53153 Commits

Author	SHA1	Message	Date
Linus Torvalds	77ae27fd98	Merge tag 'printk-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux ... Pull printk updates from Petr Mladek: - Prevent a possible out-of-bound access and a use-after-free in rather theoretical situations - Make no_hash_pointers take effect early - Some fixes and clean up of the ratelimit KUnit test * tag 'printk-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: printk: Handle pre-enabled consoles in the top-level register_console() printk: Fix possible console use-after-free lib/tests: test_ratelimit: fix stress test thread lifecycle and leak lib/vsprintf: Make no_hash_pointers take effect early	2026-08-20 15:34:31 -07:00
Linus Torvalds	6439079365	Merge tag 'probes-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace ... Pull probes updates from Masami Hiramatsu: "BTF typecasting and variable fetch enhancements: - Typecast support across probe events: Extended BTF typecasting syntax (e.g., (STRUCT)PARAM->MEMBER) to kprobes, uprobes, and fprobes on function entry and return - Nested typecasts: Added support for chaining and nesting typecasts up to 3 levels, including casting registers and stack variables - Field specifier option: Added (STRUCT,FIELD) syntax to emulate container_of(), allowing retrieval of parent structures from member pointers - $current variable support: Introduced $current special variable to access the running task_struct via BTF dereferencing - Per-CPU variable access: Added this_cpu_read() and this_cpu_ptr() fetcharg methods to trace CPU-local data safely - Fetcharg bytecode dumper: Added CONFIG_PROBE_EVENTS_DUMP_FETCHARG to dump the compiled fetcharg bytecode instructions as comments in dynamic_events - Extended symbol name handling: Removed the MAX_COMMON_HEAD_LEN limit and extended MAX_ARGSTR_LEN to 256 bytes, enabling probing of long symbols, mangled Rust symbols and complex BTF expressions - eprobe variable syntax: Allowed eprobes to reference event fields directly without requiring a '$' prefix - Cleanup unused parameters, redundant codes, duplicate macros and pointer arithmetic - Use a ternary operator for simplifying fetch_type_from_btf_type() Expanded boot time dynamic probe support: - Add boot-time tracing configuration support for event probes (eprobes), function probes (fprobes), and tracepoint probes (tprobes) - Allow comment lines ('#') in dynamic_events file Optimization, robustness, and cleanups: - Simplify fprobe_remove_ips() by reusing graph and ftrace helpers - Remove __packed attribute from struct __fprobe_header to avoid unaligned memory access penalties on RISC architectures - Remove redundant memset() calls in perf event probe handlers - Replace legacy __ASSEMBLY__ with __ASSEMBLER__ in header files Selftests & refactoring: - Refactor parse_probe_arg() and parse_probe_vars(), and eliminate recursion in probe argument parsing to protect kernel stack depth - Add selftests for BTF typecasts and module probing without module prefixes - Force LC_ALL=C in ftracetest to prevent test failures on localized systems - Refactor btf_type_skip_modifiers() to remove ignored id parameter - Sort ERRORS list in trace_probe.h alphabetically - Fix typo in fprobe docs, and trace_fprobe function name - Rename FETCH_OP_DATA to FETCH_OP_IMMSTR - Make file offset error message probe-agnostic" * tag 'probes-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (37 commits) fprobe: Simplify fprobe_remove_ips() by reusing existing helpers tracing/boot: Add support for eprobe, fprobe, and tprobe events selftests/ftrace: Force C locale in ftracetest tracing/probes: Treating longer symbol name on event comparation docs: trace: fprobe: fix 'thos' spelling tracing/probes: Fix extra whitespace in trace_probe_kernel.h tracing/kprobe: Remove redundant memset in kprobe_perf_func() tracing/fprobe: Remove redundant memset in fentry_perf_func() tracing/fprobe: Remove redundant snprintf in trace_fprobe_match_command_head() tracing/probes: Simplify BTF_KIND_PTR case in fetch_type_from_btf_type() tracing/probes: Cleanup pointer arithmetic in store_trace_entry_data() tracing/probes: Remove unused parameter from parse_probe_var_retval() tracing/probes: Remove redundant bounds check in trace_probe_compare_arg_type() tracing/probes: Remove redundant boolean conversion in trace_probe_has_single_file() tracing/probes: Remove duplicate MAX_ARRAY_LEN macro definition selftests/ftrace: Add test case for a symbol in a module without module name tracing/probes: Eliminate recursion in parse_probe_arg() tracing/probes: Extend max length of argument string tracing/probes: Sort ERRORS list in trace_probe.h alphabetically tracing/probes: Refactor parse_probe_arg() ...	2026-08-20 15:11:52 -07:00
Linus Torvalds	55ab7e1422	Merge tag 'for-7.3/block-20260819' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux ... Pull block updates from Jens Axboe: - NVMe updates via Keith: - Enable Clang context analysis for the nvme host driver, adding context annotations across core, fabrics, rdma, tcp and pci - nvmet reservation state exposed through a new namespace-level debugfs directory, plus ABI documentation for the host sysfs and target configfs interfaces - nvme-tcp host memory disclosure fixes on the read path: reject a read that transferred too few bytes, don't accept C2HData based on blk_rq_payload_bytes() alone, and fix the R2T case for a read command - Parallelize nvme-rdma I/O queue allocation and startup (Surabhi) - Apple nvme fixes and quirks: page aligned admin queue buffers, destroy the admin queue on removal, and various DMA/NVMMU correctness fixes - A large pile of nvmet and host fixes for out-of-bounds reads, refcount/resource leaks, and NULL derefs across auth, zns, passthru, pci-epf, rdma and configfs - Various other fixes and cleanups - MD updates via Yu Kuai: - llbitmap reshape support, the large series wiring exact bitmap mapping and reshape lifecycle through raid5 and raid10, growing the page cache in place, and remapping checkpointed bits as reshape progresses - raid5 fixes for lockless max_nr_stripes and recovery_offset accesses, a reshape deadlock with more failed devices than max degraded, and bitmap batch counter consistency - Atomic write handling for raid1/raid10, and removal of the REQ_NOWAIT support from raid1/10/456 - raid5-ppl use-after-free fix in ppl_do_flush() - A batch of smaller fixes across md core and the bitmap code - s390/dasd ESE full-track write support and the surrounding infrastructure, plus enabling CONTEXT_ANALYSIS for s390/block - RWF_DONTCACHE support for block devices, built on new task-context bio completion infrastructure, and wiring it up for the iomap and buffer dropbehind writeback paths - Async io_uring zone reset all, plus zone management command cleanups allowing REQ_NOWAIT and tightening conventional zone rejection - Block integrity refactoring: lift BIP_CHECK_FLAGS to the shared header, handle nogenerate/noverify properly in fs-integrity, and drop the blk-integrity.h include from bdev.c - Split out a new blk_plug.h header - ublk improvements: add UBLK_F_IO_DESC_SIZE, split request validation from io_desc init, reject non-power-of-2 zone sizes in SET_PARAMS, and a series of hardening fixes around map/unmap and auto buf reg - null_blk cleanups and configfs serialization fixes - nbd queue freeze removal on the setup paths, and a new pre_defined_connections module parameter for pre-created devices - blk-cgroup fixes for the race between policy activation and blkg destruction, and accounting per-cpu stats over possible CPUs across blk-stat, iolatency, iocost and kyber - Various dio fixes: leak on metadata mapping error, validate user space vectors during extraction, and set dma_alignment from the backing file for loop and zloop direct I/O - bio cleanups - Various other fixes and cleanups all over * tag 'for-7.3/block-20260819' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (241 commits) nbd: add pre_defined_connections module parameter for pre-created devices nbd: remove queue freeze for newly created nbd from netlink path nbd: factor out a nbd_genl_foreach_sock nbd: skip queue freeze when setting size at device startup nbd: remove queue freeze in nbd_add_socket nbd: clear queue limits on disconnect nbd: disallow NBD_SET_SOCK on an active device nbd: simplify find_fallback() by removing redundant logic blk-mq: add missing call to srcu_barrier() in blk_mq_free_tag_set() block: mtip32xx: synchronize ioctls with device removal ublk: avoid teardown retry loop on xarray allocation failure null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows block: don't include blk-integrity.h in bdev.c xfs: avoid double deferrals for RWF_DONTCACHE writes loop: Fix recently introduced lock inversion block: set QUEUE_FLAG_DYING unconditionally in blk_mark_disk_dead() swim3: Add missing MODULE_DESCRIPTION selftests: ublk: add SET_PARAMS validation test selftests: ublk: add helper for SET_PARAMS ublk: reject non-power-of-2 zone sizes in SET_PARAMS ...	2026-08-20 13:55:16 -07:00
Linus Torvalds	ae814200e8	Merge tag 'bitmap-for-7.3' of https://github.com/norov/linux ... Pull bitmap updates from Yury Norov: "The usual set of fixes, cleanups and performance improvements together with a couple of new tests: - bitmap_find_next_zero_area_off() optimization (Sunyi) - bitmap_find_next_zero_area_off(): return size when no zero area is found (Yury) - bitmap vs IDA vs Maple Tree performance test (Yury) - get rid of cpumap_print_to_pagebuf() (Yury) - use nr_node_ids in __nodemask_pr_numnodes() (Li RongQing) - bitops: make the *_bit_le functions use unsigned long (Benjamin) - bitmap scatter & gather test fix (Christophe) - use __ASSEMBLER__ in bitmap header files (Thomas)" * tag 'bitmap-for-7.3' of https://github.com/norov/linux: (25 commits) lib: test bitmap vs IDA vs Maple Tree performance for region allocations bitmap: Return size when no zero area is found media: s5p-mfc: Treat bitmap size as allocation failure crypto: ccp: Treat bitmap size as allocation failure powerpc/msi: Treat bitmap size as allocation failure ARM: dma-mapping: Treat bitmap size as allocation failure bitmap: drop bitmap_next_set_region() nodemask: reduce bitmap width to nr_node_ids in __nodemask_pr_numnodes() bitmap: Properly initialise destination bitmap for scatter & gather test lib/bitmap-str: get rid of cpumap_print_to_pagebuf() perf: Use sysfs_emit() for cpumask show callbacks PCI/sysfs: Use sysfs_emit() for cpumask show callbacks RDMA/hfi1: Use sysfs_emit() for cpumask show helper hwtracing: hisi_ptt: Use sysfs_emit() for cpumask show fpga: dfl-fme-perf: Use sysfs_emit() for cpumask show devfreq: Use sysfs_emit() for cpumask show callbacks cpu: Use sysfs_emit() for cpumask show callback x86/events: Use sysfs_emit() for cpumask show callbacks powerpc: Use sysfs_emit() for cpumask show callbacks arm: Use sysfs_emit() for cpumask show callbacks ...	2026-08-20 11:41:46 -07:00
Linus Torvalds	216b3f432a	Merge tag 'kcsan-20260817-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/melver/linux ... Pull Kernel Concurrency Sanitizer (KCSAN) update from Marco Elver: - Avoid unintended access checking in NMIs * tag 'kcsan-20260817-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/melver/linux: kcsan: avoid unintended access checking in NMIs	2026-08-20 11:32:27 -07:00
Linus Torvalds	11260c335e	Merge tag 'sched_ext-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext ... Pull sched_ext updates from Tejun Heo: "Most of this cycle completes the enqueue-path support for hierarchical sub-scheduling, which makes sub-scheduler support feature complete: a root BPF scheduler can now hand a cgroup subtree over to a nested sub-scheduler together with revocable CPU grants, and the sub-scheduler owns all scheduling decisions for its tasks on those CPUs. Development volume was high and a number of changes plugging holes in the new support landed late in the cycle. Also included are core scheduling fixes that were completed too late for the v7.2 release and are routed through this pull request. Sub-scheduler CPU delegation: - Parent schedulers now grant and revoke per-CPU capabilities (enqueueing, preemption, CPU frequency control) on their children, enforced on every path a scheduler can reach a CPU through. Previously only dispatching could be delegated; this lets sub-schedulers fully schedule their CPUs. - Rescue execution: a task whose scheduler doesn't have access to the CPUs the task needs to run on starved until the watchdog ejected the whole scheduler. The kernel now runs such tasks directly on a small bandwidth budget, turning a scheduler-killing failure into bounded degradation. - Cgroup integration: tasks migrating across a sub-scheduler boundary weren't re-homed to the new owner, causing wrong-scheduler scheduling and a use-after-free. Sub-schedulers now take over their cgroup subtree and receive its cgroup callbacks. - Arena objects now cross the kernel/BPF boundary as typed pointer arguments, translated transparently by the BPF tree's new arena argument support, replacing untyped arguments with manual translation. - scx_qmap now demonstrates full hierarchical sub-scheduling. Other fixes and updates: - Robustness improvements: the abort path is now NMI-safe, fixing deadlocks when errors are raised from NMI context and making hardlockup recovery direct. Reenqueue loops that could monopolize a CPU ahead of the watchdog now eject the offending scheduler, and stalls are blamed on the scheduler actually responsible. - Hardening: BPF-writable arena memory is validated before kernel use, and task slice and vtime writes got explicit synchronization rules, closing corruption vectors open to buggy or malicious schedulers. - Core scheduling: sched_ext dispatching can drop the rq lock inside the core-wide pick, which let interleaving selections corrupt each other's state and hard-hang the machine. The selection now restarts when the lock was released. The task ordering callback was also invoked with its arguments swapped, and the default ordering is updated to work across sub-scheduler boundaries. The fixes are marked for stable. - Other fixes headed for stable: a task init leak on fork failure during enable, tooling compat macros that silently failed to detect newer kernels, and a crash on reenqueueing against a destroyed dispatch queue. - Tooling: scx_pair moves off deprecated callbacks, and the deprecated scx_bpf_cpu_rq() kfunc is removed" * tag 'sched_ext-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: (144 commits) sched_ext: Drop the dead SCX_DEQ_CORE_SCHED_EXEC test in dequeue_task_scx() sched_ext: Make core-sched task ordering hierarchy-aware sched_ext: Use runnable_at for the default core-sched task ordering sched_ext: Fix inverted ops.core_sched_before() invocation sched_ext: Move the config-off sub-cap kfunc stubs into sub.c sched_ext: Rename balance-era identifiers to dispatch terms sched_ext: Drop the stale keep_prev fixup in dispatch_pick() sched_ext: Keep kick_sync waiting on the rq's own CPU sched_ext: Make SCHED_CLASS_EXT select GENERIC_ALLOCATOR sched_ext/scx_flatcg: Fix cvtime true-up on slice expiry sched_ext: Don't BUG_ON a destroyed DSQ in process_deferred_reenq_users sched_ext: Fix scx_bpf_dsq_move_to_local___v2 compat detection sched_ext: Make scx_bpf_events() read the calling scheduler's counters sched_ext: Drop unlocked scx_rq_clock_invalidate() from scx_root_disable() selftests/sched_ext: Fix flaky ddsp failure tests on busy systems selftests/sched_ext: Make numa idle validation race-free sched_ext: Fix scx_bpf_dsq_reenq___compat kfunc extern prototype sched_ext/scx_flatcg: expire cached hweights on weight changes sched_ext: Fix exit_task leak on fork failure during enable sched_ext: fix stale references in doc comments ...	2026-08-20 11:01:37 -07:00
Linus Torvalds	40d8c81577	Merge tag 'cgroup-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup ... Pull cgroup updates from Tejun Heo: - Attach path bug fixes: migrations spanning multiple source or destination cpusets were mishandled, most visibly leaving thread affinities stale when the controller is disabled in a threaded subtree. Configuration writes could also race an in-flight attach and apply stale state, and the deadline task count could get corrupted by concurrent updates, skewing SCHED_DEADLINE admission decisions. - Memory binding bug fixes: which node masks get applied differed between the binding update paths, and tasks cloned with CLONE_INTO_CGROUP skipped rebinding entirely. Rebinding also now runs once per process instead of repeating for every thread sharing the mm. - Overhead removals with no behavior change: CPU hotplug iterated tasks of cpusets that just inherit the parent's effective masks, and the slab-spreading task flag was still being maintained although the SLAB allocator that consumed it is long gone. - Data-race annotations for benign races so that KCSAN reports stay meaningful, selftest coverage for the fixes above along with flakiness and portability fixes, and documentation corrections. * tag 'cgroup-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: (34 commits) selftests/cgroup: Remove redundant chown in test_cgcore_lesser_ns_open selftests/cgroup: Preserve CPU hotplug write errors cgroup/cpuset: Add test for partition root invalidation returning wrong CPUs cgroup/cpuset: Remove obsolete PFA_SPREAD_SLAB task flag docs: cgroup-v2: fix stale "io" controller introduction selftests/cgroup: Avoid awk -e in cpuset tests cgroup/cpuset: Use WRITE_ONCE() for shared prs_err updates selftests/cgroup: add user_usec sanity check in test_cpucg_nice cgroup: drop unneeded semicolon docs: cgroup-v2: mark memory.pressure and io.pressure as read-write selftests/cgroup: Fix minor defects in test_cpuset Docs/admin-guide/cgroup-v2: fix delay_nsec unit in io.latency doc selftests/cgroup: Remove redundant cg_enter_current() call in test_core selftests/cgroup: Add test for cpuset affinity on controller disable cgroup/cpuset: Handle the special case of non-moving tasks in cpuset_can_attach() cgroup/cpuset: Support multiple destination cpusets for cpuset_*attach() selftests/cgroup: fix missing TAP output in test_hugetlb_memcg cgroup/cpuset: Support multiple source cpusets for cpuset_*attach() cgroup/cpuset: Move mpol_rebind_mm/cpuset_migrate_mm() calls inside cpuset_attach_task() cgroup/cpuset: Make attach_ctx.old_cs track task group leader ...	2026-08-20 10:37:42 -07:00
Linus Torvalds	39e34e88ec	Merge tag 'wq-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq ... Pull workqueue updates from Tejun Heo: - Worker wakeups moved out of pool->lock on the hot paths, shortening lock hold times. The wakeup can be expensive on arm64 due to the idle wakeup IPI, and the change improves the workqueue microbenchmark there by up to 10% - Stall diagnostics now report pools stuck with no running worker, with a backtrace of what the CPU is executing and the likely culprit worker, instead of dumping every in-flight worker - Preparation for turning per-cpu workqueues into an affinity scope of unbound workqueues instead of a separate backend - Race annotations for KCSAN and sparse warnings, and doc and monitoring script fixes * tag 'wq-for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: (23 commits) workqueue: annotate racy p->wake_cpu accesses in kick_pool_pick() workqueue: BUG_ON() instead of returning NULL in wq_node_nr_active() workqueue: use RCU accessors when populating wq->cpu_pwq workqueue: use rcu_dereference_sched() in workqueue_congested() workqueue: skip the node_nr_active update for non-unbound workqueues workqueue: rename alloc_unbound_pwq() to alloc_pwq() workqueue: allocate attrs for all workqueues workqueue: rename wq->unbound_attrs to wq->attrs workqueue: test WQ_UNBOUND explicitly in the hotplug loops workqueue: account nr_active by the backing pool workqueue: release pwq pools by pool type workqueue: factor out alloc_and_link_percpu_pwqs() workqueue: factor out get_percpu_pool() docs: workqueue: Fix bracket workqueue: annotate racy sum_exec_runtime reads for CPU-intensive detection workqueue: annotate racy PWQ_STAT_CPU_TIME update in wq_worker_tick() workqueue: dump the last woken worker for stalled pools workqueue: trigger a single-CPU backtrace for stalled pools workqueue: only show running workers in stall diagnostics workqueue: defer the worker wakeup outside pool->lock in process_one_work() ...	2026-08-20 10:34:25 -07:00
Linus Torvalds	9d2ed026f0	Merge tag 'sysctl-7.03-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl ... Pull sysctl updates from Joel Granados: - Fix kernel-doc warnings by adjusting in file documentation - Consolidate do_proc_* function into do_proc_vec Consolidate three slightly different implementations of applying a converter on all elements of a vector. Fixes to this function now propagate to the three types. - Replace CONFIG_PROC_SYSCTL with CONFIG_SYSCTL (they were the same) and restrict cad_pid modifications to global root (GLOBAL_ROOT_UID) * tag 'sysctl-7.03-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl: sysctl: remove CONFIG_PROC_SYSCTL, it just mirrors CONFIG_SYSCTL sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[] sysctl: repair some kernel-doc comments sysctl: add Returns: kernel-doc for all functions sysctl: Update API function documentation sysctl: Rename proc_doulongvec_minmax_conv to proc_doulongvec_conv sysctl: Group proc_handler declarations and document sysctl: Replace do_proc_do{int,ulong,uint}vec with do_proc_vec sysctl: Add negp parameter to douintvec converter functions sysctl: Move default converter assignment out of do_proc_dointvec	2026-08-20 08:46:41 -07:00
Linus Torvalds	91ec203513	Merge tag 'net-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next ... Pull networking updates from Jakub Kicinski: "One of the 'small improvements all over the place' releases for us. It's hard to draw any direct comparisons because summer vacations disrupted our patch processing (and presumably - generation) quite a bit. Quick and dirty count suggests we (Paolo and I) merged a very similar number of net (632) and net-next (648) patches. This is not telling the full story either because 1/3 to 1/2 of the net-next patches also *seem* like AI-driven low priority fixes, cleanups and clarifications. We are completely overwhelmed, of course. The glimmer of hope is that we secured sufficient LLM budget and access (thank you Meta!) to run reviews with multiple frontier models on each patch. This eliminates some hallucinations. That said, in terms of review, the LLMs can only do so much. The sad truth is that our APIs (especially for rare events like PCIe errors, timeouts etc) have always been racy, and now LLMs don't let us ignore that. I expect our direction for the next release will be to tweak the reviews a little bit more, but start shifting focus to letting the LLMs take care of the busy work - managing patchwork, automating common process complaints, editing commit messages, and maybe applying patches which already got "reviewed-by" tags from people we trust... Core & protocols: - A few steps lowering rtnl_lock dependence: - per-netns netdev unregistration for select SW drivers (e.g. veth, ipvlan, tunnels) - rtnl_lock-less FIB rule changes (RTM_NEWRULE and RTM_DELRULE) - prepare software drivers and TC qdiscs for rtnl_lock-less GET - Support BIG TCP (>64kB TSO) in UDP tunnels (vxlan, geneve) - Support buffers larger than PAGE_SIZE in devmem zero-copy API - Improve MPTCP handling of extreme memory pressure handling, when out-of-order queue had to be pruned - Report the per-group user count via RTM_GETMULTICAST - Expose the route deletion reason in RTM_DELROUTE - Add a SO_RIGHTS_NOTRUNC option to UNIX sockets to enable more useful handling of LSM denials when receiving SCM_RIGHTS messages: instead of truncating the message at the first blocked fd, keep every fd slot and store the LSM errno in the blocked slot - IPv6 Segment Routing - support looking up the post-encap SID (address) in a different/specified routing table - Support PRP RedBox (interlink) creation - Support per-nexthop UDP dst port in VXLAN - Continue converting getsockopt callbacks in a number of protocols to iov_iter Ethernet: - Merge initial CXL support for AMD/Solarflare NICs (shared branch with the CXL tree) - New drivers: - ADIN1140 10BASE-T1S MACPHY - Initial skeleton of Intel iXD and ZTE Dinghai drivers - High-speed NICs: - AMD/Pensando: - support firmware flashing - Cisco (enic): - SR-IOV V2 admin channel and MBOX protocol - Huawei (hns3): - support for ethtool pfc_prevention_tout - nVidia/Mellanox: - support sharing bandwidth control across interfaces of the same device - Marvell (octeontx2-pf): - link RQ page pools to netdev for Netlink stats - Google vNIC: - XDP metadata support for DQ RDA - Microsoft vNIC: - support forcing full-page RX buffers - Other NICs: - Synopsys IP: - eic7700: support for eth1 - Microchip (lan743x): - support for RMII interface - Wangxun: - support for ethtool -G and -C for VFs - add Tx timeout and PCIe error handling - Intel (igb/igc): - RSS key get/set support - support for forcing link speed without auto-negotiation - Switches: - NXP (dpaa2): - support bonding/LAG offload - Mediatek: - mt7530: EN7528 support - initial support for MT7628 - Micrel (ksz8/9): - refactoring work to move towards library model - PTP support for KSZ8463 - nVidia/Mellanox: - support rtnl-lock-less ethtool callbacks - Realtek: - rtl8366rb: use generic RTL83xx code - support SGMII and HSGMII for RTL8367S - PHYs: - Airoha: - EcoNet EN7528 PHY support - DAPU Telecom - DAPU Telecom DAP8211R(I) Gigabit PHY support - Realtek: - support RTL8261C_CG - support RTL8261D Wireless: - nl80211: per-link statistics support for multi-link operation - mac80211: AQL/airtime-fairness support for multicast - Merge Peripheral Authentication Service (PAS) / TEE support for ath12k (shared branch with the firmware/qcom tree) - New drivers: - mm81x for Morse Micro Long-Range S1G devices - nxpwifi for NXP devices (mostly forked off from mwifiex) - Driver changes: - Broadcom (brcmfmac): - DPP support, some Cypress part update - MediaTek (mt76): - mt7928 support - mt7925 NAN support - mt7996 AP powersave improvements - Qualcomm (ath12k): - much kernel infrastructure integration work - AHB platform MultiPD support - Realtek (rt89): - LED support - RTL8922DE support - dual-BT coex for RTL8922D - Intel: - new FW version support Bluetooth: - HCI: add support for Shorter Connection Interval (SCI) feature - af_bluetooth: add minimal context analysis annotations - Driver changes: - Intel: - add Bluetooth SAR revision 2 support - add vendor_reset PCI sysfs for PLDR - Mediatek: - add USB IDs for MT7902 and MT7922 devices - Realtek: - add USB IDs for 8761CU and 8852BE devices - NXP: - add M.2 Bluetooth device support using pwrseq Misc: - DPLL support for manual/numerical oscillator control (NCO) (implement in zl3073x) - MCTP support for MCTP over USB v1.1 (DMTF DSP0283) - Power-over-Ethernet: support Realtek PSE controllers - Remove the IBM EHEA driver - Remove tulip/xircom_cb driver" * tag 'net-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (1433 commits) net/mlx5e: do not HW-GRO coalesce small frames net: openvswitch: fix nf_connlabels leak in ovs_ct_init net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs() net: openvswitch: fix flow mask use-after-free on flow deletion sctp: stop processing a packet once its association is deleted dpll: zl3073x: add PTP clock support dpll: zl3073x: add channel ToD, phase step and TIE operations dpll: zl3073x: scale poll interval proportionally to timeout ptp: vmclock: prevent read-only mappings from becoming writable ipv4: reject undersized MTUs in ip_do_fragment() bonding: initialize err for empty target lists net: dsa: initial support for MT7628 embedded switch net: dsa: initial MT7628 tagging driver net: phy: mediatek: add phy driver for MT7628 built-in Fast Ethernet PHYs dt-bindings: net: dsa: add MT7628 ESW net: pse-pd: realtek-pse-mcu: add UART transport net: pse-pd: realtek-pse-mcu: add I2C transport net: pse-pd: add Realtek PSE MCU core dt-bindings: net: pse-pd: add bindings for Realtek PSE MCU vsock: use sock_error() to consume sk_err after a failed connect ...	2026-08-20 08:16:04 -07:00
Linus Torvalds	5a8cd539ac	Merge tag 'bpf-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next ... Pull bpf updates from Daniel Borkmann: "Major changes: - Redesign the verifier error reporting: failures now carry source and instruction annotations along with the causal event history that led to them, making program rejections far easier to debug and repair (Kumar Kartikeya Dwivedi) - Add arena argument support to kfuncs and struct_ops through the new __arena and __arena__nullable suffixes (Tejun Heo, Puranjay Mohan, Kumar Kartikeya Dwivedi, Ihor Solodrai) - Signed BPF program loader rework to accommodate both BPF and security community needs where the kernel runs the signature verification at BPF_PROG_LOAD time before the LSM admission hook (Daniel Borkmann) - Add a set of ksock kfuncs which let BPF LSM and syscall programs create, connect and send on UDP sockets in order to emit telemetry data (Mahe Tardy) - Unify helper and kfunc call argument verification and classify kfunc arguments purely from BTF into a generated bpf_func_proto which is computed once at add-call time (Amery Hung) Other features and fixes: - Enable EXECMEM_ROX_CACHE for BPF allocations on x86 (Mike Rapoport) - Add bidirectional VLAN support to bpf_fib_lookup() through the new BPF_FIB_LOOKUP_VLAN and BPF_FIB_LOOKUP_VLAN_INPUT flags (Avinash Duduskar) - Infer zext_dst from static register liveness analysis to fix 32-bit zero-extension semantics, and remove the artificial limitations on pointer types eligible for spilling (Eduard Zingerman) - Inline the numeric open-coded iterator kfuncs so that bpf_for() loops no longer pay a kfunc call on every iteration (Puranjay Mohan) - Add an arena-based bitmap data structure to libarena along with serial and parallel selftests (Emil Tsalapatis) - Teach resolve_btfids to discover kfuncs from the kernel's BTF ID sets and to emit kfunc BTF decl tags, reducing the kernel build's dependency on pahole features (Ihor Solodrai) - Add BPF_F_ADJ_ROOM_DECAP_* flags to bpf_skb_adjust_room() so that tunnel decapsulation can update the GSO and encapsulation state of the skb (Nick Hudson) - Fix the ring buffer pending_pos walk and the available-data accounting on 32-bit position wrap (Israel Téllez García) - Add memory usage accounting for arena maps and fix an mmap_lock deadlock on arena lock failure (Jiayuan Chen) - Add tracing_multi link info support to the kernel UAPI and bpftool, and refactor the stack map code to run with preemption disabled (Jiri Olsa) - Support BPF_F_EGRESS in bpf_redirect_peer() to emit the skb in the egress direction of the target's peer device (Jordan Rife) - Add a KF_SPINLOCK_SAFE kfunc flag so that providers, in particular modules, can declare kfuncs safe to call under bpf_spin_lock instead of relying on the verifier's hard-coded allowlist (Kaitao Cheng) - Introduce global percpu data for BPF programs with libbpf probing and bpftool skeleton support, and stop exposing uninitialized kernel heap memory when copying per-CPU map values (Leon Hwang) - Add s390 JIT support for load-acquire and store-release instructions (Maxim Khmelevskii) - Fix a CFI mismatch in the task work callback and an arm64 KASAN false positive after bpf_throw() (Mykyta Yatsenko) - Reject writes through untrusted BTF pointers and bound the rdonly/rdwr_buf_size kfunc arguments (Nicholas Dudar) - Invalidate RCU pointers only after the final spin unlock and account for preempt and IRQ disabled regions as overlapping RCU protection (Ning Ding) - Support mixing bpf2bpf calls and tail calls on RV64, add signed operations and 32-bit atomics to the RV32 JIT, and add timed may_goto support (Pu Lehui, Kuan-Wei Chiu, Feng Jiang) - Fix a use-after-free on mm_struct in bpf_find_vma() for foreign tasks and an mmap_lock leak in the irq_work path (Sanghyun Park) - Populate mmap-able BPF array map memory lazily which makes mmap() O(1) instead of proportional to the map size (Song Liu) - Introduce a jit_required flag and reject programs with inlined helpers when no JIT is available, where the interpreter would otherwise jump into an invalid address (Tiezhu Yang) - Fix the x86 JIT per-CPU address resolution into an extended register where the REX prefix dropped the high destination register bit (Vineet Gupta) - Reject MEM_ALLOC BTF accesses past object bounds, arena frees below the arena base, and mixed arena and ordinary atomic paths (Yiyang Chen) - Fix the trampoline handling of 128-bit arguments and of return values larger than 8 bytes (Yonghong Song) - Ensure that any fault prone load is rewritten with exception table handling, and fix the arena load-acquire and atomic fetch handling in the x86, arm64, riscv and s390 JITs (Daniel Borkmann) - Many more fixes and cleanups across the verifier, arena, trampolines, sockmap, cgroup, ring buffer, x86/arm64/riscv/s390 JITs, libbpf, bpftool, resolve_btfids and selftests" * tag 'bpf-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (373 commits) selftests/bpf: Add tests for a store on a fault prone qdisc pointer selftests/bpf: Add tests for fault prone loads out of RCU pointers selftests/bpf: Add tests for pointer type merge at a shared load selftests/bpf: Remove duplicate copies of the arena spinlock qnodes selftests/bpf: Retry stat generation in cgroup_iter_memcg selftests/bpf: Test pseudo-function policy diagnostics bpf: Distinguish function references in policy diagnostics bpf: Preserve source attribution without source text selftests/bpf: Test kfunc argument diagnostics bpf: Correct kfunc argument diagnostics bpf: Use canonical stack argument names in diagnostics bpf: Preserve R0 lineage across helper calls selftests/bpf: Exercise negative optlen in cgroup getsockopt hook bpf: Reject negative optlen in cgroup getsockopt hook selftests/bpf: tc_tunnel - validate decap GSO and encapsulation state bpf: Clear decap state on skb_adjust_room shrink path bpf: Allow new DECAP flags and add guard rails bpf: Add BPF_F_ADJ_ROOM_DECAP_* flags for tunnel decapsulation bpf: Refactor masks for ADJ_ROOM flags and encap validation bpf: Name the enum for BPF_FUNC_skb_adjust_room flags ...	2026-08-20 07:36:20 -07:00
Linus Torvalds	83453b6f51	Merge tag 'audit-pr-20260814' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit ... Pull audit updates from Paul Moore: - Drop BUG_ON() assertions from two functions While I don't recall any bug reports from either of these assertions in recent memory, neither of these checks warrant the kernel panic that could result from BUG_ON(). One of the BUG_ON() calls is converted to a WARN_ON_ONCE() and the other to a lockdep assertion. - Fix an audit tree reference counting problem Fix a corner case where audit could end up unintentionally dropping the last reference to an audit tree while the tree was still in use. We should probably revisit the audit tree handling code in full, but this patch works, and should be easy to backport to stable trees and downstream kernels. - Update the audit syscall classification tables Add some missing syscalls to the PERM class * tag 'audit-pr-20260814' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: audit: avoid dropping live tree ref on fsnotify rule autoremove audit: drop BUG_ON() from audit_signal_info_syscall() audit: drop BUG_ON() from audit_add_to_parent() audit: add missing syscalls to PERM class tables	2026-08-19 16:21:32 -07:00
Linus Torvalds	cb8a75eec0	Merge tag 'trace-ringbuffer-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace ... Pull ring-buffer updates from Steven Rostedt: - Remove unneeded semicolon A macro ended with a semicolon that wasn't needed. - Fix freeing cpu_buffer extra subbuffer with order greater than zero When the cpu_buffer was being freed, its "free" page, was using free_page() to free it when it could be more than one page. - Hold the cpu_buffer lock when resizing the subbuffer The freeing of the "free" page of the cpu_buffer was done without locking. The order of the data was being saved and then the "free" page was set to NULL. But there is a race that the "free" page could have been updated between those two operations. Add locking around it to prevent the race. - Save the order of the data along with the data in the free page The cpu_buffer would store just the data portion of the subbuffer page in its descriptor. But it did not store the order of the data pages. The order was being saved in the global buffer descriptor. But this leads to races. Have the cpu_buffer save the subbuf data along with its metadata (which includes the order of the page) to make sure when it frees it, it frees the correct order along with it. - Remove the subbuf_size and use the order directly when needed Having a size field for the size of the subbufer along with its order allowed for races to have them get out of sync. Remove the subbuf_size and use the order from the subbuf meta data directly under locks. Use the subbuf_order for other calculations in the ring buffer. - Remove the useless "cpus" field of trace_buffer The code has been restructured and the "cpus" field is no longer used. Remove it. - Remove the "mapped" field of the ring buffer and use a helper function instead. The "mapped" field has become a bit overused and made the code come complex in using a counter for what is denoted as being mapped or not. There are other fields that are set when the ring buffer is considered mapped. Add a helper function to check those fields and use that instead of keeping track of a counter. * tag 'trace-ringbuffer-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ring-buffer: Remove ring_buffer_per_cpu::mapped ring-buffer: Remove trace_buffer::cpus ring-buffer: Dynamically calculate max_data_size ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() ring-buffer: Fix subbuf resize race with ring buffer readers ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page ring-buffer: Hold cpu_buffer::lock when resizing a subbuf ring-buffer: Free cpu_buffer::free_page with subbuf_order ring-buffer: drop unneeded semicolon	2026-08-19 14:22:07 -07:00
Linus Torvalds	1484625c59	Merge tag 'tracefs-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace ... Pull tracefs updates from Steven Rostedt: - Define event fields before directory creation Move the event_define_fields() call in event_create_dir() before the eventfs directory creation. Previously, a failure after directory creation wouldn't clean up eventfs_inode because the error path didn't call eventfs_remove_dir(). This eliminates the need to clean up the eventfs directories if event_define_fields() fails. - Add warning for out of bounds pos in __eventfs_iterate() Sashiko complains about the ctx->pos causing issues if it is less than 2 or greater than MAX_INT in __eventfs_iterate(). The thing is, the logic prevents that from happening. But to make Sashiko happy, add a WARN_ON() and exit safely if the function ever does get input that is out of the range the function expects. * tag 'tracefs-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: eventfs: Add warning for out of bounds pos in __eventfs_iterate() eventfs: Define event fields before directory creation	2026-08-19 14:18:45 -07:00
Linus Torvalds	081e5bf2a9	Merge tag 'trace-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace ... Pull tracing updates from Steven Rostedt: - Expose btf_ids to trace events In order to allow BPF programs to attach to system call trace events (which are actually pseudo trace events built on top of raw_syscall events), expose the BTF ID of the events. This will allow BPF programs better precision in attaching to events. - Use "u64" to assign to hist_field->type Instead of using kstrdup("u64", GFP_KERNEL) to assign the hist_field->type, just point it to "u64" instead. The hist_field->type is freed via kfree_const(). - Replace kmalloc()/strcpy() with kstrdup() for trace_printk Instead of having two calls to copy the module format string, just use kstrdup(). - Use __free() in trace event histograms and triggres where possible - Use seq_buf in trace event code instead of strcat() Instead of calculating the size of the buffer to use and filling it with strcat(), use the seq_buf infrastructure that takes care of making sure not to overflow the string size. - Reject invalid preemptirq_delay_test CPU affinity The preempt_delay_test module can take an invalid CPU affinity mask and create confusing output. Simply have the module reject invalid affinity masks. - Prevent division by zero in ftrace_ops sample module code If the ftrace_ops sample module code receives the module parameter nr_function_calls set to zero, it can cause a division by zero error. - Warn when an event dereferences a parameter in TP_printk() On boot up and module load, the trace event TP_printk() is scanned for possible bugs. As the TP_printk() code is executed when the user reads the "trace" file and processes the data written when the trace_event executed, the data it reads can be literally days old. The scan currently checks for dereferencing printk formats like "%pI6". But it does not check if the parameters themselves have a dereference like: TP_printk("offset %08x: value %08x", (u32)(__entry->addr - __entry->edma->membase), __entry->value) __entry represents the pointer to the event on the ring buffer. The __entry->edma->membase is dereferencing a pointer on the ring buffer to find membase, but the __entry->edma may no longer be a valid pointer. Warn on this case too. - Replace some strcpy() with strscpy() - Clean up mmiotrace events to use assign_type() macro The assign_type() macro makes sure the event type is indeed the type that is being parsed. The mmiotrace trace was written before that macro was created so it just simply typecasted the pointer. Replace the typecasting with the macro. - Have the ENUM processing to numbers only process what is added The code that converts ENUMs to their numbers in the trace events scanned all events to do the processing. This was true when a module was loaded too. That is, instead of processing just the events for the module, it processed *all* events. Even the builtin ones that were processed at boot up. Add a check for the event->module matching mod if it is a module before processing it. * tag 'trace-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (21 commits) tracing: Have trace_event_update_all() only handle module that is loading tracing: Cleanup event_enable_trigger_parse() by using __free() tracing: Report every TP_printk double dereference tracing/mmiotrace: Use trace_assign_type() in mmio_print_mark() tracing: Make per-template BTF id lists file-local tracing: Use seq_buf for string concatenation tracing: Use strscpy() instead of strcpy() in trace_sched_switch tracing: Warn when an event dereferences a pointer in TP_printk() samples/ftrace: Prevent division by zero when nr_function_calls is zero tracing: Reject invalid preemptirq_delay_test CPU affinity fgraph: Use trace_seq_putc() in print_graph_return() tracing/user_events: Replace a seq_printf() call by seq_puts() in user_seq_show() tracing/user_events: Use seq_putc() in two functions tracing: Bound histogram expression strings with seq_buf tracing: Return ERR_PTR() from expr_str() tracing: Use __free() for expr_str() buffer kernel/trace/trace_printk: Use kstrdup() instead of kmalloc() and strcpy() tracing: Point constant hist field type to string literal selftests/bpf: Add test for tracepoint btf_ids tracefs file tracing: Expose tracepoint BTF ids via tracefs ...	2026-08-19 14:06:14 -07:00
Linus Torvalds	00d66b29a6	Merge tag 'ftrace-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace ... Pull ftrace updates from Steven Rostedt: - Deprecrate ftrace_enabled in disabling ftrace The file /proc/sys/kernel/ftrace_enabled was created when ftrace was first introduced back in 2008. It was to be a "kill switch" if something was to go wrong. It was also used as a way to turn off function tracing for the latency tracers that would have it on by default. But in 2013 (Linux 3.10) the option "function-trace" was introduced to disable function tracing for the latency tracers as the "ftrace_enabled" file was considered too big of a hammer and caused too many side effects. When live kernel patching came along, disabling ftrace via the ftrace_enabled file would put the system into an unstable state if a live kernel patch was installed. This created the need to mark some function hooks as "PERMANENT". Now there's a need for BPF usage marked as PERMANENT for the same reasons. The file "ftrace_enabled" usage is no longer viable. It doesn't do what it says it does and there is no reason to use it. Make writing '0' to it a nop and print a message saying its usage is deprecated. The return value of writing '0' is -EOPNOTSUPP so that user space will error on that write (hopefully to inform any developer that it no longer works). Eventually the file should be removed completely, but for now just making it not do anything is the path forward to that. - Update the livepatch tests to handle ftrace_enabled being disabled Because in the past, livepatch was broken by ftrace_enabled being turned off, there's a test case that checks to make sure it still doesn't break. But having the write of '0' return an error caused that test to break. Updated the test to handle the new change. * tag 'ftrace-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: selftests/livepatch: update test-ftrace.sh for deprecated ftrace_enabled ftrace: deprecate disabling via ftrace_enabled sysctl	2026-08-19 14:01:58 -07:00
Linus Torvalds	55ee4b931a	Merge tag 'trace-rv-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace ... Pull Real-time Verifier updates from Steven Rostedt: - Switch LTL and DOT parsers to Lark in code generation tool The rvgen code generation tool originally parsed DOT files and LTL specifications using custom string parsing and Ply, which is no longer maintained. The DOT parser was fragile and prone to failure on minor format variations. Both LTL and DOT parsers have been rewritten to use the Lark parsing library. - Simplify Hybrid Automata clock variables The clock variables in hybrid automata monitors now use a single representation of the elapsed time since the clock was reset, rather than converting between invariant and guard representations. This allows simpler code generation for the newly refactored parser. - Generate cleanup hook for per-obj monitor The code generation scripts now adds a cleanup function to per-obj monitors for the user to wire to the appropriate event (e.g. sched_process_exit for tasks). - Reduce read_lock scope during per-task cleanup Take the tasklist_lock only when necessary, that is when iterating over for_each_process_thread(). - Simplify task monitor slot management Only rely on the slot array for per-task slot management to avoid inconsistency with the unused counter. - Improve rvgen code robustness and templates Use pathlib in rvgen and improve kernel path discovery. Also improve consistency across templates when generating code (e.g. author placeholder and monitor struct name). - Update rtapp sleep monitor Simplify the sleep monitor by excluding kernel threads and updating the nanosleep check to focus only on CLOCK_REALTIME. Also switch to use the sched_exit tracepoint to run in the context of the offending (wakee) task. - Add wakeup monitor Add the new rtapp/wakeup monitor to detect when lower-priority tasks wake up higher-priority ones, complementing the existing sleep monitor by running in the waker context and capturing its stack trace. - Fix tools/rv exit status on failure Ensure the rv tool returns a failure exit code when a monitor fails to start because it was already running. - Add automated selftests for tools/rv and rvgen Introduced automated bash selftests to validate rv monitor listing and execution under different configurations. Added tests for the rvgen code generator, validating generated files against expected output (golden). Tests are reachable via make check. - Add KUnit test coverage for verification monitors Added comprehensive KUnit tests to validate the functionality of deterministic, hybrid, and LTL monitors by emulating event sequences and timing in a mock environment without affecting the running kernel while expecting mock reactions to fire. Ensure real RV monitors cannot run during KUnit tests to avoid state corruption. - Mock current in rv monitors Mock the call to current in rv monitors when the KUnit tests are built to allow them to run the test on dummy tasks. No overhead is expected when KUnit tests aren't running. - Introduce rvgen kunit subcommand Added a new 'kunit' subcommand to rvgen to automatically patch an already generated monitor with KUnit integration templates by parsing its event handlers and creating the required mock structures and initializations. - Refine kernel verification selftests Added new selftests for the deadline and stall monitors and rearranged the existing wwnr_printk test to resolve flakiness. Additionally, fixed an issue in the selftests framework where negative assertion failures were not correctly propagated due to shell rules. - Fix 32-bit build of nomiss KUnit test A previous commit introduced a division between an u64 and a constant value and that doesn't build on 32-bit systems. Use div_u64() instead. - Document changes in sleep monitor The sleep monitor introduced some changes in the past like allowing epoll_wait() as a valid sleep and a task going to runnable before scheduling as a valid wakeup. Document both. * tag 'trace-rv-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (40 commits) Documentation/rv: Explain epoll and aborted sleeps rv: Fix 32-bit build of nomiss KUnit test selftests/verification: Add selftests for deadline and stall monitors selftests/verification: Rearrange the wwnr_printk test selftests/verification: Fix wrong errexit assumption rv: Add KUnit tests for some LTL monitors rv: Add KUnit mock for current rv: Add KUnit tests for some DA/HA monitors rv: Export task monitor slot and react symbols verification/rvgen: Add selftests for rvgen kunit verification/rvgen: Add the rvgen kunit subcommand verification/rvgen: Add selftests verification/rvgen: Add golden and spec folders for tests tools/rv: Add selftests verification/rvgen: Improve consistency in template files verification/rvgen: Use pathlib instead of os.path verification/rvgen: Improve rv_dir discovery in RVGenerator tools/rv: Fix exit status when monitor execution fails rv: Use generic rv_this for the rv_monitor variable in LTL rv/rtapp: Add wakeup monitor ...	2026-08-19 13:29:22 -07:00
Petr Mladek	3783364ce6	Merge branch 'for-7.3-console-registration-cleanup' into for-linus	2026-08-19 10:00:46 +02:00
Linus Torvalds	104a813376	Merge tag 'timers-vdso-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip ... Pull VDSO updates from Thomas Gleixner: - Consolidate the VDSO datastore further and provide support for mlock_all() and prefaulting. - Provide 32-bit legacy time related functionality only if CONFIG_COMPAT_32BIT_TIME is enabled. The config switch exists, but architecture code still exposes the legacy functionality even disabled. Clean this up by adding the missing guards and validating at build time that the VDSO is legacy free if disabled. - Consolidate the VDSO related config options in core and drivers, which removes some non-sensical dependencies and quite an amount of #ifdeffery. - Clean up the PAGE_SIZE definition maze * tag 'timers-vdso-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (30 commits) random: vDSO: Drop custom PAGE_SIZE definitions LoongArch: Remove CONFIG_GENERIC_GETTIMEOFDAY ifdeffery clocksource/drivers/timer-riscv: Remove CONFIG_GENERIC_GETTIMEOFDAY ifdeffery clocksource/drivers/arm_arch_timer: Remove CONFIG_GENERIC_GETTIMEOFDAY ifdeffery clocksource/drivers/mips-gic-timer: Remove CONFIG_GENERIC_GETTIMEOFDAY ifdeffery MIPS: csrc-r4k: Remove CONFIG_GENERIC_GETTIMEOFDAY ifdeffery vDSO: Make clockmode constants available without CONFIG_GENERIC_GETTIMEOFDAY kbuild: Support generated asm-headers in subdirectories vdso: Rename HAVE_GENERIC_VDSO to VDSO_DATASTORE vdso: Drop HAVE_GENERIC_VDSO from architecture kconfig files vdso: Automatically select HAVE_GENERIC_VDSO if necessary MIPS: vdso: Stop using CONFIG_HAVE_GENERIC_VDSO vdso: Remove the dependency on HAVE_GENERIC_VDSO from ARCH_HAS_VDSO_ARCH_DATA futex: Remove dependency on HAVE_GENERIC_VDSO from FUTEX_ROBUST_UNLOCK vdso/gettimeofday: Verify COMPAT_32BIT_TIME interactions sparc: vdso: Respect COMPAT_32BIT_TIME MIPS: VDSO: Respect COMPAT_32BIT_TIME powerpc/vdso: Respect COMPAT_32BIT_TIME ARM: VDSO: Respect COMPAT_32BIT_TIME arm64: vdso32: Respect COMPAT_32BIT_TIME ...	2026-08-18 16:56:25 -07:00
Linus Torvalds	3b4128b9f3	Merge tag 'timers-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip ... Pull timer and timekeeping core updates from Thomas Gleixner: - Fix a subtly inconsistency in the timekeeping code, which fails to account for the monotonicity adjustment in ntp_error. For small changes of the clocksource multiplicator (+/-1) which are typically used by the NTP PLL this is hard to observe. But for larger adjustments, e.g. caused by a direct frequency setting through adjtimex() the one-time uncompensated offset is significant. Cure this by adjusting ntp_error with the resulting offset so that the discrepancy is smoothed away over time - Make tick length calculations correct in NTP. The timekeeping core takes the quantisation of the clocksource into account when calculating the tick length to compensate for the deviation of the nominal NTP_INTERVAL_LENGTH. While timekeeping gets this right, NTP is not aware of that, which means it operates on the nominal value and not on the actual value which is determined by the clock source frequency. The rounding of a coarse clocksource like the ACPI PM timer results in a +127 PPM deviation. Cure this by exposing the deviation to the NTP code so that it can operate on the same data as the timekeeping core. This is purely kernel internal. User space still sees the nominal tick lenght via adjtimex(). - The accuracy of the NTP adjustments is fairly approximate as the code assumes that the invocations are precisely in NTP interval frequency ticks and the final adjustment can over and under-run. Cure this by adjusting ntp_error by the intended skew on each tick to achieve the desired rate. - Handle the two competing skews of time offset and time adjustment correctly by calculating the conflict portion between the skews and adjusting both accordingly. - A set of updates and improvements for the selftests - The usual small fixes and improvements all over the place * tag 'timers-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (58 commits) selftests: timers: nsleep-lat: Check all calls to clock_nanosleep() and clock_gettime() selftests: timers: nsleep-lat: Reuse kselftest error numbers selftests: timers: nsleep-lat: Explicitly list the tested clocks selftests: timers: nsleep-lat: Use NSEC_PER_MSEC define for unreasonable latency selftests: timers: nanosleep: Report each test separately selftests: timers: nanosleep: Explicitly handle timer_delete() failure selftests: timers: nanosleep: Move all single clock tests out of the loop in main() selftests: timers: nanosleep: Reuse kselftest error numbers selftests: timers: nanosleep: Explicitly list the tested clocks selftests: timers: nanosleep: Drop output alignment selftests: timers: Use clock_name() and constants from clock-helpers.h selftests: Add clock-helpers.h timer_list: Use ktime_t over nanoseconds timer_list: Use standard 'long long' format placeholders hrtimer: Add a lockdep assertion to hrtimer_update_base() timekeeping: Use u32 for clock_was_set_seq timekeeping: Rename clockid_aux_valid() to clockid_is_aux_clock() hrtimer: Account nr_retries on recovered interrupt retries timers/itimer: Zero-init old itimerval before copy to userspace nohz: Replace dead select with choice default ...	2026-08-18 16:23:56 -07:00
Linus Torvalds	0dd1a54f44	Merge tag 'smp-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip ... Pull SMP core updates from Thomas Gleixner: - Reduce the preemption disabled sections in smp_call_function*(). The various smp call functions keep preemption disabled accross the full operation which includes the wait for completion. Especially the latter can take some time when one of the target CPUs is not immediately responding to the IPI, which can result in large latency spikes. To improve this provide a per task CPU mask to track the CPUs to wait for. That makes the information required for the wait task local and therefore allows to reenable preemption before the wait. While this comes with moderate extra memory cost this reduces SMP function call induced latency measured in a fleet for high priority tasks from ~17ms to ~1.5ms (~90%). - Reduce the overhead of the CSD debug code by replacing the heavy memory barriers with smp_store_release()/acquire() - Remove obsolute unused hotplug states * tag 'smp-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: scftorture: Remove preempt_disable() in scftorture_invoke_one() smp: Remove preempt_disable() from on_each_cpu_cond_mask() smp: Remove preempt_disable() from smp_call_function() smp: Enable preemption early in smp_call_function_many_cond() smp: Alloc percpu csd data in smpcfd_prepare_cpu() only once smp: Use task-local IPI cpumask in smp_call_function_many_cond() smp: Refactor remote CPU selection in smp_call_function_any() smp: Enable preemption early in smp_call_function_single() smp: Disable preemption explicitly in __csd_lock_wait() cpu/hotplug: Remove CPUHP_AP_ARM_CORESIGHT_CTI_STARTING smp: Use release stores for csd_lock_record() state	2026-08-18 15:29:53 -07:00
Linus Torvalds	b844715e8a	Merge tag 'locking-futex-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip ... Pull futex updates from Thomas Gleixner: - Improvements to various futex self tests: - Conversion to the selftest harness - Provide and use thread creation and synchronization helpers to reduce the dependency on delays, which tend to fail on loaded test systems - New tests for validating owner exit scenarios for robust and PI futexes - Runtime detect supported features and skip the tests if the kernel has no support - A few minor fixes * tag 'locking-futex-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: selftests/futex: Give circular-list nodes static storage selftests/futex: Use thread synchronization helpers instead of usleep() selftests/futex: Provide thread creation and synchronization helpers selftests/futex: Dynamically skip unsupported tests selftests/futex: Add FUTEX_LOCK_PI owner-exiting coverage selftests/futex: Migrate robust_list to harness selftests/futex: Migrate futex_priv_hash to harness selftests/futex: Migrate futex_numa_mpol to harness selftests/futex: Migrate futex_requeue_pi_signal_restart to harness selftests/futex: Migrate futex_requeue_pi_mismatched_ops to harness selftests/futex: Migrate futex_requeue_pi to harness selftests/futex: Migrate futex_requeue to harness selftests/futex: Migrate futex_wait_uninitialized_heap to harness selftests/futex: Migrate futex_wait_private_mapped_file to harness selftests/futex: Migrate futex_wait to harness selftests/futex: Correct validation logic in waitv selftests/futex: Migrate functional tests to harness selftests/futex: Remove static keyword from 'head' futex: Remove unnecessary NULL check before kvfree() selftests/rseq: Replace glibc-specific __GNUC_PREREQ with portable check	2026-08-18 15:26:35 -07:00
Linus Torvalds	762fffa407	Merge tag 'irq-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip ... Pull generic interrupt subsystem updates from Thomas Gleixner: - Remove pointless NULL checks of the kstats_irqs field. That's a historical left over and not longer required. - Add Radu Rendec as reviewer. Radu thankfully stepped up to help reviewing the interrupt core and the related drivers code. - The usual small improvements and fixes * tag 'irq-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: MAINTAINERS: Add Radu Rendec as reviewer for the interrupt subsystem genirq/msi: Move misplaced EXPORT_SYMBOL_GPL for msi_domain_free_irqs_all() parisc: Remove unnecessary NULL check of the kstat_irqs field genirq: Remove unnecessary NULL check of the kstat_irqs field irqdomain: Remove unnedded NULL check in __irq_domain_[de]activate_irq() genirq/manage: Use irqd_get_parent_data() helper in __irq_get_irqchip_state() irqdomain: Plug leak in irq_domain_alloc_irqs_locked() error path	2026-08-18 15:19:50 -07:00
Linus Torvalds	3424d8c18a	Merge tag 'core-entry-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip ... Pull generic entry code updates from Thomas Gleixner: - Make syscall user dispatching configurable Not all architectures can makes use of syscall user dispatching. Allow them to disable the feature completely. - Consolidate stack randomization for the generic entry code and the architectures using it. Stack randomization on syscall entry was sprinkled throughout the architecture specific low level entry code and in some cases at the wrong points, e.g. before establishing state, which violates the non-instrumentable constraints of that code. Clean this up by integrating stack randomization into the generic entry code helpers so that it is invoked at the earliest possible point right after establishing state and converting all generic entry code using architecture over. - Clean up the syscall number handling in the generic entry code. It works correctly for architectures which have a separate return value storage in pt_regs, but fails to distinguish the case where user space handed in -1 as syscall number from the case where the entry code rejects it by returning -1 to the callers. Aside of that the return value functionality of those interfaces is not really intuitive. Fix this by separating the decision to reject a syscall (user dispatch, ptrace, seccomp ...) from the potential modification of the syscall number through these mechanisms. This solves most of the problems for architectures which do not have a separate return value storage in pt_regs except for the case where a tracepoint has a BPF script or a probe attached which overwrite both the syscall number and the return value. But that's a problem which cannot be solved in the generic code, that only can be addressed by separating the storage model in the affected architectures. * tag 'core-entry-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (23 commits) entry, treewide: Make syscall_enter_from_user_mode[_work]() indicate syscall execution entry: Make return type of syscall_trace_enter() bool entry: Rework trace_syscall_enter() entry: Rework syscall_audit_enter() syscall_user_dispatch: Introduce ARCH_SUPPORTS_SYSCALL_USER_DISPATCH entry: Fix seccomp bypass after ptrace with TSYNC x86/entry: Simplify the syscall number logic x86/entry: Get rid of the sys_ni_syscall() indirection x86/entry: Make syscall functions static ptrace, treewide: Rename ptrace_report_syscall_entry() to ptrace_report_syscall_permit_entry() seccomp, treewide: Rename and convert __secure_computing() to return boolean entry: Use syscall number instead of rereading it entry: Remove syscall_enter_from_user_mode() x86/syscall: Use [syscall_]enter_from_user_mode_randomize_stack() s390/syscall: Use enter_from_user_mode_randomize_stack() riscv/syscall: Use syscall_enter_from_user_mode_randomize_stack() powerpc/syscall: Use syscall_enter_from_user_mode_randomize_stack() loongarch/syscall: Use syscall_enter_from_user_mode_randomize_stack() entry: Provide [syscall_]enter_from_user_mode_randomize_stack() randomize_kstack: Provide add_random_kstack_offset_irqsoff() ...	2026-08-18 15:00:56 -07:00
Linus Torvalds	e2457a664e	Merge tag 'sched-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip ... Pull scheduler updates from Ingo Molnar: "Load-balancing updates: - 'flatten the pick': improve cgroup scheduling, which has always been problematic and painful, which has caused various scheduling misbehavior such as the mishandling of reniced tasks et al. Add various cgroup weight distribution methods via cgroup_mode: 'up', 'max', 'concur' and 'tasks' - with the default being 'concur' which is the most precise yet also most expensive version. Finally, change cgroup scheduling to a single runqueue (Peter Zijlstra) - Series to improve the scheduling latency of short slice tasks (Vincent Guittot) - Series to fix cluster scheduling in the presence of asymmetric capacity (Ricardo Neri) - Prefer fully idle cores for NOHZ balancing (Andrea Righi) - Don't trigger active load-balancing if src_rq->curr is not on_rq (Xin Zhao) PSI updates: - Skip irqtime accounting when no new irq time has elapsed (Usama Arif) Scheduler debugging updates: - Remove unused schedstats (Shrikanth Hegde) - Defer freeing of cpumask memblock memory to initcall (Waiman Long) Misc fixes and updates by Yu C Chen, K Prateek Nayak, Peter Zijlstra, Vincent Guittot, Xin Zhao, Yury Norov, Zhan Xusheng" * tag 'sched-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (33 commits) sched/fair: Fix flat hierarchy sched/isolation: Defer freeing of cpumask memblock memory to initcall sched/topology: Restore SD_PREFER_SIBLING in domains with asymmetric capacity sched/fair: Allow load balancing between CPUs of identical capacity sched/fair: Skip misfit load accounting when the destination CPU cannot help sched/fair: Check CPU capacity before comparing group types during load balance sched/fair: Also gate overloaded status update for SD_ASYM_CPUCAPACITY sched/fair: Do not skip CPUs of similar capacity with busy SMT siblings sched/fair: Prefer fully idle cores for NOHZ balancing stop_machine: Make stop_one_cpu_nowait() return void sched/eevdf: Delayed dequeue task can't preempt sched/fair: Fix stale comments referring to removed CFS concepts sched/debug: Remove unused schedstats sched/psi: skip irqtime accounting when no new irq time has elapsed sched/fair: Reflow sched_balance_rq() sched/fair: Simplify balance_interval reset logic in sched_balance_rq() sched/fair: Don't trigger active lb if src_rq->curr is not on_rq sched/eevdf: Speedup short slice task scheduling sched/eevdf: Always update slice protection sched/eevdf: Cancel slice protection if short slice task is eligible ...	2026-08-18 13:39:48 -07:00
Linus Torvalds	dfa35434d7	Merge tag 'locking-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip ... Pull locking updates from Ingo Molnar: "Futexes: - Use runtime constants for futex_hash computation (K Prateek Nayak, Peter Zijlstra) - Optimise the size check get_futex_key() (Sebastian Andrzej Siewior) - Avoid private hash use-after-free on final put (Felix Hoffmann) - Tell kmemleak we're not leaking __futex_queues (Peter Zijlstra) Rust integration updates: - Implement refcounted interrupt disable and SpinLockIrq for Rust (Boqun Feng, Heiko Carstens, Joel Fernandes, Lyude Paul) - Rust sync: add helpers for mb, dma_mb and friends; add generic memory barriers and use LKMM atomics instead of Rust atomics in the revocable code (Gary Guo) - Add abstraction and integrate synchronize_rcu() (Philipp Stanner) Lock debugging: - Add qspinlock contended_release tracepoint (Dmitry Ilvokhin, Peter Zijlstra) - Enable the printing of held locks of remote running tasks and print task CPU (Ingo Molnar) - percpu-rwsem: Annotate intentional data race in readers_active_check() (Sun Shaojie) Misc fixes and updates by Boqun Feng, Peter Zijlstra, Fangrui Song, Naveen Kumar Chaudhary and Thomas Huth" * tag 'locking-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (44 commits) rust: sync: Introduce SpinLockIrq::lock_with() and friends rust: sync: Add SpinLockIrq rust: sync: Use super::* in spinlock.rs rust: helper: Add spin_{un,}lock_irq_{enable,disable}() helpers rust: Introduce interrupt module s390/preempt: Enable HAS_SEPARATE_PREEMPT_RESCHED_BITS arm64: sched/preempt: Enable HAS_SEPARATE_PREEMPT_RESCHED_BITS preempt: Introduce HAS_SEPARATE_PREEMPT_RESCHED_BITS sched: Avoid signed comparison of preempt_count() in __cant_migrate() sched: Remove the unused preempt_offset parameter of __cant_sleep() locking: Switch to _irq_{disable,enable}() variants in cleanup guards irq: Add KUnit test for refcounted interrupt enable/disable irq,spin_lock: Add counted interrupt disabling/enabling openrisc: Include <linux/cpumask.h> in smp.h preempt: Introduce __preempt_count_{sub,add}_return() preempt: Introduce HARDIRQ_DISABLE_BITS preempt: Track NMI nesting to separate per-CPU counter futex: Tell kmemleak we're not leaking __futex_queues x86/paravirt: Trace contended_release on unlock tracing/lock: Use TRACE_EVENT_FN() for contended_release ...	2026-08-18 13:07:17 -07:00
Linus Torvalds	8915457146	Merge tag 'perf-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip ... Pull performance events updates from Ingo Molnar: "uprobes updates: - Fix a category of bugs with optimized uprobes that can clobber the redzone area with call instruction storing return address on stack where user code may keep temporary data without adjusting RSP. Fix this by moving the optimized uprobes on top of 10-bytes NOP instruction, so we can squeeze another instruction to escape the redzone area before doing the call (Jiri Olsa, Andrii Nakryiko) - Switch uretprobes_srcu to SRCU-fast-updown, to improve performance (Puranjay Mohan) Intel CPU PMU driver updates: - Optimize ACR handling in match_prev_assignment() (Dapeng Mi) - Fix various PMU driver bugs and data leaks (Dapeng Mi) - Fix Intel PT stop/start with no update (Adrian Hunter) Intel uncore PMU driver updates: - Fix various uncore PMU setup robustness bugs (Zide Chen) AMD uncore PMU driver updates: - Add group validation (Sandipan Das) .. and misc fixes and updates by Dapeng Mi, Randy Dunlap and Zide Chen" * tag 'perf-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (42 commits) perf/x86: Optimize ACR handling in match_prev_assignment() perf/x86/intel: Fix intel_cap handling on hybrid PMUs perf/x86: Remove stale fixed counter helper and fix hybrid PMU access perf/x86/intel: Unwind cpuc state if PEBS buffer setup fails perf/x86: Guard intel_pmu_cpu_dead() against invalid hybrid PMU casts perf/x86: Free hybrid state on PMU init failure perf/x86: Unregister PMI handler on PMU init failure perf/x86/intel/pt: Fix stop/start with no update perf/x86/intel/pt: Use bitwise access for PERF_HES_STOPPED perf/x86/intel/pt: Factor out pt_config_enable() uprobes: Switch uretprobes_srcu to SRCU-fast-updown srcu: Add lock guard for srcu_fast_updown flavor perf/x86/intel/pt: Drop kernel-doc for deleted struct members perf/x86/amd/uncore: Add group validation selftests/bpf: Add tests for forked/cloned optimized uprobes selftests/bpf: Add tests for uprobe nop10 red zone clobbering selftests/bpf: Add reattach tests for uprobe syscall selftests/bpf: Change uprobe/usdt trigger bench code to use nop10 selftests/bpf: Change uprobe syscall tests to use nop10 selftests/bpf: Emit nop,nop10 instructions combo for x86_64 arch ...	2026-08-18 12:31:07 -07:00
Linus Torvalds	7b24dd46a7	Merge tag 'liveupdate-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux ... Pull liveupdate updates from Mike Rapoport: "Kexec Handover: - Fix size calculation in kho_preserved_memory_reserve() for preservations larger than 2 GiB Live Update Orchestrator: - move liveupdate selftest utilities into a library so that selftests of subsystems participating in liveupdate, e.g. PCI and VFIO, can use them and drop direct ioctl calls from the tests - add end to end liveupdate test infrastructure that allows running the tests across a kexec in QEMU - remove redundant INIT_LIST_HEAD in luo_session_alloc() - remember the error status of an FLB retrieve() and return it on subsequent attempts rather than retrying retrieve() with an FLB in an unexpected state - reference count the outgoing FLB so that it cannot be freed while a caller is using it, the same way it's done for the incoming FLB - reject nonzero reserved field in LIVEUPDATE_SESSION_FINISH so that it can be reused by a future extension" * tag 'liveupdate-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux: kho: fix size calculation in kho_preserved_memory_reserve() selftests/liveupdate: Move luo_test_utils.* into a reusable library selftests/liveupdate: Use luo_test_utils.c for liveupdate ioctl APIs liveupdate: Remember FLB retrieve() status liveupdate: Reference count outgoing FLB data liveupdate: reject nonzero reserved value for SESSION_FINISH liveupdate: Remove redundant INIT_LIST_HEAD in luo_session_alloc selftests/liveupdate: add end to end test infrastructure and scripts	2026-08-18 10:43:01 -07:00
Linus Torvalds	ba24659b1d	Merge tag 'kexec-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux ... Pull kexec updates from Mike Rapoport: - Deduplicate crash memory allocation and the exclusion of reserved crash kernel regions from architecture specific code into a generic crash_prepare_headers() and enable crashkernel CMA reservation on arm64 and riscv reservation on arm64 and riscv. - Skip purgatory checksum verification when the kexec segments cannot be corrupted by DMA, which saves about 250ms on kexec. - Replace __ASSEMBLY__ with the compiler provided __ASSEMBLER__ in include/linux/kexec.h. - Fix a keyring refcount imbalance in the kdump kernel's dm-crypt key restore path, which over-dropped the user keyring reference when more than one key was restored. * tag 'kexec-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux: crash_dump: release keyring reference at the correct time kexec: Replace __ASSEMBLY__ with __ASSEMBLER__ in header file kexec_file: skip checksum verification when safe riscv: kexec_file: Add support for crashkernel CMA reservation arm64: kexec_file: Add support for crashkernel CMA reservation powerpc/kexec_file: Use crash_exclude_core_ranges() helper LoongArch: kexec_file: Use crash_prepare_headers() helper to simplify code riscv: kexec_file: Use crash_prepare_headers() helper to simplify code x86/crash: Use crash_prepare_headers() helper to simplify code arm64: kexec_file: Use crash_prepare_headers() helper to simplify code crash: Add crash_prepare_headers() to exclude crash kernel memory powerpc/crash: sort crash memory ranges before preparing elfcorehdr riscv: kexec_file: Fix crashk_low_res not exclude bug	2026-08-18 10:28:28 -07:00
Linus Torvalds	a5778046a0	Merge tag 'pm-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm ... Pull power management updates from Rafael Wysocki: "As has been the case for quite some time, this set of changes is dominated by cpufreq updates including intel-pstate and amd-pstate driver updates, minor fixes and cleanups of other assorted cpufreq drivers, schedutil governor updates, fixes of the Rust bindings, new hardware support (IPQ5210 in qcom-nvmem), and some updates of self tests related to cpufreq. The second largest group of changes are cpuidle updates consisting of intel_idle driver updates and ACPI processor idle driver updates, both mostly related to ACPI _LPI support. There are also updates related to system sleep, mostly in the hibernation core code, two operating performance points (OPP) updates, one runtime PM framework update, one power capping update, and some tools updates including the addition of ACPI CPPC support to cpupower. Specifics: - Minor fixes and cleanups in assorted cpufreq drivers (Dan Carpenter, Guru Das Srinagesh, Haoxiang Li, Karl Mehltretter, Sasha Finkelstein, and Pan Chuang) - Fix cpufreq table creation and bios_limits() callback in the Rust bindings (Priya Bala Govindasamy) - Add IPQ5210 support to qcom-nvmem driver (Varadarajan Narayanan) - Adjust the .adjust_perf() cpufreq driver callback to allow the maximum performance value to be passed to drivers and update the intel_pstate driver to use it (Rafael Wysocki) - Set policy->cur to the actual requested frequency in the intel_pstate driver when the performance policy is used (Rafael Wysocki) - Simplify HWP handling on Broadwell processors in intel_pstate (Rafael Wysocki) - Fix setting minimum P-state at init time in intel_pstate (Rafael Wysocki) - Consolidate frequency values computation in intel_pstate and clean up code in that driver (Rafael Wysocki) - Add missing kernel-doc descriptions for structure and union members in the amd-pstate driver (David Vernet) - Handle missing policy in dynamic EPP callbacks in the amd-pstate driver (EDAMAMEX) - Introduce EXPORT_SYMBOL_FOR_PSTATE_UT() to export amd-pstate driver symbols to the amd-pstate-ut subdriver (K Prateek Nayak) - Add dynamic EPP as an "energy_performance_preference" mode in amd-pstate, remove the "amd_dynamic_epp" kernel command line option and the "dynamic_epp" sysfs attribute, and update the dynamic_epp documentation accordingly (K Prateek Nayak) - Add unit tests for CPPC Performance Priority and the "dynamic" EPP mode in the amd-pstate driver (K Prateek Nayak) - Set min_limit_freq based on bios_min_perf in amd-pstate and remove the defensive check for bios_min_perf from it (K Prateek Nayak) - Fix EPP return type and handle errors in amd-pstate during initialization, toggle auto_sel in active mode on shared memory systems, and cache the firmware programmed EPP value (Marco Scardovi) - Skip tests in amd-pstate-ut if the amd-pstate driver is not in active use (Qianheng Peng) - Replace sprintf() with sysfs_emit() in sysfs show in the cpufreq schedutil governor and fix a self-contradictory comment in sugov_iowait_apply() (Zhongqiu Han) - Fix the usage example for the sampling_rate tunable of the ondemand cpufreq governor in admin-guide (wangxiaodong) - Avoid using deep idle states during initialization in the intel_idle driver to work around device handling issues (Rafael Wysocki) - Fix and refactor the ACPI processor driver code related to ACPI _LPI support and add ACPI _LPI support to intel_idle based on that ACPI processor driver update (Rafael Wysocki) - Backup and restore governor for cpufreq sptests (Yiwei Lin) - Remove unnecessary sudo from quick_shuffle() and remove unused local variables from switch_show_governor() in cpufreq selftests (Jinseok Kim) - Rename the PM core module parameter prefix to "pm" and allow the PM transition (DPM) watchdog to be disabled by default (Tzung-Bi Shih) - Fix off-by-one in wakelocks number limit check in the system sleep sysfs interface (Haowen Tu) - Remove kernel-doc markings from helper descriptions in the core hibernation code (Adi Nata) - Use %pe to print error pointer values in the hibernation core (Ronan Marchal) - Fix memory leak in snapshot_write_next() error path (Malaya Kumar Rout) - Delay allocating and linking the next swap_map_page in the hibernation image saving code until another image page actually needs to be recorded (Haesung Kim) - Fix cleanup ordering around scope-based pointers in OPP (Gregor Herburger). - Use clk_get_optional() for optional clocks in OPP (Praveen Talari). - Stop setting runtime_error on runtime resume callback failures to allow drivers to recover from resume issues (Praveen Talari) - Handle PMU registration failure during probe in the intel_rapl_tpmi driver (Sumeet Pawnikar) - Avoid optional imports in intel_pstate_tracer unless they are really needed (Yousef Alhouseen) - Add generic CPPC performance display to the cpupower utility, build and call CPPC information on non-AMD processors, make cpupower print kernel and hardware frequency information, and add libm to cpupower for generic CPPC view (Jeremy Linton) - Remove conditional return with no effect from cpupower (Sang-Heon Jeon)" * tag 'pm-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (76 commits) cpufreq: imx6q: fix out-of-bounds write when probed more than once cpufreq: imx6q: fix devres accumulation across driver rebind rust: cpufreq: Fix temporary write in Registration::bios_limit_callback rust: cpufreq: Add CPUFREQ_TABLE_END as last table entry in TableBuilder::to_table opp: Use clk_get_optional() to avoid leaving opp_table->clk as an error pointer intel_idle: Avoid using deep idle states during initialization cpupower: remove conditional return with no effect cpufreq: intel_pstate: Adjust policy->cur in active mode to policy cpufreq/amd-pstate: Document missing kernel-doc members cpufreq/amd-pstate-ut: Add unit test for CPPC Performance Priority cpufreq/amd-pstate-ut: Add unit test for "dynamic" EPP mode cpufreq/amd-pstate: Reduce the scope of exported symbols Documentation/amd-pstate: Update dynamic_epp documentation with new behavior cpufreq/amd-pstate: Remove "amd_dynamic_epp" cmdline and "dynamic_epp" sysfs cpufreq/amd-pstate: Add dynamic EPP as an "energy_performance_preference" mode cpufreq/amd-pstate: Extract platform profile to EPP conversion into a helper cpufreq/amd-pstate: Remove the defensive check for bios_min_perf cpufreq/amd-pstate: Set min_limit_freq based on bios_min_perf powercap: intel_rapl_tpmi: Handle PMU registration failure during probe PM: sleep: Allow disabling DPM watchdog by default ...	2026-08-18 08:47:09 -07:00
Tejun Heo	fab183d632	sched_ext: Merge branch 'for-7.3-arena-args' into for-7.3 ... Pull to receive the __arena argument conversion: 67f1f4a48c ("sched_ext: Pass kernel arena pointers to ops_cid callbacks") a8dc810968 ("sched_ext: Convert sub-cap kfuncs to __arena cmask arguments") a05c5b5cb5 ("sched_ext: Convert scx_bpf_cid_override() to __arena array arguments") along with the bpf-next branch carrying the __arena argument support they depend on. Conflict in kernel/sched/ext/ext.c between: c384ab8a0b ("sched_ext: Move the config-off sub-cap kfunc stubs into sub.c") and: a8dc810968 ("sched_ext: Convert sub-cap kfuncs to __arena cmask arguments") which updated the stubs in their old ext.c location. Resolved by keeping ext.c without the stubs and applying the prototype conversion to the relocated stubs in sub.c. Signed-off-by: Tejun Heo <tj@kernel.org>	2026-08-17 11:20:34 -10:00
Linus Torvalds	55668d04e3	Merge tag 'vfs-7.3-rc1.netfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs ... Pull cachefiles ondemand removal from Christian Brauner: "This sunsets cachefiles ondemand mode. It was an effort to make fscache usable as a kernel cache for lazy pulling. EROFS over fscache was its only in-tree user. fscache has since become netfslib-oriented while EROFS never acts as a network filesystem and EROFS over fscache has been removed. So this cleans up the netfs, fscache and cachefiles side as well" * tag 'vfs-7.3-rc1.netfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: cachefiles,netfs: sunset ondemand mode	2026-08-17 13:32:50 -07:00
Linus Torvalds	fff0150b02	Merge tag 'vfs-7.3-rc1.kthread' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs ... Pull kthread vfs updates from Christian Brauner: "This stops kernel threads from sharing filesystem state with userspace. This work is about 3 cycles old and has been in -next for about that time. When the kernel boots init_task creates PID 1 and then kthreadd. From that point every kthread and PID 1 share the same fs_struct. That is why pivot_root() has to rewrite the fs_struct of all kthreads. The rewriting exists so that kthreads can use init's filesystem state when they want to. It also means userspace can move the ground out from under the kernel. PID 1 now gets a completely separate fs_struct. All kthreads are anchored in a private SB_KERNMOUNT instance of nullfs that cannot be mounted on and cannot be used to follow other mounts. Userspace init can no longer affect kthread filesystem state and kthreads can no longer affect userspace fs state without explicit opting in to that. Path lookup from a kthread now fails by default. It makes it deliberately hard to offload security sensitive operations into init's filesystem state from a kthread. Places that legitimately need to look something up there opt in through the new scoped_with_init_fs() which temporarily overrides the caller's fs_struct with init's. usermodehelpers remain the only kernel tasks that genuinely share init's filesystem state, since they execute random binaries in the root filesystem (excellent...). The visible result is that /proc/2/root is a nullfs with an empty mountinfo while /proc/1/root is the real root" * tag 'vfs-7.3-rc1.kthread' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (26 commits) initramfs_test: use test init/exit hooks to override init fs fs: stop rewriting paths for PF_EXITING | PF_DUMPCORE fs: stop rewriting kthread fs structs fs: start all kthreads in nullfs nullfs: make nullfs multi-instance devtmpfs: create private mount namespace fs: add umh argument to struct kernel_clone_args fs: stop sharing fs_struct between init_task and pid 1 af_unix: use scoped_with_init_fs() for coredump socket lookup initramfs: use scoped_with_init_fs() for rootfs unpacking pnfs/blocklayout: use scoped_with_init_fs() for SCSI device lookup ksmbd: use scoped_with_init_fs() for VFS path operations ksmbd: use scoped_with_init_fs() for filesystem info path lookup ksmbd: use scoped_with_init_fs() for share path resolution fs: use scoped_with_init_fs() for kernel_read_file_from_path_initns() coredump: use scoped_with_init_fs() for coredump path resolution btrfs: use scoped_with_init_fs() for update_dev_time() scsi: target: use scoped_with_init_fs() for APTPL metadata scsi: target: use scoped_with_init_fs() for ALUA metadata crypto: ccp: use scoped_with_init_fs() for SEV file access ...	2026-08-17 11:35:12 -07:00
Linus Torvalds	b9cba7ebfe	Merge tag 'vfs-7.3-rc1.binfmt' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs ... Pull binfmt updates from Christian Brauner: "This contains a bunch of work for binfmt_misc. It fixes a bunch of old bugs, reworks the locking, and then extends the format registry so a binary type can be matched programmatically and its interpreter computed per exec instead of being a fixed string recorded at registration time. This allows nixos and other to e.g., implement relocatable binaries meaning the interpreter/dynamic loader can be determined programatically, say found relative to the binary. The mechanism is flexible and can support other policies: - Handler lookup is now an rcu walk. An exec that matches no binfmt_misc entry should now never write to a shared cacheline - remove the VERBOSE_STATUS and USE_DEBUG compile time toggles - convert the entry file to a seq_file which simplifies things quite a bit and kills a lot of custom logic - make flags proper enums - rename struct Node to binfmt_misc_entry - allow entries to be removed with unlink(2) - Add the ability to attach bpf programs to binfmt_misc entries so it's possible to dynamically choose the execution environment such as the loader or interpreter on a per binary basis. A handler is an instance of a binfmt_misc_ops struct_ops with a ->match() and a ->load() program. match() decides from the entry lookup walk whether the handler applies under the same registration-order. It can read file content as needed not only the prefetched 256 bytes in bprm->buf. load() then selects the interpreter and stages it through the new bpf_binprm_set_interp(), bpf_binprm_set_interp_arg() and bpf_binprm_set_flags() kfuncs. Handlers are published in a registry keyed by the registering task's user namespace and activated through the existing text interface with a new 'B' type carrying the handler name: echo ':origin:B::::nix:' > /proc/sys/fs/binfmt_misc/register The permission and namespacing model is unchanged. Activating a handler requires the same write access to an instance as any other registration. A container mounting its own instance escapes the host's entries exactly as before. The computed interpreter is opened with open_exec() under the caller's credentials and goes through full LSM vetting as the next binprm level. A program can only ever redirect the caller to something the caller could exec anyway. - Two dispatch modes are added. So far the chosen interpreter owns the whole process identity (argv[0], /proc/pid/cmdline, /proc/self/exe all name interpreter information). So relocatable find the dynamic linker instead. Also a binary passed to execveat() as an inaccessible O_CLOEXEC fd cannot run at all and gdb trips because AT_ENTRY and AT_PHDR do not match the exe file. So PIE symbols are unrelocated. This adds transparent dispatch which allows the interpreter to load the binary through AT_EXECFD and leaves the argument vector exactly as the caller built it and labels mm->exe_file and comm with the binary. It also raises the AT_FLAGS_TRANSPARENT_INTERP aux vector bit. The interpreter keeps control of mapping the binary. The second mode is loader substitution. This allows a binary to be executed natively and only the interpreter to be changed. - Last, interpreters can be bound at registration time. Each interpreter is opened by its own write with the credentials the entry file was opened with. The program picks one per exec with bpf_binprm_select_interp(). Ucounts are used to properly account for pre-opened interpreters via /proc/sys/user/max_binfmt_misc_interpreters" * tag 'vfs-7.3-rc1.binfmt' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (63 commits) binfmt_misc: document the pre-opened interpreter limit selftests/exec: test the pre-opened interpreter limit binfmt_misc: correctly account pre-opened interpreters binfmt_misc: document interpreters bound by a 'B' entry selftests/exec: test interpreters bound to a 'B' entry binfmt_misc: let a 'B' entry bind its interpreters binfmt_misc: carry pre-opened interpreters in struct binfmt_misc_interp selftests/exec: share the bpf handler preconditions binfmt_misc: document registering an entry disabled selftests/exec: test registering an entry disabled selftests/exec: let binfmt_flag_supported() return a bool selftests/exec: check that a binfmt_misc instance cannot be pinned binfmt_misc: let a register string create an entry disabled binfmt_misc: document loader substitution selftests/exec: test binfmt_misc loader substitution binfmt_misc: let a bpf handler request loader substitution binfmt_misc: add the 'L' loader substitution flag binfmt_elf_fdpic: consume a stashed PT_INTERP substitute binfmt_elf: consume a stashed PT_INTERP substitute exec: carry a PT_INTERP substitute in struct linux_binprm ...	2026-08-17 08:35:25 -07:00
Linus Torvalds	043d7a2b40	Merge tags 'ipc-7.3-rc1.misc' and 'kernel-7.3-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs ... Pull misc ipc and core updates from Christian Brauner: - reject mq_notify() with a zero signal number - fix coding style in the exit path * tag 'ipc-7.3-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: mqueue: reject mq_notify with signo 0 * tag 'kernel-7.3-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: kernel: exit: fix coding style missing spaces	2026-08-17 08:27:30 -07:00
Kumar Kartikeya Dwivedi	fc009f4658	bpf: Distinguish function references in policy diagnostics ... add_subprogs() rejects both BPF-to-BPF calls and BPF_PSEUDO_FUNC loads for unprivileged programs. The latter loads a subprogram address for use as a callback, but its Policy report currently describes it as a function call and suggests avoiding calls that the program does not contain. Select the operation and suggestion from the instruction kind. Preserve the existing call wording for BPF_PSEUDO_CALL, and describe BPF_PSEUDO_FUNC as a BPF function reference. Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://lore.kernel.org/bpf/d02e6a6d3b2dc43a207b8ba836ce62497b250dede9252e7409c5212201c794b7@mail.kernel.org Link: https://lore.kernel.org/bpf/20260816015746.2632990-14-memxor@gmail.com	2026-08-17 11:58:24 +02:00
Kumar Kartikeya Dwivedi	6bd520a6e3	bpf: Preserve source attribution without source text ... GCC emits BTF line records with a file name and line number, but leaves the source line string empty. bpf_diag_source() currently treats that empty string as if the complete line record were unavailable, so diagnostics fall back to an instruction number and discard the function, file, and line attribution. Print the available source location before deciding whether source context can be rendered. When source text is absent, omit only the source context and retain the diagnostic annotation and instruction context. Fixes: b9c5d822f6 ("bpf: Add source and instruction diagnostic context") Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/20260816015746.2632990-12-memxor@gmail.com	2026-08-17 11:58:23 +02:00
Kumar Kartikeya Dwivedi	cc782c7ad0	bpf: Correct kfunc argument diagnostics ... The Call Type Safety diagnostics mishandle three kfunc argument classes. BTF type ID 0 represents void, but btf_show_name() also uses zero to end type traversal. A pointer that resolves to void therefore loses its pointee name and is rendered as "()". End traversal directly for concrete terminal types, but resolve referenced types before testing for ID zero, and name the void terminal type explicitly. Format the complete parameter pointer type for nullable kfunc arguments, so void pointers are reported as (void *). Also add the missing structured report when an __szk memory-size argument is not a verifier-known constant. Describe the generic bpf_refcount_acquire() contract without deriving an object type from its void pointer prototype. Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/668871823f90f69896d3db27b56db2f53e481162.camel@gmail.com Link: https://lore.kernel.org/bpf/20260816015746.2632990-7-memxor@gmail.com	2026-08-17 11:58:22 +02:00
Kumar Kartikeya Dwivedi	09a0c2d678	bpf: Use canonical stack argument names in diagnostics ... The main diagnostic identifies the first outgoing stack slot as stack argument 1 and the sixth function argument. The causal history instead labels the same value as stack arg6, making it look like a different slot. Render causal-history targets in the verifier's canonical stack-argument location form. The first outgoing slot is now shown as *(R11-8), matching reg_arg_name(), while the main diagnostic retains its fuller slot and ordinal description. Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/eb1be5327d136b7e5bd6d68e76fef6de20c40790.camel@gmail.com Link: https://lore.kernel.org/bpf/20260816015746.2632990-6-memxor@gmail.com	2026-08-17 11:58:22 +02:00
Kumar Kartikeya Dwivedi	b26c0b2dd5	bpf: Preserve R0 lineage across helper calls ... check_helper_call() clears all caller-saved registers before taking the diagnostic snapshot of R0. This records NOT_INIT as the old state for every helper return and loses the lineage of the value held in R0 before the call. bpf_diag_record_caller_saved() deliberately skips R0 because the paired modification scope is responsible for it. Open the R0 modification scope before clearing caller-saved registers, matching the kfunc, ld_abs, and subprogram call paths. Reported-by: Sashiko <sashiko-bot@kernel.org> Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/20260815073833.A93A91F000E9@smtp.kernel.org Link: https://lore.kernel.org/bpf/48e6f021b89562f68850fe21ef8c78719819b04cf9c4e4f50bc791937d37ace8@mail.kernel.org Link: https://lore.kernel.org/bpf/20260816015746.2632990-4-memxor@gmail.com	2026-08-17 11:58:21 +02:00
Junseo Lim	1b5aacd5b2	bpf: Reject negative optlen in cgroup getsockopt hook ... A cgroup getsockopt BPF program can shrink ctx->optlen after the kernel getsockopt handler has run. The kernel-buffer variant, used by TCP_ZEROCOPY_RECEIVE, only rejects values larger than the original length. If BPF writes a negative optlen, that value is accepted and propagated back to the TCP getsockopt code. It can then be passed to copy_to_sockptr() as a size_t and trigger the hardened usercopy bytes > INT_MAX warning. Reject negative ctx.optlen in __cgroup_bpf_run_filter_getsockopt_kern(), matching the lower-bound validation already present in the sockptr-based getsockopt hook. Fixes: 9cacf81f81 ("bpf: Remove extra lock_sock for TCP_ZEROCOPY_RECEIVE") Reported-by: Sechang Lim <rhkrqnwk98@gmail.com> Signed-off-by: Junseo Lim <zirajs7@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/bpf/187a4d756275aaaee5d65eecb63c1477b3b66554.1786448307.git.zirajs7@gmail.com	2026-08-17 11:33:29 +02:00
Daniel Borkmann	d99bda7f01	bpf: Rewrite any fault prone load out of a mem or btf_id pointer ... bpf_convert_ctx_accesses() turns a BPF_LDX into a BPF_PROBE_MEM one by matching the type recorded for the insn against a list of exact pointer types. The list cannot keep up with the flag combinations the verifier produces, and a type which is missing from it ends up as a plain load without an exception table entry, so a bad address panics the kernel instead of being handled. Two such types exist today and are reachable: - PTR_TO_BTF_ID | PTR_UNTRUSTED | MEM_ALLOC | NON_OWN_REF - PTR_TO_BTF_ID | PTR_UNTRUSTED | MEM_RCU Rather than adding the two, just drop the list and state the property itself in the default case of the switch. This is a superset of what the list matched, the untrusted PTR_TO_MEM does not have to carry MEM_RDONLY for it anymore, and it stays in sync with the verifier side which uses the same match in save_aux_ptr_type() and reg_type_mismatch_ok(). Assert that a fault prone type which does not get the rewrite for whatever reason is rejected at load time rather than left to fault at runtime to catch any future cases. Fixes: 1b12171533 ("bpf: Mark direct ld of stashed bpf_{rb,list}_node as non-owning ref") Fixes: 6fcd486b3a ("bpf: Refactor RCU enforcement in the verifier.") Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/20260814215301.709827-4-daniel@iogearbox.net	2026-08-17 10:06:42 +02:00
Daniel Borkmann	ee9ad135b2	bpf: Reject a store through a fault prone pointer ... check_ptr_to_btf_access() allows the program to store before the default BTF access path gets to reject a non read access. ac65c710cc ("bpf: Reject writes through untrusted BTF pointers") closed that for a PTR_UNTRUSTED pointer, but a bare PTR_TO_BTF_ID may fault on a dereference just the same and is let through. A BPF_LDX gets the BPF_PROBE_MEM rewrite in bpf_convert_ctx_accesses() and a bad address is handled, but a BPF_STX does not and cannot, there is no probed store to rewrite. The store is emitted as a plain one without an exception table entry and a bad address panics the kernel. A bpf_qdisc program can reach this, bpf_qdisc_btf_struct_access() permits a write to Qdisc::limit and Qdisc::next_sched is a plain struct Qdisc pointer which the walk turns into the compat type: struct Qdisc *next = sch->next_sched; next->limit = 1000; BUG: kernel NULL pointer dereference, address: 0000000000000014 RIP: 0010:bpf_prog_c6e14e7f32c8e325_bpf_fifo_enqueue+0x3a/0x12b Code: [...] bf e8 03 00 00 <89> 7e 14 41 8b 7f 14 [...] Kernel panic - not syncing: Fatal exception in interrupt Fix by widen the check to bpf_may_fault_on_deref() so that it covers both. Fixes: 27ae7997a6 ("bpf: Introduce BPF_PROG_TYPE_STRUCT_OPS") Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/20260814215301.709827-3-daniel@iogearbox.net	2026-08-17 10:06:16 +02:00
Daniel Borkmann	f438ba7a4c	bpf: Treat a fault prone PTR_TO_MEM as a pointer type mismatch ... reg_type_mismatch_ok() enumerates the pointer types which must not silently share a BPF_LDX with a different one, since the type recorded for the insn drives a rewrite in bpf_convert_ctx_accesses(). f2362a57ae ("bpf: allow void* cast using bpf_rdonly_cast()") added PTR_TO_MEM | MEM_RDONLY | PTR_UNTRUSTED as another type in need of one, namely the BPF_PROBE_MEM rewrite, but did not add it there. Fix it by adding the missing case to reg_type_mismatch_ok(), so that a PTR_TO_MEM which may fault on deref is not mismatch ok anymore. The triage in save_aux_ptr_type() then merges them. Fixes: f2362a57ae ("bpf: allow void* cast using bpf_rdonly_cast()") Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/20260814215301.709827-2-daniel@iogearbox.net	2026-08-17 10:05:39 +02:00
Daniel Borkmann	09c447564f	bpf: Keep fault protection when merging pointer types ... When the same BPF_LDX instruction is reached through paths that yield different pointer types, save_aux_ptr_type() merges them into a single type which is later used by bpf_convert_ctx_accesses() to decide whether the load has to be rewritten into a BPF_PROBE_MEM one. Before f2362a57ae ("bpf: allow void* cast using bpf_rdonly_cast()") the merge only accepted two PTR_TO_BTF_ID pointers and unconditionally fell back to PTR_TO_BTF_ID | PTR_UNTRUSTED, so the merged type was always one that gets the BPF_PROBE_MEM rewrite. However, the mentioned commit widened the merge to also cover a PTR_TO_MEM base and replaced the fallback by a union of the PTR_UNTRUSTED and MEM_RDONLY flags. A union of flags though cannot express the property the later rewrite is built upon, some examples: - PTR_TO_MEM merged with PTR_TO_BTF_ID | PTR_UNTRUSTED gets PTR_TO_MEM | PTR_UNTRUSTED but only the MEM_RDONLY variant is valid - PTR_TO_MEM merged with a plain PTR_TO_BTF_ID gets PTR_TO_MEM dropping the rewrite the latter type would have gotten - PTR_TO_MEM | MEM_RDONLY merged with a plain PTR_TO_BTF_ID gets PTR_TO_MEM | MEM_RDONLY which is not rewritten either since only its PTR_UNTRUSTED variant is In all three cases a program can take the unsafe path at runtime with a NULL or otherwise bad pointer and panic the kernel on the faulting load: BUG: kernel NULL pointer dereference, address: 0000000000000038 RIP: 0010:bpf_prog_77531a87032eeaf1_mixed_mem_btf_id_type+0x4b/0x65 Call Trace: <TASK> bpf_test_run+0x20b/0x460 bpf_prog_test_run_skb+0x650/0xbe0 __sys_bpf+0xb96/0x3140 __x64_sys_bpf+0x2c/0x40 do_syscall_64+0xba/0x590 Kernel panic - not syncing: Fatal exception in interrupt Note that the last two shapes have to be fixed right here, otherwise the merged type retains nothing which marks the load as fault prone, thus no rule in bpf_convert_ctx_accesses() can recover it. Fix it by normalizing the merged type instead. Reuse it in is_load_acq_unsafe() to avoid open coding, and trim the overly verbose comment which is more of an implementation detail of bpf_convert_ctx_accesses() anyway. Fixes: f2362a57ae ("bpf: allow void* cast using bpf_rdonly_cast()") Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/20260814215301.709827-1-daniel@iogearbox.net	2026-08-17 10:05:16 +02:00
Yiyang Chen	4bc49ae344	bpf: Check pointer type for all atomic RMW paths ... Atomic RMW verification records an instruction pointer type only when the current destination is PTR_TO_ARENA. A second path can therefore reach the same instruction with an ordinary pointer without comparing it against the saved arena type. The post-verification fixup uses the saved type to rewrite the instruction to BPF_PROBE_ATOMIC for every path. Record the actual destination type for all atomic RMW paths so the existing mismatch check rejects incompatible uses of one instruction. Fixes: d503a04f8b ("bpf: Add support for certain atomics in bpf_arena to x86 JIT") Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://patch.msgid.link/20260816-bpf-next-038-mixed-atomic-v1-v2-1-4644c1886dbc@mails.tsinghua.edu.cn Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>	2026-08-16 15:54:17 -07:00
Linus Torvalds	fd923b32d7	Merge tag 'sched_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip ... Pull scheduler fix from Borislav Petkov: - Make sure a delayed sched entity's runtime stats are updated at the right time so that it receives the proper lag compensation * tag 'sched_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched: Update time before requeueing delayed entities	2026-08-16 11:15:23 -07:00
Linus Torvalds	9da3fc37f5	Merge tag 'perf_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip ... Pull perf fixes from Borislav Petkov: - Prevent the use of exited events as group leaders - Avoid use-after-free of an event's group leader by promoting detached sibling events to standalone entities and correct related accounting and state transitions * tag 'perf_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/core: Fix group leader use-after-free after sibling detach perf: Reject exited events as group leaders	2026-08-16 10:31:05 -07:00
Tejun Heo	d023aa69c3	sched_ext: Drop the dead SCX_DEQ_CORE_SCHED_EXEC test in dequeue_task_scx() ... dequeue_task_scx() masks SCX_DEQ_CORE_SCHED_EXEC out of the SCX_DEQ_SCHED_CHANGE decision, but the test can never fire: the incoming flags are an int of generic DEQUEUE_* bits while the flag is bit 32, and the core-sched execute path never goes through class dequeue anyway - set_next_task_scx() calls ops_dequeue() with the flag directly. The test was live when the SCX_DEQ_SCHED_CHANGE computation sat in ops_dequeue() and became dead when 03f5304aad ("sched_ext: Pass full dequeue flags to ops.quiescent()") moved the computation here. Drop it. Signed-off-by: Tejun Heo <tj@kernel.org>	2026-08-15 16:07:49 -10:00
Tejun Heo	006dd4d04b	sched_ext: Make core-sched task ordering hierarchy-aware ... With sub-schedulers, tasks of different schedulers routinely share rqs and SMT siblings, but scx_prio_less() consults ops.core_sched_before() only when both tasks belong to the same scheduler. Every pair spanning two schedulers falls back to the default ordering, so no scheduler can express ordering across a scheduler boundary, including a root over its sub-schedulers' tasks. Order a pair spanning schedulers by the nearest common ancestor that implements ops.core_sched_before(): both tasks are in its subtree, making this the one op where a scheduler is called on tasks it delegated to its sub-schedulers and may not be scheduling anymore. Same-scheduler pairs keep using the owning scheduler's op so a parent never orders inside a subtree it delegated. The op is skipped when the deciding scheduler is bypassing on either task's CPU. Update scx_qmap to fall back to the kernel's default ordering when handed a delegated task it has no task_ctx for. Signed-off-by: Tejun Heo <tj@kernel.org>	2026-08-15 16:07:49 -10:00