summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-05-14net: dsa: microchip: bypass dev_ops for mirror operationsVladimir Oltean
Mirror operations are handled through a common function that redirects the treatment to ksz_dev_ops callbacks. This layer of indirection isn't needed since we now have a dsa_switch_ops for each switch family. Remove this indirection layer for KSZ switches, by connecting the ksz_dev_ops :: mirror_add() and mirror_del() operations directly to dsa_switch_ops. Remove the now unused mirror callbacks from ksz_dev_ops. Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com> Link: https://patch.msgid.link/20260512-clean-ksz-2nd-series-v1-6-c00f6ce037fa@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-14net: dsa: microchip: bypass dev_ops for FDB and MDB operationsVladimir Oltean
FDB and MDB operations are handled through a common function that redirects the treatment to ksz_dev_ops callbacks. This layer of indirection isn't needed since we now have a dsa_switch_ops for each kind of switch. Remove one indirection layer for KSZ switches, by connecting the ksz_dev_ops :: fdb_dump(), fdb_add(), fdb_del(), mdb_add() and mdb_del() operations directly to dsa_switch_ops. Remove the FDB and MDB operations from ksz_dev_ops. Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com> Link: https://patch.msgid.link/20260512-clean-ksz-2nd-series-v1-5-c00f6ce037fa@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-14net: dsa: microchip: bypass dev_ops for VLAN operationsVladimir Oltean
VLAN operations are handled through a common function that redirects the treatment to ksz_dev_ops callbacks. This level of indirection isn't needed since we now have a dsa_switch_ops for each kind of switch. Remove this useless layer of indirection by connecting directly the VLAN operations to the relevant dsa_switch_ops. Adapt their prototypes to match dsa_switch_ops expectations. Remove the now unused VLAN callbacks from ksz_dev_ops. Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com> Link: https://patch.msgid.link/20260512-clean-ksz-2nd-series-v1-4-c00f6ce037fa@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-14net: dsa: microchip: bypass dev_ops for change_mtu() operationVladimir Oltean
MTU changing is done through a common function that redirects the treatment to a specific ksz_dev_ops callback. This layer of indirection isn't needed since we now have a dsa_switch_ops struct for each switch family. Remove this indirection layer in MTU changing for KSZ switches, by directly connecting the ksz_dev_ops :: change_mtu() implementations to dsa_switch_ops. Remove the no longer used change_mtu() callback from ksz_dev_ops Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com> Link: https://patch.msgid.link/20260512-clean-ksz-2nd-series-v1-3-c00f6ce037fa@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-14net: dsa: microchip: bypass dev_ops for FDB ageing operationsVladimir Oltean
dsa_switch_ops :: set_ageing_time() goes through ksz_set_ageing_time(), further dispatched through ksz_dev_ops :: set_ageing_time(). Only ksz9477 and lan937x provide an implementation for this, so remove the (optional) method from ksz8463_switch_ops, ksz87xx_switch_ops, ksz88xx_switch_ops. Also, hook up ksz9477 and lan937x dsa_switch_ops directly to their respective implementations. Every switch family provides a dsa_switch_ops :: port_fast_age() implementation, which is dispatched through ksz_dev_ops :: flush_dyn_mac_table(). Remove the dev_ops indirection and connect the flush_dyn_mac_table() methods directly to their respective dsa_switch_ops. Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com> Link: https://patch.msgid.link/20260512-clean-ksz-2nd-series-v1-2-c00f6ce037fa@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-14net: dsa: microchip: remove unused phylink_mac_link_up() callbackBastien Curutchet (Schneider Electric)
ksz_dev_ops::phylink_mac_link_up() isn't used anywhere. Remove it. Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com> Link: https://patch.msgid.link/20260512-clean-ksz-2nd-series-v1-1-c00f6ce037fa@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-14Merge tag 'nvme-7.1-2026-05-14' of git://git.infradead.org/nvme into block-7.1Jens Axboe
Pull NVMe fixes from Keith: "- Fix memory leak on a passthrough integrity mapping failure (Keith) - Hide secrets behind debug option (Hannes) - Fix pci use-after-free for host memory buffer (Chia-Lin Kao) - Fix tcp taregt use-after-free for data digest (Sagi) - Revert a mistaken quirk (Alan Cui) - Fix uevent and controller state race condition (Maurizio) - Fix apple submission queue re-initialization (Nick Chan)" * tag 'nvme-7.1-2026-05-14' of git://git.infradead.org/nvme: nvme-apple: Reset q->sq_tail during queue init nvme: fix race condition between connected uevent and STARTED_ONCE flag Revert "nvme: add quirk NVME_QUIRK_IGNORE_DEV_SUBNQN for 144d:a808" nvmet-tcp: Fix potential UAF when ddgst mismatch nvme-pci: fix use-after-free in nvme_free_host_mem() nvmet-auth: Do not print DH-HMAC-CHAP secrets nvme: fix bio leak on mapping failure nvme: make prp passthrough usage less scary
2026-05-14net: block MSG_NO_SHARED_FRAGS in sendmsg()Jann Horn
This change should cause no difference in behavior; it just cleans up some hazardous code that could have become a problem in the future. MSG_NO_SHARED_FRAGS is a kernel-internal flag that cancels the effect of MSG_SPLICE_PAGES, another kernel-internal flag that influences the data-sharing semantics of SKBs. Prevent passing this flag in from userspace via sendmsg() by adding it to MSG_INTERNAL_SENDMSG_FLAGS. This is not currently an observable problem because MSG_NO_SHARED_FRAGS only has an effect if kernel code adds MSG_SPLICE_PAGES to it. The only codepath that adds MSG_SPLICE_PAGES to user-supplied flags from which MSG_NO_SHARED_FRAGS hasn't been cleared is the path tcp_bpf_sendmsg -> tcp_bpf_send_verdict -> tcp_bpf_push, and that is not a problem because tcp_bpf_sendmsg always intentionally sets MSG_NO_SHARED_FRAGS anyway. Signed-off-by: Jann Horn <jannh@google.com> Link: https://patch.msgid.link/20260512-msg_no_shared_frags-v1-1-55ea46760331@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-14net: skbuff: preserve shared-frag marker during coalescingWilliam Bowling
skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors. Fixes: cef401de7be8 ("net: fix possible wrong checksum generation") Fixes: f4c50a4034e6 ("xfrm: esp: avoid in-place decrypt on shared skb frags") Signed-off-by: William Bowling <vakzz@zellic.io> Reviewed-by: Eric Dumazet <edumazet@google.com> Tested-by: Jiayuan Chen <jiayuan.chen@linux.dev> Link: https://patch.msgid.link/20260513041635.1289541-1-vakzz@zellic.io Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-14net/mlx5e: Fix use-after-free in mlx5e_tx_reporter_timeout_recoverMatt Fleming
mlx5e_tx_reporter_timeout_recover() accesses sq->netdev after mlx5e_safe_reopen_channels() has torn down and freed the channel (and its embedded SQs). Replace the three sq->netdev references with priv->netdev which is safe because priv outlives channel teardown. The netdev_err() call already used priv->netdev for this reason; make the trylock/unlock and health_channel_eq_recover calls consistent. This fixes the following KASAN splat: BUG: KASAN: use-after-free in mlx5e_tx_reporter_timeout_recover+0x1dd/0x360 [mlx5_core] Read of size 8 at addr ffff889860ed0b28 by task kworker/u113:2/5277 Call Trace: mlx5e_tx_reporter_timeout_recover+0x1dd/0x360 [mlx5_core] devlink_health_reporter_recover+0xa2/0x150 devlink_health_report+0x254/0x7c0 mlx5e_reporter_tx_timeout+0x297/0x380 [mlx5_core] mlx5e_tx_timeout_work+0x109/0x170 [mlx5_core] process_one_work+0x677/0xf20 worker_thread+0x51f/0xd90 kthread+0x3a5/0x810 ret_from_fork+0x208/0x400 ret_from_fork_asm+0x1a/0x30 Fixes: 83ac0304a2d7 ("net/mlx5e: Fix deadlocks between devlink and netdev instance locks") Cc: stable@vger.kernel.org Reviewed-by: Cosmin Ratiu <cratiu@nvidia.com> Reviewed-by: Tariq Toukan <tariqt@nvidia.com> Signed-off-by: Matt Fleming <mfleming@cloudflare.com> Link: https://patch.msgid.link/20260513112226.140512-1-matt@readmodwrite.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-14Documentation: networking: devlink: stmmac: fix typo in phc_coarse_adjAvinash Duduskar
"Functionnal" should be "Functional". Signed-off-by: Avinash Duduskar <avinash.duduskar@gmail.com> Link: https://patch.msgid.link/20260512133214.1773502-1-avinash.duduskar@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-14Documentation: networking: ip-sysctl: fix typo in tcp_ecn_optionAvinash Duduskar
"regarless" should be "regardless". Signed-off-by: Avinash Duduskar <avinash.duduskar@gmail.com> Link: https://patch.msgid.link/20260512133125.1772658-1-avinash.duduskar@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-14rds: tcp_listen: fix typos in commentsAvinash Duduskar
Two typos in comments: - "reconneect" -> "reconnect" (block comment above rds_tcp_accept_one_path()). - "acccepted" -> "accepted" (block comment inside rds_tcp_conn_slots_available()). Signed-off-by: Avinash Duduskar <avinash.duduskar@gmail.com> Reviewed-by: Allison Henderson <achender@kernel.org> Link: https://patch.msgid.link/20260512215531.1988662-1-avinash.duduskar@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-14selftests: openvswitch: add pop_vlan testMinxi Hou
Add test_pop_vlan() to verify OVS kernel datapath pop_vlan action correctly strips 802.1Q VLAN tags from frames. Test structure: - Baseline: untagged forwarding validates basic connectivity. - Negative: forward without pop_vlan, tagged frame is invisible to ns2 (no VLAN sub-interface), ping fails. - Positive: pop_vlan strips tag on forward path, push_vlan restores tag on return path, ping succeeds. Use static ARP entries to avoid VLAN-tagged ARP complexity. Rely on ping success/failure for verification -- no tcpdump or pcap files needed. Signed-off-by: Minxi Hou <houminxi@gmail.com> Reviewed-by: Aaron Conole <aconole@redhat.com> Link: https://patch.msgid.link/20260512070841.1183581-3-houminxi@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-14selftests: openvswitch: add vlan() and encap() flow string parsingMinxi Hou
Add VLAN TCI formatting and parsing support to ovs-dpctl.py: - Add _vlan_dpstr() to decompose TCI into vid/pcp/cfi fields, with raw tci=0x%04x fallback when cfi=0 for round-trip safety. - Add _parse_vlan_from_flowstr() boundary check for missing ')'. - Add encap_ovskey subclass restricting nla_map to L2-L4 attributes (slots 0-21) that appear inside 802.1Q ENCAP, with metadata attributes set to "none". - Check encap parse() return value for unrecognized trailing content. - Support callable format functions in dpstr() output. - Change OVS_KEY_ATTR_VLAN type from uint16 to be16 to match the kernel __be16 wire format; uint16 decodes in host byte order, which gives wrong values on little-endian architectures. - Change OVS_KEY_ATTR_ENCAP type from none to encap_ovskey to enable recursive parsing of 802.1Q encapsulated flow keys. - Add push_vlan action class with fields matching kernel struct ovs_action_push_vlan (vlan_tpid, vlan_tci as network-order u16). - Add push_vlan dpstr format and parse with range validation (vid 0-4095, pcp 0-7, tpid 0-0xFFFF) and CFI forced to 1. Signed-off-by: Minxi Hou <houminxi@gmail.com> Reviewed-by: Aaron Conole <aconole@redhat.com> Link: https://patch.msgid.link/20260512070841.1183581-2-houminxi@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-14rds_tcp: close NULL deref window in rds_tcp_set_callbacksMaoyi Xie
rds_tcp_set_callbacks() links a new rds_tcp_connection onto rds_tcp_tc_list under rds_tcp_tc_list_lock. It releases the lock, then assigns tc->t_sock = sock outside the lock. rds_tcp_tc_info() and rds6_tcp_tc_info() walk rds_tcp_tc_list under the same lock. Both dereference tc->t_sock->sk without a NULL check. A reader can acquire rds_tcp_tc_list_lock between the writer's spin_unlock and the t_sock store. It then sees a list entry whose t_sock is NULL. The dereference of tc->t_sock->sk is a NULL access. Move tc->t_sock = sock inside rds_tcp_tc_list_lock, before list_add_tail. A reader holding the lock then observes the linkage and the t_sock store together. The restore path is safe. rds_tcp_restore_callbacks() does list_del_init inside the lock. The matching tc->t_sock = NULL after unlink is harmless to readers holding the lock. Fixes: 70041088e3b9 ("RDS: Add TCP transport to RDS") Suggested-by: Simon Horman <horms@kernel.org> Signed-off-by: Maoyi Xie <maoyi.xie@ntu.edu.sg> Reviewed-by: Allison Henderson <achender@kernel.org> Link: https://patch.msgid.link/20260512142807.1855619-1-maoyi.xie@ntu.edu.sg Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-14Merge branch 'net-sched-changes-around-qdisc_qstats_qlen_backlog'Jakub Kicinski
Eric Dumazet says: ==================== net/sched: changes around qdisc_qstats_qlen_backlog() First patch makes clear qdisc_qstats_qlen_backlog() runs locklessly. Second patch changes ioam6 to not acquire qdisc spinlock anymore. Third pach adds missing READ_ONCE()/WRITE_ONCE() annotations in hfsc. htb still needs fixes, I will take care of them separately. ==================== Link: https://patch.msgid.link/20260513080853.1383975-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-14net/sched: sch_hfsc: annotate data-races in hfsc_dump_class_stats()Eric Dumazet
hfsc_dump_class_stats() runs without qdisc spinlock being held. Add READ_ONCE()/WRITE_ONCE() annotations around: - cl->level - cl->cl_vtperiod - cl->cl_total - cl->cl_cumul Fixes: edb09eb17ed8 ("net: sched: do not acquire qdisc spinlock in qdisc/class stats dump") Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Toke Høiland-Jørgensen <toke@toke.dk> Link: https://patch.msgid.link/20260513080853.1383975-4-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-14net: ioam6: no longer acquire qdisc spinlock while calling ↵Eric Dumazet
qdisc_qstats_qlen_backlog() Recent changes in qdisc_qstats_qlen_backlog() and friends make it safe to use locklessly. Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Toke Høiland-Jørgensen <toke@toke.dk> Link: https://patch.msgid.link/20260513080853.1383975-3-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-14net/sched: qdisc_qstats_qlen_backlog() runs locklesslyEric Dumazet
qdisc_qstats_qlen_backlog() can be called without qdisc spinlock being held. Use qdisc_qlen_lockless() instead of qdisc_qlen(). Add a const qualifier to its first parameter (struct Qdisc *sch). Fixes: edb09eb17ed8 ("net: sched: do not acquire qdisc spinlock in qdisc/class stats dump") Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Toke Høiland-Jørgensen <toke@toke.dk> Link: https://patch.msgid.link/20260513080853.1383975-2-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-14perf metricgroup: Avoid scanning unnecessary PMUs for identifier matchIan Rogers
Only uncore PMUs can have an identifier, so add an optimized perf_pmus__scan routine for that case to avoid all PMU types being created. Reviewed-by: James Clark <james.clark@linaro.org> Signed-off-by: Ian Rogers <irogers@google.com> Cc: Adrian Hunter <adrian.hunter@intel.com> Cc: Ingo Molnar <mingo@redhat.com> Cc: Leo Yan <leo.yan@arm.com> Cc: Namhyung Kim <namhyung@kernel.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Falcon <thomas.falcon@intel.com> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-05-14perf pmu-events AMD: Switch l2_itlb_misses to bp_l1_tlb_miss_l2_tlb_miss.allIan Rogers
l2_itlb_misses is a valid legacy cache event name, hence allowing it in all_events in metric.py. l2_itlb_misses was also a json event for AMD zen1, zen2 and zen3. For zen4, zen5 and zen6 the checking that metric events are within the json was skipping l2_itlb_misses as it is a valid legacy event, however, the PMU driver lacks the event mapping causing it to be a bad event when used in the metric. Add bp_l1_tlb_miss_l2_tlb_miss.all as the l2 itlb miss event (bp = branch predictor, the AMD way to say itlb), so that is used in preference to l2_itlb_misses when the event exists. Remove l2_itlb_misses from metric.py as the legacy event isn't used by any metrics and having it is error prone for newer AMD zen models. Fixes: e596f329668ec2b5 ("perf jevents: Add itlb metric group for AMD") Reviewed-by: Sandipan Das <sandipan.das@amd.com> Signed-off-by: Ian Rogers <irogers@google.com> Cc: Adrian Hunter <adrian.hunter@intel.com> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: Ingo Molnar <mingo@redhat.com> Cc: James Clark <james.clark@linaro.org> Cc: Jiri Olsa <jolsa@kernel.org> Cc: Namhyung Kim <namhyung@kernel.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Ravi Bangoria <ravi.bangoria@amd.com> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-05-14ptp: vmw: Drop ptp_vmw_acpi_deviceRafael J. Wysocki
Static variable ptp_vmw_acpi_device in the ptp_vmw driver is assigned, but never used, so drop it. No functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/24384916.6Emhk5qWAg@rafael.j.wysocki Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-14perf record: Refactor ARM64 leaf caller setup out of archIan Rogers
Code in tools/perf/arch causes portability issues/opaqueness and LTO issues due to the use of weak symbols. Move the adding of LR to the sample_user_regs into arm64-frame-pointer-unwind-support.c conditional on EM_HOST == EM_AARCH64 (false on all non-ARM64 builds). This also better encapsulates the use of the sampled registers by get_leaf_frame_caller_aarch64 and the set up by the new add_leaf_frame_caller_opts_aarch64, exposing opportunities for possibly sampling PC and SP to help the unwinder. Reviewed-by: James Clark <james.clark@linaro.org> Signed-off-by: Ian Rogers <irogers@google.com> Cc: Adrian Hunter <adrian.hunter@intel.com> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: Dapeng Mi <dapeng1.mi@linux.intel.com> Cc: Ingo Molnar <mingo@redhat.com> Cc: Jiri Olsa <jolsa@kernel.org> Cc: John Garry <john.g.garry@oracle.com> Cc: Leo Yan <leo.yan@linux.dev> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Mike Leach <mike.leach@arm.com> Cc: Namhyung Kim <namhyung@kernel.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Shimin Guo <shimin.guo@skydio.com> Cc: Will Deacon <will@kernel.org> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-05-14netlink: add one debug check in nla_nest_end()Eric Dumazet
Add a DEBUG_NET_WARN_ON_ONCE(diff > U16_MAX) to warn if the kernel sends corrupted nested attribute to user space. Offenders can be converted to nla_nest_end_safe(). Signed-off-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260512155244.4137851-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-15ARM: Do not select HAVE_RUST when KASAN is enabledNathan Chancellor
When KASAN is enabled, such as with allmodconfig, the build fails when building the Rust code with: error: kernel-address sanitizer is not supported for this target error: aborting due to 1 previous error make[4]: *** [rust/Makefile:654: rust/core.o] Error 1 The arm-unknown-linux-gnueabi target does not support KASAN, so avoid saying Rust is supported when it is enabled. Cc: stable@vger.kernel.org Fixes: ccb8ce526807 ("ARM: 9441/1: rust: Enable Rust support for ARMv7") Link: https://github.com/Rust-for-Linux/linux/issues/1234 Signed-off-by: Nathan Chancellor <nathan@kernel.org> Reviewed-by: Christian Schrefl <chrisi.schrefl@gmail.com> Link: https://patch.msgid.link/20260511-arm-avoid-rust-with-kasan-v1-1-24d55f4a900b@kernel.org Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-05-14Merge branch 'support-bpf-traversal-of-wakeup-sources'Alexei Starovoitov
Samuel Wu says: ==================== Support BPF traversal of wakeup sources This patchset adds requisite kfuncs for BPF programs to safely traverse wakeup_sources, and puts a config flag around the sysfs interface. Currently, a traversal of wakeup sources require going through /sys/class/wakeup/* or /d/wakeup_sources/*. The repeated syscalls to query sysfs is inefficient, as there can be hundreds of wakeup_sources, with each wakeup source also having multiple attributes. debugfs is unstable and insecure. Adding kfuncs to lock/unlock wakeup sources allows BPF program to safely traverse the wakeup sources list, and a kfunc to get head of wakeup sources list is needed to start traversing the list. On a quiescent Pixel 6 traversing 150 wakeup_sources, I am seeing ~34x speedup (sampled 75 times in table below). For a device under load, the speedup is greater. +-------+----+----------+----------+ | | n | AVG (ms) | STD (ms) | +-------+----+----------+----------+ | sysfs | 75 | 44.9 | 12.6 | +-------+----+----------+----------+ | BPF | 75 | 1.3 | 0.7 | +-------+----+----------+----------+ The initial attempts for BPF traversal of wakeup_sources was with BPF iterators [1]. However, BPF already allows for traversing of a simple list with bpf_for(), and this current patchset has the added benefit of being ~2-3x more performant than BPF iterators. [1]: https://lore.kernel.org/all/20260225210820.177674-1-wusamuel@google.com/ Changes in v4: - Removed `.owner = THIS_MODULE` for btf_kfunc_id_set per Greg - Add a graceful exit in selftest if bpf_wakeup_sources_get_head() is not present due to kernel configs without CONFIG_PM_SLEEP (e.g. s390) - Relaxed substr match in wakeup_source_unlock_null() selftest - v3 link: https://lore.kernel.org/all/20260331153413.2469218-1-wusamuel@google.com/ Changes in v3: - Changed return type of bpf_wakeup_sources_get_head() to `void *` per Alexei - Added failure test for direct dereference of wakeup source head - Use bpf_core_cast() instead of macros in BPF program per Kumar - v2 link: https://lore.kernel.org/all/20260326112521.2827500-1-wusamuel@google.com/ Changes in v2: - Dropped CONFIG_PM_WAKEUP_STATS_SYSFS patch for future patchset - Added declarations for kfuncs to .h to fix sparse and checkpatch warnings - Added kfunc to get address of wakeup_source's head - Added example bpf prog selftest for traversal of wakeup sources per Kumar - Added *_fail.c selftest per Kumar - More concise commit message in patch 1/2 - v1 link: https://lore.kernel.org/all/20260320160055.4114055-1-wusamuel@google.com/ ==================== Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Acked-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://patch.msgid.link/20260511174559.659782-1-wusamuel@google.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-05-14selftests/bpf: Add tests for wakeup_sources kfuncsSamuel Wu
Introduce a set of BPF selftests to verify the safety and functionality of wakeup_source kfuncs. The suite includes: 1. A functional test (test_wakeup_source.c) that iterates over the global wakeup_sources list. It uses CO-RE to read timing statistics and validates them in user-space via the BPF ring buffer. 2. A negative test suite (wakeup_source_fail.c) ensuring the BPF verifier correctly enforces reference tracking and type safety. 3. Enable CONFIG_PM_WAKELOCKS in the test config, allowing creation of wakeup sources via /sys/power/wake_lock. A shared header (wakeup_source.h) is introduced to ensure consistent memory layout for the Ring Buffer data between BPF and user-space. Signed-off-by: Samuel Wu <wusamuel@google.com> Link: https://lore.kernel.org/r/20260511174559.659782-3-wusamuel@google.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-05-14PM: wakeup: Add kfuncs to traverse over wakeup_sourcesSamuel Wu
Iterating through wakeup sources via sysfs or debugfs can be inefficient or restricted. Introduce BPF kfuncs to allow high-performance and safe in-kernel traversal of the wakeup_sources list. There is at least a 30x speedup for walking 150 wakeup sources and all their attributes. The new kfuncs include: - bpf_wakeup_sources_get_head() to obtain the list head. - bpf_wakeup_sources_read_lock/unlock() to manage the SRCU lock. For verifier safety, the underlying SRCU index is wrapped in an opaque 'struct bpf_ws_lock' pointer. This enables the use of KF_ACQUIRE and KF_RELEASE flags, allowing the BPF verifier to strictly enforce paired lock/unlock cycles and prevent resource leaks. Signed-off-by: Samuel Wu <wusamuel@google.com> Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Acked-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://lore.kernel.org/r/20260511174559.659782-2-wusamuel@google.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-05-14docs: hwmon: sy7636a: fix temperature sysfs attribute nameChen-Shi-Hong
The hwmon sysfs naming convention uses temp[1-*]_input for temperature channels. Documentation/hwmon/sy7636a-hwmon.rst currently documents temp0_input, while the driver uses the standard hwmon temperature channel interface. Update the documentation to use temp1_input. Signed-off-by: Chen-Shi-Hong <eric039eric@gmail.com> Link: https://lore.kernel.org/r/20260514154108.1937-1-eric039eric@gmail.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-05-15ovpn: disable BHs when updating device statsRalf Lici
ovpn updates dev->dstats from both process and softirq contexts. In particular, TCP paths may run from socket callbacks, workqueues or strparser work, while UDP receive and ovpn's ndo_start_xmit path may update the same per-device dstats from BH context. Add ovpn device drop-stat helpers that disable BHs around dev_dstats_rx_dropped() and dev_dstats_tx_dropped(), and use them for drop accounting. The successful RX dev_dstats_rx_add() update is already covered by the BH-disabled section around gro_cells_receive(). For the successful TCP TX dev_dstats_tx_add() update, replace the existing preempt-disabled section with a BH-disabled one. Fixes: 11851cbd60ea ("ovpn: implement TCP transport") Signed-off-by: Ralf Lici <ralf@mandelbit.com> Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
2026-05-14perf trace: Update beautifier script for clone flagsNamhyung Kim
According to the change in the sched.h, update the script to generate the flags array like below. Note that '+1' is needed to detect bitmask pattern at index 0. $ cat tools/perf/trace/beauty/generated/clone_flags_array.c static const char *clone_flags[] = { [ilog2(0x00000100) + 1] = "VM", [ilog2(0x00000200) + 1] = "FS", [ilog2(0x00000400) + 1] = "FILES", [ilog2(0x00000800) + 1] = "SIGHAND", [ilog2(0x00001000) + 1] = "PIDFD", [ilog2(0x00002000) + 1] = "PTRACE", [ilog2(0x00004000) + 1] = "VFORK", [ilog2(0x00008000) + 1] = "PARENT", [ilog2(0x00010000) + 1] = "THREAD", [ilog2(0x00020000) + 1] = "NEWNS", [ilog2(0x00040000) + 1] = "SYSVSEM", [ilog2(0x00080000) + 1] = "SETTLS", [ilog2(0x00100000) + 1] = "PARENT_SETTID", [ilog2(0x00200000) + 1] = "CHILD_CLEARTID", [ilog2(0x00400000) + 1] = "DETACHED", [ilog2(0x00800000) + 1] = "UNTRACED", [ilog2(0x01000000) + 1] = "CHILD_SETTID", [ilog2(0x02000000) + 1] = "NEWCGROUP", [ilog2(0x04000000) + 1] = "NEWUTS", [ilog2(0x08000000) + 1] = "NEWIPC", [ilog2(0x10000000) + 1] = "NEWUSER", [ilog2(0x20000000) + 1] = "NEWPID", [ilog2(0x40000000) + 1] = "NEWNET", [ilog2(0x80000000) + 1] = "IO", [ilog2(0x00000080) + 1] = "NEWTIME", [32 + 1] = "CLEAR_SIGHAND", [33 + 1] = "INTO_CGROUP", [34 + 1] = "AUTOREAP", [35 + 1] = "NNP", [36 + 1] = "PIDFD_AUTOKILL", [37 + 1] = "EMPTY_MNTNS", }; This was found by Sashiko during review. Reviewed-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-05-14perf trace: Add beautifier script for fsmount flagsNamhyung Kim
And move the existing one to fsmount_attr.sh to be more precise. Now the fsmount_flags[] is generated from the mount.h like below. The ilog2() + 1 is an existing pattern to handle bit flags. $ cat tools/perf/trace/beauty/generated/fsmount_arrays.c static const char *fsmount_flags[] = { [ilog2(0x00000001) + 1] = "CLOEXEC", [ilog2(0x00000002) + 1] = "NAMESPACE", }; It was found by Sashiko during the review. Reviewed-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-05-14perf build: Add make check-headers targetNamhyung Kim
Don't print header differences during the perf build as it's noisy. Mostly people won't care and find it annoying. As it's to improve perf trace beautifier to catch up new changes mostly in UAPIs, we can make it a separate build target and call it occasionally. Make it and build-test related targets phony. Reviewed-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-05-14perf trace: Sync uapi/linux/sched.h with the kernel sourceNamhyung Kim
To pick up changes from: 9d4e752a24f740b3 ("namespace: allow creating empty mount namespaces") c8134b5f13ae959d ("pidfd: add CLONE_PIDFD_AUTOKILL") 24baca56fafc33d4 ("clone: add CLONE_NNP") 12ae2c81b21cfaa1 ("clone: add CLONE_AUTOREAP") 2e7af192697ef2a7 ("sched/deadline: Add reporting of runtime left & ...") This would be used to beautify scheduler syscall arguments and not to affect builds of other tools (e.g. objtool). Please see tools/include/uapi/README. Reviewed-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-05-14perf trace: Sync uapi/linux/mount.h with the kernel sourceNamhyung Kim
To pick up changes from: 5e8969bd19271241 ("mount: add FSMOUNT_NAMESPACE") This would be used to beautify mount syscall arguments and not to affect builds of other tools (e.g. objtool). Please see tools/include/uapi/README. Reviewed-by: Ian Rogers <irogers@google.com> Cc: linux-fsdevel@vger.kernel.org Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-05-14perf trace: Sync uapi/linux/fs.h with the kernel sourceNamhyung Kim
To pick up changes from: 1f662195dbc07a66 ("fs: add generic FS_IOC_SHUTDOWN definitions") This would be used to beautify filesystem syscall arguments and not to affect builds of other tools (e.g. objtool). Please see tools/include/uapi/README. Reviewed-by: Ian Rogers <irogers@google.com> Cc: linux-fsdevel@vger.kernel.org Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-05-14perf trace: Sync linux/socket.h with the kernel sourceNamhyung Kim
To pick up changes from: c66e0f453d1afa82 ("net: use ktime_t in struct scm_timestamping_internal") This would be used to beautify networking syscall arguments and not to affect builds of other tools (e.g. objtool). Please see tools/include/uapi/README. Reviewed-by: Ian Rogers <irogers@google.com> Cc: netdev@vger.kernel.org Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-05-14Merge tag 'hid-for-linus-2026051401' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - fixes for a few OOB/UAF in several HID drivers (Florian Pradines, Lee Jones, Michael Zaidman, Rosalie Wanders, Sangyun Kim and Tomasz Pakuła) - more general sanitation of input data, dealing with potentially malicious hardware in hid-core (Benjamin Tissoires) - a few device-specific quirks and fixups * tag 'hid-for-linus-2026051401' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (22 commits) HID: logitech-hidpp: Add support for newer Bluetooth keyboards HID: pidff: Fix integer overflow in pidff_rescale HID: i2c-hid: add reset quirk for BLTP7853 touchpad HID: core: introduce hid_safe_input_report() HID: pass the buffer size to hid_report_raw_event HID: google: hammer: stop hardware on devres action failure HID: appletb-kbd: run inactivity autodim from workqueues HID: appletb-kbd: fix UAF in inactivity-timer cleanup path HID: playstation: Clamp num_touch_reports HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID HID: mcp2221: fix OOB write in mcp2221_raw_event() HID: quirks: really enable the intended work around for appledisplay HID: hid-sjoy: race between init and usage HID: uclogic: Fix regression of input name assignment HID: intel-thc-hid: Intel-quickspi: Fix some error codes HID: hid-lenovo-go-s: restore OS_TYPE after resume from s2idle HID: elan: Add support for ELAN SB974D touchpad HID: sony: add missing size validation for Rock Band 3 Pro instruments HID: sony: add missing size validation for SMK-Link remotes HID: sony: remove unneeded WARN_ON() in sony_leds_init() ...
2026-05-14cgroup/rdma: document rdma.peak, rdma.events and rdma.events.localTao Cui
Add interface file documentation for the new rdma cgroup files to Documentation/admin-guide/cgroup-v2.rst. Signed-off-by: Tao Cui <cuitao@kylinos.cn> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-05-14cgroup/rdma: add rdma.events.local for per-cgroup allocation failure attributionTao Cui
Add per-cgroup local event counters to track RDMA resource limit exhaustion from the perspective of individual cgroups. The rdma.events.local file reports two per-resource counters: - max: number of times this cgroup's limit was the one that blocked an allocation in the subtree - alloc_fail: number of allocation attempts originating from this cgroup that failed due to an ancestor's limit This mirrors the design of pids.events.local, where events are attributed to the cgroup that imposed the limit, not necessarily the cgroup where the allocation was attempted. Also extend rdma.events with a hierarchical alloc_fail counter that tracks allocation failures propagating upward from the requesting cgroup, complementing the existing max counter, so that rdma.events and rdma.events.local share the same output format. Signed-off-by: Tao Cui <cuitao@kylinos.cn> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-05-14cgroup/rdma: add rdma.events to track resource limit exhaustionTao Cui
Add per-device hierarchical event counters to track when RDMA resource limits are exceeded. The rdma.events file reports max event counts propagated upward from the cgroup whose limit was hit to all ancestors. This mirrors the design of pids.events, where events are attributed to the cgroup that imposed the limit, not necessarily the cgroup where the allocation was attempted. Userspace can monitor this file via poll/epoll for real-time notification of resource exhaustion. Signed-off-by: Tao Cui <cuitao@kylinos.cn> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-05-14cgroup/rdma: add rdma.peak for per-device peak usage trackingTao Cui
rdma.peak tracks the high watermark of resource usage per device, giving a better baseline on which to set rdma.max. Polling rdma.current isn't feasible since it would miss short-lived spikes. This interface is analogous to memory.peak. Signed-off-by: Tao Cui <cuitao@kylinos.cn> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-05-14Merge tag 'acpi-7.1-rc4' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI support fixes from Rafael Wysocki: "These fix several platform drivers that use the ACPI companion of the given platform device without checking its presence, which may lead to a NULL pointer dereference or other kind of malfunction if the driver is forced to match a device without an ACPI companion via driver override, and restore debug log level for some messages in the ACPI CPPC library: - Check ACPI_COMPANION() against NULL during probe in several core ACPI device drivers (Rafael Wysocki) - Restore log level of messages in amd_set_max_freq_ratio() (Mario Limonciello)" * tag 'acpi-7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: PAD: xen: Check ACPI_COMPANION() against NULL ACPI: driver: Check ACPI_COMPANION() against NULL during probe Revert "ACPI: CPPC: Adjust debug messages in amd_set_max_freq_ratio() to warn"
2026-05-15drm/bridge/rockchip: fix build after atomic API change.Dave Airlie
Signed-off-by: Dave Airlie <airlied@redhat.com>
2026-05-14lsm: hold cred_guard_mutex for lsm_set_self_attr()Stephen Smalley
Just as proc_pid_attr_write() already does before calling the LSM hook. This only matters for SELinux and AppArmor which check whether the process is being ptraced and if so, whether to allow the transition. Cc: stable@vger.kernel.org Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com> Acked-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2026-05-14Merge branch 'acpi-cppc'Rafael J. Wysocki
Merge a revert of an ACPI CPPC commit that increased the log level of some debug messages which turned out to be a bad idea: - Restore log level of messages in amd_set_max_freq_ratio() (Mario Limonciello) * acpi-cppc: Revert "ACPI: CPPC: Adjust debug messages in amd_set_max_freq_ratio() to warn"
2026-05-14soc: microchip: mpfs-sys-controller: fix resource leak on probe errorFelix Gu
In mpfs_sys_controller_probe(), when device_get_match_data() returns NULL, it returns -EINVAL directly without freeing the mbox channel or the allocated sys_controller memory, causing a resource leak. Fixes: 63b5305ad84d ("soc: microchip: mpfs-sys-controller: add support for pic64gx") Signed-off-by: Felix Gu <ustc.gu@gmail.com> Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
2026-05-14rust: pin-init: internal: add `PhantomInvariant` and `PhantomInvariantLifetime`Gary Guo
Currently, the `pin_init` library has an `Invariant` type alias, and it is instantiated using `PhantomData`. Generated code from `pin_data` on the other hand cannot access the crate-local type alias, so it generates `PhantomData<fn(T) -> T>` directly. This is all very inconsistent, despite the exact same use case of ensuring invariance. Add `PhantomInvariant` and `PhantomInvariantLifetime` and switch all users that need to express the concept of invariance to use these. They're polyfills of unstable types in the same names in the Rust standard library. Link: https://patch.msgid.link/20260512-pin-init-sync-v1-3-81963130dfbd@garyguo.net Signed-off-by: Gary Guo <gary@garyguo.net>
2026-05-14rust: pin-init: internal: pin_data: add struct to record field infoMohamad Alsadhan
Introduce `FieldInfo` struct to encapsulate field and other relevant data, instead of carrying a pair of `(pinned, field)` in all places. This allows us to add more information to the struct in the future. Signed-off-by: Mohamad Alsadhan <mo@sdhn.cc> Co-developed-by: Gary Guo <gary@garyguo.net> Link: https://patch.msgid.link/20260512-pin-init-sync-v1-2-81963130dfbd@garyguo.net Signed-off-by: Gary Guo <gary@garyguo.net>