linux.git/tools/testing, branch master

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

2026-07-21T15:26:21+00:00

Pull kvm fixes from Paolo Bonzini: "RISC-V: - Avoid redundant allocations when allocating IMSIC page tables - Apply SBI FWFT LOCK flag only on successful set - Bound SBI PMU counter mask scan to BITS_PER_LONG, since on RV32 the PMU SBI start/stop helper can only access 32 PMU counters. - Skip TLB flush when G-stage PTE becomes valid if the Svvptc extension is available. - Always show Zicbo[m|z|p] block sizes in ONE_REG - Inject instruction access fault on unmapped guest fetch - Use raw spinlock for irqs_pending and irqs_pending_mask - Fix Spectre-v1 in vector register access via ONE_REG x86: - Fixes to SEV selftests - Once free_nested() did a VMCLEAR of shadow VMCS, there's no need to VMCLEAR it again if the kernel is preempted and thread migration happens - Preserve nested TDP shadow page tables if they are used as roots, instead of clearing them unnecessarily - Fix use of stale data if out-of-memory happens after vendor module reload - Check for invalid/obsolete root *after* making MMU pages available, because the latter can make a page invalid - Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN KVM: selftests: sev_init2_tests: Derive SEV availability from KVM KVM: selftests: sev_smoke_test: Only run VM types the host offers KVM: x86/mmu: Fix use-after-free on vendor module reload KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots KVM: x86: Check for invalid/obsolete root *after* making MMU pages available KVM: nVMX: Hide shadow VMCS right after VMCLEAR KVM: riscv: Fix Spectre-v1 in vector register access RISC-V: KVM: Serialize virtual interrupt pending state updates RISC-V: KVM: Inject instruction access fault on unmapped guest fetch RISC-V: KVM: Zicbo[m|z|p] block sizes should be always present in ONE_REG riscv: kvm: Skip TLB flush when G-stage PTE becomes valid with Svvptc KVM: riscv: PMU: Bound counter mask scan to BITS_PER_LONG KVM: riscv: SBI FWFT: Apply LOCK flag only on successful set RISC-V: KVM: Avoid redundant page-table allocations in ioremap topup

KVM: selftests: sev_init2_tests: Derive SEV availability from KVM

2026-07-21T10:25:27+00:00

The test asserted that the X86_FEATURE_SEV CPUID bit exactly matches whether KVM offers KVM_X86_SEV_VM. That is not an invariant: when all SEV ASIDs are assigned to SEV-SNP, KVM does not offer the SEV VM type even though CPUID reports SEV, so the test aborts on an SNP-only host. Derive SEV availability from KVM_CAP_VM_TYPES (as already done for SEV-ES and SNP), assert only the one-way implication that a type offered by KVM is also reported in CPUID, and TEST_REQUIRE() the SEV VM type so the test skips cleanly when it is unavailable. Reviewed-by: Tycho Andersen (AMD) Signed-off-by: David Woodhouse Message-ID: <5d3c345113748f39b7982e365d241abaf3e11086.1784545391.git.dwmw@amazon.co.uk> Signed-off-by: Paolo Bonzini

KVM: selftests: sev_smoke_test: Only run VM types the host offers

2026-07-21T10:25:26+00:00

sev_smoke_test ran the plain SEV subtest unconditionally, gated only on the X86_FEATURE_SEV CPUID bit, while gating SEV-ES and SNP on the KVM_CAP_VM_TYPES bits. CPUID reporting SEV does not mean KVM offers the SEV VM type: when all SEV ASIDs are assigned to SEV-SNP, KVM_X86_SEV_VM is unavailable even though X86_FEATURE_SEV is set. On such a host the test aborts in KVM_CREATE_VM instead of exercising the available modes. Gate the SEV subtest on KVM_CAP_VM_TYPES like the others, so the test runs the VM types the host actually offers. Reviewed-by: Tycho Andersen (AMD) Signed-off-by: David Woodhouse Message-ID: <2b5e7a83d277134294199a455469bb436196b902.1784545391.git.dwmw@amazon.co.uk> Signed-off-by: Paolo Bonzini

Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

2026-07-17T19:55:24+00:00

Pull bpf fixes from Kumar Kartikeya Dwivedi: - Fix a UAF in socket clone early bailout paths (Matt Bobrowski) - Reject unhashed UDP sockets on sockmap update to prevent refcount leaks (Michal Luczaj) - Account for receive queue data in FIONREAD on sockmap sockets without a verdict program (Mattia Meleleo) - Reject negative constant offsets for verifier buffer pointers (Sun Jian) - Fix for tracing of kfuncs with implicit arguments (Ihor Solodrai) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: selftests/bpf: Cover tracing implicit kfunc args bpf: Fix tracing of kfuncs with implicit args selftests/bpf: Cover negative buffer pointer offsets bpf: Reject negative const offsets for buffer pointers selftests/bpf: Test FIONREAD on a sockmap socket without a verdict program bpf, sockmap: Account for receive queue in FIONREAD without a verdict program selftests/bpf: Fail unbound UDP on sockmap update selftests/bpf: Adapt sockmap update error handling bpf, sockmap: Reject unhashed UDP sockets on sockmap update selftests/bpf: Ensure UDP sockets are bound bpf: Fix UAF in sock clone early bailouts

Merge tag 'net-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2026-07-17T17:25:13+00:00

Pull networking fixes from Paolo Abeni: "Including fixes from Wireless, IPsec, Netfilter and Bluetooth. Current release - new code bugs: - netfilter: flowtable: use correct direction to set up tunnel route Previous releases - regressions: - wifi: - mac80211: - free AP_VLAN bc_buf SKBs outside IRQ lock - defer link RX stats percpu free to RCU - fix double free on alloc failure - cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock - ipv4: free fib_alias with kfree_rcu() on insert error path - sched: act_tunnel_key: Defer dst_release to RCU callback - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() - bluetooth: fix locking in unpair_device/disconnect_sync - can: add locking for raw flags bitfield - openvswitch: reject oversized nested action attrs - eth: - bnxt_en: handle partially initialized auxiliary devices - ppp: defer channel free to an RCU grace period to fix UAF Previous releases - always broken: - netfilter: xt_nat: reject unsupported target families - wifi: - brcmfmac: fix heap overflow on a short auth frame - cfg80211: add missing FTM API validation - xfrm: - reject optional IPTFS templates in outbound policies - policy: preallocate inexact bins before xfrm_hash_rebuild reinsert - bluetooth: revalidate LOAD_CONN_PARAM queued update - can: fix lockless bound/ifindex race and silent RX_SETUP failure - eth: mlx5: free mlx5_st_idx_data on final dealloc" * tag 'net-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (108 commits) mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n llc: fix SAP refcount leak when creating incoming sockets selftests: netconsole: only restore MAC when it changed on resume bnxt_en: Handle partially initialized auxiliary devices sctp: fix auth_hmacs array size in struct sctp_cookie net/sched: act_tunnel_key: Defer dst_release to RCU callback dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() tcp: fix TIME_WAIT socket reference leak on PSP policy failure net/mlx5: free mlx5_st_idx_data on final dealloc can: isotp: serialize TX state transitions under so->rx_lock can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER can: isotp: use unconditional synchronize_rcu() in isotp_release() can: bcm: track a single source interface for ANYDEV timeout/throttle ops can: bcm: fix data race on rx_stamp/rx_ifindex in bcm_rx_handler() can: bcm: fix stale rx/tx ops after device removal can: bcm: add missing device refcount for CAN filter removal can: bcm: validate frame length in bcm_rx_setup() for RTR replies can: bcm: extend bcm_tx_lock usage for data and timer updates can: bcm: add missing rcu list annotations and operations can: bcm: fix CAN frame rx/tx statistics ...

selftests: netconsole: only restore MAC when it changed on resume

2026-07-17T11:15:20+00:00

The "mac" bind mode reactivation downs the interface, restores the saved MAC and renames it to trigger a target resume. This assumes the recreated interface comes back with a different MAC, which is true under MACAddressPolicy=none (as on the Netdev CI) but not when MACs are persistent. In the persistent case netconsole resumes the target on its own, and the down/restore/rename flow instead drops it and fails the test. Guard the block on the MAC having actually changed so the test passes under both policies. Fixes: 6ecc08329bab ("selftests: netconsole: validate target resume") Reported-by: Matthieu Baerts (NGI0) Closes: https://lore.kernel.org/netdev/f398373e-2cb4-4649-a491-9763df94d98b@kernel.org/ Signed-off-by: Andre Carvalho Tested-by: Matthieu Baerts (NGI0) Reviewed-by: Breno Leitao Link: https://patch.msgid.link/20260710-netcons-mac-reload-v1-1-3fb1bcc70b4a@gmail.com Signed-off-by: Paolo Abeni

selftests/bpf: Cover tracing implicit kfunc args

2026-07-16T23:11:29+00:00

KF_IMPLICIT_ARGS kfuncs have a BPF-call prototype and a real kernel target prototype. Add a tracing selftest that attaches fentry and fexit programs to bpf_kfunc_implicit_arg(), runs a syscall BPF program that calls it, and checks that the tracing context exposes both the explicit argument and the implicit prog aux pointer. Co-developed-by: Ihor Solodrai Signed-off-by: Kumar Kartikeya Dwivedi Signed-off-by: Ihor Solodrai Link: https://patch.msgid.link/20260713235223.1639022-3-ihor.solodrai@linux.dev Signed-off-by: Eduard Zingerman

Merge tag 'landlock-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux

2026-07-16T20:22:17+00:00

Pull landlock fix from Mickaël Salaün: "This fixes TCP Fast Open support, specific test environments, and doc warnings" * tag 'landlock-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: selftests/landlock: Skip scoped_signal subtest with MSG_OOB if not available selftests/landlock: Fix screwed up pointers in the scoped_signal_test landlock: Update formatting landlock: Fix kernel-doc for the nested quiet layer flag selftests/landlock: Add test for TCP fast open landlock: Fix TCP Fast Open connection bypass

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

2026-07-16T14:25:13+00:00

Pull kvm fixes from Paolo Bonzini: "arm64: - Fix an accounting buglet when reclaiming pages from a protected guest - Fix a bunch of architectural compliance issues when injecting a synthesised exception, most of which were missing the PSTATE.IL bit indicating a 32bit-wide instruction - Another set of fixes addressing issues with translation of VNCR_EL2, including corner cases where the guest point that register at a RO page... - Don't warn when trapping accesses to ZCR_EL2 from an L2 guest, as that's not unexpected at all - Address a bunch of races with LPI migration vs LPIs being disabled - Fix a total howler of a bug combining FEAT_MOPS and NV, resulting in exception returning in the wrong place... - Move locking for kvm_io_bus_get_dev() into the caller, ensuring race-free checks that the returned object is of the correct type - Fix initialisation of the page-table walk level when relaxing permissions - Correctly update the XN attribute when relaxing permissions - Fix the sign extension of loads from emulated MMIO regions - Assorted collection of fixes for pKVM's FFA proxy, together with a couple of FFA driver adjustments - Coerce Fuad Tabba into a reviewer role, and may his Inbox catch fire! s390: - more gmap KVM memory management fixes - PCI passthru fixes x86: - Fix a bug where KVM will trigger a UAF if updating IOMMU IRTEs fails when registering an IRQ-bypass producer - Ignore pending PV EOI instead of BUG()ing the host if the feature was disabled by the guest - Fix nVMX bugs where KVM would run L1 with an L1-controlled CR3 after a failed "late" consistency check when KVM is NOT using EPT - Disallow intra-host migration/mirroring of SNP VMs as KVM doesn't yet support moving/mirroring SNP state - Fix a TOCTOU bug in KVM's handling of the "trusted" CPUID for TDX guests - Fix a NULL pointer deref in trace_kvm_inj_exception() where a change to the core infrastructure missed KVM's unique (ab)use of __print_symbolic() - Put vmcs12 pages if nested VM-Enter fails due to invalid guest state - Fix TLB conflicts between two VMs if one of them VM is run on a CPU before and after it is hotplugged" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (48 commits) KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state KVM: x86: Fix null pointer deref due to dummy array in trace_kvm_inj_exception() KVM: TDX: Reject concurrent change to CPUID entry count KVM: selftests: Verify SNP VMs are rejected from migration and mirroring KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs KVM: s390: pci: Fix handling of AIF enable without AISB KVM: s390: Improve kvm_s390_vm_stop_migration() KVM: s390: Fix dat_crste_walk_range() early return KVM: s390: vsie: Avoid potential deadlock with real spaces KVM: s390: pci: Fix GISC refcount leak on AIF enable failure KVM: nVMX: Don't use vmcs01.GUEST_CR3 to snapshot L1's CR3 when EPT is disabled KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into "normal" checks KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs KVM: x86: Nullify irqfd->producer if updating IRTE for bypass fails KVM: arm64: Fix propagation of TLBI level in kvm_pgtable_stage2_relax_perms() firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() KVM: arm64: Zero out the stack initialized data in the FFA handler KVM: arm64: Ensure FFA ranges are page aligned ...

Merge tag 'linux_kselftest-fixes-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest

2026-07-15T22:37:11+00:00

Pull kselftest fixes from Shuah Khan: - Fix ftrace reading enabled_func test in add_remove_fprobe_module test - Fix tracing trigger-hist-poll.tc to use sched_process_exit * tag 'linux_kselftest-fixes-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests/tracing: Have trigger-hist-poll.tc use sched_process_exit selftests/ftrace: Fix reading enabled_functions in add_remove_fprobe_module test