summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-08-14selftests/bpf: Fix selftest build after filter.h updateIhor Solodrai
Upstream commit 7a1f400ff5e5 ("tools: Ensure tools copy of linux/filter.h exports the UAPI") caused selftests/bpf build to fail [1] with: In file included from progs/arena_atomics.c:9: /codebuild/output/src2365462129/src/actions-runner/_work/bpf/bpf/tools/testing/selftests/bpf/../../../include/linux/filter.h:9:10: fatal error: 'uapi/linux/filter.h' file not found 9 | #include <uapi/linux/filter.h> | ^~~~~~~~~~~~~~~~~~~~~ 1 error generated. CLNG-BPF [test_progs] bind_perm.bpf.o make: *** [Makefile:888: /codebuild/output/src2365462129/src/actions-runner/_work/bpf/bpf/tools/testing/selftests/bpf/arena_atomics.bpf.o] Error 1 make: *** Waiting for unfinished jobs.... GEN-OBJ [libarena] libarena.bpf.o GEN-SKEL [libarena] libarena.skel.h make: Leaving directory '/codebuild/output/src2365462129/src/actions-runner/_work/bpf/bpf/tools/testing/selftests/bpf' Process completed with exit code 2. BPF selftest programs include the tools header directly, but BPF_CFLAGS only exposes tools/include/uapi. Compiler therefore cannot resolve the nested UAPI include. Add tools/include after tools/include/uapi in BPF_CFLAGS. This preserves the existing UAPI header precedence while allowing tools headers to include uapi headers. [1] https://github.com/kernel-patches/bpf/actions/runs/31806678733/job/94787271162 Fixes: 7a1f400ff5e5 ("tools: Ensure tools copy of linux/filter.h exports the UAPI") Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Link: https://lore.kernel.org/bpf/20260814173522.2783625-1-ihor.solodrai@linux.dev
2026-08-14rcutorture: Make {,s}rcu_read_delay() better handle forward-progress testingPaul E. McKenney
The rcu_read_delay() and srcu_read_delay() functions are suppose to avoid (or at least to minimize) read-side delays during call_rcu()-based forward-progress testing. Although rcu_read_delay() does account for this by testing rcu_fwd_cb_nodelay, it only does so in some cases, and srcu_read_delay() does not bother at all. And rcutorture testing does occasionally turn up the MIN_FWD_CBS_LAUNDERED failure when running forward-progress tests on Tree SRCU flavors. This commit therefore makes both rcu_read_delay() and srcu_read_delay() take an immediate exit if rcu_fwd_cb_nodelay is set. Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-08-14rcutorture: Announce declining to forward-progress testPaul E. McKenney
Currently, rcu_torture_fwd_prog_cr() announces function entry, but silently exits if rcu_fwd_emergency_stop is set or if there is no ->call() function available. This could cause confusion, leading people to believe that rcu_torture_fwd_prog_cr() is on the job when it is not. This commit therefore also announces the early exits from this function. Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-08-14torture: Don't leak shuffle_tmp_mask when shuffler kthread fails to startJoel Fernandes
If torture_shuffle_init() successfully allocates shuffle_tmp_mask but then fails to create the torture_shuffle kthread, the cpumask is never freed. Free the cpumask directly on the kthread-creation error path. Signed-off-by: Joel Fernandes <joelagnelf@nvidia.com> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-08-14rcutorture: Use this_cpu_inc() for rcu_torture_count[] and rcu_torture_batch[]Paul E. McKenney
Currently __this_cpu_inc() is used to increment elements of both the rcu_torture_count[] and rcu_torture_batch[] arrays. However, this can fail when the increments can happen in interrupt handlers, as recently became possible. This commit therefore upgrades the uses of __this_cpu_inc() to the interrupt-safe this_cpu_inc(). KCSAN located this issue. Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-08-14rcutorture: Make RCU Tasks Trace track Reader BatchesPaul E. McKenney
This commit adds the ->get_sp_seq and ->gp_diff fields to the tasks_tracing_ops structure so that RCU Tasks Trace rcutorture runs will track Reader Batch. Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-08-14rcutorture: Test RCU Tasks Trace GP implying RCU GPPaul E. McKenney
An RCU Tasks Trace grace period is supposed to imply an RCU grace period, and this implication is relied on by BPF. But this is not currently tested. This commit therefore makes tasks_tracing_torture_read_lock() sometimes use rcu_read_lock() instead of rcu_read_lock_trace(), thus testing the required implication. Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-08-14rcutorture: Add a stall_only module parameterPaul E. McKenney
This commit adds a stall_only module parameter that shuts off all rcutorture kthreads other than the RCU CPU stall-warning test kthreads. The purpose of this is to test production applictions' reactions to CPU stalls, and with minimal additional overhead. Or you can omit the stall-warning tests as well and get a heavy no-op, your choice! Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-08-14rcutorture: Add nwriters module parameterPaul E. McKenney
Believe it or not, there are people who would like to run rcutorture without actually torturing RCU. For example, some people would like to induce various types of stall warnings without placing any unnecessary additional overhead on their systems running in production. And rcutorture provides the stall_cpu, stall_cpu_holdoff, stall_no_softlockup, stall_cpu_irqsoff, stall_cpu_block, and stall_cpu_repeat module parameters in order to allow the user to force numerous types of stalls. In addition, rcutorture provides a great number of other module parameters to allow the user to reduce other overhead. But unfortunately, there is no way to turn of the rcu_torture_writer() portion of this torture test, which on my x86 laptop consumes somewhere between 40% and 45% of a CPU. Although this is quite lightweight for a torture test, it is not welcome on systems running production workloads. This commit therefore adds an nwriters module parameter that defaults to 1 but can be set to 0 in order to disable the rcu_torture_writer() portion of the torture test, but that cannot be set to any other value (that is what the fakewriters module parameter is for!). This reduces the overhead to well under 1% of a CPU, which is much more likely to be compatible with production workloads. Reported-by: Breno Leitao <leitao@debian.org> Reported-by: Puranjay Mohan <puranjay@kernel.org> Reported-by: Usama Arif <usama.arif@linux.dev> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-08-14rcutorture: Use task_state_to_char() for task-state reportingKunwu Chan
Use the kernel's standard symbolic task-state representation instead of printing raw hexadecimal task-state values. Suggested-by: Zqiang <qiang.zhang@linux.dev> Co-developed-by: Wang Lian <lianux.mm@gmail.com> Signed-off-by: Wang Lian <lianux.mm@gmail.com> Signed-off-by: Kunwu Chan <kunwu.chan@gmail.com> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-08-14rcutorture: Use cpumask_next_wrap() in rcu_torture_preempt()Paul E. McKenney
The rcu_torture_preempt() function uses cpumask_next(), and if that returns an out-of-bounds result, re-invokes cpumask_next() on -1. Which is exactly what cpumask_next_wrap() does. This commit therefore saves a couple of lines by instead using cpumask_next_wrap(). This was reported by metacode when asked to look for opportunities to use cpumask_next_wrap() in kernel/rcu. Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-08-14rcutorture: Test RCU readers from hardware interrupt handlersPaul E. McKenney
Although rcutorture has long had the irqreader module parameter, this parameter results only in RCU readers in softirq handlers, specifically, timers. This commit therefore uses smp_call_function_single() to test RCU readers in real hardware interrupt handlers, thus providing the full effect from the irqreader module parameter. However, consistency/debug checks must account for the possibility that the smp_call_function_single() handler function is directly invoked from the idle loop, in which case, for example, in_hardirq() will return false. This commit uses a per-CPU variable to record being in the rcu_torture_irq() smp_call_function_single() handler function. Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-08-14Merge tag 'regmap-fix-v7.2-rc7-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap fixes from Mark Brown: "A couple more fixes for regmap, this time for the SoundWire MBQ support: - Several drivers omit the readable_reg callback and it's generally optional in regmap but the MBQ code had an assumption that one was present added in one of the APIs, remove that - The timeout and retry intervals were swapped in read_poll_timeout() for soundwire-mbq" * tag 'regmap-fix-v7.2-rc7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: sdw-mbq: don't call an unset readable_reg callback regmap: sdw-mbq: Fix swap of timeout and retry times
2026-08-14rcutorture: Check for immediate deboosting at reader endPaul E. McKenney
This commit adds a check for failure to have fully deboosted a multi-segmented RCU reader at the end of the full read-side critical section. This check only happens for fully task-level readers, because a a handler might have interrupted an already-boosted task-level RCU reader, and a reader in that handler could then cause false positives. The first failed check (due to an RCU reader that was not immediately deboosted) causes a splat, but only when the disabled-by-default deboost_timeliness_check module parameter is enabled. Regardless of the value of this parameter, it produces a list of the segments making up that RCU reader following a "Slow-deboost rcutorture reader segments" heading. Subsequent failures fail silently, all in the name of keeping console output down to a dull roar. Although most uses of RCU priority boosting serve as debugging aids, this might change, and in fact might already have changed. And allowing (for example) RCU priority boosting to persist until the next scheduler tick could cause an aggressively real-time system to miss sub-millisecond deadlines. So we do need to find this sort of problem during testing, and preferably not in the field. The name and type of the newly added rcu_torture_ops function pointer (named "->is_task_rcu_boosted()") may need to change should other end-of-reader checks be needed. But let's start simple. Oh, and Claude figured out that rcu_is_task_rcu_boosted() could be lockless. Perhaps there is hope for AI yet! ;-) [ paulmck: Apply Akira Yokosawa feedback. ] Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
2026-08-14Merge tag 'mmc-v7.2-rc2-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: - atmel-mci: Fix use-after-free in atmci_remove due to race condition - loongson2: Fix sg iteration in data reorder functions - omap_hsmmc: Fix busy_timeout overflow in ns conversion on 32-bit - sdhci: - Make tuning_err a signed int - Unmap the bounce buffer before device release * tag 'mmc-v7.2-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: loongson2: Fix sg iteration in data reorder functions mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition mmc: sdhci: unmap the bounce buffer before device release mmc: sdhci: make tuning_err a signed int
2026-08-14Merge tag 'pmdomain-v7.2-rc2-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain fixes from Ulf Hansson: - arm: Don't treat performance state 0 as an error - mediatek: - Fix mt8183 hang on boot - Fix potential null pointer dereference - Prevent using uninitialized data - Avoid setting RTFF's CLK_DIS before NRESTORE - qcom: Add missing MXC and MMCX power domains for Eliza * tag 'pmdomain-v7.2-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev() pmdomain: qcom: rpmhpd: Add missing MXC and MMCX power domains for Eliza pmdomain: arm: Fix -EINVAL from scmi_pd_set_perf_state() on state 0 pmdomain: mediatek: Fix mt8183 hang on boot pmdomain: mediatek: fix remaining %pOF after of_node_put() pmdomains: mediatek: Avoid setting RTFF's CLK_DIS before NRESTORE
2026-08-14sched_ext: Fix scx_bpf_dsq_reenq___compat kfunc extern prototypeTejun Heo
scx_bpf_dsq_reenq() is registered with KF_IMPLICIT_ARGS and its kernel BTF prototype omits the trailing bpf_prog_aux argument. The ___compat extern declares the argument explicitly, so libbpf never matches the prototype and the weak extern silently stays unresolved on every kernel. The wrapper always takes the old fallback path, which disables generic reenq users like scx_qmap's lowpri mechanism and fails non-local reenq with "kernel too old" even on kernels that have the kfunc. Drop the explicit aux argument. Also correct the stale v6.20 reference, the kfunc was added in v7.1. Fixes: 9c34c5074d1b ("sched_ext: Introduce scx_bpf_dsq_reenq() for remote local DSQ reenqueue") Cc: stable@vger.kernel.org # v7.1+ Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-14net: dsa: drop explicit NULL comparisonsKai Kuang
Replace explicit NULL comparisons with the boolean form to follow the kernel coding style: dev->class != NULL -> dev->class user_dev == NULL -> !user_dev No functional changes intended. Signed-off-by: Kai Kuang <kuangkai@kylinos.cn> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Reviewed-by: Joe Damato <joe@dama.to> Link: https://patch.msgid.link/20260812060644.210997-1-kuangkai@kylinos.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-14dtc: dt-check-style: Simplify setting depth of DtsLineKrzysztof Kozlowski
When creating new DtsLine object, pass expected indentation depth as constructor, instead of assigning it immediately after, so the code will be easier to read and explicit (depth is not supposed to change during DtsLine lifetime). Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20260803-n-dts-style-checker-continued-v3-2-6c9776928cea@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2026-08-14dtc: dt-check-style: Add missing /dts-v1/ to few test casesKrzysztof Kozlowski
The selftest DTS should still look like a real DTS, so it needs '/dts-v1/' marking. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20260803-n-dts-style-checker-continued-v3-1-6c9776928cea@oss.qualcomm.com Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2026-08-14dt-bindings: power: reset: ti,keystone-reset: Convert to DT schemaBhargav Joshi
Convert Texas Instruments Keystone SoC Reset Controller from text to DT schema. no new functional changes. Signed-off-by: Bhargav Joshi <j.bhargav.u@gmail.com> Link: https://patch.msgid.link/20260813-ti-keystone-reset-v1-1-189389503324@gmail.com Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2026-08-14media: dt-bindings: ti,da850-vpif: Convert to dt-schemaBhargav Joshi
Convert the Texas Instruments DA850/AM18x Video Port Interface (VPIF) device tree binding from text format to YAML dt-schema. Add power-domains property missing from text. Signed-off-by: Bhargav Joshi <j.bhargav.u@gmail.com> Link: https://patch.msgid.link/20260813-ti-da850-vpif-v2-1-80ba62ca53d0@gmail.com Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2026-08-14dt-bindings: devfreq: samsung,exynos-ppmu: Use standard regex syntaxRob Herring (Arm)
The "{,N}" regex syntax is non-standard, but happens to be supported by python re module. It is equivalent to "{0,N}" which is more commonly supported. This fixes using a rust implementation of the DT schema tools. Link: https://patch.msgid.link/20260813174037.2263884-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2026-08-14dt-bindings: interrupt-controller: mediatek,mt6577-sysirq: Drop invalid JSON ↵Rob Herring (Arm)
pointer The $ref "arm,gic.yaml#/properties/#interrupt-cells" doesn't work when used with another json-schema implementation (rust). The issue is it not a valid URI due to the 2nd "#" character in the JSON pointer. Though a "#" is supposed to be valid within a JSON pointer. A possible solution is to encode the "#" as "%23" instead, but the dtschema tools don't handle that. Just avoid all these issues as the $ref only resolves to a "const: 3" schema and specify it directly. Link: https://patch.msgid.link/20260813145453.1919998-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2026-08-14selftests/bpf: Improve readability in iter test for percpu dataLeon Hwang
The original 'offsetof()' + offset is equal to the new 'offsetof()'. Use the new 'offsetof()' instead. Rename two variables btw: * offsetof_num -> num_off * percpu_data_sum -> sum Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Link: https://lore.kernel.org/bpf/20260814173206.93082-6-leon.hwang@linux.dev
2026-08-14libbpf: Avoid unnecessary mmap resize for percpu data mapsLeon Hwang
Use array_map_mmap_sz() for PERCPU_ARRAY like ARRAY in bpf_map_mmap_sz(). This lets bpf_map__set_value_size() skip mmap(), memcpy(), and munmap() when the old and new value sizes occupy the same number of pages. Fix some typos btw: * mmapble -> mmapable * satisified -> satisfied * relocatin -> relocation * atach_btf_obj_fd -> attach_btf_obj_fd * len_secnd -> len_second * precendence -> precedence Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Link: https://lore.kernel.org/bpf/20260814173206.93082-3-leon.hwang@linux.dev
2026-08-14dt-bindings: pinctrl: Convert TI DA850 pupd to DT schemaEduard Bostina
Convert the Texas Instruments DA850/OMAP-L138/AM18x pullup/down controller bindings to DT schema. Signed-off-by: Eduard Bostina <egbostina@gmail.com> Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-08-14ACPI: APD: Add clock frequency for HJMC01 I2C controllerXiangyang Yu
I2C clock frequency for HJMC01 is 200MHz, define a new ACPI HID for it. Signed-off-by: Xiangyang Yu <hunter.yu@hj-micro.com> Signed-off-by: Hongnan Li <clarke.li@hj-micro.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/20260813064025.45242-1-clarke.li@hj-micro.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-08-14ACPI: APD: Convert fixed clock rates to use HZ_PER_MHZHongnan Li
Use HZ_PER_MHZ multiplier for fixed_clk_rate values to improve readability. Signed-off-by: Hongnan Li <clarke.li@hj-micro.com> Suggested-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/20260813063005.42925-1-clarke.li@hj-micro.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-08-14gre: fix ERSPAN o_flags race/corruption in xmit and fill_infoEric Dumazet
For IPv4 ERSPAN: In erspan_xmit(), the driver clears IP_TUNNEL_SEQ_BIT (for version 0) and IP_TUNNEL_KEY_BIT directly in the shared tunnel->parms.o_flags structure. Since transmit paths can run locklessly and concurrently, this leads to a data race. Furthermore, modifying tunnel->parms.o_flags permanently alters the tunnel configuration. To work around this, erspan_fill_info() (which reports config to userspace) was setting IP_TUNNEL_KEY_BIT back. If erspan_fill_info (running under RTNL) and erspan_xmit (running locklessly) race, erspan_xmit might see IP_TUNNEL_KEY_BIT set when it shouldn't, leading to GRE header corruption (injecting a key field into the ERSPAN GRE header). Fix this by: 1) Passing flags as an argument to __gre_xmit(). 2) Using local stack flags in ipgre_xmit(), gre_tap_xmit(), and erspan_xmit() to prevent TOCTOU data races with concurrent configuration updates, and passing them to __gre_xmit(). 3) Removing the racy modification of t->parms.o_flags in erspan_fill_info(). 4) Forcing IP_TUNNEL_KEY_BIT in the reported flags for ERSPAN locally in ipgre_fill_info(). For IPv6 ERSPAN: ip6erspan_tunnel_xmit() was locklessly clearing IP_TUNNEL_KEY_BIT in t->parms.o_flags even though it does not use these flags for building the GRE header (it uses local flags). This permanently corrupts the configuration and races with ip6gre_fill_info() which reads it. Remove the redundant and racy modification. This should remove false sharing in a fast path. Add const qualifiers in ipgre_fill_info(), erspan_fill_info() and ip6gre_fill_info() to clarify that these methods are not supposed to write any live parameters. Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260812142257.21283-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-14sched_ext/scx_flatcg: expire cached hweights on weight changesTao Cui
fcg_cgroup_set_weight() updates cgc->weight and the parent's child_weight_sum but doesn't bump hweight_gen, so the hweights cached by cgrp_refresh_hweight() stay stale until some task activation bumps the generation. For cgroups whose tasks never go through a 0->n runnable transition (e.g. persistently busy ones), a cpu.weight change never propagates to scheduling at all. Bump hweight_gen on weight changes so the next refresh recomputes with the new weight. Verified on a flatcg VM: a live cpu.weight 100->800 change on a busy cgroup leaves HWT update at 0 and the distribution unchanged; with it, hweight_gen increments and the refresh recomputes. Signed-off-by: Tao Cui <cuitao@kylinos.cn> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-14ACPI: scan: Use acpi_bus_get_primary_device()Rafael J. Wysocki
The acpi_get_first_physical_node() usage in acpi_create_video_bus_device() is generally unsafe because in theory the device returned by it may be freed at any time. Address this issues by using acpi_bus_get_primary_device() instead of acpi_get_first_physical_node() and dropping the device reference acquired by it after registering the child. Fixes: 6ab3532b4c98 ("ACPI: video: Switch over to auxiliary bus type") Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/10906414.nUPlyArG6x@rafael.j.wysocki
2026-08-14ACPI: platform: Use acpi_bus_get_primary_device()Rafael J. Wysocki
The acpi_get_first_physical_node() usage in acpi_platform_fill_resource() and acpi_create_platform_device() is generally unsafe because in theory the device returned by it may be freed at any time [1]. It is also inefficient because acpi_get_first_physical_node() is called multiple times for the same argument which can be avoided. Address these issues by using acpi_bus_get_primary_device() instead of acpi_get_first_physical_node() and adjusting the code to call it just once at the beginning of and acpi_create_platform_device() and drop the device reference acquired by it upon the return from that function. Fixes: 3b95bd160547 ("ACPI: introduce a function to find the first physical device") Fixes: a252d881c558 ("ACPI / platform: Pay attention to parent device's resources") Link: https://sashiko.dev/#/patchset/12955541.O9o76ZdvQC%40rafael.j.wysocki [1] Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/3436112.aeNJFYEL58@rafael.j.wysocki
2026-08-14ACPI: bus: Introduce acpi_bus_get_primary_device()Rafael J. Wysocki
The function used for obtaining the first "physical" device for which the given ACPI one is the ACPI companion, acpi_get_first_physical_node(), may return a stale device pointer (mostly in theory) because acpi_unbind_one() may run as a whole after dropping the ACPI device's physical_node_lock in acpi_get_first_physical_node() and before it returns. The last reference to the "physical" device may be dropped then before the pointer to it is returned to the caller. If that happens and the acpi_get_first_physical_node() caller invokes get_device() on the pointer obtained from it, which is done by the majority of its callers, a use-after-free will occur. To prepare for addressing this problem, introduce a new function for getting the first "physical" device associated with the given ACPI one (the "primary physical device") that will also reference count the device in question before returning a pointer to it. Make that new function and acpi_get_first_physical_node() share the physical node list lookup code. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/2843318.mvXUDI8C0e@rafael.j.wysocki
2026-08-14Merge back ACPI bus type changes for 7.3Rafael J. Wysocki
2026-08-14ACPI: scan: fix bus ID cleanup on device_add() failuresHongyan Xu
When device_add() fails after acpi_device_set_name() has allocated an instance ID and a new acpi_device_bus_id has been linked into acpi_bus_id_list, the rollback path only removes wakeup_list and detaches the ACPI handle data. That leaves the bus-ID bookkeeping behind and keeps the allocated instance number consumed. Move the bus-ID cleanup and wakeup-list removal into a single helper. Use it from both the normal device teardown path and the device_add() rollback path. The wakeup list node is initialized before registration, so it can be deleted without checking whether the device is wakeup- capable like in the original teardown path. Fixes: d783156ea384 ("ACPI / scan: Define non-empty device removal handler") Signed-off-by: Hongyan Xu <getshell@seu.edu.cn> [ rjw: Rename acpi_device_del_list() to acpi_device_cleanup() ] [ rjw: Subject and changelog edits ] Link: https://patch.msgid.link/20260808085943.526-1-getshell@seu.edu.cn Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-08-14modpost: add module as parameter to modpost_log()Jani Nikula
modpost has a lot of error logging with module name, but the module name is logged in a plethora of ways. Add struct module * parameter to modpost_log(), and wrappers mod_warn() and mod_error(), to allow logging with a unified module name, if provided. If the module is provided, the messages will be of the format: (ERROR|WARNING): modpost: (modname.ko|vmlinux): message Actual conversion is done separately. Signed-off-by: Jani Nikula <jani.nikula@intel.com> Link: https://patch.msgid.link/f27bd8810f0ef12fb86068f0190e4e0afa81e0fa.1786120005.git.jani.nikula@intel.com Reviewed-by: Nathan Chancellor <nathan@kernel.org> Reviewed-by: Nicolas Schier <nsc@kernel.org> Signed-off-by: Nicolas Schier <nsc@kernel.org>
2026-08-14kconfig: fix submenu rendering of negative dependenciesJulian Braha
The Kconfig frontend should render options that depend on a previous option in the submenu of that previous option. But currently, this breaks for negative dependencies. For example, option FOO may be rendered in the submenu of option BAR, despite FOO actually depending on !BAR. Let's fix this ironic rendering by modifying Kconfig to explicitly check negative dependencies. I've only tested locally on x86, but as far as I can tell, this only changes how 2 options are rendered in the menu: 1. NTFS3_FS, no longer in the NTFS_FS submenu, and 2. MTD_BLOCK_RO, no longer in the MTD_BLOCK submenu. Tested-by: Nathan Chancellor <nathan@kernel.org> Reported-by: Xi Ruoyao <xry111@xry111.site> Closes: https://lore.kernel.org/all/cbe95c15d2760f6fce8eaf207c969ce8fd3703aa.camel@xry111.site/ Assisted-by: Claude:claude-4.8-opus Signed-off-by: Julian Braha <julianbraha@gmail.com> Link: https://patch.msgid.link/20260801145238.2140291-1-julianbraha@gmail.com Reviewed-by: Nicolas Schier <nsc@kernel.org> Tested-by: Nicolas Schier <nsc@kernel.org> Signed-off-by: Nicolas Schier <nsc@kernel.org>
2026-08-14net/mlx5: SD, prefer sd_group_size from vport contextShay Drory
Newer FW reports the SD group size directly in the NIC vport context via the sd_group_size field, gated by the sd_group_size capability. Switch sd_init() to source the group size from there and fall back to the MPIR-based host_buses query only when the cap is absent. sd_group_size might return 1 in some FW configuration. Add explicit check to disable SD creation in this case. While here, rename host_buses to group_size throughout sd.c to follow the new name on capable FW. Signed-off-by: Shay Drory <shayd@nvidia.com> Reviewed-by: Moshe Shemesh <moshe@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260810093037.3138197-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-14Merge tag 'nf-next-26-08-10' of ↵Jakub Kicinski
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next Pablo Neira Ayuso says: ==================== Netfilter updates for net This includes an enhancement to detect ct memleaks easier via DEBUG_NET and flowtable preparation patches for IPv4 over IPV6 and vice-versa. This also includes a fix for the nft_ct custom expectation support. 1) Add DEBUG_NET_WARN_ON_ONCE to nf_ct_set() to spot ct memleaks. 2) Pass struct net_device_path_ctx to dev_fill_forward_path() to make it easier to pass more parameters to this function. From Lorenzo Bianconi. 3) Add ether_type field to net_device_path context structucture. 4) Rename tun.l3_proto field to tun.inner_proto. 5) Rename ctx.tun.proto to ctx.tun.inner_proto. 6) Store ether_type in flowtable context. 7) Move IPv4 and IPv6 xmit path to a helper function. 8) Move encapsulation header parser out of the flowtable lookup function. 9) Rework nft_ct custom expectation support to address a possible reallocation of ct extension area while expectation list also contains expectations. Move datapath to a ct helper to fix it. 10) Ensure timeout is always lowered for the non-closing RST case in the TCP connection tracking. 11) Bail out when inserting already dead expectation, this should not ever happen, hence report it via DEBUG_NET. 12) Comestic updates for improving the conntrack selftest dump and flush userspace program, from Qingshuang Fu. * tag 'nf-next-26-08-10' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: selftests: netfilter: conntrack_dump_flush: remove unused variables and fix typo netfilter: nf_conntrack_expect: bail out on insert dead expectations netfilter: conntrack: always lower timeout for non-closing RST packets netfilter: nft_ct: move custom expectation support to helper netfilter: flowtable: detach layer 2 encapsulation parser from lookup netfilter: flowtable: move ipv4 and ipv6 xmit path to function netfilter: flowtable: store ethertype in flowtable context netfilter: flowtable: rename ctx.tun.proto to ctx.tun.inner_proto netfilter: flowtable: rename tun.l3_proto to tun.inner_proto net: netfilter: add ether_type to net_device_path_ctx and use it net: pass net_device_path_ctx to dev_fill_forward_path() netfilter: add DEBUG_NET_WARN_ON_ONCE to skb_set_nfct() ==================== Link: https://patch.msgid.link/20260810194015.932627-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-14sched_ext: Fix exit_task leak on fork failure during enablefangqiurong
scx_fork() initializes tasks when scx_init_task_enabled is set, but scx_cancel_fork() only exits them when scx_enabled() is true. A fork that fails in the enable window (between releasing scx_fork_rwsem and setting __scx_enabled) runs ops.init_task() but never ops.exit_task(). Gate scx_cancel_fork() on scx_init_task_enabled. Fixes: 4269c603cc26 ("sched_ext: Enable scx_ops_init_task() separately") Cc: stable@vger.kernel.org # v6.12+ Signed-off-by: fangqiurong <fangqiurong@kylinos.cn> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-14ACPI: battery: Protect all properties with a separated mutexRong Zhang
The acpi_battery_get_property() callback calls acpi_battery_get_state() without any lock held. On some devices, it happens that the property cache has expired before a uevent reaches userspace, triggering simultaneous attempts to evaluate _BST. See [1] for an analysis to sysrq stacktraces on one of the these devices. In a few cases, including when the AML is sleeping or acquiring a mutex, ACPICA drops the namespace and interpreter locks and allows the evaluation of _BST to start while another task is still evaluating it. This could somehow confuse the interpreter and lead to chaos in AML mutexes on some devices, see [2] for an example. Not holding the lock is also prone to race conditions, for example: CPU0 | CPU1 acpi_battery_get_property() | acpi_battery_get_state() | [update_time expired] | extract_package() | acpi_battery_get_property() battery->update_time = jiffies | acpi_battery_get_state() kfree() | [up to date] | [read capacity_now] [fix capacity_now due to quirk] | where CPU1 gets raw capacity_now before CPU0 fixes it to a meaningful value. The existing mutex update_lock is not applicapable for acpi_battery_get_property(), as some code path could call or wait for acpi_battery_get_property() while holding update_lock. Therefore, introduce a mutex called property_lock to protect all accesses to battery properties, so that acpi_battery_get_property() can take the advantage of the mutex and synchronize itself. With the mutex, acpi_battery_get_state() are synchronized in all code paths calling it, and its cache mechanism can always clamp the frequency of _BST evaluations according to cache_time. The helper function acpi_battery_handle_discharging() for quirky devices has to be inlined due to the change, as the mutex must be unlocked before calling the expensive power_supply_is_system_supplied() helper function. Fixes: 86bfd21a0baf ("ACPI: battery: Drop redundant locking") Reported-by: Rick <rickk1166@gmail.com> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221065#c85 [1] Reported-by: Avraham Hollander <anhollander516@gmail.com> Tested-by: Avraham Hollander <anhollander516@gmail.com> Closes: https://lore.kernel.org/linux-acpi/CAP1mzZReJCn6df5DwEPu-JCQUyr=Pu1cg5xKCMttWZkHCQtVmQ@mail.gmail.com [2] Signed-off-by: Rong Zhang <i@rong.moe> Cc: All applicable <stable@vger.kernel.org> Link: https://patch.msgid.link/20260809-b4-acpi-battery-notification-v5-1-788d54fa2e35@rong.moe Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-08-14sched_ext: fix stale references in doc commentsTao Cui
- inlines.h: scx_bpf_dispatch() doesn't exist; the comment means scx_bpf_sub_dispatch() - internal.h: name %SCX_DEQ_SCHED_CHANGE instead of the never-defined %SCX_DEQ_SAVE - internal.h: @name shows up in the ops file in the scheduler's sysfs directory, not a "kernel.sched_ext_ops" sysctl Signed-off-by: Tao Cui <cuitao@kylinos.cn> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-14Documentation: sched_ext: fix events sysfs path and show_state exampleTao Cui
The events file is under the scheduler's sysfs kobject (/sys/kernel/sched_ext/root/events for the root scheduler), not the nonexistent "<scheduler-name>/events" path. Also add the missing "aborting" line to the scx_show_state.py example. Signed-off-by: Tao Cui <cuitao@kylinos.cn> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-14accel/qaic: Address potential out-of-bounds read in resp_worker()Youssef Samir
Although 'commit 2feec5ae5df7 ("accel/qaic: Handle DBC deactivation if the owner went away")' fixes the scenario it was intended for by walking the message and only decoding QAIC_TRANS_DEACTIVATE_FROM_DEV, if present, it skipped over the bounds checking code that is included in decode_message(). This could lead to issues such as reading past the slab allocation's end, infinite loops or kernel panics. For those issues to happen, a malformed wire message is needed to be sent from the device. Instead of duplicating the bounds checking code already present in decode_message(), use the function inside resp_worker(). Reported-by: Ruikai Peng <ruikai@pwno.io> Fixes: 2feec5ae5df7 ("accel/qaic: Handle DBC deactivation if the owner went away") Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com> Reviewed-by: Lizhi Hou <lizhi.hou@amd.com> Signed-off-by: Youssef Samir <youssef.abdulrahman@oss.qualcomm.com> Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com> Link: https://patch.msgid.link/20260731152344.1905882-1-youssef.abdulrahman@oss.qualcomm.com
2026-08-14Doc: admin-guide: pm: Remove unnecessary backticks and fix a spellBhaskar Chowdhury
One, Removed the superfluous backticks in the sentence. And second, s/peferred/preferred/ Signed-off-by: Bhaskar Chowdhury <unixbhaskar@gmail.com> Acked-by: Randy Dunlap <rdunlap@infradead.org> Acked-by: Mario Limonciello (AMD) <superm1@kernel.org> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20260814095716.2905589-1-unixbhaskar@gmail.com>
2026-08-14selftests/cgroup: Remove redundant chown in test_cgcore_lesser_ns_openShaojie Sun
test_cgcore_lesser_ns_open runs as root throughout and never changes its euid, so chowning the two cgroup.procs files to a non-root uid has no effect on the test. The ENOENT the test expects comes from the cgroup namespace delegation check in cgroup_procs_write_permission(): the source and destination cgroups must both be descendants of the namespace root captured at open time. That check does not depend on file ownership. In addition, the permission check only examines the common ancestor's cgroup.procs file (the test root here), which the chown calls do not touch. Remove the redundant chown calls and the now unused test_euid and cg_test_a_procs variables. Signed-off-by: Shaojie Sun <sunshaojie@kylinos.cn> Reviewed-by: Tao Cui <cuitao@kylinos.cn> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-08-14hwmon: (asus_rog_ryujin) Add ROG Ryujin III White EditionWill Smith
The ROG Ryujin III White Edition uses the same report layout as the other supported Ryujin III variants. Add its USB device ID and list it in the driver documentation. The device was tested with the driver on the author's hardware. Link: https://github.com/aleksamagicka/asus_rog_ryujin-hwmon/pull/10 Signed-off-by: Will Smith <github@notthatwillsmith.com> Assisted-by: Codex:gpt-5.6-sol sparse Signed-off-by: Arie Miller <renari@arimil.com> Reviewed-by: Aleksa Savic <savicaleksa83@gmail.com> Link: https://lore.kernel.org/r/20260812103532.395049-4-renari@arimil.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-08-14hwmon: (asus_rog_ryujin) Add ROG Ryujin III supportArie Miller
The ROG Ryujin III uses different report offsets and a different cooler-duty channel from the Ryujin II. It also lacks the separate external fan controller supplied with the older model. Add model data and USB IDs for the Extreme and EVA Edition variants. Skip controller commands and hide the unavailable controller hwmon channels for these devices. Update the driver documentation, Kconfig text, and module description accordingly. Link: https://github.com/aleksamagicka/asus_rog_ryujin-hwmon/pull/9 Assisted-by: Codex:gpt-5.6-sol sparse Signed-off-by: Arie Miller <renari@arimil.com> Reviewed-by: Aleksa Savic <savicaleksa83@gmail.com> Link: https://lore.kernel.org/r/20260812103532.395049-3-renari@arimil.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-08-14hwmon: (asus_rog_ryujin) Add per-device configurationArie Miller
Move model-specific report offsets and capabilities into a device information structure. This prepares the driver for coolers which use a different report layout or do not include the external fan controller, while preserving the existing Ryujin II 360 behavior. Handles an issue reported by Sashiko where an id could be missing driver_data. Link: https://lore.kernel.org/r/5a817284-a9f4-48b2-9f0f-802c5dc6963c@roeck-us.net Assisted-by: Codex:gpt-5.6-sol sparse Signed-off-by: Arie Miller <renari@arimil.com> Reviewed-by: Aleksa Savic <savicaleksa83@gmail.com> Link: https://lore.kernel.org/r/20260812103532.395049-2-renari@arimil.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>