linux-stable.git/include/linux, branch v7.3-rc2 Linux kernel stable tree Merge tag 'trace-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace 2026-09-06T21:21:24+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-09-06T21:21:24+00:00 b1e00ffaf91c41eb752a1c200295c9ab7abfae1d Pull tracing fixes from Steven Rostedt: - Fix several tracefs files that did not take the trace_array reference A trace instance can be created and destroyed in the tracefs "instances" directory via mkdir and rmdir respectively. The instance is represented by a trace_array descriptor. Most tracefs files pass the trace_array as the private data of the inode to the open/read/write functions. Since there is no locking between the time a task opens a file and the deletion of the instance (and the freeing of the trace_array), each open needs to get a reference to the trace_array and each close must remove it. An instance can't be removed if there's any reference taken on its trace_array. The open function uses trace_array_get() that takes a lock (preventing removal of instances) and iterates the list of all existing trace_arrays and if it finds a match, it takes the reference and releases the lock. If it doesn't find a match, it causes the open to return -ENODEV. There were some added files that did not take the trace_array reference on open that needed to be fixed. Sashiko also correctly pointed out that there were some files that took an address of an field or element of the trace_array which had a pointer back to the trace_array to take its reference on open. But this leaves a slight race between referencing this element to get the trace_array as the element itself could be freed. To solve this, some helper functions were created to look for trace_arrays with this field or element in the search so that the element did not have to be dereferenced before the trace_array's reference was taken. - Add a lock around ftrace_ops initialization When a ftrace_ops is first used by ftrace, some internal initialization is performed on the ops. But if multiple tasks were calling functions that did this initialization, it could race and perform doing the initialization more than once, corrupting the internal data. Add a lock in the initialization code to prevent this from happening. - Fix splice reads on mmapped buffers The logic in the ring buffer splice code for mmapped buffers is supposed to do a copy of the memory as the mapped buffers can't be given to splice. But there was an if statement within the copy code that would return a -1 if a request for a full page was done and it wasn't a partial read. This is because this logic was written before mmapped buffers existed and this case didn't make sense at the time. For mmapped buffers it makes perfect sense and by returning early can drop a lot of pages unnecessarily. - Have the persistent ring buffer validation check nr_subbufs Sashiko reported that the validation code was relying on the saved nr_subbufs to match the calculated nr_pages + 1 and if they were off, that the code could cause corruption. Sashiko is correct, and the saved nr_subbufs should be validated before assuming it is correct. - Do not allow more than one instance with the same name on cmdline If an admin were to add more than one trace instances with the same name they all would be created, but only the first one would be accessible via tracefs. This used to not be allowed but some restructuring of code has since made it possible. - Fix the race between subbuf resize and trace_pipe_raw readers If a task was reading trace_pipe_raw while another task was changing the ring buffer subbuf size, it could crash the reader. The trace_pipe_raw readers do get their own copy of the page from the buffer, but the code needs some restructuring to not have the resize of the subbuffers cause issues. - Cap the size of the mapped (static) ring buffer nr_pages The meta data used for ring buffer mapped buffers is 32 bit in size. A normal ring buffer could (in theory) have more than 4 billion pages. But this is not allowed by mapped buffers, so enforce it. * tag 'trace-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ring-buffer: Use a macro for static buffer bits tracing: Fix comment in tracing_buffers_splice_read() ring-buffer: Prevent truncation of nr_pages / nr_subbufs ring-buffer: Cap static ring buffer nr_pages tracing: Fix subbuf resize races with trace_pipe_raw readers tracing: Fix to avoid creating trace instances with duplicate names ring-buffer: Add checking nr_subbufs to persistent ring buffer validation ring-buffer: Allow splice reads on static buffers tracing: Take trace_array reference when opening options file ftrace: Synchronize the initialization of ftrace_ops ftrace: Take trace_array reference before accessing its ftrace_ops tracing: Have show_event_filters/triggers files take trace array ref 
Pull tracing fixes from Steven Rostedt:

 - Fix several tracefs files that did not take the trace_array reference

   A trace instance can be created and destroyed in the tracefs
   "instances" directory via mkdir and rmdir respectively. The instance
   is represented by a trace_array descriptor.

   Most tracefs files pass the trace_array as the private data of the
   inode to the open/read/write functions. Since there is no locking
   between the time a task opens a file and the deletion of the instance
   (and the freeing of the trace_array), each open needs to get a
   reference to the trace_array and each close must remove it.

   An instance can't be removed if there's any reference taken on its
   trace_array. The open function uses trace_array_get() that takes a
   lock (preventing removal of instances) and iterates the list of all
   existing trace_arrays and if it finds a match, it takes the reference
   and releases the lock. If it doesn't find a match, it causes the open
   to return -ENODEV.

   There were some added files that did not take the trace_array
   reference on open that needed to be fixed. Sashiko also correctly
   pointed out that there were some files that took an address of an
   field or element of the trace_array which had a pointer back to the
   trace_array to take its reference on open. But this leaves a slight
   race between referencing this element to get the trace_array as the
   element itself could be freed. To solve this, some helper functions
   were created to look for trace_arrays with this field or element in
   the search so that the element did not have to be dereferenced before
   the trace_array's reference was taken.

 - Add a lock around ftrace_ops initialization

   When a ftrace_ops is first used by ftrace, some internal
   initialization is performed on the ops. But if multiple tasks were
   calling functions that did this initialization, it could race and
   perform doing the initialization more than once, corrupting the
   internal data. Add a lock in the initialization code to prevent this
   from happening.

 - Fix splice reads on mmapped buffers

   The logic in the ring buffer splice code for mmapped buffers is
   supposed to do a copy of the memory as the mapped buffers can't be
   given to splice. But there was an if statement within the copy code
   that would return a -1 if a request for a full page was done and it
   wasn't a partial read. This is because this logic was written before
   mmapped buffers existed and this case didn't make sense at the time.
   For mmapped buffers it makes perfect sense and by returning early can
   drop a lot of pages unnecessarily.

 - Have the persistent ring buffer validation check nr_subbufs

   Sashiko reported that the validation code was relying on the saved
   nr_subbufs to match the calculated nr_pages + 1 and if they were off,
   that the code could cause corruption. Sashiko is correct, and the
   saved nr_subbufs should be validated before assuming it is correct.

 - Do not allow more than one instance with the same name on cmdline

   If an admin were to add more than one trace instances with the same
   name they all would be created, but only the first one would be
   accessible via tracefs. This used to not be allowed but some
   restructuring of code has since made it possible.

 - Fix the race between subbuf resize and trace_pipe_raw readers

   If a task was reading trace_pipe_raw while another task was changing
   the ring buffer subbuf size, it could crash the reader. The
   trace_pipe_raw readers do get their own copy of the page from the
   buffer, but the code needs some restructuring to not have the resize
   of the subbuffers cause issues.

 - Cap the size of the mapped (static) ring buffer nr_pages

   The meta data used for ring buffer mapped buffers is 32 bit in size.
   A normal ring buffer could (in theory) have more than 4 billion
   pages. But this is not allowed by mapped buffers, so enforce it.

* tag 'trace-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  ring-buffer: Use a macro for static buffer bits
  tracing: Fix comment in tracing_buffers_splice_read()
  ring-buffer: Prevent truncation of nr_pages / nr_subbufs
  ring-buffer: Cap static ring buffer nr_pages
  tracing: Fix subbuf resize races with trace_pipe_raw readers
  tracing: Fix to avoid creating trace instances with duplicate names
  ring-buffer: Add checking nr_subbufs to persistent ring buffer validation
  ring-buffer: Allow splice reads on static buffers
  tracing: Take trace_array reference when opening options file
  ftrace: Synchronize the initialization of ftrace_ops
  ftrace: Take trace_array reference before accessing its ftrace_ops
  tracing: Have show_event_filters/triggers files take trace array ref
Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 2026-09-06T20:49:44+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-09-06T20:49:44+00:00 2beb1b31a12b57e19cd5c82ea6d54e56520605e8 Pull bpf fixes from Alexei Starovoitov: "This mainly contains verifier fixes that address bugs reported by Nicholas Carlini. - Fix incorrect non-NULL inference in pointer comparisons: pointer types that may be NULL at runtime, pointers with unbounded offsets, JMP32 comparisons with zero, and imprecise zero registers (Eduard Zingerman) - Fix precision tracking for half-dead zero spills, ld_abs/ld_ind implicit subprog exit, bpf_loop() callbacks, linked scalar ids and NULL call arguments (Eduard Zingerman) - Reject BPF_PSEUDO_FUNC reference to the main program, fix zero extension of arena 32-bit cmpxchg, don't rewrite bpf_fastcall patterns entered by a jump (Eduard Zingerman) - Fix percpu map update and BPF_F_CPU validation with sparse CPU IDs (Hui Su) - Fix NULL-ptr-derefs in bpf_snprintf_btf() for void and VAR types, and reject key-less BTF for hash maps (Jiayuan Chen) - Various fixes (Kumar Kartikeya Dwivedi): - Fix out-of-bounds access in disassembler on invalid LDSX instruction - mark siginfo of signal tracepoints as scalar and sched_process_wait argument as nullable - mark faultable stack helpers as sleepable - reject tail calls and legacy packet loads from callbacks - enforce rbtree callback lock restrictions for resilient locks - require MEM_PERCPU for percpu kptr stores - clear NON_OWN_REF after RCU protection ends - mark NULL kptr stores precise - preserve inner map identity in callback frames - reject non-scalar bpf_loop() iteration counts - Fix trampoline allocation slowdown on x86 by using EXECMEM_MODULE_DATA (Mike Rapoport) - Keep bpf_refcount_acquire() nullable for borrowed RCU kptrs and reject untrusted allocated-object pointers (Ning Ding) - Fix special fields handling in recycled rhtab elements (Nuoqi Gui, Yuan Chen)" * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (86 commits) bpf, riscv: Make arena support depend on ZACAS selftests/bpf: Test pointer bpf_loop iteration count rejection bpf: Reject non-scalar bpf_loop iteration counts bpf: use mark_arg_precision() in check_mem_size_reg() bpf: propagate mark_chain_precision() errors out of loop_flag_is_zero() selftests/bpf: precision of a NULL global subprogram BTF_ID argument bpf: mark a NULL BTF_ID argument of a global subprogram precise selftests/bpf: precision of a NULL kfunc argument bpf: mark a NULL kfunc argument precise selftests/bpf: precision of a NULL global subprogram memory argument bpf: mark a NULL memory argument of a call precise selftests/bpf: precision of a NULL helper argument bpf: mark a NULL call argument precise selftests/bpf: Test inner map identities in callbacks bpf: Preserve inner map identity in callback frames selftests/bpf: Test imprecise scalar kptr stores bpf: Mark NULL kptr stores precise selftests/bpf: Test rhtab kptr cancellation semantics bpf: Cancel special fields when recycling rhtab elements selftests/bpf: Test timer field on recycled rhtab element ... 
Pull bpf fixes from Alexei Starovoitov:
 "This mainly contains verifier fixes that address bugs reported by
  Nicholas Carlini.

   - Fix incorrect non-NULL inference in pointer comparisons: pointer
     types that may be NULL at runtime, pointers with unbounded offsets,
     JMP32 comparisons with zero, and imprecise zero registers (Eduard
     Zingerman)

   - Fix precision tracking for half-dead zero spills, ld_abs/ld_ind
     implicit subprog exit, bpf_loop() callbacks, linked scalar ids and
     NULL call arguments (Eduard Zingerman)

   - Reject BPF_PSEUDO_FUNC reference to the main program, fix zero
     extension of arena 32-bit cmpxchg, don't rewrite bpf_fastcall
     patterns entered by a jump (Eduard Zingerman)

   - Fix percpu map update and BPF_F_CPU validation with sparse CPU IDs
     (Hui Su)

   - Fix NULL-ptr-derefs in bpf_snprintf_btf() for void and VAR types,
     and reject key-less BTF for hash maps (Jiayuan Chen)

   - Various fixes (Kumar Kartikeya Dwivedi):
       - Fix out-of-bounds access in disassembler on invalid LDSX
         instruction
       - mark siginfo of signal tracepoints as scalar and
         sched_process_wait argument as nullable
       - mark faultable stack helpers as sleepable
       - reject tail calls and legacy packet loads from callbacks
       - enforce rbtree callback lock restrictions for resilient locks
       - require MEM_PERCPU for percpu kptr stores
       - clear NON_OWN_REF after RCU protection ends
       - mark NULL kptr stores precise
       - preserve inner map identity in callback frames
       - reject non-scalar bpf_loop() iteration counts

   - Fix trampoline allocation slowdown on x86 by using
     EXECMEM_MODULE_DATA (Mike Rapoport)

   - Keep bpf_refcount_acquire() nullable for borrowed RCU kptrs and
     reject untrusted allocated-object pointers (Ning Ding)

   - Fix special fields handling in recycled rhtab elements (Nuoqi Gui,
     Yuan Chen)"

* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (86 commits)
  bpf, riscv: Make arena support depend on ZACAS
  selftests/bpf: Test pointer bpf_loop iteration count rejection
  bpf: Reject non-scalar bpf_loop iteration counts
  bpf: use mark_arg_precision() in check_mem_size_reg()
  bpf: propagate mark_chain_precision() errors out of loop_flag_is_zero()
  selftests/bpf: precision of a NULL global subprogram BTF_ID argument
  bpf: mark a NULL BTF_ID argument of a global subprogram precise
  selftests/bpf: precision of a NULL kfunc argument
  bpf: mark a NULL kfunc argument precise
  selftests/bpf: precision of a NULL global subprogram memory argument
  bpf: mark a NULL memory argument of a call precise
  selftests/bpf: precision of a NULL helper argument
  bpf: mark a NULL call argument precise
  selftests/bpf: Test inner map identities in callbacks
  bpf: Preserve inner map identity in callback frames
  selftests/bpf: Test imprecise scalar kptr stores
  bpf: Mark NULL kptr stores precise
  selftests/bpf: Test rhtab kptr cancellation semantics
  bpf: Cancel special fields when recycling rhtab elements
  selftests/bpf: Test timer field on recycled rhtab element
  ...
Merge tag 'locking-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2026-09-06T17:45:46+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-09-06T17:45:46+00:00 c8990f3179e5636832fc22e6a262de5d50c797e3 Pull locking fixes from Ingo Molnar: - Fix a softirq processing delay bug in local_interrupt_disable(), which should mostly only affect the Rust runtime (Boqun Feng) - Remove the hardirq_disable_count() function which caused the previous bug and is now unused & unnecessary (Boqun Feng) - lockdep: Invalidate stale class_cache entries for zapped classes (Eric Dumazet) - Fix rt_mutex specific futex scheduling helpers (Sebastian Andrzej Siewior) - Fix rcuwait use-after-free race during futex requeue PI (Yao Kai) * tag 'locking-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: futex: Prevent rcuwait use-after-free during requeue PI futex: Provide rt_mutex_.*_schedule() equivalents for futex scheduling locking/lockdep: Invalidate stale class_cache entries for zapped classes preempt: Remove hardirq_disable_count() interrupt: Disable interrupt before modifying hardirq_disable counter 
Pull locking fixes from Ingo Molnar:

 - Fix a softirq processing delay bug in local_interrupt_disable(),
   which should mostly only affect the Rust runtime (Boqun Feng)

 - Remove the hardirq_disable_count() function which caused the
   previous bug and is now unused & unnecessary (Boqun Feng)

 - lockdep: Invalidate stale class_cache entries for zapped classes
   (Eric Dumazet)

 - Fix rt_mutex specific futex scheduling helpers
   (Sebastian Andrzej Siewior)

 - Fix rcuwait use-after-free race during futex requeue PI (Yao Kai)

* tag 'locking-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  futex: Prevent rcuwait use-after-free during requeue PI
  futex: Provide rt_mutex_.*_schedule() equivalents for futex scheduling
  locking/lockdep: Invalidate stale class_cache entries for zapped classes
  preempt: Remove hardirq_disable_count()
  interrupt: Disable interrupt before modifying hardirq_disable counter
Merge tag 'irq-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2026-09-06T17:35:24+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-09-06T17:35:24+00:00 b485131995544741ba6dcc313d7eb573bca7bebc Pull IRQ subsystem fixes from Ingo Molnar: - Revert a commit to the mbigen irqchip driver that caused a regression on two-port Hi1616 chips (Caina) - Fix a too-long-preemption-off bug in the stm32mp-exti irqchip driver, caused by a time unit ambiguity & mismatch (Ju Nan) - Remove the now completely unused irq_domain_add_linear() inline function (Jiri Slaby) * tag 'irq-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout Revert "irqchip/mbigen: Fix mbigen node address layout" irqdomain: Delete irq_domain_add_linear() 
Pull IRQ subsystem fixes from Ingo Molnar:

 - Revert a commit to the mbigen irqchip driver that caused
   a regression on two-port Hi1616 chips (Caina)

 - Fix a too-long-preemption-off bug in the stm32mp-exti
   irqchip driver, caused by a time unit ambiguity & mismatch
   (Ju Nan)

 - Remove the now completely unused irq_domain_add_linear()
   inline function (Jiri Slaby)

* tag 'irq-urgent-2026-09-06' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  irqchip/stm32mp-exti: Fix the unit of the hwspinlock timeout
  Revert "irqchip/mbigen: Fix mbigen node address layout"
  irqdomain: Delete irq_domain_add_linear()
bpf: Reject non-scalar bpf_loop iteration counts 2026-09-06T03:50:13+00:00 Kumar Kartikeya Dwivedi memxor@gmail.com 2026-09-05T01:47:33+00:00 c3fd8e5fd100f122bad503bdc0e9277219533253 bpf_loop() declares its nr_loops argument as ARG_ANYTHING. Privileged programs may pass pointer values to such arguments, so check_func_arg() lets a pointer-valued R1 reach the helper-specific checks. Since commit bb124da69c47 ("bpf: keep track of max number of bpf_loop callback iterations"), the verifier marks R1 precise and reads its upper bound to limit callback simulation. Precision backtracking only accepts scalar registers, so passing a pointer instead triggers the "backtracking misuse" verifier warning. Kernels with panic_on_warn enabled subsequently panic. Introduce ARG_SCALAR for helper arguments that only accept scalar values and use it for bpf_loop() nr_loops. Generic helper argument validation then rejects pointers before loop inlining and precision processing. Fixes: bb124da69c47 ("bpf: keep track of max number of bpf_loop callback iterations") Reported-by: syzbot+7b47f87674e9a1569110@syzkaller.appspotmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://patch.msgid.link/20260905014735.1452988-2-memxor@gmail.com Closes: https://lore.kernel.org/bpf/6a9ad24c.b5d4176b.238c3e.0001.GAE@google.com/ Signed-off-by: Eduard Zingerman <eddyz87@gmail.com> 
bpf_loop() declares its nr_loops argument as ARG_ANYTHING. Privileged
programs may pass pointer values to such arguments, so check_func_arg()
lets a pointer-valued R1 reach the helper-specific checks.

Since commit bb124da69c47 ("bpf: keep track of max number of bpf_loop
callback iterations"), the verifier marks R1 precise and reads its upper
bound to limit callback simulation. Precision backtracking only accepts
scalar registers, so passing a pointer instead triggers the "backtracking
misuse" verifier warning. Kernels with panic_on_warn enabled subsequently
panic.

Introduce ARG_SCALAR for helper arguments that only accept scalar values
and use it for bpf_loop() nr_loops. Generic helper argument validation then
rejects pointers before loop inlining and precision processing.

Fixes: bb124da69c47 ("bpf: keep track of max number of bpf_loop callback iterations")
Reported-by: syzbot+7b47f87674e9a1569110@syzkaller.appspotmail.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://patch.msgid.link/20260905014735.1452988-2-memxor@gmail.com
Closes: https://lore.kernel.org/bpf/6a9ad24c.b5d4176b.238c3e.0001.GAE@google.com/
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Merge tag 'block-7.3-20260905' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux 2026-09-05T15:58:55+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-09-05T15:58:55+00:00 d0fc310b4dfd334023b90d2423818044190c0f68 Pull block fixes from Jens Axboe: - NVMe fixes via Keith: - nvme-tcp fixes for an out-of-bounds write on an over-long PDU - nvmet-tcp, nvmet-rdma and nvme-rdma leak and cleanup-ordering fixes - FDP placement id array racy access fix - nvme-fc double free of fabrics options on nvme_add_ctrl() failure, and a secret leak failure - Fault injection opcode filtering - stale namespace removal during scan - Various other smaller fixes and cleanups - Flag zoned disks with GENHD_FL_NO_PART - Save the page offset gaps in a cloned bio - Fix dma_alignment for large or unreported limits in loop and zloop - Clear VM_MAYWRITE on a read-only ublk char device mmap * tag 'block-7.3-20260905' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (25 commits) nvme-tcp.h: drop kernel-doc comments, fix a few descriptions nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails nvmet: reject namespace enable without device path nvmet-auth: Synchronize timeout work during SQ teardown MAINTAINERS: update nvme entry nvmet-tcp: reject unsolicited H2CData PDUs nvme-tcp: defer TLS inline send to io_work nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU nvme-tcp: return -EPROTO for a C2HData on a write nvmet: print namespace IDs as unsigned 32bit value nvme: print namespace IDs as unsigned 32bit value nvme: remove stale namespaces by NSID range during scan nvme: add missing SRCU grace period in error path nvme-fabrics: fix DHCHAP secret leak on parse failure ublk: clear VM_MAYWRITE on read-only ublk char device mmap loop, zloop: fix dma_alignment for large or unreported limits block: save page offset gaps in cloned bio block: flag zoned disks with GENHD_FL_NO_PART nvmet-rdma: fix queue leak when connect backlog is exceeded nvme: add opcode filtering for fault injection ... 
Pull block fixes from Jens Axboe:

 - NVMe fixes via Keith:
     - nvme-tcp fixes for an out-of-bounds write on an over-long PDU
     - nvmet-tcp, nvmet-rdma and nvme-rdma leak and cleanup-ordering
       fixes
     - FDP placement id array racy access fix
     - nvme-fc double free of fabrics options on nvme_add_ctrl()
       failure, and a secret leak failure
     - Fault injection opcode filtering
     - stale namespace removal during scan
     - Various other smaller fixes and cleanups

 - Flag zoned disks with GENHD_FL_NO_PART

 - Save the page offset gaps in a cloned bio

 - Fix dma_alignment for large or unreported limits in loop and zloop

 - Clear VM_MAYWRITE on a read-only ublk char device mmap

* tag 'block-7.3-20260905' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (25 commits)
  nvme-tcp.h: drop kernel-doc comments, fix a few descriptions
  nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails
  nvmet: reject namespace enable without device path
  nvmet-auth: Synchronize timeout work during SQ teardown
  MAINTAINERS: update nvme entry
  nvmet-tcp: reject unsolicited H2CData PDUs
  nvme-tcp: defer TLS inline send to io_work
  nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
  nvme-tcp: return -EPROTO for a C2HData on a write
  nvmet: print namespace IDs as unsigned 32bit value
  nvme: print namespace IDs as unsigned 32bit value
  nvme: remove stale namespaces by NSID range during scan
  nvme: add missing SRCU grace period in error path
  nvme-fabrics: fix DHCHAP secret leak on parse failure
  ublk: clear VM_MAYWRITE on read-only ublk char device mmap
  loop, zloop: fix dma_alignment for large or unreported limits
  block: save page offset gaps in cloned bio
  block: flag zoned disks with GENHD_FL_NO_PART
  nvmet-rdma: fix queue leak when connect backlog is exceeded
  nvme: add opcode filtering for fault injection
  ...
Merge tag 'drm-fixes-2026-09-05' of https://gitlab.freedesktop.org/drm/kernel 2026-09-04T20:42:16+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-09-04T20:42:16+00:00 654ae5d73c05bd2943d65636ce6cd0aa46e62f18 Pull drm fixes from Dave Airlie: "Lots of scattered fixes: nouveau has a bunch of display fixes for blackwell GPUs that should mean we light up monitors properly and fix some desktop rendering problems, amdgpu and intel display changes as usual. There also changes to the core pagemap, then the usual amouny of AI inspired validation fixes. core: - Fix drm_crtc_commit leak when PAGE_FLIP_EVENT is used dma-buf: - Publish the dma-buf only after copy_to_user succeeds - fix some kernel-doc warnings atomic-state-helpers: - set pixel_blend_mode to prop default on reset sysfb: - Fix integer overflow - fix constant comparison bug pagemap: - Prevent double migration of device pages - Reset migration page count on eviction retry - dma-unmap pages before handling migration errors - use after free fixes prime: - fix prime exports tracing amdgpu: - Fix for drm_amdgpu_info_device with mixed 64 bit kernel and 32 bit userspace - plane blend mode fixes - SR-IOV fix - GFX8 fix - MES queue reset fix - GPUVM fixes - DCN 6 warning fix - DCN 3.5/3.6 fix - DML fix - Backlight fix - Colorop fix - DC get_estimated_bw() fix - devcoredump fix - Userq fixes - APU PSP fix - Cursor fix amdkfd: - MES queue eviction fix - MQD debugfs fix xe: - oa uapi error handling fix - drm info message to report FLAT_CSS base misalignment i915: - Drop an accidentally duplicated panel fitter call in DP MST - Fix DDI clock programming for Cx0 and LT PHY - Fix PTL CDCLK handling at probe, causing a glitch - Fix dg2_power_well_count() return type - Fix a NULL pointer deref at forced probe - Fix selective fetch disable amdxdna: - out-of-bounds access fix - reject commands chains with no commands - handle chained mapping BO failures - refuse to flush an imported BO ethosu: - handle mmio mapping failures - handle storage modes only on hardware that supports it - fix job completion fence cleanup fastrpc: - Publish the dma-buf only after copy_to_user succeeds gud: - Improve TV modes and rotation handling nouveau: - use-after-free fixes - add missing scanline position support - HDMI and DP fixes - null pointer dereference fix - dmem accounting fixes for large folios - use write-combined maps for coherent qaic: - out-of-bounds access fix tegra: - Add blend mode properties virtio: - exit path and error handling fixes * tag 'drm-fixes-2026-09-05' of https://gitlab.freedesktop.org/drm/kernel: (83 commits) drm/xe/vram: report FLAT_CCS base misalignment MAINTAINERS, mailmap: use Aditya Garg's linux.dev account drm/amd/display: use plane color_mgmt_changed to track colorop changes drm/amdgpu/userq: fix struct drm_amdgpu_info_device padding for 32bit compile drm/amd/display: Fix cursor disable with horizontally split planes drm/amdgpu/userq: dont overwrite the error of subsequent map call drm/amdgpu: Skip accessing psp rum time db for APUs drm/amdgpu: update the fw version for gfx12 userqueues drm/amdgpu: update the fw version for gfx11 userqueues drm/amdgpu: fix byte/dword unit mismatch in coredump IB dump drm/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqds drm/amd/display: fix division by zero in get_estimated_bw() drm/amd/display: use halving distribution for all encode-to-linear curves drm/amd/display: Fix backlight control for luminance-capable OLED drm/amd/display: Remove const Qualifier From Non-Pointer Fields drm/amd/display: Set gpuvm min page size to 4K on dcn35/36 drm/amd/display: Fix DCN5/6 DML2 compilation warnings drm/amdgpu: fix Idle BOs list in VM debugfs status info drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT drm/amdgpu: Update queue reset support version ... 
Pull drm fixes from Dave Airlie:
 "Lots of scattered fixes: nouveau has a bunch of display fixes for
  blackwell GPUs that should mean we light up monitors properly and fix
  some desktop rendering problems, amdgpu and intel display changes as
  usual.

  There also changes to the core pagemap, then the usual amouny of AI
  inspired validation fixes.

  core:
   - Fix drm_crtc_commit leak when PAGE_FLIP_EVENT is used

  dma-buf:
   - Publish the dma-buf only after copy_to_user succeeds
   - fix some kernel-doc warnings

  atomic-state-helpers:
   - set pixel_blend_mode to prop default on reset

  sysfb:
   - Fix integer overflow
   - fix constant comparison bug

  pagemap:
   - Prevent double migration of device pages
   - Reset migration page count on eviction retry
   - dma-unmap pages before handling migration errors
   - use after free fixes

  prime:
   - fix prime exports tracing

  amdgpu:
   - Fix for drm_amdgpu_info_device with mixed 64 bit kernel and 32 bit
     userspace
   - plane blend mode fixes
   - SR-IOV fix
   - GFX8 fix
   - MES queue reset fix
   - GPUVM fixes
   - DCN 6 warning fix
   - DCN 3.5/3.6 fix
   - DML fix
   - Backlight fix
   - Colorop fix
   - DC get_estimated_bw() fix
   - devcoredump fix
   - Userq fixes
   - APU PSP fix
   - Cursor fix

  amdkfd:
   - MES queue eviction fix
   - MQD debugfs fix

  xe:
   - oa uapi error handling fix
   - drm info message to report FLAT_CSS base misalignment

  i915:
   - Drop an accidentally duplicated panel fitter call in DP MST
   - Fix DDI clock programming for Cx0 and LT PHY
   - Fix PTL CDCLK handling at probe, causing a glitch
   - Fix dg2_power_well_count() return type
   - Fix a NULL pointer deref at forced probe
   - Fix selective fetch disable

  amdxdna:
   - out-of-bounds access fix
   - reject commands chains with no commands
   - handle chained mapping BO failures
   - refuse to flush an imported BO

  ethosu:
   - handle mmio mapping failures
   - handle storage modes only on hardware that supports it
   - fix job completion fence cleanup

  fastrpc:
   - Publish the dma-buf only after copy_to_user succeeds

  gud:
   - Improve TV modes and rotation handling

  nouveau:
   - use-after-free fixes
   - add missing scanline position support
   - HDMI and DP fixes
   - null pointer dereference fix
   - dmem accounting fixes for large folios
   - use write-combined maps for coherent

  qaic:
   - out-of-bounds access fix

  tegra:
   - Add blend mode properties

  virtio:
   - exit path and error handling fixes

* tag 'drm-fixes-2026-09-05' of https://gitlab.freedesktop.org/drm/kernel: (83 commits)
  drm/xe/vram: report FLAT_CCS base misalignment
  MAINTAINERS, mailmap: use Aditya Garg's linux.dev account
  drm/amd/display: use plane color_mgmt_changed to track colorop changes
  drm/amdgpu/userq: fix struct drm_amdgpu_info_device padding for 32bit compile
  drm/amd/display: Fix cursor disable with horizontally split planes
  drm/amdgpu/userq: dont overwrite the error of subsequent map call
  drm/amdgpu: Skip accessing psp rum time db for APUs
  drm/amdgpu: update the fw version for gfx12 userqueues
  drm/amdgpu: update the fw version for gfx11 userqueues
  drm/amdgpu: fix byte/dword unit mismatch in coredump IB dump
  drm/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqds
  drm/amd/display: fix division by zero in get_estimated_bw()
  drm/amd/display: use halving distribution for all encode-to-linear curves
  drm/amd/display: Fix backlight control for luminance-capable OLED
  drm/amd/display: Remove const Qualifier From Non-Pointer Fields
  drm/amd/display: Set gpuvm min page size to 4K on dcn35/36
  drm/amd/display: Fix DCN5/6 DML2 compilation warnings
  drm/amdgpu: fix Idle BOs list in VM debugfs status info
  drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT
  drm/amdgpu: Update queue reset support version
  ...
tracing: Fix subbuf resize races with trace_pipe_raw readers 2026-09-04T20:19:07+00:00 Vincent Donnefort vdonnefort@google.com 2026-09-04T16:44:48+00:00 dae8dda341d2d9034a90d59e8a7d502e1263813f Concurrent subbuffer resizes may crash trace_pipe_raw readers or leak uninitialized memory to userspace due to stale size values. Modify ring_buffer_alloc_read_page() to handle the resizing of an existing buffer_data_read_page if necessary and add a new ring_buffer_read_page_size(). This new function enables ring-buffer buffer_data_read_page users to not call the racy ring_buffer_subbuf_size_get(). This makes the spare_size member of ftrace_buffer_info redundant. Finally, handle buffer_data_read_page/reader_page order discrepancy in ring_buffer_read_page(). On a mismatch simply copy manually the data to the buffer_data_read_page. Link: https://lore.kernel.org/all/20260817140812.2C7D41F00A3A@smtp.kernel.org/ Link: https://patch.msgid.link/20260904164450.1345852-3-vdonnefort@google.com Fixes: bce761d75745 ("ring-buffer: Read and write to ring buffers with custom sub buffer size") Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org> 
Concurrent subbuffer resizes may crash trace_pipe_raw readers or leak
uninitialized memory to userspace due to stale size values.

Modify ring_buffer_alloc_read_page() to handle the resizing of an
existing buffer_data_read_page if necessary and add a new
ring_buffer_read_page_size(). This new function enables ring-buffer
buffer_data_read_page users to not call the racy
ring_buffer_subbuf_size_get(). This makes the spare_size member of
ftrace_buffer_info redundant.

Finally, handle buffer_data_read_page/reader_page order discrepancy in
ring_buffer_read_page(). On a mismatch simply copy manually the data to
the buffer_data_read_page.

Link: https://lore.kernel.org/all/20260817140812.2C7D41F00A3A@smtp.kernel.org/
Link: https://patch.msgid.link/20260904164450.1345852-3-vdonnefort@google.com
Fixes: bce761d75745 ("ring-buffer: Read and write to ring buffers with custom sub buffer size")
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Merge tag 'probes-fixes-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace 2026-09-04T15:24:09+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-09-04T15:24:09+00:00 421066905cbceca1f78cba5f7d92b4980317ab2b Pull probes fixes from Masami Hiramatsu: - Protect kprobe_blacklist with RCU RCU-protect kprobe_blacklist and use kfree_rcu() to prevent UAF races during module unloading and enable safe atomic lookups. - Fix multi-probe field use-after-free Duplicate field and type strings on trace_probe_event to prevent UAF when freeing primary probe - Fix probe BTF member lookup: Check the containing inner struct/union kflag when resolving anonymous members to ensure correct bitfield offset calculation Prevent unnamed bitfields from being pushed to anon_stack in btf_find_struct_member(), avoiding false lookup errors Fix code block indentation in get_bitoffset_of_field() - uprobes error pointer safety Guard free_trace_uprobe() with IS_ERR_OR_NULL() to avoid crashing during automatic cleanup when an error pointer is returned * tag 'probes-fixes-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: kprobes: Protect kprobe_blacklist with RCU tracing/probes: Fix use-after-free on field name/type of events with multiple probes tracing/probes: Fix code indent in get_bitoffset_of_field() tracing/probes: Fix BTF kflag check for anonymous struct member access tracing/probes: Fix anon_stack check for unnamed bitfields in btf_find_struct_member uprobes: guard trace cleanup against error pointers 
Pull probes fixes from Masami Hiramatsu:

 - Protect kprobe_blacklist with RCU

   RCU-protect kprobe_blacklist and use kfree_rcu() to prevent UAF races
   during module unloading and enable safe atomic lookups.

 - Fix multi-probe field use-after-free

   Duplicate field and type strings on trace_probe_event to prevent UAF
   when freeing primary probe

 - Fix probe BTF member lookup:

   Check the containing inner struct/union kflag when resolving
   anonymous members to ensure correct bitfield offset calculation

   Prevent unnamed bitfields from being pushed to anon_stack in
   btf_find_struct_member(), avoiding false lookup errors

   Fix code block indentation in get_bitoffset_of_field()

 - uprobes error pointer safety

   Guard free_trace_uprobe() with IS_ERR_OR_NULL() to avoid crashing
   during automatic cleanup when an error pointer is returned

* tag 'probes-fixes-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  kprobes: Protect kprobe_blacklist with RCU
  tracing/probes: Fix use-after-free on field name/type of events with multiple probes
  tracing/probes: Fix code indent in get_bitoffset_of_field()
  tracing/probes: Fix BTF kflag check for anonymous struct member access
  tracing/probes: Fix anon_stack check for unnamed bitfields in btf_find_struct_member
  uprobes: guard trace cleanup against error pointers
bpf: Reject untrusted allocated-object pointers 2026-09-04T14:58:36+00:00 Ning Ding dingning04@gmail.com 2026-09-04T08:43:20+00:00 7441ee8276641bddaf1cba7bb75ef9c1458ceb3b When the final RCU read-side critical section ends, a local kptr is demoted to PTR_UNTRUSTED but retains MEM_ALLOC. The pointer may be NULL or may refer to an object whose lifetime is no longer protected. type_is_ptr_alloc_obj() nevertheless recognizes any PTR_TO_BTF_ID with MEM_ALLOC as a live allocated object. In particular, a refcount-only local kptr never carries NON_OWN_REF, so it still passes the bpf_refcount_acquire() argument check after RCU protection ends. The kfunc can then dereference NULL or stale memory. Make type_is_ptr_alloc_obj() reject PTR_UNTRUSTED pointers. Since type_is_non_owning_ref() is based on the same predicate, graph kfunc arguments obey the same live-object requirement. Fault-protected reads of the demoted pointer remain valid: writes are already rejected, and read fixups use bpf_may_fault_on_deref() rather than this predicate. Fixes: 1b12171533a9 ("bpf: Mark direct ld of stashed bpf_{rb,list}_node as non-owning ref") Reported-by: Nicholas Carlini <npc@anthropic.com> Suggested-by: Nicholas Carlini <npc@anthropic.com> Signed-off-by: Ning Ding <dingning04@gmail.com> [ kkd: Rewrote commit log ] Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://lore.kernel.org/r/20260904084325.52250-8-memxor@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org> 
When the final RCU read-side critical section ends, a local kptr is demoted
to PTR_UNTRUSTED but retains MEM_ALLOC. The pointer may be NULL or may refer
to an object whose lifetime is no longer protected.

type_is_ptr_alloc_obj() nevertheless recognizes any PTR_TO_BTF_ID with
MEM_ALLOC as a live allocated object. In particular, a refcount-only local
kptr never carries NON_OWN_REF, so it still passes the
bpf_refcount_acquire() argument check after RCU protection ends. The kfunc
can then dereference NULL or stale memory.

Make type_is_ptr_alloc_obj() reject PTR_UNTRUSTED pointers. Since
type_is_non_owning_ref() is based on the same predicate, graph kfunc
arguments obey the same live-object requirement. Fault-protected reads of
the demoted pointer remain valid: writes are already rejected, and read
fixups use bpf_may_fault_on_deref() rather than this predicate.

Fixes: 1b12171533a9 ("bpf: Mark direct ld of stashed bpf_{rb,list}_node as non-owning ref")
Reported-by: Nicholas Carlini <npc@anthropic.com>
Suggested-by: Nicholas Carlini <npc@anthropic.com>
Signed-off-by: Ning Ding <dingning04@gmail.com>
[ kkd: Rewrote commit log ]
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20260904084325.52250-8-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>