)]}' { "log": [ { "commit": "80e54e84911a923c40d7bee33a34c1b4be148d7a", "tree": "94d426312dfa20b7d0a1bca91c1d8cea479cd9b1", "parents": [ "9712d38c87087ae34f8cede6583092c272507c52" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 09 13:45:25 2025 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 09 13:45:25 2025 -1000" }, "message": "Linux 6.14-rc6\n" }, { "commit": "9712d38c87087ae34f8cede6583092c272507c52", "tree": "03d647b1b42d8eda03d034ab1104af734beb29e0", "parents": [ "0dc1f314f854257eb64dcea604a42a55225453a9", "b5e3956535466187657563b754ba0f1da8626c7f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 09 09:23:14 2025 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 09 09:23:14 2025 -1000" }, "message": "Merge tag \u0027kbuild-fixes-v6.14-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild\n\nPull Kbuild fixes from Masahiro Yamada:\n\n - Use the specified $(LD) when building userprogs with Clang\n\n - Pass the correct target triple when compile-testing UAPI headers\n with Clang\n\n - Fix pacman-pkg build error with KBUILD_OUTPUT\n\n* tag \u0027kbuild-fixes-v6.14-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild:\n kbuild: install-extmod-build: Fix build when specifying KBUILD_OUTPUT\n docs: Kconfig: fix defconfig description\n kbuild: hdrcheck: fix cross build with clang\n kbuild: userprogs: use correct lld when linking through clang\n" }, { "commit": "0dc1f314f854257eb64dcea604a42a55225453a9", "tree": "5eda7f323aa19e0432f557f8c62e2221a6e726a1", "parents": [ "51b38f3c5fe23deb24e6e9bf98a105095c1fd147", "b13abcb7ddd8d38de769486db5bd917537b32ab1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 09 09:14:07 2025 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 09 09:14:07 2025 -1000" }, "message": "Merge tag \u0027usb-6.14-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb\n\nPull USB fixes from Greg KH:\n \"Here are some small USB driver fixes for some reported issues. These\n contain:\n\n - typec driver fixes\n\n - dwc3 driver fixes\n\n - xhci driver fixes\n\n - renesas controller fixes\n\n - gadget driver fixes\n\n - a new USB quirk added\n\n All of these have been in linux-next with no reported issues\"\n\n* tag \u0027usb-6.14-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:\n usb: typec: ucsi: Fix NULL pointer access\n usb: quirks: Add DELAY_INIT and NO_LPM for Prolific Mass Storage Card Reader\n usb: xhci: Fix host controllers \"dying\" after suspend and resume\n usb: dwc3: Set SUSPENDENABLE soon after phy init\n usb: hub: lack of clearing xHC resources\n usb: renesas_usbhs: Flush the notify_hotplug_work\n usb: renesas_usbhs: Use devm_usb_get_phy()\n usb: renesas_usbhs: Call clk_put()\n usb: dwc3: gadget: Prevent irq storm when TH re-executes\n usb: gadget: Check bmAttributes only if configuration is valid\n xhci: Restrict USB4 tunnel detection for USB3 devices to Intel hosts\n usb: xhci: Enable the TRB overfetch quirk on VIA VL805\n usb: gadget: Fix setting self-powered state on suspend\n usb: typec: ucsi: increase timeout for PPM reset operations\n acpi: typec: ucsi: Introduce a -\u003epoll_cci method\n usb: typec: tcpci_rt1711h: Unmask alert interrupts to fix functionality\n usb: gadget: Set self-powered based on MaxPower and bmAttributes\n usb: gadget: u_ether: Set is_suspend flag if remote wakeup fails\n usb: atm: cxacru: fix a flaw in existing endpoint checks\n" }, { "commit": "51b38f3c5fe23deb24e6e9bf98a105095c1fd147", "tree": "88cab41b5ceef14fdefe0c247612b46cc0ce1a92", "parents": [ "2cc699b3c2fe5ea84081059c88c46373cbebe630", "78eb41f518f414378643ab022241df2a9dcd008b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 09 09:11:42 2025 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 09 09:11:42 2025 -1000" }, "message": "Merge tag \u0027driver-core-6.14-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core\n\nPull driver core fix from Greg KH:\n \"Here is a single driver core fix that resolves a reported memory leak.\n\n It\u0027s been in linux-next for 2 weeks now with no reported problems\"\n\n* tag \u0027driver-core-6.14-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:\n drivers: core: fix device leak in __fw_devlink_relax_cycles()\n" }, { "commit": "2cc699b3c2fe5ea84081059c88c46373cbebe630", "tree": "110a06f5e6b37d5612eda9ba56a7bf6e85c46c9e", "parents": [ "a382b06d297e78ed7ac67afd0d8e8690406ac4ca", "2397d61ee45cddb8f3bd3a3a9840ef0f0b5aa843" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 09 09:07:54 2025 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 09 09:07:54 2025 -1000" }, "message": "Merge tag \u0027char-misc-6.14-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc\n\nPull char/misc/IIO driver fixes from Greg KH:\n \"Here are a number of misc and char and iio driver fixes that have been\n sitting in my tree for way too long. They contain:\n\n - iio driver fixes for reported issues\n\n - regression fix for rtsx_usb card reader\n\n - mei and mhi driver fixes\n\n - small virt driver fixes\n\n - ntsync permissions fix\n\n - other tiny driver fixes for reported problems.\n\n All of these have been in linux-next for quite a while with no\n reported issues\"\n\n* tag \u0027char-misc-6.14-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (30 commits)\n Revert \"drivers/card_reader/rtsx_usb: Restore interrupt based detection\"\n ntsync: Check wait count based on byte size.\n bus: simple-pm-bus: fix forced runtime PM use\n char: misc: deallocate static minor in error path\n eeprom: digsy_mtc: Make GPIO lookup table match the device\n drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl\n binderfs: fix use-after-free in binder_devices\n slimbus: messaging: Free transaction ID in delayed interrupt scenario\n vbox: add HAS_IOPORT dependency\n cdx: Fix possible UAF error in driver_override_show()\n intel_th: pci: Add Panther Lake-P/U support\n intel_th: pci: Add Panther Lake-H support\n intel_th: pci: Add Arrow Lake support\n intel_th: msu: Fix less trivial kernel-doc warnings\n intel_th: msu: Fix kernel-doc warnings\n MAINTAINERS: change maintainer for FSI\n ntsync: Set the permissions to be 0666\n bus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid deadlock\n mei: vsc: Use \"wakeuphostint\" when getting the host wakeup GPIO\n mei: me: add panther lake P DID\n ...\n" }, { "commit": "a382b06d297e78ed7ac67afd0d8e8690406ac4ca", "tree": "5a9db965c84c2a24a8898b3d2565f80aa4d4e05f", "parents": [ "1110ce6a1e34fe1fdc1bfe4ad52405f327d5083b", "ea9bd29a9c0d757b3384ae3e633e6bbaddf00725" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 09 09:04:08 2025 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Mar 09 09:04:08 2025 -1000" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm\n\nPull KVM fixes from Paolo Bonzini:\n \"arm64:\n\n - Fix a couple of bugs affecting pKVM\u0027s PSCI relay implementation\n when running in the hVHE mode, resulting in the host being entered\n with the MMU in an unknown state, and EL2 being in the wrong mode\n\n x86:\n\n - Set RFLAGS.IF in C code on SVM to get VMRUN out of the STI shadow\n\n - Ensure DEBUGCTL is context switched on AMD to avoid running the\n guest with the host\u0027s value, which can lead to unexpected bus lock\n #DBs\n\n - Suppress DEBUGCTL.BTF on AMD (to match Intel), as KVM doesn\u0027t\n properly emulate BTF. KVM\u0027s lack of context switching has meant BTF\n has always been broken to some extent\n\n - Always save DR masks for SNP vCPUs if DebugSwap is *supported*, as\n the guest can enable DebugSwap without KVM\u0027s knowledge\n\n - Fix a bug in mmu_stress_tests where a vCPU could finish the \"writes\n to RO memory\" phase without actually generating a write-protection\n fault\n\n - Fix a printf() goof in the SEV smoke test that causes build\n failures with -Werror\n\n - Explicitly zero EAX and EBX in CPUID.0x8000_0022 output when\n PERFMON_V2 isn\u0027t supported by KVM\"\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm:\n KVM: x86: Explicitly zero EAX and EBX when PERFMON_V2 isn\u0027t supported by KVM\n KVM: selftests: Fix printf() format goof in SEV smoke test\n KVM: selftests: Ensure all vCPUs hit -EFAULT during initial RO stage\n KVM: SVM: Don\u0027t rely on DebugSwap to restore host DR0..DR3\n KVM: SVM: Save host DR masks on CPUs with DebugSwap\n KVM: arm64: Initialize SCTLR_EL1 in __kvm_hyp_init_cpu()\n KVM: arm64: Initialize HCR_EL2.E2H early\n KVM: x86: Snapshot the host\u0027s DEBUGCTL after disabling IRQs\n KVM: SVM: Manually context switch DEBUGCTL if LBR virtualization is disabled\n KVM: x86: Snapshot the host\u0027s DEBUGCTL in common x86\n KVM: SVM: Suppress DEBUGCTL.BTF on AMD\n KVM: SVM: Drop DEBUGCTL[5:2] from guest\u0027s effective value\n KVM: selftests: Assert that STI blocking isn\u0027t set after event injection\n KVM: SVM: Set RFLAGS.IF\u003d1 in C code, to get VMRUN out of the STI shadow\n" }, { "commit": "ea9bd29a9c0d757b3384ae3e633e6bbaddf00725", "tree": "4f5b2ff21063a2f88034f054bbbfb7dbc4b00c9a", "parents": [ "1cdad678154c627937bbbde28386c58a1fb07536", "f9dc8fb3afc968042bdaf4b6e445a9272071c9f3" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sun Mar 09 03:44:06 2025 -0400" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sun Mar 09 03:44:06 2025 -0400" }, "message": "Merge tag \u0027kvm-x86-fixes-6.14-rcN.2\u0027 of https://github.com/kvm-x86/linux into HEAD\n\nKVM x86 fixes for 6.14-rcN #2\n\n - Set RFLAGS.IF in C code on SVM to get VMRUN out of the STI shadow.\n\n - Ensure DEBUGCTL is context switched on AMD to avoid running the guest with\n the host\u0027s value, which can lead to unexpected bus lock #DBs.\n\n - Suppress DEBUGCTL.BTF on AMD (to match Intel), as KVM doesn\u0027t properly\n emulate BTF. KVM\u0027s lack of context switching has meant BTF has always been\n broken to some extent.\n\n - Always save DR masks for SNP vCPUs if DebugSwap is *supported*, as the guest\n can enable DebugSwap without KVM\u0027s knowledge.\n\n - Fix a bug in mmu_stress_tests where a vCPU could finish the \"writes to RO\n memory\" phase without actually generating a write-protection fault.\n\n - Fix a printf() goof in the SEV smoke test that causes build failures with\n -Werror.\n\n - Explicitly zero EAX and EBX in CPUID.0x8000_0022 output when PERFMON_V2\n isn\u0027t supported by KVM.\n" }, { "commit": "1cdad678154c627937bbbde28386c58a1fb07536", "tree": "d0751d45f707537ae14a95adc55b087aad8764c5", "parents": [ "916b7f42b3b3b539a71c204a9b49fdc4ca92cd82", "3855a7b91d42ebf3513b7ccffc44807274978b3d" ], "author": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sun Mar 09 03:43:56 2025 -0400" }, "committer": { "name": "Paolo Bonzini", "email": "pbonzini@redhat.com", "time": "Sun Mar 09 03:43:56 2025 -0400" }, "message": "Merge tag \u0027kvmarm-fixes-6.14-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD\n\nKVM/arm64 fixes for 6.14, take #4\n\n- Fix a couple of bugs affecting pKVM\u0027s PSCI relay implementation\n when running in the hVHE mode, resulting in the host being entered\n with the MMU in an unknown state, and EL2 being in the wrong mode.\n" }, { "commit": "1110ce6a1e34fe1fdc1bfe4ad52405f327d5083b", "tree": "9afab8e46955f1844aeb2cbaa75491e6c582b115", "parents": [ "b7c90e3e717abff6fe06445b98be306b732bbd2b", "8fe9ed44dc29fba0786b7e956d2e87179e407582" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 08 14:34:06 2025 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 08 14:34:06 2025 -1000" }, "message": "Merge tag \u0027mm-hotfixes-stable-2025-03-08-16-27\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm\n\nPull misc fixes from Andrew Morton:\n \"33 hotfixes. 24 are cc:stable and the remainder address post-6.13\n issues or aren\u0027t considered necessary for -stable kernels.\n\n 26 are for MM and 7 are for non-MM.\n\n - \"mm: memory_failure: unmap poisoned folio during migrate properly\"\n from Ma Wupeng fixes a couple of two year old bugs involving the\n migration of hwpoisoned folios.\n\n - \"selftests/damon: three fixes for false results\" from SeongJae Park\n fixes three one year old bugs in the SAMON selftest code.\n\n The remainder are singletons and doubletons. Please see the individual\n changelogs for details\"\n\n* tag \u0027mm-hotfixes-stable-2025-03-08-16-27\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (33 commits)\n mm/page_alloc: fix uninitialized variable\n rapidio: add check for rio_add_net() in rio_scan_alloc_net()\n rapidio: fix an API misues when rio_add_net() fails\n MAINTAINERS: .mailmap: update Sumit Garg\u0027s email address\n Revert \"mm/page_alloc.c: don\u0027t show protection in zone\u0027s -\u003elowmem_reserve[] for empty zone\"\n mm: fix finish_fault() handling for large folios\n mm: don\u0027t skip arch_sync_kernel_mappings() in error paths\n mm: shmem: remove unnecessary warning in shmem_writepage()\n userfaultfd: fix PTE unmapping stack-allocated PTE copies\n userfaultfd: do not block on locking a large folio with raised refcount\n mm: zswap: use ATOMIC_LONG_INIT to initialize zswap_stored_pages\n mm: shmem: fix potential data corruption during shmem swapin\n mm: fix kernel BUG when userfaultfd_move encounters swapcache\n selftests/damon/damon_nr_regions: sort collected regiosn before checking with min/max boundaries\n selftests/damon/damon_nr_regions: set ops update for merge results check to 100ms\n selftests/damon/damos_quota: make real expectation of quota exceeds\n include/linux/log2.h: mark is_power_of_2() with __always_inline\n NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback\n mm, swap: avoid BUG_ON in relocate_cluster()\n mm: swap: use correct step in loop to wait all clusters in wait_for_allocation()\n ...\n" }, { "commit": "b7c90e3e717abff6fe06445b98be306b732bbd2b", "tree": "4396c6a47c89d7f4329b30baee420169c23a0f87", "parents": [ "2e51e0ac575c2095da869ea62d406f617550e6ed", "058a6bec37c6c3b826158f6d26b75de43816a880" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 08 09:29:54 2025 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 08 09:29:54 2025 -1000" }, "message": "Merge tag \u0027x86-urgent-2025-03-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull more x86 fixes from Ingo Molnar:\n\n - Add more model IDs to the AMD microcode version check, more people\n are hitting these checks\n\n - Fix a Xen guest boot warning related to AMD northbridge setup\n\n - Fix SEV guest bugs related to a recent changes in its locking logic\n\n - Fix a missing definition of PTRS_PER_PMD that assembly builds can hit\n\n* tag \u0027x86-urgent-2025-03-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/microcode/AMD: Add some forgotten models to the SHA check\n x86/mm: Define PTRS_PER_PMD for assembly code too\n virt: sev-guest: Move SNP Guest Request data pages handling under snp_cmd_mutex\n virt: sev-guest: Allocate request data dynamically\n x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range()\n" }, { "commit": "058a6bec37c6c3b826158f6d26b75de43816a880", "tree": "5dea5868dec2ddccaa29bbd86859fed30d9f7c66", "parents": [ "14296d0e85d45695ad2dc65b653b29e5a3514cdb" ], "author": { "name": "Borislav Petkov (AMD)", "email": "bp@alien8.de", "time": "Fri Mar 07 23:02:56 2025 +0100" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Sat Mar 08 20:09:37 2025 +0100" }, "message": "x86/microcode/AMD: Add some forgotten models to the SHA check\n\nAdd some more forgotten models to the SHA check.\n\nFixes: 50cef76d5cb0 (\"x86/microcode/AMD: Load only SHA256-checksummed patches\")\nReported-by: Toralf Förster \u003ctoralf.foerster@gmx.de\u003e\nSigned-off-by: Borislav Petkov (AMD) \u003cbp@alien8.de\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nTested-by: Toralf Förster \u003ctoralf.foerster@gmx.de\u003e\nLink: https://lore.kernel.org/r/20250307220256.11816-1-bp@kernel.org\n" }, { "commit": "14296d0e85d45695ad2dc65b653b29e5a3514cdb", "tree": "c5d875755a94e8fa9d671d0cdd6f1e4755318698", "parents": [ "6914f7e2e25fac9d1d2b62c208eaa5f2bf810fe9", "21e4543a2e2f8538373d1d19264c4bae6f13e798" ], "author": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Sat Mar 08 20:09:27 2025 +0100" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Sat Mar 08 20:09:27 2025 +0100" }, "message": "Merge branch \u0027linus\u0027 into x86/urgent, to pick up dependent patches\n\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\n" }, { "commit": "2e51e0ac575c2095da869ea62d406f617550e6ed", "tree": "d368f07a54eede7200350b64381098c40484d362", "parents": [ "2a520073e74fbb956b5564818fc5529dcc7e9f0e", "6bdbb73dc8d99fbb77f5db79dbb6f108708090b4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 08 07:21:41 2025 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Mar 08 07:21:41 2025 -1000" }, "message": "Merge tag \u0027loongarch-fixes-6.14-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson\n\nPull LoongArch fixes from Huacai Chen:\n \"Fix bugs in kernel build, hibernation, memory management and KVM\"\n\n* tag \u0027loongarch-fixes-6.14-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson:\n LoongArch: KVM: Fix GPA size issue about VM\n LoongArch: KVM: Reload guest CSR registers after sleep\n LoongArch: KVM: Add interrupt checking for AVEC\n LoongArch: Set hugetlb mmap base address aligned with pmd size\n LoongArch: Set max_pfn with the PFN of the last page\n LoongArch: Use polling play_dead() when resuming from hibernation\n LoongArch: Eliminate superfluous get_numa_distances_cnt()\n LoongArch: Convert unreachable() to BUG()\n" }, { "commit": "6bdbb73dc8d99fbb77f5db79dbb6f108708090b4", "tree": "07a647eca7e45a5a83bf602c502173eadde450a9", "parents": [ "78d7bc5a02e1468df53896df354fa80727f35b7d" ], "author": { "name": "Bibo Mao", "email": "maobibo@loongson.cn", "time": "Sat Mar 08 13:52:04 2025 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Sat Mar 08 13:52:04 2025 +0800" }, "message": "LoongArch: KVM: Fix GPA size issue about VM\n\nPhysical address space is 48 bit on Loongson-3A5000 physical machine,\nhowever it is 47 bit for VM on Loongson-3A5000 system. Size of physical\naddress space of VM is the same with the size of virtual user space (a\nhalf) of physical machine.\n\nVariable cpu_vabits represents user address space, kernel address space\nis not included (user space and kernel space are both a half of total).\nHere cpu_vabits, rather than cpu_vabits - 1, is to represent the size of\nguest physical address space.\n\nAlso there is strict checking about page fault GPA address, inject error\nif it is larger than maximum GPA address of VM.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Bibo Mao \u003cmaobibo@loongson.cn\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "78d7bc5a02e1468df53896df354fa80727f35b7d", "tree": "1a2cd5fed570b8c5cd643a46b5c3d6d86ac49477", "parents": [ "6fb1867d5a44b0a061cf39d2492d23d314bcb8ce" ], "author": { "name": "Bibo Mao", "email": "maobibo@loongson.cn", "time": "Sat Mar 08 13:52:01 2025 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Sat Mar 08 13:52:01 2025 +0800" }, "message": "LoongArch: KVM: Reload guest CSR registers after sleep\n\nOn host, the HW guest CSR registers are lost after suspend and resume\noperation. Since last_vcpu of boot CPU still records latest vCPU pointer\nso that the guest CSR register skips to reload when boot CPU resumes and\nvCPU is scheduled.\n\nHere last_vcpu is cleared so that guest CSR registers will reload from\nscheduled vCPU context after suspend and resume.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Bibo Mao \u003cmaobibo@loongson.cn\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "6fb1867d5a44b0a061cf39d2492d23d314bcb8ce", "tree": "bc12e46a6e123b62d8252503042a18c485418a13", "parents": [ "3109d5ff484b7bc7b955f166974c6776d91f247b" ], "author": { "name": "Bibo Mao", "email": "maobibo@loongson.cn", "time": "Sat Mar 08 13:51:59 2025 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Sat Mar 08 13:51:59 2025 +0800" }, "message": "LoongArch: KVM: Add interrupt checking for AVEC\n\nThere is a newly added macro INT_AVEC with CSR ESTAT register, which is\nbit 14 used for LoongArch AVEC support. AVEC interrupt status bit 14 is\nsupported with macro CSR_ESTAT_IS, so here replace the hard-coded value\n0x1fff with macro CSR_ESTAT_IS so that the AVEC interrupt status is also\nsupported by KVM.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Bibo Mao \u003cmaobibo@loongson.cn\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "3109d5ff484b7bc7b955f166974c6776d91f247b", "tree": "ce6f789801fde6fae9e1ce31678e1aefc5bb174f", "parents": [ "c8477bb0a8e7f6b2e47952b403c5cb67a6929e55" ], "author": { "name": "Bibo Mao", "email": "maobibo@loongson.cn", "time": "Sat Mar 08 13:51:32 2025 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Sat Mar 08 13:51:32 2025 +0800" }, "message": "LoongArch: Set hugetlb mmap base address aligned with pmd size\n\nWith ltp test case \"testcases/bin/hugefork02\", there is a dmesg error\nreport message such as:\n\n kernel BUG at mm/hugetlb.c:5550!\n Oops - BUG[#1]:\n CPU: 0 UID: 0 PID: 1517 Comm: hugefork02 Not tainted 6.14.0-rc2+ #241\n Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 2/2/2022\n pc 90000000004eaf1c ra 9000000000485538 tp 900000010edbc000 sp 900000010edbf940\n a0 900000010edbfb00 a1 9000000108d20280 a2 00007fffe9474000 a3 00007ffff3474000\n a4 0000000000000000 a5 0000000000000003 a6 00000000003cadd3 a7 0000000000000000\n t0 0000000001ffffff t1 0000000001474000 t2 900000010ecd7900 t3 00007fffe9474000\n t4 00007fffe9474000 t5 0000000000000040 t6 900000010edbfb00 t7 0000000000000001\n t8 0000000000000005 u0 90000000004849d0 s9 900000010edbfa00 s0 9000000108d20280\n s1 00007fffe9474000 s2 0000000002000000 s3 9000000108d20280 s4 9000000002b38b10\n s5 900000010edbfb00 s6 00007ffff3474000 s7 0000000000000406 s8 900000010edbfa08\n ra: 9000000000485538 unmap_vmas+0x130/0x218\n ERA: 90000000004eaf1c __unmap_hugepage_range+0x6f4/0x7d0\n PRMD: 00000004 (PPLV0 +PIE -PWE)\n EUEN: 00000007 (+FPE +SXE +ASXE -BTE)\n ECFG: 00071c1d (LIE\u003d0,2-4,10-12 VS\u003d7)\n ESTAT: 000c0000 [BRK] (IS\u003d ECode\u003d12 EsubCode\u003d0)\n PRID: 0014c010 (Loongson-64bit, Loongson-3A5000)\n Process hugefork02 (pid: 1517, threadinfo\u003d00000000a670eaf4, task\u003d000000007a95fc64)\n Call Trace:\n [\u003c90000000004eaf1c\u003e] __unmap_hugepage_range+0x6f4/0x7d0\n [\u003c9000000000485534\u003e] unmap_vmas+0x12c/0x218\n [\u003c9000000000494068\u003e] exit_mmap+0xe0/0x308\n [\u003c900000000025fdc4\u003e] mmput+0x74/0x180\n [\u003c900000000026a284\u003e] do_exit+0x294/0x898\n [\u003c900000000026aa30\u003e] do_group_exit+0x30/0x98\n [\u003c900000000027bed4\u003e] get_signal+0x83c/0x868\n [\u003c90000000002457b4\u003e] arch_do_signal_or_restart+0x54/0xfa0\n [\u003c90000000015795e8\u003e] irqentry_exit_to_user_mode+0xb8/0x138\n [\u003c90000000002572d0\u003e] tlb_do_page_fault_1+0x114/0x1b4\n\nThe problem is that base address allocated from hugetlbfs is not aligned\nwith pmd size. Here add a checking for hugetlbfs and align base address\nwith pmd size. After this patch the test case \"testcases/bin/hugefork02\"\npasses to run.\n\nThis is similar to the commit 7f24cbc9c4d42db8a3c8484d1 (\"mm/mmap: teach\ngeneric_get_unmapped_area{_topdown} to handle hugetlb mappings\").\n\nCc: stable@vger.kernel.org # 6.13+\nSigned-off-by: Bibo Mao \u003cmaobibo@loongson.cn\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "c8477bb0a8e7f6b2e47952b403c5cb67a6929e55", "tree": "03b00f912877809abaea8ff3f936cd5eee202060", "parents": [ "c9117434c8f7523f0b77db4c5766f5011cc94677" ], "author": { "name": "Bibo Mao", "email": "maobibo@loongson.cn", "time": "Sat Mar 08 13:51:32 2025 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Sat Mar 08 13:51:32 2025 +0800" }, "message": "LoongArch: Set max_pfn with the PFN of the last page\n\nThe current max_pfn equals to zero. In this case, it causes user cannot\nget some page information through /proc filesystem such as kpagecount.\nThe following message is displayed by stress-ng test suite with command\n\"stress-ng --verbose --physpage 1 -t 1\".\n\n # stress-ng --verbose --physpage 1 -t 1\n stress-ng: error: [1691] physpage: cannot read page count for address 0x134ac000 in /proc/kpagecount, errno\u003d22 (Invalid argument)\n stress-ng: error: [1691] physpage: cannot read page count for address 0x7ffff207c3a8 in /proc/kpagecount, errno\u003d22 (Invalid argument)\n stress-ng: error: [1691] physpage: cannot read page count for address 0x134b0000 in /proc/kpagecount, errno\u003d22 (Invalid argument)\n ...\n\nAfter applying this patch, the kernel can pass the test.\n\n # stress-ng --verbose --physpage 1 -t 1\n stress-ng: debug: [1701] physpage: [1701] started (instance 0 on CPU 3)\n stress-ng: debug: [1701] physpage: [1701] exited (instance 0 on CPU 3)\n stress-ng: debug: [1700] physpage: [1701] terminated (success)\n\nCc: stable@vger.kernel.org # 6.8+\nFixes: ff6c3d81f2e8 (\"NUMA: optimize detection of memory with no node id assigned by firmware\")\nSigned-off-by: Bibo Mao \u003cmaobibo@loongson.cn\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "c9117434c8f7523f0b77db4c5766f5011cc94677", "tree": "a219acf341a09626a293f79e2b5bd4fb28e50aaa", "parents": [ "a0d3c8bcb9206ac207c7ad3182027c6b0a1319bb" ], "author": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Sat Mar 08 13:51:32 2025 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Sat Mar 08 13:51:32 2025 +0800" }, "message": "LoongArch: Use polling play_dead() when resuming from hibernation\n\nWhen CONFIG_RANDOM_KMALLOC_CACHES or other randomization infrastructrue\nenabled, the idle_task\u0027s stack may different between the booting kernel\nand target kernel. So when resuming from hibernation, an ACTION_BOOT_CPU\nIPI wakeup the idle instruction in arch_cpu_idle_dead() and jump to the\ninterrupt handler. But since the stack pointer is changed, the interrupt\nhandler cannot restore correct context.\n\nSo rename the current arch_cpu_idle_dead() to idle_play_dead(), make it\nas the default version of play_dead(), and the new arch_cpu_idle_dead()\ncall play_dead() directly. For hibernation, implement an arch-specific\nhibernate_resume_nonboot_cpu_disable() to use the polling version (idle\ninstruction is replace by nop, and irq is disabled) of play_dead(), i.e.\npoll_play_dead(), to avoid IPI handler corrupting the idle_task\u0027s stack\nwhen resuming from hibernation.\n\nThis solution is a little similar to commit 406f992e4a372dafbe3c (\"x86 /\nhibernate: Use hlt_play_dead() when resuming from hibernation\").\n\nCc: stable@vger.kernel.org\nTested-by: Erpeng Xu \u003cxuerpeng@uniontech.com\u003e\nTested-by: Yuli Wang \u003cwangyuli@uniontech.com\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "a0d3c8bcb9206ac207c7ad3182027c6b0a1319bb", "tree": "562deb27f47cf29d587fab72b0d7962021139808", "parents": [ "da64a2359092ceec4f9dea5b329d0aef20104217" ], "author": { "name": "Yuli Wang", "email": "wangyuli@uniontech.com", "time": "Sat Mar 08 13:51:32 2025 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Sat Mar 08 13:51:32 2025 +0800" }, "message": "LoongArch: Eliminate superfluous get_numa_distances_cnt()\n\nIn LoongArch, get_numa_distances_cnt() isn\u0027t in use, resulting in a\ncompiler warning.\n\nFix follow errors with clang-18 when W\u003d1e:\n\narch/loongarch/kernel/acpi.c:259:28: error: unused function \u0027get_numa_distances_cnt\u0027 [-Werror,-Wunused-function]\n 259 | static inline unsigned int get_numa_distances_cnt(struct acpi_table_slit *slit)\n | ^~~~~~~~~~~~~~~~~~~~~~\n1 error generated.\n\nLink: https://lore.kernel.org/all/Z7bHPVUH4lAezk0E@kernel.org/\nSigned-off-by: Yuli Wang \u003cwangyuli@uniontech.com\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "da64a2359092ceec4f9dea5b329d0aef20104217", "tree": "0609cb77e488b29d159c6603daa5d747672bcdc1", "parents": [ "7eb172143d5508b4da468ed59ee857c6e5e01da6" ], "author": { "name": "Tiezhu Yang", "email": "yangtiezhu@loongson.cn", "time": "Sat Mar 08 13:50:45 2025 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Sat Mar 08 13:50:45 2025 +0800" }, "message": "LoongArch: Convert unreachable() to BUG()\n\nWhen compiling on LoongArch, there exists the following objtool warning\nin arch/loongarch/kernel/machine_kexec.o:\n\n kexec_reboot() falls through to next function crash_shutdown_secondary()\n\nAvoid using unreachable() as it can (and will in the absence of UBSAN)\ngenerate fall-through code. Use BUG() so we get a \"break BRK_BUG\" trap\n(with unreachable annotation).\n\nCc: stable@vger.kernel.org # 6.12+\nAcked-by: Josh Poimboeuf \u003cjpoimboe@kernel.org\u003e\nSigned-off-by: Tiezhu Yang \u003cyangtiezhu@loongson.cn\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "2a520073e74fbb956b5564818fc5529dcc7e9f0e", "tree": "3c02a366da58a3ec1020e79d12a01c1b497d9fe4", "parents": [ "21e4543a2e2f8538373d1d19264c4bae6f13e798", "b4a1dec11793936ffe1a9fb811724532ff3b1174" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 07 16:21:02 2025 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 07 16:21:02 2025 -1000" }, "message": "Merge tag \u0027s390-6.14-6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux\n\nPull s390 fixes from Vasily Gorbik:\n\n - Fix return address recovery of traced function in ftrace to ensure\n reliable stack unwinding\n\n - Fix compiler warnings and runtime crashes of vDSO selftests on s390\n by introducing a dedicated GNU hash bucket pointer with correct\n 32-bit entry size\n\n - Fix test_monitor_call() inline asm, which misses CC clobber, by\n switching to an instruction that doesn\u0027t modify CC\n\n* tag \u0027s390-6.14-6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:\n s390/ftrace: Fix return address recovery of traced function\n selftests/vDSO: Fix GNU hash table entry size for s390x\n s390/traps: Fix test_monitor_call() inline assembly\n" }, { "commit": "6914f7e2e25fac9d1d2b62c208eaa5f2bf810fe9", "tree": "0415b08066d349a5f8419ed25a949121eaf5a3b5", "parents": [ "3e385c0d6ce88ac9916dcf84267bd5855d830748" ], "author": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Thu Mar 06 23:00:16 2025 +0100" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Sat Mar 08 00:09:09 2025 +0100" }, "message": "x86/mm: Define PTRS_PER_PMD for assembly code too\n\nAndy reported the following build warning from head_32.S:\n\n In file included from arch/x86/kernel/head_32.S:29:\n arch/x86/include/asm/pgtable_32.h:59:5: error: \"PTRS_PER_PMD\" is not defined, evaluates to 0 [-Werror\u003dundef]\n 59 | #if PTRS_PER_PMD \u003e 1\n\nThe reason is that on 2-level i386 paging the folded in PMD\u0027s\nPTRS_PER_PMD constant is not defined in assembly headers,\nonly in generic MM C headers.\n\nInstead of trying to fish out the definition from the generic\nheaders, just define it - it even has a comment for it already...\n\nReported-by: Andy Shevchenko \u003candriy.shevchenko@linux.intel.com\u003e\nTested-by: Andy Shevchenko \u003candriy.shevchenko@linux.intel.com\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nLink: https://lore.kernel.org/r/Z8oa8AUVyi2HWfo9@gmail.com\n" }, { "commit": "21e4543a2e2f8538373d1d19264c4bae6f13e798", "tree": "cbf6e8b157c4c1a4935131d5bca1aea6b60bf829", "parents": [ "d4fd25b6f883db41194e1760041560779d412d98", "dfd3df31c9db752234d7d2e09bef2aeabb643ce4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 07 12:22:41 2025 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 07 12:22:41 2025 -1000" }, "message": "Merge tag \u0027slab-for-6.14-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab\n\nPull slab fix from Vlastimil Babka:\n\n - Stable fix for kmem_cache_destroy() called from a WQ_MEM_RECLAIM\n workqueue causing a warning due to the new kvfree_rcu_barrier()\n (Uladzislau Rezki)\n\n* tag \u0027slab-for-6.14-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab:\n mm/slab/kvfree_rcu: Switch to WQ_MEM_RECLAIM wq\n" }, { "commit": "d4fd25b6f883db41194e1760041560779d412d98", "tree": "c3df72b57a4ae479c2b57c7d19e51df934a62722", "parents": [ "dd047efbe0e086f6ea82774cb239ec4c64a86d76", "9a43102daf64dd0d172d8b39836dbc1dba4da1ea" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 07 12:17:42 2025 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 07 12:17:42 2025 -1000" }, "message": "Merge tag \u0027acpi-6.14-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull ACPI fix from Rafael Wysocki:\n \"Restore the previous behavior of the ACPI platform_profile sysfs\n interface that has been changed recently in a way incompatible with\n the existing user space (Mario Limonciello)\"\n\n* tag \u0027acpi-6.14-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n platform/x86/amd: pmf: Add balanced-performance to hidden choices\n platform/x86/amd: pmf: Add \u0027quiet\u0027 to hidden choices\n ACPI: platform_profile: Add support for hidden choices\n" }, { "commit": "dd047efbe0e086f6ea82774cb239ec4c64a86d76", "tree": "88116fb4a6b7980ac78d4519599f38fc5928eddc", "parents": [ "6ceb6346b0436ea6591c33ab6ab22e5077ed17e7", "39ec9eaaa165d297d008d1fa385748430bd18e4d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 07 11:49:33 2025 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 07 11:49:33 2025 -1000" }, "message": "Merge tag \u0027execve-v6.14-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux\n\nPull core dumping fix from Kees Cook:\n\n - Only sort VMAs when core_sort_vma sysctl is set\n\n* tag \u0027execve-v6.14-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:\n coredump: Only sort VMAs when core_sort_vma sysctl is set\n" }, { "commit": "6ceb6346b0436ea6591c33ab6ab22e5077ed17e7", "tree": "e384a1133a93f766d47fedb4f99220b8b4e2de77", "parents": [ "381af8d9f484c06d93e4a0b8459526e779b35a65", "35d99c68af40a8ca175babc5a89ef7e2226fb3ca" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 07 11:17:30 2025 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 07 11:17:30 2025 -1000" }, "message": "Merge tag \u0027for-6.14-rc5-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux\n\nPull btrfs fixes from David Sterba:\n\n - fix leaked extent map after error when reading chunks\n\n - replace use of deprecated strncpy\n\n - in zoned mode, fixed range when ulocking extent range, causing a hang\n\n* tag \u0027for-6.14-rc5-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:\n btrfs: fix a leaked chunk map issue in read_one_chunk()\n btrfs: replace deprecated strncpy() with strscpy()\n btrfs: zoned: fix extent range end unlock in cow_file_range()\n" }, { "commit": "381af8d9f484c06d93e4a0b8459526e779b35a65", "tree": "7369718c15b87b8925459d645590539902af83f9", "parents": [ "d53276d2928345f68a3eb7722a849fb4a0aa2ad0", "e7112524e5e885181cc5ae4d258f33b9dbe0b907" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 07 11:12:33 2025 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 07 11:12:33 2025 -1000" }, "message": "Merge tag \u0027block-6.14-20250306\u0027 of git://git.kernel.dk/linux\n\nPull block fixes from Jens Axboe:\n\n - NVMe pull request via Keith:\n - TCP use after free fix on polling (Sagi)\n - Controller memory buffer cleanup fixes (Icenowy)\n - Free leaking requests on bad user passthrough commands (Keith)\n - TCP error message fix (Maurizio)\n - TCP corruption fix on partial PDU (Maurizio)\n - TCP memory ordering fix for weakly ordered archs (Meir)\n - Type coercion fix on message error for TCP (Dan)\n\n - Name the RQF flags enum, fixing issues with anon enums and BPF import\n of it\n\n - ublk parameter setting fix\n\n - GPT partition 7-bit conversion fix\n\n* tag \u0027block-6.14-20250306\u0027 of git://git.kernel.dk/linux:\n block: Name the RQF flags enum\n nvme-tcp: fix signedness bug in nvme_tcp_init_connection()\n block: fix conversion of GPT partition name to 7-bit\n ublk: set_params: properly check if parameters can be applied\n nvmet-tcp: Fix a possible sporadic response drops in weakly ordered arch\n nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()\n nvme-tcp: Fix a C2HTermReq error message\n nvmet: remove old function prototype\n nvme-ioctl: fix leaked requests on mapping error\n nvme-pci: skip CMB blocks incompatible with PCI P2P DMA\n nvme-pci: clean up CMBMSC when registering CMB fails\n nvme-tcp: fix possible UAF in nvme_tcp_poll\n" }, { "commit": "d53276d2928345f68a3eb7722a849fb4a0aa2ad0", "tree": "4bec834d6fac93957ab0093eab381af4ed26ccab", "parents": [ "1c5183aa6e74a0817c3a370e6a94e460dbb00098", "bcb0fda3c2da9fe4721d3e73d80e778c038e7d27" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 07 11:09:33 2025 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 07 11:09:33 2025 -1000" }, "message": "Merge tag \u0027io_uring-6.14-20250306\u0027 of git://git.kernel.dk/linux\n\nPull io_uring fix from Jens Axboe:\n \"A single fix for a regression introduced in the 6.14 merge window,\n causing stalls/hangs with IOPOLL reads or writes\"\n\n* tag \u0027io_uring-6.14-20250306\u0027 of git://git.kernel.dk/linux:\n io_uring/rw: ensure reissue path is correctly handled for IOPOLL\n" }, { "commit": "1c5183aa6e74a0817c3a370e6a94e460dbb00098", "tree": "c9f9ad5dcc4802ef36e4ab9596c6ca97e44b50ac", "parents": [ "ab60bd57319cbfeeb4cff2337016c9fd72b51412", "b1536481c81fb604074da799e4f2d2038a1663f7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 07 10:58:54 2025 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 07 10:58:54 2025 -1000" }, "message": "Merge tag \u0027sched-urgent-2025-03-07\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull misc scheduler fixes from Ingo Molnar:\n\n - Fix deadline scheduler sysctl parameter setting bug\n\n - Fix RT scheduler sysctl parameter setting bug\n\n - Fix possible memory corruption in child_cfs_rq_on_list()\n\n* tag \u0027sched-urgent-2025-03-07\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n sched/rt: Update limit of sched_rt sysctl in documentation\n sched/deadline: Use online cpus for validating runtime\n sched/fair: Fix potential memory corruption in child_cfs_rq_on_list\n" }, { "commit": "ab60bd57319cbfeeb4cff2337016c9fd72b51412", "tree": "84e8b871c03ad1c2cfda0498eb6680bba3a8ec4f", "parents": [ "042751d35326d4401d843ac3ee25957815aecd10", "003659fec9f6d8c04738cb74b5384398ae8a7e88" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 07 10:38:33 2025 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 07 10:38:33 2025 -1000" }, "message": "Merge tag \u0027perf-urgent-2025-03-07\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull perf event fixes from Ingo Molnar:\n \"Fix a race between PMU registration and event creation, and fix\n pmus_lock vs. pmus_srcu lock ordering\"\n\n* tag \u0027perf-urgent-2025-03-07\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n perf/core: Fix perf_pmu_register() vs. perf_init_event()\n perf/core: Fix pmus_lock vs. pmus_srcu ordering\n" }, { "commit": "042751d35326d4401d843ac3ee25957815aecd10", "tree": "12190ddd40d3f7a7c49ef43689e0a25339b2b5b9", "parents": [ "8287dfc2915368092e98ef0caef9c03e8e0f7aa9", "c00b413a96261faef4ce22329153c6abd4acef25" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 07 10:05:32 2025 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 07 10:05:32 2025 -1000" }, "message": "Merge tag \u0027x86-urgent-2025-03-07\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull misc x86 fixes from Ingo Molnar:\n\n - Fix CPUID leaf 0x2 parsing bugs\n\n - Sanitize very early boot parameters to avoid crash\n\n - Fix size overflows in the SGX code\n\n - Make CALL_NOSPEC use consistent\n\n* tag \u0027x86-urgent-2025-03-07\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/boot: Sanitize boot params before parsing command line\n x86/sgx: Fix size overflows in sgx_encl_create()\n x86/cpu: Properly parse CPUID leaf 0x2 TLB descriptor 0x63\n x86/cpu: Validate CPUID leaf 0x2 EDX output\n x86/cacheinfo: Validate CPUID leaf 0x2 EDX output\n x86/speculation: Add a conditional CS prefix to CALL_NOSPEC\n x86/speculation: Simplify and make CALL_NOSPEC consistent\n" }, { "commit": "8287dfc2915368092e98ef0caef9c03e8e0f7aa9", "tree": "89bb5186e154a6e86bb7d0a39358bd7163f98f65", "parents": [ "1222390d138d1f375fe28a9a052780009d2ce6ef", "10fce7ebe888fa8c97eee7e317a47e7603e5e78d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 07 07:51:27 2025 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 07 07:51:27 2025 -1000" }, "message": "Merge tag \u0027hwmon-for-v6.14-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging\n\nPull hwmon fixes from Guenter Roeck:\n\n - xgene-hwmon: Fix a NULL vs IS_ERR_OR_NULL() check\n\n - ad7314: Return error if leading zero bits are non-zero\n\n - ntc_thermistor: Update/fix the ncpXXxh103 sensor table\n\n - pmbus: Initialise page count in pmbus_identify()\n\n - peci/dimmtemp: Do not provide fake threshold data\n\n* tag \u0027hwmon-for-v6.14-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:\n hwmon: fix a NULL vs IS_ERR_OR_NULL() check in xgene_hwmon_probe()\n hwmon: (ad7314) Validate leading zero bits and return error\n hwmon: (ntc_thermistor) Fix the ncpXXxh103 sensor table\n hwmon: (pmbus) Initialise page count in pmbus_identify()\n hwmon: (peci/dimmtemp) Do not provide fake thresholds data\n" }, { "commit": "1222390d138d1f375fe28a9a052780009d2ce6ef", "tree": "234482fe35f837c2d5f51ce24ac39c4ffbd74733", "parents": [ "8aed61b8334e00f4fe5de9f2df1cd183dc328a9d", "391b41f983bf7ff853de44704d8e14e7cc648a9b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 07 07:49:23 2025 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 07 07:49:23 2025 -1000" }, "message": "Merge tag \u0027gpio-fixes-for-v6.14-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull gpio fixes from Bartosz Golaszewski:\n\n - protect gpio-aggregator against module unload\n\n - use raw spinlock in gpio-rcar to fix a lockdep splat\n\n - fix OF node leak in gpio-rcar\n\n* tag \u0027gpio-fixes-for-v6.14-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:\n gpio: rcar: Fix missing of_node_put() call\n gpio: rcar: Use raw_spinlock to protect register access\n gpio: aggregator: protect driver attr handlers against module unload\n" }, { "commit": "8aed61b8334e00f4fe5de9f2df1cd183dc328a9d", "tree": "0011130fea63307e0d5842665d42ad327940263f", "parents": [ "2a405b36a6418e9a9e07314c90c14ebe370ed79b", "376a8c2a144397d9cf2a67d403dd64f4a7ff9104" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 07 07:29:13 2025 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 07 07:29:13 2025 -1000" }, "message": "Merge tag \u0027platform-drivers-x86-v6.14-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86\n\nPull x86 platform driver fixes from Ilpo Järvinen:\n\n - amd/pmf:\n - Initialize \u0027cb_mutex\u0027\n - Support for new version of PMF-TA\n\n - intel-hid: Fix volume buttons on Microsoft Surface Go 4 tablet\n\n - intel/vsec: Add Diamond Rapids support\n\n - thinkpad_acpi: Add battery quirk for ThinkPad X131e\n\n* tag \u0027platform-drivers-x86-v6.14-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86:\n platform/x86/amd/pmf: Update PMF Driver for Compatibility with new PMF-TA\n platform/x86/amd/pmf: Propagate PMF-TA return codes\n platform/x86/intel/vsec: Add Diamond Rapids support\n platform/x86: thinkpad_acpi: Add battery quirk for ThinkPad X131e\n platform/x86: intel-hid: fix volume buttons on Microsoft Surface Go 4 tablet\n platform/x86/amd/pmf: Initialize and clean up `cb_mutex`\n" }, { "commit": "2a405b36a6418e9a9e07314c90c14ebe370ed79b", "tree": "57692e5960a8857fa44a627675adbfa403aed9c2", "parents": [ "00a7d39898c8010bfd5ff62af31ca5db34421b38", "8463d2adbe1901247937fcdfe4b525130f6db10b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 07 07:24:41 2025 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Mar 07 07:24:41 2025 -1000" }, "message": "Merge tag \u0027sound-6.14-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"There is a single change in ALSA core (for sequencer code for the\n module auto-loading in a wrong timing) while the all rest are various\n HD- and USB-audio fixes.\n\n Many of them are boring device-specific quirks, and should be safe to\n take\"\n\n* tag \u0027sound-6.14-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:\n ALSA: hda/realtek: Add support for ASUS Zenbook UM3406KA Laptops using CS35L41 HDA\n ALSA: hda/realtek: Add support for ASUS B5405 and B5605 Laptops using CS35L41 HDA\n ALSA: hda/realtek: Add support for ASUS B3405 and B3605 Laptops using CS35L41 HDA\n ALSA: hda/realtek: Add support for various ASUS Laptops using CS35L41 HDA\n ALSA: hda/realtek: Add support for ASUS ROG Strix G614 Laptops using CS35L41 HDA\n ALSA: hda/realtek: Add support for ASUS ROG Strix GA603 Laptops using CS35L41 HDA\n ALSA: hda/realtek: Add support for ASUS ROG Strix G814 Laptop using CS35L41 HDA\n ALSA: hda: intel: Add Dell ALC3271 to power_save denylist\n ALSA: hda/realtek: update ALC222 depop optimize\n ALSA: hda: realtek: fix incorrect IS_REACHABLE() usage\n ALSA: usx2y: validate nrpacks module parameter on probe\n ALSA: hda/realtek - add supported Mic Mute LED for Lenovo platform\n ALSA: seq: Avoid module auto-load handling at event delivery\n ALSA: hda: Fix speakers on ASUS EXPERTBOOK P5405CSA 1.0\n ALSA: hda/realtek: Fix Asus Z13 2025 audio\n ALSA: hda/realtek: Remove (revert) duplicate Ally X config\n" }, { "commit": "3e385c0d6ce88ac9916dcf84267bd5855d830748", "tree": "bbf77b8d5401091d3bf8d930c709675b9f852384", "parents": [ "ac7c06acaa3738b38e83815ac0f07140ad320f13" ], "author": { "name": "Alexey Kardashevskiy", "email": "aik@amd.com", "time": "Fri Mar 07 12:37:00 2025 +1100" }, "committer": { "name": "Borislav Petkov (AMD)", "email": "bp@alien8.de", "time": "Fri Mar 07 14:09:33 2025 +0100" }, "message": "virt: sev-guest: Move SNP Guest Request data pages handling under snp_cmd_mutex\n\nCompared to the SNP Guest Request, the \"Extended\" version adds data pages for\nreceiving certificates. If not enough pages provided, the HV can report to the\nVM how much is needed so the VM can reallocate and repeat.\n\nCommit\n\n ae596615d93d (\"virt: sev-guest: Reduce the scope of SNP command mutex\")\n\nmoved handling of the allocated/desired pages number out of scope of said\nmutex and create a possibility for a race (multiple instances trying to\ntrigger Extended request in a VM) as there is just one instance of\nsnp_msg_desc per /dev/sev-guest and no locking other than snp_cmd_mutex.\n\nFix the issue by moving the data blob/size and the GHCB input struct\n(snp_req_data) into snp_guest_req which is allocated on stack now and accessed\nby the GHCB caller under that mutex.\n\nStop allocating SEV_FW_BLOB_MAX_SIZE in snp_msg_alloc() as only one of four\ncallers needs it. Free the received blob in get_ext_report() right after it is\ncopied to the userspace. Possible future users of snp_send_guest_request() are\nlikely to have different ideas about the buffer size anyways.\n\nFixes: ae596615d93d (\"virt: sev-guest: Reduce the scope of SNP command mutex\")\nSigned-off-by: Alexey Kardashevskiy \u003caik@amd.com\u003e\nSigned-off-by: Borislav Petkov (AMD) \u003cbp@alien8.de\u003e\nReviewed-by: Nikunj A Dadhania \u003cnikunj@amd.com\u003e\nCc: stable@vger.kernel.org\nLink: https://lore.kernel.org/r/20250307013700.437505-3-aik@amd.com\n" }, { "commit": "ac7c06acaa3738b38e83815ac0f07140ad320f13", "tree": "26835ef7d2ce8d93503458fd13334586d86d0325", "parents": [ "14cb5d83068ecf15d2da6f7d0e9ea9edbcbc0457" ], "author": { "name": "Nikunj A Dadhania", "email": "nikunj@amd.com", "time": "Thu Mar 06 19:17:21 2025 +1100" }, "committer": { "name": "Borislav Petkov (AMD)", "email": "bp@alien8.de", "time": "Fri Mar 07 13:34:25 2025 +0100" }, "message": "virt: sev-guest: Allocate request data dynamically\n\nCommit\n\n ae596615d93d (\"virt: sev-guest: Reduce the scope of SNP command mutex\")\n\nnarrowed the command mutex scope to snp_send_guest_request(). However,\nGET_REPORT, GET_DERIVED_KEY, and GET_EXT_REPORT share the req structure in\nsnp_guest_dev. Without the mutex protection, concurrent requests can overwrite\neach other\u0027s data. Fix it by dynamically allocating the request structure.\n\nFixes: ae596615d93d (\"virt: sev-guest: Reduce the scope of SNP command mutex\")\nCloses: https://github.com/AMDESE/AMDSEV/issues/265\nReported-by: andreas.stuehrk@yaxi.tech\nSigned-off-by: Nikunj A Dadhania \u003cnikunj@amd.com\u003e\nSigned-off-by: Alexey Kardashevskiy \u003caik@amd.com\u003e\nSigned-off-by: Borislav Petkov (AMD) \u003cbp@alien8.de\u003e\nCc: stable@vger.kernel.org\nLink: https://lore.kernel.org/r/20250307013700.437505-2-aik@amd.com\n" }, { "commit": "14cb5d83068ecf15d2da6f7d0e9ea9edbcbc0457", "tree": "94e5115cbde6ed81c5ccbde620ade5a537e2a5ef", "parents": [ "c00b413a96261faef4ce22329153c6abd4acef25" ], "author": { "name": "Andrew Cooper", "email": "andrew.cooper3@citrix.com", "time": "Fri Mar 07 00:28:46 2025 +0000" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Mar 07 13:28:31 2025 +0100" }, "message": "x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range()\n\nXen doesn\u0027t offer MSR_FAM10H_MMIO_CONF_BASE to all guests. This results\nin the following warning:\n\n unchecked MSR access error: RDMSR from 0xc0010058 at rIP: 0xffffffff8101d19f (xen_do_read_msr+0x7f/0xa0)\n Call Trace:\n xen_read_msr+0x1e/0x30\n amd_get_mmconfig_range+0x2b/0x80\n quirk_amd_mmconfig_area+0x28/0x100\n pnp_fixup_device+0x39/0x50\n __pnp_add_device+0xf/0x150\n pnp_add_device+0x3d/0x100\n pnpacpi_add_device_handler+0x1f9/0x280\n acpi_ns_get_device_callback+0x104/0x1c0\n acpi_ns_walk_namespace+0x1d0/0x260\n acpi_get_devices+0x8a/0xb0\n pnpacpi_init+0x50/0x80\n do_one_initcall+0x46/0x2e0\n kernel_init_freeable+0x1da/0x2f0\n kernel_init+0x16/0x1b0\n ret_from_fork+0x30/0x50\n ret_from_fork_asm+0x1b/0x30\n\nbased on quirks for a \"PNP0c01\" device. Treating MMCFG as disabled is the\nright course of action, so no change is needed there.\n\nThis was most likely exposed by fixing the Xen MSR accessors to not be\nsilently-safe.\n\nFixes: 3fac3734c43a (\"xen/pv: support selecting safe/unsafe msr accesses\")\nSigned-off-by: Andrew Cooper \u003candrew.cooper3@citrix.com\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nLink: https://lore.kernel.org/r/20250307002846.3026685-1-andrew.cooper3@citrix.com\n" }, { "commit": "00a7d39898c8010bfd5ff62af31ca5db34421b38", "tree": "e954f728cdd695232becd597a945506b927511c2", "parents": [ "28f587adb69957125241a8df359b68b134f3c4a1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 06 18:25:35 2025 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 06 18:25:35 2025 -1000" }, "message": "fs/pipe: add simpler helpers for common cases\n\nThe fix to atomically read the pipe head and tail state when not holding\nthe pipe mutex has caused a number of headaches due to the size change\nof the involved types.\n\nIt turns out that we don\u0027t have _that_ many places that access these\nfields directly and were affected, but we have more than we strictly\nshould have, because our low-level helper functions have been designed\nto have intimate knowledge of how the pipes work.\n\nAnd as a result, that random noise of direct \u0027pipe-\u003ehead\u0027 and\n\u0027pipe-\u003etail\u0027 accesses makes it harder to pinpoint any actual potential\nproblem spots remaining.\n\nFor example, we didn\u0027t have a \"is the pipe full\" helper function, but\ninstead had a \"given these pipe buffer indexes and this pipe size, is\nthe pipe full\". That\u0027s because some low-level pipe code does actually\nwant that much more complicated interface.\n\nBut most other places literally just want a \"is the pipe full\" helper,\nand not having it meant that those places ended up being unnecessarily\nmuch too aware of this all.\n\nIt would have been much better if only the very core pipe code that\ncared had been the one aware of this all.\n\nSo let\u0027s fix it - better late than never. This just introduces the\ntrivial wrappers for \"is this pipe full or empty\" and to get how many\npipe buffers are used, so that instead of writing\n\n if (pipe_full(pipe-\u003ehead, pipe-\u003etail, pipe-\u003emax_usage))\n\nthe places that literally just want to know if a pipe is full can just\nsay\n\n if (pipe_is_full(pipe))\n\ninstead. The existing trivial cases were converted with a \u0027sed\u0027 script.\n\nThis cuts down on the places that access pipe-\u003ehead and pipe-\u003etail\ndirectly outside of the pipe code (and core splice code) quite a lot.\n\nThe splice code in particular still revels in doing the direct low-level\naccesses, and the fuse fuse_dev_splice_write() code also seems a bit\nunnecessarily eager to go very low-level, but it\u0027s at least a bit better\nthan it used to be.\n\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "28f587adb69957125241a8df359b68b134f3c4a1", "tree": "56e73b52e336b0b99b233d1c155f96419e4a6c02", "parents": [ "0f52fd4f67c67f7f2ea3063c627e466255f027fd", "c8bc66206a44f389649af374f5301b2c3a71fff4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 06 17:04:25 2025 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 06 17:04:25 2025 -1000" }, "message": "Merge tag \u0027drm-fixes-2025-03-07\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"Fixes across the board, mostly xe and imagination with some amd and\n misc others.\n\n The xe fixes are mostly hmm related, though there are some others in\n there as well, nothing really stands out otherwise.\n\n The nouveau Kconfig to select FW_CACHE is in this, which we discussed\n a while back.\n\n nouveau:\n - rely on fw caching Kconfig fix\n\n imagination:\n - avoid deadlock on fence release\n - fix fence initialisation\n - fix timestamps firmware traces\n\n scheduler:\n - fix include guard\n\n bochs:\n - dpms fix\n\n i915:\n - bump max stream count to match pipes\n\n xe:\n - Remove double page flip on initial plane\n - Properly setup userptr pfn_flags_mask\n - Fix GT \"for each engine\" workarounds\n - Fix userptr races and missed validations\n - Userptr invalid page access fixes\n - Cleanup some style nits\n\n amdgpu:\n - Fix NULL check in DC code\n - SMU 14 fix\n\n amdkfd:\n - Fix NULL check in queue validation\n\n radeon:\n - RS400 HyperZ fix\"\n\n* tag \u0027drm-fixes-2025-03-07\u0027 of https://gitlab.freedesktop.org/drm/kernel: (22 commits)\n drm/bochs: Fix DPMS regression\n drm/xe/userptr: Unmap userptrs in the mmu notifier\n drm/xe/hmm: Don\u0027t dereference struct page pointers without notifier lock\n drm/xe/hmm: Style- and include fixes\n drm/xe: Add staging tree for VM binds\n drm/xe: Fix fault mode invalidation with unbind\n drm/xe/vm: Fix a misplaced #endif\n drm/xe/vm: Validate userptr during gpu vma prefetching\n drm/amd/pm: always allow ih interrupt from fw\n drm/radeon: Fix rs400_gpu_init for ATI mobility radeon Xpress 200M\n drm/amdkfd: Fix NULL Pointer Dereference in KFD queue\n drm/amd/display: Fix null check for pipe_ctx-\u003eplane_state in resource_build_scaling_params\n drm/xe: Fix GT \"for each engine\" workarounds\n drm/xe/userptr: properly setup pfn_flags_mask\n drm/i915/mst: update max stream count to match number of pipes\n drm/xe: Remove double pageflip\n drm/sched: Fix preprocessor guard\n drm/imagination: Fix timestamps in firmware traces\n drm/imagination: only init job done fences once\n drm/imagination: Hold drm_gem_gpuva lock for unmap\n ...\n" }, { "commit": "e7112524e5e885181cc5ae4d258f33b9dbe0b907", "tree": "5b1712ebddb013c9a5c8f53d7fc2710892b2827f", "parents": [ "ca57b5bfa214063a109ae9bc85862ce3ed155027" ], "author": { "name": "Breno Leitao", "email": "leitao@debian.org", "time": "Thu Mar 06 08:27:51 2025 -0800" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu Mar 06 17:50:55 2025 -0700" }, "message": "block: Name the RQF flags enum\n\nCommit 5f89154e8e9e3445f9b59 (\"block: Use enum to define RQF_x bit\nindexes\") converted the RQF flags to an anonymous enum, which was\na beneficial change. This patch goes one step further by naming the enum\nas \"rqf_flags\".\n\nThis naming enables exporting these flags to BPF clients, eliminating\nthe need to duplicate these flags in BPF code. Instead, BPF clients can\nnow access the same kernel-side values through CO:RE (Compile Once, Run\nEverywhere), as shown in this example:\n\n rqf_stats \u003d bpf_core_enum_value(enum rqf_flags, __RQF_STATS)\n\nSuggested-by: Yonghong Song \u003cyonghong.song@linux.dev\u003e\nSigned-off-by: Breno Leitao \u003cleitao@debian.org\u003e\nLink: https://lore.kernel.org/r/20250306-rqf_flags-v1-1-bbd64918b406@debian.org\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "c8bc66206a44f389649af374f5301b2c3a71fff4", "tree": "66330dc9cfd07e0e94b343e093a3908d2b06c0aa", "parents": [ "eea6520c225adb75cae59cae712f463686aba5a9", "da552bda987420e877500fdd90bd0172e3bf412b" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Mar 07 09:41:45 2025 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Mar 07 09:54:43 2025 +1000" }, "message": "Merge tag \u0027amd-drm-fixes-6.14-2025-03-06\u0027 of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes\n\namd-drm-fixes-6.14-2025-03-06:\n\namdgpu:\n- Fix NULL check in DC code\n- SMU 14 fix\n\namdkfd:\n- Fix NULL check in queue validation\n\nradeon:\n- RS400 HyperZ fix\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/20250306193424.27413-1-alexander.deucher@amd.com\n" }, { "commit": "0f52fd4f67c67f7f2ea3063c627e466255f027fd", "tree": "7e0f38860adc8e42b588eb38e425a02d7d6be949", "parents": [ "f315296c92fd4b7716bdea17f727ab431891dc3b", "8ba73f53dc5b7545776e09e6982115dcbcbabec4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 06 13:52:15 2025 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 06 13:52:15 2025 -1000" }, "message": "Merge tag \u0027bcachefs-2025-03-06\u0027 of git://evilpiepirate.org/bcachefs\n\nPull bcachefs fixes from Kent Overstreet:\n\n - Fix a compatibility issue: we shouldn\u0027t be setting incompat feature\n bits unless explicitly requested\n\n - Fix another bug where the journal alloc/resize path could spuriously\n fail with -BCH_ERR_open_buckets_empty\n\n - Copygc shouldn\u0027t run on read-only devices: fragmentation isn\u0027t an\n issue if we\u0027re not currently writing to a given device, and it may\n not have anywhere to move the data to\n\n* tag \u0027bcachefs-2025-03-06\u0027 of git://evilpiepirate.org/bcachefs:\n bcachefs: copygc now skips non-rw devices\n bcachefs: Fix bch2_dev_journal_alloc() spuriously failing\n bcachefs: Don\u0027t set BCH_FEATURE_incompat_version_field unless requested\n" }, { "commit": "8ba73f53dc5b7545776e09e6982115dcbcbabec4", "tree": "a1c808948d586785a970ff334f9f27a2b67bdf27", "parents": [ "33255c161ac4be003ac87c434ebc49645d18a929" ], "author": { "name": "Kent Overstreet", "email": "kent.overstreet@linux.dev", "time": "Fri Feb 28 11:34:41 2025 -0500" }, "committer": { "name": "Kent Overstreet", "email": "kent.overstreet@linux.dev", "time": "Thu Mar 06 18:15:01 2025 -0500" }, "message": "bcachefs: copygc now skips non-rw devices\n\nThere\u0027s no point in doing copygc on non-rw devices: the fragmentation\ndoesn\u0027t matter if we\u0027re not writing to them, and we may not have\nanywhere to put the data on our other devices.\n\nSigned-off-by: Kent Overstreet \u003ckent.overstreet@linux.dev\u003e\n" }, { "commit": "33255c161ac4be003ac87c434ebc49645d18a929", "tree": "cec612a1096cd27816b741dba58e834bb5e65e6d", "parents": [ "4a4f9b5c7c13601c4f1b3d8c607d7439e39f40d2" ], "author": { "name": "Kent Overstreet", "email": "kent.overstreet@linux.dev", "time": "Fri Feb 28 20:07:58 2025 -0500" }, "committer": { "name": "Kent Overstreet", "email": "kent.overstreet@linux.dev", "time": "Thu Mar 06 18:15:01 2025 -0500" }, "message": "bcachefs: Fix bch2_dev_journal_alloc() spuriously failing\n\nPreviously, we fixed journal resize spuriousl failing with\n-BCH_ERR_open_buckets_empty, but initial journal allocation was missed\nbecause it didn\u0027t invoke the \"block on allocator\" loop at all.\n\nFactor out the \"loop on allocator\" code to fix that.\n\nSigned-off-by: Kent Overstreet \u003ckent.overstreet@linux.dev\u003e\n" }, { "commit": "eea6520c225adb75cae59cae712f463686aba5a9", "tree": "6b845ed9cee9cae9c5d920d1d2bd8c038852cef8", "parents": [ "019899b551a107d8d081a38dec7335e9d4ff7f76", "333b8906336174478efbbfc1e24a89e3397ffe65" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Mar 07 09:03:14 2025 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Mar 07 09:03:18 2025 +1000" }, "message": "Merge tag \u0027drm-xe-fixes-2025-03-06\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes\n\n- Remove double page flip on initial plane (Maarten)\n- Properly setup userptr pfn_flags_mask (Auld)\n- Fix GT \"for each engine\" workarounds (Tvrtko)\n- Fix userptr races and missed validations (Thomas, Brost)\n- Userptr invalid page access fixes (Thomas)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/Z8ni6w3tskCFL11O@intel.com\n" }, { "commit": "019899b551a107d8d081a38dec7335e9d4ff7f76", "tree": "931c9de3438ccd38032e78f85592affcaf89c27c", "parents": [ "ac3a75bd4205b8856631f57001ebd304e072124e", "d1039a3c12fffe501c5379c7eb1372eaab318e0a" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Mar 07 08:25:06 2025 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Mar 07 08:25:11 2025 +1000" }, "message": "Merge tag \u0027drm-intel-fixes-2025-03-06\u0027 of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes\n\n- DP MST fix (Jani)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/Z8ng8NjmRGiVcb5t@intel.com\n" }, { "commit": "ac3a75bd4205b8856631f57001ebd304e072124e", "tree": "0d05bb879457bab3e697eb8aea3e2872d134a752", "parents": [ "7eb172143d5508b4da468ed59ee857c6e5e01da6", "80da96d735094ea22985ced98bc57fe3a4422921" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Mar 07 07:03:56 2025 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Mar 07 07:06:34 2025 +1000" }, "message": "Merge tag \u0027drm-misc-fixes-2025-03-06\u0027 of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes\n\nA Kconfig fix for nouveau, locking and timestamp fixes for imagination,\na header guard fix for sched and a DPMS regression fix for bochs.\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Maxime Ripard \u003cmripard@redhat.com\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/20250306-antelope-of-imminent-anger-bca19e@houat\n" }, { "commit": "c00b413a96261faef4ce22329153c6abd4acef25", "tree": "91b59a6a3dff54f701039b992303d304bd873e92", "parents": [ "0d3e0dfd68fb9e6b0ec865be9f3377cc3ff55733" ], "author": { "name": "Ard Biesheuvel", "email": "ardb@kernel.org", "time": "Thu Mar 06 16:59:16 2025 +0100" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Thu Mar 06 22:02:39 2025 +0100" }, "message": "x86/boot: Sanitize boot params before parsing command line\n\nThe 5-level paging code parses the command line to look for the \u0027no5lvl\u0027\nstring, and does so very early, before sanitize_boot_params() has been\ncalled and has been given the opportunity to wipe bogus data from the\nfields in boot_params that are not covered by struct setup_header, and\nare therefore supposed to be initialized to zero by the bootloader.\n\nThis triggers an early boot crash when using syslinux-efi to boot a\nrecent kernel built with CONFIG_X86_5LEVEL\u003dy and CONFIG_EFI_STUB\u003dn, as\nthe 0xff padding that now fills the unused PE/COFF header is copied into\nboot_params by the bootloader, and interpreted as the top half of the\ncommand line pointer.\n\nFix this by sanitizing the boot_params before use. Note that there is no\nharm in calling this more than once; subsequent invocations are able to\nspot that the boot_params have already been cleaned up.\n\nSigned-off-by: Ard Biesheuvel \u003cardb@kernel.org\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: \"H. Peter Anvin\" \u003chpa@zytor.com\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e # v6.1+\nLink: https://lore.kernel.org/r/20250306155915.342465-2-ardb+git@google.com\nCloses: https://lore.kernel.org/all/202503041549.35913.ulrich.gemkow@ikr.uni-stuttgart.de\n" }, { "commit": "f315296c92fd4b7716bdea17f727ab431891dc3b", "tree": "7b5cdf5958d02962a9dd328ad3abe43f072b1a19", "parents": [ "1238f0af13495e14e1f40d011b9b7b414bf387fe", "5da15a9c11c1c47ef573e6805b60a7d8a1687a2a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 06 09:34:54 2025 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 06 09:34:54 2025 -1000" }, "message": "Merge tag \u0027net-6.14-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Paolo Abeni:\n \"Including fixes from bluetooth and wireless.\n\n Current release - new code bugs:\n\n - wifi: nl80211: disable multi-link reconfiguration\n\n Previous releases - regressions:\n\n - gso: fix ownership in __udp_gso_segment\n\n - wifi: iwlwifi:\n - fix A-MSDU TSO preparation\n - free pages allocated when failing to build A-MSDU\n\n - ipv6: fix dst ref loop in ila lwtunnel\n\n - mptcp: fix \u0027scheduling while atomic\u0027 in\n mptcp_pm_nl_append_new_local_addr\n\n - bluetooth: add check for mgmt_alloc_skb() in\n mgmt_device_connected()\n\n - ethtool: allow NULL nlattrs when getting a phy_device\n\n - eth: be2net: fix sleeping while atomic bugs in\n be_ndo_bridge_getlink\n\n Previous releases - always broken:\n\n - core: support TCP GSO case for a few missing flags\n\n - wifi: mac80211:\n - fix vendor-specific inheritance\n - cleanup sta TXQs on flush\n\n - llc: do not use skb_get() before dev_queue_xmit()\n\n - eth: ipa: nable checksum for IPA_ENDPOINT_AP_MODEM_{RX,TX}\n for v4.7\"\n\n* tag \u0027net-6.14-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (41 commits)\n net: ipv6: fix missing dst ref drop in ila lwtunnel\n net: ipv6: fix dst ref loop in ila lwtunnel\n mctp i3c: handle NULL header address\n net: dsa: mt7530: Fix traffic flooding for MMIO devices\n net-timestamp: support TCP GSO case for a few missing flags\n vlan: enforce underlying device type\n mptcp: fix \u0027scheduling while atomic\u0027 in mptcp_pm_nl_append_new_local_addr\n net: ethtool: netlink: Allow NULL nlattrs when getting a phy_device\n ppp: Fix KMSAN uninit-value warning with bpf\n net: ipa: Enable checksum for IPA_ENDPOINT_AP_MODEM_{RX,TX} for v4.7\n net: ipa: Fix QSB data for v4.7\n net: ipa: Fix v4.7 resource group names\n net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error\n wifi: nl80211: disable multi-link reconfiguration\n net: dsa: rtl8366rb: don\u0027t prompt users for LED control\n be2net: fix sleeping while atomic bugs in be_ndo_bridge_getlink\n llc: do not use skb_get() before dev_queue_xmit()\n wifi: cfg80211: regulatory: improve invalid hints checking\n caif_virtio: fix wrong pointer check in cfv_probe()\n net: gso: fix ownership in __udp_gso_segment\n ...\n" }, { "commit": "1238f0af13495e14e1f40d011b9b7b414bf387fe", "tree": "8185f9e28cf233a6189d31faa91d7a28d7e6dfd2", "parents": [ "5872cca23a017aae01d0b2f82346907169f7aa01", "aa2a739a75ab6f24ef72fb3fdb9192c081eacf06" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 06 09:19:15 2025 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 06 09:19:15 2025 -1000" }, "message": "Merge tag \u0027v6.14-rc5-smb3-fixes\u0027 of git://git.samba.org/ksmbd\n\nPull smb fixes from Steve French:\n \"Five SMB server fixes, two related client fixes, and minor MAINTAINERS\n update:\n\n - Two SMB3 lock fixes fixes (including use after free and bug on fix)\n\n - Fix to race condition that can happen in processing IPC responses\n\n - Four ACL related fixes: one related to endianness of num_aces, and\n two related fixes to the checks for num_aces (for both client and\n server), and one fixing missing check for num_subauths which can\n cause memory corruption\n\n - And minor update to email addresses in MAINTAINERS file\"\n\n* tag \u0027v6.14-rc5-smb3-fixes\u0027 of git://git.samba.org/ksmbd:\n cifs: fix incorrect validation for num_aces field of smb_acl\n ksmbd: fix incorrect validation for num_aces field of smb_acl\n smb: common: change the data type of num_aces to le16\n ksmbd: fix bug on trap in smb2_lock\n ksmbd: fix use-after-free in smb2_lock\n ksmbd: fix type confusion via race condition when using ipc_msg_send_request\n ksmbd: fix out-of-bounds in parse_sec_desc()\n MAINTAINERS: update email address in cifs and ksmbd entry\n" }, { "commit": "5872cca23a017aae01d0b2f82346907169f7aa01", "tree": "8bc2cd7082c84222f770a214b04f3e9e3e45da9d", "parents": [ "7f0e9ee5e44887272627d0fcde0b19a675daf597", "13940cef95491472760ca261b6713692ece9b946" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 06 08:18:48 2025 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 06 08:18:48 2025 -1000" }, "message": "Merge tag \u0027exfat-for-6.14-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat\n\nPull exfat fixes from Namjae Jeon:\n\n - Optimize new cluster allocation by correctly find empty entry slot\n\n - Add a check to prevent excessive bitmap clearing due to invalid\n data size of file/dir entry\n\n - Fix incorrect error return for zero-byte writes\n\n* tag \u0027exfat-for-6.14-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat:\n exfat: add a check for invalid data size\n exfat: short-circuit zero-byte writes in exfat_file_write_iter\n exfat: fix soft lockup in exfat_clear_bitmap\n exfat: fix just enough dentries but allocate a new cluster to dir\n" }, { "commit": "7f0e9ee5e44887272627d0fcde0b19a675daf597", "tree": "9eba04c31829275f52897fd588e473fb71ac68ab", "parents": [ "ebb0f38bb47f74b29e267babdbcd2c47d5292aa8", "d385c8bceb14665e935419334aa3d3fac2f10456" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 06 08:04:49 2025 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 06 08:04:49 2025 -1000" }, "message": "Merge tag \u0027vfs-6.14-rc6.fixes\u0027 of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs\n\nPull vfs fixes from Christian Brauner:\n\n - Fix spelling mistakes in idmappings.rst\n\n - Fix RCU warnings in override_creds()/revert_creds()\n\n - Create new pid namespaces with default limit now that pid_max is\n namespaced\n\n* tag \u0027vfs-6.14-rc6.fixes\u0027 of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs:\n pid: Do not set pid_max in new pid namespaces\n doc: correcting two prefix errors in idmappings.rst\n cred: Fix RCU warnings in override/revert_creds\n" }, { "commit": "ebb0f38bb47f74b29e267babdbcd2c47d5292aa8", "tree": "08d5de22ef643daece4769b36c32ceab024c92c8", "parents": [ "d810d4c27bf34c719243bab9feb0d843edc09fd7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 06 07:53:25 2025 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 06 07:53:25 2025 -1000" }, "message": "fs/pipe: fix pipe buffer index use in FUSE\n\nThis was another case that Rasmus pointed out where the direct access to\nthe pipe head and tail pointers broke on 32-bit configurations due to\nthe type changes.\n\nAs with the pipe FIONREAD case, fix it by using the appropriate helper\nfunctions that deal with the right pipe index sizing.\n\nReported-by: Rasmus Villemoes \u003cravi@prevas.dk\u003e\nLink: https://lore.kernel.org/all/878qpi5wz4.fsf@prevas.dk/\nFixes: 3d252160b818 (\"fs/pipe: Read pipe-\u003e{head,tail} atomically outside pipe-\u003emutex\")Cc: Oleg \u003e\nCc: Mateusz Guzik \u003cmjguzik@gmail.com\u003e\nCc: K Prateek Nayak \u003ckprateek.nayak@amd.com\u003e\nCc: Swapnil Sapkal \u003cswapnil.sapkal@amd.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "d810d4c27bf34c719243bab9feb0d843edc09fd7", "tree": "3e9336008e89eecda4b375cd2aff5c5a475638f8", "parents": [ "74d42bdb3a4673b1c10d1f457184e4d3c9cb0196" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 06 07:33:58 2025 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 06 07:33:58 2025 -1000" }, "message": "fs/pipe: do not open-code pipe head/tail logic in FIONREAD\n\nRasmus points out that we do indeed have other cases of breakage from\nthe type changes that were introduced on 32-bit targets in order to read\nthe pipe head and tail values atomically (commit 3d252160b818: \"fs/pipe:\nRead pipe-\u003e{head,tail} atomically outside pipe-\u003emutex\").\n\nFix it up by using the proper helper functions that now deal with the\npipe buffer index types properly. This makes the code simpler and more\nobvious.\n\nThe compiler does the CSE and loop hoisting of the pipe ring size\nmasking that we used to do manually, so open-coding this was never a\ngood idea.\n\nReported-by: Rasmus Villemoes \u003cravi@prevas.dk\u003e\nLink: https://lore.kernel.org/all/87cyeu5zgk.fsf@prevas.dk/\nFixes: 3d252160b818 (\"fs/pipe: Read pipe-\u003e{head,tail} atomically outside pipe-\u003emutex\")Cc: Oleg Nesterov \u003coleg@redhat.com\u003e\nCc: Mateusz Guzik \u003cmjguzik@gmail.com\u003e\nCc: K Prateek Nayak \u003ckprateek.nayak@amd.com\u003e\nCc: Swapnil Sapkal \u003cswapnil.sapkal@amd.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "74d42bdb3a4673b1c10d1f457184e4d3c9cb0196", "tree": "471dd914993c371f8c26e45fcfa3f9592230ca5d", "parents": [ "848e076317446f9c663771ddec142d7c2eb4cb43" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 06 07:30:42 2025 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Mar 06 07:30:42 2025 -1000" }, "message": "fs/pipe: express \u0027pipe_empty()\u0027 in terms of \u0027pipe_occupancy()\u0027\n\nThat\u0027s what \u0027pipe_full()\u0027 does, so it\u0027s more consistent. But more\nimportantly it gets the type limits right when the pipe head and tail\nare no longer necessarily \u0027unsigned int\u0027.\n\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "b13abcb7ddd8d38de769486db5bd917537b32ab1", "tree": "2190748d35f2d4c3d6231a1a3db92c5c2b87521e", "parents": [ "ff712188daa3fe3ce7e11e530b4dca3826dae14a" ], "author": { "name": "Andrei Kuchynski", "email": "akuchynski@chromium.org", "time": "Wed Mar 05 11:17:39 2025 +0000" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Mar 06 16:55:46 2025 +0100" }, "message": "usb: typec: ucsi: Fix NULL pointer access\n\nResources should be released only after all threads that utilize them\nhave been destroyed.\nThis commit ensures that resources are not released prematurely by waiting\nfor the associated workqueue to complete before deallocating them.\n\nCc: stable \u003cstable@kernel.org\u003e\nFixes: b9aa02ca39a4 (\"usb: typec: ucsi: Add polling mechanism for partner tasks like alt mode checking\")\nSigned-off-by: Andrei Kuchynski \u003cakuchynski@chromium.org\u003e\nReviewed-by: Heikki Krogerus \u003cheikki.krogerus@linux.intel.com\u003e\nLink: https://lore.kernel.org/r/20250305111739.1489003-2-akuchynski@chromium.org\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "ff712188daa3fe3ce7e11e530b4dca3826dae14a", "tree": "3b04f185f858f83a257a322e43fbcdeb1531a093", "parents": [ "c7c1f3b05c67173f462d73d301d572b3f9e57e3b" ], "author": { "name": "Miao Li", "email": "limiao@kylinos.cn", "time": "Tue Mar 04 15:07:57 2025 +0800" }, "committer": { "name": "Greg Kroah-Hartman", "email": "gregkh@linuxfoundation.org", "time": "Thu Mar 06 16:50:24 2025 +0100" }, "message": "usb: quirks: Add DELAY_INIT and NO_LPM for Prolific Mass Storage Card Reader\n\nWhen used on Huawei hisi platforms, Prolific Mass Storage Card Reader\nwhich the VID:PID is in 067b:2731 might fail to enumerate at boot time\nand doesn\u0027t work well with LPM enabled, combination quirks:\n\tUSB_QUIRK_DELAY_INIT + USB_QUIRK_NO_LPM\nfixed the problems.\n\nSigned-off-by: Miao Li \u003climiao@kylinos.cn\u003e\nCc: stable \u003cstable@kernel.org\u003e\nLink: https://lore.kernel.org/r/20250304070757.139473-1-limiao870622@163.com\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n" }, { "commit": "391b41f983bf7ff853de44704d8e14e7cc648a9b", "tree": "6e9cd7c9372d4f3459100883e83a20777ea66247", "parents": [ "f02c41f87cfe61440c18bf77d1ef0a884b9ee2b5" ], "author": { "name": "Fabrizio Castro", "email": "fabrizio.castro.jz@renesas.com", "time": "Wed Mar 05 16:37:50 2025 +0000" }, "committer": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@linaro.org", "time": "Thu Mar 06 15:51:27 2025 +0100" }, "message": "gpio: rcar: Fix missing of_node_put() call\n\nof_parse_phandle_with_fixed_args() requires its caller to\ncall into of_node_put() on the node pointer from the output\nstructure, but such a call is currently missing.\n\nCall into of_node_put() to rectify that.\n\nFixes: 159f8a0209af (\"gpio-rcar: Add DT support\")\nSigned-off-by: Fabrizio Castro \u003cfabrizio.castro.jz@renesas.com\u003e\nReviewed-by: Lad Prabhakar \u003cprabhakar.mahadev-lad.rj@bp.renesas.com\u003e\nReviewed-by: Geert Uytterhoeven \u003cgeert+renesas@glider.be\u003e\nLink: https://lore.kernel.org/r/20250305163753.34913-2-fabrizio.castro.jz@renesas.com\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@linaro.org\u003e\n" }, { "commit": "35d99c68af40a8ca175babc5a89ef7e2226fb3ca", "tree": "5edcdce3fc0f6bd6a8763ffbb7f55f3c6077b941", "parents": [ "2df2c6ed89600a02e1c7a581a6a55e53c38ce0f5" ], "author": { "name": "Haoxiang Li", "email": "haoxiang_li2024@163.com", "time": "Mon Mar 03 10:42:33 2025 +0800" }, "committer": { "name": "David Sterba", "email": "dsterba@suse.com", "time": "Thu Mar 06 14:40:09 2025 +0100" }, "message": "btrfs: fix a leaked chunk map issue in read_one_chunk()\n\nAdd btrfs_free_chunk_map() to free the memory allocated\nby btrfs_alloc_chunk_map() if btrfs_add_chunk_map() fails.\n\nFixes: 7dc66abb5a47 (\"btrfs: use a dedicated data structure for chunk maps\")\nCC: stable@vger.kernel.org\nReviewed-by: Qu Wenruo \u003cwqu@suse.com\u003e\nReviewed-by: Filipe Manana \u003cfdmanana@suse.com\u003e\nSigned-off-by: Haoxiang Li \u003chaoxiang_li2024@163.com\u003e\nSigned-off-by: David Sterba \u003cdsterba@suse.com\u003e\n" }, { "commit": "ca57b5bfa214063a109ae9bc85862ce3ed155027", "tree": "0be8fc358d9ffeb01562885f78a5f5fd35a96604", "parents": [ "e06472bab2a5393430cc2fbc3211cd3602422c1e", "528361c49962708a60f51a1afafeb00987cebedf" ], "author": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu Mar 06 04:32:46 2025 -0700" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Thu Mar 06 04:32:46 2025 -0700" }, "message": "Merge tag \u0027nvme-6.14-2025-03-05\u0027 of git://git.infradead.org/nvme into block-6.14\n\nPull NVMe fixe from Keith:\n\n\"nvme fixes for Linux 6.14\n\n - TCP use after free fix on polling (Sagi)\n - Controller memory buffer cleanup fixes (Icenowy)\n - Free leaking requests on bad user passthrough commands (Keith)\n - TCP error message fix (Maurizio)\n - TCP corruption fix on partial PDU (Maurizio)\n - TCP memory ordering fix for weakly ordered archs (Meir)\n - Type coercion fix on message error for TCP (Dan)\"\n\n* tag \u0027nvme-6.14-2025-03-05\u0027 of git://git.infradead.org/nvme:\n nvme-tcp: fix signedness bug in nvme_tcp_init_connection()\n nvmet-tcp: Fix a possible sporadic response drops in weakly ordered arch\n nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()\n nvme-tcp: Fix a C2HTermReq error message\n nvmet: remove old function prototype\n nvme-ioctl: fix leaked requests on mapping error\n nvme-pci: skip CMB blocks incompatible with PCI P2P DMA\n nvme-pci: clean up CMBMSC when registering CMB fails\n nvme-tcp: fix possible UAF in nvme_tcp_poll\n" }, { "commit": "b5e3956535466187657563b754ba0f1da8626c7f", "tree": "8cebc4ea512260d7ec4e6fe67eddf5f7e1b59369", "parents": [ "dd0b7d4a56e3349de65bf9752734510fb55baf29" ], "author": { "name": "Inochi Amaoto", "email": "inochiama@gmail.com", "time": "Thu Mar 06 14:39:51 2025 +0800" }, "committer": { "name": "Masahiro Yamada", "email": "masahiroy@kernel.org", "time": "Thu Mar 06 20:32:30 2025 +0900" }, "message": "kbuild: install-extmod-build: Fix build when specifying KBUILD_OUTPUT\n\nSince commit 5f73e7d0386d (\"kbuild: refactor cross-compiling\nlinux-headers package\"), the linux-headers pacman package fails\nto build when \"O\u003d\" is set. The build system complains:\n\n/mnt/chroot/linux/scripts/Makefile.build:41: mnt/chroots/linux-mainline/pacman/linux-upstream/pkg/linux-upstream-headers/usr//lib/modules/6.14.0-rc3-00350-g771dba31fffc/build/scripts/Makefile: No such file or directory\n\nThis is because the \"srcroot\" variable is set to \".\" and the\n\"build\" variable is set to the absolute path. This makes the\n\"src\" variables point to wrong directory.\n\nChange the \"build\" variable to a relative path to \".\" to\nfix build.\n\nFixes: 5f73e7d0386d (\"kbuild: refactor cross-compiling linux-headers package\")\nSigned-off-by: Inochi Amaoto \u003cinochiama@gmail.com\u003e\nSigned-off-by: Masahiro Yamada \u003cmasahiroy@kernel.org\u003e\n" }, { "commit": "5da15a9c11c1c47ef573e6805b60a7d8a1687a2a", "tree": "0da14a089264858caca5167bcd8cf5597e566f56", "parents": [ "0e7633d7b95b67f1758aea19f8e85621c5f506a3" ], "author": { "name": "Justin Iurman", "email": "justin.iurman@uliege.be", "time": "Wed Mar 05 09:16:55 2025 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Mar 06 11:08:45 2025 +0100" }, "message": "net: ipv6: fix missing dst ref drop in ila lwtunnel\n\nAdd missing skb_dst_drop() to drop reference to the old dst before\nadding the new dst to the skb.\n\nFixes: 79ff2fc31e0f (\"ila: Cache a route to translated address\")\nCc: Tom Herbert \u003ctom@herbertland.com\u003e\nSigned-off-by: Justin Iurman \u003cjustin.iurman@uliege.be\u003e\nLink: https://patch.msgid.link/20250305081655.19032-1-justin.iurman@uliege.be\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "0e7633d7b95b67f1758aea19f8e85621c5f506a3", "tree": "3f57406e32768f6a17fbcd85e3af3be9ec7de2c1", "parents": [ "cf7ee25e70c6edfac4553d6b671e8b19db1d9573" ], "author": { "name": "Justin Iurman", "email": "justin.iurman@uliege.be", "time": "Tue Mar 04 19:10:39 2025 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Mar 06 10:48:57 2025 +0100" }, "message": "net: ipv6: fix dst ref loop in ila lwtunnel\n\nThis patch follows commit 92191dd10730 (\"net: ipv6: fix dst ref loops in\nrpl, seg6 and ioam6 lwtunnels\") and, on a second thought, the same patch\nis also needed for ila (even though the config that triggered the issue\nwas pathological, but still, we don\u0027t want that to happen).\n\nFixes: 79ff2fc31e0f (\"ila: Cache a route to translated address\")\nCc: Tom Herbert \u003ctom@herbertland.com\u003e\nSigned-off-by: Justin Iurman \u003cjustin.iurman@uliege.be\u003e\nLink: https://patch.msgid.link/20250304181039.35951-1-justin.iurman@uliege.be\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "cf7ee25e70c6edfac4553d6b671e8b19db1d9573", "tree": "e0df5cc39c3fe38ff42f9deea47ccf5702061d9a", "parents": [ "ccc2f5a436fbb0ae1fb598932a9b8e48423c1959" ], "author": { "name": "Matt Johnston", "email": "matt@codeconstruct.com.au", "time": "Tue Mar 04 13:59:51 2025 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Mar 06 10:33:07 2025 +0100" }, "message": "mctp i3c: handle NULL header address\n\ndaddr can be NULL if there is no neighbour table entry present,\nin that case the tx packet should be dropped.\n\nsaddr will usually be set by MCTP core, but check for NULL in case a\npacket is transmitted by a different protocol.\n\nSigned-off-by: Matt Johnston \u003cmatt@codeconstruct.com.au\u003e\nFixes: c8755b29b58e (\"mctp i3c: MCTP I3C driver\")\nLink: https://patch.msgid.link/20250304-mctp-i3c-null-v1-1-4416bbd56540@codeconstruct.com.au\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "b1536481c81fb604074da799e4f2d2038a1663f7", "tree": "c42c590abcb5eed4062e028738a97d17e94f876d", "parents": [ "14672f059d83f591afb2ee1fff56858efe055e5a" ], "author": { "name": "Shrikanth Hegde", "email": "sshegde@linux.ibm.com", "time": "Thu Mar 06 10:59:54 2025 +0530" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Thu Mar 06 10:21:31 2025 +0100" }, "message": "sched/rt: Update limit of sched_rt sysctl in documentation\n\nBy default fair_server dl_server allocates 5% of the bandwidth to the root\ndomain. Due to this writing any value less than 5% fails due to -EBUSY:\n\n $ cat /proc/sys/kernel/sched_rt_period_us\n 1000000\n\n $ echo 49999 \u003e /proc/sys/kernel/sched_rt_runtime_us\n -bash: echo: write error: Device or resource busy\n\n $ echo 50000 \u003e /proc/sys/kernel/sched_rt_runtime_us\n $\n\nSince the sched_rt_runtime_us allows -1 as the minimum, put this\nrestriction in the documentation.\n\nOne should check average of runtime/period in\n/sys/kernel/debug/sched/fair_server/cpuX/* for exact value.\n\nSigned-off-by: Shrikanth Hegde \u003csshegde@linux.ibm.com\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nReviewed-by: Juri Lelli \u003cjuri.lelli@redhat.com\u003e\nLink: https://lore.kernel.org/r/20250306052954.452005-3-sshegde@linux.ibm.com\n" }, { "commit": "14672f059d83f591afb2ee1fff56858efe055e5a", "tree": "99ca9727bd36f6eb0194f53dc8fd03715d34d283", "parents": [ "3b4035ddbfc8e4521f85569998a7569668cccf51" ], "author": { "name": "Shrikanth Hegde", "email": "sshegde@linux.ibm.com", "time": "Thu Mar 06 10:59:53 2025 +0530" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Thu Mar 06 10:21:31 2025 +0100" }, "message": "sched/deadline: Use online cpus for validating runtime\n\nThe ftrace selftest reported a failure because writing -1 to\nsched_rt_runtime_us returns -EBUSY. This happens when the possible\nCPUs are different from active CPUs.\n\nActive CPUs are part of one root domain, while remaining CPUs are part\nof def_root_domain. Since active cpumask is being used, this results in\ncpus\u003d0 when a non active CPUs is used in the loop.\n\nFix it by looping over the online CPUs instead for validating the\nbandwidth calculations.\n\nSigned-off-by: Shrikanth Hegde \u003csshegde@linux.ibm.com\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nReviewed-by: Juri Lelli \u003cjuri.lelli@redhat.com\u003e\nLink: https://lore.kernel.org/r/20250306052954.452005-2-sshegde@linux.ibm.com\n" }, { "commit": "d385c8bceb14665e935419334aa3d3fac2f10456", "tree": "4b3abd62055a41c32ba1ae010d863368eb50d652", "parents": [ "50dc696c3a482ea35bd0691f728d47e40b668483" ], "author": { "name": "Michal Koutný", "email": "mkoutny@suse.com", "time": "Wed Mar 05 15:58:49 2025 +0100" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Thu Mar 06 10:18:36 2025 +0100" }, "message": "pid: Do not set pid_max in new pid namespaces\n\nIt is already difficult for users to troubleshoot which of multiple pid\nlimits restricts their workload. The per-(hierarchical-)NS pid_max would\ncontribute to the confusion.\nAlso, the implementation copies the limit upon creation from\nparent, this pattern showed cumbersome with some attributes in legacy\ncgroup controllers -- it\u0027s subject to race condition between parent\u0027s\nlimit modification and children creation and once copied it must be\nchanged in the descendant.\n\nLet\u0027s do what other places do (ucounts or cgroup limits) -- create new\npid namespaces without any limit at all. The global limit (actually any\nancestor\u0027s limit) is still effectively in place, we avoid the\nset/unshare race and bumps of global (ancestral) limit have the desired\neffect on pid namespace that do not care.\n\nLink: https://lore.kernel.org/r/20240408145819.8787-1-mkoutny@suse.com/\nLink: https://lore.kernel.org/r/20250221170249.890014-1-mkoutny@suse.com/\nFixes: 7863dcc72d0f4 (\"pid: allow pid_max to be set per pid namespace\")\nSigned-off-by: Michal Koutný \u003cmkoutny@suse.com\u003e\nLink: https://lore.kernel.org/r/20250305145849.55491-1-mkoutny@suse.com\nSigned-off-by: Christian Brauner \u003cbrauner@kernel.org\u003e\n" }, { "commit": "80da96d735094ea22985ced98bc57fe3a4422921", "tree": "5a9d9da5cebbbc9c1b7cf7811c48a6e87f4c047f", "parents": [ "23e0832d6d7be2d3c713f9390c060b6f1c48bf36" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Tue Mar 04 14:41:57 2025 +0100" }, "committer": { "name": "Thomas Zimmermann", "email": "tzimmermann@suse.de", "time": "Thu Mar 06 08:54:42 2025 +0100" }, "message": "drm/bochs: Fix DPMS regression\n\nThe recent rewrite with the use of regular atomic helpers broke the\nDPMS unblanking on X11. Fix it by moving the call of\nbochs_hw_blank(false) from CRTC mode_set_nofb() to atomic_enable().\n\nFixes: 2037174993c8 (\"drm/bochs: Use regular atomic helpers\")\nLink: https://bugzilla.suse.com/show_bug.cgi?id\u003d1238209\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nReviewed-by: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nSigned-off-by: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nLink: https://patchwork.freedesktop.org/patch/msgid/20250304134203.20534-1-tiwai@suse.de\n" }, { "commit": "8fe9ed44dc29fba0786b7e956d2e87179e407582", "tree": "fc207a0d3603ca609891a0a8532f8fc4db819693", "parents": [ "e842f9a1edf306bf36fe2a4d847a0b0d458770de" ], "author": { "name": "Hao Zhang", "email": "zhanghao1@kylinos.cn", "time": "Thu Feb 27 11:41:29 2025 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Mar 05 21:36:20 2025 -0800" }, "message": "mm/page_alloc: fix uninitialized variable\n\nThe variable \"compact_result\" is not initialized in function\n__alloc_pages_slowpath(). It causes should_compact_retry() to use an\nuninitialized value.\n\nInitialize variable \"compact_result\" with the value COMPACT_SKIPPED.\n\nBUG: KMSAN: uninit-value in __alloc_pages_slowpath+0xee8/0x16c0 mm/page_alloc.c:4416\n __alloc_pages_slowpath+0xee8/0x16c0 mm/page_alloc.c:4416\n __alloc_frozen_pages_noprof+0xa4c/0xe00 mm/page_alloc.c:4752\n alloc_pages_mpol+0x4cd/0x890 mm/mempolicy.c:2270\n alloc_frozen_pages_noprof mm/mempolicy.c:2341 [inline]\n alloc_pages_noprof mm/mempolicy.c:2361 [inline]\n folio_alloc_noprof+0x1dc/0x350 mm/mempolicy.c:2371\n filemap_alloc_folio_noprof+0xa6/0x440 mm/filemap.c:1019\n __filemap_get_folio+0xb9a/0x1840 mm/filemap.c:1970\n grow_dev_folio fs/buffer.c:1039 [inline]\n grow_buffers fs/buffer.c:1105 [inline]\n __getblk_slow fs/buffer.c:1131 [inline]\n bdev_getblk+0x2c9/0xab0 fs/buffer.c:1431\n getblk_unmovable include/linux/buffer_head.h:369 [inline]\n ext4_getblk+0x3b7/0xe50 fs/ext4/inode.c:864\n ext4_bread_batch+0x9f/0x7d0 fs/ext4/inode.c:933\n __ext4_find_entry+0x1ebb/0x36c0 fs/ext4/namei.c:1627\n ext4_lookup_entry fs/ext4/namei.c:1729 [inline]\n ext4_lookup+0x189/0xb40 fs/ext4/namei.c:1797\n __lookup_slow+0x538/0x710 fs/namei.c:1793\n lookup_slow+0x6a/0xd0 fs/namei.c:1810\n walk_component fs/namei.c:2114 [inline]\n link_path_walk+0xf29/0x1420 fs/namei.c:2479\n path_openat+0x30f/0x6250 fs/namei.c:3985\n do_filp_open+0x268/0x600 fs/namei.c:4016\n do_sys_openat2+0x1bf/0x2f0 fs/open.c:1428\n do_sys_open fs/open.c:1443 [inline]\n __do_sys_openat fs/open.c:1459 [inline]\n __se_sys_openat fs/open.c:1454 [inline]\n __x64_sys_openat+0x2a1/0x310 fs/open.c:1454\n x64_sys_call+0x36f5/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:258\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nLocal variable compact_result created at:\n __alloc_pages_slowpath+0x66/0x16c0 mm/page_alloc.c:4218\n __alloc_frozen_pages_noprof+0xa4c/0xe00 mm/page_alloc.c:4752\n\nLink: https://lkml.kernel.org/r/tencent_ED1032321D6510B145CDBA8CBA0093178E09@qq.com\nReported-by: syzbot+0cfd5e38e96a5596f2b6@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d0cfd5e38e96a5596f2b6\nSigned-off-by: Hao Zhang \u003czhanghao1@kylinos.cn\u003e\nReviewed-by: Vlastimil Babka \u003cvbabka@suse.cz\u003e\nCc: Michal Hocko \u003cmhocko@kernel.org\u003e\nCc: Mel Gorman \u003cmgorman@techsingularity.net\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "e842f9a1edf306bf36fe2a4d847a0b0d458770de", "tree": "7868fa924473343624a31e178df3d937e95899ba", "parents": [ "b2ef51c74b0171fde7eb69b6152d3d2f743ef269" ], "author": { "name": "Haoxiang Li", "email": "haoxiang_li2024@163.com", "time": "Thu Feb 27 12:11:31 2025 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Mar 05 21:36:19 2025 -0800" }, "message": "rapidio: add check for rio_add_net() in rio_scan_alloc_net()\n\nThe return value of rio_add_net() should be checked. If it fails,\nput_device() should be called to free the memory and give up the reference\ninitialized in rio_add_net().\n\nLink: https://lkml.kernel.org/r/20250227041131.3680761-1-haoxiang_li2024@163.com\nFixes: e6b585ca6e81 (\"rapidio: move net allocation into core code\")\nSigned-off-by: Yang Yingliang \u003cyangyingliang@huawei.com\u003e\nSigned-off-by: Haoxiang Li \u003chaoxiang_li2024@163.com\u003e\nCc: Alexandre Bounine \u003calex.bou9@gmail.com\u003e\nCc: Matt Porter \u003cmporter@kernel.crashing.org\u003e\nCc: Dan Carpenter \u003cdan.carpenter@linaro.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "b2ef51c74b0171fde7eb69b6152d3d2f743ef269", "tree": "546885f206051f8148f57c3b23dfc24c0676bbd5", "parents": [ "88f5a9a945bf25df1f90032baf95457370c2206e" ], "author": { "name": "Haoxiang Li", "email": "haoxiang_li2024@163.com", "time": "Thu Feb 27 15:34:09 2025 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Mar 05 21:36:19 2025 -0800" }, "message": "rapidio: fix an API misues when rio_add_net() fails\n\nrio_add_net() calls device_register() and fails when device_register()\nfails. Thus, put_device() should be used rather than kfree(). Add\n\"mport-\u003enet \u003d NULL;\" to avoid a use after free issue.\n\nLink: https://lkml.kernel.org/r/20250227073409.3696854-1-haoxiang_li2024@163.com\nFixes: e8de370188d0 (\"rapidio: add mport char device driver\")\nSigned-off-by: Haoxiang Li \u003chaoxiang_li2024@163.com\u003e\nReviewed-by: Dan Carpenter \u003cdan.carpenter@linaro.org\u003e\nCc: Alexandre Bounine \u003calex.bou9@gmail.com\u003e\nCc: Matt Porter \u003cmporter@kernel.crashing.org\u003e\nCc: Yang Yingliang \u003cyangyingliang@huawei.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "88f5a9a945bf25df1f90032baf95457370c2206e", "tree": "78ff15be53d39aed702c7d47b621ea6fcc2e3906", "parents": [ "eae116d1f0449ade3269ca47a67432622f5c6438" ], "author": { "name": "Sumit Garg", "email": "sumit.garg@linaro.org", "time": "Thu Feb 27 17:02:28 2025 +0530" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Mar 05 21:36:19 2025 -0800" }, "message": "MAINTAINERS: .mailmap: update Sumit Garg\u0027s email address\n\nUpdate Sumit Garg\u0027s email address to @kernel.org.\n\nLink: https://lkml.kernel.org/r/20250227113228.1809449-1-sumit.garg@linaro.org\nSigned-off-by: Sumit Garg \u003csumit.garg@linaro.org\u003e\nCc: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nCc: Jarkko Sakkinen \u003cjarkko@kernel.org\u003e\nCc: Jens Wiklander \u003cjens.wiklander@linaro.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "eae116d1f0449ade3269ca47a67432622f5c6438", "tree": "f93381d7c17d8d322dd1198071bd7b8c3592b1bf", "parents": [ "34b82f33cf3f03bc39e9a205a913d790e1520ade" ], "author": { "name": "Gabriel Krisman Bertazi", "email": "krisman@suse.de", "time": "Tue Feb 25 22:22:58 2025 -0500" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Mar 05 21:36:19 2025 -0800" }, "message": "Revert \"mm/page_alloc.c: don\u0027t show protection in zone\u0027s -\u003elowmem_reserve[] for empty zone\"\n\nCommit 96a5c186efff (\"mm/page_alloc.c: don\u0027t show protection in zone\u0027s\n-\u003elowmem_reserve[] for empty zone\") removes the protection of lower zones\nfrom allocations targeting memory-less high zones. This had an unintended\nimpact on the pattern of reclaims because it makes the high-zone-targeted\nallocation more likely to succeed in lower zones, which adds pressure to\nsaid zones. I.e, the following corresponding checks in\nzone_watermark_ok/zone_watermark_fast are less likely to trigger:\n\n if (free_pages \u003c\u003d min + z-\u003elowmem_reserve[highest_zoneidx])\n return false;\n\nAs a result, we are observing an increase in reclaim and kswapd scans, due\nto the increased pressure. This was initially observed as increased\nlatency in filesystem operations when benchmarking with fio on a machine\nwith some memory-less zones, but it has since been associated with\nincreased contention in locks related to memory reclaim. By reverting\nthis patch, the original performance was recovered on that machine.\n\nThe original commit was introduced as a clarification of the\n/proc/zoneinfo output, so it doesn\u0027t seem there are usecases depending on\nit, making the revert a simple solution.\n\nFor reference, I collected vmstat with and without this patch on a freshly\nbooted system running intensive randread io from an nvme for 5 minutes. I\ngot:\n\nrpm-6.12.0-slfo.1.2 -\u003e pgscan_kswapd 5629543865\nPatched -\u003e pgscan_kswapd 33580844\n\n33M scans is similar to what we had in kernels predating this patch. \nThese numbers is fairly representative of the workload on this machine, as\nmeasured in several runs. So we are talking about a 2-order of magnitude\nincrease.\n\nLink: https://lkml.kernel.org/r/20250226032258.234099-1-krisman@suse.de\nFixes: 96a5c186efff (\"mm/page_alloc.c: don\u0027t show protection in zone\u0027s -\u003elowmem_reserve[] for empty zone\")\nSigned-off-by: Gabriel Krisman Bertazi \u003ckrisman@suse.de\u003e\nReviewed-by: Vlastimil Babka \u003cvbabka@suse.cz\u003e\nAcked-by: Michal Hocko \u003cmhocko@suse.com\u003e\nAcked-by: Mel Gorman \u003cmgorman@suse.de\u003e\nCc: Baoquan He \u003cbhe@redhat.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "34b82f33cf3f03bc39e9a205a913d790e1520ade", "tree": "39da404285db9b2751977f39f699843b14727f94", "parents": [ "3685024edd270f7c791f993157d65d3c928f3d6e" ], "author": { "name": "Brian Geffon", "email": "bgeffon@google.com", "time": "Wed Feb 26 11:23:41 2025 -0500" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Mar 05 21:36:18 2025 -0800" }, "message": "mm: fix finish_fault() handling for large folios\n\nWhen handling faults for anon shmem finish_fault() will attempt to install\nptes for the entire folio. Unfortunately if it encounters a single\nnon-pte_none entry in that range it will bail, even if the pte that\ntriggered the fault is still pte_none. When this situation happens the\nfault will be retried endlessly never making forward progress.\n\nThis patch fixes this behavior and if it detects that a pte in the range\nis not pte_none it will fall back to setting a single pte.\n\n[bgeffon@google.com: tweak whitespace]\n Link: https://lkml.kernel.org/r/20250227133236.1296853-1-bgeffon@google.com\nLink: https://lkml.kernel.org/r/20250226162341.915535-1-bgeffon@google.com\nFixes: 43e027e41423 (\"mm: memory: extend finish_fault() to support large folio\")\nSigned-off-by: Brian Geffon \u003cbgeffon@google.com\u003e\nSuggested-by: Baolin Wang \u003cbaolin.wang@linux.alibaba.com\u003e\nReported-by: Marek Maslanka \u003cmmaslanka@google.com\u003e\nCc: Hugh Dickins \u003chughd@google.com\u003e\nCc: David Hildenbrand \u003cdavid@redhat.com\u003e\nCc: Hugh Dickens \u003chughd@google.com\u003e\nCc: Kefeng Wang \u003cwangkefeng.wang@huawei.com\u003e\nCc: Matthew Wilcow (Oracle) \u003cwilly@infradead.org\u003e\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: Zi Yan \u003cziy@nvidia.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "3685024edd270f7c791f993157d65d3c928f3d6e", "tree": "0a9f2f2f2895176e4aa516c57df03e1e901b7a82", "parents": [ "adae46ac1e38a288b14f0298e27412adcba83f8e" ], "author": { "name": "Ryan Roberts", "email": "ryan.roberts@arm.com", "time": "Wed Feb 26 12:16:09 2025 +0000" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Mar 05 21:36:18 2025 -0800" }, "message": "mm: don\u0027t skip arch_sync_kernel_mappings() in error paths\n\nFix callers that previously skipped calling arch_sync_kernel_mappings() if\nan error occurred during a pgtable update. The call is still required to\nsync any pgtable updates that may have occurred prior to hitting the error\ncondition.\n\nThese are theoretical bugs discovered during code review.\n\nLink: https://lkml.kernel.org/r/20250226121610.2401743-1-ryan.roberts@arm.com\nFixes: 2ba3e6947aed (\"mm/vmalloc: track which page-table levels were modified\")\nFixes: 0c95cba49255 (\"mm: apply_to_pte_range warn and fail if a large pte is encountered\")\nSigned-off-by: Ryan Roberts \u003cryan.roberts@arm.com\u003e\nReviewed-by: Anshuman Khandual \u003canshuman.khandual@arm.com\u003e\nReviewed-by: Catalin Marinas \u003ccatalin.marinas@arm.com\u003e\nCc: Christop Hellwig \u003chch@infradead.org\u003e\nCc: \"Uladzislau Rezki (Sony)\" \u003curezki@gmail.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "adae46ac1e38a288b14f0298e27412adcba83f8e", "tree": "45358d03b226438c6738141d41182190591da0a6", "parents": [ "927e926d72d9155fde3264459fe9bfd7b5e40d28" ], "author": { "name": "Ricardo Cañuelo Navarro", "email": "rcn@igalia.com", "time": "Wed Feb 26 13:26:27 2025 +0100" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Mar 05 21:36:18 2025 -0800" }, "message": "mm: shmem: remove unnecessary warning in shmem_writepage()\n\nAlthough the scenario where shmem_writepage() is called with info-\u003eflags \u0026\nVM_LOCKED is unlikely to happen, it\u0027s still possible, as evidenced by\nsyzbot [1]. However, the warning in this case isn\u0027t necessary because the\nsituation is already handled correctly [2].\n\n[2] https://lore.kernel.org/lkml/8afe1f7f-31a2-4fc0-1fbd-f9ba8a116fe3@google.com/\n\nLink: https://lkml.kernel.org/r/20250226-20250221-warning-in-shmem_writepage-v1-1-5ad19420e17e@igalia.com\nFixes: 9a976f0c847b (\"shmem: skip page split if we\u0027re not reclaiming\")\nSigned-off-by: Ricardo Cañuelo Navarro \u003crcn@igalia.com\u003e\nReported-by: Pengfei Xu \u003cpengfei.xu@intel.com\u003e\nCloses: https://lore.kernel.org/lkml/ZZ9PShXjKJkVelNm@xpf.sh.intel.com/ [1]\nSuggested-by: Hugh Dickins \u003chughd@google.com\u003e\nReviewed-by: Baolin Wang \u003cbaolin.wang@linux.alibaba.com\u003e\nCc: Florent Revest \u003crevest@chromium.org\u003e\nCc: Christian Brauner \u003cbrauner@kernel.org\u003e\nCc: David Hildenbrand \u003cdavid@redhat.com\u003e\nCc: Davidlohr Bueso \u003cdave@stgolabs.net\u003e\nCc: Florent Revest \u003crevest@chromium.org\u003e\nCc: Luis Chamberalin \u003cmcgrof@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "927e926d72d9155fde3264459fe9bfd7b5e40d28", "tree": "ce7e6f6074916b9c8d36753e3dc35538dcf47c68", "parents": [ "37b338eed10581784e854d4262da05c8d960c748" ], "author": { "name": "Suren Baghdasaryan", "email": "surenb@google.com", "time": "Wed Feb 26 10:55:09 2025 -0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Mar 05 21:36:18 2025 -0800" }, "message": "userfaultfd: fix PTE unmapping stack-allocated PTE copies\n\nCurrent implementation of move_pages_pte() copies source and destination\nPTEs in order to detect concurrent changes to PTEs involved in the move. \nHowever these copies are also used to unmap the PTEs, which will fail if\nCONFIG_HIGHPTE is enabled because the copies are allocated on the stack. \nFix this by using the actual PTEs which were kmap()ed.\n\nLink: https://lkml.kernel.org/r/20250226185510.2732648-3-surenb@google.com\nFixes: adef440691ba (\"userfaultfd: UFFDIO_MOVE uABI\")\nSigned-off-by: Suren Baghdasaryan \u003csurenb@google.com\u003e\nReported-by: Peter Xu \u003cpeterx@redhat.com\u003e\nReviewed-by: Peter Xu \u003cpeterx@redhat.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Barry Song \u003c21cnbao@gmail.com\u003e\nCc: Barry Song \u003cv-songbaohua@oppo.com\u003e\nCc: David Hildenbrand \u003cdavid@redhat.com\u003e\nCc: Hugh Dickins \u003chughd@google.com\u003e\nCc: Jann Horn \u003cjannh@google.com\u003e\nCc: Kalesh Singh \u003ckaleshsingh@google.com\u003e\nCc: Liam R. Howlett \u003cLiam.Howlett@Oracle.com\u003e\nCc: Lokesh Gidra \u003clokeshgidra@google.com\u003e\nCc: Lorenzo Stoakes \u003clorenzo.stoakes@oracle.com\u003e\nCc: Matthew Wilcow (Oracle) \u003cwilly@infradead.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "37b338eed10581784e854d4262da05c8d960c748", "tree": "d62ed6435a896c4ea500e44efc79db67d7bd4096", "parents": [ "ea6de4f8f8f32e54662118a97c441a6ad7b24345" ], "author": { "name": "Suren Baghdasaryan", "email": "surenb@google.com", "time": "Wed Feb 26 10:55:08 2025 -0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Mar 05 21:36:17 2025 -0800" }, "message": "userfaultfd: do not block on locking a large folio with raised refcount\n\nLokesh recently raised an issue about UFFDIO_MOVE getting into a deadlock\nstate when it goes into split_folio() with raised folio refcount. \nsplit_folio() expects the reference count to be exactly mapcount +\nnum_pages_in_folio + 1 (see can_split_folio()) and fails with EAGAIN\notherwise.\n\nIf multiple processes are trying to move the same large folio, they raise\nthe refcount (all tasks succeed in that) then one of them succeeds in\nlocking the folio, while others will block in folio_lock() while keeping\nthe refcount raised. The winner of this race will proceed with calling\nsplit_folio() and will fail returning EAGAIN to the caller and unlocking\nthe folio. The next competing process will get the folio locked and will\ngo through the same flow. In the meantime the original winner will be\nretried and will block in folio_lock(), getting into the queue of waiting\nprocesses only to repeat the same path. All this results in a livelock.\n\nAn easy fix would be to avoid waiting for the folio lock while holding\nfolio refcount, similar to madvise_free_huge_pmd() where folio lock is\nacquired before raising the folio refcount. Since we lock and take a\nrefcount of the folio while holding the PTE lock, changing the order of\nthese operations should not break anything.\n\nModify move_pages_pte() to try locking the folio first and if that fails\nand the folio is large then return EAGAIN without touching the folio\nrefcount. If the folio is single-page then split_folio() is not called,\nso we don\u0027t have this issue. Lokesh has a reproducer [1] and I verified\nthat this change fixes the issue.\n\n[1] https://github.com/lokeshgidra/uffd_move_ioctl_deadlock\n\n[akpm@linux-foundation.org: reflow comment to 80 cols, s/end/end up/]\nLink: https://lkml.kernel.org/r/20250226185510.2732648-2-surenb@google.com\nFixes: adef440691ba (\"userfaultfd: UFFDIO_MOVE uABI\")\nSigned-off-by: Suren Baghdasaryan \u003csurenb@google.com\u003e\nReported-by: Lokesh Gidra \u003clokeshgidra@google.com\u003e\nReviewed-by: Peter Xu \u003cpeterx@redhat.com\u003e\nAcked-by: Liam R. Howlett \u003cLiam.Howlett@Oracle.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Barry Song \u003c21cnbao@gmail.com\u003e\nCc: Barry Song \u003cv-songbaohua@oppo.com\u003e\nCc: David Hildenbrand \u003cdavid@redhat.com\u003e\nCc: Hugh Dickins \u003chughd@google.com\u003e\nCc: Jann Horn \u003cjannh@google.com\u003e\nCc: Kalesh Singh \u003ckaleshsingh@google.com\u003e\nCc: Lorenzo Stoakes \u003clorenzo.stoakes@oracle.com\u003e\nCc: Matthew Wilcow (Oracle) \u003cwilly@infradead.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "ea6de4f8f8f32e54662118a97c441a6ad7b24345", "tree": "3b28711d5d45e6a901bc8fadbdbf3962e54b8987", "parents": [ "058313515d5aab10d0a01dd634f92ed4a4e71d4c" ], "author": { "name": "Sun YangKai", "email": "sunk67188@gmail.com", "time": "Wed Feb 26 23:32:43 2025 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Mar 05 21:36:17 2025 -0800" }, "message": "mm: zswap: use ATOMIC_LONG_INIT to initialize zswap_stored_pages\n\nThis is currently the only atomic_long_t variable initialized by\nATOMIC_INIT macro found in the kernel by using `grep -r atomic_long_t |\ngrep ATOMIC_INIT`\n\nThis was introduced in 6e1fa555ec77, in which we modified the type of\nzswap_stored_pages to atomic_long_t, but didn\u0027t change the initialization.\n\nLink: https://lkml.kernel.org/r/20250226153253.19179-1-sunk67188@gmail.com\nFixes: 6e1fa555ec77 (\"mm: zswap: modify zswap_stored_pages to be atomic_long_t\")\nSigned-off-by: Sun YangKai \u003csunk67188@gmail.com\u003e\nAcked-by: Yosry Ahmed \u003cyosry.ahmed@linux.dev\u003e\nAcked-by: David Hildenbrand \u003cdavid@redhat.com\u003e\nCc: Chengming Zhou \u003cchengming.zhou@linux.dev\u003e\nCc: Johannes Weiner \u003channes@cmpxchg.org\u003e\nCc: Kanchana P Sridhar \u003ckanchana.p.sridhar@intel.com\u003e\nCc: Nhat Pham \u003cnphamcs@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "058313515d5aab10d0a01dd634f92ed4a4e71d4c", "tree": "6740c4d435e75147fcecbde6ecdbefbeab89f98c", "parents": [ "c50f8e6053b0503375c2975bf47f182445aebb4c" ], "author": { "name": "Baolin Wang", "email": "baolin.wang@linux.alibaba.com", "time": "Tue Feb 25 17:52:55 2025 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Mar 05 21:36:17 2025 -0800" }, "message": "mm: shmem: fix potential data corruption during shmem swapin\n\nAlex and Kairui reported some issues (system hang or data corruption) when\nswapping out or swapping in large shmem folios. This is especially easy\nto reproduce when the tmpfs is mount with the \u0027huge\u003dwithin_size\u0027\nparameter. Thanks to Kairui\u0027s reproducer, the issue can be easily\nreplicated.\n\nThe root cause of the problem is that swap readahead may asynchronously\nswap in order 0 folios into the swap cache, while the shmem mapping can\nstill store large swap entries. Then an order 0 folio is inserted into\nthe shmem mapping without splitting the large swap entry, which overwrites\nthe original large swap entry, leading to data corruption.\n\nWhen getting a folio from the swap cache, we should split the large swap\nentry stored in the shmem mapping if the orders do not match, to fix this\nissue.\n\nLink: https://lkml.kernel.org/r/2fe47c557e74e9df5fe2437ccdc6c9115fa1bf70.1740476943.git.baolin.wang@linux.alibaba.com\nFixes: 809bc86517cc (\"mm: shmem: support large folio swap out\")\nSigned-off-by: Baolin Wang \u003cbaolin.wang@linux.alibaba.com\u003e\nReported-by: Alex Xu (Hello71) \u003calex_y_xu@yahoo.ca\u003e\nReported-by: Kairui Song \u003cryncsn@gmail.com\u003e\nCloses: https://lore.kernel.org/all/1738717785.im3r5g2vxc.none@localhost/\nTested-by: Kairui Song \u003ckasong@tencent.com\u003e\nCc: David Hildenbrand \u003cdavid@redhat.com\u003e\nCc: Lance Yang \u003cioworker0@gmail.com\u003e\nCc: Matthew Wilcow \u003cwilly@infradead.org\u003e\nCc: Hugh Dickins \u003chughd@google.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "c50f8e6053b0503375c2975bf47f182445aebb4c", "tree": "b32bed9be0f164b18af21d40955a995f1a52434a", "parents": [ "582ccf78f6090d88b1c7066b1e90b3d9ec952d08" ], "author": { "name": "Barry Song", "email": "v-songbaohua@oppo.com", "time": "Wed Feb 26 13:14:00 2025 +1300" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Mar 05 21:36:17 2025 -0800" }, "message": "mm: fix kernel BUG when userfaultfd_move encounters swapcache\n\nuserfaultfd_move() checks whether the PTE entry is present or a\nswap entry.\n\n- If the PTE entry is present, move_present_pte() handles folio\n migration by setting:\n\n src_folio-\u003eindex \u003d linear_page_index(dst_vma, dst_addr);\n\n- If the PTE entry is a swap entry, move_swap_pte() simply copies\n the PTE to the new dst_addr.\n\nThis approach is incorrect because, even if the PTE is a swap entry,\nit can still reference a folio that remains in the swap cache.\n\nThis creates a race window between steps 2 and 4.\n 1. add_to_swap: The folio is added to the swapcache.\n 2. try_to_unmap: PTEs are converted to swap entries.\n 3. pageout: The folio is written back.\n 4. Swapcache is cleared.\nIf userfaultfd_move() occurs in the window between steps 2 and 4,\nafter the swap PTE has been moved to the destination, accessing the\ndestination triggers do_swap_page(), which may locate the folio in\nthe swapcache. However, since the folio\u0027s index has not been updated\nto match the destination VMA, do_swap_page() will detect a mismatch.\n\nThis can result in two critical issues depending on the system\nconfiguration.\n\nIf KSM is disabled, both small and large folios can trigger a BUG\nduring the add_rmap operation due to:\n\n page_pgoff(folio, page) !\u003d linear_page_index(vma, address)\n\n[ 13.336953] page: refcount:6 mapcount:1 mapping:00000000f43db19c index:0xffffaf150 pfn:0x4667c\n[ 13.337520] head: order:2 mapcount:1 entire_mapcount:0 nr_pages_mapped:1 pincount:0\n[ 13.337716] memcg:ffff00000405f000\n[ 13.337849] anon flags: 0x3fffc0000020459(locked|uptodate|dirty|owner_priv_1|head|swapbacked|node\u003d0|zone\u003d0|lastcpupid\u003d0xffff)\n[ 13.338630] raw: 03fffc0000020459 ffff80008507b538 ffff80008507b538 ffff000006260361\n[ 13.338831] raw: 0000000ffffaf150 0000000000004000 0000000600000000 ffff00000405f000\n[ 13.339031] head: 03fffc0000020459 ffff80008507b538 ffff80008507b538 ffff000006260361\n[ 13.339204] head: 0000000ffffaf150 0000000000004000 0000000600000000 ffff00000405f000\n[ 13.339375] head: 03fffc0000000202 fffffdffc0199f01 ffffffff00000000 0000000000000001\n[ 13.339546] head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000\n[ 13.339736] page dumped because: VM_BUG_ON_PAGE(page_pgoff(folio, page) !\u003d linear_page_index(vma, address))\n[ 13.340190] ------------[ cut here ]------------\n[ 13.340316] kernel BUG at mm/rmap.c:1380!\n[ 13.340683] Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP\n[ 13.340969] Modules linked in:\n[ 13.341257] CPU: 1 UID: 0 PID: 107 Comm: a.out Not tainted 6.14.0-rc3-gcf42737e247a-dirty #299\n[ 13.341470] Hardware name: linux,dummy-virt (DT)\n[ 13.341671] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE\u003d--)\n[ 13.341815] pc : __page_check_anon_rmap+0xa0/0xb0\n[ 13.341920] lr : __page_check_anon_rmap+0xa0/0xb0\n[ 13.342018] sp : ffff80008752bb20\n[ 13.342093] x29: ffff80008752bb20 x28: fffffdffc0199f00 x27: 0000000000000001\n[ 13.342404] x26: 0000000000000000 x25: 0000000000000001 x24: 0000000000000001\n[ 13.342575] x23: 0000ffffaf0d0000 x22: 0000ffffaf0d0000 x21: fffffdffc0199f00\n[ 13.342731] x20: fffffdffc0199f00 x19: ffff000006210700 x18: 00000000ffffffff\n[ 13.342881] x17: 6c203d2120296567 x16: 6170202c6f696c6f x15: 662866666f67705f\n[ 13.343033] x14: 6567617028454741 x13: 2929737365726464 x12: ffff800083728ab0\n[ 13.343183] x11: ffff800082996bf8 x10: 0000000000000fd7 x9 : ffff80008011bc40\n[ 13.343351] x8 : 0000000000017fe8 x7 : 00000000fffff000 x6 : ffff8000829eebf8\n[ 13.343498] x5 : c0000000fffff000 x4 : 0000000000000000 x3 : 0000000000000000\n[ 13.343645] x2 : 0000000000000000 x1 : ffff0000062db980 x0 : 000000000000005f\n[ 13.343876] Call trace:\n[ 13.344045] __page_check_anon_rmap+0xa0/0xb0 (P)\n[ 13.344234] folio_add_anon_rmap_ptes+0x22c/0x320\n[ 13.344333] do_swap_page+0x1060/0x1400\n[ 13.344417] __handle_mm_fault+0x61c/0xbc8\n[ 13.344504] handle_mm_fault+0xd8/0x2e8\n[ 13.344586] do_page_fault+0x20c/0x770\n[ 13.344673] do_translation_fault+0xb4/0xf0\n[ 13.344759] do_mem_abort+0x48/0xa0\n[ 13.344842] el0_da+0x58/0x130\n[ 13.344914] el0t_64_sync_handler+0xc4/0x138\n[ 13.345002] el0t_64_sync+0x1ac/0x1b0\n[ 13.345208] Code: aa1503e0 f000f801 910f6021 97ff5779 (d4210000)\n[ 13.345504] ---[ end trace 0000000000000000 ]---\n[ 13.345715] note: a.out[107] exited with irqs disabled\n[ 13.345954] note: a.out[107] exited with preempt_count 2\n\nIf KSM is enabled, Peter Xu also discovered that do_swap_page() may\ntrigger an unexpected CoW operation for small folios because\nksm_might_need_to_copy() allocates a new folio when the folio index\ndoes not match linear_page_index(vma, addr).\n\nThis patch also checks the swapcache when handling swap entries. If a\nmatch is found in the swapcache, it processes it similarly to a present\nPTE.\nHowever, there are some differences. For example, the folio is no longer\nexclusive because folio_try_share_anon_rmap_pte() is performed during\nunmapping.\nFurthermore, in the case of swapcache, the folio has already been\nunmapped, eliminating the risk of concurrent rmap walks and removing the\nneed to acquire src_folio\u0027s anon_vma or lock.\n\nNote that for large folios, in the swapcache handling path, we directly\nreturn -EBUSY since split_folio() will return -EBUSY regardless if\nthe folio is under writeback or unmapped. This is not an urgent issue,\nso a follow-up patch may address it separately.\n\n[v-songbaohua@oppo.com: minor cleanup according to Peter Xu]\n Link: https://lkml.kernel.org/r/20250226024411.47092-1-21cnbao@gmail.com\nLink: https://lkml.kernel.org/r/20250226001400.9129-1-21cnbao@gmail.com\nFixes: adef440691ba (\"userfaultfd: UFFDIO_MOVE uABI\")\nSigned-off-by: Barry Song \u003cv-songbaohua@oppo.com\u003e\nAcked-by: Peter Xu \u003cpeterx@redhat.com\u003e\nReviewed-by: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: Andrea Arcangeli \u003caarcange@redhat.com\u003e\nCc: Al Viro \u003cviro@zeniv.linux.org.uk\u003e\nCc: Axel Rasmussen \u003caxelrasmussen@google.com\u003e\nCc: Brian Geffon \u003cbgeffon@google.com\u003e\nCc: Christian Brauner \u003cbrauner@kernel.org\u003e\nCc: David Hildenbrand \u003cdavid@redhat.com\u003e\nCc: Hugh Dickins \u003chughd@google.com\u003e\nCc: Jann Horn \u003cjannh@google.com\u003e\nCc: Kalesh Singh \u003ckaleshsingh@google.com\u003e\nCc: Liam R. Howlett \u003cLiam.Howlett@oracle.com\u003e\nCc: Lokesh Gidra \u003clokeshgidra@google.com\u003e\nCc: Matthew Wilcox (Oracle) \u003cwilly@infradead.org\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Mike Rapoport (IBM) \u003crppt@kernel.org\u003e\nCc: Nicolas Geoffray \u003cngeoffray@google.com\u003e\nCc: Ryan Roberts \u003cryan.roberts@arm.com\u003e\nCc: Shuah Khan \u003cshuah@kernel.org\u003e\nCc: ZhangPeng \u003czhangpeng362@huawei.com\u003e\nCc: Tangquan Zheng \u003czhengtangquan@oppo.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "582ccf78f6090d88b1c7066b1e90b3d9ec952d08", "tree": "9ceb2d1ecfc9e55f4e2cd96d735155e082dbf44a", "parents": [ "695469c07a65547acb6e229b3fdf6aaa881817e3" ], "author": { "name": "SeongJae Park", "email": "sj@kernel.org", "time": "Tue Feb 25 14:23:33 2025 -0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Mar 05 21:36:16 2025 -0800" }, "message": "selftests/damon/damon_nr_regions: sort collected regiosn before checking with min/max boundaries\n\ndamon_nr_regions.py starts DAMON, periodically collect number of regions\nin snapshots, and see if it is in the requested range. The check code\nassumes the numbers are sorted on the collection list, but there is no\nsuch guarantee. Hence this can result in false positive test success. \nSort the list before doing the check.\n\nLink: https://lkml.kernel.org/r/20250225222333.505646-4-sj@kernel.org\nFixes: 781497347d1b (\"selftests/damon: implement test for min/max_nr_regions\")\nSigned-off-by: SeongJae Park \u003csj@kernel.org\u003e\nCc: Shuah Khan \u003cshuah@kernel.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "695469c07a65547acb6e229b3fdf6aaa881817e3", "tree": "ef5f4e9583d66be88e52d1cb4186e24c50973c2f", "parents": [ "1c684d77dfbcf926e0dd28f6d260e8fdd8a58e85" ], "author": { "name": "SeongJae Park", "email": "sj@kernel.org", "time": "Tue Feb 25 14:23:32 2025 -0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Mar 05 21:36:16 2025 -0800" }, "message": "selftests/damon/damon_nr_regions: set ops update for merge results check to 100ms\n\ndamon_nr_regions.py updates max_nr_regions to a number smaller than\nexpected number of real regions and confirms DAMON respect the harsh\nlimit. To give time for DAMON to make changes for the regions, 3\naggregation intervals (300 milliseconds) are given.\n\nThe internal mechanism works with not only the max_nr_regions, but also\nsz_limit, though. It avoids merging region if that casn make region of\nsize larger than sz_limit. In the test, sz_limit is set too small to\nachive the new max_nr_regions, unless it is updated for the new\nmin_nr_regions. But the update is done only once per operations set\nupdate interval, which is one second by default.\n\nHence, the test randomly incurs false positive failures. Fix it by\nsetting the ops interval same to aggregation interval, to make sure\nsz_limit is updated by the time of the check.\n\nLink: https://lkml.kernel.org/r/20250225222333.505646-3-sj@kernel.org\nFixes: 8bf890c81612 (\"selftests/damon/damon_nr_regions: test online-tuned max_nr_regions\")\nSigned-off-by: SeongJae Park \u003csj@kernel.org\u003e\nCc: Shuah Khan \u003cshuah@kernel.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "1c684d77dfbcf926e0dd28f6d260e8fdd8a58e85", "tree": "152c61b35a12eabf0d832053bcf7fef8e48c8d38", "parents": [ "c29564d8b46f64f5e6e6f1c9c02f7761b7b90963" ], "author": { "name": "SeongJae Park", "email": "sj@kernel.org", "time": "Tue Feb 25 14:23:31 2025 -0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Mar 05 21:36:16 2025 -0800" }, "message": "selftests/damon/damos_quota: make real expectation of quota exceeds\n\nPatch series \"selftests/damon: three fixes for false results\".\n\nFix three DAMON selftest bugs that cause two and one false positive\nfailures and successes.\n\n\nThis patch (of 3):\n\ndamos_quota.py assumes the quota will always exceeded. But whether quota\nwill be exceeded or not depend on the monitoring results. Actually the\nmonitored workload has chaning access pattern and hence sometimes the\nquota may not really be exceeded. As a result, false positive test\nfailures happen. Expect how much time the quota will be exceeded by\nchecking the monitoring results, and use it instead of the naive\nassumption.\n\nLink: https://lkml.kernel.org/r/20250225222333.505646-1-sj@kernel.org\nLink: https://lkml.kernel.org/r/20250225222333.505646-2-sj@kernel.org\nFixes: 51f58c9da14b (\"selftests/damon: add a test for DAMOS quota\")\nSigned-off-by: SeongJae Park \u003csj@kernel.org\u003e\nCc: Shuah Khan \u003cshuah@kernel.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "c29564d8b46f64f5e6e6f1c9c02f7761b7b90963", "tree": "a9729b6edd3fd07f0bf24776dce560272e78b473", "parents": [ "ce6d9c1c2b5cc785016faa11b48b6cd317eb367e" ], "author": { "name": "Su Hui", "email": "suhui@nfschina.com", "time": "Fri Feb 21 15:16:25 2025 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Mar 05 21:36:16 2025 -0800" }, "message": "include/linux/log2.h: mark is_power_of_2() with __always_inline\n\nWhen building kernel with randconfig, there is an error:\n\nIn function `kvm_is_cr4_bit_set\u0027,inlined from\n`kvm_update_cpuid_runtime\u0027 at arch/x86/kvm/cpuid.c:310:9:\n\ninclude/linux/compiler_types.h:542:38: error: call to\n`__compiletime_assert_380\u0027 declared with attribute error:\nBUILD_BUG_ON failed: !is_power_of_2(cr4_bit).\n\n\u0027!is_power_of_2(X86_CR4_OSXSAVE)\u0027 is False, but gcc treats is_power_of_2()\nas non-inline function and a compilation error happens. Fix this by marking\nis_power_of_2() with __always_inline.\n\nLink: https://lkml.kernel.org/r/20250221071624.1356899-1-suhui@nfschina.com\nSigned-off-by: Su Hui \u003csuhui@nfschina.com\u003e\nCc: Binbin Wu \u003cbinbin.wu@linux.intel.com\u003e\nCc: Paolo Bonzini \u003cpbonzini@redhat.com\u003e\nCc: Sean Christopherson \u003cseanjc@google.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "ce6d9c1c2b5cc785016faa11b48b6cd317eb367e", "tree": "3cd518c9d936916e57a75861eeb2ab865143aa2c", "parents": [ "57d910cffaa0be981f558ff603e2d896b36b8241" ], "author": { "name": "Mike Snitzer", "email": "snitzer@kernel.org", "time": "Mon Feb 24 21:20:02 2025 -0500" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Mar 05 21:36:15 2025 -0800" }, "message": "NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback\n\nAdd PF_KCOMPACTD flag and current_is_kcompactd() helper to check for it so\nnfs_release_folio() can skip calling nfs_wb_folio() from kcompactd.\n\nOtherwise NFS can deadlock waiting for kcompactd enduced writeback which\nrecurses back to NFS (which triggers writeback to NFSD via NFS loopback\nmount on the same host, NFSD blocks waiting for XFS\u0027s call to\n__filemap_get_folio):\n\n6070.550357] INFO: task kcompactd0:58 blocked for more than 4435 seconds.\n\n{---\n[58] \"kcompactd0\"\n[\u003c0\u003e] folio_wait_bit+0xe8/0x200\n[\u003c0\u003e] folio_wait_writeback+0x2b/0x80\n[\u003c0\u003e] nfs_wb_folio+0x80/0x1b0 [nfs]\n[\u003c0\u003e] nfs_release_folio+0x68/0x130 [nfs]\n[\u003c0\u003e] split_huge_page_to_list_to_order+0x362/0x840\n[\u003c0\u003e] migrate_pages_batch+0x43d/0xb90\n[\u003c0\u003e] migrate_pages_sync+0x9a/0x240\n[\u003c0\u003e] migrate_pages+0x93c/0x9f0\n[\u003c0\u003e] compact_zone+0x8e2/0x1030\n[\u003c0\u003e] compact_node+0xdb/0x120\n[\u003c0\u003e] kcompactd+0x121/0x2e0\n[\u003c0\u003e] kthread+0xcf/0x100\n[\u003c0\u003e] ret_from_fork+0x31/0x40\n[\u003c0\u003e] ret_from_fork_asm+0x1a/0x30\n---}\n\n[akpm@linux-foundation.org: fix build]\nLink: https://lkml.kernel.org/r/20250225022002.26141-1-snitzer@kernel.org\nFixes: 96780ca55e3c (\"NFS: fix up nfs_release_folio() to try to release the page\")\nSigned-off-by: Mike Snitzer \u003csnitzer@kernel.org\u003e\nCc: Anna Schumaker \u003canna.schumaker@oracle.com\u003e\nCc: Trond Myklebust \u003ctrond.myklebust@hammerspace.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "57d910cffaa0be981f558ff603e2d896b36b8241", "tree": "4c3c72ab5011ea8acada5edd9da0879813e60be2", "parents": [ "7a2e7ae5d13658ada38898e5a3a8a40a7910db06" ], "author": { "name": "Kemeng Shi", "email": "shikemeng@huaweicloud.com", "time": "Sun Feb 23 00:08:47 2025 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Mar 05 21:36:15 2025 -0800" }, "message": "mm, swap: avoid BUG_ON in relocate_cluster()\n\nIf allocation is racy with swapoff, we may call free_cluster for cluster\nalready in free list and trigger BUG_ON() as following:\n\nAllocation Swapoff\ncluster_alloc_swap_entry\n ...\n /* may get a free cluster with offset */\n offset \u003d xxx;\n if (offset)\n ci \u003d lock_cluster(si, offset);\n\n ...\n del_from_avail_list(p, true);\n si-\u003eflags \u0026\u003d ~SWP_WRITEOK;\n\n alloc_swap_scan_cluster(si, ci, ...)\n ...\n /* failed to alloc entry from free entry */\n if (!cluster_alloc_range(...))\n break;\n ...\n /* add back a free cluster */\n relocate_cluster(si, ci);\n if (!ci-\u003ecount)\n free_cluster(si, ci);\n VM_BUG_ON(ci-\u003eflags \u003d\u003d CLUSTER_FLAG_FREE);\n\nTo prevent the BUG_ON(), call free_cluster() for free cluster to move the\ncluster to tail of list.\n\nCheck cluster is not free before calling free_cluster() in\nrelocate_cluster() to avoid BUG_ON().\n\nLink: https://lkml.kernel.org/r/20250222160850.505274-4-shikemeng@huaweicloud.com\nFixes: 3b644773eefd (\"mm, swap: reduce contention on device lock\")\nSigned-off-by: Kemeng Shi \u003cshikemeng@huaweicloud.com\u003e\nReviewed-by: Kairui Song \u003ckasong@tencent.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "7a2e7ae5d13658ada38898e5a3a8a40a7910db06", "tree": "b2f42851d71873ff1f38285123cec3c420d24d35", "parents": [ "51f271c1940fc9a5f77931ec603b457ea293bd56" ], "author": { "name": "Kemeng Shi", "email": "shikemeng@huaweicloud.com", "time": "Sun Feb 23 00:08:46 2025 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Mar 05 21:36:15 2025 -0800" }, "message": "mm: swap: use correct step in loop to wait all clusters in wait_for_allocation()\n\nUse correct step in loop to wait all clusters in wait_for_allocation(). \nIf we miss some cluster in wait_for_allocation(), use after free may occur\nas follows:\n\nshmem_writepage swapoff\n folio_alloc_swap\n get_swap_pages\n scan_swap_map_slots\n cluster_alloc_swap_entry\n alloc_swap_scan_cluster\n cluster_alloc_range\n /* SWP_WRITEOK is valid */\n if (!(si-\u003eflags \u0026 SWP_WRITEOK))\n\n ...\n del_from_avail_list(p, true);\n ...\n /* miss the cluster in shmem_writepage */\n wait_for_allocation()\n ...\n try_to_unuse()\n\n memset(si-\u003eswap_map + start, usage, nr_pages);\n swap_range_alloc(si, nr_pages);\n ci-\u003ecount +\u003d nr_pages;\n /* return a valid entry */\n\n ...\n exit_swap_address_space(p-\u003etype);\n ...\n\n ...\n add_to_swap_cache\n /* dereference swap_address_space(entry) which is NULL */\n xas_lock_irq(\u0026xas);\n\nLink: https://lkml.kernel.org/r/20250222160850.505274-3-shikemeng@huaweicloud.com\nFixes: 9a0ddeb79880 (\"mm, swap: hold a reference during scan and cleanup flag usage\")\nSigned-off-by: Kemeng Shi \u003cshikemeng@huaweicloud.com\u003e\nReviewed-by: Kairui Song \u003ckasong@tencent.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "51f271c1940fc9a5f77931ec603b457ea293bd56", "tree": "ac46f6e60e59c5cea0dfef1f1817dd79251d4b20", "parents": [ "47b16d0462a460000b8f05dfb1292377ac48f3ca" ], "author": { "name": "Kemeng Shi", "email": "shikemeng@huaweicloud.com", "time": "Mon Feb 24 19:39:10 2025 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Mar 05 21:36:15 2025 -0800" }, "message": "mm: swap: add back full cluster when no entry is reclaimed\n\nIf no swap cache is reclaimed, cluster taken off from full_clusters list\nwill not be put in any list and we can\u0027t reclaime HAS_CACHE slots\nefficiently. Do relocate_cluster for such cluster to avoid inefficiency.\n\nLink: https://lkml.kernel.org/r/20250224113910.522439-1-shikemeng@huaweicloud.com\nFixes: 3b644773eefd (\"mm, swap: reduce contention on device lock\")\nSigned-off-by: Kemeng Shi \u003cshikemeng@huaweicloud.com\u003e\nReviewed-by: Kairui Song \u003ckasong@tencent.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "47b16d0462a460000b8f05dfb1292377ac48f3ca", "tree": "d3cab8ffb09698893fd05d870ca8ea3bf1df590a", "parents": [ "67bab13307c83fb742c2556b06cdc39dbad27f07" ], "author": { "name": "Lorenzo Stoakes", "email": "lorenzo.stoakes@oracle.com", "time": "Sat Feb 22 16:19:52 2025 +0000" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Mar 05 21:36:14 2025 -0800" }, "message": "mm: abort vma_modify() on merge out of memory failure\n\nThe remainder of vma_modify() relies upon the vmg state remaining pristine\nafter a merge attempt.\n\nUsually this is the case, however in the one edge case scenario of a merge\nattempt failing not due to the specified range being unmergeable, but\nrather due to an out of memory error arising when attempting to commit the\nmerge, this assumption becomes untrue.\n\nThis results in vmg-\u003estart, end being modified, and thus the proceeding\nattempts to split the VMA will be done with invalid start/end values.\n\nThankfully, it is likely practically impossible for us to hit this in\nreality, as it would require a maple tree node pre-allocation failure that\nwould likely never happen due to it being \u0027too small to fail\u0027, i.e. the\nkernel would simply keep retrying reclaim until it succeeded.\n\nHowever, this scenario remains theoretically possible, and what we are\ndoing here is wrong so we must correct it.\n\nThe safest option is, when this scenario occurs, to simply give up the\noperation. If we cannot allocate memory to merge, then we cannot allocate\nmemory to split either (perhaps moreso!).\n\nAny scenario where this would be happening would be under very extreme\n(likely fatal) memory pressure, so it\u0027s best we give up early.\n\nSo there is no doubt it is appropriate to simply bail out in this\nscenario.\n\nHowever, in general we must if at all possible never assume VMG state is\nstable after a merge attempt, since merge operations update VMG fields. \nAs a result, additionally also make this clear by storing start, end in\nlocal variables.\n\nThe issue was reported originally by syzkaller, and by Brad Spengler (via\nan off-list discussion), and in both instances it manifested as a\ntriggering of the assert:\n\n\tVM_WARN_ON_VMG(start \u003e\u003d end, vmg);\n\nIn vma_merge_existing_range().\n\nIt seems at least one scenario in which this is occurring is one in which\nthe merge being attempted is due to an madvise() across multiple VMAs\nwhich looks like this:\n\n start end\n |\u003c------\u003e|\n |----------|------|\n | vma | next |\n |----------|------|\n\nWhen madvise_walk_vmas() is invoked, we first find vma in the above\n(determining prev to be equal to vma as we are offset into vma), and then\nenter the loop.\n\nWe determine the end of vma that forms part of the range we are\nmadvise()\u0027ing by setting \u0027tmp\u0027 to this value:\n\n\t\t/* Here vma-\u003evm_start \u003c\u003d start \u003c (end|vma-\u003evm_end) */\n\t\ttmp \u003d vma-\u003evm_end;\n\nWe then invoke the madvise() operation via visit(), letting prev get\nupdated to point to vma as part of the operation:\n\n\t\t/* Here vma-\u003evm_start \u003c\u003d start \u003c tmp \u003c\u003d (end|vma-\u003evm_end). */\n\t\terror \u003d visit(vma, \u0026prev, start, tmp, arg);\n\nWhere the visit() function pointer in this instance is\nmadvise_vma_behavior().\n\nAs observed in syzkaller reports, it is ultimately madvise_update_vma()\nthat is invoked, calling vma_modify_flags_name() and vma_modify() in turn.\n\nThen, in vma_modify(), we attempt the merge:\n\n\tmerged \u003d vma_merge_existing_range(vmg);\n\tif (merged)\n\t\treturn merged;\n\nWe invoke this with vmg-\u003estart, end set to start, tmp as such:\n\n start tmp\n |\u003c---\u003e|\n |----------|------|\n | vma | next |\n |----------|------|\n\nWe find ourselves in the merge right scenario, but the one in which we\ncannot remove the middle (we are offset into vma).\n\nHere we have a special case where vmg-\u003estart, end get set to perhaps\nunintuitive values - we intended to shrink the middle VMA and expand the\nnext.\n\nThis means vmg-\u003estart, end are set to... vma-\u003evm_start, start.\n\nNow the commit_merge() fails, and vmg-\u003estart, end are left like this. \nThis means we return to the rest of vma_modify() with vmg-\u003estart, end\n(here denoted as start\u0027, end\u0027) set as:\n\n start\u0027 end\u0027\n |\u003c--\u003e|\n |----------|------|\n | vma | next |\n |----------|------|\n\nSo we now erroneously try to split accordingly. This is where the\nunfortunate stuff begins.\n\nWe start with:\n\n\t/* Split any preceding portion of the VMA. */\n\tif (vma-\u003evm_start \u003c vmg-\u003estart) {\n\t\t...\n\t}\n\nThis doesn\u0027t trigger as we are no longer offset into vma at the start.\n\nBut then we invoke:\n\n\t/* Split any trailing portion of the VMA. */\n\tif (vma-\u003evm_end \u003e vmg-\u003eend) {\n\t\t...\n\t}\n\nWhich does get invoked. This leaves us with:\n\n start\u0027 end\u0027\n |\u003c--\u003e|\n |----|-----|------|\n | vma| new | next |\n |----|-----|------|\n\nWe then return ultimately to madvise_walk_vmas(). Here \u0027new\u0027 is unknown,\nand putting back the values known in this function we are faced with:\n\n start tmp end\n | | |\n |----|-----|------|\n | vma| new | next |\n |----|-----|------|\n prev\n\nThen:\n\n\t\tstart \u003d tmp;\n\nSo:\n\n start end\n | |\n |----|-----|------|\n | vma| new | next |\n |----|-----|------|\n prev\n\nThe following code does not cause anything to happen:\n\n\t\tif (prev \u0026\u0026 start \u003c prev-\u003evm_end)\n\t\t\tstart \u003d prev-\u003evm_end;\n\t\tif (start \u003e\u003d end)\n\t\t\tbreak;\n\nAnd then we invoke:\n\n\t\tif (prev)\n\t\t\tvma \u003d find_vma(mm, prev-\u003evm_end);\n\nWhich is where a problem occurs - we don\u0027t know about \u0027new\u0027 so we\nessentially look for the vma after prev, which is new, whereas we actually\nintended to discover next!\n\nSo we end up with:\n\n start end\n | |\n |----|-----|------|\n |prev| vma | next |\n |----|-----|------|\n\nAnd we have successfully bypassed all of the checks madvise_walk_vmas()\nhas to ensure early exit should we end up moving out of range.\n\nWe loop around, and hit:\n\n\t\t/* Here vma-\u003evm_start \u003c\u003d start \u003c (end|vma-\u003evm_end) */\n\t\ttmp \u003d vma-\u003evm_end;\n\nOh dear. Now we have:\n\n tmp\n start end\n | |\n |----|-----|------|\n |prev| vma | next |\n |----|-----|------|\n\nWe then invoke:\n\n\t\t/* Here vma-\u003evm_start \u003c\u003d start \u003c tmp \u003c\u003d (end|vma-\u003evm_end). */\n\t\terror \u003d visit(vma, \u0026prev, start, tmp, arg);\n\nWhere start \u003d\u003d tmp. That is, a zero range. This is not good.\n\nWe invoke visit() which is madvise_vma_behavior() which does not check the\nrange (for good reason, it assumes all checks have been done before it was\ncalled), which in turn finally calls madvise_update_vma().\n\nThe madvise_update_vma() function calls vma_modify_flags_name() in turn,\nwhich ultimately invokes vma_modify() with... start \u003d\u003d end.\n\nvma_modify() calls vma_merge_existing_range() and finally we hit:\n\n\tVM_WARN_ON_VMG(start \u003e\u003d end, vmg);\n\nWhich triggers, as start \u003d\u003d end.\n\nWhile it might be useful to add some CONFIG_DEBUG_VM asserts in these\ninstances to catch this kind of error, since we have just eliminated any\npossibility of that happening, we will add such asserts separately as to\nreduce churn and aid backporting.\n\nLink: https://lkml.kernel.org/r/20250222161952.41957-1-lorenzo.stoakes@oracle.com\nFixes: 2f1c6611b0a8 (\"mm: introduce vma_merge_struct and abstract vma_merge(),vma_modify()\")\nSigned-off-by: Lorenzo Stoakes \u003clorenzo.stoakes@oracle.com\u003e\nTested-by: Brad Spengler \u003cbrad.spengler@opensrcsec.com\u003e\nReported-by: Brad Spengler \u003cbrad.spengler@opensrcsec.com\u003e\nReported-by: syzbot+46423ed8fa1f1148c6e4@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/linux-mm/6774c98f.050a0220.25abdd.0991.GAE@google.com/\nCc: Jann Horn \u003cjannh@google.com\u003e\nCc: Liam Howlett \u003cliam.howlett@oracle.com\u003e\nCc: Vlastimil Babka \u003cvbabka@suse.cz\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "67bab13307c83fb742c2556b06cdc39dbad27f07", "tree": "a9c3070bd6982a0814049187777a0b25a4709ce4", "parents": [ "c3e998398de48a7528842f05858a3a6bb21002e6" ], "author": { "name": "Ge Yang", "email": "yangge1116@126.com", "time": "Wed Feb 19 11:46:44 2025 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Mar 05 21:36:14 2025 -0800" }, "message": "mm/hugetlb: wait for hugetlb folios to be freed\n\nSince the introduction of commit c77c0a8ac4c52 (\"mm/hugetlb: defer freeing\nof huge pages if in non-task context\"), which supports deferring the\nfreeing of hugetlb pages, the allocation of contiguous memory through\ncma_alloc() may fail probabilistically.\n\nIn the CMA allocation process, if it is found that the CMA area is\noccupied by in-use hugetlb folios, these in-use hugetlb folios need to be\nmigrated to another location. When there are no available hugetlb folios\nin the free hugetlb pool during the migration of in-use hugetlb folios,\nnew folios are allocated from the buddy system. A temporary state is set\non the newly allocated folio. Upon completion of the hugetlb folio\nmigration, the temporary state is transferred from the new folios to the\nold folios. Normally, when the old folios with the temporary state are\nfreed, it is directly released back to the buddy system. However, due to\nthe deferred freeing of hugetlb pages, the PageBuddy() check fails,\nultimately leading to the failure of cma_alloc().\n\nHere is a simplified call trace illustrating the process:\ncma_alloc()\n -\u003e__alloc_contig_migrate_range() // Migrate in-use hugetlb folios\n -\u003eunmap_and_move_huge_page()\n -\u003efolio_putback_hugetlb() // Free old folios\n -\u003etest_pages_isolated()\n -\u003e__test_page_isolated_in_pageblock()\n -\u003ePageBuddy(page) // Check if the page is in buddy\n\nTo resolve this issue, we have implemented a function named\nwait_for_freed_hugetlb_folios(). This function ensures that the hugetlb\nfolios are properly released back to the buddy system after their\nmigration is completed. By invoking wait_for_freed_hugetlb_folios()\nbefore calling PageBuddy(), we ensure that PageBuddy() will succeed.\n\nLink: https://lkml.kernel.org/r/1739936804-18199-1-git-send-email-yangge1116@126.com\nFixes: c77c0a8ac4c5 (\"mm/hugetlb: defer freeing of huge pages if in non-task context\")\nSigned-off-by: Ge Yang \u003cyangge1116@126.com\u003e\nReviewed-by: Muchun Song \u003cmuchun.song@linux.dev\u003e\nAcked-by: David Hildenbrand \u003cdavid@redhat.com\u003e\nCc: Baolin Wang \u003cbaolin.wang@linux.alibaba.com\u003e\nCc: Barry Song \u003c21cnbao@gmail.com\u003e\nCc: Oscar Salvador \u003cosalvador@suse.de\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "c3e998398de48a7528842f05858a3a6bb21002e6", "tree": "4b126fd89bf969fadc1c1039bfef44054076bd4d", "parents": [ "19fac3c93991502a22c5132824c40b6a2e64b136" ], "author": { "name": "gao xu", "email": "gaoxu2@honor.com", "time": "Wed Feb 19 01:56:28 2025 +0000" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Mar 05 21:36:14 2025 -0800" }, "message": "mm: fix possible NULL pointer dereference in __swap_duplicate\n\nAdd a NULL check on the return value of swp_swap_info in __swap_duplicate\nto prevent crashes caused by NULL pointer dereference.\n\nThe reason why swp_swap_info() returns NULL is unclear; it may be due\nto CPU cache issues or DDR bit flips. The probability of this issue is\nvery small - it has been observed to occur approximately 1 in 500,000\ntimes per week. The stack info we encountered is as follows:\n\nUnable to handle kernel NULL pointer dereference at virtual address\n0000000000000058\n[RB/E]rb_sreason_str_set: sreason_str set null_pointer\nMem abort info:\n ESR \u003d 0x0000000096000005\n EC \u003d 0x25: DABT (current EL), IL \u003d 32 bits\n SET \u003d 0, FnV \u003d 0\n EA \u003d 0, S1PTW \u003d 0\n FSC \u003d 0x05: level 1 translation fault\nData abort info:\n ISV \u003d 0, ISS \u003d 0x00000005, ISS2 \u003d 0x00000000\n CM \u003d 0, WnR \u003d 0, TnD \u003d 0, TagAccess \u003d 0\n GCS \u003d 0, Overlay \u003d 0, DirtyBit \u003d 0, Xs \u003d 0\nuser pgtable: 4k pages, 39-bit VAs, pgdp\u003d00000008a80e5000\n[0000000000000058] pgd\u003d0000000000000000, p4d\u003d0000000000000000,\npud\u003d0000000000000000\nInternal error: Oops: 0000000096000005 [#1] PREEMPT SMP\nSkip md ftrace buffer dump for: 0x1609e0\n...\npc : swap_duplicate+0x44/0x164\nlr : copy_page_range+0x508/0x1e78\nsp : ffffffc0f2a699e0\nx29: ffffffc0f2a699e0 x28: ffffff8a5b28d388 x27: ffffff8b06603388\nx26: ffffffdf7291fe70 x25: 0000000000000006 x24: 0000000000100073\nx23: 00000000002d2d2f x22: 0000000000000008 x21: 0000000000000000\nx20: 00000000002d2d2f x19: 18000000002d2d2f x18: ffffffdf726faec0\nx17: 0000000000000000 x16: 0010000000000001 x15: 0040000000000001\nx14: 0400000000000001 x13: ff7ffffffffffb7f x12: ffeffffffffffbff\nx11: ffffff8a5c7e1898 x10: 0000000000000018 x9 : 0000000000000006\nx8 : 1800000000000000 x7 : 0000000000000000 x6 : ffffff8057c01f10\nx5 : 000000000000a318 x4 : 0000000000000000 x3 : 0000000000000000\nx2 : 0000006daf200000 x1 : 0000000000000001 x0 : 18000000002d2d2f\nCall trace:\n swap_duplicate+0x44/0x164\n copy_page_range+0x508/0x1e78\n copy_process+0x1278/0x21cc\n kernel_clone+0x90/0x438\n __arm64_sys_clone+0x5c/0x8c\n invoke_syscall+0x58/0x110\n do_el0_svc+0x8c/0xe0\n el0_svc+0x38/0x9c\n el0t_64_sync_handler+0x44/0xec\n el0t_64_sync+0x1a8/0x1ac\nCode: 9139c35a 71006f3f 54000568 f8797b55 (f9402ea8)\n---[ end trace 0000000000000000 ]---\nKernel panic - not syncing: Oops: Fatal exception\nSMP: stopping secondary CPUs\n\nThe patch seems to only provide a workaround, but there are no more\neffective software solutions to handle the bit flips problem. This path\nwill change the issue from a system crash to a process exception, thereby\nreducing the impact on the entire machine.\n\nakpm: this is probably a kernel bug, but this patch keeps the system\nrunning and doesn\u0027t reduce that bug\u0027s debuggability.\n\nLink: https://lkml.kernel.org/r/e223b0e6ba2f4924984b1917cc717bd5@honor.com\nSigned-off-by: gao xu \u003cgaoxu2@honor.com\u003e\nReviewed-by: Barry Song \u003cbaohua@kernel.org\u003e\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: Yosry Ahmed \u003cyosry.ahmed@linux.dev\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "19fac3c93991502a22c5132824c40b6a2e64b136", "tree": "d3d0de549173116a111f5391295572642c23d3b3", "parents": [ "04ec365e3fdf136ba5f9053b02fb6c3368a22e83" ], "author": { "name": "Sebastian Andrzej Siewior", "email": "bigeasy@linutronix.de", "time": "Tue Feb 18 10:14:11 2025 +0100" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Mar 05 21:36:14 2025 -0800" }, "message": "dma: kmsan: export kmsan_handle_dma() for modules\n\nkmsan_handle_dma() is used by virtio_ring() which can be built as a\nmodule. kmsan_handle_dma() needs to be exported otherwise building the\nvirtio_ring fails.\n\nExport kmsan_handle_dma for modules.\n\nLink: https://lkml.kernel.org/r/20250218091411.MMS3wBN9@linutronix.de\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nCloses: https://lore.kernel.org/oe-kbuild-all/202502150634.qjxwSeJR-lkp@intel.com/\nFixes: 7ade4f10779c (\"dma: kmsan: unpoison DMA mappings\")\nSigned-off-by: Sebastian Andrzej Siewior \u003cbigeasy@linutronix.de\u003e\nCc: Alexander Potapenko \u003cglider@google.com\u003e\nCc: Dmitriy Vyukov \u003cdvyukov@google.com\u003e\nCc: Macro Elver \u003celver@google.com\u003e\nCc: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nCc: Thomas Gleixner \u003ctglx@linutronix.de\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "04ec365e3fdf136ba5f9053b02fb6c3368a22e83", "tree": "170e2135e8fab51821ca5cfdbcd512976bb11d3c", "parents": [ "af288a426c3e3552b62595c6138ec6371a17dbba" ], "author": { "name": "Ujwal Kundur", "email": "ujwal.kundur@gmail.com", "time": "Sat Feb 15 16:21:07 2025 +0530" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Mar 05 21:36:13 2025 -0800" }, "message": "Documentation: fix doc link to fault-injection.rst\n\nFix incorrect reference to fault-injection docs\n\nLink: https://lkml.kernel.org/r/20250215105106.734-1-ujwal.kundur@gmail.com\nSigned-off-by: Ujwal Kundur \u003cujwal.kundur@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "af288a426c3e3552b62595c6138ec6371a17dbba", "tree": "0a231d8a781ad9ca278b9b3cf2636db87410dc31", "parents": [ "773b9a6aa6d38894b95088e3ed6f8a701d9f50fd" ], "author": { "name": "Ma Wupeng", "email": "mawupeng1@huawei.com", "time": "Mon Feb 17 09:43:29 2025 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Mar 05 21:36:13 2025 -0800" }, "message": "hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio\n\nCommit b15c87263a69 (\"hwpoison, memory_hotplug: allow hwpoisoned pages to\nbe offlined) add page poison checks in do_migrate_range in order to make\noffline hwpoisoned page possible by introducing isolate_lru_page and\ntry_to_unmap for hwpoisoned page. However folio lock must be held before\ncalling try_to_unmap. Add it to fix this problem.\n\nWarning will be produced if folio is not locked during unmap:\n\n ------------[ cut here ]------------\n kernel BUG at ./include/linux/swapops.h:400!\n Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP\n Modules linked in:\n CPU: 4 UID: 0 PID: 411 Comm: bash Tainted: G W 6.13.0-rc1-00016-g3c434c7ee82a-dirty #41\n Tainted: [W]\u003dWARN\n Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015\n pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE\u003d--)\n pc : try_to_unmap_one+0xb08/0xd3c\n lr : try_to_unmap_one+0x3dc/0xd3c\n Call trace:\n try_to_unmap_one+0xb08/0xd3c (P)\n try_to_unmap_one+0x3dc/0xd3c (L)\n rmap_walk_anon+0xdc/0x1f8\n rmap_walk+0x3c/0x58\n try_to_unmap+0x88/0x90\n unmap_poisoned_folio+0x30/0xa8\n do_migrate_range+0x4a0/0x568\n offline_pages+0x5a4/0x670\n memory_block_action+0x17c/0x374\n memory_subsys_offline+0x3c/0x78\n device_offline+0xa4/0xd0\n state_store+0x8c/0xf0\n dev_attr_store+0x18/0x2c\n sysfs_kf_write+0x44/0x54\n kernfs_fop_write_iter+0x118/0x1a8\n vfs_write+0x3a8/0x4bc\n ksys_write+0x6c/0xf8\n __arm64_sys_write+0x1c/0x28\n invoke_syscall+0x44/0x100\n el0_svc_common.constprop.0+0x40/0xe0\n do_el0_svc+0x1c/0x28\n el0_svc+0x30/0xd0\n el0t_64_sync_handler+0xc8/0xcc\n el0t_64_sync+0x198/0x19c\n Code: f9407be0 b5fff320 d4210000 17ffff97 (d4210000)\n ---[ end trace 0000000000000000 ]---\n\nLink: https://lkml.kernel.org/r/20250217014329.3610326-4-mawupeng1@huawei.com\nFixes: b15c87263a69 (\"hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined\")\nSigned-off-by: Ma Wupeng \u003cmawupeng1@huawei.com\u003e\nAcked-by: David Hildenbrand \u003cdavid@redhat.com\u003e\nAcked-by: Miaohe Lin \u003clinmiaohe@huawei.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Naoya Horiguchi \u003cnao.horiguchi@gmail.com\u003e\nCc: Oscar Salvador \u003cosalvador@suse.de\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "773b9a6aa6d38894b95088e3ed6f8a701d9f50fd", "tree": "832bc244b13b7185acc096b78cb82c609f0fcbf1", "parents": [ "b81679b1633aa43c0d973adfa816d78c1ed0d032" ], "author": { "name": "Ma Wupeng", "email": "mawupeng1@huawei.com", "time": "Mon Feb 17 09:43:28 2025 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Mar 05 21:36:13 2025 -0800" }, "message": "mm: memory-hotplug: check folio ref count first in do_migrate_range\n\nIf a folio has an increased reference count, folio_try_get() will acquire\nit, perform necessary operations, and then release it. In the case of a\npoisoned folio without an elevated reference count (which is unlikely for\nmemory-failure), folio_try_get() will simply bypass it.\n\nTherefore, relocate the folio_try_get() function, responsible for checking\nand acquiring this reference count at first.\n\nLink: https://lkml.kernel.org/r/20250217014329.3610326-3-mawupeng1@huawei.com\nSigned-off-by: Ma Wupeng \u003cmawupeng1@huawei.com\u003e\nAcked-by: David Hildenbrand \u003cdavid@redhat.com\u003e\nAcked-by: Miaohe Lin \u003clinmiaohe@huawei.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Naoya Horiguchi \u003cnao.horiguchi@gmail.com\u003e\nCc: Oscar Salvador \u003cosalvador@suse.de\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "b81679b1633aa43c0d973adfa816d78c1ed0d032", "tree": "b815177664f59ebad986e203cb84594f61b041f7", "parents": [ "a564ccfe300fa6a065beda06ab7f3c140d6b4d63" ], "author": { "name": "Ma Wupeng", "email": "mawupeng1@huawei.com", "time": "Mon Feb 17 09:43:27 2025 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Mar 05 21:36:13 2025 -0800" }, "message": "mm: memory-failure: update ttu flag inside unmap_poisoned_folio\n\nPatch series \"mm: memory_failure: unmap poisoned folio during migrate\nproperly\", v3.\n\nFix two bugs during folio migration if the folio is poisoned.\n\n\nThis patch (of 3):\n\nCommit 6da6b1d4a7df (\"mm/hwpoison: convert TTU_IGNORE_HWPOISON to\nTTU_HWPOISON\") introduce TTU_HWPOISON to replace TTU_IGNORE_HWPOISON in\norder to stop send SIGBUS signal when accessing an error page after a\nmemory error on a clean folio. However during page migration, anon folio\nmust be set with TTU_HWPOISON during unmap_*(). For pagecache we need\nsome policy just like the one in hwpoison_user_mappings to set this flag. \nSo move this policy from hwpoison_user_mappings to unmap_poisoned_folio to\nhandle this warning properly.\n\nWarning will be produced during unamp poison folio with the following log:\n\n ------------[ cut here ]------------\n WARNING: CPU: 1 PID: 365 at mm/rmap.c:1847 try_to_unmap_one+0x8fc/0xd3c\n Modules linked in:\n CPU: 1 UID: 0 PID: 365 Comm: bash Tainted: G W 6.13.0-rc1-00018-gacdb4bbda7ab #42\n Tainted: [W]\u003dWARN\n Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015\n pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE\u003d--)\n pc : try_to_unmap_one+0x8fc/0xd3c\n lr : try_to_unmap_one+0x3dc/0xd3c\n Call trace:\n try_to_unmap_one+0x8fc/0xd3c (P)\n try_to_unmap_one+0x3dc/0xd3c (L)\n rmap_walk_anon+0xdc/0x1f8\n rmap_walk+0x3c/0x58\n try_to_unmap+0x88/0x90\n unmap_poisoned_folio+0x30/0xa8\n do_migrate_range+0x4a0/0x568\n offline_pages+0x5a4/0x670\n memory_block_action+0x17c/0x374\n memory_subsys_offline+0x3c/0x78\n device_offline+0xa4/0xd0\n state_store+0x8c/0xf0\n dev_attr_store+0x18/0x2c\n sysfs_kf_write+0x44/0x54\n kernfs_fop_write_iter+0x118/0x1a8\n vfs_write+0x3a8/0x4bc\n ksys_write+0x6c/0xf8\n __arm64_sys_write+0x1c/0x28\n invoke_syscall+0x44/0x100\n el0_svc_common.constprop.0+0x40/0xe0\n do_el0_svc+0x1c/0x28\n el0_svc+0x30/0xd0\n el0t_64_sync_handler+0xc8/0xcc\n el0t_64_sync+0x198/0x19c\n ---[ end trace 0000000000000000 ]---\n\n[mawupeng1@huawei.com: unmap_poisoned_folio(): remove shadowed local `mapping\u0027, per Miaohe]\n Link: https://lkml.kernel.org/r/20250219060653.3849083-1-mawupeng1@huawei.com\nLink: https://lkml.kernel.org/r/20250217014329.3610326-1-mawupeng1@huawei.com\nLink: https://lkml.kernel.org/r/20250217014329.3610326-2-mawupeng1@huawei.com\nFixes: 6da6b1d4a7df (\"mm/hwpoison: convert TTU_IGNORE_HWPOISON to TTU_HWPOISON\")\nSigned-off-by: Ma Wupeng \u003cmawupeng1@huawei.com\u003e\nSuggested-by: David Hildenbrand \u003cdavid@redhat.com\u003e\nAcked-by: David Hildenbrand \u003cdavid@redhat.com\u003e\nAcked-by: Miaohe Lin \u003clinmiaohe@huawei.com\u003e\nCc: Ma Wupeng \u003cmawupeng1@huawei.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Naoya Horiguchi \u003cnao.horiguchi@gmail.com\u003e\nCc: Oscar Salvador \u003cosalvador@suse.de\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "a564ccfe300fa6a065beda06ab7f3c140d6b4d63", "tree": "805e87d6f1cfcd3635957b26529e4f3eca60a9f6", "parents": [ "7277dd0a0ba4f8259f7abe37c4b7280fbfc2a182" ], "author": { "name": "Qi Zheng", "email": "zhengqi.arch@bytedance.com", "time": "Mon Feb 17 10:49:24 2025 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Wed Mar 05 21:36:12 2025 -0800" }, "message": "arm: pgtable: fix NULL pointer dereference issue\n\nWhen update_mmu_cache_range() is called by update_mmu_cache(), the vmf\nparameter is NULL, which will cause a NULL pointer dereference issue in\nadjust_pte():\n\nUnable to handle kernel NULL pointer dereference at virtual address 00000030 when read\nHardware name: Atmel AT91SAM9\nPC is at update_mmu_cache_range+0x1e0/0x278\nLR is at pte_offset_map_rw_nolock+0x18/0x2c\nCall trace:\n update_mmu_cache_range from remove_migration_pte+0x29c/0x2ec\n remove_migration_pte from rmap_walk_file+0xcc/0x130\n rmap_walk_file from remove_migration_ptes+0x90/0xa4\n remove_migration_ptes from migrate_pages_batch+0x6d4/0x858\n migrate_pages_batch from migrate_pages+0x188/0x488\n migrate_pages from compact_zone+0x56c/0x954\n compact_zone from compact_node+0x90/0xf0\n compact_node from kcompactd+0x1d4/0x204\n kcompactd from kthread+0x120/0x12c\n kthread from ret_from_fork+0x14/0x38\nException stack(0xc0d8bfb0 to 0xc0d8bff8)\n\nTo fix it, do not rely on whether \u0027ptl\u0027 is equal to decide whether to hold\nthe pte lock, but decide it by whether CONFIG_SPLIT_PTE_PTLOCKS is\nenabled. In addition, if two vmas map to the same PTE page, there is no\nneed to hold the pte lock again, otherwise a deadlock will occur. Just\nadd the need_lock parameter to let adjust_pte() know this information.\n\nLink: https://lkml.kernel.org/r/20250217024924.57996-1-zhengqi.arch@bytedance.com\nFixes: fc9c45b71f43 (\"arm: adjust_pte() use pte_offset_map_rw_nolock()\")\nSigned-off-by: Qi Zheng \u003czhengqi.arch@bytedance.com\u003e\nReported-by: Ezra Buehler \u003cezra.buehler@husqvarnagroup.com\u003e\nCloses: https://lore.kernel.org/lkml/CAM1KZSmZ2T_riHvay+7cKEFxoPgeVpHkVFTzVVEQ1BO0cLkHEQ@mail.gmail.com/\nAcked-by: David Hildenbrand \u003cdavid@redhat.com\u003e\nTested-by: Ezra Buehler \u003cezra.buehler@husqvarnagroup.com\u003e\nCc: Hugh Dickins \u003chughd@google.com\u003e\nCc: Muchun Song \u003cmuchun.song@linux.dev\u003e\nCc: Qi Zheng \u003czhengqi.arch@bytedance.com\u003e\nCc: Russel King \u003clinux@armlinux.org.uk\u003e\nCc: Ryan Roberts \u003cryan.roberts@arm.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" } ], "next": "7277dd0a0ba4f8259f7abe37c4b7280fbfc2a182" }