summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-04-07bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()Weiming Shi
CO-RE accessor strings are colon-separated indices that describe a path from a root BTF type to a target field, e.g. "0:1:2" walks through nested struct members. bpf_core_parse_spec() parses each component with sscanf("%d"), so negative values like -1 are silently accepted. The subsequent bounds checks (access_idx >= btf_vlen(t)) only guard the upper bound and always pass for negative values because C integer promotion converts the __u16 btf_vlen result to int, making the comparison (int)(-1) >= (int)(N) false for any positive N. When -1 reaches btf_member_bit_offset() it gets cast to u32 0xffffffff, producing an out-of-bounds read far past the members array. A crafted BPF program with a negative CO-RE accessor on any struct that exists in vmlinux BTF (e.g. task_struct) crashes the kernel deterministically during BPF_PROG_LOAD on any system with CONFIG_DEBUG_INFO_BTF=y (default on major distributions). The bug is reachable with CAP_BPF: BUG: unable to handle page fault for address: ffffed11818b6626 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page Oops: Oops: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 85 Comm: poc Not tainted 7.0.0-rc6 #18 PREEMPT(full) RIP: 0010:bpf_core_parse_spec (tools/lib/bpf/relo_core.c:354) RAX: 00000000ffffffff Call Trace: <TASK> bpf_core_calc_relo_insn (tools/lib/bpf/relo_core.c:1321) bpf_core_apply (kernel/bpf/btf.c:9507) check_core_relo (kernel/bpf/verifier.c:19475) bpf_check (kernel/bpf/verifier.c:26031) bpf_prog_load (kernel/bpf/syscall.c:3089) __sys_bpf (kernel/bpf/syscall.c:6228) </TASK> CO-RE accessor indices are inherently non-negative (struct member index, array element index, or enumerator index), so reject them immediately after parsing. Fixes: ddc7c3042614 ("libbpf: implement BPF CO-RE offset relocation algorithm") Reported-by: Xiang Mei <xmei5@asu.edu> Signed-off-by: Weiming Shi <bestswngs@gmail.com> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Acked-by: Paul Chaignon <paul.chaignon@gmail.com> Link: https://lore.kernel.org/r/20260404161221.961828-2-bestswngs@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-07orangefs_readahead: don't overflow the bufmap slot.Mike Marshall
generic/340 showed that this caller of wait_for_direct_io was sometimes asking for more than a bufmap slot could hold. This splits the calls up if needed. Signed-off-by: Mike Marshall <hubcap@omnibond.com>
2026-04-07debugfs: take better advantage of strscpy.Mike Marshall
Signed-off-by: Mike Marshall <hubcap@omnibond.com>
2026-04-07orangefs: add usercopy whitelist to orangefs_op_cacheZiyi Guo
orangefs_op_cache is created with kmem_cache_create(), which provides no usercopy whitelist. orangefs_devreq_read() copies the tag and upcall fields directly from slab objects to userspace via copy_to_user(). With CONFIG_HARDENED_USERCOPY enabled, this triggers usercopy_abort(). Switch to kmem_cache_create_usercopy() with a whitelist covering the tag and upcall fields, matching the pattern already used by orangefs_inode_cache in super.c. Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu> Signed-off-by: Mike Marshall <hubcap@omnibond.com>
2026-04-07orangefs-debugfs.c: fix parsing problem with kernel debug keywords.Mike Marshall
When /sys/kernel/debug/orangefs/kernel-debug was set to a single keyword, the keyword was ignored. Now single and multiple keyword settings produce the expected debug output to the ring buffer. Signed-off-by: Mike Marshall <hubcap@omnibond.com>
2026-04-07drm/i915/pfit: Prevent negative coordinates in center modeNemesa Garg
When the pipe_src width or height are greater than adjusted_mode hdisplay and vdisplay, computed x and y offsets for center mode can be negative. Writing negative values into the pch_fit registers result in a state error. Add a check to clamp these values so that they are never negative. v2: Compare in terms of pipe_src width and height.[Ville] v3: Change width/height to pipe_src_w/h in logging. [Ville] Signed-off-by: Nemesa Garg <nemesa.garg@intel.com> Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com> Link: https://patch.msgid.link/20260402061310.111073-1-nemesa.garg@intel.com
2026-04-07KVM: s390: ucontrol: Fix memslot handlingClaudio Imbrenda
Fix memslots handling for UCONTROL guests. Attempts to delete user memslots will fail, as they should, without the risk of a NULL pointer dereference. Fixes: 413c98f24c63 ("KVM: s390: fake memslot for ucontrol VMs") Reviewed-by: Steffen Eiden <seiden@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
2026-04-07KVM: s390: selftests: enable some common memory-related testsClaudio Imbrenda
Enable the following tests on s390: * memslot_modification_stress_test * memslot_perf_test * mmu_stress_test Since the first two tests are now supported on all architectures, move them into TEST_GEN_PROGS_COMMON and out of the indiviual architectures. Reviewed-by: Steffen Eiden <seiden@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
2026-04-07KVM: selftests: Remove 1M alignment requirement for s390Claudio Imbrenda
Remove the 1M memslot alignment requirement for s390, since it is not needed anymore. Reviewed-by: Steffen Eiden <seiden@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
2026-04-07KVM: s390: Allow 4k granularity for memslotsClaudio Imbrenda
Until now memslots on s390 needed to have 1M granularity and be 1M aligned. Since the new gmap code can handle memslots with 4k granularity and alignment, remove the restrictions. Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Steffen Eiden <seiden@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
2026-04-07KVM: s390: Add alignment checks for hugepagesClaudio Imbrenda
When backing a guest page with a large page, check that the alignment of the guest page matches the alignment of the host physical page backing it within the large page. Also check that the memslot is large enough to fit the large page. Those checks are currently not needed, because memslots are guaranteed to be 1m-aligned, but this will change. Reviewed-by: Steffen Eiden <seiden@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
2026-04-07KVM: s390: Add some useful mask macrosClaudio Imbrenda
Add _{SEGMENT,REGION3}_FR_MASK, similar to _{SEGMENT,REGION3}_MASK, but working on gfn/pfn instead of addresses. Use them in gaccess.c instead of using the normal masks plus gpa_to_gfn(). Also add _PAGES_PER_{SEGMENT,REGION3} to make future code more readable. Reviewed-by: Steffen Eiden <seiden@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
2026-04-07net: hsr: emit notification for PRP slave2 changed hw addr on port deletionFernando Fernandez Mancera
On PRP protocol, when deleting the port the MAC address change notification was missing. In addition to that, make sure to only perform the MAC address change on slave2 deletion and PRP protocol as the operation isn't necessary for HSR nor slave1. Note that the eth_hw_addr_set() is correct on PRP context as the slaves are either in promiscuous mode or forward offload enabled. Reported-by: Luka Gejak <luka.gejak@linux.dev> Closes: https://lore.kernel.org/netdev/DHFCZEM93FTT.1RWFBIE32K7OT@linux.dev/ Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de> Reviewed-by: Felix Maurer <fmaurer@redhat.com> Link: https://patch.msgid.link/20260403123928.4249-2-fmancera@suse.de Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-04-08drm/exynos: Drop MAX_FB_BUFFER in favor of DRM_FORMAT_MAX_PLANESChen-Yu Tsai
MAX_FB_BUFFER refers to the maximum number of buffer planes for a framebuffer. This is the same as DRM_FORMAT_MAX_PLANES, which denotes the maximum number of planes. Signed-off-by: Chen-Yu Tsai <wenst@chromium.org> Tested-by: Marek Szyprowski <m.szyprowski@samsung.com> Acked-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Inki Dae <inki.dae@samsung.com>
2026-04-08drm/exynos: Drop exynos_drm_gem.size fieldChen-Yu Tsai
A size field is already included in the base GEM object, and is initialized through drm_gem_object_init() with the same value. Drop the field in the subclass to save some space. More changes to make exynos_drm_gem a subclass of drm_gem_dma_object will follow. Signed-off-by: Chen-Yu Tsai <wenst@chromium.org> Tested-by: Marek Szyprowski <m.szyprowski@samsung.com> Acked-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Inki Dae <inki.dae@samsung.com>
2026-04-08drm/exynos: Use DRM core dedicated DMA device tracking facilityChen-Yu Tsai
The exynos driver tracks a dedicated DMA device in its private data. The DRM core already has facilities to do this, and it is integrated into DRM PRIME imports and GEM DMA helpers. Convert the exynos driver to use the core's dedicated DMA device tracking facility. Also get rid of exynos_drm_gem_prime_import() as it is identical to drm_gem_prime_import() after the conversion. Signed-off-by: Chen-Yu Tsai <wenst@chromium.org> Tested-by: Marek Szyprowski <m.szyprowski@samsung.com> Acked-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Inki Dae <inki.dae@samsung.com>
2026-04-08drm/exynos: Internalize exynos_drm_gem_free_object()Chen-Yu Tsai
exynos_drm_gem_free_object() is only provided as a callback for GEM objects. It does not need to be exposed to the rest of the driver. Move it above where it is used and internalize it to just the GEM functions. Signed-off-by: Chen-Yu Tsai <wenst@chromium.org> Tested-by: Marek Szyprowski <m.szyprowski@samsung.com> Acked-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Inki Dae <inki.dae@samsung.com>
2026-04-07bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooksJiayuan Chen
bpf_lsm_task_to_inode() is called under rcu_read_lock() and bpf_lsm_inet_conn_established() is called from softirq context, so neither hook can be used by sleepable LSM programs. Fixes: 423f16108c9d8 ("bpf: Augment the set of sleepable LSM hooks") Reported-by: Quan Sun <2022090917019@std.uestc.edu.cn> Reported-by: Yinhao Hu <dddddd@hust.edu.cn> Reported-by: Kaiyan Mei <M202472210@hust.edu.cn> Reported-by: Dongliang Mu <dzm91@hust.edu.cn> Closes: https://lore.kernel.org/bpf/3ab69731-24d1-431a-a351-452aafaaf2a5@std.uestc.edu.cn/T/#u Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev> Link: https://lore.kernel.org/r/20260407122334.344072-1-jiayuan.chen@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-07ASoC: Merge up v7.0-rc7Mark Brown
Merge tag 'v7.0-rc7' to get fixes that make my CI happier.
2026-04-07Documentation: tracing: Add PCI controller event documentationShawn Lin
The PCI controller tracepoint, pcie_ltssm_state_transition, monitors the LTSSM state transition and data rate changes for debugging purposes. Add documentation for it. Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com> [mani: added MAINTAINERS entry] Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org> Link: https://patch.msgid.link/1774403912-210670-3-git-send-email-shawn.lin@rock-chips.com
2026-04-07RDMA/core: Fix memory free for GID tablezhenwei pi
When removing a RXE device, kernel oops: RIP: 0010:free_large_kmalloc+0xf6/0x140 Code: 75 28 0f 0b 44 0f b6 2d a5 d6 d1 01 41 80 fd 01 0f 87 7c d1 ad ff 41 83 e5 01 74 3d 41 bc 00 f0 ff ff 45 31 ed e9 61 ff ff ff <0f> 0b 48 c7 c6 af b1 70 83 48 89 df e8 79 0a fa ff 5b 41 5c 41 5d RSP: 0018:ffffd038c18074d8 EFLAGS: 00010293 RAX: 0017ffffc0000000 RBX: fffff86984219d00 RCX: 0000000000000000 RDX: 00000000000000f0 RSI: ffff899b88674000 RDI: fffff86984219d00 RBP: ffffd038c18074f0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff899b88674000 R13: 0000000000000001 R14: ffff899b88674000 R15: ffff899b86180000 FS: 00007b163c71c740(0000) GS:ffff899c378bf000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007b163c730200 CR3: 0000000106a1d000 CR4: 0000000000350ef0 Call Trace: <TASK> kfree+0x163/0x3a0 gid_table_release_one+0xaf/0xf0 [ib_core] ib_cache_release_one+0x66/0x80 [ib_core] ib_device_release+0x48/0xb0 [ib_core] device_release+0x44/0xa0 kobject_put+0x9b/0x250 put_device+0x13/0x30 ib_unregister_device_and_put+0x40/0x60 [ib_core] nldev_dellink+0xd3/0x140 [ib_core] rdma_nl_rcv_msg+0x11d/0x300 [ib_core] ? netlink_bind+0x141/0x3a0 rdma_nl_rcv_skb.constprop.0.isra.0+0xba/0x110 [ib_core] rdma_nl_rcv+0xe/0x20 [ib_core] netlink_unicast+0x28d/0x3e0 netlink_sendmsg+0x214/0x470 __sys_sendto+0x21f/0x230 __x64_sys_sendto+0x24/0x40 x64_sys_call+0x1888/0x26e0 do_syscall_64+0xcb/0x14d0 ? _copy_from_user+0x27/0x70 ? do_sock_setsockopt+0xbd/0x190 ? __sys_setsockopt+0x72/0xd0 ? __x64_sys_setsockopt+0x1f/0x40 ? x64_sys_call+0x221b/0x26e0 ? do_syscall_64+0x109/0x14d0 ? exc_page_fault+0x92/0x1c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e GID table is allocated by kzalloc_flex() instead of raw kzalloc_obj(), kfree() should not be called on the data_vec flex array. Fixes: cef2842c922c ("RDMA/core: Use kzalloc_flex for GID table") Link: https://patch.msgid.link/r/20260406132830.435381-2-zhenwei.pi@linux.dev Reported-by: syzbot+4334f9a250019c1b79b4@syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/69cc35ec.a70a0220.97f31.02a2.GAE@google.com Signed-off-by: zhenwei pi <zhenwei.pi@linux.dev> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2026-04-07PCI: trace: Add PCI controller tracepoint featureShawn Lin
Some PCI controllers may provide debug functionalities to track PCI bus activities like LTSSM state transitions and data rate changes. These will be very useful for debugging PCI link specific issues such as endpoint not getting detected or performance issues. Hence, implement the PCI controller tracepoint feature for recording LTSSM state transitions and data rate changes. Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com> [mani: commit log and maintainers entry] Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Tested-by: Anand Moon <linux.amoon@gmail.com> Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org> Link: https://patch.msgid.link/1774403912-210670-2-git-send-email-shawn.lin@rock-chips.com
2026-04-07platform/x86: dell-wmi-sysman: Fix typo in function commentThorsten Blum
s/Fress/Frees/ Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Link: https://patch.msgid.link/20260401094318.658932-2-thorsten.blum@linux.dev Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-04-07nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error pathShivam Kumar
In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected, nvmet_req_uninit() is called unconditionally. However, if the command arrived via the nvmet_tcp_handle_req_failure() path, nvmet_req_init() had returned false and percpu_ref_tryget_live() was never executed. The unconditional percpu_ref_put() inside nvmet_req_uninit() then causes a refcount underflow, leading to a WARNING in percpu_ref_switch_to_atomic_rcu, a use-after-free diagnostic, and eventually a permanent workqueue deadlock. Check cmd->flags & NVMET_TCP_F_INIT_FAILED before calling nvmet_req_uninit(), matching the existing pattern in nvmet_tcp_execute_request(). Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Shivam Kumar <kumar.shivam43666@gmail.com> Signed-off-by: Keith Busch <kbusch@kernel.org>
2026-04-07regulator: bd71828-regulator.c: Fix LDON-HEAD modeMatti Vaittinen
The ROHM BD72720 supports so called LDON-HEAD -mode, in which the buck10 is expected to be supplying power for an LDO. In this mode, the buck10 voltage will follow what is set for the LDO, on order to lower the power-loss in the LDO. This hardware configuration can be adverticed via the device-tree. When this is done, the Linux driver should omit registering the voltage control operations for the buck10, because the voltage control is now done by the hardware. This is done by modifying the buck10 regulator descriptor, before passing it to the regulator registration functions. There is an off-by-one error when the regulator descriptor array is indexed, and wrong descriptor is modified causing the LDO1 operations to be modified instead of the BUCK10 operations. Fix this by correcting the indexing. Signed-off-by: Matti Vaittinen <mazziesaccount@gmail.com> Fixes: f16a9d76a71d ("regulator: bd71828: Support ROHM BD72720") Link: https://patch.msgid.link/e7eef0bd407522ae5d9b7d0c4ec43f40b1dba833.1775565148.git.mazziesaccount@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-04-07platform/x86: dell-wmi-sysman: Clean up security buffer helpersThorsten Blum
In calculate_security_buffer(), call strlen() once and use ALIGN() to round up to an even size. In populate_security_buffer(), also avoid recomputing strlen(), rename the u32 pointer from 'seclen' to 'seclenp' to avoid confusion with the new length variable, and drop the memcpy() guard since calling it with size 0 is a no-op and therefore safe. Use 'const char *' for the read-only source string in both helpers. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Link: https://patch.msgid.link/20260331160310.608857-3-thorsten.blum@linux.dev Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-04-07xfs: use bio_await in xfs_zone_gc_reset_syncChristoph Hellwig
Replace the open-coded bio wait logic with the new bio_await helper. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Link: https://patch.msgid.link/20260407140538.633364-6-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-04-07block: add a bio_submit_or_kill helperChristoph Hellwig
Factor the common logic for the ioctl helpers to either submit a bio or end if the process is being killed. As this is now the only user of bio_await_chain, open code that. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Link: https://patch.msgid.link/20260407140538.633364-5-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-04-07block: factor out a bio_await helperChristoph Hellwig
Add a new helper to wait for a bio and anything chained off it to complete synchronously after submitting it. This factors common code out of submit_bio_wait and bio_await_chain and will also be useful for file system code and thus is exported. Note that this will now set REQ_SYNC also for the bio_await case for consistency. Nothing should look at the flag in the end_io handler, but if something does having the flag set makes more sense. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Link: https://patch.msgid.link/20260407140538.633364-4-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-04-07block: unify the synchronous bi_end_io callbacksChristoph Hellwig
Put the bio in bio_await_chain after waiting for the completion, and share the now identical callbacks between submit_bio_wait and bio_await_chain. Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Link: https://patch.msgid.link/20260407140538.633364-3-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-04-07xfs: fix number of GC bvecsChristoph Hellwig
GC scratch allocations can wrap around and use the same buffer twice, and the current code fails to account for that. So far this worked due to rounding in the block layer, but changes to the bio allocator drop the over-provisioning and generic/256 or generic/361 will now usually fail when running against the current block tree. Simplify the allocation to always pass the maximum value that is easier to verify, as a saving of up to one bvec per allocation isn't worth the effort to verify a complicated calculated value. Fixes: 102f444b57b3 ("xfs: rework zone GC buffer management") Signed-off-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Reviewed-by: Hans Holmberg <hans.holmberg@wdc.com> Link: https://patch.msgid.link/20260407140538.633364-2-hch@lst.de Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-04-07Merge tag 'rtw-next-2026-04-02' of https://github.com/pkshih/rtw into ↵Johannes Berg
wireless-next Ping-Ke Shih says: ================== rtw-next patches for -next Improve MLO and some random fixes. Notable changes are: * drop usb device reference across drivers rtw89: * add RTL8922DE but not enabled yet, because BT coexistence is still cooking. * add USB RX aggregation to improve performance. * add USB TX flow control by tracking in-flight URBs. ================== Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-07hwmon: (yogafan) various markup improvementsRandy Dunlap
There are several places in yogafan.rst where it appears that lines are meant to be presented on their own but instead they are strung together due to the lack of markups. Fix these issues by: - using bullets where needed - indenting continuation lines of bulleted items - using a table where appropriate - using a literal block where appropriate Fixes: c67c248ca406 ("hwmon: (yogafan) Add support for Lenovo Yoga/Legion fan monitoring") Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Link: https://lore.kernel.org/r/20260407052317.2097791-1-rdunlap@infradead.org Signed-off-by: Guenter Roeck <linux@roeck-us.net>
2026-04-07docs: add an Assisted-by mention to submitting-patches.rstJonathan Corbet
We now require disclosure of the use of coding assistants, but our core submitting-patches document does not mention that. Add a brief mention with a pointer to Documentation/process/coding-assistants.rst Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <877bqtlzug.fsf@trenco.lwn.net>
2026-04-07wifi: mac80211: enable MLO support for 4-address mode interfacesTamizh Chelvam Raja
The current code does not support establishing MLO connections for interfaces operating in 4-address AP_VLAN mode. MLO bringup is blocked by sanity checks in cfg.c, iface.c, and mlme.c, which prevent MLD initialization when use_4addr is enabled. Remove these restrictions to allow 4-address AP_VLAN interfaces to initialize as part of an MLD and successfully participate in MLO connections. This patch series also adds the necessary changes to support WDS operation in MLO, making these modifications valid. Allow 4-address mode interfaces to: - Proceed with MLD initialization during interface setup - Add MLO links dynamically via ieee80211_add_intf_link() - Establish associations with MLO-capable access points - Support AP_VLAN interfaces with MLO parent APs Signed-off-by: Tamizh Chelvam Raja <tamizh.raja@oss.qualcomm.com> Link: https://patch.msgid.link/20260326164723.553927-4-tamizh.raja@oss.qualcomm.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-07wifi: mac80211: use ap_addr for 4-address NULL frame destinationTamizh Chelvam Raja
Currently ieee80211_send_4addr_nullfunc() uses deflink.u.mgd.bssid for addr1 and addr3 fields. In MLO configurations, deflink.u.mgd.bssid represents link 0's BSSID and is not updated when link 0 is not an assoc link. This causes 4-address NULL frames to be sent to the wrong address, preventing WDS AP_VLAN interface creation on the peer AP. To fix this use sdata->vif.cfg.ap_addr instead, which contains the AP's MLD address populated during authentication/association and remains valid regardless of which links are active. This ensures 4-address NULL frames reach the correct AP, allowing proper WDS operation over MLO connections. Co-developed-by: Sathishkumar Muruganandam <quic_murugana@quicinc.com> Signed-off-by: Sathishkumar Muruganandam <quic_murugana@quicinc.com> Signed-off-by: Tamizh Chelvam Raja <tamizh.raja@oss.qualcomm.com> Link: https://patch.msgid.link/20260326164723.553927-3-tamizh.raja@oss.qualcomm.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-07wifi: mac80211: synchronize valid links for WDS AP_VLAN interfacesTamizh Chelvam Raja
The current code does not provide any link-configuration support for 4-address mode WDS AP_VLAN interfaces in MLO setups, preventing MLD stations from being added correctly. Add the required handling to enable proper integration of 4-address WDS stations into an MLO environment. When a 4-address station associates with an MLO AP, compute the intersection of valid links between the master AP interface and the station's advertised capabilities. Configure the AP_VLAN interface with only these common links to ensure correct data-path operation. This update ensures AP_VLAN interfaces correctly track link-state transitions and maintain consistent addressing across all active MLO links. Co-developed-by: Muna Sinada <muna.sinada@oss.qualcomm.com> Signed-off-by: Muna Sinada <muna.sinada@oss.qualcomm.com> Signed-off-by: Tamizh Chelvam Raja <tamizh.raja@oss.qualcomm.com> Link: https://patch.msgid.link/20260326164723.553927-2-tamizh.raja@oss.qualcomm.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-07selftests/ublk: add read-only buffer registration testMing Lei
Add --rdonly_shmem_buf option to kublk that registers shared memory buffers with UBLK_SHMEM_BUF_READ_ONLY (read-only pinning without FOLL_WRITE) and mmaps with PROT_READ only. Add test_shmemzc_04.sh which exercises the new flag with a null target, hugetlbfs buffer, and write workload. Write I/O works because the server only reads from the shared buffer — the data flows from client to kernel to the shared pages, and the server reads them out. Signed-off-by: Ming Lei <ming.lei@redhat.com> Link: https://patch.msgid.link/20260331153207.3635125-11-ming.lei@redhat.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-04-07selftests/ublk: add filesystem fio verify test for shmem_zcMing Lei
Add test_shmemzc_03.sh which exercises shmem_zc through the full filesystem stack: mkfs ext4 on the ublk device, mount it, then run fio verify on a file inside the filesystem with --mem=mmaphuge. Extend _mkfs_mount_test() to accept an optional command that runs between mount and umount. The function cd's into the mount directory so the command can use relative file paths. Existing callers that pass only the device are unaffected. Signed-off-by: Ming Lei <ming.lei@redhat.com> Link: https://patch.msgid.link/20260331153207.3635125-10-ming.lei@redhat.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-04-07selftests/ublk: add hugetlbfs shmem_zc test for loop targetMing Lei
Add test_shmem_zc_02.sh which tests the UBLK_IO_F_SHMEM_ZC zero-copy path on the loop target using a hugetlbfs shared buffer. Both kublk and fio mmap the same hugetlbfs file with MAP_SHARED, sharing physical pages. The kernel's PFN matching enables zero-copy — the loop target reads/writes directly from the shared buffer to the backing file. Uses standard fio --mem=mmaphuge:<path> (supported since fio 1.10), no patched fio required. Signed-off-by: Ming Lei <ming.lei@redhat.com> Link: https://patch.msgid.link/20260331153207.3635125-9-ming.lei@redhat.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-04-07selftests/ublk: add shared memory zero-copy testMing Lei
Add test_shmem_zc_01.sh which tests UBLK_IO_F_SHMEM_ZC on the null target using a hugetlbfs shared buffer. Both kublk (--htlb) and fio (--mem=mmaphuge:<path>) mmap the same hugetlbfs file with MAP_SHARED, sharing physical pages. The kernel PFN match enables zero-copy I/O. Uses standard fio --mem=mmaphuge:<path> (supported since fio 1.10), no patched fio required. Signed-off-by: Ming Lei <ming.lei@redhat.com> Link: https://patch.msgid.link/20260331153207.3635125-8-ming.lei@redhat.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-04-07selftests/ublk: add UBLK_F_SHMEM_ZC support for loop targetMing Lei
Add loop_queue_shmem_zc_io() which handles I/O requests marked with UBLK_IO_F_SHMEM_ZC. When the kernel sets this flag, the request data lives in a registered shared memory buffer — decode index + offset from iod->addr and use the server's mmap as the I/O buffer. The dispatch check in loop_queue_tgt_rw_io() routes SHMEM_ZC requests to this new function, bypassing the normal buffer registration path. Signed-off-by: Ming Lei <ming.lei@redhat.com> Link: https://patch.msgid.link/20260331153207.3635125-7-ming.lei@redhat.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-04-07selftests/ublk: add shared memory zero-copy support in kublkMing Lei
Add infrastructure for UBLK_F_SHMEM_ZC shared memory zero-copy: - kublk.h: struct ublk_shmem_entry and table for tracking registered shared memory buffers - kublk.c: per-device unix socket listener that accepts memfd registrations from clients via SCM_RIGHTS fd passing. The listener mmaps the memfd and registers the VA range with the kernel for PFN matching. Also adds --shmem_zc command line option. - kublk.c: --htlb <path> option to open a pre-allocated hugetlbfs file, mmap it with MAP_SHARED|MAP_POPULATE, and register it with the kernel via ublk_ctrl_reg_buf(). Any process that mmaps the same hugetlbfs file shares the same physical pages, enabling zero-copy without socket-based fd passing. Signed-off-by: Ming Lei <ming.lei@redhat.com> Link: https://patch.msgid.link/20260331153207.3635125-6-ming.lei@redhat.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-04-07wifi: mac80211: handle VHT EXT NSS in ieee80211_determine_our_sta_mode()Nicolas Escande
A station which has a NSS ratio on the number of streams it is capable of in 160MHz VHT operation is supposed to use the 'Extended NSS BW Support' as defined by section '9.4.2.156.2 VHT Capabilities Information field'. This was missing in ieee80211_determine_our_sta_mode() and so we would wrongfully downgrade our bandwidth when connecting to an AP that supported 160MHz with messages such as: [ 37.638346] wlan1: AP XX:XX:XX:XX:XX:XX changed bandwidth in assoc response, new used config is 5280.000 MHz, width 3 (5290.000/0 MHz) Fixes: 310c8387c638 ("wifi: mac80211: clean up connection process") Signed-off-by: Nicolas Escande <nico.escande@gmail.com> Link: https://patch.msgid.link/20260327100256.3101348-1-nico.escande@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-07wifi: mac80211: remove unused variables in minstrel_ht_alloc_staJiajia Liu
Remove the unused variable max_rates and related code. Also remove the variable mi and pass type to kzalloc_obj instead. Signed-off-by: Jiajia Liu <liujiajia@kylinos.cn> Link: https://patch.msgid.link/20260407063205.68471-1-liujiajia@kylinos.cn Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-07ublk: eliminate permanent pages[] array from struct ublk_bufMing Lei
The pages[] array (kvmalloc'd, 8 bytes per page = 2MB for a 1GB buffer) was stored permanently in struct ublk_buf but only needed during pin_user_pages_fast() and maple tree construction. Since the maple tree already stores PFN ranges via ublk_buf_range, struct page pointers can be recovered via pfn_to_page() during unregistration. Make pages[] a temporary allocation in ublk_ctrl_reg_buf(), freed immediately after the maple tree is built. Rewrite __ublk_ctrl_unreg_buf() to iterate the maple tree for matching buf_index entries, recovering struct page pointers via pfn_to_page() and unpinning in batches of 32. Simplify ublk_buf_erase_ranges() to iterate the maple tree by buf_index instead of walking the now-removed pages[] array. Signed-off-by: Ming Lei <ming.lei@redhat.com> Link: https://patch.msgid.link/20260331153207.3635125-5-ming.lei@redhat.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-04-07Merge tag 'linux-cpupower-7.1-rc1' of ↵Rafael J. Wysocki
git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux Pull cpupower utility updates for 7.1-rc1 from Shuah Khan: "- Fixes errors in cpupower-frequency-info short option names to its manpage. - Fixes cpupower-idle-info perf option name to its manpage. - Adds boost and epp options to cpupower-frequency-info to its manpage. - Adds description for perf-bias option to cpupower-info to its manpage. - Removes unnecessary extern declarations from getopt.h in arguments parsing functions in cpufreq-set, cpuidle-info, cpuidle-set, cpupower-info, and cpupower-set utilities. These functions are defined getopt.h file." * tag 'linux-cpupower-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux: cpupower: remove extern declarations in cmd functions cpupower-info.1: describe the --perf-bias option cpupower-frequency-info.1: document --boost and --epp options cpupower-frequency-info.1: use the proper name of the --perf option cpupower-idle-info.1: fix short option names
2026-04-07ublk: enable UBLK_F_SHMEM_ZC feature flagMing Lei
Add UBLK_F_SHMEM_ZC (1ULL << 19) to the UAPI header and UBLK_F_ALL. Switch ublk_support_shmem_zc() and ublk_dev_support_shmem_zc() from returning false to checking the actual flag, enabling the shared memory zero-copy feature for devices that request it. Signed-off-by: Ming Lei <ming.lei@redhat.com> Link: https://patch.msgid.link/20260331153207.3635125-4-ming.lei@redhat.com [axboe: ublk_buf_reg -> ublk_shmem_buf_reg errors] Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-04-07wifi: brcmfmac: silence warning for non-existent, optional firmwareAlexander Stein
The driver tries to load optional firmware files, specific to the actual board compatible. These might not exist resulting in a warning like this: brcmfmac mmc2:0001:1: Direct firmware load for brcm/brcmfmac4373-sdio.tq,imx93-tqma9352-mba93xxla-mini.bin failed with error -2 Silence this by using firmware_request_nowait_nowarn() for all firmware loads which use brcmf_fw_request_done_alt_path() as callback. This one handles optional firmware files. Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com> Tested-by: Christian Hewitt <christianshewitt@gmail.com> [arend: use nowarn api for optional firmware files] Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Link: https://patch.msgid.link/20260328140121.2583606-1-arend.vanspriel@broadcom.com [clean up code a bit] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-07ublk: add PFN-based buffer matching in I/O pathMing Lei
Add ublk_try_buf_match() which walks a request's bio_vecs, looks up each page's PFN in the per-device maple tree, and verifies all pages belong to the same registered buffer at contiguous offsets. Add ublk_iod_is_shmem_zc() inline helper for checking whether a request uses the shmem zero-copy path. Integrate into the I/O path: - ublk_setup_iod(): if pages match a registered buffer, set UBLK_IO_F_SHMEM_ZC and encode buffer index + offset in addr - ublk_start_io(): skip ublk_map_io() for zero-copy requests - __ublk_complete_rq(): skip ublk_unmap_io() for zero-copy requests The feature remains disabled (ublk_support_shmem_zc() returns false) until the UBLK_F_SHMEM_ZC flag is enabled in the next patch. Signed-off-by: Ming Lei <ming.lei@redhat.com> Link: https://patch.msgid.link/20260331153207.3635125-3-ming.lei@redhat.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-14 13:05:38 +0000