| Age | Commit message (Collapse) | Author |
|---|
|
Implement con_unblank from struct consw with the !blank branches from
fbcon_blank(). The new function is called fbcon_unblank(). Remove the
duplicated code from fbcon_blank().
Fbcon tracks fbdev blank state in par->blank_state using fbdev's FB_BLANK
constants. In fbcon_unblank() the stored value is always FB_BLANK_UNBLANK.
In fbcon_blank(), the new blank state is 1 + plus the VESA blank mode
given in the parameter blank.
fbcon_blank() now disables the cursor worker unconditionally.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
|
|
Implement con_unblank from struct consw as a duplicate of con_blank.
As dummycon does not do anything, the implementation only returns
true or false to trigger a redraw (or not).
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
|
|
Add struct consw.con_unblank as inverse operation to con_blank.
If implemented invoke con_blank to turn the console from blanked to
unblanked. Also update the semantics of con_blank in this case: The
blank parameter of con_blank receives a VESA blank mode from enum
vesa_blank_mode instead of the hybrid unblank/blank values it has
used so far.
With con_unblank not implemented, invoke con_blank for blanking and
unblanking as before.
The old semantics of con_blank will be removed when all consoles
implement con_unblank.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux
Pull devicetree updates from Rob Herring:
- A bunch of improvements in dt-check-style. Fix various bindings based
on these additional checks.
- Convert hisilicon,hix5hd2-ir, hisilicon,hi6220-ade,
hisilicon,hi6220-dsi, hisilicon,hip05-sas-v1, MediaTek RT5650 codecs,
mediatek,g3dsys, mediatek,mt2701-scpsys, ti,omap-mpu, and
ti,omap-ocp2scp to DT schema format
- Add schemas for ST STM32MP2 DWC3 xHCI USB, ST STM32MP25 USB2-FEMTO
PHY, spacemit,k1-gpu and spacemit,k3-gpu, HiSilicon local bus,
HiSilicon HIP05 CPLD, SDMC DM2016, and QCom SM7250 and Kuno PDC
- Various binding updates to fix schema warnings in .dts files
- Drop obsolete .txt bindings for STM32(MP1) RCC, VExpress hwmon and
regulator, and mailbox.txt
- Remove the unused of_overlay_remove_all() function
- Fixes for of_check_msi_parent()
- Add "i2c-parent" tracking to fw_devlink
* tag 'devicetree-for-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (72 commits)
dt-bindings: usb: dwc3: Document ST STM32MP2 DWC3 xHCI USB controller
dt-bindings: iommu: Describe MT8195 infra IRQs
dt-bindings: clock: mediatek: Add MT8516 fallbacks
dt-bindings: media: Convert hisilicon,hix5hd2-ir to DT schema
dt-bindings: display: Convert hisilicon,hi6220-ade to DT schema
dt-bindings: display: Convert hisilicon,hi6220-dsi to DT schema
dt-bindings: phy: Document ST STM32MP25 USB2-FEMTO PHY
of: overlay: remove unused of_overlay_remove_all()
dt-bindings: power: Convert mediatek,mt2701-scpsys to DT schema
dt-bindings: bus: Add HiSilicon local bus
dt-bindings: gpu: img,powervr-rogue: add spacemit,k1-gpu and spacemit,k3-gpu
dt-bindings: interrupt-controller: qcom,pdc: Document SM7250 PDC
dt-bindings: vendor-prefixes: add Ambarella
dt-bindings: reset: Drop obsolete STM32(MP1) RCC bindings
dt-bindings: arm: keystone: ti,sci: Correct reg and mboxes constraints
dt-bindings: ASoC: Convert MediaTek RT5650 codecs bindings to DT schema
dt-bindings: scsi: Convert hisilicon,hip05-sas-v1 to DT schema
of/irq: Stop the MSI walk at the first msi-parent
of/irq: Fix device node refcount leak in of_check_msi_parent()
dt-bindings: display: faraday,tve200: Use a level-high interrupt
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi
Pull EFI updates from Ard Biesheuvel:
- Set the LoaderDevicePartUUID EFI variable from the stub to help
systemd discover the file system layout when booting straight into
Linux without GRUB or systemd-boot (Vincent Mailhol)
- Some GUID deduplication work from Vincent
- Remove pointless UTF16->UTF8 and vice versa conversions from the stub
- Some kmap() -> kmap_local_page() conversions in the capsule loader
- Add a runtime control to en/disable EFI runtime services so that
PREEMPT_RT systems can enable them as needed
- Add a 'nostatfs' mount option to efivarfs so that the cost of
querying the EFI variable store (which is already rate limited) can
be avoided entirely on systems where it is disproportionately costly
- Rework the EFI libstub Makefile to align x86 with other
architectures, and inherit/adapt the global CFLAGS variable rather
than reconstruct it from scratch
- Constify attributes of statically allocated sysfs nodes
- Avoid register x18 when building the arm64 EFI stub, in order to
comply with the UEFI spec, and to permit it to execute in a context
where x18 is special
- Preserve the physical addresses of all EFI config tables that may be
of interest to an incoming kexec kernel
- Add some LKDTM tests for EFI runtime crashes where the faulting
address is inside a EFI memory region
- Other minor bug fixes and cosmetic cleanups
* tag 'efi-next-for-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: (35 commits)
lkdtm: Add more EFI runtime tests
efi: Initialize all configuration table addresses to EFI_INVALID_TABLE_ADDR
efi: Retain the address of the LINUX_EFI_MEMRESERVE table
efi/libstub: Don't replace an existing LINUX_EFI_MEMRESERVE table
efi/runtime-wrappers: Don't park the worker after a recovered firmware fault
efi: Use sysfs_emit() not sprintf() to generate sysfs file contents
efi: Constify sysfs attributes
efi/libstub: Disable kernel stack erasing in the common flags
efi/libstub: Build the x86 stub from KBUILD_CFLAGS
efi/libstub: Declare the x86 stub's assembly entry points
efi/libstub: arm64: Don't use the platform register x18
efi/libstub: Free cmdline_ptr in efi_pe_entry
efi/riscv: libstub: Don't set image_size in handle_kernel_image()
efi/libstub: Fix error unwind freeing fdt in allocate_new_fdt_and_exit_boot()
efivarfs: add nostatfs mount option to skip QueryVariableInfo()
efi/libstub: add initial Boot Loader Interface support
efi/libstub: Add efi_snprintf() to construct wide strings
efi/libstub: Add support for printing human readable GUIDs
efi/libstub: Output UTF-16 directly from vsnprintf()
efi/libstub: Avoid efi_puts() for compile time constant strings
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux
Pull gpio fixes from Bartosz Golaszewski:
- add ACPI quirks for Thinkpad L13 Gen 2a and Acer Nitro 16S AI to
ignore a wrong GPIO interrupt declaration
- add missing return value check of devm_gpiochip_add_data() to
gpio-lpc32xx
- don't set GPIOD_FLAG_IS_OUT from character device code as GPIO core
already does it where needed and it can lead to providing invalid
info to user-space on request errors
- don't report a bogus -ENOMEM for a line requested without a label
- propagate errors occurring when setting line values for pins for
which we emulate open-drain or open-source drive settings
- fix interrupt handling bugs in gpio-pca953x and gpio-davinci
- fix more memory leaks in GPIO core
- clear event clock flags from pins on GPIO release
* tag 'gpio-fixes-for-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
gpiolib: don't report -ENOMEM for a requested line without a label
gpiolib: Propagate emulated drive errors when setting arrays
gpio: pca953x: Handle direction register read errors in IRQ paths
gpio: pca953x: Preserve wakeup accounting on parent IRQ failure
gpio: davinci: Clear interrupt status in every bank on suspend
gpiolib: Free chip resources when allocating the label fails
gpiolib: cdev: don't set GPIOD_FLAG_IS_OUT
gpiolib: clear the event clock flags when a line is released
gpiolib: fix memory leak in gpiod_set_array_value_complex() EPERM error path
gpiolib: acpi: Ignore GPIO 11 interrupt on Acer Nitro 16S AI
gpio: lpc32xx: check devm_gpiochip_add_data() return value
gpiolib: acpi: Ignore GPIO 11 interrupt on ThinkPad L13 Gen 2a
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux
Pull MTD updates from Miquel Raynal:
"Core MTD:
- Fixes to the virt-concat driver
- Added INT0800 firmware-flash map driver
- mtdblock: prevent reclaim I/O during request processing
- cfi_cmdset_0002: cap the write-buffer chunk at 256 bytes on an x8 device
Raw NAND:
- Clean up the Qualcomm controller driver again
- Improve / create Arasan and IBM
- Reflect that ESMT and GigaDevice share ID 0xc8, and disable broken
timings feature on GD9FU2G8F3A
- Drop platform data support from the lpc32xx drivers
SPI NAND:
- Heyangtek uses two bytes for the BBM like every other device
- Winbond: Add support for W25N04LW and W25N08LW
- Support for ISSI SPI NAND flashes
SPI NOR:
- Support for new Macronix and (lots of) Winbond flash devices
- Rewrite the status register handling. There were many small helper
functions to enable quad I/O mode in many different ways. That's
now consolidated in one generic function.
- Rework the SFPD handling. It used to be only parsed for flashes
present in the in-kernel database which had any of the multi-I/O
bit set - or with the addition of generic flash driver for any
unknown flashes. This left a gap where SFDP wasn't handled and it
turns out newer flashes (with SFDP support) will reused IDs of just
these old flashed. With the rework, SFDP is tried to be parsed for
any flashes and will amend the information which is already present
in the in-kernel database.
- Increase SFDP size limit to 16KiB. There are flashes which have
some larger gaps between tables and thus exceeds the former 4KiB
limit.
- Flash fixups are getting more and more common. Due to this, the
fixups are now a separate list (per manufacturer) instead of being
attached to a specific flash. A new .match() callback makes them
more flexible, when one is applied.
- Support 1-1-8 and 1-8-8 modes with larger flashes which need 4byte
addresses
Then there is the load of API updates and misc AI fixes"
* tag 'mtd/for-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (155 commits)
mtd: spi-nor: sfdp: reduce stack usage in spi_nor_parse_sfdp()
mtd: spi-nor: sfdp: fix missing kernel-doc
mtd: parsers: qcom: fix offset/size overflow on large partitions
mtd: spinand: heyangtek: Reserve both bad block marker bytes
mtd: rawnand: pl353: fix clk reference leak in pl35x_nfc_setup_interface()
mtd: nand: use dmaengine_submit() instead of ->tx_submit()
dt-bindings: mtd: convert IBM NDFC binding to YAML
mtd: rawnand: fsl_ifc: allocate shared ctrl with devm_kzalloc
mtd: rawnand: qcom: fix read location register usage in config_nand_cw_read()
mtd: rawnand: qcom: move common code to the 'qpic_common' module
mtd: rawnand: qcom: rename 'nand_stats' structure
mtd: rawnand: qcom: make nandc_set_read_loc_last() more generic
mtd: rawnand: qcom: make nandc_set_read_loc_first() more generic
mtd: rawnand: qcom: make config_nand_cw_write() more generic
mtd: rawnand: qcom: make config_nand_page_write() more generic
mtd: rawnand: qcom: make config_nand_page_read() more generic
mtd: rawnand: qcom: make check_flash_errors() more generic
dt-bindings: mtd: arasan: Add "power-domains" for ZynqMP
mtd: virt-concat: unlink discarded items before freeing
mtd: virt-concat: unlink concat node before freeing it
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl
Pull pin control updates from Linus Walleij:
"Nothing special really, some new drivers, the usual trickle of fixes.
Oddly not even vary many LLM-assisted fixes, I guess they haven't
found their way into this subsystem yet.
Core changes:
- Support input-debounce-ns pin config property.
New drivers:
- Qualcomm:
- Hawi SoC TLMM and LPASS LPI TLMM
- Kuno (ARM32!) SoC TLMM
- MSM8952 SoC TLMM
- PMAU0102 SPMIO GPIO
- Starfive JHB100 SoC sys0, sys0h, sys1, sys2, per0, per1,
per2 per2pok and per3 (apparently strongly modularized silicon)
- Ambarella CV75
- Apple T8140 SoC used in iPhone 16 [Pro] and MacBook Neo
- Econet EN7528
- Allwinner Sunxi A733
- Mediatek MT6735
Improvements:
- Renesas RZ/3GL: SD channel PoC, I2C power source etc
- The SCMI pin controller uses generic helpers for handling
groups and functions"
* tag 'pinctrl-v7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (106 commits)
pinctrl: stm32: program the EXTI mux from .alloc instead of .activate
pinctrl: stm32: Fix the unit of the hwspinlock timeout
pinctrl: stm32: Fix fwnode reference leak in stm32_gpiolib_register_bank()
dt-bindings: pinctrl: brcm,nsp-gpio: Convert to DT schema
pinctrl: mediatek: Add MT6735 pinctrl driver
dt-bindings: pinctrl: mediatek,mt6779-pinctrl: Add bindings for MT6735 pin controller
dt-bindings: pinctrl: mediatek,mt6779-pinctrl: Document MT6765 pin controller
dt-bindings: pinctrl: mediatek,mt6779-pinctrl: Add MT6795
dt-bindings: pinctrl: mediatek,mt6779-pinctrl: Improve pinctrl subnode and property descriptions
dt-bindings: pinctrl: mediatek,mt6779-pinctrl: Pull pinctrl node changes from MT6795 document
pinctrl: tegra: xusb: free maps on DT map failure
pinctrl: sprd: free maps on DT map failure
pinctrl: kconfig: Select generic pinctrl helpers for scmi pinctrl
pinctrl: scmi: Replace pinctrl ops get group info with generics
pinctrl: scmi: Replace pinmux ops get function info with generics
pinctrl: ambarella: fix NULL vs IS_ERR() bug in amb_pinctrl_register()
pinctrl: starfive: fix missing CONFIG_OF dependencies
pinctrl: ambarella: add CONFIG_OF dependency
pinctrl: apple: Add t8140-pinctrl support
dt-bindings: pinctrl: apple,pinctrl: Add t8140 compatible
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input updates from Dmitry Torokhov:
- Updates to input core to reject parent device overrides on managed
input devices so devres lifetime management is not split across
different devices, along with fixes for da7280, drv2665, drv2667, and
tps6507x-ts that were reparenting managed input devices, and removal
of redundant parent assignments across multiple drivers
- A fix in input core to always accept EV_SYN events in input_event()
and input_inject_event() so events seeded before device registration
are properly flushed by input_sync()
- A fix in matrix-keymap helper to reject keycodes above KEY_MAX and
prevent out-of-bounds bitmap writes
- Fixes and cleanups for HP GSC PS/2 (gscps2) serio driver to resolve
race conditions in port list management, ring buffer access, and
interrupt handling, return IRQ_NONE for unhandled shared interrupts,
and drop busy-waiting on transmit
- Fixes for maple_keyb driver to correct inverted key press detection,
implement open and close methods so polling only runs while the
device is open, and clean up unused driver fields
- Fixes for maplecontrol driver to emit EV_SYN after reporting events,
only enable axes reported by the controller with corrected hat
limits, and stop polling and clear the callback on close
- Updates to maplemouse driver to stop polling and clear the callback
on close and drop redundant driver data cleanup
- Fixes for matrix_keypad driver reverting forced switching of row
GPIOs to input mode that broke row interrupts on platforms with
separate GPIO and interrupt pinmux functions, and propagating the
actual error code from matrix_keypad_build_keymap()
- A fix for st-keyscan driver to keep the interrupt disabled while the
peripheral clock is gated off to prevent bus faults, along with probe
error handling improvements
- A fix for mms114 touchscreen driver to disable interrupts before
synthesizing touch release events during suspend so concurrent
interrupts do not leave stuck active touch slots
- Updates to xpad driver to support GameSir Nova Lite controller
- A number of updates to device tree bindings, including a new schema
for Analog Devices AD7147 CapTouch controller, conversion of SiS 9200
I2C touchscreen binding to DT schema format, and allowing the
wakeup-source property on Dialog DA9062 onkey
- Other assorted driver cleanups, style fixes, and conversions,
including switching to named initializers for acpi_device_id tables
and converting cyttsp5 to DEFINE_SIMPLE_DEV_PM_OPS.
* tag 'input-for-v7.4-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (94 commits)
Revert "Input: matrix_keypad - force switch rows to input mode"
Input: s6sy761 - drop duplicate axis initialization in s6sy761_probe()
Input: always accept EV_SYN in input_event()
dt-bindings: input: dlg,da9062-onkey: Allow wakeup-source property
Input: xpad - add GameSir Nova Lite support
Input: touchscreen - use named initializers for acpi_device_id
Input: mouse - cyapa: use named initializers for acpi_device_id
Input: misc - use named initializers for acpi_device_id
Input: keyboard - use named initializers for acpi_device_id
Input: reject parent overrides on managed input devices
Input: tps6507x-ts - fix input device parent assignment
Input: drv2667 - fix input device parent assignment
Input: drv2665 - fix input device parent assignment
Input: da7280 - fix input device parent assignment
Input: maple_keyb - remove unused mdev->driver assignment
Input: maplecontrol - remove unused mdev->driver assignment
Input: maplemouse - remove unused mdev->driver assignment
Input: maplecontrol - remove redundant drvdata resetting
Input: maple_keyb - remove redundant drvdata resetting
Input: maplemouse - remove redundant drvdata resetting
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394
Pull firewire updates from Takashi Sakamoto:
- Guarantee asynchronous packet and transaction callbacks in process
context
Both the 1394 OHCI driver and the core transaction layer have been
changed to guarantee that asynchronous packet and transaction
callbacks are invoked in process context. In v6.17, the execution
context depended on the transaction destination: callbacks for
transactions destined for remote nodes were invoked from a workqueue,
whereas callbacks for transactions destined for the local node or
terminated due to internal errors were invoked in the transaction
initiator's context.
All such callbacks are now guaranteed to execute in process context,
eliminating the need to account for different execution contexts when
implementing callback functions.
- Fill kerneldoc for transaction layer
The above change guarantees a consistent execution context for packet
and transaction callbacks, making it possible to document their
execution context in kerneldoc.
- Enable compiler-based context analysis for the transaction layer
The core transaction layer is sufficiently complex that
compiler-based context analysis can help detect invalid call paths.
- Fix a reference count leak in the cdev layer
A reference count leak was reported when a user space application
delegated isochronous resource management. This issue has now been
fixed.
- Add KUnit tests for the configuration ROM parser and generator
In recent years, questions have been raised about how the
configuration ROM parser and generator handle boundary conditions and
edge cases. KUnit tests have been added to verify their behavior in
these situations. KUNIT_STATIC_STUB_REDIRECT is used to stub the
transaction responder so that it returns the configuration ROM
contents.
- Misc fixes for kerneldoc and nosy-dump application
* tag 'firewire-updates-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: (88 commits)
firewire: core: replace drain_workqueue() with flush_workqueue()
firewire: core: adjust context_unsafe() usage for lockdep checks
firewire: core: invoke packet callback from workqueue when removing card instance
firewire: core: use designated initializer for dummy driver on card removal
firewire: core: use context analysis to check lock state when scheduling error callbacks
firewire: core: check precondition when scheduling error callbacks
firewire: core: use workqueue to cancel all pending transactions on card removal
firewire: core: reuse helper function for scheduling error callbacks
firewire: core: don't disable error work for transaction
firewire: core: use release/acquire pair when replacing underlying driver on card removal
firewire: core: add kerneldoc for inbound transaction-related symbols
firewire: core: add kerneldoc for outbound transaction-related symbols
firewire: core: use appropriate spinlock variants for transaction-related locks
firewire: core: narrow the card lock scope when accessing node_id
firewire: core: use context analysis annotations and lockdep checks for topology map lock
firewire: core: use context analysis annotations and lockdep checks for split timeout lock
firewire: core: use context analysis annotations and lockdep checks for transactions lock
firewire: core: enable context analysis for transaction layer
firewire: core: add might_sleep() checks to transaction layer
firewire: core: fulfill kerneldoc for fw_cancel_transaction()
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media
Pull media updates from Mauro Carvalho Chehab:
- v4l2 core:
- improve subdev and pixformat kAPI;
- fix P010 format info and add Y12 format info;
- add fwnode_graph_for_each_endpoint_scoped();
- New sensor drivers:
- Sony IMX576
- OmniVision OS02G10, OV05C10 and OG0VA1B
- Samsung S5KJN5
- Himax HM1246
- Maxim GMSL2/3: add support for MAX9296A, MAX96717, and MAX96724
- Intel IPU6: add support for IPU7, IPU7.5 and IPU8
- NXP: add support for i.MX95 CSI pixel formatter driver
- ITE: add driver for IT6625/IT6626 HDMI bridge
- Qualcomm: add CSI2 3ph DPHY driver
- Rockchip: add rk3576 MIPI capture vicap driver
- STM32 DCMIPP: Add STM32MP25 subdevices
- Lots of driver fixes and cleanups
* tag 'media/v7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (596 commits)
media: i2c: imx576: Fix line length register
media: ov05c10: Remove duplicated writes to analogue gain register
media: ov05c10: Power management fixes
media: ov05c10: Set reset GPIO high when acquiring it
media: ov05c10: Small cleanups
media: maxim-serdes: Disable test pattern generator for now
media: mc: Keep INTERNAL pad flags just for the kernel, for now
media: i2c: imx576: select VIDEO_CCS_PLL to repair build error
media: Documentation: mc: Fix Stream reference
media: i2c: add imx576 image sensor driver
dt-bindings: media: i2c: Add imx576 sensor
media: i2c: maxim-serdes: add MAX9296A driver
media: i2c: remove MAX96714 driver
media: i2c: maxim-serdes: add MAX96724 driver
staging: media: remove MAX96712 driver
arm64: defconfig: disable deprecated MAX96712 driver
media: i2c: maxim-serdes: add MAX96717 driver
media: i2c: remove MAX96717 driver
media: i2c: add Maxim GMSL2/3 deserializer framework
media: i2c: add Maxim GMSL2/3 serializer framework
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound updates from Takashi Iwai:
"The AI flood continues, which brought us a fairly busy development
cycle again with changes spread across the subsystem, ranging from
(lots of) core hardening to new platforms and codecs.
Here are some highlights.
ALSA core:
- PCM: race fixes around channel-map controls, draining/unlink, drop
sync-stop handling, and DMA buffer delay sync
- Compress-offload: state and geometry validations, buffer leak fix,
and stream/card lifetime management
- Jack: module pinning during debugfs access, control removal race
fix, and early injection exposure
- Timer & sequencer: module pinning for user timers, RCU grace period
wait on port deletion, UMP bounds fixes
- Mark OSS sequencer emulation as deprecated
- RawMIDI: proper disconnect handling and input work drain cleanup
- Control: fixes for vmaster racy setups and control callback
serialization, UAF fix on card disconnect
ASoC core:
- Continued framework refactoring, deployment of
auto_selectable_formats across codecs and platform DAIs
- Generic card cleanup: free jack GPIOs on card remove for
simple-card and audio-graph-card variants
- SDCA improvements: SimpleJack function type support, library
helpers, and non-ACPI build support
- Conversion of deprecated DMA API calls
ASoC SOF:
- Support for compressed audio playback on SOF IPC4 with Intel TGL+
- AMD ACP 7.B / 7.F SoundWire and PDM controller support, ASP
carveout firmware loading
- Function topology support for Intel I2S machines
ASoC platforms & codecs:
- Qualcomm: New QAIF driver for Shikra platform, WCD9378 SDCA codec,
Nord Ride/RRD and Motorola Edge 30 boards, LPASS macro cache
converted to maple tree
- New codec drivers: ESS ES9039Q2M, Nuvoton NAU83G60 amplifier,
Senary SN624x SoundWire SDCA codec
- MediaTek / Airoha: New Airoha AN7581 AFE and WM8960 machine
drivers, extensive clock and error-handling cleanups across
MediaTek SoCs
- NVIDIA Tegra: WM8994 machine driver and CS35L45 MDSYNC support
- Realtek: RT766/RT767, RT721_U, RT718 variants, RT712 GPIO LED
control
- Cirrus Logic: CS35L45 MDSYNC support, CS35L56 regmap default tests
- TI: TAS2573 DSP support in TAS2781, TAS2783 SoundWire fixes
- Everest Semi: ES8326 standby / HPF controls, ES8389 / ES8375 resume
fixes
- Removal of obsolete ST-Ericsson Ux500 MOP500 machine driver
HD-audio:
- ACPI controller runtime PM suspend/resume support
- Controller shutdown and unbind race fixes for unsol events and jack
polling
- HDMI: High Bit Rate (HBR) audio capability enabled, ELD proc and
converter bounds checks
- AW88399 side codec SSID-specific firmware naming and Lenovo Legion
R9000P enablement
- Realtek / Conexant / Cirrus / TI quirks for numerous laptops
(Lenovo, ASUS, HP, Acer, HONOR, Minisforum, MSI, etc.)
- Creative CA0132 Sound BlasterX AE-5 external RGB LED strip support
USB-audio:
- Dedicated mixer driver for Audient EVO4
- Native Instruments Kore controller LCD support and keymap fix
- Pioneer DJ DDJ-SZ and Roland (OCTA-CAPTURE / QUAD-CAPTURE
multirate, TD-11) support
- UAC2/3 mixer unit matrix evaluation and bounds checking
- Hardening for LINE6 and caiaq drivers against malformed packets and
races
- Device-specific quirks for PreSonus, TASCAM, Logitech, Mayflower,
MOONDROP, Yamaha, etc.
Misc:
- Auto-cleanup conversion for snd_card_free() and devres migration
across dozens of legacy PCI, ISA, and Sparc drivers
- ALSA loopback (aloop) timer lifecycle fixes and new aloop selftest
- pcmtest driver fixes and kselftest updates"
* tag 'sound-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (924 commits)
ALSA: hda/realtek: Add mute and mic-mute LEDs for HP ENVY 16 (103c:8be5)
selftests: ALSA: pcmtest: Compare all captured bytes in ni_capture
ALSA: usb-audio: Use strscpy() in append_ctl_name()
ALSA: caiaq: Use strscpy() in snd_usb_caiaq_input_init()
ALSA: hiface: Use scnprintf() in hiface_chip_create()
selftests/alsa: Check the aloop PCM Slave controls for a matching playback
ALSA: aloop: Update the PCM Slave controls for a matching playback
selftests: ALSA: pcmtest: Make room for the longest fill pattern
selftests: ALSA: pcmtest: Check the frame count of each transfer
ALSA: hda/realtek: Fix speakers on COLORFUL L1 Plus
ALSA: hda/realtek: enable AW88399 on Lenovo Legion R9000P AFR10
ALSA: line6: Handle period elapsed calls outside the locks
ALSA: emux: Stop voices before freeing zones in all cases
ALSA: emux: Fix UAF of soundfont zones at note-on
ALSA: mtpav: restore negation dropped in guard() conversion
ALSA: compress: reject restarting an ACTIVE task via origin_seqno
ALSA: compress: add missing OPEN-state gate to SET_METADATA
ALSA: compress: reject buffer geometry change on gapless next_track
ALSA: compress: fix buffer leak on failed SET_PARAMS
ALSA: hda/realtek: Enable jack detection on Minisforum AI X1
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev
Pull fbdev updates from Helge Deller:
"A whole lot of small fixes all over many drivers, but the majority of
changes are related to code cleanups regarding the cursor handling in
vt and fbcon.
Fixes:
- core: initialize modelist in framebuffer_alloc()
- core: bitblit: fix glyph clipping when fbcon pans
- fbcon: restore font geometry if font rotation fails
- sh_mobile_lcdcfb: restore the per-overlay sysfs attributes
- udlfb: don't rebuild the mode list while the framebuffer is in use
- atmel_lcdfb: prevent FIFO work after removal
Cleanups:
- vt, fbcon, vgacon: cursor code rework & cleanups
- MAINTAINERS: name the deller/linux-fbdev for-next branch
- drop unused FB_IOMEM_HELPERS_DEFERRED Kconfig option
- acornfb: remove unused code
- atafb: fix sparse warnings and avoid casts
- sstfb: use managed PCI device enable
- gxt4500, kyro, nvidia: release write-combining handle on probe failure
- various drivers: typo fixes in comments
- various drivers: fix error path on fb_deferred_io_init() failure
- various drivers: use FB blanking constants instead of VESA constants"
* tag 'fbdev-for-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: (53 commits)
fbdev: xilinxfb: Use FB blanking constants
fbdev: platinumfb: Use FB blanking constants
fbdev: sa1100fb: Remove comment on VESA DPMS modes
fbdev: i810fb: Use FB blanking constants
fbdev: au1100fb: Use FB blanking constants
fbcon: Retry rotated font allocation after failure
fbcon: Rebuild rotated font buffer on font change
fbcon: Include font geometry in the rotated font cache
fbdev: bitblit: Fix glyph clipping when fbcon pans
fbcon: Replace fbcon_fill_cursor_mask() with fbcon_cursor_glyph()
lib/fonts: Add font_glyph_cursor() helper
vgacon: Use vt_cursor_{start,end}()
vgacon: Remove trailing whitespaces
vt: Add cursor-size helpers
MAINTAINERS: name the deller/linux-fbdev for-next branch
fbdev: atafb: avoid cast when assigning buffer address pointer
fbdev: atafb: fix sparse warnings
fbdev: atyfb_base: fix typos in comments
fbdev: aty128fb: fix typos in comments
fbdev: mach64: fix typos in comments
...
|
|
https://git.kernel.org/pub/scm/linux/kernel/git/mdraid/linux into block-7.4
Pull MD changes from Yu Kuai:
"Bug Fixes:
- Wake RAID10 barrier waiters when a pending-count rollback satisfies
an active array freeze. (Zizhi Wo)
- Reject v0.90 superblocks whose device count cannot fit the metadata
format, preventing out-of-bounds access. (Jérémy Jean)
- Track RAID5 disk-array allocation size and avoid removing an
unregistered CPU hotplug instance on setup or resize failure.
(Cao Guanghui)
- Validate the RAID0 device count before allocating its device list.
(Chandradhar Kumar)
- Validate RAID5 journal payload header, size, and checksum bounds
before accessing them. (Martin Wilck)
- Reject inconsistent RAID5 reshape metadata instead of triggering a
kernel BUG. (Yogesh Gaur)
- Reject invalid RAID4/5 disk counts before setup and invalid reshape
disk counts in raid5_run. (Chen Cheng)
- Fix a NULL-pointer dereference in RAID5 setup error handling.
(Zhihao Cheng)
- Reject RAID5 per-device sizes smaller than one chunk. (Zizhi Wo)
- Fix mddev_unlock() on an unacquired mutex in lbs_store().
(Jack Wang)
- Give RAID5 io_unit slab caches per-array names to avoid duplicate
cache names. (Yogesh Gaur)
- Validate v1.x bad-block log size when loading superblocks.
(Yuchao Zhang)
- Take reconfig_mutex while enabling PPL on an inactive array to
prevent a NULL PPL configuration. (Nguyen Ngoc Thang)
- Drain released RAID5 stripes before destroying the stripe cache on
takeover setup failure. (Li Youhong)
- Protect RAID5 big_stripe_tree lookup with RCU. (Sang-Hoon Choi)
- Prevent a NULL mddev->private dereference when stopping an array
while I/O is being submitted. (Zhihao Cheng)
- Don't publish an md array before md_alloc() finishes initializing
mddev->kobj. (Yogesh Gaur)
Cleanups:
- Annotate intentional lockless RAID10 freeze-state accesses.
(Zizhi Wo)
- Add shared RAID write-error and bad-block-sector helpers, and share
flush_bio_list between RAID1 and RAID10. (Li Youhong)
- Extract RAID5 min_raid_disks() helper. (Chen Cheng)
- Use assign_bit() where applicable in MD/RAID. (Peng Fan)"
* tag 'md-7.4-20261013' of https://git.kernel.org/pub/scm/linux/kernel/git/mdraid/linux: (25 commits)
md: don't hand out the array before md_alloc() has added mddev->kobj
md: Fix the null-ptr-deref of 'mddev->private' while submitting IO
md/raid5: protect big_stripe_tree lookup with RCU
md/raid5: drain released_stripes before destroying the cache
md: take reconfig_mutex when enabling PPL on an inactive array
md: validate bblog_size when loading v1.x badblocks metadata
md/raid: use assign_bit() where applicable
md/raid5: reject invalid reshape disks in raid5_run()
md/raid5: extract min_raid_disks()
md/raid5: give the io_unit slab caches per-array names
md: fix mddev_unlock() called without holding lock in lbs_store()
md/raid1-10: share flush_bio_list between raid1 and raid10
md/raid1-10: add rdev_bb_block_sectors() helper
md: add rdev_record_write_error() helper
md/raid5: reject a per-device size smaller than one chunk
md/raid5: setup_conf: Fix null-ptr-def in error handling path
md/raid5: reject raid4/5 arrays with too few disks
md/raid5: don't BUG() on an inconsistent reshape state from the superblock
md/raid5: validate payload size before calculating payload_len
md/raid0: validate device count before allocating devlist
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
Pull Char/Misc/IIO/others driver updates from Greg KH:
"Here is the big set of char/misc/android/iio and other small driver
subsystem patches for 7.4-rc1. Loads of stuff in here, larger than
normal. Highlights include:
- removal of the C binder code, the rust version is stable and will
be used going forward in a few billion devices. Great job by those
developers
- loads and loads of IIO driver updates and feature additions
- speakup driver fixes and updates
- mhi driver updates
- mei driver updates
- xillybus driver fixes
- comedi driver fixes
- lots of coresight driver updates
- Interconnect driver updates
- nvmem driver updates and fixes
- slimbus driver updates and fixes
- spmi driver updates and fixes
- lots of tiny misc and char driver fixes based on people scanning
for things
All of these have been in linux-next for a while with no reported
issues, other than a merge conflict with one of the rust tree files,
which should be simple to resolve"
* tag 'char-misc-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (446 commits)
rust_binder: wake epoll on self-work queued to poll thread
rust_binder: avoid overflow in get_node_debug_info()
MAINTAINERS: Add Abel as SPMI co-maintainer
spmi: mtk-pmif: Fix clock reference leak in mtk_spmi_bus_probe()
iio: adc: qcom-spmi-iadc: Remove regmap R/W wrapper functions
iio: adc: qcom-spmi-iadc: Migrate to devm_spmi_subdevice_alloc_and_add()
misc: qcom-coincell: Migrate to devm_spmi_subdevice_alloc_and_add()
phy: qualcomm: eusb2-repeater: Migrate to devm_spmi_subdevice_alloc_and_add()
power: reset: qcom-pon: Migrate to devm_spmi_subdevice_alloc_and_add()
nvmem: qcom-spmi-sdam: Migrate to devm_spmi_subdevice_alloc_and_add()
spmi: Add helper to get a parent SPMI device
spmi: Implement spmi_subdevice_alloc_and_add() and devm variant
spmi: Remove unneeded goto in spmi_device_add() error path
spmi: Print error status with %pe format
spmi: Remove redundant dev_name() print in spmi_device_add()
spmi: Fix potential use-after-free by grabbing of_node reference
spmi: mtk-pmif: Add workaround for FSM lockup/error in read operation
MAINTAINERS: Add Qualcomm SPMI controller entry
spmi: pmic-arb: return 0 in spmi_pmic_arb_register_buses() on success
comedi: addi_apci_3xxx: fix subdevice count underallocation
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Pull USB / Thunderbolt update from Greg KH:
"Here is the big set of USB and Thunderbolt changes for 7.4-rc1.
Included in here are:
- thunderbolt driver updates and fixes
- lots of dt schema conversions
- usb gadget driver fixes (and a new maintainer!)
- usb core fixups with some interactions with the driver core
- usb serial updates and fixes for scan-found "issues"
- xhci driver updates
- typec driver updates
- dwc3 driver updates
- lots of usb gadget driver fixes for syzbot found "problems"
- lots of other small USB driver fixes for randomly reported problems.
All of these have been in linux-next with no reported issues"
* tag 'usb-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (158 commits)
usb: gadget: dummy_hcd: prevent unbind via sysfs
usb: gadget: dummy_hcd: add tick_us module parameter for timer-rate tuning
usb: gadget: dummy_hcd: set no_sg_constraint only on the SuperSpeed bus
usb: gadget: dummy_hcd: fix SuperSpeed ep0 maxpacket
usb: gadget: fix refcount underflow in gadgetfs_bind() error path
USB: core: document purpose of interface parent reference
MAINTAINERS: add Neill Kapron as USB Gadget maintainer
USB: Documentation: Update description of completion callback context
USB: serial: mxuport: support RS485 mode configuration
USB: serial: mxuport: handle SEND_NEXT transmit flow control
USB: serial: add generic write control callbacks
USB: serial: mxuport: add MUX50U-based device support
USB: serial: mxuport: clean up firmware version handling
USB: serial: mxuport: clean up product ID definitions and device table
USB: serial: sierra: fix urb leak on write completion
usb: typec: ucsi_ccg: Add retry mechanism in ccg_read
usb: host: xhci-tegra: Add Tegra264 XHCI support
usb: host: xhci-tegra: Skip MBOX MSG_ENABLED on Tegra264
dt-bindings: usb: Add Tegra264 XUSB host support
usb: xhci-pci: Add TUSB73x0 definitions
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
Pull tty / serial driver updates from Greg KH:
"Here is the "big" set of tty and serial driver updates for 7.4-rc1.
It's not really all that big, it's been kind of quiet in this area of
the tree this development cycle in relation to other parts of the
tree. But still, included in here are:
- 8250 port updates and fixes
- 8250 driver cleanups by Jiri
- deletion of the obsolete moxa driver (making this pull request
remove more lines than added!)
- different serial driver updates for dma and other reported issues
All of these have been in linux-next with no reported problems"
* tag 'tty-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (91 commits)
tty: hvc: dcc: Detect JTAG connection only on CPU core 0
serial: earlycon: Use isdigit() in earlycon_init()
serial: core: Use isdigit() in uart_parse_options()
dt-bindings: serial: snps-dw-apb-uart: Add Synaptics sl2610 uart
serial: amba-pl011: drive the bus during break in RS485 mode
serial: mcf: update author email address
serial: pmac_zilog: report received breaks
serial: pmac_zilog: push received data to the port that received it
serial: amba-pl011: keep transmitter enabled when disabling RS485
serial: ma35d1: Do not force-enable an unselected console
serial: amba-pl011: honour delay_rts_before_send for every write
Revert "serial: 8250_port: Drop duplicate NULL check"
serial: 8250: make port operations work on struct uart_8250_port
serial: 8250_omap: set priv->line before enabling the IRQ
serial: 8250_lpss: do not touch uninitialized line in ehl_serial_exit()
serial: 8250_exar: store the GPIO platform device in struct exar8250
serial: 8250_exar: remove useless void * casts
serial: 8250: drop err label from serial8250_register_8250_port()
serial: core: fix TIOCSSERIAL and TIOCSERCONFIG on uninitialised ports
serial: max310x: don't transmit while an RS485 reconfigure is pending
...
|
|
Xu Yunxiang says:
====================
bpf: Track borrowed iterator result lifetimes
Make non-RCU, non-acquired struct iterator results borrow the current
element lifetime by default. KF_ITER_RET_INDEPENDENT marks the explicit
exception for results whose lifetime is independent of the iterator.
Trusted field loads and dynptr constructors propagate the source lifetime
so derived pointers stay in the invalidation graph. Next preserves the
iterator itself and invalidates old dependents before both return
outcomes; destroy propagates outstanding-child errors.
This revision addresses Alexei's implementation review. Share the pointer
invalidation traversal through invalidate_reference(), with root reference
release performed separately by release_reference(). Iterator next calls
invalidation directly. The existing result classification already keeps
MEM_RCU results out of the iterator dependency graph, so the duplicate
RCU checks at next are unnecessary. The traversal excludes STACK_ITER,
so it also needs no special guard for the iterator's own stack identity.
Patch 1 retains the generic trusted-field rule and its file/inode lifetime
explanation. Patch 2 retains the iterator lifetime tests and the VFS
before-release and after-release controls unchanged.
Justin has coordinated the overlapping work and dropped the iterator
and acquired-parent trusted-field fixes from his v3 series. This series
keeps those fixes; his series covers RCU-parent field classification and
the __derives_ret kfunc argument annotation, including bpf_real_data_inode().
The two series are based independently on bpf-next. They overlap at
reg_lifetime_id() and the struct-return parent_id assignment and will need
those sites reconciled when combined.
Changes in v8:
- Remove the duplicate RCU checks before iterator-next invalidation.
- Separate pointer invalidation from root reference release, removing
release_root and its unreachable root-alias guard. Keep the existing
inline acquired-child leak check in the shared traversal.
- Retain the test code and carry Amery's Reviewed-by tags from v7.
- Rebase onto bpf-next 4169c9c90532 without changing either patch diff.
- Remove the obsolete Assisted-by trailer for the current submission
tooling; retain the AI-assistance disclosure in this cover.
- Document the scope coordination with Justin and add him to Cc.
Changes in v7:
- Explain the generic trusted-field lifetime rule and the file/inode
example in patch 1's commit log, as requested by Alexei.
- Add a positive and negative VFS test for that example in patch 2.
- Rebase onto bpf-next b116ac6087541. The implementation's added and
removed lines were unchanged from posted v6; the field-load hunk's
context includes the upstream __nullable handling.
v7:
https://lore.kernel.org/r/20261021210754.3270023-1-xyx2021@mail.ustc.edu.cn
Alexei's v7 review:
https://lore.kernel.org/r/DMB212RCKZ56.LTNAJWB2D39T@gmail.com
v6:
https://lore.kernel.org/r/20260927120406.1041915-1-xyx2021@mail.ustc.edu.cn
Alexei's v6 review:
https://lore.kernel.org/r/DMA2SZ5PRG4N.3I51MHSTWUUTS@gmail.com
Justin's scope-coordination reply:
https://lore.kernel.org/r/att73Z9XpompG3k1@zenbox
Justin's v3:
https://lore.kernel.org/r/20261023212041.884996-1-utilityemal77@gmail.com
Kumar's related work:
https://lore.kernel.org/r/DLGYPZAL708V.3GFLANAPH2L8O@gmail.com
These lifetime paths were investigated through AI-assisted source
inspection and annotated verifier programs. The regressions check loading
and diagnostics. The independent-lifetime control uses a small bpf_testmod
iterator; the VFS control uses existing kfuncs. No delay or fault injection
is used to force runtime reclamation.
Validation on this candidate with a matching bpf_testmod:
- W=1 verifier, full kernel and modules builds passed.
- Changed BPF objects and required fixture compiled strictly.
- iters: 1/122 passed; 0 skipped.
- dynptr: 2/137 passed; 0 skipped.
- file_reader: 1/10 passed; 0 skipped.
- verifier_vfs_accept: 1/7 passed; 0 skipped.
- verifier_vfs_reject: 1/13 passed; 0 skipped.
- kmem_cache_iter: 1/3 passed; 0 skipped.
- dmabuf_iter: 1/4 passed; 0 skipped.
- verifier_ref_tracking: 1/57 passed; 0 skipped.
- task_kfunc: 1/47 passed; 0 skipped.
The before-release VFS program loaded on both the unmodified
baseline and this candidate. The after-release program loaded on the
baseline and was rejected by this candidate with the expected scalar
access diagnostic. These annotated programs are load-only.
The VMs used panic_on_warn and panic_on_oops. No WARN_ON report,
Oops or panic was found. Unprivileged BPF was enabled only in the
isolated guests.
The complete test_progs build used BPF_STRICT_BUILD=1. The unfiltered
full suite, sanitizer and architecture matrices were not run. The
fresh baseline comparison covers the VFS example retained from v7.
Please queue the verifier fix for stable after it reaches the BPF tree.
====================
Link: https://patch.msgid.link/20261024100647.2579244-1-xyx2021@mail.ustc.edu.cn
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
|
|
Exercise borrowed VMA results before and after iterator advancement
and destruction, including NULL next, trusted fields, and a FILE
dynptr that must be discarded before advancing. Keep positive controls
for using the current element and discarding the dynptr first.
Use a test-module iterator returning current to verify the explicit
independent-lifetime exception. Retain controls for RCU-protected
results. Also check the generic trusted-field rule outside iterators:
reading file->f_inode while holding an acquired file reference succeeds,
but using the saved inode pointer after bpf_put_file() is rejected.
The annotated programs check verifier loading and diagnostics; they do
not request runtime execution of the added programs.
Signed-off-by: Xu Yunxiang <xyx2021@mail.ustc.edu.cn>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Reviewed-by: Amery Hung <ameryhung@gmail.com>
Link: https://patch.msgid.link/20261024100647.2579244-3-xyx2021@mail.ustc.edu.cn
|
|
An open-coded iterator can return a struct pointer borrowed from its
current element. The verifier has not tied such results to iterator
state since the task_vma iterator was introduced, so a saved result
can still be used after destroy. Commit bee9ef4a40a27 ("bpf: switch
task_vma iterator from mmap_lock to per-VMA locks") also made next
release the protection of the prior element. A later snapshot
conversion made vm_file explicitly borrowed from that element.
Associate non-RCU, non-acquired struct results with the iterator
reference by default. Invalidate dependents before next forks its
NULL and non-NULL paths, while retaining the iterator itself. Let
destroy propagate child-reference errors. Add KF_ITER_RET_INDEPENDENT
for results that outlive the current element, preserving existing
RCU and acquired-reference rules.
Trusted pointer field loads also need to preserve the source lifetime.
Loading a trusted field does not acquire a reference to the pointed-to
object. Set the field pointer's parent_id to the source's reference ID
if the source is referenced, or inherit its parent_id if it is borrowed.
This is a generic rule, including accesses unrelated to iterators. For
example, the following access is now rejected:
file = bpf_get_task_exe_file(task);
if (!file)
return 0;
inode = file->f_inode;
bpf_put_file(file);
ino = inode->i_ino;
The inode pointer borrows the file's lifetime. Releasing the acquired
file reference removes that lifetime guarantee, so the verifier must
invalidate the derived inode pointer as well. This does not imply that
bpf_put_file() immediately frees the file or inode. Reading the inode
while the file reference is held remains valid. Fields with independent
RCU protection retain their existing lifetime rules.
For an iterator result, the same propagation keeps trusted fields such
as vm_file and f_inode tied to the current element. Propagate the backing
object's lifetime through dynptr construction too, so its descendants
remain in the invalidation graph. Share the invalidation traversal
between next and release, so advancing the iterator preserves its own
reference.
Fixes: 4ac454682158 ("bpf: Introduce task_vma open-coded iterator kfuncs")
Suggested-by: Amery Hung <ameryhung@gmail.com>
Signed-off-by: Xu Yunxiang <xyx2021@mail.ustc.edu.cn>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Reviewed-by: Amery Hung <ameryhung@gmail.com>
Link: https://patch.msgid.link/20261024100647.2579244-2-xyx2021@mail.ustc.edu.cn
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
Pull staging driver updates from Greg KH:
"Here is the big set of staging driver updates for 7.4-rc1.
The huge majority of changes in here were to the rtl8723bs driver,
which ended up being deleted entirely through the wifi driver tree, so
while the work here was nice to have done to get experience by people,
the overall goal was achieved in that we have a solid working and sane
driver in the real part of the tree now.
Other than that, included in here are:
- some greybus driver removal of broken drivers that no one ever used
- minor coding style cleanups for other staging drivers
All of these have been in linux-next with no reported issues, other
than the merge conflict of the driver being removed, but that's an
obvious one to resolve :)"
* tag 'staging-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (145 commits)
staging: rtl8723bs: remove unnecessary parentheses
rtl8723bs: Remove redundant macro in basic_types.h
staging: rtl8723bs: remove spaces before tabs in hal_com_reg.h
staging: greybus: Align function arguments
staging: greybus: uart: fix argument alignment
staging: greybus: Remove unused header declaration to_fw_mgmt_connection
staging: most: fix typo in driver_usage.txt
staging: vme_user: avoid iterator variable access outside list loop
staging: greybus: Remove unused function 'to_fw_mgmt_connection'
staging: greybus: replace PTR_ERR() with %pe in error messages
staging: octeon: fix misuse of kernel-doc comment
staging: nvec: fix GPIO descriptor documentation
staging: fbtft: update outdated struct fbtft_ops comment
greybus: Discard pm_runtime_put_autosuspend() return value
staging: rtl8723bs: remove unused defines in odm.h
staging: rtl8723bs: remove commented out code in hal/ files
staging: rtl8723bs: remove unused defines in HalBtcOutSrc.h
staging: rtl8723bs: remove unused PCI ASPM OSC definitions
staging: rtl8723bs: remove unused EEPROM definitions
staging: rtl8723bs: return bool from check_pending_xmitbuf
...
|
|
Pull SCSI updates from James Bottomley:
"Small number of driver updates (mpi3mr, ufs, scsi_debug).
By far the biggest core change (at 4000+ lines) is the sense code
rework to make our sense handling follow the 16 bit defines in the
SCSI standard rather than our split ASC and ASCQ handling which ends
up being confusing and difficult to grep.
The changes should all be functionally equivalent and so far the bots
and AI seem to agree; the code has been incubating in -next since 16
September with one reported issue fixed.
The remaining updates are minor"
* tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (114 commits)
scsi: ufs: rpmb: Fix power-on UNIT ATTENTION retry
scsi: bfa: Use snprintf() in bfa_fcs_fabric_psymb_init()
scsi: bfa: Use snprintf() in bfa_fcs_fabric_nsymb_init()
scsi: MAINTAINERS: Remove Avri Altman as UFS reviewer
scsi: st: Relock the door after a reset
scsi: st: Restore the drive buffering mode after reset
scsi: st: Record the tape position after a successful MTLOAD
scsi: st: Restore changed drive settings after reset also for MTLOAD and MTRETEN
scsi: scsi_debug: Validate the access parameters of WRITE ATOMIC (16)
scsi: scsi_debug: Map the region written by WRITE ATOMIC (16)
scsi: scsi_debug: Refuse a short WRITE ATOMIC (16) before writing it
scsi: scsi_debug: Advance the write pointer over the data written
scsi: scsi_debug: Do not write a partial physical block to a zoned device
scsi: scsi_debug: Enforce physical block alignment of zoned writes
scsi: scsi_debug: Report the residual of a write
scsi: scsi_debug: Avoid 32-bit overflow in WRITE SCATTERED offsets
scsi: scsi_debug: Evaluate scsi_debug_lbp() only once
scsi: scsi_debug: Take the zone metadata lock before the data lock
scsi: scsi_debug: Refuse a negative physblk_exp
scsi: scsi_debug: Make atomic writes and ZBC emulation mutually exclusive
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull block updates from Jens Axboe:
- NVMe updates via Keith:
- Apple M4 (t8132) ANS2 NVMe support
- nvme-multipath sysfs attributes for path_state, iopolicies, and
fail_on_ctrl_loss, plus path state evaluation fixes
- nvme-tcp parallelized I/O queue allocation and startup, and using
the caller's network namespace
- nvmet passthru UAF fix and rework, PR preempt use-after-free
fixes, auth hardening, and traffic based keep alive support
- DH-HMAC-CHAP secret attributes readable by root only
- Various other fixes and cleanups
- swim driver overhaul and fixes, plus floppy fixes, via a pull from
Denis
- Block device buffered and direct I/O rework from Tal: use
iomap_dirty_folio, take i_rwsem for the write fallback and splice
read, honor IOCB_NOWAIT in the buffered read path, and reject atomic
write fallback to buffered I/O
- Large zone revalidation rework: serialize revalidation, handle
capacity changes by dropping and retrying zone write plugs, propagate
read-only and offline conditions, and treat offline and read-only
zones as dead
- ublk robustness work around canceled FETCH rounds and going live over
canceled io commands, dropping the default I/O scheduler, and a batch
of selftest additions
- blk-iocost flush cost support and zone append accounting
- rust block fixes for Send/Sync bounds on GenDisk and TagSet, and
import style cleanups
- Atomic write fixes capping size by the PI buffer constraints and
failing short atomic pins
- Skip the redundant flush for O_DSYNC direct writes, and only use
REQ_FUA when the device supports it
- Store GPT attributes as a raw value
- Remove support for swapping loop fds
- Various other fixes and cleanups all over
* tag 'for-7.4/block-20261021' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (144 commits)
block: restore the iterator when rejecting a misaligned bio
blk-mq: clear stale inactive flag on hctx reuse
block, bfq: initialize active lists for all actuators
zloop: print device that had errors
ublk: pin module while release work is pending
blk-mq: drop the tag_set argument from blk_mq_free_rq_map/tags
blk-mq: share one tags_srcu instance across all tag sets
blk-iocost: fix stale comment in ioc_rqos_throttle()
blk-iocost: account zone append completions in latency stats
blk-iocost: charge zone appends as writes
blk-iocost: add flush cost support with the flushiops model parameter
ublk: use global index for reported zones
selftests: ublk: add test for going live over canceled io commands
selftests: ublk: stop a batch thread when PREP_IO_CMDS fails
selftests: ublk: move the control command helpers into ctrl.c
ublk: refuse to go live after an io command was canceled
ublk: let STOP_DEV cancel the server's commands before its release
ublk: allow a NULL io->cmd in the cancel callback
ublk: reset the FETCH round under ub->mutex
ublk: reset the FETCH round in release also without a disk
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull io_uring updates from Jens Axboe:
"The bulk of this is a big robustness pass over cancelation, io-wq,
timeouts, and poll. Outside of that:
- Large series from Josef hardening the cancelation, io-wq, timeout,
poll, and wait paths. Fixes for lost wakeups and lost cancels as
io-wq arms poll/timeouts, work stranding on worker exit, CQE32
resize handling, napi entry timeouts, and a pile of smaller
correctness issues across the board
- Rework of how io-wq posts completions, posting from the last
request reference and dropping the request file before the
completion, and running ring release cancelations synchronously -
canceling and waiting for all in-flight requests and dropping
registered files and buffers at release time
- Don't charge the SQ/CQ rings or provided buffer rings to
RLIMIT_MEMLOCK, which the region API conversion had started doing
- Split io_uring_cmd_set_res() out from io_uring_cmd_done() so a
command can set the result from its ->end_io() handler, used by
nvme
- CQE32 ring fixes for the free entry check, aux CQE big_cqe zeroing,
and the dummy skip CQE
- Timeout fixes for sequence handling and multishot updates
- net fixes for MSG_TRUNC buffer overconsumption and keeping recv
buffer select length within MAX_RW_COUNT
- Wake real-time waiters from hard interrupt context
- Don't spin on local work an exiting task can't run, reachable by an
unprivileged user
- Various other fixes and cleanups"
* tag 'for-7.4/io_uring-20261021' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (75 commits)
io_uring: end the drain when the drain request completes
io_uring/futex: return a wait's data to the cache when it fails to arm
io_uring/wait: wake real-time waiters from hard interrupt context
io_uring/waitid: return -EAGAIN for a non-blocking pidfd
io_uring/net: keep recv buffer select length within MAX_RW_COUNT
io_uring/waitid: prevent cancel reference wrap
io_uring/poll: don't loop on HUP with multiple references
io_uring/timeout: don't lose a cancel as io-wq arms a timeout
io_uring/timeout: don't flush with the sequence behind the last flush
io_uring/timeout: don't put a sequence target behind the last flush
io_uring/poll: avoid retry wakeup loss when dropping ownership
io_uring: look up the file before queueing to io-wq
io_uring/timeout: don't end a linked timeout with 1
io_uring/timeout: no ABS update of multishot timeouts
io_uring/net: don't retry recv on uncommitted buffers
io_uring: don't pass restart error codes to userspace
io_uring/openclose: keep the lock in io_pipe_fixed()
io_uring/sqpoll: let the thread sleep on disabled rings
io_uring/kbuf: handle index wrap in last buffer check
io_uring/zcrx: fix buffer offsets in areas above 4GB
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm
Pull device mapper updates from Mikulas Patocka:
"dm:
- fix a bug in dm_accept_partial_bio that broke dm-writecache
in persistent-memory mode
- use assign_bit()
dm-vdo:
- fix misbehavior on invalid metadata
dm-crypt:
- use memzero_explicit
- reject malformed keys
- allow sector size up to page size
dm-delay:
- advertise flush support if the user wants to delay flushes
dm-writecache:
- reduce per-block metadata overhead by 8 bytes
- report I/O error when flush failed
- fix a quirk in statistics
- fix a crash if we attempt to use a non-dax device
- fix uncommitted_blocks underflow
- fix REQ_FUA processing
dm-verity:
- add the option DM_VERITY_VERIFY_ROOTHASH_SIG_FORCE
- clear LSM integrity state on suspend
dm-thin:
- remove unnecessary locking in pool_map
dm-mpath:
- small refactoring of the historical service time path selector
dm-snapshot:
- fix crash if dm_io_client_create fails
- make the chunk list being sorted by the chunk number
dm-bufio:
- fix non-working memory limit
- fix a race leading to an unsigned integer underflow
- clean-up cache limit reading"
* tag 'for-7.4/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: (29 commits)
dm-verity: clear LSM integrity state on suspend
dm-bufio: clean-up cache size reading
dm-bufio: fix a race leading to an unsigned integer underflow
dm-bufio: fix non-working memory limit
dm-snapshot: make the chunk list sorted by the chunk number
dm-snapshot: fix crash if dm_io_client_create fails
dm-crypt: allow encryption sector size up to PAGE_SIZE
dm-mpath: check values in hst_status while holding spinlock
dm-mpath: standardize repeat_count handling in the HST path selector
dm-mpath: streamline setup work in the HST path selector
dm-writecache: fix REQ_FUA processing
dm-writecache: fix uncommitted_blocks underflow
dm-writecache: fix a crash if we attempt to use non-dax device
dm-writecache: fix a quirk in statistics
dm-writecache: report I/O error if flush failed
dm: fix a bug in dm_accept_partial_bio
dm thin: Remove unnecessary locking from pool_map()
dm-verity: add DM_VERITY_VERIFY_ROOTHASH_SIG_FORCE
dm: use assign_bit() where applicable
dm-writecache: Reduce metadata memory use by 8 bytes per cache block
...
|
|
Kernels built for the MIPS64-based Cavium Octeon SoCs are normally
big-endian, but little-endian builds are also supported. Currently, the
SHA-1, SHA-256, and SHA-512 code using the Octeon crypto co-processor is
enabled in both builds.
This code is untestable without the hardware. However, based on the
code itself, it is implausible that it computes hash values correctly in
little-endian builds. Such builds write many incorrect values to COP2:
- SHA-1 and SHA-256: The 64-bit integer that contains the last two
32-bit message words of each block is written to COP2 entirely
byte-reflected, due to missing endianness conversion in
octeon_sha1_start() and octeon_sha256_start() to compensate for
using native 64-bit loads from the message bytes. This differs from
all the earlier message words which are written correctly.
Furthermore, the state is written to COP2 with each 32-bit word
byte-reflected within each 64-bit integer, due to incorrect use of
64-bit endianness conversion in write_octeon_64bit_hash_dword() when
the state is kept in memory in native-endian 32-bit words.
- SHA-512: All the 64-bit message words are written to COP2
byte-reflected, due to missing endianness conversion in
write_octeon_64bit_block_sha512() and octeon_sha512_start(). The
SHA-512 state words seem to be written correctly.
Big-endian kernels aren't affected by these bugs. These bugs also
aren't new; this code has been broken on little-endian ever since it and
Octeon little-endian support were first added in v4.1.
Commit d2a948d2db68 ("MIPS: Octeon: Make octeon-md5 driver
endian-agnostic") made the MD5 code work on little-endian kernels by
adding 64-bit endianness conversions to the COP2 macros used by MD5
(some of which are shared by SHA-1 and SHA-256, despite those algorithms
keeping the state words in native-endian instead of MD5's little-endian,
causing some of the strange behavior described above). However, SHA-1,
SHA-256, and SHA-512 were never fixed to work on little-endian kernels.
Therefore, disable the Octeon SHA-1, SHA-256, and SHA-512 code in
little-endian kernels. This causes the generic code that actually
computes hash values correctly to be used instead.
Fixes: 82be2dcfa6a1 ("crypto: octeon - add SHA1 module")
Fixes: c3d0def62001 ("crypto: octeon - add SHA256 module")
Fixes: fbaa4dfd51a0 ("crypto: octeon - add SHA512 module")
Cc: stable@vger.kernel.org
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://patch.msgid.link/20261022054450.20746-1-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
|
|
Encryption is not supported when a filesystem's block size is larger
than the page size. ext4_check_large_folio() refuses to mount a
filesystem like that if the "encrypt" feature is already enabled, and
ext4_set_context() refuses to create encrypted inodes if the feature
is enabled after mounting.
However, a corrupted or hand-crafted filesystem can still have
encrypted inodes even if the "encrypt" feature is not set, and those
inodes can be unlocked if they're using v1 policies.
Check this in __ext4_iget() and reject them as corrupted.
Fixes: 709f0f1f1bf5 ("ext4: add checks for large folio incompatibilities when BS > PS")
Suggested-by: Eric Biggers <ebiggers@kernel.org>
Cc: stable@vger.kernel.org # v6.19+
Signed-off-by: Alberto Garcia <berto@igalia.com>
Reviewed-by: Baokun Li <libaokun@linux.alibaba.com>
Reviewed-by: Eric Biggers <ebiggers@kernel.org>
Link: https://patch.msgid.link/aeb8efa8beb72721fb4b13cffe6eb22c795ec33f.1790343958.git.berto@igalia.com
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
|
|
Encryption is not supported when a filesystem's block size is larger
than the page size, and commit 709f0f1f1bf5 ("ext4: add checks for
large folio incompatibilities when BS > PS") added a check to refuse
mounting such a filesystem.
However, it is also possible to enable the "encrypt" feature on a
filesystem that is already mounted (with tune2fs -O encrypt). Once
that happens it won't be possible to mount the filesystem again in
the future, but there is nothing preventing the user from setting an
encryption policy while the filesystem is still mounted.
Fix this by refusing to set an fscrypt context in ext4_set_context()
when the block size is larger than the page size.
Fixes: 709f0f1f1bf5 ("ext4: add checks for large folio incompatibilities when BS > PS")
Cc: stable@vger.kernel.org # v6.19+
Signed-off-by: Alberto Garcia <berto@igalia.com>
Reviewed-by: Baokun Li <libaokun@linux.alibaba.com>
Reviewed-by: Eric Biggers <ebiggers@kernel.org>
Link: https://patch.msgid.link/093b40e9df29fc102907092f4ff73461f4cfcbfd.1790343958.git.berto@igalia.com
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
|
|
fscrypt_find_mode_key() walks an RCU list and hands out a per-mode
key without an acquire:
setup task
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
setup_per_mode_enc_key()
├─ fscrypt_prepare_key()
│ └─ fscrypt_prepare_inline_crypt_key()
│ └─ blk_crypto_start_using_key()
│ └─ blk_crypto_fallback_start_using_mode()
│ ├─ init profile, keyslots, tfms[]
│ └─ smp_store_release(tfms_inited[mode]) # init order
└─ list_add_tail_rcu(&new_node->link, ...) # release -> finder
finding task (later submits the I/O itself)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
fscrypt_find_mode_key()
├─ list_for_each_entry_rcu(node, ...)
└─ return &node->key # no acquire, chain breaks
...
blk_crypto_fallback_bio_prep() # WRITE path
├─ tfms_inited[mode] # addr-dep, reads true
├─ blk_crypto_fallback_profile # no dependency
├─ blk_crypto_keyslots # no dependency
└─ slotp->tfms[mode] # no dependency
RCU publishes the node and the key reachable from it, so
tfms_inited[mode] reads true through the address dependency. The
independent fallback globals are not covered by it and can be read as
uninitialized.
On a weakly ordered machine, a WRITE bio can crash in
blk_crypto_get_keyslot() or crypto_sync_skcipher_setkey().
Other tasks reach the key through fscrypt_inode_info's
cmpxchg_release()/smp_load_acquire(), which is already ordered after
the list walk; only the finding task's own later I/O was not.
Fix this by upgrading the control dependency to an acquire with
smp_acquire__after_ctrl_dep() once a matching entry has been found.
Fixes: dd015b566d50 ("fscrypt: Fix key setup in edge case with multiple data unit sizes")
Cc: stable@vger.kernel.org
Suggested-by: Eric Biggers <ebiggers@kernel.org>
Link: https://lore.kernel.org/r/20261014161153.GC322435@quark
Signed-off-by: Baokun Li <libaokun@linux.alibaba.com>
Link: https://patch.msgid.link/20261024104350.2257313-1-libaokun@linux.alibaba.com
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
|
|
Explicitly zeroize the sw_secret array in the case where
fscrypt_derive_sw_secret() fails, in case anything was written to it.
Doesn't really matter, but this came up in a code review.
Link: https://patch.msgid.link/20261021224431.2353673-1-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
|
|
When CONFIG_MEMCG=y, lruvec_pgdat() returns lruvec->pgdat, which for the
per-node pgdat->__lruvec is left NULL by lruvec_init() and only filled in
lazily by mem_cgroup_lruvec(). Normally that happens early, e.g. on the
first folio_add_lru().
With cgroup_disable=memory, lru_gen_shrink_node() passes &pgdat->__lruvec
directly to shrink_one(). If direct reclaim runs before anything has
called mem_cgroup_lruvec() for the node, which can happen during early
boot under memory pressure (e.g. a kdump kernel), get_swappiness() ends
up dereferencing a NULL pgdat:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000005040
pc : get_swappiness+0x68/0xb0
lr : try_to_shrink_lruvec+0x54/0x2c0
Call trace:
get_swappiness+0x68/0xb0 (P)
try_to_shrink_lruvec+0x54/0x2c0
shrink_one+0x8c/0x240
shrink_node+0xc6c/0xe08
do_try_to_free_pages+0xdc/0x570
try_to_free_pages+0x124/0x278
__alloc_frozen_pages_noprof+0x6e8/0xf78
alloc_pages_mpol+0xc4/0x1c0
alloc_frozen_pages_noprof+0x54/0xe8
alloc_pages_noprof+0x1c/0x40
atomic_pool_expand+0x98/0x300
__dma_atomic_pool_init+0x58/0xd8
dma_atomic_pool_init+0x154/0x170
do_one_initcall+0x64/0x350
kernel_init_freeable+0x214/0x430
kernel_init+0x2c/0x208
ret_from_fork+0x10/0x20
The classic LRU path and MGLRU before per-node lru_gen_folio lists
obtained the lruvec through mem_cgroup_lruvec(), which sets
lruvec->pgdat.
The above was hit on an arm64 kdump kernel (6.18-based) booted with
cgroup_disable=memory nr_cpus=4. It also reproduces on mainline on an
arm64 VM with CONFIG_ARM64_64K_PAGES=y, CONFIG_MEMCG=y,
CONFIG_LRU_GEN_ENABLED=y and:
mem=160M nr_cpus=4 coherent_pool=512M cgroup_disable=memory
These options only serve to force direct reclaim early in boot; with
160M the boot eventually ends in OOM regardless. On mainline the first
LRU reclaim happens while unpacking the initramfs, and faults the same
way:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000005040
pc : get_swappiness+0xd4/0x150
Call trace:
get_swappiness+0xd4/0x150 (P)
try_to_shrink_lruvec+0x44/0x2b8
shrink_one+0x80/0x1a0
shrink_node+0xd98/0xea8
do_try_to_free_pages+0xf4/0x4b0
try_to_free_pages+0x110/0x360
__alloc_frozen_pages_noprof+0x8b0/0x1718
...
__filemap_get_folio_mpol+0x2ac/0x548
simple_write_begin+0x44/0xf8
page_symlink+0x178/0x198
...
do_populate_rootfs+0x13c/0x200
Link: https://lore.kernel.org/20261017050928.128582-1-sidchintamaneni@gmail.com
Fixes: e4dde56cd208 ("mm: multi-gen LRU: per-node lru_gen_folio lists")
Signed-off-by: Siddharth Chintamaneni <sidchintamaneni@gmail.com>
Signed-off-by: Hardik Garg <hargar@linux.microsoft.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Barry Song <baohua@kernel.org>
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Assisted-by: LLM
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: David Hildenbrand <david@kernel.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Qi Zheng <qi.zheng@linux.dev>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Kairui Song <kasong@tencent.com>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Cc: Wei Xu <weixugc@google.com>
Cc: Baoquan He <baoquan.he@linux.dev>
Cc: Yu Zhao <yuzhao@google.com>
Cc: <apais@microsoft.com>
Cc: <rlmenge@gmail.com>
Cc: <stable@vger.kernel.org> # 6.3+
|
|
page_counter_calculate_protection() runs without locks. Several
reclaimers can update the same counter's emin and elow at the same time,
and readers such as mem_cgroup_below_min(), mem_cgroup_protection() and
the dmem eviction code load them with READ_ONCE().
Commit b3a7822e5e75 ("mm, memcg: prevent mem_cgroup_protected store
tearing") made the main path store emin and elow with WRITE_ONCE(), but it
missed the early return for a counter whose parent is the reclaim root.
Those two stores are the only plain accesses to emin and elow left.
With CONFIG_KCSAN_STRICT=y, a few tasks writing to the same cgroup's
memory.reclaim trigger reports like this within seconds:
BUG: KCSAN: data-race in page_counter_calculate_protection / shrink_node
read (marked) to 0xff1f91b146d40e40 of 8 bytes by task 163 on cpu 4:
shrink_node+0x57a/0x1210
do_try_to_free_pages+0x194/0x930
try_to_free_mem_cgroup_pages+0x204/0x3f0
user_proactive_reclaim+0x28a/0x4d0
memory_reclaim+0x35/0x50
...
write to 0xff1f91b146d40e40 of 8 bytes by task 167 on cpu 6:
page_counter_calculate_protection+0x1fa/0x360
mem_cgroup_calculate_protection+0x4e/0x70
shrink_node+0x53e/0x1210
...
The default KCSAN config does not report it, because it treats aligned
word-sized plain writes as atomic.
Use WRITE_ONCE() for these two stores as well.
There is no functional change. Readers already accept stale values, and
compilers emit a single word-sized store either way: with GCC 14 the
x86-64 object code is the same before and after this change.
Link: https://lore.kernel.org/20261021204818.3431099-1-shakeel.butt@linux.dev
Fixes: b3a7822e5e75 ("mm, memcg: prevent mem_cgroup_protected store tearing")
Signed-off-by: Shakeel Butt <shakeel.butt@linux.dev>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Sashiko <sashiko-bot@kernel.org>
Reviewed-by: Gregory Price (Meta) <gourry@gourry.net>
Reviewed-by: SJ Park <sj@kernel.org>
Acked-by: Muchun Song <muchun.song@linux.dev>
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Chris Down <chris@chrisdown.name>
|
|
struct memcg_stock_pcp hold references to cgroups that it tracks to make
sure that the memcg never gets freed with unaccounted charges still
living in the stock. When the cached stock goes to 0 for a memcg, its
reference is dropped and the cached memcg pointer is set to NULL.
If that was the last reference, the css_put would free the associated
cgroup before publishing the NULL pointer, which can be racy on
PREEMPT_RT. To summarize Shakeel Butt's analysis in [2],
CPU 1 CPU 2
local_trylock() takes a per-CPU
spinlock, which is an rcu read
lock along with migrate_disable
drain_stock
css_put drops the last reference
release work is queued
kworker runs css_release_work_fn()
call_rcu() starts grace period G
which waits for the refill task.
<preempt>
drain_all_stock
is_memcg_drain_needed()
enters rcu_read_lock(), but
grace period G does not wait
since it started after G did
<prempt>
stock->cached[i] is cleared and
unlocks. Grace period G ends,
old is freed
mem_cgroup_is_descendant() reads
old->css.cgroup which has just
been freed.
To close this gap on PREEMPT_RT, switch the order of the referene drop
and the publishing so that we publish the NULL pointer before dropping
the reference. Note that this can only happen from drain_stock who can
hold the last reference, but not on consume_stock since another
reference will always be held. But fix this in both sites to maintain
consistency.
This is based on a report from Sashiko, who found this pre-existing
issue in my page_counter_stock series [1].
Link: https://lore.kernel.org/20261021010051.1529261-1-joshua.hahnjy@gmail.com
Link: https://sashiko.dev/#/patchset/20260928192349.3432886-1-joshua.hahnjy%40gmail.com [1]
Link: https://lore.kernel.org/all/atfMngq7nyZpt4u-@linux.dev/ [2]
Fixes: e1a366be5cb4 ("mm: memcontrol: switch to rcu protection in drain_all_stock()")
Signed-off-by: Joshua Hahn <joshua.hahnjy@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
Acked-by: Muchun Song <muchun.song@linux.dev>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
|
|
This commit adds a test that builds two maple_range_64 trees in RCU
mode. The first tree has a root that is a full maple_range_64 node and
ensures that the destruction under RCU does not misinterpret the last
slot as metadata. 226 insertions produce such a root on a 64-bit build.
The second tree is a height 3 tree whose root holds 15 child pointers
and metadata in its last slot, so every slot is non-zero and ensures
that the destruction under RCU does not descend into the metadata slot.
3166 insertions produce such a tree on a 64-bit build.
Link: https://lore.kernel.org/20261005-fix-maple-tree-range64-rcu-v3-2-ebe7fb278e20@cslab.ece.ntua.gr
Signed-off-by: Dimitris Charisis <dchar@cslab.ece.ntua.gr>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Liam R. Howlett (Google) <liam@infradead.org>
Cc: Alice Ryhl <aliceryhl@google.com>
Cc: Andrew Ballance <andrewjballance@gmail.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Florian Schmaus <florian.schmaus@codasip.com>
|
|
Patch series "maple_tree: fix maple_range_64 crashes in RCU mode", v3.
The patch series fixes two RCU destroy path issues on maple_range_64
nodes. Both arising from the fact that a maple_range_64 node repurposes
the last slot to hold metadata when the node is not full. Patch 1
addresses the issues, and patch 2 adds a test used to catch them.
Currently there is no in-tree user of maple_range_64 nodes in RCU mode.
All in-tree users of MT_FLAGS_USE_RCU also set MT_FLAGS_ALLOC_RANGE which
makes the internal nodes maple_arange_64.
Below is the minimal reproducer used during debugging:
static DEFINE_MTREE(tree);
static int __init maple_fix_init(void)
{
unsigned long i, j;
for (i = 10; i < 4000; i++) {
mt_init_flags(&tree, MT_FLAGS_USE_RCU);
for (j = 0; j < i; j++) {
mtree_insert_range(&tree, j * 10, j * 10 + 9,
xa_mk_value(j), GFP_KERNEL);
}
mtree_destroy(&tree);
rcu_barrier();
}
return 0;
}
The splat for the first issue addressed by the first patch is shown below.
mt_clear_meta() runs after the slots have been rewritten with raw
pointers by mte_dead_leaves(), so it cannot recognize a valid last pointer
because the type information is stripped. On my 64-bit LE machine, it
clears bytes 248 and 249 of the maple_range_64 which are the two least
significant bytes of the last pointer. The lowest byte is already zero,
since nodes are 256-byte aligned, but zeroing byte 249 corrupts the
pointer.
KASAN catches it as a double-free, because that corrupted pointer happens
to land on a node that was freed previously. The splat appears at 226
insertions in the reproducer. This is when the tree has a full root node
on a 64-bit build.
==================================================================
BUG: KASAN: double-free in mt_free_walk+0x138/0x3a0
Free of addr ffff0000f3d40000 by task swapper/2/0
[...]
Call trace:
[...]
kmem_cache_free_bulk+0x5b8/0xc18
mt_free_walk+0x138/0x3a0
rcu_core+0x5d0/0x1638
rcu_core_si+0x18/0x30
[...]
Allocated by task 1218:
[...]
kmem_cache_alloc_from_sheaf_noprof+0xa8/0x2f0
dst_setup+0x210/0x630
mas_wr_split+0x568/0x26e0
mas_wr_store_entry+0x98c/0x1de0
mas_insert.isra.0+0x3d0/0x5d8
mtree_insert_range+0xec/0x1c8
maple_fix_init+0x94/0xff8 [maple_fix_obj]
[...]
Freed by task 0:
[...]
__kasan_slab_free+0x88/0xb8
__rcu_free_sheaf_prepare+0x94/0x360
rcu_free_sheaf+0x30/0x138
rcu_core+0x5d0/0x1638
rcu_core_si+0x18/0x30
[...]
The buggy address belongs to the object at ffff0000f3d40000
which belongs to the cache maple_node of size 256
The buggy address is located 0 bytes inside of
256-byte region [ffff0000f3d40000, ffff0000f3d40100)
[...]
Memory state around the buggy address:
ffff0000f3d3ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff0000f3d3ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff0000f3d40000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff0000f3d40080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff0000f3d40100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
The second issue fixed in the first patch is in the mt_free_walk().
mt_free_walk() descends by checking if the corresponding slot[offset]
entry is non-zero. In a maple_range_64 node that has
MAPLE_RANGE64_SLOTS-1 valid pointers to child nodes, all slots will be
non-zero, since the last slot holds the metadata. Thus, mte_dead_walk()
dereferences the metadata as if it were a node and hits the
null-ptr-deref as shown in the splat below.
After fixing the first issue, the reproducer reaches this case at 3166
insertions. The affected node is the root on a tree with height 3 and it
has 15 valid child nodes on a 64-bit machine. The first fix does not
introduce this bug, but it exposes it for the root node because it no
longer clears the root metadata. On an unmodified kernel, the same bug
exists and is reachable when such a maple_range_64 node appears below
the root, where mt_clear_meta() is not called.
Second KASAN splat:
Unable to handle kernel paging request at virtual address dfff800000000006
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
[...]
Call trace:
mte_dead_walk+0x78/0x140 (P)
mt_free_walk+0x1f8/0x3a0
rcu_core+0x5d0/0x1638
rcu_core_si+0x18/0x30
[..]
Both splats are from an arm64 QEMU guest. The test_maple_tree and the
userspace suite pass after each patch in the series.
This patch (of 2):
This commit fixes two issues in maple_range_64 nodes under RCU mode. A
maple_range_64 node repurposes its last slot to hold metadata whenever
the node is not full. Both issues arise from mishandling that last slot.
More specifically the two fixes are:
1. Remove mt_clear_meta() function. mt_clear_meta() decides whether the
last slot of a maple_range_64 node holds a child pointer or a
struct maple_metadata with the check
if (unlikely((mte_to_node(next) &&
mte_node_type(next))))
return; /* no metadata, could be node */
The check expects the pointer to be encoded. But the only callsite
of mt_clear_meta() is mt_destroy_walk() on the RCU destroy path, and
by the time it runs, mte_dead_leaves() has overwritten every slot on
a full node with a raw pointer, stripping the type information. Thus,
the check above never returns early for a full node as it should. It
falls through and then:
meta->gap = 0;
meta->end = 0;
zeroes two bytes of a valid child pointer. Later, mt_free_walk()
dereferences the corrupted pointer.
Fix this by removing mt_clear_meta() along with its only callsite.
mt_clear_meta() is only called for the root of each sub-tree destroyed
under RCU. Descendant nodes retain their metadata until they are
freed. RCU readers may use the metadata while traversing a node, but
do not use cleared metadata to detect that a node has been removed.
They detect a dead node via ma_dead_node().
2. Fix invalid memory access in mt_free_walk(). mt_free_walk() descends
to the left-most unvisited "parent-of-a-leaf" node by checking the
condition:
if ((offset < mt_slots[type]) &&
rcu_dereference_protected(slots[offset],
lock_is_held(&rcu_callback_map)))
slots = mte_dead_walk(&enode, offset);
On a maple_range_64 node with MAPLE_RANGE64_SLOTS-1 children *all*
slots are non-NULL. The first MAPLE_RANGE64_SLOTS-1 hold valid
pointers to child nodes, and the last slot contains metadata. The
above check therefore passes for all offsets, and mte_dead_walk()
dereferences the metadata as if it were a node.
To trigger this, a node at least two levels above the leaves has to
have exactly MAPLE_RANGE64_SLOTS-1 valid pointers to other nodes.
maple_arange_64 nodes cannot hit this since they store the metadata
in a separate field.
Fix this by bounding the descent with slot_len which holds the number
of children of a dead node.
Link: https://lore.kernel.org/20261005-fix-maple-tree-range64-rcu-v3-0-ebe7fb278e20@cslab.ece.ntua.gr
Link: https://lore.kernel.org/20261005-fix-maple-tree-range64-rcu-v3-1-ebe7fb278e20@cslab.ece.ntua.gr
Fixes: 54a611b60590 ("Maple Tree: add new data structure")
Fixes: 2e5b4921f8ef ("maple_tree: fix freeing of nodes in rcu mode")
Signed-off-by: Dimitris Charisis <dchar@cslab.ece.ntua.gr>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Liam R. Howlett (Google) <liam@infradead.org>
Reviewed-by: Florian Schmaus <florian.schmaus@codasip.com>
Cc: Alice Ryhl <aliceryhl@google.com>
Cc: Andrew Ballance <andrewjballance@gmail.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
|
|
Userfaultfd often causes unexpected interactions within mm, and does so at
the intersection of uffd, mremap() and VMA merging.
When an mremap of a VMA occurs, copy_vma_and_data() calls
mremap_userfaultfd_prep() to notify uffd of this.
However, mremap_userfaultfd_prep() simply drops the UFFD context for the
VMA if the user did not register it for remap, i.e. didn't specify the
UFFD_FEATURE_EVENT_REMAP flag.
This is OK for the VMA itself, as upon page table move, move_ptes() clears
UFFD page table flags, using vma_has_uffd_without_event_remap() to
determine whether to do so.
However, this doesn't account for merging with adjacent VMAs, whose page
tables won't have received this treatment, and thus latent UFFD markers
will be left around.
Worse, it'll break UFFD for any VMAs it is merged with. This is very
surprising behaviour for a user, who will then simply not receive UFFD
events for VMAs they ought to.
Resolve the issue by explicitly checking for this case via
vma_has_uffd_without_event_remap() in vma_merge_copied_range(), the merge
function explicitly designated for mremap() operations.
Also update the userland VMA tests accordingly.
Link: https://lore.kernel.org/20261020-uffd-remap-fix-v1-1-0f34fc181f0a@kernel.org
Fixes: 3cfd22be0ad6 ("userfaultfd: clear flag if remap event not enabled")
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: shaos <shawnq1@163.com>
Closes: https://lore.kernel.org/all/20261020110748.959870-1-shawnq1@163.com/
Reviewed-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Reviewed-by: Gregory Price (Meta) <gourry@gourry.net>
Reviewed-by: Xueyuan Chen <xueyuan.chen21@gmail.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: <stable@vger.kernel.org>
|
|
posix_memalign() returns zero or a positive error number and never sets
errno, so the checks for a negative return in kmem_cache_alloc_lru() and
kmem_cache_alloc_bulk() is not possible. A failed aligned allocation
carries on with the pointer unset, into the constructor or the memset().
Test for any non-zero return.
Link: https://lore.kernel.org/20261020033128.1934349-1-liam@infradead.org
Fixes: 8801c35c3672 ("tools: fix -Wunused-result in linux.c")
Signed-off-by: Liam R. Howlett (Google) <liam@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Reviewed-by: Vishal Moola (Fractile) <vishal.moola@gmail.com>
Reviewed-by: SJ Park <sj@kernel.org>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
|
|
damos_quota->charge_{target,addr}_from saves the target and region the
scheme's quota limit is reached. damos_skip_charged_region() skips the
target and regions before the point. The target that was assigned to
charge_target_from could be dynamically removed from the context by the
runtime parameters update (aka commit) feature. In this case,
damos_skip_charged_region() cannot find if the point is passed or not,
so the scheme is effectively disabled.
Similarly, the user could also remove all the regions of the target
using the runtime parameters update feature. It would be uncommon to do
that, but it is a supported feature. Because the skip pointer detection
logic (damos_skip_charged_region()) works for each region of targets,
this result in the logic is entirely skipped and the scheme is
effectively disabled again.
The user impact is that the DAMOS scheme could suddenly stop working
under certain uses of the runtime parameters update feature. It could
surprise users. No crash or leak happens though. Users could also
simply work around by re-installing the scheme.
Catch the corner cases in damos_adjust_quota() and reset the pointers.
Link: https://lore.kernel.org/20261020023958.108276-1-sj@kernel.org
Fixes: da87878010e5 ("mm/damon/sysfs: support online inputs update")
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Closes: https://sashiko.dev/#/bug/linux-cd0c55fc-0cc8-45d8-9637-3334811c49b8
Cc: <stable@vger.kernel.org> # 5.19.x
|
|
shrinker_info_unit holds BITS_PER_LONG atomic_long_t of deferred work plus
a one-word bitmap, 520 bytes on 64-bit. kzalloc_node() takes it from
kmalloc-1k, so almost half of every unit is padding.
Allocate the units from a cache of their own, sized to the unit. The
cache is not cache-line aligned: the counters of a unit already share
cache lines between shrinkers, and aligning the unit would only keep
neighbouring units off each other's boundary line, at the cost of part of
the saving.
Link: https://lore.kernel.org/20261019-vstor-144715-shrinker_info_unit-kmem_cache-v3-1-0fb061e09bf4@virtuozzo.com
Signed-off-by: Konstantin Khorenko <khorenko@virtuozzo.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Suggested-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Harry Yoo (Meta) <harry@kernel.org>
Reviewed-by: Qi Zheng <qi.zheng@linux.dev>
Acked-by: Muchun Song <muchun.song@linux.dev>
Assisted-by: LLM
Cc: Dave Chinner <david@fromorbit.com>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
|
|
RISC-V THP splitting uses a temporary invalid PMD state where
pmd_mkinvalid() clears _PAGE_PRESENT and _PAGE_PROT_NONE but leaves
_PAGE_LEAF set so the MM code can still recognize the PMD as a THP split
in-progress entry.
That temporary state no longer describes a user-accessible mapping, but
page_table_check currently treats it as one because the RISC-V PMD
user-accessibility test only checks whether the PMD is a leaf and has user
permissions.
As a result, when a PMD-sized anonymous THP is split during a COW fault,
page_table_check can account the invalid intermediate PMD as a live PMD
mapping, and then account the replacement PTE mappings again when the
split installs the PTE table. This leaves stale PMD accounting behind and
later triggers page_table_check failures such as a non-zero anon_map_count
when the folio is freed.
Fix this by tightening pmd_user_accessible_page() so PMD page-table-check
accounting only considers leaf PMDs that still carry either _PAGE_PRESENT
or _PAGE_PROT_NONE. This preserves the THP split semantics required by
the MM code while preventing page_table_check from treating invalid split
PMDs as live user mappings.
With CONFIG_PAGE_TABLE_CHECK=y and CONFIG_PAGE_TABLE_CHECK_ENFORCED=y,
tools/testing/selftests/mm/cow completes successfully on RISC-V after this
change.
Link: https://lore.kernel.org/20260523042052.35476-1-cuiyunhui@bytedance.com
Fixes: 3fee229a8eb9 ("riscv/mm: enable ARCH_SUPPORTS_PAGE_TABLE_CHECK")
Signed-off-by: Yunhui Cui <cuiyunhui@bytedance.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Albert Ou <aou@eecs.berkeley.edu>
Cc: Palmer Dabbelt <palmer@dabbelt.com>
Cc: Pasha Tatashin <pasha.tatashin@soleen.com>
Cc: Paul Walmsley <paul.walmsley@sifive.com>
Cc: tongtiangen <tongtiangen@huawei.com>
Cc: Alexandre Ghiti <alex@ghiti.fr>
Cc: David Hildenbrand (Arm) <david@kernel.org>
Cc: Vivian Wang <wangruikang@iscas.ac.cn>
Cc: Yaxing Guo <guoyaxing@bosc.ac.cn>
Cc: <stable@vger.kernel.org>
|
|
When an address type DAMOS filter is configured, DAMOS tries to split the
region for the filter range, and apply DAMOS action to the filter-in
region. The split operation (damon_split_region_at()) could fail from
allocation failure under extreme memory pressure. In the case, DAMOS
action could be applied more or less than expected, ignoring the address
filter.
The issue only rarely happens under extreme memory pressure. No crash or
leak happens. Occasionally not applying the action to a few regions
shouldn't be a real problem. But applying the action to a region that the
user has excluded via address filter could be a surprise depending on the
use case. It is only theoretical. No such real case is found yet.
Filter out the entire region if the split is failed. Update
damos_filter_match() signature to receive the error from split. Also
update kunit tests for the updated signature.
The issue was discovered [1] by sashiko.
Link: https://lore.kernel.org/20261020004119.106690-1-sj@kernel.org
Link: https://lore.kernel.org/20260801203121.117449-1-sj@kernel.org [1]
Fixes: ab9bda001b68 ("mm/damon/core: introduce address range type damos filter")
Signed-off-by: SJ Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: <stable@vger.kernel.org> # 6.6.x
|
|
The PAGEMAP_SCAN ioctl takes mmap_read_lock() on an mm obtained from
/proc/<pid>/pagemap without holding a reference to mm_users.
proc_mem_open() deliberately grabs only mm_count, so a consumer that
touches the address space has to call mmget_not_zero() first. Every other
consumer in this file does -- m_start(), do_procmap_query(),
show_smaps_rollup() and pagemap_read() -- but do_pagemap_scan() does not.
Without that reference the target can reach exit_mmap() concurrently, and
exit_mmap() calls unmap_vmas() while holding mmap_lock only for reading,
which does not exclude the scanner. For ordinary VMAs this is harmless,
as free_pgtables() and remove_vma() run afterwards under mmap_write_lock.
A shared hugetlb VMA is different: __hugetlb_zap_end() frees the VMA's
hugetlb_vma_lock inside the read-locked phase.
walk_hugetlb_range() can therefore load vma->vm_private_data, have the
lock freed underneath it, and then down_read() a freed rw_semaphore. The
load happens before the freeing side clears the pointer, so this is a
use-after-free and not a NULL dereference. Any unprivileged user can
reach it with no huge pages configured, as hugetlb_reserve_pages()
allocates the lock before the VM_NORESERVE early return.
Pin mm_users across the scan, the way the other consumers do. mmput()
from the exiting task can then no longer reach exit_mmap() while a walk is
in progress.
[akpm@linux-foundation.org: remove unneeded & undesirable test for !mm]
Link: https://lore.kernel.org/20261014095540.3261469-1-ngocquy0700@gmail.com
Fixes: 52526ca7fdb9 ("fs/proc/task_mmu: implement IOCTL to get and optionally clear info about PTEs")
Signed-off-by: Ngoc Quy <ngocquy0700@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Assisted-by: Claude:claude-opus-5
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Muhammad Usama Anjum <usama.anjum@arm.com>
Cc: <stable@vger.kernel.org>
|
|
QEMU fails to start a guest with a VFIO device when guest RAM comes
from a memory backend bound to a movable-only node:
vfio_container_dma_map(0x55b1b1317800, 0x0, 0x10000000,
0x7f39a2200000)
= -12 (Cannot allocate memory)
VFIO pins guest RAM when the device is realized, and the pin faults
the pages in. io_uring fixed buffers fail the same way. Faulting the
range in before pinning lets the same pin succeed, since resident
pages are migrated off the node instead.
A long-term pin faults under memalloc_pin_save(). PF_MEMALLOC_PIN makes
current_gfp_context() clear __GFP_MOVABLE, but policy_nodemask() tests
apply_policy_zone() against the caller's gfp.
The bind keeps its movable-only nodemask, and the allocation finds no
usable zone:
page allocation failure:
order:0,
mode:0x140dc2(GFP_HIGHUSER|__GFP_ZERO|__GFP_COMP),
nodemask=1,cpuset=/,mems_allowed=0-1
Call Trace:
warn_alloc+0x136/0x150
__alloc_frozen_pages_noprof+0xed8/0x1720
alloc_pages_mpol+0xaa/0x170
vma_alloc_folio_noprof+0x65/0xd0
__handle_mm_fault+0x137b/0x1ac0
handle_mm_fault+0xa0/0x270
__get_user_pages+0x250/0xfd0
__gup_longterm_locked+0x116/0x870
gup_fast_fallback+0xcfc/0xdf0
pin_user_pages_fast+0x47/0x60
io_pin_pages+0x9a/0x110
Base page faults fail with -ENOMEM.
hugetlb faults fail with -EFAULT.
Check the policy zone against current_gfp_context(gfp), so a pin-scoped
fault falls back off the movable-only nodemask, like any other
non-movable allocation under the same bind.
Tested in qemu with a dax/kmem movable-only node 1. io_uring and VFIO
pins of unfaulted base pages and 2MB hugetlb pages now succeed and land
on node 0 (correct). QEMU now starts with the same backend binding.
Link: https://lore.kernel.org/20261018023349.1697434-1-gourry@gourry.net
Fixes: 8e3560d963d2 ("mm: honor PF_MEMALLOC_PIN for all movable pages")
Signed-off-by: Gregory Price (Meta) <gourry@gourry.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Zi Yan <ziy@nvidia.com>
Cc: Rakie Kim <rakie.kim@sk.com>
Cc: Ying Huang <ying.huang@linux.alibaba.com>
Cc: Pasha Tatashin <pasha.tatashin@soleen.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: <stable@vger.kernel.org>
|
|
user_proactive_reclaim() limits per-node reclaim to
gfp_zone(GFP_KERNEL), which is ZONE_NORMAL. Proactive reclaim serves no
allocation, but that limit makes shrink_node() skip every ZONE_MOVABLE
folio, so writing to /sys/devices/system/node/nodeN/reclaim never
reclaims a node's movable memory. A movable-only node, such as dax/kmem
or hotplugged memory onlined movable, reclaims nothing and fails with
-EAGAIN.
To reproduce, fill a movable-only node with clean page cache and write
200M to its nodeN/reclaim: the write fails with -EAGAIN and the page
cache stays. The same write to a ZONE_NORMAL node frees 200MB.
Scan every zone, as memory.reclaim does.
Link: https://lore.kernel.org/20261019185002.3428594-1-gourry@gourry.net
Fixes: b980077899ea ("mm: introduce per-node proactive reclaim interface")
Signed-off-by: Gregory Price (Meta) <gourry@gourry.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Barry Song <baohua@kernel.org>
Reviewed-by: Johannes Weiner <hannes@cmpxchg.org>
Reviewed-by: Harry Yoo (Meta) <harry@kernel.org>
Acked-by: Shakeel Butt <shakeel.butt@linux.dev>
Reviewed-by: Yosry Ahmed <yosry@kernel.org>
Reviewed-by: SJ Park <sj@kernel.org>
Reviewed-by: Balbir Singh <balbirs@nvidia.com>
Acked-by: Davidlohr Bueso <dave@stgolabs.net>
Acked-by: Michal Hocko <mhocko@suse.com>
Reviewed-by: Xueyuan Chen <xueyuan.chen21@gmail.com>
Acked-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Acked-by: Vishal Moola (Fractile) <vishal.moola@gmail.com>
Cc: Kairui Song <kasong@tencent.com>
Cc: Qi Zheng <qi.zheng@linux.dev>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Cc: Wei Xu <weixugc@google.com>
Cc: Baoquan He <baoquan.he@linux.dev>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: <stable@vger.kernel.org>
|
|
The mremap error path is a fragile and unwieldy beast - it reverses the
page table move then updates vma_remap_struct state to swap VMA, length and
address between old and new VMAs in copy_vma_and_data().
If the mremap() operation didn't specify MREMAP_DONTUNMAP then its caller,
move_vma(), invokes unmap_source_vma(), which unmaps the new VMA rather
than the old one.
For accountable VMAs when MREMAP_DONTUNMAP is not specified,
unmap_source_vma() unsets VMA_ACCOUNT_BIT during this unmap in order that
only the delta of a VMA expansion is charged (performed by
vrm_calc_charge() earlier).
Therefore nothing uncharges the expanded VMA size, and there is a permanent
leak in global Committed_AS.
Resolve the issue by uncharging when MREMAP_DONTUNMAP is not specified.
Link: https://lore.kernel.org/20261019-other-mremap-charge-leak-v1-1-d94477fe6545@kernel.org
Fixes: fdbef6149135 ("mm/mremap: don't account pages in vma_to_resize()")
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Brian Geffon <bgeffon@google.com>
Cc: Dmitry Safonov <0x7f454c46@gmail.com>
Cc: <stable@vger.kernel.org>
|
|
Commit d5c8aec0542e ("mm/mremap: initial refactor of move_vma()")
introduced the vma_remap_struct helper to pass state sanely through
mremap() logic.
Part of this state is vrm->delta - equal to the absolute difference between
vrm->old_len and vrm->new_len (the old and new lengths of the VMA,
respectively).
This value is used to correctly charge accounted VMAs.
When shrinking a VMA, mremap_to() sets vrm->old_len equal to vrm->new_len
having performed the shrink of the VMA first, prior to any potential move
(e.g. MREMAP_FIXED | MREMAP_MAYMOVE specified).
However it does not recalculate vrm->delta, which results in incorrectly
overcharging the VMA when both moving and shrinking a VMA.
The charge leaks to Committed_AS globally, meaning a mischievous user can
cause allocations to fail across the system in strict overcommit mode.
Resolve the issue by abstracting the update of vrm->delta to
vrm_populate_calculated() and invoking this from mremap_to() when
vrm->old_len is changed.
Additionally, update vrm->remap_type whose value depends on vrm->delta.
The field is not read again after the shrink, but it is the logically
correct thing to do and protects against future changes which break this.
Link: https://lore.kernel.org/20261019-mremap-fix-shrink-charge-v1-1-a3ce209e5360@kernel.org
Fixes: d5c8aec0542e ("mm/mremap: initial refactor of move_vma()")
Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Nickolai Zeldovich <nickolai@csail.mit.edu>
Closes: https://lore.kernel.org/all/20261017233527.797191-1-nickolai@csail.mit.edu/
Reviewed-by: Xueyuan Chen <xueyuan.chen21@gmail.com>
Reviewed-by: Pedro Falcato <pfalcato@suse.de>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: <stable@vger.kernel.org>
|
|
Split out files related to SPARSE and SPARSE_VMEMMAP management from
MEMORY MANAGEMENT - CORE into a dedicated entry.
Also include architecture specific sparsemem.h headers, pfn_to_page() and
page_to_pfn() conversions and Documentation/mm/memory-model.rst.
Muchun, who did a lot of work cleaning up SPARSE_VMEMMAP and extending
vmemmap optimization, volunteered to help with the maintenance.
David and I will continue to look after that part of the mm subsystem.
Link: https://lore.kernel.org/20261019-memmap-maint-v1-1-80850871d0cc@kernel.org
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Acked-by: Harry Yoo (Meta) <harry@kernel.org>
Acked-by: Muchun Song <muchun.song@linux.dev>
Acked-by: SJ Park <sj@kernel.org>
|
|
A write to /sys/class/bdi/<dev>/min_ratio (or min_ratio_fine or min_bytes)
that races with the removal of the device leaves the global sum of minimum
dirty shares charged for a bdi that no longer exists. Until the next
reboot, that share of the dirty threshold is withheld from every other bdi
(__wb_calc_thresh() scales by 100 % minus the sum), and a later min_ratio
store on any bdi that would push the sum to 100 % fails with EINVAL
although every bdi reads 0. Root privilege is needed for the store; the
removal is any del_gendisk() (a disk or loop device going away) or the
unmount of a filesystem with its own bdi. On an x86_64 defconfig kernel
(v7.3-rc7), 2000 rounds of LOOP_CTL_ADD/LOOP_CTL_REMOVE on one loop device
with a second thread writing 50 to its min_ratio leak the share on the
first round the store lands in the window; afterwards `echo 99 >
min_ratio` on another loop device fails with EINVAL. With the fix the
same run keeps the sum at 0 and the store succeeds. Affected since v5.16,
when the reset in bdi_unregister() was added.
bdi_unregister() gives the bdi's share back with bdi_set_min_ratio(bdi, 0)
and only then calls device_unregister(), which removes the sysfs
attributes. A min_ratio_store() that gets its kernfs active reference
before the removal runs to completion after the reset:
__bdi_set_min_ratio() takes bdi_lock, sees bdi->min_ratio == 0, adds the
new value to bdi_min_ratio and stores it in the bdi, which bdi_put() then
frees. Nothing gives that share back.
Move the reset after device_unregister(): once the attributes are gone no
store can run, and bdi_set_min_ratio() needs nothing from the device.
Found while formally verifying bdi_unregister() against the kernel binary.
Link: https://lore.kernel.org/20261017030620.793108-1-nickolai@csail.mit.edu
Fixes: 3c376dfafbf7 ("mm: bdi: initialize bdi_min_ratio when bdi is unregistered")
Signed-off-by: Nickolai Zeldovich <nickolai@csail.mit.edu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Jan Kara <jack@suse.cz>
Assisted-by: LLM
Cc: David Hildenbrand <david@kernel.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Manjong Lee <mj0123.lee@samsung.com>
|
|
A PTE-mapped large folio can straddle PMD boundaries after an unaligned
mremap(). If the first part is discarded and replaced with an unrelated
huge PMD, page_vma_mapped_walk() stops instead of looking for the rest of
the folio in subsequent PMDs.
This also affects migration entries. A walk that stops at an unrelated
huge PMD can leave migration PTEs behind when migration or an anonymous
folio split restores the mappings. Those entries do not hold mapping
references and can outlive the source folio.
This issue can lead to memory corruption and I have a reproducer for
it.
Skip the current PMD rather than ending the walk on a flag or PFN
mismatch. Do the same if the PMD became nonpresent before the locked
recheck. Release the PMD lock, clear the per-PMD state and advance with
step_forward(), so the existing range limit controls termination. This
covers present, migration and device-private huge PMDs while preserving
the matching-PMD and split-to-PTE paths.
Link: https://lore.kernel.org/20261016011549.61146-1-kylebot@openai.com
Fixes: ace71a19cec5 ("mm: introduce page_vma_mapped_walk()")
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Assisted-by: LLM
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Rik van Riel <riel@surriel.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Harry Yoo <harry@kernel.org>
Cc: Jann Horn <jannh@google.com>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: <stable@vger.kernel.org>
|
|
With -cgroup-v2, charge_reserved_hugetlb.sh and
hugetlb_reparenting_test.sh mount a cgroup2 hierarchy on a temporary
directory when none is mounted and enable the hugetlb controller
(hugetlb_reparenting_test.sh also enables memory) in its
cgroup.subtree_control.
On a system that still binds these controllers to cgroup v1, they are not
available in the new hierarchy. Writing to cgroup.subtree_control fails
with ENOENT, "set -e" aborts the script, the test is reported as failed,
and the temporary cgroup2 mount is left behind.
Check cgroup.controllers first, and skip the test when a controller is
missing, after unmounting the hierarchy and removing the directory the
script created.
With hugetlb and memory bound to cgroup v1, per script:
before after
result fail skip
cgroup2 mounts left behind 1 0
Link: https://lore.kernel.org/20261016-bug-selftests-mm-hugetlb-cgroup2-skip-v1-1-7c78883a67b4@gmail.com
Fixes: 29750f71a9b4 ("hugetlb_cgroup: add hugetlb_cgroup reservation tests")
Signed-off-by: Qiliang Yuan <odys.yuan@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Joshua Hahn <joshua.hahnjy@gmail.com>
Cc: David Hildenbrand <david@kernel.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Mina Almasry <almasrymina@google.com>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Oscar Salvador <osalvador@suse.de>
|
