(Sascha Bischoff)
* tag 'irq-urgent-2026-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
irqchip/irq-realtek-rtl: Use readl_be()/writel_be() instead of readl()/writel()
irqchip/gic-v5: Defer default SPI and LPI IAFFID programming
irqchip/gic-v5: Use logical cpu 0 irs_data for dynamic IST allocation
irqchip/gic-v5: Release IRS iomem region on driver init failure
irqchip/gic-v5: Fix gicv5_init_common() error paths
irqchip/gic-v5: Disable IRSes on probe failures
irqchip/gic-v5: Check for NULL LPI domain on domain teardown
irqchip/gic-v5: Check get_logical_index() return value in MADT IAFFID parsing
irqchip/gic-v5: Synchronize CPU interface disable
irqchip/gic-v5: Clear per-CPU IRS data on teardown
irqchip/ast2700-intc: Disable all interrupt merge banks on probe
irqchip/ast2700-intc: Avoid allocating in the irq_domain activate() callback
irqchip/renesas-rzg2l: Fix loss of interrupt
Pull timer fixes from Ingo Molnar:
- Fix timer debugobjects state corruption on CPU offlining (Thomas
Gleixner)
- Fix ARM get_cycles() regression causing boot hangs on certain ARM
configs (Nathan Chancellor)
* tag 'core-urgent-2026-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
timer: Keep debugobjects state consistent in migrate_timer_list()
* tag 'timers-urgent-2026-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
ARM: Fix get_cycles() after delay_read_timer() conversion
Pull unicode updates from Gabriel Krisman Bertazi:
"Two minor fixes:
- Remove the normalization function that we no longer use (David Alan
Gilbert))
- Fix a parsing issue in the encoding version argument passed by
filesystems (me)"
* tag 'unicode-for-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/krisman/unicode:
unicode: Properly reject invalid encoding version strings
utf8: Remove unused utf8_normalize
Pull capabilities update from Serge Hallyn:
"Just one trivial patch which corrects two comments to avoid kernel-doc
warnings"
* tag 'caps-pr-20260820' of git://git.kernel.org/pub/scm/linux/kernel/git/sergeh/linux:
capability: remove non-kernel-doc comments
Pull exfat updates from Namjae Jeon:
"A set of exfat fixes covering shared writable mappings, entry error
handling, allocation cleanup, FITRIM bounds, and locking:
- Fix valid_size extension over shared writable mappings by lazily
zeroing page-cache gaps and ensuring racing stores cannot be
overwritten or extend beyond valid_size
- Clean up partially written directory entries on add-entry failure
and safely free new directory clusters
- Free a newly allocated directory cluster when zeroing it fails
- Write the destination entry before removing the source entry during
rename, preserving the source if the destination write fails
- Keep FITRIM within the requested range, even when the free-space
search wraps around the allocation bitmap
- Fix truncated FS_IOC_GETFSLABEL results by passing the destination
buffer size in bytes to the UTF-16-to-NLS conversion
- Fix overflow in the cluster-to-dentry calculation, which could
cause readdir to stop early on large volumes
- Replace the per-inode truncate_lock with inode_lock, using shared
locking in bmap to serialize against concurrent truncation
- Update the exfat mailing list address in MAINTAINERS"
* tag 'exfat-for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat:
exfat: replace truncate_lock with inode_lock
exfat: keep FITRIM within the requested range
exfat: fix truncated volume labels returned by FS_IOC_GETFSLABEL
exfat: fix overflow in cluster-to-dentry conversion
exfat: clean up new entry on add entry failure
exfat: free new directory cluster if zeroing fails
exfat: write moved entry before removing source
MAINTAINERS: update mailing list address for exfat
exfat: fix valid_size extension over a shared writable mapping
Pull perf tools updates from Namhyung Kim:
"perf c2c:
- Add 'function view' in perf c2c report TUI (switched by pressing
'TAB' in the cacheline view) to organize samples around functions
rather than cachelines in 3-level hierarchy:
Level 1: Read-side function (sorted by estimated Cycles %)
Level 2: Contending writer functions (sorted by Store count)
Level 3: Shared cacheline addresses
Users can navigate the entries and fold/unfold using 'e' key. An
example output would look like below:
Shared Data Functions Table (19 entries, sorted on Cycles %)
Cycles Store
% count Function / Contending function / Cacheline
----------------------------------------------------------------------
+ 35.67% 876 + [k] cpupri_set
+ 24.31% 424 + [k] pull_rt_task
- 16.53% 555 - [k] dequeue_pushable_task
145 - [k] pull_rt_task
145 0xff2d0082809da080
139 - [k] enqueue_pushable_task
70 0xff2d00a2071f9640
69 0xff2d0082809da000
python module support:
- Extend "perf" python module so that it can be fully functional. The
goal is to run scripts directly, not by 'perf script' command. This
would give better performance as well as more control to build
standalone programs with UI.
- Add LiveSession helper (perf_live.py) to enable live event
collection directly from Python using perf.evlist and
perf.parse_events.
perf stat:
- Add --hide-zero-events option to suppress zero-count events
- Reject conflicting --field-separator and --json-output options
- Fix duplicate event output with --for-each-cgroup
perf sched latency:
- Add -H/--histogram and --hist-mode (log|linear) options to show
scheduler wait latency histograms
- Add --time option to filter analysis by time span in 'perf sched
latency'
ARM CoreSight:
- Synthesize callchains for instruction samples from CoreSight trace
using thread stack ('--itrace=g...')
- Support call indentation ('perf script -F +callindent') to display
call depth hierarchy on branch samples
- Decode ETE (Embedded Trace Extension) exception packets
Build system:
- Add 'make install-build-deps' target to install required packages
- Parallelize JSON and metric pre-computation in jevents.py for
faster builds
Vendor event/metric updates:
- Add Intel Nova Lake events and update tables for existing models
- Update AMD Zen 5 and Zen 6 core events
- Update Arm64 Tegra410 metrics and PowerPC hcalls
Internal changes and fixes:
- Harden trace-event and synthetic event parsing against corrupted
data
- Fix unwinding of multi-threaded processes in libdw unwinder
- Fix memory leaks in various commands and python bindings
- Speed up 'perf test' shell tests"
* tag 'perf-tools-for-v7.3-2026-08-21' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: (232 commits)
perf vendor events arm64: Fix Tegra410 Olympus event 0x0197
perf vendor events arm64: fix swapped MetricGroup for Tegra410 L1 prefetcher metrics
perf evlist: Warn when 'sleep' workload is used without system-wide (-a) option
perf c2c: document function view in perf-c2c man page
perf c2c: add function view browser UI and cacheline detail
perf c2c: build and finalize the function view hierarchy
perf c2c: add function view hierarchy entry creation
perf c2c: add function view stats merge and memory management
perf c2c: add HPP list parsing for function view columns
perf c2c: add column rendering for function view
perf c2c: add function view model skeleton
perf c2c: extract shared data structures into util/c2c.h
perf test sample-parsing: Validate PERF_FORMAT_GROUP values without LOST
perf dso: Replace assert with runtime check in dso__read_symbol()
perf dso: Guard against cache underflow on short reads in dso_cache__memcpy()
perf dso: Use stored fd error instead of stale errno in file_read() and file_size()
perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path()
perf dso: Guard against errno==0 when dso__get_filename() returns NULL
perf build: install-build-deps: add RHEL family devel package mapping
perf build: Remove leftover feature tests for removed cxx and clang support
...
Pull firewire updates from Takashi Sakamoto:
"Error handling, a potential bug fix, and KUnit tests:
- Handle failures when generating the contents of the configuration
ROM with parameters supplied by in-kernel implementations such as
unit drivers (Sreeraj S Kurup)
- Fix potential memory leak when an invalid self-ID sequence causes
an error while building the internal node tree (Abdun Nihaal)
KUnit tests have been added to trigger this case"
* tag 'firewire-updates-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394:
firewire: core: fix memory leak in error path of build_tree()
firewire: core: validate parent port count before allocating nodes in build_tree()
firewire: core: consolidate port counting in build_tree()
firewire: core: add KUnit tests for failure of tree building
firewire: core: add KUnit tests for successful tree building
firewire: core: add KUnit test skeleton for node tree
firewire: core: validate sub-block lengths in fw_core_add_descriptor()
firewire: core: validate overall descriptor length in fw_core_add_descriptor()
Pull livepatching updates from Petr Mladek:
- Move consistency checks to catch missing func->old_name before the
first access
- Allow to run livepatching selftests from top-level directory
* tag 'livepatching-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/livepatching/livepatching:
kbuild: unset sub_make_done before calling kselftest build system
livepatch: Fix NULL pointer dereference in klp_find_func()
Pull module updates from Petr Pavlu:
- Remove unnecessary module::args. Nowadays, no parameter-handling code
points into the module::args buffer. The last user of module::args in
xtensa/simdisk is updated and the data is then removed
- Add Rust support for boolean parameters. This will initially be used
by the Rust null block driver
- Fix clearing the current charp parameter value when setting a new one
fails due to an allocation failure
- Improve the debugging code for kmod (request_module()) duplicates.
Fix a potential use-after-free when waiting on a duplicate request
and make several general improvements to the code
- Fix the symbol size returned when looking up a data symbol through
kallsyms
- Smaller fixes and cleanups
* tag 'modules-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux:
params: fix charp corruption on allocation failure
module: validate string table section types
module/dups: Clean up includes
module/dups: Use strcmp() to compare module names
module/dups: Use scope-based cleanup helpers
module/dups: Avoid unnecessary kmod_dup_req allocations
module/dups: Fix use-after-free in kmod_dup_req lifetime handling
module/dups: Inform duplicate requests about the result directly
rust: module_param: support bool parameters
rust: module_param: return value by copy from `value`
module: Remove unnecessary module::args
xtensa/simdisk: Avoid referring to module::args
module: Remove unused DISCARD_EH_FRAME definition from module.lds.S
module: procfs: use matching type for accumulator in module_total_size()
module: use strscpy() to copy module names in stats and dup tracking
params: fix path of /sys/module/XYZ/parameters/ in comment
module/kallsyms: fix nextval for data symbol lookup
Pull MIPS updates from Thomas Bogendoerfer:
- switch gpio code to use swnodes
- rework of TXX9 gpio code
- enable multi-vpe for econet
- cleanups and fixes
* tag 'mips_7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux:
mips: dts: econet: Describe dual-VPE 34Kc processor
mips: econet: add multi-vpe capability to EN751221
MIPS: ptrace: Fix syscall skipping via PTRACE_SYSCALL
mips: remove dead select
MIPS: BCM47XX: Convert buttons to software nodes
ssb: gpio: Add and register software node for GPIO controller
bcma: gpio: Add and register software node for GPIO controller
MIPS: ip22-gio: Drop #include of <linux/mod_devicetable.h>
MIPS: TXX9: Clean up txx9_iocled_init()
MIPS: TXX9: Convert gpio_txx9 to dynamic GPIO base allocation
MIPS: TXX9: Drop GPIOLIB_LEGACY select
MIPS: TXX9: Use GPIO lookup table for iocled LEDs
MIPS: TXX9: Reduce TXX9_IOCLED_MAXLEDS to 3
MIPS: TXX9: rbtx4927: Use GPIO lookup table for TXx9 LEDs
MIPS: TXX9: rbtx4927: Use GPIO lookup table for SIO DTR
MIPS: TXX9: Remove txx9_7segled_*() forward declarations
MIPS: TXX9: Remove tx4938_spi_init() and txx9_spi_init()
MIPS: kernel: proc: Use two seq_putc() calls in show_cpuinfo()
Pull eCryptfs updates from Tyler Hicks:
- Hardening and fixes for maliciously crafted eCryptfs metadata in the
lower encrypted file
- Hardening and fixes for maliciously crafted userspace <-> kernel
miscdev communications
- Locking fixes for userspace <-> kernel miscdev communications
- Fix to display encrypted filename related mount options
- Clean up address_space_operations and reduce build dependencies by
moving to filemap_dirty_folio()
- Get rid of an unnecessary memory allocation in the inode update path
- Kernel-doc formatting corrections
* tag 'ecryptfs-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs:
ecryptfs: ecryptfs_kernel.h: clean up kernel-doc comments
ecryptfs: use filemap_dirty_folio for address space operations
ecryptfs: avoid heap allocation for inode size write
ecryptfs: show filename encryption options
eCryptfs: bound the packet-length peek to the user buffer
ecryptfs: reject too-small tag 70 packets
ecryptfs: fix tag 11 packet exact-fit size check
ecryptfs: pass packet set buffer size to parser
ecryptfs: hold msg ctx list lock when cleaning daemon queue
ecryptfs: release message context on send failure
ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet
Pull Landlock update from Mickaël Salaün:
"This improves observability with Landlock tracepoints support, which
required some refactoring for dedicated domain types and common
helpers shared with audit code.
A LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS flag is also added to improve
process-wide domain enforcement consistency.
Whiteout files are now correctly handled and tested, and a few other
fixes"
* tag 'landlock-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: (34 commits)
landlock: Document tracepoints
selftests/landlock: Add landlock_enforce_domain trace tests
selftests/landlock: Add scope and ptrace tracepoint tests
selftests/landlock: Add network tracepoint tests
selftests/landlock: Add filesystem tracepoint tests
selftests/landlock: Add trace event test infrastructure and tests
landlock: Add tracepoints for ptrace and scope denials
landlock: Add landlock_deny_access_fs and landlock_deny_access_net
landlock: Add tracepoints for rule checking
landlock: Add landlock_enforce_domain tracepoint
landlock: Add create_domain and free_domain tracepoints
landlock: Add landlock_add_rule_fs and landlock_add_rule_net tracepoints
landlock: Add create_ruleset and free_ruleset tracepoints
landlock: Consolidate access-right and scope names in a shared header
landlock: Decouple the per-denial logging decision from CONFIG_AUDIT
landlock: Split denial logging from audit into common framework
landlock: Split struct landlock_domain from struct landlock_ruleset
landlock: Move domain query functions to domain.c
landlock: Prepare ruleset and domain type split
samples/landlock: Add LANDLOCK_RESTRICT_SELF_NO_NEW_PRIVS to sampler
...
Pull cifs maintainer update from Paulo Alcantara.
* tag 'cifs-maintainer-switch-7.3-rc1' of https://git.manguebit.org/linux:
MAINTAINERS: Replace Steve French as CIFS maintainer
Pull MMC updates from Ulf Hansson:
"MMC core:
- Reject invalid perdev_minors for the block device before division
- Document DT fixed-layout NVMEM provider support for eMMC cards
MMC host:
- Convert a couple of plain text DT bindings to the yaml format
- bcm2835: DMA mapping improvements
- cqhci: Fix sparse warnings for endian conversions
- dw_mmc: Stop and complete DMA also in busy state
- dw_mmc-rockchip: Add support for the RV1106 variant
- litex_mmc: Add dynamic bus width support
- moxart: Propagate error for DMA completion timeout
- pxamci: Remove PXA remnants for the PXA93x support
- rtsx_usb_sdmmc: Avoid USB I/O in runtime autosuspend
- rtsx_usb_sdmmc: Suppress false CD after init timeout
- sdhci_am654: Add Judith Mendez as maintainer
- sdhci-esdhc-mcf: Do not use readl()/writel() on ColdFire
- sdhci-msm: Extend the DT bindings for ICE
- sdhci-tegra: Add support for Tegra264/Tegra238 variants
- sunxi: Add support for the Allwinner A733 variant
- via-sdmmc: Clean up card detect work at remove and in probe error path"
* tag 'mmc-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (35 commits)
ARM: PXA: Fix build error for PXA93x
dt-bindings: mmc: sunxi: add compatible string for Allwinner A733 MMC0/1/2
dt-bindings: mmc: Document fixed-layout NVMEM provider support
mmc: sdhci-tegra: Add Tegra264 SoC data
dt-bindings: mmc: tegra: Document Tegra264 SDHCI
mmc: sdhci-tegra: Add Tegra238 SoC data
dt-bindings: mmc: tegra: Document Tegra238 SDHCI
mmc: omap_hsmmc: use platform_get_irq_optional for wake IRQ
mmc: via-sdmmc: cancel card-detect work on remove
mmc: via-sdmmc: stop card-detect handling on probe failure
mmc: moxart: use platform helpers for resource and IRQ
mmc: host: Remove redundant dev_err()/dev_err_probe()
mmc: bcm2835: DMA mapping improvements
mmc: dw_mmc: move declaration of dw_mci_pmops
dt-bindings: mmc: rockchip-dw-mshc: Add RV1106 compatible
mmc: rtsx_usb_sdmmc: suppress false CD after init timeout
misc: rtsx_usb: avoid USB I/O in runtime autosuspend
mmc: sdhci-of-dwcmshc: Log eMMC reset calls
mmc: block: reject invalid perdev_minors before division
mmc: sdhci-of-ma35d1: add missing MODULE_DEVICE_TABLE()
...
Pull RDMA updates from Jason Gunthorpe:
"About the normal size, still a lot of AI bug fixes and so on, but some
interesting new functionality too:
- Assorted locking, bounds-checking, cleanup, and error-path fixes
across UCMA/CMA, bng_re, bnxt_re, cxgb4, EFA, ERDMA, HFI1, HNS,
ionic, iRDMA, mlx4/mlx5, RXE, SIW, SRP/SRPT, and iSER target.
- netlink report for max # of supported resources
- get_zeroed_page()/etc removal
- Robust udata for ionic
- Allow unique RDMA device names per network namespace
- Completion counters and v2 admit queue support for EFA
- UC QP support for MANA
- Completion timestamps for ionic
- Harden uverbs data validation and resource lifetime handling,
fixing several core use-after-free conditions.
- bnxt_re toggle-page ownership and lifetime bug fixes
- dmabuf SRQ support for mlx5"
* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (160 commits)
RDMA/ucma: Allow path records to exactly fit the output buffer
RDMA/uverbs: Guard legacy bundles without method_elm
RDMA/efa: Add support for 128B admin v2 SQ entry
RDMA/efa: Generalize the admin SQ
RDMA/efa: Decouple admin command payload from admin header
RDMA/rxe: Fix OOB in free_rd_atomic_resources()
RDMA/cma: Fix WARNING in res_to_rt
RDMA/cxgb4: Free debugfs on registration failure
RDMA/cxgb4: Cancel reg_work before freeing device on remove
RDMA/ucma: Lock the handler in ucma_set_ib_path()
RDMA/ucma: Lock the handler in ucma_write_cm_event()
RDMA/erdma: restrict the driver to little-endian systems
RDMA/ionic: Embed counter driver data in rdma_counter allocation
RDMA/ionic: Cap eq_count to the eth driver's interrupt vector budget
RDMA/siw: Fix use-after-free in siw_accept()
IB/isert: post the full-feature receive buffers after session registration
IB/isert: delay the final Login Response until the session is registered
RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ
RDMA/erdma: Hold QP references for AE and CM processing
RDMA/erdma: Hold CQ references when processing EQ events
...
Pull SCSI updates from James Bottomley:
"One new driver: leapraid (similar to mpi3mr but OK'd by Broadcom). The
usual suspects for driver updates (ufs, qla2xxx, smartpqi, zfcp, fnic,
ibmvfc) plus a few small core updates: a fix for an uninitialized sg
list pad bytes plus the removal of the dma mask check for max sectors.
The big update in the sd driver is mostly code refactoring for obscure
error leg handling"
* tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (195 commits)
scsi: fnic: Fix built-in NVMe/FC build
scsi: fnic: Fix invalid comparison for error
scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()
scsi: zfcp: Enable CONTEXT_ANALYSIS
scsi: zfcp: Add __must_hold() attribute to zfcp_qdio_sbal_get()
scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock
scsi: storvsc: Support manual scans for all Hyper-V targets
scsi: sd: Fix sd_done() sense handling condition
scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails
scsi: sd: Fix error handling in sd_probe() after large pool creation failure
scsi: leapraid: Add driver documentation
scsi: leapraid: Add new SCSI driver
scsi: ufs: Add support for the aggregated read query opcode
scsi: ufs: Use unsigned types for the BSG query
scsi: ibmvfc: Fix spelling mistake "Deleteing" -> "Deleting"
scsi: qla2xxx: Update version to 12.00.00.2607b2
scsi: qla2xxx: Bound i2c->length in I2C bsg handlers
scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers
scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]
scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak
...
Pull fbdev updates from Helge Deller:
"The usual bunch of many small fixes in various fbdev drivers, but
more interestingly the Vodoo3/4/5 cards will now be initialized even
without PC BIOS support and vintage Atari computers gain more color
depths and console acceleration on SuperVidel's SuperBlitter chips.
New features:
- Allow Vodoo3/4/5 card to be initialized without PC-BIOS (Daniel
Palmer)
- Add support for SuperVidel's SuperBlitter (Miro Kropacek)
- Add further video bit depths (Miro Kropacek)
- Detect default graphics card for console output on sticon/parisc
(Helge Deller)
Fixes:
- kyro: Validate overlay viewport coordinates (Danila Chernetsov)
- platinumfb: add error checking for ioremap calls (BingKun Yue)
- ssd1307fb: damage callback fixes (Hui Su)
- maxine: fix 64-bit build error and code cleanups (Randy Dunlap)
- omapfb: panel-dsi-cm: initialize lock before registering display
(Runyu Xiao)
- core: Clamp total_size to smem_len in read/write functions
(Mingyu Wang)
- uvesafb, tdxfb: failure path cleanups (Myeonghun Pak)
- udlfb: validate DisplayLink vendor descriptor items before usage
(Pengpeng Hou)
Cleanups:
- Convert multiple drivers to managed PCI and ioremap API (Shixiong Ou)
- Remove redundant dev_err() from multiple drivers (Pan Chuang)
- omap2: do not copy isr table (Andreas Kemnade)
- pvr2fb: correct user pointer annotation and sentinel initializer
(Florian Fuchs)
- mb862xxfb: silence possibly unused functions (Helge Deller)
- au1100fb: drop unneeded semicolon (Julia Lawall)
- clps711x-fb: remove unreachable code (Karl Mehltretter)
- viafb: refactor strcpy call (Ajith P V)
- sstfb: add missing MODULE_DEVICE_TABLE() (Pengpeng Hou)
- mb862xx: replace dead Kconfig select with dependency (Julian Braha)
Documentation fixes:
- fonts: fixup font.h kernel-doc warnings (Randy Dunlap)"
* tag 'fbdev-for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: (43 commits)
fbdev: atafb: Add support for SuperVidel's SuperBlitter
fbdev: atafb: Add support for further video bit depths on atafb:external
fbdev: atafb: Give atafb proper parent
fbdev: omapfb: panel-dsi-cm: initialize lock before registering display
fbdev: viafb: refactor strcpy and viafb_name
fbdev: platinumfb: add error checking for ioremap calls
fbdev: maxine: use MODULE_LICENSE() unconditionally
fbdev: maxine: fix maxinefb_init() return value
fbdev: maxine: fix 64-bit build error
fbdev: maxine: elide an unused function
fbdev: maxine: make functions static
fbdev: atyfb: Convert to managed PCI and ioremap API
fbdev: matrox: Convert to managed PCI and ioremap API
fbdev: savage: Convert to managed PCI and ioremap API
fbdev: nvidia: Convert to managed PCI and ioremap API
fbdev: aty128fb: Convert to managed PCI and ioremap API
fbdev: clps711x-fb: Remove unreachable unregister_framebuffer() call
fbdev: mb862xxfb: Silence possibly unused functions
sticon/parisc: Detect default STI graphics card for console output
fbdev: ssd1307fb: defer I2C transfers from damage callbacks
...
get_flat_ccs_offset() reads the base of the flat CCS storage from the
hardware, scales it by the number of enabled L3 nodes, and rounds the
result up to 128K. Everything below that offset is then handed to the
VRAM allocator as usable memory.
Rounding a limit that means "usable memory ends here" upwards publishes
whatever lies between the real base and the rounded one as free memory,
and that memory belongs to the compression hardware. The scaled value
has no reason to be 128K aligned, and on a Battlemage G21 with 16 GiB it
is not:
flat CCS base: raw 0x3fafff800, rounded 0x3fb000000
so the last 2 KiB of page 0x3fafff000 is CCS storage, in the allocator's
pool. Whatever is allocated there gets that tail overwritten by the
compression hardware, which needs no page-table entry, no buffer object
and no GPU submission to do it, and does it before userspace exists.
On this machine a Mesa VM's level-3 page table landed on that page on
every cold boot. It lost the entry covering the compositor's
batch-buffer heap, so the compositor's first submission faulted fetching
its batch and gdm restarted it forever: a black screen on an otherwise
working machine. Restarting gdm cleared it because the next VM's page
tables were allocated somewhere else.
Round down instead, to the page size the allocator works in. On this
machine that excludes exactly one page.
Reading the reserved page afterwards shows what had been writing it:
[369] 0xcccc000000000000
[371] 0xcc77000000000000
[373] 0xcccc000000000000
[375] 0xcc77000000000000
compression metadata, two bytes per sixteen, sitting where the driver
used to hand out memory.
The assertion that should have caught this compares the offset against
GSMBASE - ccs_size for equality. That value is 128K aligned, so it
agrees with the rounded-up offset precisely when the base is not
aligned - the check cannot fail in the case it exists to catch, and is
compiled out unless CONFIG_DRM_XE_DEBUG is set. Replace it with one
that can fail: CCS storage must not run into GSM.
[ And this was a debug session from hell, enormously helped by an AI
doing much of the grunt-work.
I'd like to call it my tireless helper, but the AI several times
stated flat out that this was impossible and unsolvable and that we
should just write a report about it.
I suspect those things have been trained by people who may not be
quite as stubborn as I am.
But while the AI was ready to give up several times, it did keep
adding debug code and analyzing it faithfully when I pushed. So credit
where credit is due and I let the AI write the commit message above.
This is basically a one-liner fixing a bogus "round_up()" to a
"round_down()", but there were 24 patches adding more and more debug
information to this, and 18 kernel boot to finally narrow it down to
this. - Linus ]
Fixes: 3717339274 ("drm/xe/vram: fix ccs offset calculation")
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Pull hotfixes from Andrew Morton:
"8 hotfixes. 5 are cc:stable. 5 are for MM.
All are singletons, please see their changelogs for details"
* tag 'mm-hotfixes-stable-2026-08-19-21-33' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
mm/pagewalk: fix stale walk->action escaping walk_pmd_range()
mm, swap: don't free a hibernation slot that is in the swap cache
mm: memcg-v1: fix memsw and TCP failcnt accounting
mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()
mailmap: add entries for Guodong Xu
MAINTAINERS, mailmap: update email address for JP Kobryn
MAINTAINERS: remove git URL for Squashfs
memcg: keep folio's objcg same as its node
trusted_tpm_exit() drops the TPM chip reference and frees the digest
array before unregistering the trusted key type. key_type_lookup()
holds key_types_sem for reading until the key operation finishes, while
unregister_key_type() takes it for writing. It therefore provides the
synchronization point that must precede backend teardown.
The current order permits this interleaving:
CPU 0 CPU 1
trusted_tpm_exit() key_type_lookup("trusted")
put_device(&chip->dev) trusted_tpm_seal()
kfree(digests) pcrlock()
unregister_key_type() tpm_pcr_extend(..., digests)
CPU 1 can consequently dereference the freed digest array. The chip can
also be released before callbacks stop using it.
KASAN reported:
BUG: KASAN: slab-use-after-free in tpm_pcr_extend+0x1f0/0x200
Read of size 2 at addr ffff88810872d000 by task poc/89
Call Trace:
tpm_pcr_extend+0x1f0/0x200
pcrlock+0x42/0x70 [trusted]
trusted_tpm_seal+0x1b6/0x570 [trusted]
trusted_instantiate+0x293/0x340 [trusted]
__key_instantiate_and_link+0xb2/0x2b0
__key_create_or_update+0x61e/0xb50
__do_sys_add_key+0x1b8/0x310
Allocated by task 88:
__kmalloc_noprof+0x1a7/0x490
do_one_initcall+0xa1/0x390
do_init_module+0x2df/0x840
Freed by task 90:
kfree+0x131/0x3c0
trusted_tpm_exit+0x59/0xa0 [trusted]
__do_sys_delete_module+0x346/0x510
Move unregister_key_type() before releasing either resource. This stops
new lookups and waits for in-flight key operations to finish before the
backend state is destroyed.
Fixes: 0b6cf6b97b ("tpm: pass an array of tpm_extend_digest structures to tpm_pcr_extend()")
Cc: stable@vger.kernel.org
Signed-off-by: Chengfeng Ye <nicoyip.dev@gmail.com>
Link: https://lore.kernel.org/r/20260731140925.2973492-1-nicoyip.dev@gmail.com
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Tested-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
