summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-08-13netlink: specs: rt-route: split out the request attribute listYuyang Huang
The newroute and delroute requests alias the same attribute list as the getroute reply, but requests and replies do not carry the same attributes. Give the requests their own list. The two lists are identical today, so the generated code does not change. Signed-off-by: Yuyang Huang <sigefriedhyy@gmail.com> Link: https://patch.msgid.link/20260808005642.26901-9-sigefriedhyy@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-13netlink: specs: rt-route: add route notificationsYuyang Huang
Declare the RTM_NEWROUTE and RTM_DELROUTE notifications and the route multicast groups, so that generated clients can subscribe to route changes. Both notifications reuse the getroute reply attributes. Signed-off-by: Yuyang Huang <sigefriedhyy@gmail.com> Link: https://patch.msgid.link/20260808005642.26901-8-sigefriedhyy@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-13ipv6: add inet6_rt_del_notify()Yuyang Huang
Move the body of inet6_rt_notify() to __inet6_rt_notify() and give it the deletion reason. inet6_rt_notify() keeps its prototype, so the route addition path does not change. Add inet6_rt_del_notify() and call it from fib6_del_route(). RTA_DEL_REASON now reaches user space on RTM_DELROUTE for routes the kernel deleted on its own. Signed-off-by: Yuyang Huang <sigefriedhyy@gmail.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260808005642.26901-7-sigefriedhyy@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-13ipv6: expose the route deletion reason in RTM_DELROUTEYuyang Huang
Emit RTA_DEL_REASON from rt6_fill_node() when the deletion reason is not RT_DEL_REASON_UNSPEC, and reserve room for it in rt6_nlmsg_size(). Every caller still passes RT_DEL_REASON_UNSPEC. Signed-off-by: Yuyang Huang <sigefriedhyy@gmail.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260808005642.26901-6-sigefriedhyy@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-13ipv6: add a deletion reason argument to rt6_fill_node()Yuyang Huang
Add the deletion reason to rt6_fill_node() so that it can report it to user space. All callers pass RT_DEL_REASON_UNSPEC for now. Signed-off-by: Yuyang Huang <sigefriedhyy@gmail.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260808005642.26901-5-sigefriedhyy@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-13ipv6: record the reason for kernel-initiated route deletionsYuyang Huang
Record why the kernel deletes an IPv6 route on its own: - RT_DEL_REASON_EXPIRED for routes reaped by the FIB6 garbage collector after their RTF_EXPIRES lifetime ran out. - RT_DEL_REASON_RA_WITHDRAWN for default routes, prefix routes and RFC 4191 route information routes withdrawn by a zero-lifetime Router Advertisement. Deleting a default route because its metric changed is not a withdrawal, so it keeps RT_DEL_REASON_UNSPEC. Signed-off-by: Yuyang Huang <sigefriedhyy@gmail.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260808005642.26901-4-sigefriedhyy@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-13ipv6: propagate the route deletion reason to fib6_del_route()Yuyang Huang
Pass the deletion reason from ip6_del_rt_reason() down through __ip6_del_rt(), fib6_del() and into fib6_del_route(). All existing callers pass RT_DEL_REASON_UNSPEC. fib6_del_route() ignores the reason until the notification path learns to report it. Signed-off-by: Yuyang Huang <sigefriedhyy@gmail.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260808005642.26901-3-sigefriedhyy@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-13ipv6: add ip6_del_rt_reason()Yuyang Huang
Add RTA_DEL_REASON and enum rt_del_reason to the rtnetlink uAPI, and add ip6_del_rt_reason(), which takes the reason a route is being deleted. It has no skip_notify argument: a caller that records a deletion reason wants the notification that carries it. The reason is unused for now. Subsequent patches propagate it to the deletion path and report it on RTM_DELROUTE. Signed-off-by: Yuyang Huang <sigefriedhyy@gmail.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260808005642.26901-2-sigefriedhyy@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-13selftests/namespaces: Fix racy pipe handshake in timens and pidns_separateRicardo B. Marlière (SUSE)
In timens_separate and pidns_separate both the child and the grandchild write a 'Y' readiness byte to the same pipe, but the parent expects a single 'Y' followed by the grandchild's pid. If the grandchild's byte arrives first, the parent takes it for the child's and reads the pid misaligned, ending up with a garbage value. The parent stores that pid in self->grandchild_pid so that FIXTURE_TEARDOWN() can kill the grandchild. A garbage pid leaves the real grandchild alive in pause(), holding the test runner's TAP pipe open and hanging the whole collection. The grandchild has nothing to report, so drop its write() and leave the child as the sole writer. Fixes: fdb48976b637 ("selftests/namespaces: Kill grandchild in nsid fixture teardown") Signed-off-by: Ricardo B. Marlière (SUSE) <ricardo@marliere.net> Link: https://patch.msgid.link/20260810-selftests-namespaces_race-v1-1-4307e833783e@marliere.net Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-13selftests/epoll: add a regression test for pipe->poll_usageOleg Nesterov
pipe->poll_usage was added to ensure that edge-triggered epoll consumers get a wakeup on every write, even if the pipe was already non-empty. However, none of the existing epoll_wakeup_test cases cover this; the test suite passes even with WRITE_ONCE(pipe->poll_usage, true) removed. Add a test that writes twice to a pipe and verifies that epoll_wait with EPOLLET reports data each time. This covers the pipe-specific per-write wakeup behavior that edge-triggered consumers depend on. Signed-off-by: Oleg Nesterov <oleg@redhat.com> Link: https://patch.msgid.link/amnlGZesXu-SUK2H@redhat.com Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-08-13rust: kernel: add `LocalModule` fallback for `#[vtable]` `impl`sDanilo Krummrich
Like commit 98f256e27262 ("rust: doctest: add LocalModule fallback for #[vtable] ThisModule"), add another `LocalModule` struct with a null-pointer `ModuleMetadata` `impl` for the `kernel` crate, so that `crate::LocalModule` (auto-inserted by `#[vtable]`) resolves correctly when there is no `module!` macro. This will be needed by DRM to use `#[vtable]` `impl` blocks in KUnit tests within the `kernel` crate [1]. Signed-off-by: Danilo Krummrich <dakr@kernel.org> Link: https://lore.kernel.org/rust-for-linux/DKNAS52KYWLD.M15VEC6U0F6R@kernel.org/ [1] [ Created commit out of the diff in the link above. Fixed the `clippy::undocumented_unsafe_blocks` lint by wrapping with a block like in the other commit too. Added `#[allow(dead_code)]` until we actually (and unconditionally, i.e. KUnit tests may be not enabled) use it. - Miguel ] Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-08-13l2tp: fix tunnel and session refcount leak on seq_file releaseEric Dumazet
In pppol2tp_proc_open() and l2tp_dfs_seq_open(), iteration state (pd->tunnel and pd->session) is kept in seq_file private data to allow iteration across multiple read() system calls. However, if userspace closes /proc/net/pppol2tp or /sys/kernel/debug/l2tp/tunnels before reading to end-of-file (EOF), any tunnel or session reference stored in pd->tunnel / pd->session is left un-dropped when seq_file private data is freed. Fix this by dropping any remaining pd->tunnel and pd->session references in pppol2tp_proc_release() and l2tp_dfs_seq_release() when closing the file. Fixes: 0e0c3fee3a59 ("l2tp: hold reference on tunnels printed in pppol2tp proc file") Fixes: f726214d9b23 ("l2tp: hold reference on tunnels printed in l2tp/tunnels debugfs file") Reported-by: syzbot+d6fa74e3f19d6ee01e3a@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6a760f32.01d0871a.3a0d52.004f.GAE@google.com/T/#u Assisted-by: Jetski:Gemini-3.1-Pro Cc: James Chapman <jchapman@katalix.com> Cc: Guillaume Nault <gnault@redhat.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260811144651.2733424-1-edumazet@google.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-13net/sched: cls_bpf: reject dev-bound programs bound to a different deviceJamal Hadi Salim
cls_bpf_prog_from_efd() obtained a SCHED_CLS program via bpf_prog_get_type_dev() but never verified that a device-bound (offloaded) program's bound netdev matches the TC netdev the classifier is being attached to. This let a program loaded with prog_ifindex for device A be attached via cls_bpf + skip_sw to device B; deleting device A then destroyed the program's offload state while it was still attached to device B, triggering a netdevsim WARN (panic with panic_on_warn=1). Mirror the XDP attach path (net/core/dev.c) and reject the attach with -EINVAL when a dev-bound program's bound device does not match the target device. Fixes: 2b3486bc2d23 ("bpf: Introduce device-bound XDP programs") Reported-by: vega@nebusec.ai Tested-by: Victor Nogueira <victor@mojatatu.com> Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://patch.msgid.link/20260809094418.901607-1-jhs@mojatatu.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-13ALSA: hda/realtek: Add mute LED quirk for HP 250 G8 (0x85f3)Bramwel Barack
The HP 250 G8 Laptop PC (subsystem 103c:85f3) using the Realtek ALC236 codec requires a specific quirk to enable the mute button LED. Currently, the audio mutes in software, but the physical indicator light remains unlit. Adding a quirk entry to the alc236_fixup_tbl with the ALC236_FIXUP_HP_MUTE_LED_COEFBIT2 fixup correctly maps the LED to the mute state via COEF index 0x07. Signed-off-by: Bramwel Barack <bramwelbarack89@gmail.com> Link: https://patch.msgid.link/20260812192832.69240-1-bramwelbarack89@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-13RISC-V: KVM: fix vcpu vector context handling for kernel-mode vectorAndy Chiu
Running vector workloads like perf + mcf on KVM can result in an unexpected termination due to a vtype corruption. This happens because the kernel-mode vector (KMV) misattributes the guest's vcpu context as the user's context and source from a wrong status.VS. The simplified call chain that results in this problem is shown as follow: __riscv_sys_ioctl() kvm_arch_vcpu_ioctl_run() kvm_riscv_vcpu_exit() kvm_riscv_vcpu_sbi_ecall() kvm_riscv_vcpu_pmu_ctr_stop() kvm_vcpu_write_guest() __copy_to_user() enter_vector_usercopy() kernel_vector_begin() kernel_vector_begin() should use the sstatus.VS from guest's vcpu context instead of task_pt_reg(current). Also, it should not save guest's v-reg into the user's context memory. To resolve this, the vcpu context must be correctly saved when KMV is serving a guest. However, invoking KVM functions directly from generic RISC-V architecture code introduces a reverse dependency, breaking builds when KVM is configured as N or M. Address this by registering an RCU-protected callback for context flushing. KVM registers this callback at module initialization and unregisters it on exit. When KMV starts a kernel context, it can now safely flush the vector context via the callback. Fixes: ecd2ada8a5e0 ("riscv: Add support for kernel mode vector") Signed-off-by: Andy Chiu <tchiu@tenstorrent.com> Reviewed-by: Yong-Xuan Wang <yongxuan.wang@sifive.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260803215250.824417-4-tchiu@tenstorrent.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-08-13riscv: vector: allow non-preemptible kernel-mode vector with IRQs offAndy Chiu
Similar to commit 7137a203b251 ("arm64/fpsimd: Permit kernel mode NEON with IRQs off"), we are upgrading get/put_cpu_vector_context such that kvm_arch_vcpu_load/put can be safely called under both irq off and regular process context. Also, export both symbols so the kvm module can call into it. Signed-off-by: Andy Chiu <tchiu@tenstorrent.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260803215250.824417-3-tchiu@tenstorrent.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-08-13riscv: vector: refactor riscv_v_start_kernel_contextAndy Chiu
Refactor riscv_v_start_kernel_context() to drop `is_nested` variable and simplify the logic. This introduces no functional change and works as a preparatory patch for the kernel-mode vector fix. Signed-off-by: Andy Chiu <tchiu@tenstorrent.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260803215250.824417-2-tchiu@tenstorrent.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-08-13ALSA: hda/ext: preserve PPLCCTL bits when clearing resetXu Rao
snd_hdac_ext_stream_reset() polls PPLCCTL for STRST by masking the register value with AZX_PPLCCTL_STRST: val = readl(...) & AZX_PPLCCTL_STRST; The same masked value is then used when clearing STRST. Since val contains no bits other than STRST, clearing STRST from it always produces zero. The subsequent writel() therefore writes zero to the entire PPLCCTL register instead of clearing only the reset bit. PPLCCTL contains other stream control fields, including the stream tag in AZX_PPLCCTL_STRM_MASK. Those fields must not be modified as a side effect of clearing stream reset. Use snd_hdac_updatel() to clear STRST, matching the existing set-reset path and preserving all unrelated PPLCCTL bits. Fixes: df203a4e46f4 ("ALSA: hdac_ext: add extended stream capabilities") Cc: stable@vger.kernel.org Signed-off-by: Xu Rao <raoxu@uniontech.com> Link: https://patch.msgid.link/43BB7930B0F07C09+20260813065524.1955696-1-raoxu@uniontech.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-08-13KVM: s390: gmap: Make prefix handling optionalSteffen Eiden
Guard guest prefix handling behind `KVM_S390_MANAGES_S390_GUEST`. This enables other KVM implementations to use gmap without implementing prefix handling. The prefix handling is integrated deeply in the gmap implementation. Therefore, provide safe default implementations for the guarded functions. No functional changes. Signed-off-by: Steffen Eiden <seiden@linux.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
2026-08-13KVM: s390: gmap: Make CMMA optionalSteffen Eiden
Guard guest CMMA behind `KVM_S390_MANAGES_S390_GUEST`. This enables other KVM implementations to use gmap without implementing CMMA. No functional changes. Signed-off-by: Steffen Eiden <seiden@linux.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
2026-08-13KVM: s390: gmap: Make storage keys optionalSteffen Eiden
Guard guest storage key handling behind `KVM_S390_MANAGES_S390_GUEST`. This enables other KVM implementations to use gmap without implementing storage key infrastructure. Define KVM_S390_MANAGES_S390_GUEST to 1 for KVM hosts managing s390 guests (in kvm_host_s390.h). A KVM implementation not implementing those features must define KVM_S390_MANAGES_S390_GUEST to 0 in its kvm_host_<guest_arch>.h. No functional changes besides the new guard. Signed-off-by: Steffen Eiden <seiden@linux.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
2026-08-13KVM: s390: Prepare gmap for a second KVM implementationSteffen Eiden
Refactor gmap code such that a second s390 (host) KVM implementation can use the gmap code as well. Move mmu code from s390 to gmap so the other KVM implementation can use it as well. No functional change. Signed-off-by: Steffen Eiden <seiden@linux.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
2026-08-13KVM: s390: Move PGM code definitions to asm/kvm_host.hSteffen Eiden
Move PGM code definitions from kvm_host_s390.h (back) to the generic kvm_host.h. These definitions are needed by multiple KVM implementations and should be in a shared location. No functional change. Signed-off-by: Steffen Eiden <seiden@linux.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
2026-08-13KVM: s390: Move s390 kvm code into a subdirectorySteffen Eiden
Move all the code required to run s390 KVM guests on s390 to a s390 subdirectory. Move gmap related code into a gmap directory to later share gmap code between KVM implementations. Update S390 VFIO-PCI MAINTAINERS filepath. No functional change. Signed-off-by: Steffen Eiden <seiden@linux.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
2026-08-13KVM: s390: Move kvm_host definitions to kvm_host_s390Steffen Eiden
Rename kvm_host.h to kvm_host_s390.h and kvm_host_types.h to kvm_host_s390_types.h to distinguish s390-specific KVM definitions from the generic kvm_host.h that will be used for shared definitions. No functional change. Signed-off-by: Steffen Eiden <seiden@linux.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
2026-08-13KVM: s390: Rename kvm-s390.{c,h} to s390.{c,h}Steffen Eiden
Rename kvm-s390.c to s390.c and kvm-s390.h to s390.h for consistency with the new directory structure. Update all include statements and simplify Makefile ccflags from explicit paths to -I$(src). No functional change. Signed-off-by: Steffen Eiden <seiden@linux.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
2026-08-13KVM: s390: Prepare include guards for a new locationSteffen Eiden
Update include guard names in dat.h, faultin.h, and gmap.h to ARCH_KVM_GMAP_* to reflect their upcoming relocation to a shared gmap directory. No functional change. Signed-off-by: Steffen Eiden <seiden@linux.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
2026-08-13KVM: s390: Extract gmap tracing to a separate headerSteffen Eiden
Move the kvm_s390_major_guest_pfault trace event from trace.h to a new trace_gmap.h header. This separates gmap-specific tracing from general KVM/s390 tracing, preparing for code sharing between multiple KVM implementations. The trace event definition is updated to use local defines for parameters so that they can be replaced later with ease for when another KVM implementation uses these traces. No functional change. Signed-off-by: Steffen Eiden <seiden@linux.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
2026-08-12KVM: arm64: Correctly cap TLBI Range to the architural limitMarc Zyngier
TLB Invalidation by Range has a fairly powerful way of encoding pretty large ranges in a small number of bits. This range can be based on an arbitrary VA, which means it is pretty easy for a guest to generate an overflow should the hypervisor be naive enough to add the range to the base... Make sure the range is capped to the limit dictated by the address bit that determines the VA range. For an IPA invalidation, this is further corrected down the line to ignore the upper range. Fixes: 4ffa72ad8f37e ("KVM: arm64: nv: Add S1 TLB invalidation primitive for VNCR_EL2") Reported-by: Wei-Lin Chang <weilin.chang@arm.com> Link: https://lore.kernel.org/r/yifz3wn5gk5sr6mapi32trgk5m5kp33bquctsjmkifebnsnndt@fix6u4rthx4g Signed-off-by: Marc Zyngier <maz@kernel.org> Cc: stable@vger.kernel.org Reviewed-by: Wei-Lin Chang <weilin.chang@arm.com> Link: https://patch.msgid.link/20260810170616.746100-1-maz@kernel.org Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-08-13PCI: dwc: Handle return value from endpoint .pre_init callbackMarek Vasut
Add return value handling for struct dw_pcie_ep_ops .pre_init callback. Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Reviewed-by: Siddharth Vadapalli <s-vadapalli@ti.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Acked-by: Roy Zang <Roy.Zang@nxp.com> Link: https://patch.msgid.link/20260728012548.465139-3-marek.vasut+renesas@mailbox.org
2026-08-13PCI: dwc: Handle return value from endpoint .init callbackMarek Vasut
Add return value handling for struct dw_pcie_ep_ops .init callback. Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Reviewed-by: Siddharth Vadapalli <s-vadapalli@ti.com> Acked-by: Roy Zang <Roy.Zang@nxp.com> Link: https://patch.msgid.link/20260728012548.465139-2-marek.vasut+renesas@mailbox.org
2026-08-12accel/amdxdna: Skip unmapped range in aie2_populate_range()Lizhi Hou
aie2_populate_range() incorrectly failed jobs for BOs with multiple mmaps: if the unmapped entry appeared first in umap_list, the loop would pick it up, call hmm_range_fault() on a gone VMA, and return -EFAULT without ever trying the remaining valid mapps. Fix it by skipping unmapped entries. After the loop, if the map list is empty or all maps are valid, map_invalid can be cleared normally. Fixes: e486147c912f ("accel/amdxdna: Add BO import and export") Reviewed-by: Max Zhen <max.zhen@amd.com> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patch.msgid.link/20260812205628.810816-1-lizhi.hou@amd.com
2026-08-13dma/swiotlb: decouple high watermark tracking from CONFIG_DEBUG_FSchenhuguanshen
Under heavy concurrent DMA traffic on CoCo VMs, inc_used_and_hiwater() performs an atomic_long_add_return() plus a CAS loop on the global used_hiwater, and dec_used() performs an atomic_long_sub() on total_used. All CPUs contend on the same cacheline, causing measurable throughput degradation at scale. Historically these counters were only compiled in under CONFIG_DEBUG_FS, which means production kernels with debugfs paid the atomic overhead unconditionally. Make the tracking boot-time opt-in instead so that it is disabled by default with near-zero overhead via static_call, and can be enabled via "swiotlb=track_hiwater" parameter on demand for debugging. Note that when CONFIG_DEBUG_FS is enabled but hiwater tracking is disabled, the "io_tlb_used" metric reports an approximate value rather than an instantaneously exact one. Suggested-by: Fan Du <fan.du@intel.com> Signed-off-by: Jun Miao <jun.miao@intel.com> Co-developed-by: Fan Du <fan.du@intel.com> Signed-off-by: Fan Du <fan.du@intel.com> Tested-by: chenhuguanshen <chenhgs@chinatelecom.cn> Signed-off-by: chenhuguanshen <chenhgs@chinatelecom.cn> Reviewed-by: Michael Kelley <mhklinux@outlook.com> Tested-by: Michael Kelley <mhklinux@outlook.com> Link: https://lore.kernel.org/r/20260812070459.637077-1-frankchen158@126.com Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
2026-08-13PCI: dwc: Add PCI ID for LECARC PCIe PMUBrett Zhou
Add support for the PCIe PMU found on LECARC SoCs. LECARC platforms use the standard DesignWare PCIe Controller, and the existing DWC driver already handles the enumeration and basic functionality through the generic PCIe core. Hence, add the PCI vendor ID to the vendor-specific capability (VSEC) list, which enables the standard DWC RAS/DES feature detection. Signed-off-by: Brett Zhou <brett_zhou@lecomputing.com> Signed-off-by: Braden Zhang <braden_zhang@lecomputing.com> [mani: commit log] Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Link: https://patch.msgid.link/20260721-pcie-pmu-v5-1-570e44af7cde@lecomputing.com
2026-08-12hwmon: (tmp102) Add TMP110 device IDMarek Vasut
The TMP110 is register compatible with TMP102, add non-DT I2C device ID. Signed-off-by: Marek Vasut <marex@nabladev.com> Link: https://lore.kernel.org/r/20260812191021.65304-2-marex@nabladev.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-08-13platform/chrome: of_hw_prober: Add delay for hana trackpadsChen-Yu Tsai
Up until now, the MT8173 elm/hana device tree has set the dedicated regulator supplying the trackpad as always-on, simply because the Elan driver was missing proper delays. As a result the delay for the Synaptics trackpad was also omitted, as it was not strictly required under such a model and delayed the availability of the trackpad to the user. The Elan driver recently gained proper delays after power-up, with adaptive skipping of the delay if the regulator was originally on. The I2C HID driver and I2C OF component prober library gained similar adaptive delay skipping. The device tree will be fixed to have the regulator not be always on, and proper post-power-on delay time added to the I2C HID device. Also add the post-power-on delay to the ChromeOS OF component prober, so that if the regulator is off at the time of probing, the prober knows to wait for the hardware to initialize. Signed-off-by: Chen-Yu Tsai <wenst@chromium.org> Link: https://lore.kernel.org/r/20260811122011.3539250-8-wenst@chromium.org Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
2026-08-13bpf: Trim special_kfunc_list in verifierLeon Hwang
The commit 7619a0ee9340 ("bpf: Mark existing lock-safe kfuncs with KF_SPINLOCK_SAFE") dropped some helpers in verifier, which also eliminated the use of the following kfuncs from the special_kfunc_list: * bpf_arena_reserve_pages * bpf_stream_vprintk * bpf_stream_print_stack So, drop them from the special_kfunc_list. Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Link: https://lore.kernel.org/bpf/20260812164843.55601-1-leon.hwang@linux.dev Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-13bpf: Eliminate dup/restore of insn_aux_dataXu Kuohai
The dup/restore of insn_aux_data was introduced to resolve the inconsistency between insnsi and insn_aux_data arrays, which occurs on the failure path where insnsi was rolled back to the original state before constants blinding, while insn_aux_data was not. After JIT failure, there is only one user, bpf_clear_insn_aux_data(), that requires insnsi and insn_aux_data to be synchronized. It accesses both insnsi and insn_aux_data using the same array size and index. However, the access to insnsi in bpf_clear_insn_aux_data() is not necessary. It is checked to skip the second slot of an ldimm64 instruction, whose jt is never set and can be absorbed into the jt check itself. So remove the access to insnsi from bpf_clear_insn_aux_data(), and add a specific length field for insn_aux_data to allow it to have a different length from the insnsi array. Then remove dup/restore of insn_aux_data. Signed-off-by: Xu Kuohai <xukuohai@huawei.com> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/5a4528f019c8d2638c019a2f37475cccc16a9503.1785240296.git.xukuohai@huawei.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-12io_uring/rsrc: reject overflowing regvec bvec byte countsJérémy Jean
io_import_reg_vec() converts the estimated number of bio_vec entries into iovec-sized storage when struct bio_vec is larger than struct iovec. The conversion still multiplies nr_segs by sizeof(struct bio_vec) in size_t without checking for overflow. On 32-bit kernels, a registered buffer large enough to make io_estimate_bvec_size() return 357913942 segments wraps the byte count from 0x100000008 to 8. io_vec_realloc() then reserves only the input iovecs plus one extra slot while io_vec_fill_bvec() writes the full bio_vec array. Check both the multiplication and the rounding addition before deriving the replacement iovec count. Fixes: b4e41050b212 ("io_uring/rsrc: raise registered buffer 1GB limit") Assisted-by: Codex:gpt-5 Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr> Link: https://patch.msgid.link/20260812203042.720348-1-Jeremy.Jean@oss.cyber.gouv.fr Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-08-12Merge tag 'batadv-next-pullrequest-20260805' of https://git.open-mesh.org/batadvJakub Kicinski
Simon Wunderlich says: ==================== This cleanup patchset includes the following patches: - dat: drop non-4addr backwards compatibility, by Sven Eckelmann - tvlv: handle negative tvlv processing return codes, by Sven Eckelmann - improve kernel-doc, add comments and warnings, by Sven Eckelmann (3 patches) - coding style: split declarations, reverse x-mas tree, by Sven Eckelmann (2 patches) - handle errors in batadv_init(), by Minhong He - correct NET_RX_* NET_XMIT_* confusion, by Sven Eckelmann - remove negative returns for batadv_send_skb_unicast, by Sven Eckelmann * tag 'batadv-next-pullrequest-20260805' of https://git.open-mesh.org/batadv: batman-adv: remove negative returns for batadv_send_skb_unicast batman-adv: correct NET_RX_* NET_XMIT_* confusion batman-adv: handle errors in batadv_init() batman-adv: switch var declarations to reverse x-mas tree order batman-adv: split multiple declarations per line batman-adv: annotate functions which may reallocate the skbuff batman-adv: fix kernel-doc for functions holding skb ownership batman-adv: add missing kernel-doc comments batman-adv: tvlv: handle negative tvlv processing return codes batman-adv: dat: drop non-4addr backwards compatibility ==================== Link: https://patch.msgid.link/20260805143200.722098-1-sw@simonwunderlich.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-12mac80211: fils_aead: Use __cleanup() instead of memzero_explicit()Thomas Huth
By using __cleanup(aes_cmac_zeroize_key) for clearing the key data, we can save one line of code here. Signed-off-by: Thomas Huth <thuth@redhat.com> Acked-by: Johannes Berg <johannes@sipsolutions.net> Link: https://patch.msgid.link/20260807125845.1477067-7-thuth@redhat.com Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-08-12Bluetooth: SMP: clear the aes_cmac_key when doneThomas Huth
Clear the local aes_cmac_key structure via __cleanup() function when we're done with it to avoid that sensitive data could leak on the stack. While we're at it, also clear the tmp[] array here that is populated with a raw version of the original key and thus would leak the same information via the stack otherwise. Signed-off-by: Thomas Huth <thuth@redhat.com> Link: https://patch.msgid.link/20260807125845.1477067-5-thuth@redhat.com Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-08-12smb: clear the aes_cmac_key and aes_cmac_ctx when doneThomas Huth
Clear the local crypto-related structures via __cleanup() functions when we're done with them to avoid that sensitive data could leak on the stack. Note: cmac_ctx in ksmbd_sign_smb3_pdu() gets cleared in aes_cmac_final() already, so this does not need a __cleanup() marker. Signed-off-by: Thomas Huth <thuth@redhat.com> Acked-by: Namjae Jeon <linkinjeon@kernel.org> Link: https://patch.msgid.link/20260807125845.1477067-3-thuth@redhat.com Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-08-12Merge branch 'add-resolve_btfids-support-for-__arena-kfunc-suffix'Eduard Zingerman
Kumar Kartikeya Dwivedi says: ==================== Add resolve_btfids support for __arena kfunc suffix Use __arena/__arena__nullable suffixes to emit address_space(1) annotations on kfunc definitions in vmlinux.h. See commits for details. Changelog: ---------- v1 -> v2 v1: https://lore.kernel.org/bpf/20260809085155.3305519-1-memxor@gmail.com * Avoid enumerating all the ways resolve_btfids can emit the "address_space(1)" attribute in its header comment and in kfuncs.rst. (Ihor) * Drop the kfunc_has_arena_arg() helper: add_arena_tagged_proto() returns the original prototype when nothing needs tagging, so it can be invoked unconditionally for every kfunc. (Ihor) * Add resolve_btfids selftest cases with mixed tagged and untagged arguments, and a kfunc that combines the KF_ARENA_RET flag with suffixed arena arguments. (Ihor) ==================== Link: https://patch.msgid.link/20260812193842.2879226-1-memxor@gmail.com Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-12selftests/bpf: Test resolve_btfids arena argument suffixesKumar Kartikeya Dwivedi
Add a suffix-only kfunc declaration with arena annotations on all five arguments. Verify that resolve_btfids emits address_space(1) type tags for every position without KF_ARENA_ARG flags in the BTF ID sets. Represent expected arena arguments as a per-parameter bitmap so the test covers suffixes beyond the two positions expressible by flags. Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://patch.msgid.link/20260812193842.2879226-3-memxor@gmail.com Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-12resolve_btfids: Emit arena attributes from kfunc parameter suffixesKumar Kartikeya Dwivedi
Kfunc declarations can identify arena arguments through parameter name suffixes without repeating KF_ARENA_ARG flags in their BTF ID sets. resolve_btfids currently misses those arguments when synthesizing the address_space(1) attributes used by generated vmlinux.h files. Teach the arena prototype rewrite to recognize __arena and __arena__nullable directly on each parameter. Keep KF_ARENA_ARG1 and KF_ARENA_ARG2 handling for explicitly flagged kfuncs, while allowing suffixes on any argument without synthesizing kfunc flags. Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://patch.msgid.link/20260812193842.2879226-2-memxor@gmail.com Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-12tcp: clarify comment for mdev_us in struct tcp_sockZiran Zhang
The existing comment for mdev_us says "medium deviation", but this term is inaccurate. The field stores the "mean deviation" of RTT, as originally defined in Van Jacobson's paper "Congestion Avoidance and Control", and it is scaled by 4 (<< 2) in the Linux implementation. Update the comment to reflect the correct terminology and storage format. Signed-off-by: Ziran Zhang <zhangcoder@yeah.net> Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de> Link: https://patch.msgid.link/20260805131927.27661-1-zhangcoder@yeah.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-12Merge tag 'ovpn-net-20260809' of https://github.com/OpenVPN/ovpn-net-nextJakub Kicinski
Antonio Quartulli says: ==================== Included fixes: * release key slot crypto transforms from a workqueue rather than an RCU callback, because crypto_free_aead() may sleep with async or hardware implementations * run all deferred ovpn work on a module-owned workqueue and drain it on module exit, so no work item can still be executing module text after the module is unloaded * finish crypto callback cleanup (key slot release and leftover skb) before dropping the peer reference that gates netdev unregistration and module removal * avoid dereferencing a NULL key slot when userspace asks to kill a key that is not installed on the peer * tag 'ovpn-net-20260809' of https://github.com/OpenVPN/ovpn-net-next: ovpn: defer key slot crypto freeing to workqueue ovpn: run deferred work on a module-owned workqueue ovpn: finish crypto callback cleanup before peer release ovpn: fix NULL dereference when killing missing key ==================== Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260809212142.2249027-1-antonio@openvpn.net Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-12sctp: fix use-after-free of cached ASCONF chunkYuxiang Yang
addip_last_asconf caches the outstanding outbound ASCONF chunk. The normal ASCONF-ACK completion path releases the chunk and clears the pointer. However, sctp_asconf_queue_teardown() releases the cached chunk without clearing addip_last_asconf. During peer restart handling, sctp_sf_do_dupcook_a() queues SCTP_CMD_PURGE_ASCONF_QUEUE, which invokes sctp_asconf_queue_teardown() while the association remains alive and leaves the pointer dangling. A delayed authenticated ASCONF-ACK can then reach sctp_sf_do_asconf_ack(), which accesses the stale chunk and passes it to sctp_process_asconf_ack(), causing a use-after-free and a second release. Clearing the pointer exposes a race with T4 expiry. Peer restart handling queues the timer stop before the purge, but SCTP_CMD_TIMER_STOP uses timer_delete(), which does not wait for a callback already running on another CPU. Such a callback can reach sctp_sf_t4_timer_expire() after the purge and dereference NULL. Clear addip_last_asconf after releasing the cached chunk, and make sctp_sf_t4_timer_expire() consume a stale T4 expiry if no outstanding ASCONF remains. Fixes: a000c01e60e4 ("sctp: stop pending timers and purge queues when peer restart asoc") Cc: stable@vger.kernel.org Suggested-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn> Acked-by: Xin Long <lucien.xin@gmail.com> Link: https://patch.msgid.link/20260809043806.2768302-1-yangyx22@mails.tsinghua.edu.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-13Merge branch 'bpf-fix-trampoline-image-uaf-on-multi-detach-failure'Kumar Kartikeya Dwivedi
Hui Zhu says: ==================== bpf: Fix trampoline image UAF on multi detach failure From: Hui Zhu <zhuhui@kylinos.cn> This series fixes a UAF in bpf_trampoline_multi_attach_free() where old_image is freed while ftrace still calls into it, and makes bpf_trampoline_multi_detach() return void as suggested by Jiri Olsa. Patch 1 fixes the UAF. Patch 2 is an independent cleanup that changes the return type to void and drops the WARN_ON_ONCE at the call site. Changelog: v5: According to the comments of bot+bpf-ci, split the single patch into two: the bug fix and the return-type cleanup. v4: According to the comments of bot+bpf-ci, add Fixes: and update comments of bpf_trampoline_multi_attach_free. v3: According to the comments of Jiri Olsa, drop patches 2/3 and the prog-side machinery. keep only the simplified image-side fix in bpf_trampoline_multi_attach_free() and make bpf_trampoline_multi_detach() return void. v2: Folded v1's two detach patches into patch 1. According to the comments of Jiri Olsa, Pin the prog (pinned_prog) on cur_image so it stays alive while ftrace may still call into it. Make bpf_trampoline_multi_detach() return void. Fix the same UAF in standard (non-multi) trampolines. According to the comments of sashiko, Fix the prog UAF in bpf_trampoline_multi_attach() rollback. Leak the trampoline in bpf_trampoline_put() when cur_image is left by a rollback. ==================== Link: https://patch.msgid.link/cover.1786412280.git.zhuhui@kylinos.cn Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-08 00:59:45 +0000