summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-10-15bpf, x86: Compare against 0, 127 and -128 with the adjusted conditionDaniel Borkmann
A strict compare against 1 or 128 is the non-strict compare against 0 or 127, and a strict compare against -129 or, with a signed condition, -1 the non-strict compare against -128 or 0. LLVM canonicalizes x <= 0 to x < 1, x >= 0 to x > -1 and x <= 127 to x < 128, so these reach the JIT as compares against 1, -1 and 128. Adjust the condition and the immediate, so that the compare against 0 becomes the test without an immediate already emitted for it and 127 and -128 fit into an imm8. Before, for if r1 s> -1 goto ... and if r1 < 128 goto ...: 48 83 ff ff cmpq $-0x1,%rdi 7f xx jg ... 48 81 ff 80 00 00 00 cmpq $0x80,%rdi 72 xx jb ... After: 48 85 ff testq %rdi,%rdi 7d xx jge ... 48 83 ff 7f cmpq $0x7f,%rdi 76 xx jbe ... Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20261013171230.523677-6-daniel@iogearbox.net Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-10-15bpf, x86: Use shorter test and cmp encodings for immediatesDaniel Borkmann
test has no sign-extended imm8 form, so a JSET against a constant was always emitted as a 6 to 7 byte test with imm32. When the mask fits into the low byte, the result only depends on that byte, so test the 8-bit register instead, which takes 2 to 4 bytes. Reading the low byte of a register that was written as a whole has no partial register penalty on Intel or AMD cores. Also use the one byte shorter accumulator forms of test and cmp with imm32 when the destination is r0, like the ALU immediates already do. Before/after for if r1 & 0x40 goto ...: 48 f7 c7 40 00 00 00 testq $0x40,%rdi 40 f6 c7 40 testb $0x40,%dil Before/after for if r0 == 0x1000 goto ...: 48 81 f8 00 10 00 00 cmpq $0x1000,%rax 48 3d 00 10 00 00 cmpq $0x1000,%rax Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20261013171230.523677-5-daniel@iogearbox.net Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-10-15bpf, x86: Shorten the stack adjusts and the tail call counter loadsDaniel Borkmann
The prologue and the tail call sequences always used the imm32 forms of sub/add rsp and a disp32 load of the tail call counter pointer, even when the rounded stack depth fits into a byte. Route them through the existing emit_sub_rsp()/emit_add_rsp() and emit_ldx() helpers which pick the short forms, and derive the ip adjustment for the counter load in front of a subprog call from the emitted length instead of hardcoding the 7 bytes. Nothing depends on the size of these instructions: the tail call entry offset covers only the code in front of the stack adjustment, and the poke targets are computed from the emitted bytes. Before/after for a program with 32 bytes of stack: 48 81 ec 20 00 00 00 subq $0x20,%rsp 48 83 ec 20 subq $0x20,%rsp 48 8b 85 d0 ff ff ff movq -0x30(%rbp),%rax 48 8b 45 d0 movq -0x30(%rbp),%rax Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20261013171230.523677-4-daniel@iogearbox.net Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-10-15bpf, x86: Omit the displacement byte for zero offsetsDaniel Borkmann
A memory operand with a zero offset was encoded with a mod 01 ModR/M and an explicit zero displacement byte. Use the mod 00 form instead, which saves a byte for every load, store and atomic with a zero offset, as LLVM emits them for the first field of a struct and for every plain pointer dereference. The exception are rbp and r13 as base register, where mod 00 with r/m 101 selects a RIP-relative disp32 and with SIB base 101 a disp32 without base, so these keep their displacement byte. Also let emit_st() reuse emit_insn_suffix() instead of open-coding the ModR/M encoding. Before/after for r0 = *(u64 *)(r1 + 0): 48 8b 47 00 movq 0x0(%rdi),%rax 48 8b 07 movq (%rdi),%rax Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20261013171230.523677-3-daniel@iogearbox.net Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-10-15bpf, x86: Drop redundant REX prefixes from zero and sign extensionsDaniel Borkmann
movzx into a 32-bit register already clears the upper 32 bits, so the REX.W prefix on the 8 and 16-bit BPF_LDX loads only costs a byte. This also matches what the arena variants of these loads emit. Likewise, the 32-bit movsx from an 8-bit register only needs a REX prefix when the destination is an extended register or the source is sil, dil, bpl or an extended register. LLVM emits these loads for u8 and u16 fields and, with cpu v4, the movsx for a cast to s8 or s16. Before/after for r0 = *(u8 *)(r1 + 0): 48 0f b6 47 00 movzbq 0x0(%rdi),%rax 0f b6 47 00 movzbl 0x0(%rdi),%eax Before/after for w1 = (s8)w0: 40 0f be f8 movsbl %al,%edi 0f be f8 movsbl %al,%edi Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20261013171230.523677-2-daniel@iogearbox.net Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-10-14iommufd: Reject a zero-length dirty bitmap requestAndrea Parri
iommufd_check_iova_range() subtracts one from bitmap->length before it checks the length, so a zero-length request wraps to SIZE_MAX. With iova = 0 the wrapped value passes the overflow and alignment checks, and the request reaches iova_bitmap_alloc() with length 0. iova_bitmap_alloc() then sizes the bitmap from a length - 1 of SIZE_MAX, so mapped_total_index is effectively unbounded. The scan uses last_iova = ULONG_MAX, which spans the whole IOAS when an area is mapped at IOVA 0. Reject a zero length before the subtraction. Fixes: b9a60d6f850e ("iommufd: Add IOMMU_HWPT_GET_DIRTY_BITMAP") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Andrea Parri <parri.andrea@gmail.com> Link: https://patch.msgid.link/20260925161142.189813-4-parri.andrea@gmail.com Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-10-14iommufd/iova_bitmap: Fail GET_DIRTY_BITMAP when a bitmap page cannot be pinnedSamarth Narang
The iova_bitmap_set() function reports dirty IOVAs into a user-provided bitmap, it does so by pinning the bitmap pages lazily one chunk at a time as the reported IOVA advances. When advancing to the next chunk fails, the function simply returns without recording the dirty bits. if (iova_bitmap_advance_to(bitmap, iova)) return; So on an IOMMU_HWPT_GET_DIRTY_BITMAP ioctl, if any bitmap chunk past the first cannot be pinned, the dirty pages in that chunk are cleared in the page table, not set in the bitmap, and the ioctl will still return success. This means that the destination VM will observe stale memory. This patch records the first such error in the iova_bitmap and propagates it so the ioctl fails instead of silently succeeding. Fixes: 4a00f9434891 ("iommupt: Add read_and_clear_dirty op") Signed-off-by: Samarth Narang <samarth.colleges@gmail.com> Link: https://patch.msgid.link/20261013171045.3104619-1-samarth.colleges@gmail.com Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-10-14iommufd: Fix event queue release use-after-freeNirmoy Das
iommufd_eventq_fops_release() drops the file's users reference before reading eventq->ictx. Once that reference is dropped, IOMMU_DESTROY in another thread can remove and free the event queue, so the later load accesses freed memory. Read ictx while the users reference still pins the event queue, then drop the reference and put the saved context. The context reference taken by iommufd_eventq_init() keeps ictx valid until the put. Fault and vEVENTQ file descriptors share this release path. Fixes: 07838f7fd529 ("iommufd: Add iommufd fault object") Cc: stable@vger.kernel.org Assisted-by: LLM, Specula Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com> Link: https://patch.msgid.link/20261014133632.3440297-1-nirmoyd@nvidia.com Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-10-14iommufd: Keep dmabuf PFNs MMIO when filling another domainAndrea Parri
A VFIO PCI dmabuf mapped into an IOAS is mapped with IOMMU_MMIO only in the domains present when it is mapped. A domain added later, or a copy of the area into another IOAS, maps the same BAR as cacheable CPU memory: IOMMU_CACHE set and IOMMU_MMIO clear. Once the area is in pages->domains_itree, pfn_reader_fill_span() reads its PFNs back from the storage domain through batch_from_domain(), which adds them with batch_add_pfn() as BATCH_CPU_MEMORY. Only a hole in the span reaches pfn_reader_fill_dmabuf() and gets BATCH_MMIO, so batch_to_domain() programs the later domain with the wrong prot. The effect depends on the page table format. io-pgtable-arm maps the BAR as Normal cacheable instead of Device memory, the AMDv1 and x86_64 generic_pt formats set the SME C-bit on it when the tables are encrypted, and the RISC-V format with Svpbmt maps it as normal memory instead of IO. Read dmabuf PFNs from the recorded phys for every span, before the xarray and domain paths. The phys range is always available, and the read-back from a domain only serves to avoid re-pinning user pages. Sashiko pointed this out while reviewing an RFC that plumbs the dma-buf memory type through pfn_reader_fill_dmabuf(). Fixes: 74014a4b55f5 ("iommufd: Have pfn_reader process DMABUF iopt_pages") Reported-by: Sashiko <sashiko-bot@kernel.org> Link: https://lore.kernel.org/all/20260716154123.32DC01F000E9@smtp.kernel.org/ Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Andrea Parri <parri.andrea@gmail.com> Link: https://patch.msgid.link/20261008125206.11990-2-parri.andrea@gmail.com Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-10-14iommufd: Keep reserved IOVA ranges when a replace within one IOAS failsDonggeun Yoo
iommufd_device_do_replace() installs the group's reserved IOVA ranges in the new hwpt's IOAS only when it differs from the old hwpt's IOAS. If the replace fails in iommufd_device_do_replace() or iommufd_group_do_replace_reserved_iova(), the error paths remove the ranges from the new hwpt's IOAS whether or not the IOAS is shared between the old and new hwpt, which removes the ranges that the old hwpt still needs. For example, on x86 with intel-iommu, after a replace within a shared IOAS fails with -ENODEV, IOMMU_IOAS_IOVA_RANGES goes from 0x0-0xfedfffff 0xfef00000-0xffffffffffff to 0x0-0xffffffffffff and IOMMU_IOAS_MAP at 0xfee00000 succeeds. Remove the ranges on failure only when the replace installed them, and look up the old hwpt_paging before the replace so that the error path can compare the IOAS. Fixes: e88d4ec154a8 ("iommufd: Add iommufd_device_replace()") Assisted-by: LLM Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com> Link: https://patch.msgid.link/20260929031402.1998253-1-donggeunyoo.kernel@gmail.com Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-10-15Merge tag 'v7.4-rockchip-dts64-2' of ↵Alexandre Belloni
https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt New boards: MangoPi M28K, NanoPi R28S, DFRobot UNIHIKER M10 V1.2 The gpio controllers on the RK3576 are always on, so they can get aliases in the main soc dtsi. Apart from that some cleanup of MMC properties and some board changes. * tag 'v7.4-rockchip-dts64-2' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: arm64: dts: rockchip: Add MangoPi M28K dt-bindings: arm: rockchip: Add MangoPi M28K arm64: dts: rockchip: Add devicetree for the FriendlyElec NanoPi R28S arm64: dts: rockchip: Split out the common NanoPi RK3528 parts dt-bindings: arm: rockchip: Add FriendlyElec NanoPi R28S arm64: dts: rockchip: Add DFRobot UNIHIKER M10 V1.2 dt-bindings: arm: rockchip: Add DFRobot UNIHIKER M10 V1.2 arm64: dts: rockchip: Add supplies for es8316 on RockPro64 arm64: dts: rockchip: Add PWM fan to Radxa ROCK 3B arm64: dts: rockchip: Remove cap-mmc-highspeed from SD-only slots arm64: dts: rockchip: Remove broken-cd on Rock 5 ITX SDIO arm64: dts: rockchip: Add missing audio codec supplies to Pinebook Pro arm64: dts: rockchip: Set gpioN aliases on RK3576 Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-10-15Merge tag 'mvebu-dt64-7.4-1' of ↵Alexandre Belloni
git://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu into soc/dt mvebu dt64 for 7.4 (part 1) Add Sophos XGS 107w NPU board (CN9130 based) * tag 'mvebu-dt64-7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu: arm64: dts: marvell: Add Sophos XGS 107w NPU board dt-bindings: arm: marvell: Add Sophos XGS 107w NPU dt-bindings: vendor-prefixes: Add Sophos Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-10-14kbuild: AutoFDO: Update split machine function argument for upstream renameNathan Chancellor
A recent LLVM commit [1] renamed the internal LLVM plugin option '-split-machine-functions' to '-function-splitting=all', breaking the AutoFDO + ThinLTO build with: ld.lld: error: -plugin-opt=-: ld.lld: Unknown command line argument '-split-machine-functions'. Try: 'ld.lld --help' The plugin option is needed for in-process ThinLTO, so handle the rename accordingly using ld-option. Cc: stable@vger.kernel.org Closes: https://github.com/ClangBuiltLinux/linux/issues/2186 Fixes: 2fd65f7afd5a ("AutoFDO: Enable machine function split optimization for AutoFDO") Link: https://github.com/llvm/llvm-project/commit/3e6acc87c58843e551d6e8e4bf06c26712b04622 [1] Link: https://patch.msgid.link/20261014-update-autofdo-split-machine-function-option-v1-1-5c71b3005e89@kernel.org Signed-off-by: Nathan Chancellor <nathan@kernel.org>
2026-10-14Merge tag 'wq-for-7.3-rc7-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue fix from Tejun Heo: - Fix a NULL dereference in the check for whether the current task is running a memory reclaim work item when called from a kworker outside work item execution * tag 'wq-for-7.3-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: Fix NULL current_pwq deref in mem-reclaim helper
2026-10-14ring-buffer: Skip si_mem_available() for persistent and remote buffersVincent Donnefort
Persistent and remote buffer memory is pre-allocated by the time __rb_allocate_pages() is called. Skip si_mem_available() to avoid wrongly failing the allocation under memory pressure. For the same reason, unset user_thread. Link: https://patch.msgid.link/20261013102047.1488347-2-vdonnefort@google.com Fixes: be68d63a139b ("ring-buffer: Add ring_buffer_alloc_range()") Fixes: 2e67fabd8b77 ("ring-buffer: Introduce ring-buffer remotes") Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-10-14eventfs: Free the eventfs_inode after an rcu grace period tooChristian Brauner
tracefs_d_revalidate() reads ->is_freed of the eventfs_inode that dentry->d_fsdata points to, and ->d_revalidate() is called in rcu pathwalk mode with nothing but rcu_read_lock() held. The dentry itself stays around for such a walker, but tracefs_d_release() drops its reference to the eventfs_inode when the dentry is killed, and release_ei() then frees it after a grace period of eventfs_srcu. An SRCU grace period doesn't wait for rcu_read_lock() sections, so the walker can read an eventfs_inode that is already gone. With a pathwalk held up in tracefs_d_revalidate() while the dentry goes away: BUG: KASAN: slab-use-after-free in tracefs_d_revalidate+0x76/0x90 Read of size 1 at addr ff1100010152d8d0 by task walker/97 Call Trace: <TASK> tracefs_d_revalidate+0x76/0x90 lookup_fast+0x320/0x640 path_lookupat+0x160/0xb00 filename_lookup+0x1f1/0x5b0 vfs_statx+0xd7/0x3b0 vfs_fstatat+0x4d/0x90 __do_sys_newfstatat+0xa0/0x100 do_syscall_64+0x10e/0x5e0 entry_SYSCALL_64_after_hwframe+0x77/0x7f [...] Allocated by task 1: __kmalloc_cache_noprof+0x249/0x560 eventfs_create_dir+0x7a/0x590 event_create_dir+0x2fb/0xcf0 trace_add_event_call+0xbf/0x150 [...] Freed by task 11: kfree+0x1db/0x5b0 srcu_invoke_callbacks+0x3a3/0x620 process_one_work+0x937/0x1810 worker_thread+0x4f1/0xd60 Before commit 8e556432477e ("eventfs: Use SRCU for freeing eventfs_inodes") release_ei() used call_rcu(), which covered the walker, while eventfs_iterate() needs the SRCU grace period. Wait for both and chain call_rcu() from the SRCU callback. Cc: stable@vger.kernel.org Fixes: 8e556432477e ("eventfs: Use SRCU for freeing eventfs_inodes") Link: https://patch.msgid.link/20261009-work-fixes-rcu-v1-4-7446d2d335e6@kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-10-14tracing: Do not initialize tracefs work if tracing is disabledAmit Machhiwal
If trace buffer allocation fails during early boot (e.g. in early_trace_init() -> allocate_trace_buffers()), tracing_disabled is left set to 1 and the global trace array events list remains uninitialized. Later during boot, tracer_init_tracefs() (invoked via fs_initcall) queues tracerfs_init_work asynchronously without checking if tracing was disabled. When tracer_init_tracefs_work_func() runs, it calls event_trace_init() and init_tracer_tracefs(&global_trace, NULL) unconditionally. This leads to __find_event_file() dereferencing an uninitialized tr->events list, causing an early boot NULL pointer dereference Oops: BUG: Kernel NULL pointer dereference on read at 0x00000010 Faulting instruction address: 0xc000000000485be0 Oops: Kernel access of bad area, sig: 7 [#1] ... NIP [c000000000485be0] __find_event_file+0x70/0x3c0 LR [c000000000448874] init_tracer_tracefs+0x274/0xc80 Call Trace: init_tracer_tracefs+0x274/0xc80 tracer_init_tracefs_work_func+0x50/0x320 process_one_work+0x1e8/0x5c0 worker_thread+0x1dc/0x3d0 kthread+0x194/0x1b0 start_kernel_thread+0x14/0x18 Check tracing_disabled at the beginning of tracer_init_tracefs_work_func() and return immediately if tracing is disabled or failed to initialize, preventing the crash. Cc: stable@vger.kernel.org Fixes: 6621a7004684 ("tracing: make tracer_init_tracefs initcall asynchronous") Link: https://patch.msgid.link/20261009163557.88467-2-amachhiw@linux.ibm.com Reported-by: Michal Suchánek <msuchanek@suse.de> Closes: https://lore.kernel.org/all/arYskzbiaNzBR9MD@kunlun.suse.cz/ Signed-off-by: Amit Machhiwal <amachhiw@linux.ibm.com> Tested-by: Michal Suchánek <msuchanek@suse.de> Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-10-14tracing: Fix hist trigger timestamps for buffered eventsTengda Wu
Syzkaller triggered a WARN_ON_ONCE(!nest) warning: WARNING: kernel/trace/ring_buffer.c:821 at ring_buffer_event_time_stamp Call trace: ring_buffer_event_time_stamp hist_field_timestamp hist_fn_call event_hist_trigger event_triggers_call __event_trigger_test_discard trace_event_buffer_commit do_trace_event_raw_event_sched_switch trace_event_raw_event_sched_switch The warning is probabilistically reproducible and is related to syzkaller executing the following commands: echo 'prev_pid == 999999' > events/sched/sched_switch/filter echo 'hist:keys=common_timestamp' > events/sched/sched_switch/trigger The specific triggering process is as follows: CPU 0 CPU 1 (context switching) (echo 'hist:keys=common_timestamp' > \ events/sched/sched_switch/trigger) do_trace_event_raw_event_##call trace_event_buffer_lock_reserve if (!tr->no_filter_buffering_ref && trace_file->flags & EVENT_FILE_FL_FILTERED) return entry; // return directly event_hist_trigger_parse hist_register_trigger tracing_set_filter_buffering(file->tr, true); tr->no_filter_buffering_ref++; __trace_buffer_lock_reserve rb_start_commit local_inc(&cpu_buffer->committing); // skipped and not executed trace_event_buffer_commit __event_trigger_test_discard event_triggers_call event_hist_trigger hist_fn_call hist_field_timestamp ring_buffer_event_time_stamp nest = local_read(&cpu_buffer->committing); WARN_ON_ONCE(!nest) // trigger warning The root cause is that when an event file has a filter attached and the hist trigger has not yet been attached, trace_event_buffer_lock_reserve() writes the event into the per-CPU trace_buffered_event temp buffer instead of reserving it in the ring buffer, so cpu_buffer->committing is not incremented. When the event is later processed at commit time by a hist trigger, hist_field_timestamp() -> ring_buffer_event_time_stamp() sees a zero committing count, triggering WARN_ON_ONCE(!nest). tracing_event_time_stamp() was added by commit d8279bfc5e959 ("tracing: Add tracing_event_time_stamp() API") for exactly this case: if the event is the per-CPU trace_buffered_event, it returns the current ring buffer timestamp. But it never gained a caller. Use it in hist_field_timestamp(), so that a hist trigger that races onto a buffered event records the current time, which is only marginally later than when the event was recorded, instead of warning and recording a bogus timestamp. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260929104015.1689921-1-wutengda@huaweicloud.com Fixes: b94bc80df648 ("tracing: Use a no_filter_buffering_ref to stop using the filter buffer") Signed-off-by: Tengda Wu <wutengda@huaweicloud.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-10-14tracing: Fix ignored return value of resize_buffer_duplicate_size()Dmitry Kandybka
When tr->allocated_snapshot is true, resize_buffer_duplicate_size() is called to update the snapshot buffer size. However, its return value was not checked. In case of a failed resize this could lead next snapshot being incomplete. Add resize_buffer_duplicate_size() result check and return error if resize fails. Compile tested only. Found by Linux Verification Center (linuxtesting.org) with SVACE. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260928152634.4354-1-d.kandybka@gmail.com Fixes: 180e4e390978 ("tracing: Add snapshot refcount") Signed-off-by: Dmitry Kandybka <d.kandybka@gmail.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-10-14ring-buffer: Fix false warning in ring_buffer_map_get_reader()Krystian Kaniewski
The mmap reader can warn when it catches up with a writer that is still committing events. rb_get_reader_page() returns NULL in this case, but ring_buffer_map_get_reader() treats that result as an error. The initial rb_per_cpu_empty() check filters out an empty buffer, but it does not guarantee that the next reader page has committed data. Writers do not take reader_lock and can advance commit_page before publishing the committed length on the new page. rb_get_reader_page() can swap to that page, catch up with the writer and return NULL. Handle NULL through the existing no-data exit without warning. Remove the caller's reader_page == commit_page check as well, since the reader-page helper already handles that case. The existing metadata update and return path remain in place. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260924084946.20104-1-krystianmkaniewski@gmail.com Fixes: 117c39200d9d ("ring-buffer: Introducing ring-buffer mapping functions") Assisted-by: Gemini:gemini-3.8-flash syzbot Reported-by: syzbot+de3d7f9bcc9212f3fae1@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=de3d7f9bcc9212f3fae1 Link: https://syzkaller.appspot.com/ai_job?id=488adc18-a10e-42d2-a205-25327c38837f Signed-off-by: Krystian Kaniewski <krystianmkaniewski@gmail.com> Reviewed-by: Vincent Donnefort <vdonnefort@google.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-10-14tracing: Fix simple_ring_buffer undef check on sparc64Vincent Donnefort
simple_ring_buffer relies on headers that end up including <asm/thread_info.h>. On sparc64, this emits the undefined symbol current_thread_info_reg. Allow this symbol. Link: https://patch.msgid.link/20260923074213.3077182-4-vdonnefort@google.com Fixes: 1211907ac0b5 ("tracing: Generate undef symbols allowlist for simple_ring_buffer") Reported-by: Guenter Roeck <linux@roeck-us.net> Closes: https://lore.kernel.org/all/5574c9e6-9ed2-4ee6-a2b2-fb6ee81e83a1@roeck-us.net/ Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Tested-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-10-14tracing: Fix simple_ring_buffer undef check on pariscVincent Donnefort
simple_ring_buffer uses local_set() and cmpxchg() on unsigned long. Add them to undefsyms_base.c to extend the allowlist for the parisc architecture. Link: https://patch.msgid.link/20260923074213.3077182-3-vdonnefort@google.com Fixes: 1211907ac0b5 ("tracing: Generate undef symbols allowlist for simple_ring_buffer") Reported-by: Guenter Roeck <linux@roeck-us.net> Closes: https://lore.kernel.org/all/5574c9e6-9ed2-4ee6-a2b2-fb6ee81e83a1@roeck-us.net/ Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Tested-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-10-14tracing: Fix empty symbol names in simple_ring_buffer undef checkVincent Donnefort
Sparc64 emits empty symmbol names. Skips them when establishing the allowlist and when extracing undefined symbols. Link: https://patch.msgid.link/20260923074213.3077182-2-vdonnefort@google.com Fixes: 1211907ac0b5 ("tracing: Generate undef symbols allowlist for simple_ring_buffer") Reported-by: Guenter Roeck <linux@roeck-us.net> Closes: https://lore.kernel.org/all/5574c9e6-9ed2-4ee6-a2b2-fb6ee81e83a1@roeck-us.net/ Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Tested-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-10-14Merge tag 'sched_ext-for-7.3-rc7-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext fixes from Tejun Heo: - A task that skipped the BPF scheduler on its way back to its CPU's local queue could stall there until the watchdog fired, as the CPU had already decided to go idle. - Use-after-free of a destroyed user dispatch queue by a deferred re-enqueue request. - A task could be moved off a dispatch queue while the dispatching CPU was still running ops.dequeue() on it. - Bypass mode mishandled a sub-scheduler bypass overlapping an ancestor's, as across a system suspend. Descendants could leave bypass mid-teardown and tasks could be stranded on bypass queues. - The idle CPU selection helper could return a CPU outside the allowed CPUs of a pinned or migration-disabled task. * tag 'sched_ext-for-7.3-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs sched_ext: Rename scx_reenq_wait_dispatching() to scx_wait_dispatching() sched_ext: idle: Respect task affinity in restricted CPU selection sched_ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor sched_ext: Propagate every bypass depth change to the descendants sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ
2026-10-14Merge tag 'pci-v7.3-fixes-5' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull PCI fixes from Bjorn Helgaas: - Leave ANFE masked on Apple T2 Secure Enclave, which fixes spontaneous poweroff regressions on MacBookPro16,1 and likely other models with the T2 caused by new Advisory Non-Fatal Error support (Jason Perlow) - Move dw-rockchip INTx IRQ setup from rockchip_pcie_host_init(), where it runs after every reset, to the rockchip_pcie_probe() path to avoid installing new IRQ handler (which causes INTx IRQs to be lost) and leaking an IRQ domain on every reset; fixes a regression added this cycle (Shawn Lin) * tag 'pci-v7.3-fixes-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI: dw-rockchip: Move INTx IRQ setup to probe PCI/AER: Keep ANFE masked on Apple T2 Secure Enclave
2026-10-15Merge branch 'bpf-follow-up-for-scalar-evolution-series'Daniel Borkmann
Eduard Zingerman says: ==================== bpf: follow-up for scalar evolution series Assorted follow-ups for the series [1]: - Handle ARG_SCALAR and ARG_PTR_TO_DYNPTR in bpf_global_subprog_stack_access_bytes(). - Fixes for other nits reported by bots for the series. Changelog v1 -> v2: - dropped patch #1, "bpf: static subprogram arguments liveness should use BTF type info", see the v1 lore link for explanation. v1: https://lore.kernel.org/bpf/20261010-scev-minimal-v3-followups-v1-0-6000e95ef993@gmail.com/ --- ==================== Link: https://patch.msgid.link/20261013-scev-minimal-v3-followups-v2-0-6d9d61965486@gmail.com Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2026-10-15selftests/bpf: BPF_F_ANY_ALIGNMENT for byte_array_size_spanning()Eduard Zingerman
The test case indexes inside `char bytes[32]` array with unaligned offset. Use BPF_F_ANY_ALIGNMENT flag to avoid the test rejection for unrelated reason. Fixes: e187fac8ac6b ("selftests/bpf: Tests for varying offset access to PTR_TO_BTF_ID") Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20261013-scev-minimal-v3-followups-v2-7-6d9d61965486@gmail.com
2026-10-15selftests/bpf: Harden __msg patterns for step_movsx_bounds_on_lineEduard Zingerman
The `{{.*}}` in the pattern for R5 below might hide the `step=...` logging from the __no_step annotation. Replace it with full expected log instead. Also drop __no_step for R3 above, where it is unnecessary. Fixes: 2db5837f9ada ("selftests/bpf: Tests for register base/step arithmetic") Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20261013-scev-minimal-v3-followups-v2-6-6d9d61965486@gmail.com
2026-10-15selftests/bpf: Harden __msg pattern for global_callee_btf_argEduard Zingerman
The original pattern: __msg("3: (85) call pc+{{[0-9]+}}\n") Is ambigous, as this line is printed on the main verification pass as well. Harden the test case by ensuring a __msg_next sequence matching the stack use/def results specifically. Fixes: 063c85f5d8c7 ("selftests/bpf: Tests for BTF-based global subprog stack liveness") Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20261013-scev-minimal-v3-followups-v2-5-6d9d61965486@gmail.com
2026-10-15selftests/bpf: Stack effects of scalar/dynptr global subprog paramsEduard Zingerman
Verify that a frame pointer derived value does not induce stack liveness effects, when passed as a scalar argument of a global function. Verify that a stack-based dynptr passed to a global function marks live only corresponding 16 bytes. Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20261013-scev-minimal-v3-followups-v2-4-6d9d61965486@gmail.com
2026-10-15bpf: Reg_bounds_sync() comment fixupEduard Zingerman
Array traversal logic in btf_struct_access() starts from reg_smin(). Update comment to match the logic. Fixes: 0892ef2a7ef3 ("bpf: Representation for intervals with steps") Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20261013-scev-minimal-v3-followups-v2-3-6d9d61965486@gmail.com
2026-10-15bpf: Avoid duplicate declaration for BPF_SCEV_REGS_NUMEduard Zingerman
The "bpf: Use SCEV to widen bounded loops" commit introduced a second (identical and unnecessary) definition for the BPF_SCEV_REGS_NUM macro. Fixes: 088a5477a9bd ("bpf: Avoid widening registers that hinder exact stack-slot tracking") Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20261013-scev-minimal-v3-followups-v2-2-6d9d61965486@gmail.com
2026-10-15bpf: More precise stack liveness effects for global func paramsEduard Zingerman
The following types can be returned by the btf_prepare_func_args(): - ARG_PTR_TO_CTX - ARG_PTR_TO_BTF_ID (+ flags) - ARG_PTR_TO_MEM (+ flags) - ARG_PTR_TO_ARENA - ARG_PTR_TO_DYNPTR - ARG_SCALAR Of these, valid programs can pass frame pointer only as ARG_PTR_TO_{MEM,BTF_ID,DYNPTR}. Additionally, pointer arithmetic allows the following trick: 0: (bf) r1 = r10 1: (07) r1 += -8 2: (1f) r1 -= r10 3: (85) call pc+1 // r1=fp0 ? 4: (95) exit This commit changes bpf_global_subprog_stack_access_bytes() to handle ARG_SCALAR and ARG_PTR_TO_DYNPTR, thus addressing the full set of possible returned values. Fixes: 8212c1c2986d ("bpf: Derive global subprog stack liveness from BTF signatures") Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20261013-scev-minimal-v3-followups-v2-1-6d9d61965486@gmail.com
2026-10-15resolve_btfids: Fix the --fatal_warnings exit statusPetr Pavlu
The resolve_btfids --fatal_warnings option is intended to make the tool exit with a non-zero status if any warnings are reported. main() initializes err to -1 and uses 'goto out' to return this status when a sub-operation fails. If no error occurs, 'if (!(fatal_warnings && warnings)) err = 0;' modifies the final status depending on whether any warnings have been reported. Commit 522397d05e7d ("resolve_btfids: Change in-place update with raw binary output") broke this logic by assigning the return values of newly added sub-operations to err. As a result, successful sub-operations overwrite the initial err value of -1 with 0, causing the tool to exit successfully even when --fatal_warnings is enabled and warnings have been reported. Fix the issue by setting the final value of err unconditionally, so the code doesn't depend on its previous value. Fixes: 522397d05e7d ("resolve_btfids: Change in-place update with raw binary output") Signed-off-by: Petr Pavlu <petr.pavlu@suse.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Ihor Solodrai <ihor.solodrai@linux.dev> Link: https://lore.kernel.org/bpf/20261008-resolve_btfids-warnings-v1-1-0d4e613ffa6e@suse.com
2026-10-15libbpf: Start v1.9 development cycleIhor Solodrai
libbpf 1.8.0 has been released [1]. Update libbpf.map and libbpf_version.h to start v1.9 development cycle. [1] https://github.com/libbpf/libbpf/releases/tag/v1.8.0 Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20261005183511.201045-1-ihor.solodrai@linux.dev
2026-10-14Merge tag 'imx-dt64-7.4' of ↵Alexandre Belloni
https://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux into soc/dt i.MX arm64 dts updates for v7.4 New board support: Add i.MX952 FRDM, i.MX93 Wireless FRDM, Toradex OSM iMX91, iMX93, iMX95, Lino iMX91 and iMX93 (with dahlia), MR-NAVQ95, Free Mobile Nodebox v3 CPU Module Data Modul i.MX8M Mini/Plus eDM SBC DT overlays (LVDS, HDMI, CM, FIO1, FIO1-Audio, legacy board), ifm VHIP4 EvalBoard EEPROM layout DTOs for i.MX8MN MQS1 sound support: - Add MQS1 pinmux, clocks and board muxes on i.MX91, i.MX93, i.MX94, i.MX95 EVKs and FRDM boards, i.MX952 AONMIX MQS device node. - Add one MQS1 DT overlay shared for all i.MX9 platforms. PCIe updates: - Describe PCIe M.2 Key E connector on i.MX95-19x19-EVK and i.MX943-EVK - Avoid 32-bit PCIe window System RAM overlap on i.MX95, i.MX94, i.MX943 - Move PCIe PERST# and vpcie supply to Root Port node on i.MX95-15x15-FRDM Display/media: - Add tianma,tm050rdh03 panel on i.MX91-9x9-QSB, Assign media_{axi,apb}_root clock parents/rates on i.MX91, Override dpi_bridge compatible string on i.MX91, Enable I2C_3_DSI1 on i.MX95 Aquila Clover board Fixes and cleanup: - Fix usbphynop2 power-domain and add #phy-cells - Fix reserved memory node names across i.MX93, i.MX95, i.MX8QM, i.MX8QXP, i.MX8DXL, i.MX8ULP EVKs - Fix LVDS clock frequency for DL device on i.MX8MP Kontron - Fix GPIO4_IO29 usage and USB-C connector mode on i.MX93 Kontron - Fix gpio-line-names on i.MX95 Aquila, i.MX8MP/i.MX8MM Verdin/Toradex - Fix duplicated can-phy node names on i.MX95-15x15-FRDM - Fix RTC aliases on i.MX93-11x11-FRDM - Fix reserved memory node names for remoteproc (multiple boards) - Drop unsupported opp-hz-real in OPP tables on i.MX95 - Drop undocumented "hardware" root node properties Other additions: - Add HSIC usb@5b0e0000 node and usbotg3 iommu information - Add Apalis i.MX8 USB HSIC support - Add ENETC port 2 in SGMII mode on i.MX95 Aquila and Toradex SMARC - Add thermal zones on i.MX95-TQMa9596SA - Add boot phase properties on i.MX95-15x15-FRDM - Add RTC1 alias for PCF2131 on i.MX91/i.MX93 EVK/QSB - Add PEB-WLBT-07 expansion board for i.MX8MP phyBOARD-Pollux - Add phyBOARD-Pollux PEB-AV-10 SAI master fix - Add Wi-Fi SD interface on i.MX95 Toradex SMARC - Add EEPROM nWP GPIO, label and layout on i.MX8MM/i.MX8MP - Add TPM support and SAI3 sync RX mode on i.MX8MM VAR-DART - Add SPI EERAM, GPIO labels, ethernet PHY LEDs on i.MX8MM Kontron - Set #pinctrl-cells on lx2160a pinmux node - ARM: vf610/vf500: describe L2 cache geometry and Cortex-A5 L1 caches - i.MX93-11x11-FRDM: factor out common parts into dtsi - i.MX8MQ-EVK: add regulator-off-in-suspend for VGEN1/VGEN6 - i.MX8MP: add DT label to SPBA5 bus * tag 'imx-dt64-7.4' of https://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux: (111 commits) arm64: dts: imx95-tqma9596sa: Add thermal zones arm64: dts: imx95-tqma9596sa-mb-smarc-2.dts: improve SD reset pulse arm64: dts: freescale: Drop undocumented "hardware" root node properties arm64: dts: freescale: imx8mm-verdin: add gpio-line-name for CTRL_SLEEP_MOCI# arm64: dts: freescale: imx95-aquila: Enable I2C_3_DSI1 on Clover board arm64: dts: lx2160a: set #pinctrl-cells on the pinmux node arm64: dts: freescale: add MR-NAVQ95 basic board support dt-bindings: arm: fsl: add MR-NAVQ95 board arm64: dts: imx8mm-var-dart: increase PHY reset deassert delay arm64: dts: imx8mm-var-dart: add TPM support arm64: dts: imx8mm-var-dart: configure SAI3 synchronous RX mode arm64: dts: imx8mn-solidsense-n8-compact: drop undocumented adi,led-polarity arm64: dts: freescale: Add Toradex OSM iMX91 arm64: dts: freescale: Add Toradex OSM iMX93 arm64: dts: freescale: Add Lino iMX91 arm64: dts: freescale: imx93-lino: Add dahlia arm64: dts: freescale: Add Lino iMX93 dt-bindings: arm: fsl: Add Toradex OSM iMX91/iMX93 dt-bindings: arm: fsl: Add Lino iMX91/iMX93 arm64: dts: imx95-15x15-frdm: fix reserved memory node names for remoteproc ... Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-10-14ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()Donggeun Yoo
On a persistent ring buffer, rb_meta_subbuf_idx() can return an index one sub-buffer too high. rb_setup_ids_meta_page() then fills subbuf_ids[] shifted by one and leaves subbuf_ids[0] NULL, which __rb_map_vma() dereferences when userspace maps trace_pipe_raw. rb_update_meta_reader() writes two such indices into meta->buffers[], which rb_cpu_meta_valid() would reject on the next boot, discarding the previous boot's trace. A CPU's sub-buffer array starts after its meta header and the nr_subbufs integers that follow, aligned up to a sub-buffer. rb_meta_subbuf_idx() inverts that calculation but skips only the integers, not the header, so its base is one sub-buffer low whenever the omitted header size crosses the alignment boundary. Invert the calculation with rb_subbufs_from_meta() rather than repeating it. rb_range_buffer() maps an index back to an address through the same helper, so the two directions can no longer disagree. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260918071507.1019251-1-donggeunyoo.kernel@gmail.com Fixes: b14d032973d4 ("ring-buffer: Add ring_buffer_meta data") Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com> Reviewed-by: Vincent Donnefort <vdonnefort@google.com> Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-10-14tracing: Fix the shift out of bounds in the log2 histogram modifierDonggeun Yoo
The .log2 key modifier files a value under its base-2 order: # echo 'hist:keys=bytes_req.log2' > events/kmem/kmalloc/trigger hist_field_log2() computes that as ilog2(roundup_pow_of_two(val)). The out-of-line form of roundup_pow_of_two() is return 1UL << fls_long(n - 1); which shifts by 64 on a 64-bit kernel both when n is 0, where n - 1 wraps to ULONG_MAX, and when n is above 2^63. Both are ordinary keys, because the field fetch hands every value over as a u64: a syscall argument of 0 reaches the first, and one above 2^63 reaches the second. Keying sys_enter_lseek on offset.log2 and passing 0, 1, 2, 3, 1000, 2^63+1 and U64_MAX gives { offset: ~ 2^1 } hitcount: 1 { offset: ~ 2^10 } hitcount: 1 { offset: ~ 2^2 } hitcount: 1 { offset: ~ 2^0 } hitcount: 4 Keys above 2^63 land in the lowest bucket. With CONFIG_UBSAN_SHIFT=y the shift is also reported: UBSAN: shift-out-of-bounds in include/linux/log2.h:57:13 shift exponent 64 is too large for 64-bit type 'long unsigned int' __ubsan_handle_shift_out_of_bounds.cold+0xdd/0x1cb hist_fn_call.cold+0x8b/0xd9 event_hist_trigger+0x1cc/0x790 ftrace_syscall_enter+0x197/0x360 do_syscall_64+0x402/0x4b0 Use order_base_2(), which is ilog2(n - 1) + 1 for n > 1 and 0 below that. It returns what the old expression returned on every input the old one was defined for. Where it was not, 0 stays in bucket 0, which is where x86_64 had been putting it, and the keys above 2^63 move into bucket 64. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260916002735.808520-1-donggeunyoo.kernel@gmail.com Fixes: 4b94f5b7b4a5 ("tracing: Add hist trigger 'log2' modifier") Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com> Assisted-by: Claude:claude-fable-5 Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-10-14ring-buffer: Do not show buffer_meta for CPUs without a bufferDavid Carlier
The per_cpu/cpuN/buffer_meta files are created for every possible CPU, but buffer->buffers[cpu] is only allocated once that CPU comes online. Reading the file of a CPU that never came online dereferences a NULL cpu_buffer in rbm_start(). Fail the open with -ENODEV when the CPU has no buffer, as the other per CPU ring buffer interfaces do. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260914133506.4865-3-devnexen@gmail.com Fixes: 950032ffcee7 ("ring-buffer: Add output of ring buffer meta page") Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://lore.kernel.org/all/20260913134906.6E8A01F000FF@smtp.kernel.org/ Signed-off-by: David Carlier <devnexen@gmail.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-10-14tracing: Take trace_types_lock when dropping the buffer_meta referenceDavid Carlier
tracing_buffer_meta_open() drops the trace_array reference with __trace_array_put() when ring_buffer_meta_seq_init() fails, without holding trace_types_lock. Use trace_array_put() like every other open error path. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260914133506.4865-2-devnexen@gmail.com Fixes: 950032ffcee7 ("ring-buffer: Add output of ring buffer meta page") Signed-off-by: David Carlier <devnexen@gmail.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-10-14tracing: Fix NULL dereference when copying keys for a field variableDonggeun Yoo
In event_hist_trigger_parse() where it needs to create actions like "onmatch", it calls: event_hist_trigger_parse() { create_actions() { action_create() { trace_action_create() { trace_action_create_field_var() { create_field_var_hist() Where create_field_var_hist() does a loop on the hist_data representing the keys. The issue is, if the keys uses one of the pseudo field types (like common_cpu), the hist_data field element will have NULL for its field member causing a NULL pointer dereference when accessing the key_field->field->name. # echo 'hist:keys=common_cpu:ts0=common_timestamp.usecs' > \ events/sched/sched_waking/trigger # echo 'my_synth u64 lat; int prio' > synthetic_events # echo 'hist:keys=common_cpu:wakeup_lat=common_timestamp.usecs-$ts0:\ onmatch(sched.sched_waking).my_synth($wakeup_lat,prio)' > \ events/sched/sched_switch/trigger KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:create_field_var_hist+0x771/0x1380 Call Trace: trace_action_create_field_var+0x360/0x600 trace_action_create+0x393/0xe80 event_hist_trigger_parse+0x3e47/0x69e0 trigger_process_regex+0x1a6/0x250 event_trigger_write+0xce/0x160 Instead of accessing it directly, use the proper handler expr_field_str() to get the name. The three previous patches are prerequisites: without them a .buckets key and a common_stacktrace key each render into a command that cannot be parsed back. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260914053443.981201-5-donggeunyoo.kernel@gmail.com Fixes: 02205a6752f2 ("tracing: Add support for 'field variables'") Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com> Assisted-by: Claude:claude-fable-5 Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-10-14sched_ext: Keep proxy donors with slice left on the local DSQAndrea Righi
Commit ee172227d0dc ("sched_ext: Delegate proxy donor admission to BPF schedulers") makes put_prev_task_scx() pass a retained proxy donor to ops.enqueue() with SCX_ENQ_BLOCKED. Some of these puts are only proxy bookkeeping; proxy_resched_idle() drops the rq's donor reference before switching to idle when: - find_proxy_task() cannot run the mutex owner yet and retries through idle (e.g., the owner is on a remote CPU), - proxy_migrate_task() detaches the donor before migration, - proxy_deactivate() blocks a task in the chain whose owner cannot run. In the first case, BPF has already selected a donor with slice left. Returning it to ops.enqueue() forces BPF to dispatch it again before proxy resolution can continue. In the other two cases, the donor is typically deactivated right after ops.enqueue(), undoing any placement BPF makes. As also discussed at the sched_ext microconference at Linux Plumbers 2026, these ops.enqueue/dequeue() invocations do not represent any meaningful scheduling events, so we should avoid triggering them. A more reasonable semantic is to keep a donor with slice left at the head of the local DSQ, so the next pick can resolve its owner, or deactivation can remove it without an unnecessary BPF handoff. An IMMED donor can stay there only for a bookkeeping put during proxy resolution. Mark a blocked pick as awaiting resolution with SCX_RQ_PROXY_PENDING to distinguish that put from a real preemption and re-insert the donor with SCX_ENQ_IMMED, so that it only needs SCX_CAP_ENQ_IMMED rather than SCX_CAP_ENQ. A preempted IMMED donor still returns to BPF. If a higher priority class takes the CPU once proxy resolution completes, schedule a local reenqueue, so that a parked IMMED donor returns to BPF instead of lingering on the local DSQ. Update the SCX_ENQ_IMMED and SCX_ENQ_BLOCKED documentation accordingly. Moreover, a donor that has run out of slice now follows the regular put path, so it can receive SCX_ENQ_LAST when the CPU is about to go idle and the scheduler needs to arrange a follow-up scheduling event. This does not apply to bookkeeping puts, where the switch to idle is only temporary. The blocked-donor specific sanity checks go away together with the special case. When a retained donor is removed ahead of a scheduler ownership or policy change, mark the proxy reset with SCX_RQ_PROXY_BLOCKING and skip reenqueueing the active donor: sched_proxy_block_task() will dequeue it next. Report it as not runnable to ops.stopping(), as a regular dequeue of the current donor does. This avoids a transient ops.enqueue/dequeue() pair and a false ENQ_LAST warning. With this, the sched_ext core absorbs the transient proxy-bookkeeping puts and the BPF scheduler only sees a blocked donor when there is an actual placement decision to make. Fixes: ee172227d0dc ("sched_ext: Delegate proxy donor admission to BPF schedulers") Signed-off-by: Andrea Righi <arighi@nvidia.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-10-14Merge tag 'imx-dt-7.4' of ↵Alexandre Belloni
https://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux into soc/dt i.MX ARM dt changes for 7.4: - dt-bindings fixes and cleanups: allow single reg for fsl,imx6sx-ldb, allow bridge@18 child in imx-iomuxc-gpr, allow display0 child for i.MX6UL lcdif, add deprecated/optional properties for st,stmpe MFD. - ARM dts cleanups: whitespace/indentation fixes, drop undocumented st,stmpe properties, drop fallback "dlg,da9052" compatible, remove unused CSI nodes, fix/remove unrecognized PCIe/wakeup properties - ARM dts board updates: - Add Variscite VAR-SOM-MX7, Colibri VF50/VF61, Amazon Kindle 4 (Yoshi) board. - imx7d Colibri eMMC: add Toradex Capacitive/Resistive 7" Parallel displays and VGA overlay. - imx7-colibri/imx6ull-colibri: set LCDIF bus width. - imx7d: add Variscite VAR-SOM-MX7 and MX7CustomBoard support. - imx7-tqma7: fix PMIC voltage constraints, sort I2C nodes by address. - imx6ul-kontron-bl: add GPIO labels, fix USB OTG1 ID pin, replace UART3 with DIP switch GPIOs. - imx6qdl-pico/wandboard: replace clock-frequency in camera sensor. - mba6ulx: add Ethernet PHY interrupt and USB hub nodes. - imx6dl-phytec-mira: add phyBOARD-Mira-i.MX6DL with eMMC. - imx6qdl phycore-som: add custom volt/freq OPP table. * tag 'imx-dt-7.4' of https://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux: (46 commits) ARM: dts: imx6dl-phytec-mira: Add phyBOARD-Mira-i.MX6DL with eMMC ARM: dts: imx50: add support for Amazon Kindle 4 (Yoshi) dt-bindings: arm: fsl: add Amazon Kindle 4 (Yoshi) ARM: dts: imx6qdl: phycore-som: Add custom volt/freq table ARM: dts: imx6dl: Add a label to cpu1 node ARM: dts: imx7-colibri: Set LCDIF bus width ARM: dts: imx6ull-colibri: Set LCDIF bus width ARM: dts: imx: remove undocument properties of st,stmpe* dt-bindings: mfd: st,stmpe: let interrupt property optional dt-bindings: mfd: st,stmpe: add deprecated properties ARM: dts: imx7-colibri-iris-v2: drop no-op delete-property ARM: dts: imx6ul-kontron-bl-common: Fix USB OTG1 ID pin configuration ARM: dts: imx6ul-kontron-bl-common: Add GPIO labels ARM: dts: imx6ul-kontron-bl-common: Replace UART3 with DIP switch GPIOs ARM: dts: imx53: drop fallback compatible "dlg,da9052" ARM: dts: imx6ul-14x14-evk: remove reduntant bus-type under csi node ARM: dts: imx6sll: remove unused node csi@20e8000 ARM: dts: imx6dl-b125v2: add touchscreen-size-x/y to exc80h60 node ARM: dts: imx50-kobo-aura: convert sd2_vmmc to regulator-fixed ARM: dts: imx7d-meerkat96: disable lcdif node ... Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-10-14Merge tag 'stm32-dt-for-v7.4-1' of ↵Alexandre Belloni
git://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32 into soc/dt STM32 DT for v7.4, round 1 Highlights: ========== - STM32MP13: - Add DCMI / LTDC ETZPC access controler. - Add SRAM nodes: SRAM1 16kB, SRAM2 8kB, SRAM3 8kB. - Add SPI5 DMA chaining support. - STMP32MP15: - Use DMA FIFO for all SPIs. - Add SPI4 DMA chaining support - STM32MP25/23: - Add SYSCFG driver to bind USB PHY. - Add digital temperature sendore (Moortec). - Add DCMI nodes. - Enable eMMC on stm32mp257f-dk. - Add I/O sync to eth1 rgmii pins to match with RGMII specification. - ENGICAM: - Add Engicam MicroGEA-STM32MP257D-RMM board support based on Engicam MicroGEA-STM32MP257 SoM (8GB eMMC Flash, 2 GB LPDDR4 DRAM). Embedding CAN, LEDS, LCD with touchscreen, uSD, Audiocodec. - DH: - Add DH STM32MP23xx/STM32MP25xx DHCOS SoM and Breakout Board and DHSBC support: This stm32mp25xx-dhcos-bb board is a stack of DHCOS SoM based on STM32MP25xx SoC (1200MHz / crypto capabilities) populated on SoM Breakout Board, the stm32mp255c-dhcos-dhsbc is the SoM populated on DHSBC carrier board. The stm32mp23xx-dhcos-bb is a stack with STM32MP23xx SoC. - The SoM contains the following peripherals: - STPMIC (power delivery) - 4GiB LPDDR4 memory - eMMC and SDIO WiFi module - The Breakout Board carrier board contains the following peripherals: - USB-C peripheral port, power supply plug - The DHSBC carrier board contains the following peripherals: - Two RGMII Ethernet ports - MicroSD slot - LVDS connector - MIPI CSI2 connector - USB-A Host port, USB-C power supply plug - USB-C / DP port - Expansion connector * tag 'stm32-dt-for-v7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32: (64 commits) soc: st: Add STM32MP2 SYSCFG driver dt-bindings: arm: stm32: Document st,stm32mp23/25-syscfg subnodes and cells arm64: dts: st: fix sai3b unit address on stm32mp231 arm64: dts: st: fix sai3b unit address on stm32mp251 arm64: defconfig: enable Moortec MR75203 PVT controller arm64: dts: st: add digital temperature sensor on stm32mp251 arm64: dts: st: add Engicam MicroGEA-STM32MP257D-RMM LVDS display overlay arm64: dts: st: move Engicam MicroGEA-STM32MP257D-RMM display to an overlay arm64: dts: st: enable eMMC on stm32mp257f-dk arm64: dts: st: add sdmmc2 pins_b for stm32mp25 arm64: dts: st: add dcmi node on stm32mp23x arm64: dts: st: add dcmi node on stm32mp25x arm64: dts: st: add imx335/csi/dcmipp nodes on stm32mp235f-dk arm64: dts: st: use video-interfaces media bus type in stm32mp257f-ev1 arm64: dts: st: ensure IMX335 is enabled on stm32mp257f-ev1 arm64: dts: st: add imx335/csi/dcmipp nodes on stm32mp257f-dk MAINTAINERS: Add DH electronics DHCOS SoM entry and fix email address arm64: dts: st: Add support for DH electronics STM32MP23xx/STM32MP25xx DHCOS SoM and Breakout Board and DHSBC arm64: dts: st: Add pinmux nodes for DH electronics STM32MP23xx/STM32MP25xx DHCOS SoM and Breakout Board arm64: dts: st: Add OMM node on stm32mp231 ... Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-10-14perf symbol: Get rid of machine_or_dso_e_machine()Namhyung Kim
The function tries to get e_machine from a DSO (preferred) or env from the machine. But currently it's only used for kernel DSO's during the load which refers to /proc/kallsyms most likely and it doesn't have an ELF header. Also machine->env would have proper information about the kernel so no need to check DSO in this case. Actually check DSO's e_machine requires a correct binary type to be set but it'd cause a recursive locking problem. I think it's ok to use machine->env info for the kernel. Reviewed-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-10-14perf symbol: Set binary/symtab type for split kallsymsNamhyung Kim
When it creates new DSOs for split kallsyms, set the binary and symtab type to KALLSYMS properly. Reviewed-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-10-14perf symbol: Update symtab type of vmlinux from build-id cacheNamhyung Kim
Currently dso__load_vmlinux() sets both binary type and symtab type to VMLINUX. To precisely track the symtab type of the kernel dso, update the type to build-id cache if it's loaded from there. It won't have any functional difference though. Reviewed-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-10-14perf tools: Try linked debug files for DSO debug infoNamhyung Kim
The dso__find_dbginfo_type() should try DSO_BINARY_TYPE__DEBUGLINK so it can follow the .gnu_debuglink and find the debug information in the separate file. Reviewed-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-10-14perf tools: Check ELF section type with nameNamhyung Kim
In filename__has_section(), it just checks the name of the section but it's possible that the section header is present without actual data. In that case, it'll have SHT_NOBITS type and can confuse the result. Update the function to check the section type as well. Normally we want to check if the section content is present in the file so it'd have SHT_PROGBITS. All the current callers of the function expect the section with SHT_PROGBITS type (even for debug info). Signed-off-by: Namhyung Kim <namhyung@kernel.org> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-10-14perf tools: Remove redundant dso data initNamhyung Kim
The fd and status are initialized later with cache. Reviewed-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>