)]}' { "log": [ { "commit": "220752c6d02ab97ea019227c8296b7b137e009c7", "tree": "3f2a3383e57a8c89f3e725f416c27c24fc832318", "parents": [ "0381ade2ea82b48584fa57ef23d63f97b2d87d7b", "92747742d660f52ecccb71cd5f8ff93e27db265a" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Tue Oct 06 11:57:36 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Tue Oct 06 11:57:36 2026 -0700" }, "message": "Merge branches \u0027misc.2026.10.06a\u0027 and \u0027torture.2026.10.01a\u0027 into HEAD\n\nmisc.2026.10.06a: Miscellaneous fixes.\ntorture.2026.10.01a: Make call_{s,}rcu() invocable from any environment,\n\tadd atomic SRCU, additional SRCU updates, and torture-test updates.\n" }, { "commit": "0381ade2ea82b48584fa57ef23d63f97b2d87d7b", "tree": "96a5dd411ef8a80cc4b9ffaec9e7d9b458e95f86", "parents": [ "5de907d24919f42ec2e221ed33a50749016368fe" ], "author": { "name": "Ricardo Ribalda", "email": "ribalda@chromium.org", "time": "Mon Sep 14 13:53:31 2026 +0000" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Tue Oct 06 11:56:16 2026 -0700" }, "message": "rcu: Drop the address space qualifier from the dereference macros\n\nThe RCU dereference macros end with a cast that is meant to hand back a\nplain kernel pointer from a __rcu pointer.\n\nFor that it uses:\n\t((typeof(*p) __force __kernel *)(local))\n\nThe problem is that typeof preserves every qualifier, including the\naddress space qualifiers (__rcu).\n\nRecent versions of smatch[1] care about this and throw tens of warnings\nlike this one:\n ./include/trace/events/vb2.h:46:1: warning: incorrect type in assignment (different address spaces)\n ./include/trace/events/vb2.h:46:1: expected struct tracepoint_func *it_func_ptr\n ./include/trace/events/vb2.h:46:1: got struct tracepoint_func __rcu *\n\nUse a new macro TYPEOF_NO_ADDRESS_SPACE() for the result type. This new\nmacro strips all the qualifiers when running with sparse (so const and\nvolatile are gone). But keeps all the qualifiers when running with the\ncompiler, caring about const/volatile mismatch.\n\n[1] https://github.com/error27/smatch/commit/e53027a4e816a772403baafa83c09e4a94c1cb8f\n\nSuggested-by: Dan Carpenter \u003cdan.carpenter@linaro.org\u003e\nLink: https://lore.kernel.org/r/20260825-unqual-v1-1-7024fb81b4f9@chromium.org\nSigned-off-by: Ricardo Ribalda \u003cribalda@chromium.org\u003e\nReviewed-by: Joel Fernandes \u003cjoelagnelf@nvidia.com\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "5de907d24919f42ec2e221ed33a50749016368fe", "tree": "fce4f48bed21179daaa7854ec61c27aaa516190f", "parents": [ "852fbf7fc857fd375d8caccbce576aefc37fb065" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Tue Aug 11 11:44:00 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Tue Oct 06 11:56:16 2026 -0700" }, "message": "rcu-tasks: Disable callback contend/collapse messages by default\n\nNew workloads can do large bursts of call_rcu_tasks() invocations in a\nshort time period, followed by a quiet time period long enough to drain\nall of the callbacks, followed by another burst of call_rcu_tasks()\ninvocations. This can cause RCU Tasks to switch back and forth between\nqueuing callbacks only on CPU 0 (during quiet periods) and on all CPUs\n(during bursts).\n\nWhich is fine. Except for the fact that each cycle from CPU-0-only to\nall-CPUs queuing and back generates three console messages, one announcing\nthe shift to all-CPUs queuing, another announcing the start of the shift\nback to CPU-0-only queuing, and the third announcing completion of this\nshift after an RCU grace period. And these console messages can overrun\nconsole-log communications channels and obscure other console-message-based\ndebugging information. And the only known use for these console messages\nis debugging RCU Tasks itself.\n\nThis commit therefore adds a rcupdate.rcu_task_collapse_debug module\nparameter that defaults to false (suppressing these console messages).\nThose debugging or otherwise playing with RCU Tasks callback queuing\nauto-adjustment can set this parameter to the value true.\n\n[ paulmck: Apply Breno Leitao feedback. ]\n\nReported-by: Breno Leitao \u003cleitao@debian.org\u003e\nReported-by: David Dai \u003cdavid.dai@linux.dev\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\nReviewed-by: Breno Leitao \u003cleitao@debian.org\u003e\n" }, { "commit": "852fbf7fc857fd375d8caccbce576aefc37fb065", "tree": "70962d3b6a3ef4602a2a81932631a8589827289b", "parents": [ "c0fa92ccfdc9af4c6db695cbbae3f25262d56ca4" ], "author": { "name": "Karl Mehltretter", "email": "kmehltretter@gmail.com", "time": "Fri Sep 11 23:36:43 2026 +0200" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Tue Oct 06 11:56:16 2026 -0700" }, "message": "rcuref: Fix the rcuread_is_dead reference in rcuref_read() kernel-doc\n\nThe kernel-doc comment of rcuref_read() refers to rcuread_is_dead, which\ndoes not exist. The name is rcuref_is_dead. Say rcuref_is_dead.\n\nFixes: 3efa66ce6ee1 (\"rcuref: Provide rcuref_is_dead()\")\nAssisted-by: LLM\nSigned-off-by: Karl Mehltretter \u003ckmehltretter@gmail.com\u003e\nReviewed-by: Sebastian Andrzej Siewior \u003cbigeasy@linutronix.de\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "c0fa92ccfdc9af4c6db695cbbae3f25262d56ca4", "tree": "ed3ca769a32c865dfb4a68b004498e385d39f423", "parents": [ "88f77859564b81543b7efbe0d866b2a0b20963d9" ], "author": { "name": "Matthias Goergens", "email": "matthias.goergens@gmail.com", "time": "Fri Sep 11 11:40:59 2026 +0800" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Tue Oct 06 11:56:16 2026 -0700" }, "message": "rcu: Make userspace barrier hook drain kvfree_rcu work\n\nThe bcachefs ktest allocation-leak check writes rcutree.do_rcu_barrier\nbefore reading /proc/allocinfo. While testing bcachefs performance\nchanges, small objects released with kfree_rcu() remained visible after\nrepeated writes to the hook and 20 seconds of waiting, causing otherwise\nclean tests to fail their leak check.\n\nThe test assumes a stronger contract than the hook currently documents:\nrcu_barrier() waits for ordinary callbacks, but does not flush objects\nstill held in kfree_rcu() batching or per-CPU SLUB sheaves. The retained\npopulation eventually fell as a sheaf filled; there is no evidence here\nof unbounded growth or OOM.\n\nChanging the hook to drain kvfree_rcu() work let the same unmodified\nbcachefs workload pass its allocation check. All eight checkpoints in\none VM, after 50 through 400 option changes, reported zero retained\nreconcile_scan objects. This motivated the separate private-cache test\nused to isolate the incomplete drain from bcachefs.\n\nCalling kvfree_rcu_barrier() from rcu_barrier_throttled() was proposed\nwhen kvfree_rcu_barrier() was added in 2024, to restore a clean baseline\nbetween userspace benchmark runs. The discussion concluded that keeping\nthe existing hook name, adding the second operation and documenting both\nwas the safest compatibility choice, but the follow-up was not added.\n\nAdd that drain and document the stronger test interface. Always retain\nthe existing start-rate limit and perform the kvfree_rcu() drain: an\nunrelated ordinary barrier does not establish that this work completed.\n\nRetain the entry ordinary-barrier sequence snapshot. After draining,\nskip the final ordinary barrier only if that snapshot is complete,\npreserving the memory barrier on the completion path. Otherwise, invoke\nrcu_barrier() explicitly. This keeps the ordinary-callback guarantee\nindependent of whether kvfree_rcu_barrier() embeds an ordinary barrier.\n\nClarify that the documented completion guarantee covers work queued\nbefore the request, without preventing new work from being queued.\n\nEarlier validation of the unconditional-drain version used four fresh\nVM pairs with a private-cache fixture: controls retained the queued\nobject (60 to 60 active objects), and treatments drained it (60 to 59).\nAn ordinary-callback test passed on both kernels. Those runs predated\nthe guarded skip and do not validate that change. No elapsed-time\nimprovement is claimed.\n\nLink: https://lore.kernel.org/all/20240820155935.1167988-1-urezki@gmail.com/\nSigned-off-by: Matthias Goergens \u003cmatthias.goergens@gmail.com\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "88f77859564b81543b7efbe0d866b2a0b20963d9", "tree": "0118bff8f5703b9b2711a0fcbc3e047f2bd807f0", "parents": [ "2eaee974b5da25b55ae72cb6c649524410316ae8" ], "author": { "name": "Bradley Morgan", "email": "brads@mainlining.org", "time": "Thu Sep 10 17:25:37 2026 +0000" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Tue Oct 06 11:56:16 2026 -0700" }, "message": "rcu: Drop the private tick-internal.h include from tree.c\n\nNothing in the tree.c translation unit uses anything from the\nprivate timekeeping header ../time/tick-internal.h, included\nsince commit 48d07c04b4cc (\"rcu: Enable elimination of\nTree-RCU softirq processing\"). The tick symbols RCU uses,\ntick_dep_set(), tick_dep_clear(), their _cpu and _task\nvariants, tick_nohz_full_cpu() and TICK_DEP_BIT_RCU, are all\ndeclared in the public linux/tick.h, which tree.c already\nincludes.\n\nDrop the include.\n\nSigned-off-by: Bradley Morgan \u003cbrads@mainlining.org\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "2eaee974b5da25b55ae72cb6c649524410316ae8", "tree": "5d4682053e617c85dfc8fbc73cae24b222cc18ce", "parents": [ "49be2ba9f0fa25cf2137ce111c7d84e869398a8f" ], "author": { "name": "Hemanth Selam", "email": "hemanth.selam@gmail.com", "time": "Mon Sep 07 12:06:22 2026 +0530" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Tue Oct 06 11:56:16 2026 -0700" }, "message": "rcu: Fix typo \"upto\" in comment\n\nCorrect \"upto\" to \"up to\", reported by scripts/checkpatch.pl using the\nmisspelling list in scripts/spelling.txt. Only touches comments, no code\nchanges.\n\nAssisted-by: Cursor:claude-opus-5\nSigned-off-by: Hemanth Selam \u003chemanth.selam@gmail.com\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "49be2ba9f0fa25cf2137ce111c7d84e869398a8f", "tree": "41c1780ee8b601cd5cd63120b53562227fc0d80a", "parents": [ "e71035eb6e2d8af8bfde78938671695571e6d063" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Sep 03 15:26:24 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Tue Oct 06 11:54:52 2026 -0700" }, "message": "rcu: Add running and boosted indications to RCU task stall dump\n\nCurrently, rcu_print_task_stall() will dump out the PID, RCU reader\nnesting level, the rcu_special structure\u0027s flags, and whether or not\nthat reader is on the -\u003eblkd_tasks list. When debugging RCU priority\nboosting, it is also good to know whether the stalled RCU reader is\ncurrently running and whether it is currently being RCU priority boosted.\nThis commit therefore adds this information to the output.\n\n[ paulmck: Apply kernel test robot feedback. ]\n[ paulmck: Apply feedback from Arnd Bergmann and kernel test robot. ]\n\nLink: https://lore.kernel.org/all/20260925133922.1356404-1-arnd@kernel.org/\nLink: https://lore.kernel.org/all/202609261005.GrnaXBXT-lkp@intel.com/\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\nReviewed-by: Bradley Morgan \u003cbrads@mainlining.org\u003e\nReviewed-by: Kunwu Chan \u003ckunwu.chan@gmail.com\u003e\nTested-by: Kunwu Chan \u003ckunwu.chan@gmail.com\u003e\n" }, { "commit": "92747742d660f52ecccb71cd5f8ff93e27db265a", "tree": "1aa06a8da119358dbdb734192ab9ac593bfbbbaf", "parents": [ "7743179aaa22b6ecb499dbb7fdb4207c8fce6f3e" ], "author": { "name": "Kunwu Chan", "email": "kunwu.chan@gmail.com", "time": "Mon Sep 14 17:34:19 2026 +0800" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:21:08 2026 -0700" }, "message": "rcutorture: Add atomic SRCU cross-CPU IRQ context mismatch test\n\nAdd testtype 7 to verify that lockdep detects an IRQ-context\nmismatch when an atomic SRCU read-side critical section is held\nwith IRQs enabled on one CPU and synchronize_srcu_atomic() is\ncalled from an IPI handler on another CPU.\n\nThis covers the cross-CPU case that cannot be detected by\nchecking the current task\u0027s held locks.\n\nCo-developed-by: Zqiang \u003cqiang.zhang@linux.dev\u003e\nSigned-off-by: Zqiang \u003cqiang.zhang@linux.dev\u003e\nSigned-off-by: Kunwu Chan \u003ckunwu.chan@gmail.com\u003e\nAcked-by: Boqun Feng \u003cboqun@kernel.org\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "7743179aaa22b6ecb499dbb7fdb4207c8fce6f3e", "tree": "cbc6c8553abd91a78b336f0cd8b3ae018b2b6dfb", "parents": [ "f07c9df1b55ca1f23aa0c69de79b02313c4db47e" ], "author": { "name": "Kunwu Chan", "email": "kunwu.chan@gmail.com", "time": "Mon Sep 14 17:34:18 2026 +0800" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:21:07 2026 -0700" }, "message": "selftests/rcutorture: Fix double nerrs count in srcu_lockdep.sh\n\nWhen CONFIG_PROVE_LOCKING is missing, the deadlock-detection loop\nand the mixed-SRCU-readers section each increment nerrs once in\nthe configuration check and again in the common error path,\ncounting the same error twice.\n\nRemove the stray increments so that each error advances nerrs\nby one.\n\nSigned-off-by: Kunwu Chan \u003ckunwu.chan@gmail.com\u003e\nAcked-by: Boqun Feng \u003cboqun@kernel.org\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "f07c9df1b55ca1f23aa0c69de79b02313c4db47e", "tree": "3280aeffba8b3bc4c2591f115e3cb70322a7c860", "parents": [ "54013a141a980cc8a7b98a10a92a682b9498fd91" ], "author": { "name": "Kunwu Chan", "email": "kunwu.chan@gmail.com", "time": "Mon Sep 14 17:34:16 2026 +0800" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:21:07 2026 -0700" }, "message": "selftests/rcutorture: Wire atomic SRCU into srcu_lockdep.sh\n\nAdd testtypes 4 (atomic SRCU same-type deadlock) and 5 (atomic SRCU\n+ raw_spinlock dependency cycle) to the deadlock-detection loop.\nAdd a separate loop for testtype 6 (rcu_read_lock() →\nsynchronize_srcu_atomic()), which also verifies via console.log that\nno lockdep warning is triggered.\n\nCo-developed-by: Zqiang \u003cqiang.zhang@linux.dev\u003e\nSigned-off-by: Zqiang \u003cqiang.zhang@linux.dev\u003e\nSigned-off-by: Kunwu Chan \u003ckunwu.chan@gmail.com\u003e\nAcked-by: Boqun Feng \u003cboqun@kernel.org\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "54013a141a980cc8a7b98a10a92a682b9498fd91", "tree": "576652d58c9438e94a6d0e91780c036401e3bc40", "parents": [ "e78910f3563099242581194c762437fa03b0cb77" ], "author": { "name": "Kunwu Chan", "email": "kunwu.chan@gmail.com", "time": "Mon Sep 14 17:34:15 2026 +0800" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:21:07 2026 -0700" }, "message": "rcutorture: Add atomic SRCU lockdep support\n\nAdd three testtypes covering atomic SRCU lockdep behavior:\n\n testtype 4: atomic SRCU same-type deadlock\n testtype 5: atomic SRCU + raw spinlock dependency cycle\n testtype 6: synchronize_srcu_atomic() inside rcu_read_lock()\n\nCo-developed-by: Zqiang \u003cqiang.zhang@linux.dev\u003e\nSigned-off-by: Zqiang \u003cqiang.zhang@linux.dev\u003e\nSigned-off-by: Kunwu Chan \u003ckunwu.chan@gmail.com\u003e\nAcked-by: Boqun Feng \u003cboqun@kernel.org\u003e\nReviewed-by: Joel Fernandes \u003cjoelagnelf@nvidia.com\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "e78910f3563099242581194c762437fa03b0cb77", "tree": "8011de22f9d038564bda68c928a773843a34c828", "parents": [ "872459d693e506f5108b2c6d042ee7b7d9ba8996" ], "author": { "name": "Zhouyi Zhou", "email": "zhouzhouyi@gmail.com", "time": "Sat Sep 19 01:06:06 2026 +0000" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:21:07 2026 -0700" }, "message": "rcutorture: Fix kvm-again.sh re-run failure on ppc64\n\nDiscovered in the Open Source Lab of Oregon State University when running\ntorture.sh on a ppc64le VM. Two bugs were exposed:\n\n1. The kvm-transform.sh call hard-coded \"bzImage\" as the kernel image\n name. On ppc64, the boot image is vmlinux, not bzImage, so the\n re-run failed to find the image. Fix this by extracting the QEMU\n binary from the qemu-cmd file and passing it to identify_boot_image()\n to obtain the correct architecture-specific image name, the same way\n kvm.sh already does.\n\n2. The rm -f invocation on re-run listed vmlinux among the files to\n delete. On ppc64 vmlinux is the boot image, so deleting it broke\n the re-run on that architecture. Drop vmlinux from the unconditional\n list, and instead conditionally delete it only when the boot image\n basename is not vmlinux.\n\nIn addition, identify qemu_binary before the copy step so that on\nnon-PowerPC systems (where vmlinux is not the boot image) the vmlinux\nfile can be removed immediately after the run directory is copied,\nsaving storage before any tests run. This also eliminates the\nper-iteration re-computation of qemu_binary and boot_image inside\nthe qemu-cmd transform loop.\n\nTested on a local x86_64 machine and on a PPC VM of the Open Source Lab\nof Oregon State University.\n\nSigned-off-by: Zhouyi Zhou \u003czhouzhouyi@gmail.com\u003e\nReviewed-by: Joel Fernandes \u003cjoelagnelf@nvidia.com\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "872459d693e506f5108b2c6d042ee7b7d9ba8996", "tree": "5c6ed615e1c4c20d99b9eef60844609b1ef66690", "parents": [ "6f5e6e799fb2a845e3bef758507ba00fbf56bcd6" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Aug 27 11:25:51 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:21:07 2026 -0700" }, "message": "torture: Allow specifying alternative ssh command to kvm-remote.sh\n\nSome environments require use of alternative commands to access the\ntest hosts. This commit therefore adds a KVM_REMOTE_SSH environment\nvariable for this purpose. If this variable is unset, ssh is used.\nAny alternative ssh command must support the usual ssh arguments,\nincluding the command to be executed remotely. In some cases, you may\nneed a wrapper script to make the alternative ssh-like command look\nenough like ssh to satisfy kvm-remote.sh.\n\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "6f5e6e799fb2a845e3bef758507ba00fbf56bcd6", "tree": "be1bf9e85fb393bc5c8bc18300dd892b9a625690", "parents": [ "727809b56ef96e9f0fbdcfc2324dea78b074db45" ], "author": { "name": "Zqiang", "email": "qiang.zhang@linux.dev", "time": "Mon Aug 24 17:24:27 2026 +0800" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:21:07 2026 -0700" }, "message": "rcutorture: Synchronously wait for all rcu_torture_irq() callbacks to complete\n\nThe rcu_torture_reader() drives RCU readers from interrupt context via\nsmp_call_function_single(cpu, rcu_torture_irq, NULL, 0) with wait\u003d0, to\nruns rcu_torture_irq() on a remote CPU. this is async, nothing waits for\nthe remote handler to run.\n\nOn shutdown, torture_stop_kthread() only waits for each reader kthread to\nreturn, and the reader\u0027s timer_delete_sync() only drains its timer. Neither\nwaits for a rcu_torture_irq() which still pending or executing on a remote\nCPU, so it can run after all readers have exited and rcu_torture_cleanup()\nhas already advanced.\n\n1. rcu_torture_irq() may issue cur_ops-\u003ecall(rhp, rcu_torture_timer_cb)\n after cur_ops-\u003ecb_barrier() has been waiting for all outstanding\n callbacks complete. once the module is unloaded, fires into freed\n module text, a use-after-free happen.\n\n2. rcu_torture_irq() may still be inside rcu_torture_one_read(), holding\n a read-side critical section, when cur_ops-\u003ecleanup() tears the flavor\n down (e.g. cleanup_srcu_struct()), triggering an active-reader warning\n or use-after-free of the torn-down structure.\n\nThis commit therefore issue a kick_all_cpus_sync() after all readers\nkthread have returned and before cur_ops-\u003ecb_barrier(), synchronous IPI\nround trip to every CPU guarantees that every rcu_torture_irq() which\npreviously issued by any reader has completed.\n\nSigned-off-by: Zqiang \u003cqiang.zhang@linux.dev\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "727809b56ef96e9f0fbdcfc2324dea78b074db45", "tree": "9cf772a2cf4c0d07943c7a3c5aad1312413a4bb6", "parents": [ "54b2bba7cce8019f472eed17704fc60e1436b399" ], "author": { "name": "Kunwu Chan", "email": "kunwu.chan@gmail.com", "time": "Thu Aug 20 17:42:28 2026 +0800" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:21:07 2026 -0700" }, "message": "rcutorture: Fix divide-by-zero with fwd_progress_div\u003d1\n\nWhen fwd_progress_div\u003d1, the forward-progress test computes:\n sd4 \u003d (sd + div - 1) / div \u003d sd\n dur \u003d sd4 + torture_random(\u0026trs) % (sd - sd4) \u003d sd4 + % 0\n\nThe modulo operation with a zero divisor triggers an integer\ndivision by zero (undefined behavior at the C level, #DE trap on x86),\ncausing a kernel Oops and panic. On x86_64, this manifests as:\n\n rcu_torture_fwd_prog_nr: Starting forward-progress test 0\n Oops: divide error: 0000 [#1] SMP PTI\n RIP: 0010:rcu_torture_fwd_prog+0x90b/0x1160\n R12: 0000000000000000\n\nThe existing guard only handles non-positive values. However,\nfwd_progress_div\u003d1 also makes the random range empty because\nsd4 \u003d\u003d sd.\n\nChange the guard to reject values below 2. The forward-progress test\nonly reaches this calculation when stall_dur() is positive, so\nsd \u003d stall_dur() + 1 \u003e\u003d 2. For fwd_progress_div \u003e\u003d 2, sd4 \u003c sd,\nensuring that sd - sd4 is at least 1.\n\nKeep the existing fallback to the default value of 4 for invalid\nvalues.\n\nVerified with QEMU/KVM: a 138-second run with fwd_progress_div\u003d1\ncompleted 81 forward-progress test cycles without a crash.\n\nFixes: 1b27291b1ea4f (\"rcutorture: Add forward-progress tests for RCU grace periods\")\nSigned-off-by: Kunwu Chan \u003ckunwu.chan@gmail.com\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "54b2bba7cce8019f472eed17704fc60e1436b399", "tree": "b8895dd8bdc272026592c7dd8d8f40df73d9f23b", "parents": [ "77752f0c7a41856332b884f1e5511751bf4561aa" ], "author": { "name": "Kunwu Chan", "email": "kunwu.chan@gmail.com", "time": "Mon Sep 14 17:34:17 2026 +0800" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:18:26 2026 -0700" }, "message": "srcutree: Preserve IRQ state in synchronize_srcu_atomic() callchain\n\nsynchronize_srcu_atomic() may be called with interrupts disabled, but\nits callchain uses raw_spin_lock_irq_rcu_node() /\nraw_spin_unlock_irq_rcu_node(), which unconditionally enables\ninterrupts on unlock. This can incorrectly change the caller\u0027s IRQ\nstate.\n\nUse the irqsave/irqrestore variants for the locks in this callchain\nso that the caller\u0027s IRQ state is preserved.\n\nCo-developed-by: Zqiang \u003cqiang.zhang@linux.dev\u003e\nSigned-off-by: Zqiang \u003cqiang.zhang@linux.dev\u003e\nSigned-off-by: Kunwu Chan \u003ckunwu.chan@gmail.com\u003e\nAcked-by: Boqun Feng \u003cboqun@kernel.org\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "77752f0c7a41856332b884f1e5511751bf4561aa", "tree": "d6c8d20fc53da7691fc21cb591a661b35e60a472", "parents": [ "a5fbccd991b93d2a224f472badb781f0976608d7" ], "author": { "name": "Kunwu Chan", "email": "kunwu.chan@gmail.com", "time": "Sat Sep 12 00:09:13 2026 +0800" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:18:26 2026 -0700" }, "message": "srcutiny: Add lockdep and early-boot checks to synchronize_srcu_atomic()\n\nAdd the RCU_LOCKDEP_WARN and early-boot check that the Tree version\ngained, srcu_lock_sync() was already present.\n\nSuggested-by: Zqiang \u003cqiang.zhang@linux.dev\u003e\nSigned-off-by: Kunwu Chan \u003ckunwu.chan@gmail.com\u003e\nReviewed-by: Bradley Morgan \u003cbrads@mainlining.org\u003e\nReviewed-by: Joel Fernandes \u003cjoelagnelf@nvidia.com\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "a5fbccd991b93d2a224f472badb781f0976608d7", "tree": "faca441e1888fe8bc5b432ccb4a8e663233198b5", "parents": [ "2105acb883db44369c9317abf8849592a7a898ed" ], "author": { "name": "Kunwu Chan", "email": "kunwu.chan@gmail.com", "time": "Fri Sep 11 17:35:15 2026 +0800" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:18:26 2026 -0700" }, "message": "srcutree: Add lockdep and early-boot checks to synchronize_srcu_atomic()\n\nAdd the lockdep annotation, same-type SRCU nesting warning, and\nearly-boot check used by __synchronize_srcu().\n\nSuggested-by: Zqiang \u003cqiang.zhang@linux.dev\u003e\nSigned-off-by: Kunwu Chan \u003ckunwu.chan@gmail.com\u003e\nReviewed-by: Joel Fernandes \u003cjoelagnelf@nvidia.com\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "2105acb883db44369c9317abf8849592a7a898ed", "tree": "5cb0ea338e84cb4fd3f48644f9db59ce3f399f5a", "parents": [ "0a113deb2069ddd36099e7cd70ba7c42c456cb47" ], "author": { "name": "Kunwu Chan", "email": "kunwu.chan@gmail.com", "time": "Fri Sep 11 12:02:51 2026 +0800" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:18:25 2026 -0700" }, "message": "srcutree: Skip torture to-big transition for atomic SRCU\n\nAtomic SRCU does not use the srcu_node combining tree. Exclude it\nfrom the SRCU_SIZING_IS_TORTURE() transition in\nsrcu_torture_stats_print(), and warn if such a transition is requested.\n\nSigned-off-by: Kunwu Chan \u003ckunwu.chan@gmail.com\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "0a113deb2069ddd36099e7cd70ba7c42c456cb47", "tree": "5f922ceb7eef6db2fa4624abb7b27cdc35c3936b", "parents": [ "86af18c7aed2db251e216abda55bc21925b654ff" ], "author": { "name": "Kunwu Chan", "email": "kunwu.chan@gmail.com", "time": "Fri Sep 11 15:21:25 2026 +0800" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:18:25 2026 -0700" }, "message": "srcutree: Don\u0027t transition atomic SRCU to big in srcu_gp_end()\n\nAtomic SRCU must remain in the small size state. Warn if this\ninvariant is violated and avoid transitioning to big in that case.\n\n[ paulmck: Folded \"if\" onto one line for 100-character limit. ]\n\nSigned-off-by: Kunwu Chan \u003ckunwu.chan@gmail.com\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\nReviewed-by: Bradley Morgan \u003cbrads@mainlining.org\u003e\n" }, { "commit": "86af18c7aed2db251e216abda55bc21925b654ff", "tree": "57b753112558e82377f58da5fabe9e97688dacc1", "parents": [ "4568fb5557a6b774ae2da1c7f04334ddb765fc09" ], "author": { "name": "Kunwu Chan", "email": "kunwu.chan@gmail.com", "time": "Mon Sep 07 15:58:22 2026 +0800" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:18:25 2026 -0700" }, "message": "srcutree: Make init_srcu_struct_atomic() prevent transition to big\n\nThe is_atomic parameter of init_srcu_struct_fields() exists so that\natomic SRCU never transitions to big, but neither\ninit_srcu_struct_atomic() nor its lockdep counterpart\n__init_srcu_struct_atomic() sets it.\n\nOn systems where srcutree.convert_to_big selects SRCU_SIZING_INIT,\nthis needlessly allocates a full srcu_node combining tree for any\ndynamically initialized atomic srcu_struct, despite atomic SRCU\nhaving neither callbacks nor srcu_barrier() operations.\n\nPass true from both atomic entry points, adding an is_atomic parameter\nto __init_srcu_struct_common().\n\nSigned-off-by: Kunwu Chan \u003ckunwu.chan@gmail.com\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "4568fb5557a6b774ae2da1c7f04334ddb765fc09", "tree": "2c4e8e06e3fb8b2535c4e8dc576a5cd6f8614ff4", "parents": [ "5bc19bb1c42fe9a0d3ed4808dc20494b0746022b" ], "author": { "name": "Kunwu Chan", "email": "kunwu.chan@gmail.com", "time": "Mon Sep 07 15:58:29 2026 +0800" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:18:25 2026 -0700" }, "message": "srcu: Restrict atomic-SRCU non_block annotation to task context\n\nsrcu_read_lock_atomic() and srcu_read_unlock_atomic() arm and disarm\nmight_sleep() checks via non_block_start()/non_block_end(), skipping\nhardirq so the update does not land on the interrupted task\u0027s\n-\u003enon_block_count.\n\nInline softirqs run on the interrupted task\u0027s stack as well, so a\ntimer callback running atomic-SRCU readers races with the interrupted\ntask\u0027s own -\u003enon_block_count updates, as KCSAN reports:\n\n\tBUG: KCSAN: data-race in srcu_torture_read_lock / srcu_torture_read_unlock\n\n\twrite to 0xffffa00f818ea418 of 4 bytes by interrupt on cpu 0:\n\t\tsrcu_torture_read_lock+0x422/0x470\n\t\trcutorture_one_extend+0xdc/0x600\n\t\trcu_torture_one_read+0xd1/0x330\n\t\trcu_torture_timer+0x75/0x140\n\t\tcall_timer_fn+0xe6/0x2f0\n\t\t...\n\t\trun_timer_softirq+0xb7/0x130\n\t\thandle_softirqs+0xfc/0x3f0\n\t\t__irq_exit_rcu+0x8e/0x100\n\nUse in_task() so the annotation is applied only in task context; it\nis redundant elsewhere because might_sleep() already warns about\nsleeping from atomic context.\n\nSigned-off-by: Kunwu Chan \u003ckunwu.chan@gmail.com\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "5bc19bb1c42fe9a0d3ed4808dc20494b0746022b", "tree": "a3ad698e274f6cdc2f816f49a4915912c0b063f8", "parents": [ "960ebfba7ba3a9fabc2318d12f4c0b47f8db52a3" ], "author": { "name": "Kunwu Chan", "email": "kunwu.chan@gmail.com", "time": "Mon Sep 07 15:58:27 2026 +0800" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:18:25 2026 -0700" }, "message": "srcutree: Remove srcu_barrier() sleep for atomic SRCU\n\nThe atomic-SRCU path in srcu_barrier() sleeps for 100 milliseconds just\nin case there are callbacks to wait for. But call_srcu() refuses\natomic SRCU with a WARN_ON_ONCE() before reaching the deferred-enqueue\npath, so there can be no callbacks, deferred or otherwise.\n\nDrop the sleep.\n\nSigned-off-by: Kunwu Chan \u003ckunwu.chan@gmail.com\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "960ebfba7ba3a9fabc2318d12f4c0b47f8db52a3", "tree": "6d596bc29c4f866199ed6028954a7aa0f0d47341", "parents": [ "b276c45f87e2bbe61d6af0b860792933df72eb13" ], "author": { "name": "Kunwu Chan", "email": "kunwu.chan@gmail.com", "time": "Mon Sep 07 15:58:26 2026 +0800" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:18:25 2026 -0700" }, "message": "srcutree: Skip callback scheduling for atomic SRCU grace periods\n\ncall_srcu() is forbidden on atomic srcu_struct, so srcu_gp_end() never\nhas callbacks to invoke for them. Yet it schedules callback invocation,\nwhich for atomic SRCU\u0027s SRCU_SIZE_SMALL state arms the boot CPU\u0027s\n-\u003edelay_work timer every grace period, only for srcu_invoke_callbacks()\nto find nothing to do.\n\nSkip this for atomic SRCU.\n\nSigned-off-by: Kunwu Chan \u003ckunwu.chan@gmail.com\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "b276c45f87e2bbe61d6af0b860792933df72eb13", "tree": "d29024f22f288754e32613d428cfff1d6a4b2e84", "parents": [ "94aa5637b56283463e5e649b5ef3b29492b65e13" ], "author": { "name": "Kunwu Chan", "email": "kunwu.chan@gmail.com", "time": "Mon Sep 07 15:58:19 2026 +0800" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:18:25 2026 -0700" }, "message": "srcutree: Add reader-free fastpath to synchronize_srcu_atomic()\n\nsynchronize_srcu_atomic() is restricted to srcu_read_lock_atomic() and\nsrcu_read_unlock_atomic(), whose read-side critical sections disable\npreemption. In the common case where there are no readers at all, the\ngrace period therefore need not do the index flip. Add a fastpath\nthat sums both ranks of the per-CPU -\u003esrcu_ctrs[] counters and, if the\nlock counts match the unlock counts on both ranks, ends the grace\nperiod immediately, skipping the srcu_advance_state() scans, mirroring\nthe similar Tiny SRCU fastpath.\n\nCorrectness requires the counter-sum proof to follow the grace-period\nanchor written by srcu_gp_start(); placing it before the anchor could\nlet this grace period miss a pre-existing reader and return without\nwaiting for it. The smp_mb() between the unlock and lock sums pairs\nwith the smp_mb() in __srcu_read_lock(). The grace period is ended\nmanually under -\u003elock and -\u003esrcu_atomic_gp_flag.\n\nIn theory, this is slower than David Woodhouse\u0027s earlier patch, but\nDavid\u0027s measurements showed that the performance was close enough\nthat it makes sense to keep the get_state_synchronize_srcu() and\npoll_state_synchronize_srcu semantics.\n\nLink: https://lore.kernel.org/all/20260907075829.2073224-4-kunwu.chan@linux.dev/\nLink: https://lore.kernel.org/all/0f4dea21bac43685d3286df329401177e4452b36.camel@infradead.org/\nLink: https://lore.kernel.org/all/0d4af6318ac67486858be1df8d436147b444a2d2.camel@infradead.org/\nSigned-off-by: Kunwu Chan \u003ckunwu.chan@gmail.com\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\nCc: David Woodhouse \u003cdwmw2@infradead.org\u003e\n" }, { "commit": "94aa5637b56283463e5e649b5ef3b29492b65e13", "tree": "f2db7048ad54355a13df8828ef637bffa9bf6fcf", "parents": [ "dc02fff7ca9bc081ea044fdebf068627c4a69265" ], "author": { "name": "Kunwu Chan", "email": "kunwu.chan@gmail.com", "time": "Mon Sep 07 15:58:20 2026 +0800" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:18:25 2026 -0700" }, "message": "rcutorture: Add atomic-SRCU support to torture.sh\n\nAdd the --do-atomic-srcu argument to torture.sh, which runs the\nSRCU-N, SRCU-P, and SRCU-T scenarios, thus covering both Tree SRCU\n(SRCU-N and SRCU-P) and Tiny SRCU (SRCU-T), with\nrcutorture.reader_flavor\u003d0x10 appended to the boot parameters so\nthat it takes precedence over each scenario\u0027s own reader-flavor\nsetting. This exercises srcu_read_lock_atomic(),\nsrcu_read_unlock_atomic(), and synchronize_srcu_atomic().\n\nAs with other torture.sh tests, the --do-kcsan argument runs a\nKCSAN+PROVE_LOCKING variant of this test.\n\n[ paulmck: Make --do-atomic-srcu be default-on. ]\n\nSigned-off-by: Kunwu Chan \u003ckunwu.chan@gmail.com\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "dc02fff7ca9bc081ea044fdebf068627c4a69265", "tree": "d3350794387ba6bbd82ebcdeedfce711a03d0e09", "parents": [ "cb9985f8c17574099429a449cc0a0d147b51fa12" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Wed Sep 02 12:58:24 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:18:25 2026 -0700" }, "message": "srcutree: Explicitly note DEFINE_SRCU() needs for srcu_barrier()\n\nIn the core kernel, an srcu_struct structure created by DEFINE_SRCU()\nor friends lives as long as the kernel does, so there are no particular\nrequirements surrounding the end of that structure\u0027s life. In contrast,\nwhen DEFINE_SRCU() and friends are used within a module, the corresponding\nsrcu_struct structures\u0027 lifetimes end when that module exits. This in\nturn means that if such a structure was passed to call_srcu(), then\nsrcu_barrier() must be invoked after the last call_srcu() invocation\nbut before the module exits.\n\nThis commit therefore adds a comment stating this.\n\nReported-by: Alexander Aring \u003caahringo@redhat.com\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "cb9985f8c17574099429a449cc0a0d147b51fa12", "tree": "7ffc65f138e2ac3d71084c2f96cf3ac72176172c", "parents": [ "9828d2d688c447513416e77724cc5a1d2fafb297" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Wed Sep 02 08:30:38 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:18:25 2026 -0700" }, "message": "srcutree: Warn if Tiny SRCU readers are preempted\n\nThe fastpath of synchronize_srcu_atomic() should always be taken\nbecause readers always disable preemption. Therefore, the fact that\nsynchronize_srcu_atomic() is running at all should mean that all readers\nhave ended.\n\nBut there are always bugs. And responding to a usage bug with a\ntoo-short SRCU grace period, and thus possibly corrupting memory\nis at best a sadistic response so such a bug. For this reason,\nsynchronize_srcu_atomic() explicitly waits for readers. Except that\nit does so silently, possibly failing to flag this bug. This commit\ntherefore adds a splat if synchronize_srcu_atomic() fails to take the\nearly exit.\n\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "9828d2d688c447513416e77724cc5a1d2fafb297", "tree": "f8cbdbe7816aa9ceea2d8fd68da2974e83e665a7", "parents": [ "0627b18797ae16f3937fe3e2d0e6c496ff8d57b1" ], "author": { "name": "Sebastian Andrzej Siewior", "email": "bigeasy@linutronix.de", "time": "Fri Aug 21 20:38:09 2026 +0200" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:18:25 2026 -0700" }, "message": "srcu: Use IRQ_WORK_INIT_HARD for srcu\u0027s irq_work\n\nThe irq_work in srcu is used to schedule a delayed work. The work item\nis not scheduled directly because it is not always possible wake a\nthread directly.\n\nOn PREEMPT_RT the default irq_work is initialized with IRQ_WORK_LAZY and\nis delayed to the irq_work thread. A system booted with the command line\n\"trace_event\u003d…\" will freeze during boot because the irq_work thread is\nnot yet deployed (and tracing uses synchronize_srcu() in\ntp_rcu_cond_sync()).\n\nThe irq_work performs just a wakeup a thread, there is nothing wrong\nwith doing this from hardirq context on PREEMPT_RT.\n\nUse IRQ_WORK_INIT_HARD for srcu\u0027s irq_work.\n\nFixes: 7c405fb3279b3 (\"rcu: Use an intermediate irq_work to start process_srcu()\")\nSigned-off-by: Sebastian Andrzej Siewior \u003cbigeasy@linutronix.de\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "0627b18797ae16f3937fe3e2d0e6c496ff8d57b1", "tree": "cc2eba6e0c1fe8679f0569862166389b034862c0", "parents": [ "563c07aee0f176e2479e2c58629961f2222e693d" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Wed Aug 26 09:03:57 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:18:25 2026 -0700" }, "message": "srcutree: Disable preemption across synchronize_srcu_atomic()\n\nBecause synchronize_srcu_atomic() cannot sleep, if a pair of them run\nconcurrently pinned to the same CPU, it is possible that one will spin\nuselessly waiting for the other while at the same time preventing that\nother from running. This commit therefore disables preemption to prevent\nthis failure mode.\n\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "563c07aee0f176e2479e2c58629961f2222e693d", "tree": "f5fe904b267522b40babf962cd50711780d18a3b", "parents": [ "85d5f89bdc4232287a1c60fa61c44a0b2e2a0bf2" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Aug 21 16:30:31 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:18:24 2026 -0700" }, "message": "rcutorture: Add support for testing synchronize_srcu_atomic()\n\nThis commit adds support for the value 0x10 for reader_flavor, which\nspecifies SRCU_READ_FLAVOR_ATOMIC, that is, srcu_read_lock_atomic(),\nsrcu_read_unlock_atomic(), and synchronize_srcu_atomic().\n\n[ paulmck: Apply Kunwu Chan feedback. ]\n\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "85d5f89bdc4232287a1c60fa61c44a0b2e2a0bf2", "tree": "341fe13c3c18a672fb3b7e12402d7e782a244f09", "parents": [ "a5130cf7b27f78fde4321727f9f59fe2419f7cfa" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Tue Aug 18 17:10:15 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:18:24 2026 -0700" }, "message": "srcutiny: Add an atomic Tiny SRCU\n\nThis commit adds the Tiny SRCU counterpart to Tree SRCU\u0027s\nsynchronize_srcu_atomic(). One might hope that this could be as trivial\nas Tiny RCU\u0027s synchronize_rcu(), and there was a time when it would\nhave been. But lazy preemption really can preempt an SRCU read-side\ncritical section, which means that synchronize_srcu_atomic() really must\nbe prepared to spin waiting for it.\n\nThis spinning currently consists of cond_resched_tasks_rcu_qs()\nand cpu_relax(). It would be better to have some way of telling the\nscheduler that there is nothing useful for us to do. We cannot use\nthe traditional wait_event() approach because synchronize_srcu_atomic()\nis not permitted to block.\n\n[ paulmck: Apply Kunwu Chan and Joel Fernandes feedback. ]\n\nCo-developed-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\nAssisted-by: Claude:claude-mythos-5\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "a5130cf7b27f78fde4321727f9f59fe2419f7cfa", "tree": "f31010958275715059883aae3a570bb39660f21d", "parents": [ "ee6bd18ef1673f526e795b368603f692576bb148" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Tue Aug 18 17:10:15 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:18:24 2026 -0700" }, "message": "srcutree: Add an atomic Tree SRCU\n\nSome dedicated srcu_struct users have read-side critical sections\nwhich are short, never sleep, and never block on anything which may\nitself depend on memory allocation — because they were, until\nrecently, spinlock or rwlock critical sections. For such a domain the\nupdate side can safely wait for readers by spinning, from contexts\nwhere sleeping is undesirable or the grace-period machinery\u0027s\nlatency (workqueue scheduling, jiffy-paced retries) dominates the\nactual reader drain time.\n\nBut that is only safe if every reader keeps the promise. Make the\npromise explicit and machine-checkable:\n\n - srcu_read_lock_atomic() / srcu_read_unlock_atomic() enter the\n usual (smp_mb-based) read-side critical section with preemption\n disabled and (except in hardirq, where it is redundant)\n non_block_start() armed, recording SRCU_READ_FLAVOR_ATOMIC in the\n per-CPU reader flavor. Disabling preemption enforces the\n no-sleeping promise on every configuration and bounds the section,\n so it is always running on some CPU; non_block_start() extends the\n enforcement to even potentially-sleeping calls on paths which\n happen not to block. The existing reader-flavor consistency checks\n complain about any mixing with other flavors.\n\n - synchronize_srcu_atomic() waits for all pre-existing readers by\n repeating the try_synchronize_srcu() both-epoch counter proof with\n cpu_relax() until it succeeds: no sleeping, no index flip, no\n grace-period sequence update, and therefore no interaction with\n concurrent call_srcu(), synchronize_srcu() or srcu_barrier(). It\n always provides the full grace-period guarantee: if the domain\n turns out to have had readers of any other flavor — a caller bug,\n since such a reader may be asleep and spinning on it would be\n unbounded — it complains and falls back to a real (sleeping) grace\n period internally, that being the only correct wait for a\n possibly-sleeping reader. The flavor mask is rechecked on every\n iteration so a first non-atomic reader appearing mid-spin takes\n the same path.\n\nThe immediate motivation is the proposed conversion of KVM\u0027s\ngfn_to_pfn_cache to SRCU¹, whose mmu_notifier invalidation path drains\nreaders before the primary MMU zaps a page. With the readers declared\natomic, that drain becomes spin-only: no sleeping at all in the\nnotifier, bounded by the longest reader section, satisfying even the\nstrictest reading of the OOM-reaper non-blocking requirement without\nneeding to touch the non_block_start() annotation².\n\nThis commit also adds atomic-SRCU-specific initializers:\ninit_srcu_struct_atomic(), DEFINE_SRCU_ATOMIC(), and\nDEFINE_STATIC_SRCU_ATOMIC().\n\nThis commit implements only Tree SRCU. Tiny SRCU will follow.\n\n¹ https://lore.kernel.org/all/20260811132237.102400-1-dwmw2@infradead.org/\n² https://lore.kernel.org/all/20260812134934.GC662699@ziepe.ca/\n\n[ paulmck: Apply Kunwu Chan feedback. ]\n\nCo-developed-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\nSigned-off-by: David Woodhouse \u003cdwmw2@infradead.org\u003e\nAssisted-by: Claude:claude-mythos-5\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "ee6bd18ef1673f526e795b368603f692576bb148", "tree": "3f3e69c507f14e450c89c02430d39b2cee2f94c5", "parents": [ "21345a8eff2bf1e12a5defdd12fcf364b29791a9" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Tue Aug 18 11:41:01 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:18:24 2026 -0700" }, "message": "srcutree: Suppress to-big transition for atomic SRCU\n\nInitially (and perhaps forever), call_srcu() will not be available for\natomic srcu_struct structures. There is therefore no reason to transition\nsuch a structure to big, because the main purpose of such a transition\nis to reduce lock contention for concurrent SRCU callback queueing.\n\nThis commit therefore adds an is_atomic parameter to both the\ncheck_init_srcu_struct() and init_srcu_struct_fields() functions, which\nsuppresses the initialization-time transition to big that is enabled by\ndefault on large systems.\n\nIt will still be possible to force a transition using rcutorture as a\ndestructive test. This might (or might not) be adjusted later.\n\n[ paulmck: Apply feedback from Kunwu Chan. ]\n\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "21345a8eff2bf1e12a5defdd12fcf364b29791a9", "tree": "a1f230d6361ac75d7568a585e13482678e2f5b2b", "parents": [ "835a10eeb028a932a0061ef141537f5d17fc9aac" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Tue Aug 18 10:51:42 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:18:24 2026 -0700" }, "message": "srcutree: Suppress srcu_advance_state() mutex_lock in atomic\n\nThe new SRCU_READ_FLAVOR_ATOMIC prohibits sleeping in both readers and\ngrace-period waits in order to permit waiting on an SRCU grace period\nwithin an OOM notifier. This means that srcu_advance_state() cannot\nacquire -\u003esrcu_gp_mutex in this case, because mutex_lock() can sleep.\n\nThis commit therefore adds an is_atomic parameter to srcu_advance_state().\nWhen this parameter is false, current behavior is maintained, in other\nwords, -\u003esrcu_gp_mutex is acquired and released as before. But when this\nis_atomic parameter is false, the caller is responsible for excluding\nother callers.\n\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "835a10eeb028a932a0061ef141537f5d17fc9aac", "tree": "3bf205955e55b0656947b0886f1b56d6e9d05c31", "parents": [ "0464f587c61af5bba0cc8122e8341769c8f8d73d" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Jul 09 09:36:34 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:18:24 2026 -0700" }, "message": "srcutiny: Make a Tiny SRCU grace period imply an RCU grace period\n\nIn non-preemptible kernels, a Tiny SRCU grace period implies an RCU\ngrace period because any context switch suffices. But in preemptible\nkernels, it is possible for a Tiny SRCU grace period to elapse without\na corresponding RCU grace period.\n\nWhich was OK until RCU Tasks Trace was re-implemented in terms\nof SRCU-fast, which in Tiny SRCU is implemented as SRCU, which is\nalready fast. And RCU Tasks Trace grace periods are required to imply\nRCU grace periods. This commit therefore adds a synchronize_rcu(),\nbut only in preemptible kernels.\n\nBecause preemptible Tiny SRCU is not in mainline, this added call to\nsynchronize_rcu() will not slow anything down: The comparison would\ninstead be with TREE SRCU. But if this added call ever becomes a problem,\nthe Tiny SRCU srcu_struct structure could track whether or not this is for\nSRCU-fast, and to add the synchronize_rcu() only in the SRCU-fast case.\nHowever, at the moment, this is seen as unnecessary complexity.\n\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "0464f587c61af5bba0cc8122e8341769c8f8d73d", "tree": "5b0ea33e0666ca7cf0a679afab6ad9200dd2acf9", "parents": [ "813f2ad27003296b9a0dc8ffd764c834626a2549" ], "author": { "name": "Puranjay Mohan", "email": "puranjay@kernel.org", "time": "Mon Aug 10 05:27:55 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:18:24 2026 -0700" }, "message": "selftests/bpf: Add a call_srcu() re-entry reproducer\n\nRe-enter call_srcu() from a BPF program to exercise its any-context\nsafety, via call_rcu_tasks_trace(), which is call_srcu() on\nrcu_tasks_trace_srcu_struct.\n\nAn fentry program on rcu_segcblist_enqueue() fires mid-enqueue: that\nfunction is reached from srcu_gp_start_if_needed() with the srcu_data\n-\u003elock held. The program does a task-storage delete, whose only deferred\nwork is call_rcu_tasks_trace(), re-entering the enqueue on the same CPU.\nThe handler matches on TID and fires once; pinning the thread removes the\nmigration window between picking the srcu_data and taking its lock.\n\nWithout the fix the nested call re-takes the same sdp lock and\nself-deadlocks; with it the nested __call_srcu() sees interrupts disabled\nand defers via irq_work, so the delete returns and the test passes.\n\nThe test skips where it does not apply: Tiny RCU has no\nrcu_segcblist_enqueue() to attach to, and a UP+PREEMPT kernel pairs Tree\nRCU with Tiny SRCU, so the attach succeeds but call_srcu() never reaches\nthe enqueue. Tiny SRCU is told apart by srcu_expedite_current(), which it\nstubs out, so on Tree SRCU a zero hit count fails rather than skips and the\nreproducer cannot quietly stop reproducing.\n\nSigned-off-by: Puranjay Mohan \u003cpuranjay@kernel.org\u003e\nAcked-by: Kumar Kartikeya Dwivedi \u003cmemxor@gmail.com\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "813f2ad27003296b9a0dc8ffd764c834626a2549", "tree": "ddddc1651c0fcd7fc478d21fb7b61c3e934429eb", "parents": [ "d23e30d76c32d88845ce8cf4ce069addb5fa4910" ], "author": { "name": "Puranjay Mohan", "email": "puranjay@kernel.org", "time": "Mon Aug 10 05:27:54 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:18:24 2026 -0700" }, "message": "rcutorture: Exercise -\u003ecall() from NMI context\n\ncall_rcu() and call_srcu() are now safe to invoke from NMI, but\nrcutorture never does, leaving the deferral path untested.\n\nAdd an -\u003enmi_capable flag to rcu_torture_ops. For flavors that set it,\narm a per-CPU hardware perf counter whose overflow handler submits a\ncallback via -\u003ecall(). The handler acts only when in_nmi(), so only a\ngenuine NMI exercises the deferral path. One preallocated callback per\nCPU is kept in flight, guarded by an atomic, to avoid allocating in NMI.\nThe counter uses a fixed sample period rather than a frequency: a\nfrequency-based event sets TICK_DEP_BIT_PERF_EVENTS and would pin the tick\nfor the whole run on NO_HZ_FULL kernels.\n\nReport the count issued from NMI (\"nmi-calls:\") and the count invoked\n(\"nmi-cbs:\"). rcu_torture_cleanup() disables the counters and then calls\ncb_barrier(), which drains every deferred callback, so the two counts must\nthen match; a mismatch fails the test. This relies on\nrcu_barrier()/srcu_barrier() flushing deferred callbacks, as added earlier\nin the series.\n\nSet -\u003enmi_capable on the NMI-safe flavors: rcu, srcu, srcud, and\ntasks-tracing (call_srcu() under the hood). Tasks and Tasks Rude are left\nalone, as call_rcu_tasks_generic() is not yet NMI-safe.\n\nEnabled by default; the nmi_calls parameter disables it, which helps rule\nNMI handling in or out when triaging a failure. Requires\nCONFIG_PERF_EVENTS and a hardware PMU: without one nothing is issued from\nNMI and the end-of-test check compares zero against zero, so a pass does\nnot by itself mean the path ran. That is the case under kvm.sh, which\nboots qemu with -cpu kvm64 and no vPMU; rcu_torture_nmi_cleanup() says so\non the console.\n\nSigned-off-by: Puranjay Mohan \u003cpuranjay@kernel.org\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "d23e30d76c32d88845ce8cf4ce069addb5fa4910", "tree": "8730f9cf20f2a77eb19aa90ec3119240c86c000d", "parents": [ "a04b2854bedc788d2e1bb421592c2a68633fd036" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Wed Aug 05 13:18:58 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:18:24 2026 -0700" }, "message": "rcutorture: Disable fragile readers during overload testing\n\nVanilla RCU readers, when either non-preemptible or preemptible with\npriority-boosting enabled, can handle heavy overload conditions.\nOther RCU implementations are more fragile. This commit adds an\nrcu_torture_ops structure field named -\u003erdrs_handle_load that is set\nfor non-fragile configurations of vanilla RCU, but cleared otherwise.\nIt also refrains from running fragile readers concurrently with overload\ntesting, thus avoiding false-positive overload-testing failures.\n\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "a04b2854bedc788d2e1bb421592c2a68633fd036", "tree": "e9f15945048286270837a2fff24fa3cce8e5c959", "parents": [ "35a26d87042b7c9814165f244a141104655ed345" ], "author": { "name": "Puranjay Mohan", "email": "puranjay@kernel.org", "time": "Mon Aug 10 05:27:53 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:18:24 2026 -0700" }, "message": "srcu: Make Tiny call_srcu() safe to call from any context\n\nGive Tiny call_srcu() the same treatment as Tree SRCU. When interrupts\nare disabled and the scheduler is up, stage the callback on the\nsrcu_struct\u0027s lockless list for an irq_work to re-issue later. Tiny SRCU\nis uniprocessor, so there is no CPU-offline drain. A draining flag drops\na deferring call_srcu() that re-enters mid-drain (unless from an NMI), as\nin Tree SRCU; such a drop can strand state the caller tied to the callback,\nnot just the callback itself.\n\nInterrupts stay off for the whole batch. TINY_SRCU implies !SMP, where\narch_irq_work_has_interrupt() is false, so the drain always waits for the\ntick and a batch is whatever one tick\u0027s worth of interrupts-disabled\ncall_srcu()s staged. Unlike the other three flavors srcu_do_enqueue() here\nhas no debug_rcu_head_queue(), so nothing reports a double call_srcu();\ntermination of the drain rests on srcu_do_enqueue() clearing -\u003enext, and\nthe callback list self-links at the tail exactly as a double call_srcu()\nmade it before.\n\nsrcu_barrier() (now out of line) and cleanup_srcu_struct() drain the\ndeferred list first, so a deferred callback is re-issued onto the callback\nlist and invoked by the grace-period work that cleanup_srcu_struct()\nflushes, rather than stranded on a soon-to-be-freed srcu_struct.\ncleanup_srcu_struct() also syncs -\u003edefer_iw, since that irq_work is\nembedded in the srcu_struct the caller is about to free.\n\nThe draining flag is global rather than per-srcu_struct: a re-entrant\ncall_srcu(B) inside a drain of A raises B\u0027s own -\u003edefer_iw, whose drain can\nstage back onto A, so a per-srcu_struct flag would not break the chain.\nThe cost is that a drain of A also drops a non-NMI call_srcu() to any\nother srcu_struct for its duration.\n\nGated by CONFIG_RCU_DEFER like Tree SRCU, though the srcu_struct members\nare unconditional.\n\nSuggested-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\nSigned-off-by: Puranjay Mohan \u003cpuranjay@kernel.org\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "35a26d87042b7c9814165f244a141104655ed345", "tree": "780bac591995853f2c2c3d31a2678fbc25b2f626", "parents": [ "0ed912d346fdb2ecc3bd03674134b956aa8e7c5d" ], "author": { "name": "Puranjay Mohan", "email": "puranjay@kernel.org", "time": "Mon Aug 10 05:27:52 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:18:24 2026 -0700" }, "message": "srcu: Make call_srcu() safe to call from any context\n\ncall_srcu() has the same constraint as call_rcu():\nsrcu_gp_start_if_needed() enqueues under raw_spin_lock_irqsave() and may\nwalk the srcu_node tree, as do callback invocation and grace-period work,\nso a call_srcu() with interrupts already disabled can race an operation in\nflight on this CPU. call_rcu_tasks_trace() is call_srcu() under the hood,\nso a sleepable BPF program freeing an object can reach this.\n\nDefer as call_rcu() does: stage the callback on the srcu_data\u0027s\n-\u003edefer_cbs, chain that srcu_data onto a per-CPU list, and raise a per-CPU\nirq_work that re-issues it straight to the enqueue helper, never back\nthrough __call_srcu(). The irqs-enabled path is unchanged; as for\ncall_rcu() the gate is bare irqs_disabled(), so callers that merely hold\ninterrupts off are deferred too and pay one irq_work hop, including\ncall_rcu_tasks_trace() from the BPF memalloc irq_work.\n\nThe irq_work is per-CPU rather than per-srcu_struct and statically\ninitialized, so deferral never runs check_init_srcu_struct(); it is\nIRQ_WORK_INIT_HARD as for call_rcu(). srcu_barrier() flushes it first, and\nrcutree_migrate_callbacks() calls srcu_offline_drain() for an outgoing CPU.\ncleanup_srcu_struct() drains before its \"just leak it\" early returns, and\nsrcu_module_going() before freeing any -\u003esda, since a staged srcu_data left\nchained on a per-CPU list would dangle. Staging is two steps, the callback\nonto\n-\u003edefer_cbs and then the srcu_data onto the per-CPU list, so a flusher can\nfind the per-CPU list empty while a callback whose call_srcu() has not\nreturned sits on -\u003edefer_cbs; the staging CPU\u0027s own irq_work takes that\none.\n\nThe per-CPU srcu_defer -\u003elock, not any srcu_data\u0027s, is held with interrupts\noff across the whole nested drain: the chain of srcu_datas staged on that\nCPU and, for each, its callbacks, with srcu_do_enqueue() taking that\nsrcu_data\u0027s -\u003elock and possibly starting a grace period for every one.\nThat is what serializes the drainers. The bound is as for call_rcu(): what\none interrupts-disabled region could stage, normally a single callback, or\nwhatever accumulates before the tick where arch_irq_work_has_interrupt() is\nfalse. Both lists are drained newest-first; nothing depends on call_srcu()\nordering.\n\nThe drain clears -\u003enext before re-issuing, which bounds a node self-linked\nby a double call_srcu(); a longer cycle is not bounded, and a double\ncall_srcu() stays undefined, as for call_rcu().\n\nA callback deferred past the CPUHP_AP_SMPCFD_DYING irq_work flush leaves\nthat CPU\u0027s srcu_defer -\u003eiw claimed with its self-IPI lost, as for\ncall_rcu(). srcu_offline_drain() still re-issues the callback, but the\nirq_work cannot be un-queued, and here the claim is shared by every\nsrcu_struct on the CPU.\n\nAs in call_rcu(), the re-issue runs with interrupts disabled and can be\nre-entered by instrumentation, so a per-CPU flag, set only while that CPU\nis inside its own irq_work drain, drops a deferring call_srcu() seen\nmid-drain unless it comes from an NMI. Such a drop can strand state the\ncaller associated with the callback, not just the callback itself.\n\nStaging records only the callback, so a deferred expedited call_srcu()\ncompletes as a normal grace period. Only srcu_expedite_current() can hit\nthat, and only when invoked with interrupts already disabled.\n\nGated by CONFIG_RCU_DEFER, though the srcu_data members and the per-CPU\nsrcu_defer are unconditional. Under CONFIG_PROVE_RCU, warn if the direct\npath is reached from an NMI.\n\nSuggested-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\nSigned-off-by: Puranjay Mohan \u003cpuranjay@kernel.org\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "0ed912d346fdb2ecc3bd03674134b956aa8e7c5d", "tree": "954ed48c282bde0cb715131f421cc0a3c027107a", "parents": [ "af78eca13b0350ee04665ffa4af88ff4dae6c3e0" ], "author": { "name": "Puranjay Mohan", "email": "puranjay@kernel.org", "time": "Mon Aug 10 05:27:51 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:18:23 2026 -0700" }, "message": "rcu: Make Tiny call_rcu() safe to call from any context\n\nGive Tiny call_rcu() the same treatment as Tree RCU. When interrupts are\ndisabled and the scheduler is up, stage the callback on a lockless list\nthat an irq_work re-issues later. One global list and irq_work suffice\nsince Tiny RCU is uniprocessor, and there is no CPU-offline drain.\n\nThe re-issue runs with interrupts disabled and can be re-entered by\ninstrumentation, so a draining flag drops a deferring call_rcu() seen\nmid-drain (unless from an NMI), as in Tree RCU. Gated by CONFIG_RCU_DEFER,\nthough the deferral state is unconditional.\n\nInterrupts stay off for the whole batch, but the re-issue is a tail append\nwith no locks. TINY_RCU implies !SMP, where arch_irq_work_has_interrupt()\nis false, so the drain always waits for the tick and a batch is whatever\none tick\u0027s worth of interrupts-disabled call_rcu()s staged. As in Tree\nRCU the drain clears -\u003enext before re-issuing, which bounds a node\nself-linked by a double call_rcu(): rcu_do_enqueue()\u0027s duplicate path\nreturns without clearing it. A longer cycle is not bounded; a double\ncall_rcu() stays undefined.\n\nThe idle-task reschedule moves out of the enqueue helper so that a drain\ndoes it once for the batch rather than once per callback, which would\notherwise take the runqueue lock N times with interrupts disabled.\n\nSuggested-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\nSigned-off-by: Puranjay Mohan \u003cpuranjay@kernel.org\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "af78eca13b0350ee04665ffa4af88ff4dae6c3e0", "tree": "4c67f150656c65ebaa780bf6fb4943c0636f94d8", "parents": [ "26f90559a77cac4b8fdfa3491732b7c7e08210ac" ], "author": { "name": "Puranjay Mohan", "email": "puranjay@kernel.org", "time": "Mon Aug 10 05:27:50 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:18:23 2026 -0700" }, "message": "rcu: Make call_rcu() safe to call from any context\n\nRCU\u0027s per-CPU callback list is only touched with interrupts disabled: the\nenqueue runs under local_irq_save() (and the nocb locks when offloaded),\nas do callback invocation and grace-period work. A call_rcu() that\narrives with interrupts already disabled, whether from an NMI or from\ninstrumentation that re-enters RCU, can interrupt one of those and corrupt\nthe list or deadlock.\n\nDefer instead: stage the callback on a per-CPU llist and raise an irq_work\nthat re-issues it once interrupts are on, straight to the enqueue so it\ncannot defer again. The gate is bare irqs_disabled(), so callers that\nmerely hold interrupts off are deferred too and pay one irq_work hop.\nSkip it while the scheduler is down (RCU_SCHEDULER_INACTIVE): irq_work is\nnot usable that early, rcu_init() already calls call_rcu(), and the per-CPU\ndeferral state is not initialised until rcu_init_one() runs later in it.\n\nrcu_barrier() drains every CPU\u0027s -\u003edefer_head before it scans the lists,\nand rcutree_migrate_callbacks() drains an outgoing CPU\u0027s. A drain\nre-issues onto the draining CPU, so a barrier moves other CPUs\u0027 staged\ncallbacks onto\nits own -\u003ecblist; call_rcu() promises no CPU affinity for invocation.\n-\u003edefer_lock is held across llist_del_all() and the whole re-issue so the\ndrainers\nserialize: one that finds the list empty can conclude that everything\nstaged before it is already on a callback list. Interrupts stay off for\nthe batch. Where the arch has an irq_work self-IPI that is what one\ninterrupts-disabled region could stage, normally a single callback; where\narch_irq_work_has_interrupt() is false the drain waits for the tick, so\nseveral regions can accumulate first.\n\nThe drain clears -\u003enext before re-issuing. A double call_rcu() on a head\nthat is already debug-object-active self-links the staged node, and\nrcu_do_enqueue()\u0027s duplicate path returns without clearing it, so the\ndrain would spin. A re-add behind other staged callbacks makes a longer\ncycle, which that does not bound; a double call_rcu() stays undefined.\nllist_del_all() yields newest-first, so a batch is re-issued in reverse\ncall order; nothing depends on call_rcu() ordering. The re-issue drops\nthe lazy hint, since staging records only -\u003efunc, so a deferred callback\nloses its batching on CONFIG_RCU_LAZY. kasan_record_aux_stack() moves to\n__call_rcu_common() so a use-after-free report names the caller rather\nthan the irq_work.\n\nThe re-issue runs with interrupts disabled, so instrumentation on the\nenqueue path can re-enter call_rcu(), stage another callback and re-raise\nthe irq_work, livelocking the drain. A per-CPU flag guards it: a deferral\nthat arrives while this CPU is draining, and is not from an NMI, is\ndropped. The WARN_ONCE() is under CONFIG_PROVE_RCU, so a production kernel\ndrops it silently. That leaks the callback and can strand state\nthe caller tied to it, since a one-shot flag only the callback clears\nnever resets, but the alternative is an unbounded loop.\n\nA callback deferred past the CPUHP_AP_SMPCFD_DYING irq_work flush leaves\n-\u003edefer_work claimed with its self-IPI lost. rcutree_migrate_callbacks()\nstill re-issues the callback, but the first deferral after that CPU comes\nback raises no IPI and waits for the next irq_work there, or for\nrcu_barrier(). Unqueueing an irq_work is not something the API offers.\n\nThe irq_work is IRQ_WORK_INIT_HARD so the re-issue stays prompt on\nPREEMPT_RT, where a non-HARD irq_work runs in a kthread that can be\ndelayed under load. A hidden CONFIG_RCU_DEFER gates the deferral code and\nits IRQ_WORK dependency, though the rcu_data members are unconditional;\nwithout it call_rcu() enqueues directly as before. Under\nCONFIG_PROVE_RCU, warn if the direct path is reached from an NMI.\n\nSuggested-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\nSigned-off-by: Puranjay Mohan \u003cpuranjay@kernel.org\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "26f90559a77cac4b8fdfa3491732b7c7e08210ac", "tree": "146e8cee752f106a1ca30b5ae0024a1eb2c7a11c", "parents": [ "cee9395acd8043be0644b25c34bfa86623f2b935" ], "author": { "name": "Sunho Park", "email": "shpark061104@gmail.com", "time": "Sun Aug 30 18:56:05 2026 +0900" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Oct 01 17:17:48 2026 -0700" }, "message": "srcu: Fix WARN_ON() for rcu_segcblist_n_cbs() in cleanup_srcu_struct()\n\nThe WARN_ON() added by commit 78a38cbf6f20 (\"srcu: Queue sdp-\u003ework\nwhen the delay timer is successfully deleted\") uses rcu_segcblist_n_cbs()\nto detect callbacks that srcu_barrier() failed to wait for. However, the\n-\u003elen counter is decremented only at the end of srcu_invoke_callbacks(),\nafter the invoking loop has finished. Since srcu_barrier() can return\nright after the barrier callback is invoked, cleanup_srcu_struct() can see\na non-zero n_cbs even though the cblist is already physically empty,\nfalsely triggering the WARN_ON() together with a still-pending delay_work\ntimer.\n\nThis can be triggered as follows, as seen in the syzbot report against\nkvm_destroy_vm() -\u003e cleanup_srcu_struct(\u0026kvm-\u003esrcu):\n\n1. call_srcu(\u0026kvm-\u003esrcu, \u0026bus-\u003ercu, __free_bus) starts SRCU grace\n period GP1.\n\n2. GP1 ends: a delay timer is armed and sdp-\u003ework is queued, but\n sdp-\u003ework has not run yet.\n\n3. Another call_srcu(\u0026kvm-\u003esrcu, \u0026bus-\u003ercu, __free_bus) call invokes\n srcu_segcblist_advance(), which moves the GP1 callback to\n RCU_DONE_TAIL, and starts SRCU grace period GP2.\n\n4. srcu_barrier() is called. It queues its barrier callback after the\n GP2 callback and waits for srcu_invoke_callbacks() to invoke it.\n\n5. GP2 ends: another delay timer is armed, and the sdp-\u003ework queued in\n step 2 begins to run. Its srcu_invoke_callbacks() call invokes\n srcu_segcblist_advance() again, moving the GP2 and barrier callbacks\n to RCU_DONE_TAIL as well, and then invokes all of them. However,\n rcu_segcblist_add_len(), which updates srcu_cblist\u0027s -\u003elen, has not\n run yet at this point.\n\n6. srcu_barrier() returns once its callback has been invoked, and\n cleanup_srcu_struct() starts running. It finds the delay timer\n armed in step 5 still pending and srcu_cblist\u0027s -\u003elen still\n non-zero (because step 5 has not reached rcu_segcblist_add_len()\n yet), and WARN_ON() fires even though every callback has actually\n been invoked.\n\nUse rcu_segcblist_empty(), which checks the actual head of the cblist,\ninstead of rcu_segcblist_n_cbs(), which checks the racy -\u003elen counter.\nCallbacks that have genuinely not been invoked yet still leave the list\nnon-empty, so the WARN_ON() still catches callers that skip srcu_barrier()\nor queue callbacks after it.\n\nLink: https://lore.kernel.org/rcu/e6350377085ddd85d6ef00d8e9a67bd50c762d3c@linux.dev/T/#t\nReported-by: syzbot+d4faf7db59e11f6fd1ab@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003dd4faf7db59e11f6fd1ab\nFixes: 78a38cbf6f20 (\"srcu: Queue sdp-\u003ework when the delay timer is successfully deleted\")\nSuggested-by: Zqiang \u003cqiang.zhang@linux.dev\u003e\nSigned-off-by: Sunho Park \u003cshpark061104@gmail.com\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\nTested-by: Sean Christopherson \u003cseanjc@google.com\u003e\n" }, { "commit": "e71035eb6e2d8af8bfde78938671695571e6d063", "tree": "a2be17f3c3ebc3a7a8cd4f146f4e612bb82c2bed", "parents": [ "4c714f015d9ecc37d7a330b31822ccbcaff5ddc9" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Wed Sep 02 17:30:02 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Sep 18 16:14:54 2026 -0700" }, "message": "rcu: Don\u0027t panic on already-ended RCU CPU stalls\n\nThe current RCU CPU stall-warning code can say \"INFO: Stall ended before\nstate dump start\" but then panic the system anyway. This commit therefore\navoids panicking the system if the stall has already ended.\n\nHowever, the sched_ext scheduler will still be ejected, as it might have\nbeen the cause of the almost stall. This can easily be changed if needed.\n\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "4c714f015d9ecc37d7a330b31822ccbcaff5ddc9", "tree": "a3ee522ab57087db75ec649b1323fa39b26d2f5b", "parents": [ "b3eb16109ae108c3464b0f5f8850ca4b6085561a" ], "author": { "name": "Longlong Xia", "email": "xialonglong@kylinos.cn", "time": "Wed Aug 26 16:21:50 2026 +0800" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Sep 17 15:42:03 2026 -0700" }, "message": "rcu: fix shrink budget underflow in lazy_rcu_shrink_scan\n\nThe lazy RCU shrinker decremented sc-\u003enr_to_scan (unsigned long)\nand then tested the result with \u003c\u003d 0. When a single CPU\u0027s lazy\ncallback count exceeds the remaining budget, the subtraction wraps\nto a large positive value and the \u003c\u003d 0 comparison, which is\nequivalent to \u003d\u003d 0 for an unsigned type, never fires again. The\nscan loop then iterates through every nocb CPU instead of honouring\nthe reclaim budget.\n\nAccumulate into count and stop once count \u003e\u003d nr_to_scan.\n\nFixes: c945b4da7a448 (\"rcu: Shrinker for lazy rcu\")\nAssisted-by: Zcode:GLM-5.2\nSigned-off-by: Longlong Xia \u003cxialonglong@kylinos.cn\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "b3eb16109ae108c3464b0f5f8850ca4b6085561a", "tree": "77f485e27ae4b10664c4786987e83d62f822e651", "parents": [ "cee9395acd8043be0644b25c34bfa86623f2b935" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Wed Aug 05 21:21:29 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Sep 17 15:42:03 2026 -0700" }, "message": "doc: Update stallwarn.rst based on RCU Tasks Trace as SRCU\n\nNow that RCU Tasks Trace has been re-implemented in terms of SRCU,\nupdate stallwarn.rst to remove obsolete verbiage about RCU Tasks Trace\nstall warnings.\n\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "cee9395acd8043be0644b25c34bfa86623f2b935", "tree": "40f18a04489cadca07bfa864ca8f62c8d3d80806", "parents": [ "78bb208b99e7d3314f670710fa9ee0a793682bca" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 30 13:34:40 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 30 13:34:40 2026 -0700" }, "message": "Linux 7.3-rc1\n" }, { "commit": "78bb208b99e7d3314f670710fa9ee0a793682bca", "tree": "611c2459d965a68ff88af1a0241f8d5d89716e56", "parents": [ "eea8bdcb59e02729a33a8666f7b0b5e30e6cb736", "b15b548d52b43ba8ac4652bc2c7244a8dd1e9622" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 30 10:53:24 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 30 10:53:24 2026 -0700" }, "message": "Merge tag \u0027i2c-fixes-7.3-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux\n\nPull i2c fixes from Andi Shyti:\n \"Fixes mainly for teardown and resource handling, runtime PM and\n hardware-specific controller issues:\n\n - fix debugfs use-after-free when removing the adapter\n\n - designware: apply interrupt mask quirk for HJMC3001\n\n - imx-lpi2c: avoid target accesses on master-only controllers\n\n - mux: release channel node when adapter registration fails\n\n - qcom-cci: fix autosuspend and runtime PM cleanup on removal\n\n - qcom-geni: fix timing parameters for 32 MHz clock\"\n\n* tag \u0027i2c-fixes-7.3-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux:\n i2c: core: fix debugfs UAF on adapter removal\n i2c: imx-lpi2c: avoid accessing target registers on master-only controllers\n i2c: qcom-cci: fix autosuspend cleanup\n i2c: designware: Enable interrupt mask workaround for HJMC3001\n i2c: qcom-geni: update frequency table to fix timing parameters\n i2c: mux: Fix channel node leak on adapter add failure\n" }, { "commit": "eea8bdcb59e02729a33a8666f7b0b5e30e6cb736", "tree": "13129668f546c78eb4c64ba97cfa9227c4e60b55", "parents": [ "cbb4c6d9af7dde462f8c9261bdcd35c47a0b4054", "ef6a1dca8de41a408019310649e6d1b7b21ac4bc" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 30 10:42:40 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 30 10:42:40 2026 -0700" }, "message": "Merge tag \u0027cocci-7.3-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux\n\nPull Coccinelle updates from Julia Lawall:\n\n - Clean up a number of the semantic patches in the scripts/coccinelle\n directory, particularly with respect to functions that no longer\n exist in the kernel (Sang-Heon Jeon)\n\n He and I have also done some reorganizations that improve\n performance.\n\n - Eliminate some false positives (me)\n\n - Fix an out of date URL (相浦彰)\n\n* tag \u0027cocci-7.3-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux:\n coccinelle: ifnulldev_put: update error message\n coccinelle: ifnulldev_put: update outdated helper names\n coccinelle: atomic_as_refcounter: drop atomic_long_dec_and_lock\n coccinelle: kfree_mismatch: drop vmalloc_exec\n coccinelle: pool_zalloc-simple: drop the pci_pool_alloc rules\n coccinelle: zalloc-simple: drop the kmem_alloc rules\n coccinelle: alloc_cast: drop removed allocators\n coccinelle: remove obsolete pci_free_consistent.cocci\n scripts: coccinelle: devm_free: reduce false positives\n coccinelle: misc: struct_size: drop unneeded parentheses\n coccinelle: mini_lock: improve performance when searching loops\n coccinelle: api: check for macro context\n coccinelle: update Coccinelle website URL\n coccinelle: misc: minmax: avoid unhelpful isomorphisms\n coccinelle: misc: minmax: check for the presence of if cases\n coccinelle: misc: minmax: drop unneeded parentheses\n coccinelle: misc: minmax: improve performance when no candidate exists\n coccinelle: double_lock: improve performance when no double lock exists\n" }, { "commit": "cbb4c6d9af7dde462f8c9261bdcd35c47a0b4054", "tree": "7186d2b63cd47031f0b8f4e76b53a0f78276422d", "parents": [ "a23cbb05744b22719efdc34f9e329a120e81e617" ], "author": { "name": "Darrick J. Wong", "email": "djwong@kernel.org", "time": "Fri Aug 28 09:15:01 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 30 10:29:08 2026 -0700" }, "message": "CREDITS/mailmap: add some info about Darrick J. Wong\n\nAdd myself to CREDITS because apparently I\u0027ve never done that; and\nupdate mailmap so that all my old email addresses get remapped to the\nkernel.org redirector.\n\nSigned-off-by: \"Darrick J. Wong\" \u003cdjwong@kernel.org\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "a23cbb05744b22719efdc34f9e329a120e81e617", "tree": "f16d636557c5c6bf2e5528f926e64a2fb41da260", "parents": [ "637836563deb95f4338decf2d2d832c4deef022a", "64f74d8f728877858372c52067e5c0c091f8db24" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 30 10:19:11 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 30 10:19:11 2026 -0700" }, "message": "Merge tag \u0027timers-urgent-2026-08-30\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull timer fix from Ingo Molnar:\n\n - Fix UM build regression caused by the removal of the UM\n specific timex.h header (Thomas Weißschuh)\n\n* tag \u0027timers-urgent-2026-08-30\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n um: Use asm-generic/timex.h over the host architecture one\n" }, { "commit": "637836563deb95f4338decf2d2d832c4deef022a", "tree": "3310a88f40dc986e35a8d61bf7cab0c1e085d115", "parents": [ "f59c074e76a6a9ea55818373decdf56c6fddca30", "46094a7708b7945cb7eba9eb887e3ea9757440a7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 30 09:57:35 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 30 09:57:35 2026 -0700" }, "message": "Merge tag \u0027locking-urgent-2026-08-30\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull locking fix from Ingo Molnar:\n\n - Revert a commit to spinlock cleanup guards that got caught up\n in the subtle limitations \u0026 fragility of guards (again...) and\n caused a regression (Peter Zijlstra)\n\n* tag \u0027locking-urgent-2026-08-30\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n locking: Revert switching guards to _irq_{disable,enable}()\n" }, { "commit": "f59c074e76a6a9ea55818373decdf56c6fddca30", "tree": "29fb3ea5dfb5a7a52977766b7178146b9fce83b6", "parents": [ "0fe792fa9b616b790f03cbeed067b83eeaae7e7e", "1b0bab4a873f1034c27573cfc613394cff7e0a5b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 30 09:47:39 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 30 09:47:39 2026 -0700" }, "message": "Merge tag \u0027rust-fixes-7.3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux\n\nPull Rust fixes from Miguel Ojeda:\n \"Toolchain and infrastructure:\n\n - Fix KCFI failures, such as in Rust doctests, by disabling function\n merging when CFI is enabled. Gary reported the LLVM bug to upstream\n and it is now fixed in their mainline.\n\n - Fix \u0027objtool\u0027 fallthrough warnings under the experimental\n \u0027CONFIG_RUST_INLINE_HELPERS\u0027 by passing (for the combined Rust and\n helpers code) the LLVM options needed to preserve the unreachable\n traps that \u0027rustc\u0027 normally emits.\n\n In addition, fix \u0027objtool\u0027 errors when LTO is enabled on top, by\n also filtering out the LTO flags (for the combined Rust and helpers\n code) so that the traps are kept in place.\n\n - Fix \u0027objtool\u0027 warnings by adding one more \u0027noreturn\u0027 function.\n\n - Fix \u0027make rusttest\u0027 target when the \u0027rustc-dev\u0027 component is\n installed and Rust \u003e\u003d 1.82.0, \u003c\u003d 1.87.0 is used.\n\n \u0027kernel\u0027 crate:\n\n - \u0027num\u0027 module: fix soundness issue in the \u0027Bounded\u0027 conversion from\n \u0027bool\u0027 by restricting the conversions to unsigned \u0027Bounded\u0027.\n\n - \u0027jump_label\u0027 module: fix future \u0027make rusttest\u0027 target failures\n when \u0027ARCH\u003d\u0027 is set to an arch different than the host\u0027s.\n\n - \u0027list\u0027 module: fix incorrect \u0027pop_back()\u0027 comment\"\n\n* tag \u0027rust-fixes-7.3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:\n rust: kbuild: disambiguate `zerocopy_derive` for `rusttest`\n rust: num: restrict bool conversion to unsigned Bounded\n kbuild: rust: keep Rust objects out of Clang LTO with inline helpers\n kbuild: rust: preserve unreachable traps with inline helpers\n rust: cfi: disable function merging if CFI is enabled\n rust: jump_label: skip arch-specific asm in `testlib` builds\n objtool/rust: add one more `noreturn` Rust function\n rust: kernel: list: fix incorrect pop_back example comment\n" }, { "commit": "0fe792fa9b616b790f03cbeed067b83eeaae7e7e", "tree": "592def0c1a5ad43870105b325d0abe40c65ee3bd", "parents": [ "fb5b59a6a678bab054a78d99eecfdb6f5558e82e", "1a89abc009cb5035d0cb4e5ba48d32b94f30e8e4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 30 09:43:01 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 30 09:43:01 2026 -0700" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux\n\nPull arm updates from Russell King:\n \"Updates for 7.3:\n\n - add module description for kprobes testing module\n\n - remove references to CONFIG_CPU_ARM92x_CPU_IDLE options\n\n - expand comment in ARM\u0027s __switch_to()\n\n Also a number of fixes that missed 7.2:\n\n - disable broken eBPF on RiscPC\n\n - more BKPT fixes (guys, it\u0027s a *very* bad idea when everyone uses\n the BKPT instruction for their own differing purposes)\n\n - another preempt-rt fix, this time for siglock / CPU timers\n\n - fix another path where we try to send signals to processes with\n interrupts disabled\n\n - acquire mmap write lock for show_pte() with user faults\"\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux:\n ARM: 9480/1: entry: expand comment in __switch_to\n ARM: 9478/1: Remove references to removed CONFIG_CPU_ARM92x_CPU_IDLE options\n ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults\n ARM: 9484/1: enable interrupts when unhandled user faults are triggered\n ARM: 9483/1: select HAVE_POSIX_CPU_TIMERS_TASK_WORK\n ARM: 9481/2: breakpoint: CFI breakpoints only on demand\n ARM: 9477/1: Disable broken eBPF JIT on the Risc PC\n ARM: 9473/1: kprobes: test: add MODULE_DESCRIPTION\n" }, { "commit": "fb5b59a6a678bab054a78d99eecfdb6f5558e82e", "tree": "5c777bc9b314223fbfc9418fae093d7df571031e", "parents": [ "034dd340b08be1f2f0477ad16131d609f9dbd53c", "78004e9a87f240df03e2f73120d291763c32e0a7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 30 09:26:54 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 30 09:26:54 2026 -0700" }, "message": "Merge tag \u0027for-linus\u0027 of https://github.com/openrisc/linux\n\nPull OpenRISC updates from Stafford Horne:\n \"One small trivial macro cleanup and one bug fix.\n\n The bug fix is to fix an unchecked access in our or1k_atomic syscall,\n I am debating if we should just deprecate this as there is minimal\n need for it\"\n\n* tag \u0027for-linus\u0027 of https://github.com/openrisc/linux:\n openrisc: fix arbitrary kernel memory access via or1k_atomic syscall\n openrisc: drop unneeded semicolon\n" }, { "commit": "034dd340b08be1f2f0477ad16131d609f9dbd53c", "tree": "2536f4b2d7893ccd916b5abdf3c454ad6edc03c2", "parents": [ "08dbfad3f5040f5bdb6c529da20d6d4e81fefd72", "5eab74874d11160725c42ab676ba97a797a362eb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 30 09:22:00 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Aug 30 09:22:00 2026 -0700" }, "message": "Merge tag \u0027trace-v7.3-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull tracing fixes from Steven Rostedt:\n\n - Fix error output of boot instance creation failure\n\n Currently if a boot instance creation fails, instead of printing out\n the name of the instance that failed, it prints \"(null)\". That is\n because it prints \"cur_str\" that had already been processed by\n strsep(). Print the saved name instead.\n\n While at it, print the error code of the failure.\n\n - Fix use-after-free for same named historgrams\n\n Histograms can be named so that they can be used in multiple events.\n But if the named histogram has a variable attached, the second event\n that uses the named histogram which duplicates it and needs to free\n the original after duplication leaves the old variable in place and\n still visible. If another histogram uses than variable, it will use\n the stale one which will try to reference the freed duplicate\n histogram and crash the kernel.\n\n Free the duplicate variables along with the duplicated histogram\n data.\n\n - Check return value of kthread_run() in event self test\n\n The events self tests uses a kthread for testing but does not check\n if it succeeded in creating a kthread. If the kthread creation were\n to fail, the code will still try to call kthread_stop() on the error\n returned.\n\n - Fix race between reading trace_pipe and updating subbuffer size\n\n If a user is reading the trace_pipe file at the same time they update\n the ring buffer sub-buffer size, can cause the trace_pipe read to\n read stale data. Add trace_access_lock() around updating the ring\n buffer sub-buffer size.\n\n - Fix eventfs_inode on failure path in creation of the events directory\n\n In the creation of the \"events\" directory, if after allocating the\n eventfs_inode a failure is detected, it calls cleanup_ei() which\n calls free_ei(). The free_ei() will test if eventfs_inode being freed\n has no children. It is a bug if it does. But on the failure case of\n the creation of the \"events\" directory, the children lists have not\n yet been initialized and the free will trigger a warning because\n list_empty() on an uninitialized list returns false.\n\n Move the initialization into init_ei() where it makes more sense and\n makes sure that a created eventfs_inode has its lists initialized\n upon creation.\n\n - Check return value of kthread_run() in ftrace direct sample code\n\n The sample code that shows how to use the ftrace direct calls does\n not test the return of kthread_run() to see if it succeeds. Return a\n failure if the kthread_run() doesn\u0027t succeed.\n\n - Clear user events state on fork in case of alloc failure\n\n On fork, the child gets a pointer to the parent\u0027s user events state.\n It makes a copy of it then updates the child\u0027s pointer to it. But if\n the allocation fails, the duplication function leaves the child with\n a pointer to its parent\u0027s descriptor. When the child cleans up its\n data, it will free the parent\u0027s descriptor while the parent is still\n using it.\n\n In the duplication function, set the child\u0027s user_event_mm to NULL\n before testing if the allocation succeeded, and when it exits it will\n not free the parent\u0027s descriptor.\n\n - Fix retry exhaustion in simple ring buffer reader swap\n\n simple_ring_buffer_swap_reader_page() starts with retry set to 8 and\n post-decrements it only after a failed link replacement. On the final\n attempt, a successful replacement leaves retry at zero, while a\n failed replacement leaves it at -1.\n\n But the check for success expects the retry value to be non-zero and\n exits with an error on zero. This is the opposite result. Fix it.\n\n - Fail nicely when the remote swap_reader_page() returns an error\n\n Currently, if the swap_reader_page() of a remote buffer fails, it\n triggers a WARN_ON_ONCE() and continues normally. Instead, have it\n exit with an error and a pr_warn() print instead of a full WARNING.\n\n* tag \u0027trace-v7.3-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n ring-buffer: Stop remote reader update when page swap fails\n tracing: Fix retry exhaustion in simple ring buffer reader swap\n tracing/user_events: Clear copied tracing state before fork duplication\n samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify\n samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-modify\n eventfs: Initialize ei-\u003echildren and ei-\u003elist in init_ei()\n tracing: Fix use-after-free in trace_pipe read on sub-buffer order change\n tracing: Fix crash passing ERR_PTR to kthread_stop()\n tracing: Fix use-after-free with same-name named triggers\n tracing: Fix logged instance name on creation failure\n" }, { "commit": "1a89abc009cb5035d0cb4e5ba48d32b94f30e8e4", "tree": "1d443a8a35c356b42e9f3f035f908c36b682ef56", "parents": [ "1039bffd6ae9c75b42b7d148d6c1106134107b66", "bb3b2cfeb206f5b10b859e134651b54120e3f530" ], "author": { "name": "Russell King (Oracle)", "email": "rmk+kernel@armlinux.org.uk", "time": "Wed Aug 05 17:08:50 2026 +0100" }, "committer": { "name": "Russell King", "email": "rmk+kernel@armlinux.org.uk", "time": "Sun Aug 30 15:05:54 2026 +0100" }, "message": "Merge branches \u0027fixes\u0027 and \u0027misc\u0027 into for-linus\n" }, { "commit": "ef6a1dca8de41a408019310649e6d1b7b21ac4bc", "tree": "2621d06098801b297805a40f45d1f9221b0a3818", "parents": [ "f83b8a58695cbf419beaa3f63b9d3e264792d8ea" ], "author": { "name": "Julia Lawall", "email": "Julia.Lawall@inria.fr", "time": "Sun Aug 30 14:36:11 2026 +0200" }, "committer": { "name": "Julia Lawall", "email": "Julia.Lawall@inria.fr", "time": "Sun Aug 30 14:36:11 2026 +0200" }, "message": "coccinelle: ifnulldev_put: update error message\n\nUpdate the report and org mode messages to reflect the new\nfunction names.\n\nSigned-off-by: Julia Lawall \u003cJulia.Lawall@inria.fr\u003e\n" }, { "commit": "f83b8a58695cbf419beaa3f63b9d3e264792d8ea", "tree": "f294ec57e7c66f0204ef02095dd9a79055f23c91", "parents": [ "5264281879ef19b68f61846a7455a627f10b92e8" ], "author": { "name": "Sang-Heon Jeon", "email": "ekffu200098@gmail.com", "time": "Mon Aug 24 01:18:19 2026 +0900" }, "committer": { "name": "Julia Lawall", "email": "Julia.Lawall@inria.fr", "time": "Sun Aug 30 14:34:22 2026 +0200" }, "message": "coccinelle: ifnulldev_put: update outdated helper names\n\ndev_put_track() and dev_hold_track() were renamed to netdev_put() and\nnetdev_hold() by commit d62607c3fe45 (\"net: rename reference+tracking\nhelpers\").\n\nSo update the names.\n\nSigned-off-by: Sang-Heon Jeon \u003cekffu200098@gmail.com\u003e\nSigned-off-by: Julia Lawall \u003cJulia.Lawall@inria.fr\u003e\n" }, { "commit": "5264281879ef19b68f61846a7455a627f10b92e8", "tree": "312656fee0a536d44f7b7ec961485cef3170db6a", "parents": [ "3beb6e620fae118f1dc1092b08b2c82b4e762b8a" ], "author": { "name": "Sang-Heon Jeon", "email": "ekffu200098@gmail.com", "time": "Mon Aug 24 01:18:18 2026 +0900" }, "committer": { "name": "Julia Lawall", "email": "Julia.Lawall@inria.fr", "time": "Sun Aug 30 14:17:25 2026 +0200" }, "message": "coccinelle: atomic_as_refcounter: drop atomic_long_dec_and_lock\n\natomic_long_dec_and_lock() has never existed. So drop it from the rules.\n\nNo functional change.\n\nSigned-off-by: Sang-Heon Jeon \u003cekffu200098@gmail.com\u003e\nSigned-off-by: Julia Lawall \u003cJulia.Lawall@inria.fr\u003e\n" }, { "commit": "3beb6e620fae118f1dc1092b08b2c82b4e762b8a", "tree": "94df61108e280d7745c22eeffc83b2eca8f2a790", "parents": [ "729eb52aa17f480a14ec0e7df363deabd41e57a3" ], "author": { "name": "Sang-Heon Jeon", "email": "ekffu200098@gmail.com", "time": "Mon Aug 24 01:18:17 2026 +0900" }, "committer": { "name": "Julia Lawall", "email": "Julia.Lawall@inria.fr", "time": "Sun Aug 30 14:09:27 2026 +0200" }, "message": "coccinelle: kfree_mismatch: drop vmalloc_exec\n\nvmalloc_exec() was removed by commit 7a0e27b2a0ce (\"mm: remove\nvmalloc_exec\").\n\nSo drop it from the rules.\n\nNo functional change.\n\nSigned-off-by: Sang-Heon Jeon \u003cekffu200098@gmail.com\u003e\nSigned-off-by: Julia Lawall \u003cJulia.Lawall@inria.fr\u003e\n" }, { "commit": "729eb52aa17f480a14ec0e7df363deabd41e57a3", "tree": "2560f906f438453d358fb6af30157b1365678c3c", "parents": [ "0319b42e1e28b845a3092082fa1e1ff9043f833e" ], "author": { "name": "Sang-Heon Jeon", "email": "ekffu200098@gmail.com", "time": "Mon Aug 24 01:18:16 2026 +0900" }, "committer": { "name": "Julia Lawall", "email": "Julia.Lawall@inria.fr", "time": "Sun Aug 30 11:19:01 2026 +0200" }, "message": "coccinelle: pool_zalloc-simple: drop the pci_pool_alloc rules\n\npci_pool_alloc() and pci_pool_zalloc() were removed by commit\n88dee3b0efe4 (\"PCI: Remove unused pci_pool wrappers\").\n\nSo drop the pci_pool_alloc rules.\n\nNo functional change.\n\nSigned-off-by: Sang-Heon Jeon \u003cekffu200098@gmail.com\u003e\nSigned-off-by: Julia Lawall \u003cJulia.Lawall@inria.fr\u003e\n" }, { "commit": "08dbfad3f5040f5bdb6c529da20d6d4e81fefd72", "tree": "94767b4d009979fd40f7c1deab59bb578c88529b", "parents": [ "cf72cbb39da84b6f02f90c07f33b102fc10b16f0", "12e67eb89eb2b9516685c744d3f7de0a2d1bd701" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Aug 29 11:55:36 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Aug 29 11:55:36 2026 -0700" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi\n\nPull more SCSI updates from Martin Petersen:\n \"Remaining updates for the 7.3 merge window. The only core change is\n enabling context analysis for the SCSI layer and UFS.\n\n The remaining changes are either bug fixes or hardening\"\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi: (26 commits)\n scsi: snic: Fix SCSI host leak on workqueue allocation failure\n scsi: MAINTAINERS: Update my email address\n scsi: MAINTAINERS: Leave the cumana_1 and oak drivers to the RISCPC maintainers\n scsi: leapraid: Standardize NCQ priority sysfs attributes\n scsi: leapraid: Serialize firmware log mmap with teardown\n scsi: leapraid: Balance host references for firmware log VMAs\n scsi: lpfc: Remove unnnecessary NULL check\n scsi: qla2xxx: Fix an loop timeout test\n scsi: qla2xxx: Fix an error code in qla_get_tmf()\n scsi: ibmvfc: Fix use of uninitialized rport in ibmvfc_do_work()\n scsi: core: Enable context analysis for hosts.o\n scsi: lpfc: Replace strlcat() with sysfs_emit_at() in the sysfs show functions\n scsi: lpfc: Replace strlcat() with seq_buf in the debugfs dump helpers\n scsi: lpfc: Replace strlcat() with seq_buf in lpfc_rx_monitor_report()\n scsi: lpfc: Replace strlcat() with scnprintf() in lpfc_vport_symbolic_node_name()\n scsi: lpfc: Replace strlcat() with seq_buf in lpfc_info()\n scsi: core: Enable context analysis\n scsi: core: Protect host state changes with the host lock\n scsi: core: Add lock context annotations\n scsi: core: Pass the SCSI host pointer directly to scanning functions\n ...\n" }, { "commit": "78004e9a87f240df03e2f73120d291763c32e0a7", "tree": "137c22dd795222931b9d2bf2501d37cd766741aa", "parents": [ "6620f5e8c11c4f7e41222a86f5c97150cc5f84a5" ], "author": { "name": "Ali Ahmet Memis", "email": "ali@iusegentoo.com", "time": "Fri Aug 21 01:45:27 2026 +0000" }, "committer": { "name": "Stafford Horne", "email": "shorne@gmail.com", "time": "Sat Aug 29 07:32:26 2026 +0100" }, "message": "openrisc: fix arbitrary kernel memory access via or1k_atomic syscall\n\nsys_or1k_atomic() (syscall 244 in the \"or1k\" ABI) takes two user\npointers, v1 and v2, and swaps the words they point to in hand-written\nassembly.\n\n l.lwz r29,0(r4)\n l.lwz r27,0(r5)\n l.sw 0(r4),r27\n l.sw 0(r5),r29\n\nThe pointers are not checked with access_ok(). The four memory\naccesses also have no exception table entries.\n\nA caller passes a kernel address as either pointer, and the syscall\nreads from and writes to it directly.\n\nThis gives an unprivileged process a kernel read/write primitive. It\noverwrites kernel data such as the sys_call_table, gaining code\nexecution in kernel context.\n\nCheck both pointers before entering the critical section. Add fixups\nfor the four memory accesses so faults on valid but unmapped user\naddresses return -EFAULT.\n\n[shorne@gmail.com: fix comment style]\nFixes: 9d02a4283e9c (\"OpenRISC: Boot code\")\nCc: stable@vger.kernel.org\nSigned-off-by: Ali Ahmet Memis \u003cali@iusegentoo.com\u003e\nSigned-off-by: Stafford Horne \u003cshorne@gmail.com\u003e\n" }, { "commit": "cf72cbb39da84b6f02f90c07f33b102fc10b16f0", "tree": "b2277e9778654a59680b9d8799c778a84732dca9", "parents": [ "a99d741df7372f2175677673d78a6335f3e0706f", "2cf20c4e0f72d523b8673053e7120d092ff1f074" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 28 16:51:14 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 28 16:51:14 2026 -0700" }, "message": "Merge tag \u0027io_uring-7.3-20260828\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n \"A few smaller fixes for io_uring that should go into the 7.3-rc1\n kernel, all three headed to stable as well. This contains:\n\n - A few fixes around cancellation and teardown for waitid\n\n - Cap the user size for the query interface copy-out\"\n\n* tag \u0027io_uring-7.3-20260828\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n io_uring/waitid: avoid siginfo copy during ring teardown\n io_uring/waitid: honor task_work cancellation\n io_uring/query: cap user size passed to copy_struct_to_user\n" }, { "commit": "a99d741df7372f2175677673d78a6335f3e0706f", "tree": "88ae56988eeca18429599a14503eed2068bd09aa", "parents": [ "4cc4cc367fd5c37ddef3279038bccbf152ef68d9", "a8b02aa825803e6c5b6b27340f583900afa0861d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 28 16:37:55 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 28 16:37:55 2026 -0700" }, "message": "Merge tag \u0027drm-next-2026-08-29\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull more drm updates from Dave Airlie:\n \"As mentioned last week, an msm pull request fell down the side of the\n couch or whatever the email equivalent of that is. This has the msm\n next stuff + the usual fixes for amd/intel.\n\n core:\n - use drm_warn instead of warn\n\n msm:\n - Bindings:\n - Added Shikra support\n - Document a840, a704, a722\n - Core:\n - Use drm_client buffers for fbdev emulation\n - teardown fixes\n - ARM32 DMA fixup\n - Remove objects from evict list when re-validated\n - Bunch of corner case and error path fixes\n - DPU:\n - Dropped dev_pm_opp_set_rate(0) preventing burnout\n - Fixed SSPP offsets of Kaanapali\n - DP:\n - Dropped dev_pm_opp_set_rate(0) preventing burnout\n - Cleaned up core code in preparation for MST support\n - Fixed prepare() to let Pipewire continue in case of the unplugged cable\n - GPU:\n - Add support for a704\n - Add support for a722\n - HDMI:\n - Simplifed register access\n\n amdgpu:\n - eGPU fixes\n - Runtime PM fix\n - UserQ fixes\n - Backlight fix\n - Discovery sysfs fix\n - Reset handling fixes\n - Buffer func handling fix for xgmi\n - VCN boundary check fix\n - DC lut handling fixes\n - MES fixes\n - UVD fix\n - VCE 3 fix\n - Enforce isolation fix\n - HPD fix for VGA/LVDS\n - DML fix\n - DCN 6 fixes\n - DC gpu reset fix\n\n amdkfd:\n - Fix return value\n - CU occupancy for GFX 11\n - CU occupancy for GFX 12/12.1\n - Queue bounds checking fix\n - SVM fixes\n - CRIU bounds checking fix\n\n radeon:\n - iMac display fix\n\n xe:\n - error message cleanups\n - i2c global register definitions as dependency for xe/i2c fixes\n - Media workardound\n - Add CCS to gt_idle debugfs print\n - Page fault related fix\n - i2c related fixes\n - System Controller mailbox bit fix\"\n\n* tag \u0027drm-next-2026-08-29\u0027 of https://gitlab.freedesktop.org/drm/kernel: (121 commits)\n drm/xe/sysctrl: Read mailbox phase bit from hardware\n drm/xe/i2c: Keep the i2c controller always enabled\n drm/xe/i2c: Fix the interrupt handling\n i2c: designware: Global register definitions\n drm/xe: Reject page faults from non-fault-mode scratch VMs\n drm/xe/xe_gt_idle: Add CCS to the powergating info print\n drm/xe: Do not apply WA 14025883347 to media 3503\n drm/amd/display: fix dc_lock leak on GPU reset error paths\n drm/amd/display: Fix redundant GPUVMEnable checks in dcn6 flip schedule\n drm/amd/display: Fix wrong bytes-per-pixel value for dml2_422_packed_10\n drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore\n drm/amdgpu/userq: fix lock missing for userq fence error set\n drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram\n drm/amdkfd: Fix error path at svm_migrate_copy_to_ram\n drm/amd/display: Log details when failing to register HPD IRQ\n drm/amd/display: Fix HPD consideration for VGA/LVDS connectors on DCE\n drm/amdgpu: clamp the isolation index for rings outside a partition\n drm/amdkfd: Reject zero-sized AQL queue allocations after size halving\n drm/amdgpu: Fix VCE 3 ring align_mask\n drm/kfd: Add CU occupancy support to GFX12.1\n ...\n" }, { "commit": "4cc4cc367fd5c37ddef3279038bccbf152ef68d9", "tree": "ba53ffa6138c552ead9384d59d18be2f4e9ca49a", "parents": [ "548e7bcd0c5460ddcbca9600cea603ebeebf4da7", "05ec76cfbce653e07cec19b9b8b20e33449d5d87" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 28 16:32:12 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 28 16:32:12 2026 -0700" }, "message": "Merge tag \u0027for-linus-7.3-1\u0027 of https://github.com/cminyard/linux-ipmi\n\nPull ipmi updates from Corey Minyard:\n \"Several cleanup on error fixes and a missing RCU wait and proper\n validation on a received message in one place.\n\n The biggest change is the initialization of the driver can be done\n asynchronously on a work queue. That saves significant boot time\"\n\n* tag \u0027for-linus-7.3-1\u0027 of https://github.com/cminyard/linux-ipmi:\n ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()\n ipmi:msghandler: Cancel work cleanly on an error\n ipmi:si: Add async init to ipmi_si\n char: ipmi: use named initializers for acpi_device_id\n ipmi: Fix leak in __ipmi_bmc_register\n ipmi: Remove all sysfs files on registration failure\n ipmi: si: Fix NULL pointer dereference after failed registration\n ipmi: ipmb: validate write message length\n" }, { "commit": "548e7bcd0c5460ddcbca9600cea603ebeebf4da7", "tree": "f6c9495617263ee073c84c9735afa173a3686a3b", "parents": [ "ce727a090be04dc7c51edd5c0da2a41d2fb6e106", "8fdf946445732c2bcd685abc8bd0e509d2ebc158" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 28 11:51:05 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 28 11:51:05 2026 -0700" }, "message": "Merge tag \u0027ceph-for-7.3-rc1\u0027 of https://github.com/ceph/ceph-client\n\nPull ceph updates from Ilya Dryomov:\n \"A wide variety of mostly CephFS fixes and cleanups, split between\n changes that address edge cases (Sam, Xiubo, Matthew), efficiency\n improvements (Max) and AI-assisted hardening (Michael, Jeremy).\n\n One thing that stands out is Alex\u0027s change to how CephFS behaves in\n NEARFULL scenarios: the long-standing \"make all writes synchronous\"\n behavior has become opt-in. It was always somewhat controversial and\n doesn\u0027t make much sense for modern deployments; the new default is to\n continue normal operation (i.e. buffer writes as MDS allows, etc). The\n behavior in case the cluster reaches any FULL state remains the same\n as before\"\n\n* tag \u0027ceph-for-7.3-rc1\u0027 of https://github.com/ceph/ceph-client: (32 commits)\n ceph: force a cap message when a deferred revoke can\u0027t be acked immediately\n libceph: reject buckets with mismatched CRUSH ids\n ceph: reject export_targets ranks \u003e\u003d CEPH_MAX_MDS in mdsmap decode\n ceph: fix leaked inode reference on writeback abort at umount\n libceph: remove ceph_put_page_vector()\n libceph: validate banner payload length\n ceph: make nearfull sync writes opt-in\n ceph: do not repeat ceph_trim_dentries() if no progress possible\n ceph: drop mdsc-\u003emutex before decoding the MDS reply\n ceph: fix UAF in check_new_map() on session freed during unlock\n ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock\n ceph: pass inode pointer around instead of reloading it\n ceph: mark cap remove with RB_CLEAR_NODE() instead of setting ci\u003dNULL\n ceph: add helper function ceph_cap_is_removed()\n ceph: make __ceph_remove_cap() static\n ceph: cap delegated inode count in ceph_parse_deleg_inos()\n ceph: bound num_export_targets array for mds info v2/v3\n ceph: bound MDSCapAuth path and fs_name decode in handle_session()\n ceph: bound xattr value length in __build_xattrs()\n ceph: bound copied dentry name length in NFS export get_name\n ...\n" }, { "commit": "ce727a090be04dc7c51edd5c0da2a41d2fb6e106", "tree": "5c7c741e397b38eb198ef2a4b2c518dce68016eb", "parents": [ "115bd364ab20b2dbef22824ec80d15901847dbe2", "a5e0055eac837a1168c781653943d4a0d9920af3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 28 10:59:07 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 28 10:59:07 2026 -0700" }, "message": "Merge tag \u0027ubifs-for-linus-7.3-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs\n\nPull UBI and UBIFS updates from Richard Weinberger:\n \"UBI:\n - Support for a per-device wear-leveling threshold\n - Various fixes and cleanups of error paths\n - Correctly preserve torture flag up wear-leveling\n\n UBIFS:\n - Various fixes and cleanups of error paths and kernel-doc\"\n\n* tag \u0027ubifs-for-linus-7.3-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs:\n UBI: support per-device wear-leveling threshold\n UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC\n mtd: ubi: Release device reference on busy detach\n ubi: Fix rollback for explicit UBI device numbers\n ubifs: fix out-of-bounds read in signature length check\n UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs\n UBI: Preserve torture flag when rescheduling failed erasures\n ubifs: ubifs.h: clean up kernel-doc comments\n ubifs: key.h: use correct function parameter name\n ubifs: debug.h: fix kernel-doc struct prototypes\n" }, { "commit": "115bd364ab20b2dbef22824ec80d15901847dbe2", "tree": "dc4e57a6e9047e8efc745b9b737363015ae49099", "parents": [ "c20313e98b04ce543936431b6122dd639d3a8346", "c966d29e01bbf829f8bb4a39a49811c56cdb49c3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 28 10:48:48 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 28 10:48:48 2026 -0700" }, "message": "Merge tag \u0027f2fs-for-7.3-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs\n\nPull f2fs updates from Jaegeuk Kim:\n \"In this round, key enhancements focus on reducing inode management\n memory overhead, introducing resizable tail sections with unified\n pinned allocation, and boosting I/O throughput via parallel\n multi-device flushes and asynchronous f2fs_write_end_io() execution.\n We also add dynamic device alias reservations to allow on-the-fly\n space donation from user partitions.\n\n Alongside these features, critical bug fixes resolve folio race\n conditions, lingering dirty flags, dentry and block counter leaks, and\n potential deadloops in f2fs_fsync_node_pages(). Additional stability\n patches address error-path handling across symlink, sync, and\n rename/unlink operations, prevent pinned file fragmentation, and\n correct segment migration and free section accounting in\n free_segment_range.\n\n Enhancements:\n - reduce memory footprint of ino management\n - support dynamic reserve/release for device aliasing\n - issue multi-device flushes in parallel\n - add a way to run f2fs_write_end_io() asynchronously\n - support resizable tail section and unify pinned allocation\n\n Bug fixes:\n - fix to pass folio-\u003eindex to f2fs_sanity_check_node_footer()\n - fix folio_nr_pages() race after put in large folio invalidate\n - fix to clear dirty flag on folio in error path\n - accurately adjust free_sections during free_segment_range\n - fix to avoid potential deadloop in f2fs_fsync_node_pages()\n - fix the error path in symlink, device alias in rename/unlink,\n f2fs_sync_fs\n - fix to migrate all curseg types during free_segment_range\n - fix to avoid pinfile fragment on fragment:{block, segment} mode\n - fix valid block count leak on data block allocation failure\n - fix dentry folio leak in find_in_level\n - reject overlapping move range after len expansion\n - fix some bugs related to file pinning, GC functions, i_size\n\n And, the series includes a number of minor bug fixes\"\n\n* tag \u0027f2fs-for-7.3-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (51 commits)\n f2fs: support resizable tail section and unify pinned allocation\n f2fs: don\u0027t leave the hashed inode while it\u0027s unlinked\n f2fs: accurately adjust free_sections during free_segment_range\n f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()\n f2fs: use adjusted write range after f2fs_write_checks()\n f2fs: fix to propagate error from f2fs_sync_fs()\n f2fs: return symlink writeback errors\n f2fs: fix error handling on device alias check in rename and unlink\n f2fs: fix to reset all pinned status during fggc\n f2fs: use f2fs_{down, up}_(read, write}_trace() for nat_tree_lock\n f2fs: reduce memory footprint of ino management\n f2fs: fix i_size when pinned fallocate partially fails\n f2fs: fix to migrate all curseg types during free_segment_range\n f2fs: avoid setting SBI_NEED_FSCK on transient resize failure\n f2fs: fix to avoid pinfile fragment on fragment:{block, segment} mode\n f2fs: cleanup w/ f2fs_need_rand_{blk, seg, seg_blk}\n f2fs: fix to shrink gc_lock coverage in f2fs_gc_range()\n f2fs: fix to reclaim space in f2fs_allocate_pinning_section()\n f2fs: unify add/remove ino entry API for all ino types\n f2fs: fix to zero post-EOF data when extending file size\n ...\n" }, { "commit": "c20313e98b04ce543936431b6122dd639d3a8346", "tree": "072bec938a695bfbb143627045539dfa706b7548", "parents": [ "275bc4eedf2c6081200998954efcb5eb90413a41", "c4a0927f535f779700d5ccda8182c2db01e9d551" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 28 10:01:02 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 28 10:01:02 2026 -0700" }, "message": "Merge tag \u0027sound-fix-7.3-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"A collection of various small fixes since the last PR. Most changes\n are device-specific fixes, while there are a few fixes addressing the\n issues reported recently by fuzzers.\n\n Here are highlights:\n\n ALSA Core:\n - Prevent adding invalid kcontrols to the LED layer\n - Workaround for a false-positive mutex lockdep warning in rawmidi\n\n USB-audio:\n - Relaxed the sticky mixer behavior check that caused regressions\n - Fix an OOB write in Novation MIDI output\n - Proper cleanup after system-resume errors\n - Quirk updates for M-Audio Venom, Audient iD14 MkI, Logitech PRO X\n Wireless, SMSL USB DAC, and Creative Sound Blaster Play! 3\n\n HD-audio:\n - Conexant headset plugin fixes\n - Quirk additions and fixes for HP Laptop 15, Lenovo IdeaPad Slim 3,\n TongFang XxAF5xxx, Lenovo Legion Pro 7, and Lenovo Yoga Pro 9\n\n ASoC:\n - DAPM: Fix off-by-one check on the second enum channel\n - Tegra: Fix and sort register defaults\n - AMD quirk updates for ASUS FA401EA, HP OmniBook X Flip 16,\n HVY-WXX9/M1060, Alienware m18 R1, and MSI Thin A15 B7UC\n - Fixes Qualcomm TDM handling\n - Fix double put_device() on SoundWire\n - Codec fixes for rt766, tac5xx2, rt712, tas2783, and max98926\n\n Misc:\n - Fix card leak on probe error on ice1712 driver\n - Hardening for legacy aoa, mtpav and pcxhr drivers\"\n\n* tag \u0027sound-fix-7.3-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (53 commits)\n ALSA: control: Don\u0027t add invalid kcontrols to LED layer\n ASoC: amd: acp-config: change quirks to cover all ASUS FA401EA variants\n ALSA: hda/conexant: Always enable the headset-mic pin on plugin\n ASoC: dapm: Fix off-by-one check on the second enum channel\n ASoC: amd: acp-config: force SoundWire probe on HP OmniBook X Flip 16\n ASoC: amd: acp3x-es83xx: Add HVY-WXX9/M1060 DMI quirk\n ASoC: amd: acp-config: Add HVY-WXX9/M1060 DMI quirk\n ASoC: soc-generic-dmaengine: Fix DMA channel request warning\n ALSA: rawmidi: Another workaround for false-positive mutex lockdep warning\n ASoC: amd: yc: Add DMI entry for Alienware m18 R1 AMD\n ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC\n ALSA: hda/realtek: Fix speaker mute LED for HP Laptop 15-fd0039nt\n ALSA: usb-audio: Complete cleanup after system-resume errors\n ALSA: hda/realtek: Add quirk for Lenovo IdeaPad Slim 3 15ABR8\n ALSA: aoa: i2sbus: Check IRQ before requesting it\n ALSA: usb-audio: Skip mixer creation on M-Audio Venom\n ALSA: usb-audio: Skip reading sample rate on M-Audio Venom\n ASoC: rt766: add RT766/RT767 VA1 device IDs\n ALSA: hda/realtek: Add quirk for TongFang XxAF5xxx\n ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()\n ...\n" }, { "commit": "275bc4eedf2c6081200998954efcb5eb90413a41", "tree": "f8f0b71a819301d7283fff7cc21f1f9e44170d6f", "parents": [ "afe0579334f622c803f2864f22c04c20c320bd80", "afce9701d6423a63194a349d2f1e34c50ce76482" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 28 09:53:43 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 28 09:53:43 2026 -0700" }, "message": "Merge tag \u0027rtc-7.3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux\n\nPull RTC updates from Alexandre Belloni:\n \"The RZN1 driver got a fairly comprehensive cleanup. More DT binding\n are converted to DT schema, leaving only 5 remaining files to convert.\n\n Subsystem:\n - patchwork project is moving to kernel.org\n - fully initialize clk_init_data\n - add missing MODULE_DEVICE_TABLE()\n - DT bindings conversions to DT schema\n\n Drivers:\n - ds1307: fix WADA bit for alarms on RX8130\n - rzn1: add support for RZ/T2H and RZ/N2H, many fixes\"\n\n* tag \u0027rtc-7.3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: (42 commits)\n MAINTAINERS: update rtc subsystem patchwork location\n rtc: msc313: Select by default on MSTARV7\n rtc: microcrystal: Make sure clk_init_data is fully initialized\n rtc: philips: Make sure clk_init_data is fully initialized\n rtc: nct3018y: Make sure clk_init_data is fully initialized\n rtc: m41t80: Make sure clk_init_data is fully initialized\n rtc: hym8563: Make sure clk_init_data is fully initialized\n rtc: rzn1: Add support for Renesas RZ/T2H and RZ/N2H SoCs\n rtc: rzn1: Drop trailing comma from OF match table sentinel\n rtc: rzn1: Add OF match data to gate SUBU register access\n rtc: rzn1: use FIELD_PREP/FIELD_GET and GENMASK for register access\n rtc: rzn1: Consistently use dev_err_probe()\n rtc: rzn1: Use temporary variable for struct device\n rtc: rzn1: Dynamically calculate synchronization delay based on clock rate\n rtc: rzn1: Replace remove callback with devm_add_action_or_reset()\n rtc: rzn1: Use pm_runtime_put_sync()\n rtc: Kconfig: Broaden RTC_DRV_RZN1 dependency to ARCH_RENESAS\n rtc: rzn1: Fix malformed MODULE_AUTHOR string\n rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers\n rtc: rzn1: Fix alarm range check truncation on 32-bit systems\n ...\n" }, { "commit": "afe0579334f622c803f2864f22c04c20c320bd80", "tree": "60294d63366c42dedf06ab285f6f21c5b283bc3f", "parents": [ "9df08cdd33a70ee1310523065fc4e3f161f6242e", "55ba91d4c54ab31ee8387bae40e799de467f8269" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 28 09:36:27 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 28 09:36:27 2026 -0700" }, "message": "Merge tag \u0027for-next-tpm-7.3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd\n\nPull TPM updates from Jarkko Sakkinen:\n \"The bulk of this is Ross Philipson\u0027s TPM enablement for Trenchboot.\n That exposes TPM constants, and decouple and improve robustness of\n tpm_buf a bit in order to implement a minimal early TPM driver.\n\n Early boot code will call either SKINIT on AMD or GETSEC[SENTER] on\n Intel before jumping into kernel\u0027s entry point. They re-initalize TPM\n PCRs but leave up to the early boot code measure initrd, boot_params\n and Trenchboot associated metadata.\n\n The motivation here is just that we would want in future iterations of\n the series put our full focus to the x86 part of the review, and call\n it a day as per TPM changes. Further, even if Trenchboot turned out to\n be empty lottery the worst possible outcome for TPM driver is that\n things get cleaned up a bit\"\n\n* tag \u0027for-next-tpm-7.3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:\n tpm-buf: Add TPM buffer support header for standalone reuse\n tpm-buf: Memory-safe allocations\n tpm-buf: Remove chip parameter from tpm_buf_append_handle()\n tpm-buf: Merge TPM_BUF_BOUNDARY_ERROR and TPM_BUF_OVERFLOW\n tpm: Remove main TPM header from TPM event log header\n tpm: Move platform specific definitions to the new PTP header\n tpm: Move TPM common base definitions to the command header\n tpm: Move TPM2 specific definitions to the command header\n tpm: Move TPM1 specific definitions to the command header\n tpm: Initial step to reorganize TPM public headers\n tpm: st33zp24: Validate locality read result\n tpm: st33zp24: Return zero on status read failure\n tpm: tpm_tis_spi: fix nodef CR50 tpm_tis_spi_resume is null\n tpm: atmel: depend on X86\n tpm: Remove redundant dev_err()\n tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout\n" }, { "commit": "9df08cdd33a70ee1310523065fc4e3f161f6242e", "tree": "4461f95d57f819fec8483a688403de6f49fcf64a", "parents": [ "344be13211d0fceb791a7da70ef810ad13340fe0", "ee440d4fc0d2f15894ab1f64c474a3adbc858880" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 28 09:28:40 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 28 09:28:40 2026 -0700" }, "message": "Merge tag \u0027v7.3-p2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6\n\nPull crypto fix from Herbert Xu:\n \"Fix a memory allocation overrun in crypto acomp\"\n\n* tag \u0027v7.3-p2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:\n crypto: acomp - allocate async request context when cloning\n" }, { "commit": "344be13211d0fceb791a7da70ef810ad13340fe0", "tree": "c2eef88aacb8c70c7efa0c49fc21dfab040383c8", "parents": [ "9d607ae0f7d629dc068aed5f498e24d3e9875ef1", "3b446d169a93e6abae9a93535369fa18bbcbefd9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 28 09:09:01 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 28 09:09:01 2026 -0700" }, "message": "Merge tag \u0027acpi-7.3-rc1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull ACPI support fix from Rafael Wysocki:\n \"Revert an incomplete recent commit that may cause ACPI device power\n management to stop working\"\n\n* tag \u0027acpi-7.3-rc1-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n Revert \"ACPI: scan: Defer device power initialization\"\n" }, { "commit": "9d607ae0f7d629dc068aed5f498e24d3e9875ef1", "tree": "a66740d5e5fa38735a640f41b2e6d30ce9a43a60", "parents": [ "72ecc30d607f6c8ef8ac0d7b88b0c176a7409367", "2bd533739234d79b74afabfece1abfe9c6d52c83" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 28 09:02:04 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 28 09:02:04 2026 -0700" }, "message": "Merge tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux\n\nPull arm64 fixes from Will Deacon:\n \"A mixture of ptdump, compat and MTE fixes that came in during the\n merge window:\n\n - Fix address handling of final memory region in ptdump\n\n - Fix emulation of decrementing load/store multiple from 32-bit task\n\n - Fix SCTLR context-switching for store-only MTE mode\n\n - Fix numerous issues in MTE selftests\"\n\n* tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:\n selftests/arm64: Add MTE test config fragment\n selftests/arm64: Fix MTE prctl TAP plan\n selftests/arm64: Treat KSM merge_across_nodes as optional\n selftests/arm64: Print missing MTE TAP headers\n arm64: compat: Fix decrementing LDM/STM alignment emulation\n arm64: process: Fix context switching MTE store-only tag check\n KVM: arm64: ptdump: Flush the last region\n arm64: ptdump: Make note_page_flush() range aware\n" }, { "commit": "72ecc30d607f6c8ef8ac0d7b88b0c176a7409367", "tree": "239bc2903867e89c68f7be04a519ad54cfd7a082", "parents": [ "874b43b9f3c704f24f0bdcc347b2e596ad3228ec", "eb049bdbf2b98d103d93daef44a5e1a0164d01eb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 28 08:55:47 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 28 08:55:47 2026 -0700" }, "message": "Merge tag \u0027xtensa-20260828\u0027 of https://github.com/jcmvbkbc/linux-xtensa\n\nPull Xtensa updates from Max Filippov:\n\n - use strnlen() to improve iss_console_write()\n\n - remove unused function setup_profiling_timer()\n\n - fix CONFIG_XTENSA_CALIBRATE_CCOUNT macro name in comment\n\n* tag \u0027xtensa-20260828\u0027 of https://github.com/jcmvbkbc/linux-xtensa:\n xtensa: remove unused setup_profiling_timer function\n xtensa: correct CONFIG_XTENSA_CALIBRATE_CCOUNT macro name in comment\n tty: xtensa/iss: use strnlen to improve iss_console_write\n" }, { "commit": "874b43b9f3c704f24f0bdcc347b2e596ad3228ec", "tree": "820b407a03c7004c94c3b353ccc7eb4060146f64", "parents": [ "1b78070aaef63512688aebfbc82365ef9d6660f1", "de0dab22cbf6943d0f12f3b1e2eb1bbdd807f039" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 28 08:44:36 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Aug 28 08:44:36 2026 -0700" }, "message": "Merge tag \u0027m68knommu-for-v7.3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu\n\nPull m68knommu updates from Greg Ungerer:\n \"This includes a couple more new defconfigs to improve test build\n coverage, changes to use the more correct linux/gpio/legacy.h and\n platform setup for the reset device of the ColdFire 5441x SoC\n hardware.\n\n - new defconfigs for 2 more ColdFire boards\n\n - change to use linux/gpio/legacy.h\n\n - add platform setup for reset device of the 5441x SoC boards\"\n\n* tag \u0027m68knommu-for-v7.3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu:\n m68k: coldfire/5441x: register mcf-rcm-reset platform device\n m68k/coldfire: replace linux/gpio.h inclusions\n m68k: defconfig: add config for M5282EVB board\n m68k: defconfig: add config for M52358EVB board\n" }, { "commit": "a8b02aa825803e6c5b6b27340f583900afa0861d", "tree": "36d1458d1bd4ff48d15db459b5da1c3f13594210", "parents": [ "1dd31281a6e3f370914f99b7cf6cccbc2c050ea3", "92a9eebd2a1f892fe482154d83f9f1626bc73d3b" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Aug 28 13:27:51 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Aug 28 13:31:33 2026 +1000" }, "message": "Merge tag \u0027amd-drm-next-7.3-2026-08-27\u0027 of https://gitlab.freedesktop.org/agd5f/linux into drm-next\n\namd-drm-next-7.3-2026-08-27:\n\namdgpu:\n- MES fixes\n- Userq fixes\n- UVD fix\n- VCE 3 fix\n- Enforce isolation fix\n- HPD fix for VGA/LVDS\n- DML fix\n- DCN 6 fixes\n- DC gpu reset fix\n\namdkfd:\n- CU occupancy for GFX 11\n- CU occupancy for GFX 12/12.1\n- Queue bounds checking fix\n- SVM fixes\n- CRIU bounds checking fix\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Alex Deucher \u003calexander.deucher@amd.com\u003e\nLink: https://patch.msgid.link/20260827203610.3249084-1-alexander.deucher@amd.com\n" }, { "commit": "1dd31281a6e3f370914f99b7cf6cccbc2c050ea3", "tree": "c20b0b4ca076abb893d4587f7a65e60b5c1e72c2", "parents": [ "1ff8d3e3165fd077faa4259fd232bdddcd30249f", "a62212b35a214c2ff3bd1c785a440d7ad8205ec9" ], "author": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Aug 28 13:14:31 2026 +1000" }, "committer": { "name": "Dave Airlie", "email": "airlied@redhat.com", "time": "Fri Aug 28 13:14:52 2026 +1000" }, "message": "Merge tag \u0027drm-xe-next-fixes-2026-08-27\u0027 of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next\n\nCross-subsystem Changes:\n- i2c global register definitions as dependency for xe/i2c fixes. (Heikki)\n\nDriver Changes:\n- Media workardound (Daniele)\n- Add CCS to gt_idle debugfs print (Bala)\n- Page fault related fix (Arvind)\n- i2c related fixes (Heikki)\n- System Controller mailbox bit fix (Anoop)\n\nSigned-off-by: Dave Airlie \u003cairlied@redhat.com\u003e\n\nFrom: Rodrigo Vivi \u003crodrigo.vivi@intel.com\u003e\nLink: https://patch.msgid.link/apBrVgvZwIRIfuhR@intel.com\n" }, { "commit": "5eab74874d11160725c42ab676ba97a797a362eb", "tree": "9834233e5bde5c0587aaa2ee57eb75420b40eb12", "parents": [ "e0d3aed7b12cf37b74c7cc5265073d0263b49cde" ], "author": { "name": "Ivan Immanuel Shaji", "email": "ivanimmanuel1234@gmail.com", "time": "Tue Aug 25 12:52:50 2026 -0400" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Aug 27 21:31:51 2026 -0400" }, "message": "ring-buffer: Stop remote reader update when page swap fails\n\nThe remote swap_reader_page callback can return -EBUSY when the writer\nmoves the head before the remote catches it, particularly during an event\nstorm on a small buffer. __rb_get_reader_page_from_remote() currently\nwarns about that failure but continues with the unchanged reader ID and\nrearranges the local page list as though the swap succeeded.\n\nHandle the callback failure as a recoverable error. Report it with\npr_warn_ratelimited() and return NULL. Callers already handle a NULL reader\npage as a failed attempt. This avoids splicing the same page as both the\nprevious and new reader without flooding the log under contention.\n\nCc: stable@vger.kernel.org\nFixes: 2e67fabd8b77 (\"ring-buffer: Introduce ring-buffer remotes\")\nLink: https://patch.msgid.link/20260825-kernel-patch-1-v2-2-bb3461807a32@gmail.com\nAssisted-by: LLM sparse\nSigned-off-by: Ivan Immanuel Shaji \u003civanimmanuel1234@gmail.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "e0d3aed7b12cf37b74c7cc5265073d0263b49cde", "tree": "a5b43543a712c3ab39facbbe3a4919b4692f006c", "parents": [ "390f6bd8583d177029d9df4bea6667509e55a765" ], "author": { "name": "Ivan Immanuel Shaji", "email": "ivanimmanuel1234@gmail.com", "time": "Tue Aug 25 12:52:49 2026 -0400" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Aug 27 21:31:41 2026 -0400" }, "message": "tracing: Fix retry exhaustion in simple ring buffer reader swap\n\nsimple_ring_buffer_swap_reader_page() starts with retry set to 8 and\npost-decrements it only after a failed link replacement. On the final\nattempt, a successful replacement leaves retry at zero, while a failed\nreplacement leaves it at -1.\n\nThe current !retry test reverses both outcomes. It returns an error after\na successful final replacement, leaving the link update complete but the\nreader bookkeeping unfinished. After a failed final replacement, it\nfalls through and updates the head and reader pointers as though the\nreplacement succeeded, which can corrupt the ring.\n\nTreat only a negative counter as exhaustion and return the documented\n-EBUSY error.\n\nCc: stable@vger.kernel.org\nFixes: 34e5b958bdad (\"tracing: Introduce simple_ring_buffer\")\nLink: https://patch.msgid.link/20260825-kernel-patch-1-v2-1-bb3461807a32@gmail.com\nAssisted-by: LLM sparse\nReviewed-by: Vincent Donnefort \u003cvdonnefort@google.com\u003e\nSigned-off-by: Ivan Immanuel Shaji \u003civanimmanuel1234@gmail.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "390f6bd8583d177029d9df4bea6667509e55a765", "tree": "5317be8482875dd24e4c04c99bdc7eb03bcda80d", "parents": [ "6727b7618f49401acf373fa3ec5712e2ec52e5cf" ], "author": { "name": "Jérémy Jean", "email": "Jeremy.Jean@oss.cyber.gouv.fr", "time": "Thu Aug 27 18:43:22 2026 +0000" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Thu Aug 27 21:30:22 2026 -0400" }, "message": "tracing/user_events: Clear copied tracing state before fork duplication\n\ndup_task_struct() copies user_event_mm from the parent into the child,\nwithout grabbing a reference to it. user_event_mm_dup() should\nreplace it, but it leaves that copied pointer unmodified if\nuser_event_mm_alloc() fails.\n\nWhen the child exits, user_event_mm_remove() decrements a reference\nthe child never owned, which ultimately frees user_event_mm, while\nthe parent still as a stale pointer to it. This creates a UAF, which\nKASAN reports as:\n\n BUG: KASAN: slab-use-after-free in\n current_user_event_mm+0x51/0x1d0 Write of size 4 at addr\n ffff888005010d30 by task init/44\n\n Call Trace:\n \u003cTASK\u003e\n kasan_report+0xce/0x100\n kasan_check_range+0x10f/0x1e0\n current_user_event_mm+0x51/0x1d0\n user_events_ioctl+0x82e/0x15c0\n __x64_sys_ioctl+0x139/0x1c0\n do_syscall_64+0xce/0x450\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n Allocated by task 44:\n __kasan_kmalloc+0x8f/0xa0\n __kmalloc_cache_noprof+0x180/0x3a0\n user_event_mm_alloc+0x3c/0x1f0\n current_user_event_mm+0x88/0x1d0\n\n Freed by task 42:\n __kasan_slab_free+0x43/0x70\n kfree+0x13a/0x390\n process_one_work+0x696/0xf90\n worker_thread+0x420/0xba0\n\nThe fix simply clears the copied pointer before any possible failure.\nIn case of failure, the child then has nothing to free.\n\nCc: stable@vger.kernel.org\nFixes: 7235759084a4 (\"tracing/user_events: Use remote writes for event enablement\")\nLink: https://patch.msgid.link/20260827184321.2964601-2-Jeremy.Jean@oss.cyber.gouv.fr\nAssisted-by: Codex:gpt-5\nSigned-off-by: Jérémy Jean \u003cJeremy.Jean@oss.cyber.gouv.fr\u003e\nReviewed-by: Bradley Morgan \u003cbrads@mainlining.org\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "b15b548d52b43ba8ac4652bc2c7244a8dd1e9622", "tree": "0b605f892ce4086608fb2b5c3efa74365b7debaa", "parents": [ "27c9445be86b1313746c46d659d3f823a5f7a218" ], "author": { "name": "Vasileios Almpanis", "email": "vasilisalmpanis@gmail.com", "time": "Wed Aug 12 11:14:48 2026 +0200" }, "committer": { "name": "Andi Shyti", "email": "andi.shyti@kernel.org", "time": "Fri Aug 28 03:12:01 2026 +0200" }, "message": "i2c: core: fix debugfs UAF on adapter removal\n\ni2c_del_adapter() frees the adapter\u0027s debugfs directory before it\nunregisters the adapter device, but the new_device sysfs attribute\nstays writable until device_del(). A write racing with removal still\nreaches i2c_device_probe(), which passes the freed adap-\u003edebugfs to\ndebugfs_create_dir() as the new client\u0027s parent:\n\n BUG: KASAN: slab-use-after-free in lookup_noperm_common+0x407/0x430\n Read of size 4 at addr ffff88803ef87810 by task syz.0.61/6090\n lookup_noperm_common+0x407/0x430\n simple_start_creating+0x9c/0x110\n debugfs_start_creating+0xdb/0x1a0\n debugfs_create_dir+0x24/0x350\n i2c_device_probe+0x814/0xbf0\n\nIt\u0027s technically possible to create a client after i2c_deregister_clients\nhas run. That client will never be unregistered and make\nwait_for_completion hang.\n\nClose the window by removing the new_device attribute at the start of\ni2c_del_adapter(). device_remove_file() will drain any clients left.\n\nFixes: 73febd775bdb (\"i2c: create debugfs entry per adapter\")\nReported-by: syzbot+23ad911c819b923238b7@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d23ad911c819b923238b7\nSigned-off-by: Vasileios Almpanis \u003cvasilisalmpanis@gmail.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e # v6.8+\nTested-by: syzbot+23ad911c819b923238b7@syzkaller.appspotmail.com\nSigned-off-by: Andi Shyti \u003candi.shyti@kernel.org\u003e\nLink: https://patch.msgid.link/20260812-i2c-v2-1-5efaab4c3334@gmail.com\n" }, { "commit": "27c9445be86b1313746c46d659d3f823a5f7a218", "tree": "57e975b54f1439a286b32a972919670b2185e452", "parents": [ "f98d4986482151a835b521a734722fe8dc5ca37d" ], "author": { "name": "Carlos Song", "email": "carlos.song@nxp.com", "time": "Mon Aug 03 11:27:05 2026 +0800" }, "committer": { "name": "Andi Shyti", "email": "andi.shyti@kernel.org", "time": "Fri Aug 28 03:00:32 2026 +0200" }, "message": "i2c: imx-lpi2c: avoid accessing target registers on master-only controllers\n\nNot all LPI2C controller instances implement the Target block.\nSince commit 90311787f483 (\"i2c: imx-lpi2c: reset controller in\nprobe stage\"), the driver unconditionally resets both the Master\nand Target blocks during probe.\n\nOn controllers that do not support target mode, accessing the\nTarget registers triggers an asynchronous SError and prevents the\ndriver from probing successfully. For example on i.MX8QM:\n\n SError Interrupt on CPU2, code 0x00000000bf000002 -- SError\n Hardware name: Freescale i.MX8QM MEK (DT)\n pc : lpi2c_imx_probe+0x280/0x594\n lr : lpi2c_imx_probe+0x224/0x594\n Kernel panic - not syncing: Asynchronous SError Interrupt\n\nThe VERID register is implemented in the Master block and can be\nsafely accessed on all controller variants. Its FEATURE field\nindicates whether target mode is supported.\n\nRead VERID during probe and use it to determine whether the\nTarget block is present. Only access Target registers when target\nmode is supported and reject target registration requests with\n-EOPNOTSUPP otherwise.\n\nFixes: 90311787f483 (\"i2c: imx-lpi2c: reset controller in probe stage\")\nSigned-off-by: Carlos Song \u003ccarlos.song@nxp.com\u003e\nReviewed-by: Frank Li \u003cFrank.Li@nxp.com\u003e\nSigned-off-by: Andi Shyti \u003candi.shyti@kernel.org\u003e\nLink: https://patch.msgid.link/20260803032705.2250373-1-carlos.song@oss.nxp.com\n" }, { "commit": "f98d4986482151a835b521a734722fe8dc5ca37d", "tree": "b9eb6aa23050ce39ed16f6bbf05d8f7f5d2853c2", "parents": [ "77549d01edecc20da73c8599e14648877198ce9b" ], "author": { "name": "Guangshuo Li", "email": "lgs201920130244@gmail.com", "time": "Wed Aug 12 17:44:25 2026 +0800" }, "committer": { "name": "Andi Shyti", "email": "andi.shyti@kernel.org", "time": "Fri Aug 28 02:52:43 2026 +0200" }, "message": "i2c: qcom-cci: fix autosuspend cleanup\n\ncci_probe() calls pm_runtime_use_autosuspend(), but the remove path\ndoes not call the matching pm_runtime_dont_use_autosuspend() before\ndisabling runtime PM.\n\nIf the autosuspend delay is set to a negative value while autosuspend\nis enabled, the runtime PM core increments usage_count to prevent\nruntime suspend. Without undoing the autosuspend setting during\nteardown, this reference is not dropped and usage_count remains\nunbalanced.\n\nUse devm_pm_runtime_set_active_enabled() to manage the runtime PM\nstate. Its managed cleanup disables autosuspend and runtime PM and\nrestores the suspended state on probe failure and driver removal.\nRemove the now redundant manual runtime PM cleanup.\n\nThis issue was found by manual code inspection.\n\nFixes: e517526195de (\"i2c: Add Qualcomm CCI I2C driver\")\nSigned-off-by: Guangshuo Li \u003clgs201920130244@gmail.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e # v5.8+\nReviewed-by: Vladimir Zapolskiy \u003cvladimir.zapolskiy@linaro.org\u003e\nReviewed-by: Loic Poulain \u003cloic.poulain@oss.qualcomm.com\u003e\nSigned-off-by: Andi Shyti \u003candi.shyti@kernel.org\u003e\nLink: https://patch.msgid.link/20260812094425.3515179-1-lgs201920130244@gmail.com\n" }, { "commit": "77549d01edecc20da73c8599e14648877198ce9b", "tree": "b7f1a258f98b32b9778aaaac78f8f43037f1d5ce", "parents": [ "a4f3fbccb65de757569686baaf2b72e329096aba" ], "author": { "name": "Hongbo Yao", "email": "andy.xu@hj-micro.com", "time": "Wed Aug 26 15:05:47 2026 +0800" }, "committer": { "name": "Andi Shyti", "email": "andi.shyti@kernel.org", "time": "Fri Aug 28 02:38:00 2026 +0200" }, "message": "i2c: designware: Enable interrupt mask workaround for HJMC3001\n\nOn HJMicro ARM64 servers, the DesignWare I2C controller does not\nretrigger a pending interrupt if the interrupt status changes after\nthe current status bits have been cleared.\n\nThe issue is exposed under heavy system load when the corresponding\nSPI is routed across sockets to a core in the remote socket. The\ninterrupt is then lost and the I2C transfer times out.\n\nEnable ACCESS_INTR_MASK for HJMC3001. This toggles DW_IC_INTR_MASK\nbefore returning from the interrupt handler and retriggers any\npending interrupt.\n\nFixes: 6816ce57c479 (\"i2c: designware: Add a new ACPI HID for HJMC01 I2C controller\")\nSigned-off-by: Hongbo Yao \u003candy.xu@hj-micro.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e # v6.13+\nAcked-by: Mika Westerberg \u003cmika.westerberg@linux.intel.com\u003e\nSigned-off-by: Andi Shyti \u003candi.shyti@kernel.org\u003e\nLink: https://patch.msgid.link/20260826070547.268672-1-andy.xu@hj-micro.com\n" }, { "commit": "a4f3fbccb65de757569686baaf2b72e329096aba", "tree": "bc91ba99121801e40966558ba5b616873dc7b2c8", "parents": [ "385c7af4e3b95d0769fd211831674e83b16a2ebf" ], "author": { "name": "Kathiravan Thirumoorthy", "email": "kathiravan.thirumoorthy@oss.qualcomm.com", "time": "Wed Aug 12 14:00:55 2026 +0530" }, "committer": { "name": "Andi Shyti", "email": "andi.shyti@kernel.org", "time": "Fri Aug 28 02:27:57 2026 +0200" }, "message": "i2c: qcom-geni: update frequency table to fix timing parameters\n\nIn IPQ5424, to meet the setup and hold timing requirements in the\nstandard mode, update the frequency table with the values recommended by\nHW design team.\n\nAlso remove the stray space in the I2C_MAX_FAST_MODE_FREQ entry.\n\nFixes: 85c34532849d (\"i2c: qcom-geni: fix I2C frequency table to achieve accurate bus rates\")\nFixes: 506bb2ab0075 (\"i2c: qcom-geni: Support systems with 32MHz serial engine clock\")\nSigned-off-by: Kathiravan Thirumoorthy \u003ckathiravan.thirumoorthy@oss.qualcomm.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e # v6.13+\nReviewed-by: Mukesh Savaliya \u003cmukesh.savaliya@oss.qualcomm.com\u003e\nReviewed-by: Konrad Dybcio \u003ckonrad.dybcio@oss.qualcomm.com\u003e\nSigned-off-by: Andi Shyti \u003candi.shyti@kernel.org\u003e\nLink: https://patch.msgid.link/20260812-ipq5424_i2c_scl_updates-v2-1-e09cd39d01d7@oss.qualcomm.com\n" }, { "commit": "afce9701d6423a63194a349d2f1e34c50ce76482", "tree": "43c375b0e0e6f506fa45a2e3f192a471ffb2ac6b", "parents": [ "c9e17e381e021536a9f0fe36f4c9c693d6c0f27c" ], "author": { "name": "Alexandre Belloni", "email": "alexandre.belloni@bootlin.com", "time": "Fri Aug 21 22:07:58 2026 +0200" }, "committer": { "name": "Alexandre Belloni", "email": "alexandre.belloni@bootlin.com", "time": "Thu Aug 27 23:35:24 2026 +0200" }, "message": "MAINTAINERS: update rtc subsystem patchwork location\n\nThe RTC subsystem is migrating it patchwork to kernel.org.\n\nLink: https://patch.msgid.link/202608212007582a463833@mail.local\nSigned-off-by: Alexandre Belloni \u003calexandre.belloni@bootlin.com\u003e\n" }, { "commit": "1b78070aaef63512688aebfbc82365ef9d6660f1", "tree": "691c0aeaa3d92278ceeb6ace56bc8cd56a7f2ae8", "parents": [ "3ba13f5e7180c034b0a1ef7e052fb780856b134e", "4a9d62a8774f130a5b8de26ca9f415e6050a9d51" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Aug 27 13:53:43 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Aug 27 13:53:43 2026 -0700" }, "message": "Merge tag \u0027net-7.3-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"Including fixes from Bluetooth, IPSec and Netfilter.\n\n Current release - fix to a fix:\n\n - netfilter: ipset: remove need to allocate memory on delete operations\n\n Current release - regressions:\n\n - macb: drop CONFIG_OF #if block, fix build\n\n Previous releases - always broken:\n\n - stream of fixes for SCTP continues\n\n - inet: frags: strip GSO state from fragments before reassembly\n\n - virtio-net: ensure that TCP packets don\u0027t overflow gso_segs\n\n - tcp-ao: fix use-after-free of current_key on reconnect to another\n peer\n\n - page_pool: remove zone/policy GFP flags when allocating XArray\n entries\n\n - Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN\n\n - tls: device: fix out-of-bounds write in tls_append_frag()\n\n - eth: bnxt:\n - ring the doorbell when SW USO exits early, avoid packets stuck\n in Tx\n - gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check, avoid\n users of older NICs seeing non-actionable warning messages\n\n - eth: qede: fix NULL pointer dereference in TPA fragment processing\"\n\n* tag \u0027net-7.3-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (216 commits)\n inet: frags: strip GSO state from fragments before reassembly\n net/sched: sch_htb: limit htb_classify inner-class filter hops\n selftests/net: packetdrill: add tcp_urg_ptr_retransmit\n tcp: fix corruption of urgent data on multi-segment retransmit\n usb: atm: usbatm: fix invalid ci_range initialization\n net: fec: only stop PTP if it was initialized\n slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()\n net: bridge: mcast: fix use-after-free of a master VLAN\u0027s multicast context\n net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup\n net: dsa: mxl862xx: enable assisted learning on CPU port\n net: stmmac: restore NET_IP_ALIGN in the RX DMA offset\n net: stmmac: drop gso_enabled_types and rely on netdev features\n net: stmmac: selftests: Don\u0027t test flow control for small rx fifos\n net: stmmac: selftests: Account for the UC filter list for filtering tests\n net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering\n net: stmmac: dwmac4: Account for the primary MAC address for UC filtering\n net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering\n net: stmmac: selftests: Check multiple MMC counters\n selftests: net: Fix slow configurations in big_tcp_tunnels.sh\n selftests: net: Lower threshold with csum offload off in big_tcp_tunnels.sh\n ...\n" }, { "commit": "4a9d62a8774f130a5b8de26ca9f415e6050a9d51", "tree": "bffd1527dc117d4b445cd7a11841499f46b0594d", "parents": [ "d5dc1e69fd7258ea605c9952e5d5947539159ae3", "fc04229727d8fffbf02e0635de38413fe0102d02" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Aug 27 13:13:18 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Aug 27 13:13:18 2026 -0700" }, "message": "Merge tag \u0027nf-26-08-27\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf\n\nPablo Neira Ayuso says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nNetfilter fixes for net\n\nThe following patchset contains Netfilter fixes for net:\n\n1) Use DEBUG_NET_WARN_ON_ONCE() instead of WARN_ON() from the tproxy\n datapath, a recent bug found a way to reach WARN_ON from datapath\n due to insufficient validation of xt_TPROTO checkentry.\n From Fernando F. Mancera.\n\n2) Similar to previous patch to replace WARN_ON_ONCE by\n DEBUG_NET_WARN_ON_ONCE() for connlimit. Not known issue, but\n since this patch has been around for a while, let\u0027s merge it.\n Also from Fernando.\n\n3) Move nf_tables harware offload commit path after chain blob\n and audit to reduce chances of leaving the hardware in\n inconsistent state.\n\n4) Add missing vzeroupper to nf_tables pipapo AVX2 to address\n performace degradation to later user of SSE code,\n from Eric Biggers.\n\n5) Remove pr_debug() in x_tables extensions, a recent bogus found a\n way to print a unsanitized string in xt_IDLETIMER, many of these\n pr_debug() calls are there for historical reasons.\n\n6) Use pr_info_ratelimited() in x_tables .checkentry.\n\n7) Fix an imbalance in module refcount due to incorrect override\n expression logic with sets. Remove unnecessary clone in control\n plane, use the existing expressions provided by set or dynset\n expression. Release override expressions only.\n\n8) Tigthen nf_tables device name removal, it is possible to remove\n prefix strings with exact device name. From Fernando F. Mancera.\n\n9) Set on the set dead bit earlier, otherwise it is possible to\n call .commit on deleted sets. This also addresses the\n re-introduction of a bug.\n\n* tag \u0027nf-26-08-27\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:\n netfilter: nf_tables: remove leftover set_update_list\n netfilter: nf_tables: set on dead bit when performing early element removal\n netfilter: nf_tables: skip double clone set expressions on element insert\n netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited()\n netfilter: x_tables: remove pr_debug\n netfilter: nft_set_pipapo_avx2: add missing vzeroupper\n netfilter: nf_tables: move hardware offload step after building the chain blob\n netfilter: conncount: use DEBUG_NET_WARN_ON_ONCE on reaching count limit\n netfilter: tproxy: use DEBUG_NET_WARN_ON_ONCE for protocol fallbacks\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260827141733.423453-1-pablo@netfilter.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3ba13f5e7180c034b0a1ef7e052fb780856b134e", "tree": "d8dc386ad29ac55b8b4a6d8a58019a9c24ceb75d", "parents": [ "9bb34313d94b17a379ea68fae65be0810c88ee64", "5bb01c657ff9fc807c2c592ca18af34c4fc3bc6f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Aug 27 12:53:43 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Aug 27 12:53:43 2026 -0700" }, "message": "Merge tag \u0027devicetree-fixes-for-7.3-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux\n\nPull devicetree fixes from Rob Herring:\n\n - Fix possible out-of-bounds access in of_alias_scan()\n\n - Fix refcount leak in of_irq_get_affinity()\n\n - Add Qualcomm SPMI PMIC haptics input which is already referenced\n\n* tag \u0027devicetree-fixes-for-7.3-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux:\n of: fix out-of-bounds read in of_alias_scan() stem parser\n of/irq: Fix device node refcount leak in of_irq_get_affinity()\n dt-bindings: input: Add Qualcomm SPMI PMIC haptics\n" }, { "commit": "d5dc1e69fd7258ea605c9952e5d5947539159ae3", "tree": "2b6e087f85f5a0a2764413a6839e6e88b4d0503e", "parents": [ "729c4896ab829169f95915d65edd530325910b37" ], "author": { "name": "Xinyang Ge", "email": "xinyang@anthropic.com", "time": "Thu Aug 27 16:07:07 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Aug 27 12:52:10 2026 -0700" }, "message": "inet: frags: strip GSO state from fragments before reassembly\n\nA virtio_net_hdr (tun/tap, or AF_PACKET with PACKET_VNET_HDR) can mark\nan IPv4 or IPv6 fragment as GSO; nothing relates gso_type to frag_off.\ninet_frag_reasm_prepare()/inet_frag_reasm_finish() keep the first\nfragment\u0027s skb as the head of the reassembled datagram, including its\nshinfo-\u003egso_size/gso_type/gso_segs, and chain the remaining fragments\non frag_list with whatever linear/paged layout they arrived with.\n\nAfter ip_defrag() (ip_local_deliver(), nf_defrag_ipv4, ...) the\nreassembled skb therefore still claims to be GSO (SKB_GSO_DODGY), and\nthe next software segmentation point - udp_rcv_segment() on local\ndelivery, validate_xmit_skb(), or the ip_finish_output_gso() slow\npath - hands it to skb_segment(). skb_segment()\u0027s frag_list walk\nassumes GRO-shaped input and hits one of its BUG_ON()s. Two writes to\na tap by an unprivileged user in its own userns are enough:\n\n kernel BUG at net/core/skbuff.c:4899!\n Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\n CPU: 0 UID: 1000 PID: 82 Comm: poc Not tainted 7.2.0-pentest+ #2\n RIP: 0010:skb_segment+0x20ca/0x48b0\n Call Trace:\n \u003cTASK\u003e\n __udp_gso_segment+0x29a/0x27d0\n udp4_ufo_fragment+0x458/0x6c0\n inet_gso_segment+0x429/0x1340\n skb_mac_gso_segment+0x233/0x4f0\n __skb_gso_segment+0x308/0x660\n udp_queue_rcv_skb+0x440/0xad0\n udp_unicast_rcv_skb+0xc7/0x2c0\n udp_rcv+0x16ce/0x2260\n ip_protocol_deliver_rcu+0x197/0x2d0\n ip_local_deliver+0x430/0x690\n ip_rcv+0x16f/0x1f0\n __netif_receive_skb_one_core+0x15e/0x1c0\n __netif_receive_skb+0x1e/0x110\n netif_receive_skb+0xf6/0x5c0\n tun_rx_batched.isra.0+0x3ab/0x790\n tun_get_user+0x17c3/0x3550\n tun_chr_write_iter+0xba/0x1b0\n vfs_write+0x646/0x1130\n \u003c/TASK\u003e\n Kernel panic - not syncing: Fatal exception in interrupt\n\nThis runs with BH disabled, so it is a panic rather than an oops. The\nsame is reachable with CAP_NET_RAW in a netns where a defrag point\nprecedes a GSO point, and from a guest whose VMM forwards\nvirtio_net_hdr to a tap. The SKB_GSO_DODGY frag_list checks added by\ncommit 3dcbdb134f32 (\"net: gso: Fix skb_segment splat when splitting\ngso_size mangled skb having linear-headed frag_list\") and by\ncommit 9e4b7a99a03a (\"net: gso: fix panic on frag_list with mixed head\nalloc types\") do not cover it: page-backed heads skip them, and kmalloc\nheads skip them when gso_size \u003d\u003d skb_headlen(head), which the sender\ncontrols.\n\nAn skb entering a frag queue is an IP fragment by definition and\ncannot legitimately carry GSO state: GRO does not merge fragments and\nthe stack segments before it fragments, so only untrusted sources are\naffected. This has been reachable since\ncommit f43798c27684 (\"tun: Allow GSO using virtio_net_hdr\"), the first\npath that let userspace attach GSO metadata to an IP fragment. Reset\nthe GSO fields of every fragment as it is queued, in\ninet_frag_queue_insert(), which IPv4, IPv6, nf_conntrack_reasm and\n6lowpan reassembly share; then neither the head nor the frag_list\nmembers of the reassembled skb carry them (the members matter too:\nthe ip_do_fragment()/ip6_fragment() fast paths send them out as they\nare). The head may remain CHECKSUM_PARTIAL; that is already accepted\non receive and resolved by skb_checksum_help() in\nip_do_fragment()/ip6_fragment() on forward.\n\nTested on top of net.git (dc4b95b8fee9), x86_64: the tap reproducer\nabove, two further IPv4 frag_list geometries that reach\nBUG_ON(i \u003e\u003d nfrags) and BUG_ON(!list_skb-\u003ehead_frag), and an IPv6\nfragment-header variant (udp6_ufo_fragment()) each panic the unpatched\nkernel; with this patch all four datagrams are delivered intact and\nnothing is logged.\n\nFixes: f43798c27684 (\"tun: Allow GSO using virtio_net_hdr\")\nCc: stable@kernel.org\nSuggested-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: Xinyang Ge \u003cxinyang@anthropic.com\u003e\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/937926e509f2acd8e0e66520dc2b30fd6b4d1687.1787839506.git.pabeni@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "729c4896ab829169f95915d65edd530325910b37", "tree": "6ef0be24e18acef873929a0c986f959d4f93cc83", "parents": [ "6a7e91f890eceb4fd9d3662e7ffba1fcb55cc00e" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Wed Aug 26 11:33:39 2026 -0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Aug 27 12:47:58 2026 -0700" }, "message": "net/sched: sch_htb: limit htb_classify inner-class filter hops\n\nhtb_classify() follows each filter-selected inner class by switching\nto cl-\u003efilter_list, but never bounds the number of hops. A filter on\nan inner class can point back to itself or to another inner class that\npoints back, creating an infinite loop in the packet classification\npath with the qdisc lock held and BH disabled — a soft lockup / panic\nfrom a single packet.\n\nBound the traversal with a hop counter and drop the packet with a\nrate-limited warning once the bound is exceeded. The counter is\nincremented at the point the inner filter chain is picked up, after the\nTC_ACT_* switch has consumed the classifier verdict, so a terminal\nTC_ACT_QUEUED/STOLEN/TRAP on the last permitted chain still sets *qerr\nto __NET_XMIT_STOLEN and the packet is not charged as a drop by this\nqdisc or its parent.\n\nThe bound is TC_HTB_MAXDEPTH, taken from HTB\u0027s own parameters rather than\nfrom the qdisc hierarchy depth limit. Class levels run from 0 to\nTC_HTB_MAXDEPTH - 1, so a traversal that strictly descends in level can\ntake at most TC_HTB_MAXDEPTH hops. That descent is what a sane\nconfiguration does, but it is assumed here rather than enforced:\nhtb_find() resolves a classid against every class in the qdisc, so a\nfilter may equally select a sibling or an ancestor. The normal\nroot -\u003e inner -\u003e leaf path takes a single hop, so the bound does not\naffect legitimate classification.\n\nhtb_classify() can now return NULL irrespective of CONFIG_NET_CLS_ACT,\nwhereas previously every NULL return sat inside that ifdef. The NULL\nhandler in htb_enqueue() therefore cannot stay conditional either, so\ndrop the ifdef around it. This matches hfsc_enqueue(), which has always\nhandled a NULL class unconditionally. Without it, a kernel built\nwithout actions would dereference a NULL class instead of dropping.\n\nConditions to recreate the bug:\n- CONFIG_NET_SCHED, CONFIG_NET_SCH_HTB, CONFIG_NET_CLS_U32,\n CONFIG_LOCKUP_DETECTOR.\n- Create an HTB qdisc on a device (e.g. lo), add an inner class\n 1:1 with a leaf child 1:10, install a root u32 filter selecting\n 1:1, and an inner-class u32 filter on 1:1 also selecting 1:1.\n- Send one packet (ping). On the unfixed kernel the classify loop\n spins with the qdisc lock held; with softlockup_panic\u003d1 it panics.\n- Reachable from unprivileged user via unshare -Urn (CAP_NET_ADMIN).\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReported-by: Vega \u003cvega@nebusec.ai\u003e\nCo-developed-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nSigned-off-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260826143339.271935-1-victor@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6a7e91f890eceb4fd9d3662e7ffba1fcb55cc00e", "tree": "98365cd23bcfbda7709155208a607e2e1e85409b", "parents": [ "ce2b807f42ed5e55567b8864ab72963f90779270" ], "author": { "name": "Jiayuan Chen", "email": "jiayuan.chen@linux.dev", "time": "Wed Aug 26 22:11:27 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Aug 27 12:47:34 2026 -0700" }, "message": "selftests/net: packetdrill: add tcp_urg_ptr_retransmit\n\nDrive a connection into urgent mode and force a multi-segment retransmit,\nchecking that each retransmitted segment keeps its own urg_ptr.\n\nThe test asserts the fixed behaviour: the hole is retransmitted as two\nindependent skbs, each with its own urg_ptr (5001 and 4001) and no PSH.\nAn unpatched kernel instead sends one super-skb whose GSO split copies\nurg_ptr onto the second segment and also sets PSH there, so on an unpatched\nkernel the mismatch shows up on the PSH bit (actual P.U ... urg 5001) before\nthe urg_ptr:\n\n\ttcp_urg_ptr_retransmit.pkt:63: live packet field tcp_psh:\n\t\texpected: 0 (0x0) vs actual: 1 (0x1)\n\tscript packet: .U 1001:2001(1000) ack 1\n\tactual packet: P.U 1001:2001(1000) ack 1 win 1050\n\nAfter the fix the retransmit carries a per-segment urg_ptr and the test\npasses.\n\nSigned-off-by: Jiayuan Chen \u003cjiayuan.chen@linux.dev\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260826141145.67823-2-jiayuan.chen@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ce2b807f42ed5e55567b8864ab72963f90779270", "tree": "630f204f6ed81dc972d9b177ace820b1288902b9", "parents": [ "a60fd8c6dbaa76da4163cf225ed2b9e982540f39" ], "author": { "name": "Jiayuan Chen", "email": "jiayuan.chen@linux.dev", "time": "Wed Aug 26 22:11:26 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Aug 27 12:47:34 2026 -0700" }, "message": "tcp: fix corruption of urgent data on multi-segment retransmit\n\nOn the normal xmit path, while in urgent mode we refuse to build a\nmulti-segment TSO packet, so every segment gets its own urg_ptr:\n\n\t/* tcp_write_xmit() */\n\tlimit \u003d mss_now;\n\tif (tso_segs \u003e 1 \u0026\u0026 !tcp_urg_mode(tp))\n\t\tlimit \u003d tcp_mss_split_point(...);\n\nThe retransmit path has no such guard. __tcp_retransmit_skb() builds a\nsegs \u003e 1 skb and hands it to the GSO layer, which only advances th-\u003eseq\nper segment and copies urg_ptr verbatim:\n\n\t/* __tcp_retransmit_skb() */\n\tlen \u003d cur_mss * segs;\t\t/* segs \u003e 1, no urg_mode check */\n\t...\n\t/* tcp_gso_segment(): bumps seq only, urg_ptr is copied */\n\nurg_ptr is an offset from the segment\u0027s own seq, so a copied value points\nat a different place on each segment. The receiver rebuilds the absolute\nurgent seq as seg.seq + urg_ptr, so it walks a moving urgent point instead\nof the one OOB byte:\n\n\tseg1 seq 1 urg_ptr 5001 -\u003e urgent @ 5001 (ok)\n\tseg2 seq 1001 urg_ptr 5001 -\u003e urgent @ 6001 (wrong, +MSS)\n\tseg3 seq 2001 urg_ptr 5001 -\u003e urgent @ 7001 (wrong, +2*MSS)\n\nThe real OOB byte is never pointed at, so the receiver stops splicing it\nout and delivers it as normal in-band data, corrupting the stream.\n\nGuard the retransmit length like the xmit path: keep segs \u003d 1 while in\nurgent mode.\n\nFixes: 10d3be569243 (\"tcp-tso: do not split TSO packets at retransmit time\")\nSigned-off-by: Jiayuan Chen \u003cjiayuan.chen@linux.dev\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260826141145.67823-1-jiayuan.chen@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a60fd8c6dbaa76da4163cf225ed2b9e982540f39", "tree": "cccdf9a4d16ddd050015b0720daaa108c8e0b190", "parents": [ "dd890ae29299636fb037276fc1b5238698d08b03" ], "author": { "name": "Deepanshu Kartikey", "email": "kartikey406@gmail.com", "time": "Wed Aug 26 19:02:58 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Aug 27 12:46:16 2026 -0700" }, "message": "usb: atm: usbatm: fix invalid ci_range initialization\n\nsyzbot reported a shift-out-of-bounds in __vcc_connect():\n\n UBSAN: shift-out-of-bounds in net/atm/common.c:382:32\n shift exponent -1 is negative\n CPU: 0 UID: 0 PID: 5987 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full)\n Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120\n ubsan_epilogue+0xa/0x30 lib/ubsan.c:233\n __ubsan_handle_shift_out_of_bounds+0x36d/0x400 lib/ubsan.c:494\n __vcc_connect+0x14b4/0x19c0 net/atm/common.c:382\n vcc_connect+0x328/0x8f0 net/atm/common.c:498\n pvc_bind+0x272/0x380 net/atm/pvc.c:52\n __sys_bind+0x2e3/0x410 net/socket.c:1976\n __x64_sys_bind+0x7a/0x90 net/socket.c:1979\n ...\n\nATM device ci_range fields (vpi_bits and vci_bits) represent the\nnumber of bits supported for VPI and VCI addressing on the device.\nnet/atm/common.c directly uses these fields as bit shift counts:\n vpi \u003e\u003e dev-\u003eci_range.vpi_bits\n vci \u003e\u003e dev-\u003eci_range.vci_bits\n 1 \u003c\u003c vcc-\u003edev-\u003eci_range.vpi_bits\n 1 \u003c\u003c vcc-\u003edev-\u003eci_range.vci_bits\n\nusbatm_atm_init() sets ci_range.vpi_bits and ci_range.vci_bits to\nATM_CI_MAX (-1), which is defined in \u003cuapi/linux/atmdev.h\u003e as a\nsentinel value for userspace ATM_SETCIRANGE requests, not a valid bit\ncount. Shifting by -1 is undefined behavior and triggers UBSAN\nwarnings.\n\nATM UNI cell headers allow up to 8 bits for VPI (0..255) and 16 bits\nfor VCI (0..65535). Initialize vpi_bits to 8 and vci_bits to 16, as\ndone by solos-pci.\n\nFixes: c59bba75fa50 (\"[PATCH] USB ATM: new usbatm core\")\nReported-by: syzbot+6665d3db5fef15914802@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d6665d3db5fef15914802\nSuggested-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://lore.kernel.org/all/20260824024620.23485-1-kartikey406@gmail.com/T/ [v1]\nSigned-off-by: Deepanshu Kartikey \u003ckartikey406@gmail.com\u003e\nLink: https://patch.msgid.link/20260826133258.8306-1-kartikey406@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "dd890ae29299636fb037276fc1b5238698d08b03", "tree": "0d4ff2c5b9f03e0551b74aa811a6ac5db5fc0262", "parents": [ "23c53269f2baaedf2d92784290cb9ef6db2a3bce" ], "author": { "name": "bui duc phuc", "email": "phucduc.bui@gmail.com", "time": "Wed Aug 26 17:34:28 2026 +0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Aug 27 12:41:14 2026 -0700" }, "message": "net: fec: only stop PTP if it was initialized\n\nfec_ptp_init() is only called when fep-\u003ebufdesc_ex is available.\nHowever, fec_probe() unconditionally calls fec_ptp_stop() on the\nfailed_init path, and fec_drv_remove() unconditionally calls\nfec_ptp_stop() during device removal.\n\nCheck fep-\u003ebufdesc_ex before calling fec_ptp_stop() in both paths\nto avoid stopping PTP when it was not initialized.\n\nFixes: 32cba57ba74b (\"net: fec: introduce fec_ptp_stop and use in probe fail path\")\nReviewed-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Frank Li \u003cFrank.Li@nxp.com\u003e\nSigned-off-by: bui duc phuc \u003cphucduc.bui@gmail.com\u003e\nLink: https://patch.msgid.link/20260826103428.32807-1-phucduc.bui@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" } ], "next": "23c53269f2baaedf2d92784290cb9ef6db2a3bce" }