summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-05-10sched_ext: Handle SCX_TASK_NONE in disable/switched_from pathsTejun Heo
scx_fail_parent() leaves cgroup tasks at (state=NONE, sched=parent, sched_class=ext) until the parent itself is torn down by the scx_error() it raised. When the later root_disable iterates them, two paths trip on NONE. scx_disable_and_exit_task() re-enters the wrapper at NONE: the inner switch returns early but the trailing scx_set_task_sched(p, NULL) clobbers the parent sched left by scx_fail_parent(), and scx_set_task_state(p, NONE) wastes a write on an already-NONE task. switched_from_scx() then calls scx_disable_task(), which WARNs on non-ENABLED state and writes state=READY, producing a NONE -> READY transition the validation matrix rejects. Treat NONE as "nothing to do" in both paths. Add a NONE early-return at the top of scx_disable_and_exit_task() and a parallel NONE check in switched_from_scx() next to task_dead_and_done(). Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-05-10sched_ext: Close sub-sched init race with post-init DEAD recheckTejun Heo
scx_sub_enable_workfn()'s init pass and scx_sub_disable() migration both drop the rq lock to call __scx_init_task() against the other sched. A TASK_DEAD @p can fall through sched_ext_dead() in that window. sched_ext_dead() runs ops.exit_task() on the sched @p was attached to, not on the sched whose init just completed, so the new allocation leaks. Reuse the DEAD signal set by sched_ext_dead(). After __scx_init_task() returns, take task_rq_lock(p) and check for DEAD; on hit, call scx_sub_init_cancel_task() against the sub sched the init ran for and drop @p; on miss, proceed as before. Reported-by: zhidao su <suzhidao@xiaomi.com> Link: https://lore.kernel.org/all/20260429133155.3825247-1-suzhidao@xiaomi.com/ Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-05-10sched_ext: Close root-enable vs sched_ext_dead() race with SCX_TASK_INIT_BEGINTejun Heo
scx_root_enable_workfn() drops the iter rq lock for ops.init_task() and a TASK_DEAD @p can fall through sched_ext_dead() in that window. The race hits when sched_ext_dead() observes SCX_TASK_INIT (the intermediate state before @p->scx.sched is published) and dereferences NULL via SCX_HAS_OP(NULL, exit_task), or observes SCX_TASK_NONE during the unlocked init window and skips cleanup so exit_task() never runs. Add SCX_TASK_INIT_BEGIN. The enable path writes NONE -> INIT_BEGIN under the iter rq lock, then takes the rq lock again after init to walk INIT_BEGIN -> INIT -> READY. sched_ext_dead() that wins the rq-lock race observes INIT_BEGIN and sets DEAD without calling into ops; the post-init recheck unwinds via scx_sub_init_cancel_task(). scx_fork() runs single-threaded against sched_ext_dead() (the task is not on scx_tasks until scx_post_fork() adds it) so its INIT_BEGIN -> INIT walk needs no rq-lock pairing; it rolls back to NONE on ops.init_task() failure. The validation matrix grows the INIT_BEGIN row and the INIT_BEGIN -> DEAD edge; INIT now requires INIT_BEGIN as the predecessor. scx_sub_disable()'s migration writes INIT_BEGIN as a synthetic predecessor to satisfy the tightened verification. The sub-sched paths still race with sched_ext_dead() during the unlocked init window. This will be fixed by the next patch. Reported-by: zhidao su <suzhidao@xiaomi.com> Link: https://lore.kernel.org/all/20260429133155.3825247-1-suzhidao@xiaomi.com/ Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-05-10sched_ext: Replace SCX_TASK_OFF_TASKS flag with SCX_TASK_DEAD stateTejun Heo
SCX_TASK_OFF_TASKS marked tasks already through sched_ext_dead() so cgroup task iteration would skip them. This can be expressed better with a task state. Replace the flag with SCX_TASK_DEAD. scx_disable_and_exit_task() resets state to NONE on its way out, so sched_ext_dead() now sets DEAD after the wrapper returns. The validation matrix grows NONE -> DEAD, warns on DEAD -> NONE, and tightens READY's predecessor to INIT or ENABLED so the new DEAD value cannot silently transition to READY. Prepares for the following enable vs dead race fix. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-05-10sched_ext: Inline scx_init_task() and move RESET_RUNNABLE_AT into ↵Tejun Heo
scx_set_task_state() Prepare for the SCX_TASK_INIT_BEGIN/DEAD work that follows by collapsing the scx_init_task() helper. Move the SCX_TASK_RESET_RUNNABLE_AT setting into scx_set_task_state() on the INIT transition (it was set unconditionally at every INIT site through the scx_init_task() helper), inline scx_init_task() into scx_fork() and scx_root_enable_workfn(), and drop the helper. As a side effect, scx_sub_disable() migration sequence now also sets RESET_RUNNABLE_AT (it previously wrote INIT directly without going through scx_init_task()). The flag triggers a runnable_at reset on the next set_task_runnable(), which is harmless on a task that has just been moved between scheds. On root-enable, p->scx.flags is written without the task's rq lock. The task isn't visible to scx yet, and a follow-up patch restores the lock-held write. v2: Note p->scx.flags rq-lock relaxation on root-enable path. (Andrea) Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-05-10sched_ext: Cleanups in preparation for the SCX_TASK_INIT_BEGIN/DEAD workTejun Heo
Cleanups in preparation for the state-machine work that follows: - Convert three sub-sched call sites that open-code rcu_assign_pointer(p->scx.sched, ...) to scx_set_task_sched(). - Move scx_get_task_state()/scx_set_task_state() above the SCX task iter section so scx_task_iter_next_locked() can use them without a forward declaration. No functional change. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-05-10Merge tag 'edac_urgent_for_v7.1_rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC fix from Borislav Petkov: - Fix a string leak in the versalnet driver * tag 'edac_urgent_for_v7.1_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/versalnet: Fix device name memory leak
2026-05-10Merge branch 'net-mlx5-steering-misc-enhancements'Jakub Kicinski
Tariq Toukan says: ==================== net/mlx5: Steering misc enhancements This small series by Yevgeny contains a few steering enhancements / cleanups. ==================== Link: https://patch.msgid.link/20260507173443.320465-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-10net/mlx5: DR, Remove unused field of struct mlx5dr_matcher_rx_txYevgeny Kliteynik
Remove a field that was never used. Signed-off-by: Yevgeny Kliteynik <kliteyn@nvidia.com> Reviewed-by: Erez Shitrit <erezsh@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260507173443.320465-4-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-10net/mlx5: HWS, Handle destroying table that has a miss tableYevgeny Kliteynik
If a table has a miss table that was created by 'mlx5hws_table_set_default_miss' API function, its miss_tbl keeps the table that points to it in a list. If such table is deleted, we need to also remove it from the miss_tbl list, otherwise the node in miss_tbl list will contain garbage. Signed-off-by: Erez Shitrit <erezsh@nvidia.com> Signed-off-by: Yevgeny Kliteynik <kliteyn@nvidia.com> Reviewed-by: Moshe Shemesh <moshe@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260507173443.320465-3-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-10net/mlx5: HWS, Check if device is down while polling for completionYevgeny Kliteynik
In case the device is down for any reason (e.g. FLR), the HW will no longer generate completions - no point polling and waiting for timeout. Signed-off-by: Yevgeny Kliteynik <kliteyn@nvidia.com> Reviewed-by: Erez Shitrit <erezsh@nvidia.com> Reviewed-by: Shay Drori <shayd@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260507173443.320465-2-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-10Merge branch 'log-clean-up-and-tap-follow-ups'Jakub Kicinski
Allison Henderson says: ==================== Log clean up and TAP follow ups This is a follow up series to the "Log collection, TAP compliance and cleanups" set. The sashiko report had made some points that I thought was worth addressing. This patch set fixes a few more TAP compliance prints in the check_gcov* routines. Also since the user must now pass in the log folder to collect logs, log clean up is tightened to only remove rds* prefixed artifacts instead of the entire folder. Lastly a the signal handler alarm should be disarmed after the completes to avoid multiple calls to the stop_pcaps routine. ==================== Link: https://patch.msgid.link/20260507233213.556182-1-achender@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-10selftests: rds: Disarm signal alarm on test completionAllison Henderson
A race in stop_pcaps is possible if the test completes and then times out while waiting for the tcpdump process to exit. The signal handler may fire again and needlessly call stop_pcap a second time. Fix this by disabling the alarm after normal test completion. Also if there are no tcpdump processes to wait on, stop_pcaps can just exit. This avoids misleading prints when there are no procs to collect dumps from. Signed-off-by: Allison Henderson <achender@kernel.org> Link: https://patch.msgid.link/20260507233213.556182-4-achender@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-10selftests: rds: Fix TAP-prefixed prints in check_gcov*Allison Henderson
This patch adds the # prefix to info and warning prints in the check_gcov* routines. Since these routines do not exit, as the other check_* routines do, the output here should be kept TAP compliant. Signed-off-by: Allison Henderson <achender@kernel.org> Link: https://patch.msgid.link/20260507233213.556182-3-achender@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-10selftests: rds: Fix stale log clean upAllison Henderson
Since rds self tests no longer has a default folder, users must specify a log collection folder if they want to collect logs. Currently the log folder is deleted and recreated, but this can be dangerous if the user exports RDS_LOG_DIR=/tmp or /var/log. This patch corrects the clean up to delete only rds log artifacts from the log folder, and further prefixes rds specific logs as rds* Signed-off-by: Allison Henderson <achender@kernel.org> Link: https://patch.msgid.link/20260507233213.556182-2-achender@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-10net: xgene: fix mdio_np leak in xgene_mdiobus_register()Shitalkumar Gandhi
The for_each_child_of_node() loop captures mdio_np via break, holding the refcount. of_mdiobus_register() does not consume the reference, so it leaks on success. Put it after registration. Fixes: e6ad767305eb ("drivers: net: Add APM X-Gene SoC ethernet driver support.") Signed-off-by: Shitalkumar Gandhi <shitalkumar.gandhi@cambiumnetworks.com> Link: https://patch.msgid.link/20260507142024.811543-1-shitalkumar.gandhi@cambiumnetworks.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-10Merge branch 'ipv4-flush-the-fib-once-on-multiple-nexthop-removal'Jakub Kicinski
Cosmin Ratiu says: ==================== ipv4: Flush the FIB once on multiple nexthop removal This series optimizes multiple nexthop removal performance from having to do a FIB flush for each nexthop being removed to only doing a single FIB flush after all nexthops are removed. This dramatically improves performance in scenarios where there are many nexthops and many ipv4 routes. Please see individual patches for more details and for a test scenario. ==================== Link: https://patch.msgid.link/20260507075606.322405-1-cratiu@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-10ipv4: Add __must_check to nexthop removal functionsCosmin Ratiu
These functions return a signal whether FIB flushing is required which must not be ignored. Use the compiler to help with enforcing this requirement in the future. Signed-off-by: Cosmin Ratiu <cratiu@nvidia.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Reviewed-by: David Ahern <dsahern@kernel.org> Link: https://patch.msgid.link/20260507075606.322405-4-cratiu@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-10ipv4: Flush the FIB once on multiple nexthop removalCosmin Ratiu
When a device is going down or when a net namespace is deleted, all nexthops on it are removed, and for each nexthop being removed the FIB table is flushed, which does a full trie traversal looking for entries marked RTNH_F_DEAD and removing them. This is O(N x R), with N being number of dev nexthops and R being number of IPv4 routes. The RTNL is held the entire time. When there are many nexthops to be removed and many routing entries, this can result in the RTNL being held for multiple minutes, which causes unhappiness in other processes trying to acquire the RTNL (e.g. systemd-networkd for DHCP renewals). In a complicated deployment with multiple vxlan devices, each having 16K nexthops and a total of 128K ipv4 routes, this is exactly what happens: nexthop_flush_dev() # loops over 16K nexthops -> remove_nexthop() -> __remove_nexthop() -> __remove_nexthop_fib() # marks fi->fib_flags |= RTNH_F_DEAD -> fib_flush() # for EACH nexthop! -> fib_table_flush() # walks the ENTIRE FIB, 128K entries This patch makes use of the previously added FIB flushing signal to only do a single FIB flush after all nexthops to be removed are marked as RTNH_F_DEAD: - __remove_nexthop_fib() no longer flushes the FIB. - nexthop_flush_dev() and flush_all_nexthops() now keep track whether any nexthop was removed and trigger a FIB flush at the end. - a new wrapper is defined, remove_one_nexthop() which calls remove_nexthop() and flushes if necessary. This is intended for places which must remove a single nexthop and shouldn't worry about the need to trigger a FIB flush. For now, the only caller is rtm_del_nexthop(). - The two direct callers of __remove_nexthop() get a WARN_ON_ONCE, since the nh about to be removed should not have any FIB entries referencing it when replacing or inserting a new one. This dramatically improves performance from O(N x R) to O(N + R). Releasing a nexthop reference in remove_nexthop() now no longer frees it. Instead, it is deleted when the last fib_info pointing to it gets freed via free_fib_info_rcu(). All routing code is already careful not to take into consideration routes marked with RTNH_F_DEAD. Tested with: DEV=eth2 ip link set up dev $DEV ip link add testnh0 link $DEV type macvlan mode bridge ip addr add 198.51.100.1/24 dev testnh0 ip link set testnh0 up seq 1 65536 | \ sed 's/.*/nexthop add id & via 198.51.100.2 dev testnh0/' | \ ip -batch - i=1 for a in $(seq 0 255); do for b in $(seq 0 255); do echo "route add 10.${a}.${b}.0/32 nhid $i" i=$((i + 1)) done done | ip -batch - time ip link set testnh0 down ip link del testnh0 Without this patch: real 0m32.601s user 0m0.000s sys 0m32.511s With this patch: real 0m0.209s user 0m0.000s sys 0m0.153s Signed-off-by: Cosmin Ratiu <cratiu@nvidia.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Reviewed-by: David Ahern <dsahern@kernel.org> Link: https://patch.msgid.link/20260507075606.322405-3-cratiu@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-10ipv4: Provide a FIB flushing signal from nexthop removal functionsCosmin Ratiu
Plumb a bool value throughout the various nexthop removal functions, determined in the innermost __remove_nexthop_fib() (which still does the FIB flushing) and propagated up all callers. The next patch will make use of this signal to optimize the removal of multiple nexthops by moving the FIB flushing up the call hierarchy. Signed-off-by: Cosmin Ratiu <cratiu@nvidia.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Reviewed-by: David Ahern <dsahern@kernel.org> Link: https://patch.msgid.link/20260507075606.322405-2-cratiu@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-10Merge branch 'net-convert-four-more-protocols-to-getsockopt_iter'Jakub Kicinski
Breno Leitao says: ==================== net: convert four more protocols to getsockopt_iter Continue the work to convert protocols to the new getsockopt_iter API. Convert four additional getsockopt implementations to the new sockopt_t/getsockopt_iter callback: - MCTP - LLC - X.25 - KCM These are mechanical, ABI-preserving conversions following the same pattern as the previously converted protocols (af_packet, can/raw, af_netlink, af_vsock): the (char __user *optval, int __user *optlen) pair is replaced with a single sockopt_t *opt that carries the buffer length on input and the returned size on output, and exposes an iov_iter for the copy-out path. put_user()/copy_to_user() pairs are replaced with a single copy_to_iter() per option, and the wrapper in do_sock_getsockopt() handles writing optlen back to userspace. I picked these four because each is small and self-contained. ==================== Link: https://patch.msgid.link/20260507-getsock_two-v2-0-5873111d9c12@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-10selftests: net: getsockopt_iter: cleanupBreno Leitao
Apply two cleanups suggested by Stanislav and bobby on the original selftest series: - Reorder local variable declarations into reverse christmas-tree order (longest line first). Because that ordering puts socklen_t optlen before the variable whose size it stores, the "optlen = sizeof(...)" initializer is moved out of the declaration to a plain assignment in the test body, as Stanislav suggested. - Add ASSERT_EQ(optlen, ...) on every error path so the value the kernel writes back to the userspace optlen is pinned down even when the syscall returns -1. With do_sock_getsockopt() now writing opt->optlen back to userspace unconditionally, asserting that the netlink/vsock error paths leave the original input length untouched guards against future regressions. Bobby Eshleman pointed out that SO_VM_SOCKETS_CONNECT_TIMEOUT_NEW/OLD return a sock_timeval-shaped payload (16 bytes on 64-bit), which is wider than the u64 case already covered. Add four tests that exercise this path: - connect_timeout_new_exact exact-size buffer - connect_timeout_new_oversize_clamped oversize buffer, clamped - connect_timeout_new_undersize undersize -> -EINVAL, optlen untouched - connect_timeout_old_exact exact-size buffer for OLD optname Suggested-by: Stanislav Fomichev <sdf@fomichev.me> Suggested-by: Bobby Eshleman <bobbyeshleman@meta.com> Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260507-getsock_two-v2-5-5873111d9c12@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-10kcm: convert to getsockopt_iterBreno Leitao
Convert KCM socket's getsockopt implementation to use the new getsockopt_iter callback with sockopt_t. Key changes: - Replace (char __user *optval, int __user *optlen) with sockopt_t *opt - Use opt->optlen for buffer length (input) and returned size (output) - Use copy_to_iter() instead of put_user()/copy_to_user() - Add linux/uio.h for copy_to_iter() Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260507-getsock_two-v2-4-5873111d9c12@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-10x25: convert to getsockopt_iterBreno Leitao
Convert X.25 socket's getsockopt implementation to use the new getsockopt_iter callback with sockopt_t. Key changes: - Replace (char __user *optval, int __user *optlen) with sockopt_t *opt - Use opt->optlen for buffer length (input) and returned size (output) - Use copy_to_iter() instead of put_user()/copy_to_user() - Add linux/uio.h for copy_to_iter() Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260507-getsock_two-v2-3-5873111d9c12@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-10llc: convert to getsockopt_iterBreno Leitao
Convert LLC socket's getsockopt implementation to use the new getsockopt_iter callback with sockopt_t. Key changes: - Replace (char __user *optval, int __user *optlen) with sockopt_t *opt - Use opt->optlen for buffer length (input) and returned size (output) - Use copy_to_iter() instead of put_user()/copy_to_user() - Add linux/uio.h for copy_to_iter() Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260507-getsock_two-v2-2-5873111d9c12@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-10mctp: convert to getsockopt_iterBreno Leitao
Convert MCTP socket's getsockopt implementation to use the new getsockopt_iter callback with sockopt_t. Key changes: - Replace (char __user *optval, int __user *optlen) with sockopt_t *opt - Use opt->optlen for buffer length (input) - Use copy_to_iter() instead of copy_to_user() - Add linux/uio.h for copy_to_iter() Signed-off-by: Breno Leitao <leitao@debian.org> Link: https://patch.msgid.link/20260507-getsock_two-v2-1-5873111d9c12@debian.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-10net: eth: fbnic: Fix addr validation in pcs writeMike Marciniszyn (Meta)
The DW IP has two distinct PCS address ranges cooresponding to the C45 PCS registers. The shim translates the PCS addr/regno into specific CSR writes into one of those two zero-relative ranges. This patch fixes a one off in the test that could allow an invalid CSR write if an addr == 2 was called. There are is of yet, no real impact for the bug as no PCS writes are present. Signed-off-by: Mike Marciniszyn (Meta) <mike.marciniszyn@gmail.com> Link: https://patch.msgid.link/20260507154203.3667-1-mike.marciniszyn@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-10Merge tag 'batadv-net-pullrequest-20260508' of https://git.open-mesh.org/batadvJakub Kicinski
Simon Wunderlich says: ==================== Here are some batman-adv bugfixes: - fix integer overflow on buff_pos, by Lyes Bourennani - fix invalid tp_meter access during teardown, by Jiexun Wang (2 patches) - stop caching unowned originator pointers in BAT IV, by Jiexun Wang - tp_meter: fix tp_num leak on kmalloc failure, by Sven Eckelmann - fix BLA refcounting issues, by Sven Eckelmann (3 patches) * tag 'batadv-net-pullrequest-20260508' of https://git.open-mesh.org/batadv: batman-adv: bla: put backbone reference on failed claim hash insert batman-adv: bla: only purge non-released claims batman-adv: bla: prevent use-after-free when deleting claims batman-adv: tp_meter: fix tp_num leak on kmalloc failure batman-adv: stop caching unowned originator pointers in BAT IV batman-adv: stop tp_meter sessions during mesh teardown batman-adv: reject new tp_meter sessions during teardown batman-adv: fix integer overflow on buff_pos ==================== Link: https://patch.msgid.link/20260508154314.12817-1-sw@simonwunderlich.de Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-10net: ena: PHC: Fix potential use-after-free in get_timestampArthur Kiyanovski
Move the phc->active check and resp pointer assignment to after acquiring the spinlock. Previously, phc->active was checked without holding the lock, and resp was cached from ena_dev->phc.virt_addr before the lock was acquired. If ena_com_phc_destroy() runs between the lockless active check and the lock acquisition, it sets active=false, releases the lock, frees the DMA memory, and sets virt_addr=NULL. The get_timestamp path would then read a NULL virt_addr and dereference it. With both the active check and the pointer read under the lock, destroy cannot free the memory while get_timestamp is using it. Fixes: e0ea34158ee8 ("net: ena: Add PHC support in the ENA driver") Cc: stable@vger.kernel.org Signed-off-by: Arthur Kiyanovski <akiyano@amazon.com> Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Link: https://patch.msgid.link/20260508062126.7273-1-akiyano@amazon.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-10drm/fourcc: Fix descriptions of 32b float formatsRobert Ancell
The channels were described in reverse format, i.e. RGBA instead of ABGR Signed-off-by: Robert Ancell <robert.ancell@canonical.com> CC: Rob Clark <robin.clark@oss.qualcomm.com> Reviewed-by: Simon Ser <contact@emersion.fr> Signed-off-by: Simon Ser <contact@emersion.fr> Link: https://patch.msgid.link/20260503235327.92428-1-robert.ancell@canonical.com
2026-05-10NFSD: Fix infinite loop in layout state revocationChuck Lever
find_one_sb_stid() skips stids whose sc_status is non-zero, but the SC_TYPE_LAYOUT case in nfsd4_revoke_states() never sets sc_status before calling nfsd4_close_layout(). The retry loop therefore finds the same layout stid on every iteration, hanging the revoker indefinitely. Fixes: 1e33e1414bec ("nfsd: allow layout state to be admin-revoked.") Reported-by: Dai Ngo <dai.ngo@oracle.com> Reviewed-by: Jeff Layton <jlayton@kernel.org> Tested-by: Dai Ngo <dai.ngo@oracle.com> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
2026-05-10sunrpc: start cache request seqno at 1 to fix netlink GET_REQSJeff Layton
sunrpc_cache_requests_snapshot() filters requests with crq->seqno <= min_seqno. The min_seqno for the first netlink dump call is cb->args[0] which is 0. Since next_seqno was initialized to 0, the very first cache request got seqno=0 and was silently skipped by the snapshot (0 <= 0 is true). This caused netlink-based GET_REQS to return 0 pending requests even when a request was queued, preventing mountd from resolving cache entries (particularly expkey/nfsd.fh). The unresolved CACHE_PENDING state blocked all further notifications for the entry, leading to permanent NFS4ERR_DELAY hangs. Start next_seqno at 1 so all requests have seqno >= 1 and pass the snapshot filter when min_seqno is 0. Fixes: facc4e3c8042 ("sunrpc: split cache_detail queue into request and reader lists") Signed-off-by: Jeff Layton <jlayton@kernel.org> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
2026-05-10nfsd: update mtime/ctime on COPY in presence of delegated attributesOlga Kornievskaia
When delegated attributes are given on open, the file is opened with NOCMTIME and modifying operations do not update mtime/ctime as to not get out-of-sync with the client's delegated view. However, for COPY operation, the server should update its view of mtime/ctime and reflect that in any GETATTR queries. Fixes: e5e9b24ab8fa ("nfsd: freeze c/mtime updates with outstanding WRITE_ATTRS delegation") Cc: stable@vger.kernel.org Signed-off-by: Olga Kornievskaia <okorniev@redhat.com> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
2026-05-10nfsd: update mtime/ctime on CLONE in presense of delegated attributesOlga Kornievskaia
When delegated attributes are given on open, the file is opened with NOCMTIME and modifying operations do not update mtime/ctime as to not get out-of-sync with the client's delegated view. However, for CLONE operation, the server should update its view of mtime/ctime and reflect that in any GETATTR queries. Fixes: e5e9b24ab8fa ("nfsd: freeze c/mtime updates with outstanding WRITE_ATTRS delegation") Cc: stable@vger.kernel.org Signed-off-by: Olga Kornievskaia <okorniev@redhat.com> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
2026-05-10nfsd: fix file change detection in CB_GETATTRScott Mayhew
RFC 8881, section 10.4.3 doesn't say anything about caching the file size in the delegation record, nor does it say anything about comparing a cached file size with the size reported by the client in the CB_GETATTR reply for the purpose of determining if the client holds modified data for the file. What section 10.4.3 of RFC 8881 does say is that the server should compare the *current* file size with the size reported by the client holding the delegation in the CB_GETATTR reply, and if they differ to treat it as a modification regardless of the change attribute retrieved via the CB_GETATTR. Doing otherwise would cause the server to believe the client holding the delegation has a modified version of the file, even if the client flushed the modifications to the server prior to the CB_GETATTR. This would have the added side effect of subsequent CB_GETATTRs causing updates to the mtime, ctime, and change attribute even if the client holding the delegation makes no further updates to the file. Modify nfsd4_deleg_getattr_conflict() to obtain the current file size via i_size_read(). Retain the ncf_cur_fsize field, since it's a convenient way to return the file size back to nfsd4_encode_fattr4(), but don't use it for the purpose of detecting file changes. Remove the unnecessary initialization of ncf_cur_fsize in nfs4_open_delegation(). Also, if we recall the delegation (because the client didn't respond to the CB_GETATTR), then skip the logic that checks the nfs4_cb_fattr fields. Fixes: c5967721e106 ("NFSD: handle GETATTR conflict with write delegation") Cc: stable@vger.kernel.org Signed-off-by: Scott Mayhew <smayhew@redhat.com> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
2026-05-10tools/ynl: add missing uapi header deps in Makefile.depsStanislav Fomichev
ethtool.h includes linux/typelimits.h which is a relatively new header not yet shipped in most distro kernel-header packages. Without the explicit entry, the build silently falls through to -idirafter. dev_energymodel.h is a new YNL family whose uapi header is not in system paths at all and was missing a CFLAGS entry entirely. Signed-off-by: Stanislav Fomichev <sdf@fomichev.me> Link: https://patch.msgid.link/20260508204114.205896-2-sdf@fomichev.me Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-10watchdog: rzn1: remove now obsolete interrupt supportWolfram Sang
Previously, it was overlooked that the watchdog could reset the system directly. So, a workaround using the interrupt which called emergency_restart() was implemented. We now configure the controller when booting properly to allow watchdog resets directly. Thus, remove the interrupt workaround. Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Reviewed-by: Herve Codina <herve.codina@bootlin.com> Link: https://lore.kernel.org/r/20260507102410.43384-4-wsa+renesas@sang-engineering.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-05-10dt-bindings: watchdog: Add watchdog compatible for RK3528Jonas Karlman
The RK3528 uses the same watchdog block as all previous Rockchip SoCs. So add a compatible for it to the soc-list. Signed-off-by: Jonas Karlman <jonas@kwiboo.se> Signed-off-by: Heiko Stuebner <heiko@sntech.de> Acked-by: Conor Dooley <conor.dooley@microchip.com> Link: https://lore.kernel.org/r/20260506092420.3320031-1-heiko@sntech.de Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-05-10watchdog: convert the Kconfig dependency on OF_GPIO to OFBartosz Golaszewski
OF_GPIO is selected automatically on all OF systems. Any symbols it controls also provide stubs so there's really no reason to select it explicitly. We could simply remove the dependency but in order to avoid a new symbol popping up for everyone in make config - just convert it to requiring CONFIG_OF. Reviewed-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260506081600.4921-1-bartosz.golaszewski@oss.qualcomm.com [groeck: Resolved conflict; updated dependencies to require OF _or_ ACPI] Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-05-10watchdog: Remove AMD Elan SC520 processor watchdog driverGuenter Roeck
AMD Elan support was removed from the upstream kernel with commit 8b793a92d862 ("x86/cpu: Remove M486/M486SX/ELAN support"). Its watchdog driver can no longer be enabled except for test builds. Remove it. Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-05-10watchdog: lenovo_se10_wdt: Fix use-after-free and resource leak riskMark Pearson
Review by sashiko.dev highlighted potential use after free and resource leak instances. Set se10_pdev to null to prevent use after free Remove DMI call back and instead directly call se10_create_platform_device. Handle error cases appropriately Link: https://sashiko.dev/#/patchset/20260428124954.1193450-1-mpearson-lenovo%40squebb.ca Signed-off-by: Mark Pearson <mpearson-lenovo@squebb.ca> Link: https://lore.kernel.org/r/20260504180159.999189-1-mpearson-lenovo@squebb.ca Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-05-10dt-bindings: watchdog: qcom-wdt: Document Shikra watchdogKomal Bajaj
Add devicetree binding for watchdog present on Qualcomm's Shikra SoC Signed-off-by: Komal Bajaj <komal.bajaj@oss.qualcomm.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260501-shikra-wdog-binding-v1-1-fd8c14bc2d20@oss.qualcomm.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-05-10watchdog: Prefix WDT with ICS for clarityPhilipp Hahn
`wdt.rst` is only about the Watchdog from "Industrial Computer Source" (ICS). Change the title and rename the file to better express this. Add missing SPDX license identifier `GPL-2.0-or-later` same as code to silence `checkpatch`. Fix wrong link to sample driver in drivers/watchdog/smsc37b787_wdt.c. Signed-off-by: Philipp Hahn <phahn-oss@avm.de> Link: https://lore.kernel.org/r/5a71979d8e8ab8e0a30de33f6aa2540b3b5dc1ee.1777972790.git.phahn-oss@avm.de Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-05-10watchdog: Separate kind of documentationPhilipp Hahn
Currently there are several (sub-)documents for "Generic kernel infrastructure API" and several "driver specific" documents. Put each one into its own sub-section. Signed-off-by: Philipp Hahn <phahn-oss@avm.de> Link: https://lore.kernel.org/r/7d1b722205bab83603832e66750f7b5f1f73eaa5.1777972790.git.phahn-oss@avm.de Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-05-10watchdog: Replace intermixed tab/space indentPhilipp Hahn
Consistently indent all lines with tabs instead of having one line using blanks. Signed-off-by: Philipp Hahn <phahn-oss@avm.de> Link: https://lore.kernel.org/r/e1ccbfb0efb9a9f508d1afe10263af1578a1aa46.1777972790.git.phahn-oss@avm.de Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-05-10watchdog: Move `struct` before namePhilipp Hahn
Write `struct ` before the structure name as Sphinx otherwise uses the following word after it. See https://docs.kernel.org/watchdog/watchdog-api.html#environmental-monitoring Signed-off-by: Philipp Hahn <phahn-oss@avm.de> Link: https://lore.kernel.org/r/e66ec58f3b8252b3676cc9fe68818af95123210c.1777972790.git.phahn-oss@avm.de Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-05-10watchdog: Change suffix .txt to .rst in referencesPhilipp Hahn
Fix link to documentation, which has already been converted to reST. Also remove apostrophes which are no longer needed. Signed-off-by: Philipp Hahn <phahn-oss@avm.de> Link: https://lore.kernel.org/r/bb1aa3129d5e52bc4c8e1ec3340b88f80f726fef.1777972790.git.phahn-oss@avm.de Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-05-10dt-bindings: watchdog: qcom-wdt: Add compatible for Nord watchdogDeepti Jaggi
Document Krait Processor Sub-system (KPSS) Watchdog timer on Nord SoC. Signed-off-by: Deepti Jaggi <deepti.jaggi@oss.qualcomm.com> Signed-off-by: Shawn Guo <shengchao.guo@oss.qualcomm.com> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260504081643.826038-1-shengchao.guo@oss.qualcomm.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-05-10watchdog: lenovo_se10_wdt: Add support for SE10 Gen 2 platformMark Pearson
The Lenovo SE10 Gen 2 platform uses a watchdog chip from the same family. Watchdog functionality is the same, so update the driver with the new chip ID. Add the Gen 2 MTM's to enable support on the platform. Tested on SE10 G2. Signed-off-by: Mark Pearson <mpearson-lenovo@squebb.ca> Link: https://lore.kernel.org/r/20260428124954.1193450-1-mpearson-lenovo@squebb.ca Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-05-10MAINTAINERS: Add entry for Andes ATCWDT200CL Wang
Add a MAINTAINERS entry for the Andes ATCWDT200 watchdog driver and its associated Device Tree bindings. Signed-off-by: CL Wang <cl634@andestech.com> Link: https://lore.kernel.org/r/20260115081444.2452357-4-cl634@andestech.com Signed-off-by: Guenter Roeck <linux@roeck-us.net>