summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-08-04memblock: always include KHO headersPratyush Yadav (Google)
In a coming commit, memblock will start using kho_scratch_overlap() without a compile guard. The compile guard for the function is in kexec_handover.h and provides a stub when CONFIG_KEXEC_HANDOVER is disabled. Since in memblock the call will exist unconditionally, always include the KHO headers. Including these headers unconditionally breaks memblock test compilation. Add stubs to fix that. Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org> Link: https://patch.msgid.link/20260801084833.1897543-20-pratyush@kernel.org Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-08-04kho: extend scratchPratyush Yadav (Google)
Motivation ========== The scratch space is allocated by the first kernel in the KHO chain, and is reused by all subsequent kernels. The size of the space is either set via the commandline by the system administrator or by calculating the amount of memory used by the kernel and adding a multiplier. In either case, the scratch space is a heuristic and is liable to fill up and fail allocation if a kernel uses more memory than expected. In addition, gigantic huge pages (usually 1 GiB) are allocated via memblock, and in a KHO boot that memory comes from the scratch space. In hypervisors it is common to dedicate a major part of the system's memory to gigantic hugepages for VM memory. If this memory needs to come from scratch space, then scratch needs to be greater than the memory needed for huge pages, which is impractical. In addition, hugepages can be preserved memory. Allocating them from scratch violates the assumption that scratch contains no preserved memory. Methodology =========== Discover areas that don't contain any preserved memory at boot by walking the preserved memory radix tree. Mark them as scratch to allow allocations from them. This makes KHO more resilient to memory pressure and allows supporting huge page preservation. Since the preserved memory radix tree mixes both physical address and order into a single key, and does not track table pages, it is difficult to identify free areas from it directly. Walk the tree and digest it down into another radix tree. The latter tracks blocks of KHO_SCRATCH_EXT_BLKSIZE (1 GiB as of now) granularity. Then walk the digested tree and mark the areas between the present keys as scratch. Performance =========== The discovery algorithm traverses the preserved memory radix tree exactly once. While it does use memory for the digested radix tree, since the blocks are split by 1 GiB, a single bitmap with 4k pages can track up to 32 TiB of memory. So there are likely to be very few radix tree pages used in this tracking. For systems with all physical memory below 32 TiB, this should result in a total of 6 pages being used (KHO_TREE_MAX_DEPTH == 6). An alternate way of achieving this would be to call kho_mem_retrieve() earlier in boot and mark all the KHO preservations as reserved. But that can blow up memblock.reserved with a bunch of 4K pages scattered everywhere, which will reduce performance of subsequent allocations. Since the free blocks are tracked in chunks of 1 GiB, this won't blow up memblock.memory as much. There is no inherent reason for using 1 GiB as the discovered block size. This can be changed later if needed. Currently, KHO is mainly targeted for server grade systems with hundreds of gigabytes to terabytes of memory. So 1 GiB is a reasonable granularity for those systems. For smaller systems this doesn't work as well, but we can arrive at a better heuristic when we have concrete use cases. Practical evaluation ==================== The testing is done on a x86_64 qemu VM running under KVM with 64G memory and 12 CPUs. The machine pre-allocates 50 1G pages. Since the performance scales with how busy the radix tree is, tests are done with 2 preservation patterns: first with two 1M memfds, second with two 1G memfds, both using 4k pages. Test case 1 - 1M memfd ~~~~~~~~~~~~~~~~~~~~~~ This test case has two memfds with 1M memory each in 4k pages, plus other preservations from LUO core and other KHO users. This is how the radix tree stats look like: radix_nodes: 0x13 nr_preservations: 0x214 mem_preserved: 0x227000 per order preservations: order 0: 0x20f order 1: 0x4 order 4: 0x1 and this is how long it takes to extend the scratch after KHO boot: KHO: KHO extend time: 47 us KHO: KHO extend total mem: 0xe6c17b000 (~57G) Test case 2 - 1G memfd ~~~~~~~~~~~~~~~~~~~~~~ This test case has two memfds with 1G memory each in 4k pages, plus other preservations from LUO core and other KHO users. This is how the radix tree stats look like: radix_nodes: 0x28 nr_preservations: 0x80816 mem_preserved: 0x80829000 per order preservations: order 0: 0x80811 order 1: 0x4 order 4: 0x1 and this is how long it takes to extend the scratch after KHO boot: KHO: KHO extend time: 22514 us KHO: KHO extend total mem: 0xd3f200000 (~52G) Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org> Link: https://patch.msgid.link/20260801084833.1897543-19-pratyush@kernel.org Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-08-04mm/mm_init: don't rely on memblock to get KHO scratch migratetypePratyush Yadav (Google)
Currently struct page init via memmap_init() or deferred_init_memmap() only queries the migrate type from KHO for each discrete memory range. That works currently since KHO scratch memory has a different memory type so it is always it its own region. An upcoming patch will add support for discovering blocks of memory with no preservations and it will mark it as MEMBLOCK_KHO_SCRATCH to allow allocations from them. This can lead to the bootmem KHO scratch areas to be merged into larger free ranges. This merging breaks the selection of migrate type. Get rid of memblock_is_kho_scratch_memory(). Instead, use kho_scratch_overlap() to decide the migrate type of the PFN. Since kho_scratch_migratetype() only uses KHO functions, move it to kexec_handover.h. Instead of calling kho_scratch_migratetype() once for each free range, call it once for each pageblock. Update pageblock_migratetype_init_range() and memmap_init_range() to do so. Since the migrate type is now evaluated for each pageblock and not each free range, drop the migratetype arguments to deferred_free_pages() and memmap_init_zone_range() and use MIGRATE_MOVABLE directly. Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org> Link: https://patch.msgid.link/20260801084833.1897543-18-pratyush@kernel.org Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-08-04kho: initialize preserved memory map radix tree earlierPratyush Yadav (Google)
Currently the preserved memory radix tree is initialized from kho_memory_init(), which happens relatively late in MM init. In a coming patch, the tree will be used from kho_memory_init_early(). Move the tree initialization there. Simplify some of the code in kho_mem_retrieve() by getting rid of the err variable and jumping to err directly. Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org> Link: https://patch.msgid.link/20260801084833.1897543-16-pratyush@kernel.org Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-08-04kho: initialize kho_scratch pointer earlier in bootPratyush Yadav (Google)
In a future patch, mm init will use kho_scratch_overlap() for deciding the migrate type of pageblocks it initializes. The earliest user currently is free_area_init(). kho_scratch_overlap() relies on kho_scratch pointer being initialized. Introduce kho_memory_init_early() to do this. kho_populate() would normally be a good place to do this, but unfortunately, phys_to_virt() does not work at that point on ARM64. So we need yet another initialization function. Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org> Link: https://patch.msgid.link/20260801084833.1897543-15-pratyush@kernel.org Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-08-04kho: expose kho_scratch_overlap() to kexec_handover.hPratyush Yadav (Google)
Support for discovering memory blocks with no preserved memory will be added in coming patches. These areas will also be marked as scratch to allow allocations from them. Memblock will switch to looking through the scratch array to decide the right migratetype. Expose kho_scratch_overlap() to KHO users. Since it is now used by non-debug code, move it out of kexec_handover_debug.c and into kexec_handover.c. Gate the overlap checks in kho_preserve_folio() and kho_preserve_pages() by IS_ENABLED(CONFIG_KEXEC_HANDOVER_DEBUG) instead. Since kexec_handover_debug.c is now empty, delete it. Add a stub for kho_scratch_overlap() to memblock tests to make sure it compiles. It will be used in memblock by a coming commit. No functional changes. Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org> Link: https://patch.msgid.link/20260801084833.1897543-14-pratyush@kernel.org Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-08-04kho: add kho_radix_init_tree()Pratyush Yadav (Google)
Move the initialization logic of the radix tree into kho_radix_init_tree() instead of having users open-code it. Makes the boundaries cleaner and reduces code duplication when a new user of the radix tree will be added in a future commit. Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org> Link: https://patch.msgid.link/20260801084833.1897543-13-pratyush@kernel.org Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-08-04kho: allow destroying KHO radix treePratyush Yadav (Google)
Add kho_radix_destroy_tree() which allows destroying the radix tree and freeing all its pages. This is will be used by the upcoming scratch extension mechanism. It creates a radix tree to track free blocks and then frees them after telling memblock about them. Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com> Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org> Link: https://patch.msgid.link/20260801084833.1897543-12-pratyush@kernel.org Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-08-04kho: allow early-boot usage of the KHO radix treePratyush Yadav (Google)
The KHO radix tree allocates memory for table pages from the buddy allocator using get_zeroed_page(). This is not available in early boot when memblock is still active. Using the radix tree in early boot is useful for KHO to track metadata about its memory. One such example is for tracking free blocks for memory allocation when scratch runs out of space. This feature will be added in the following commits. Add kho_radix_{alloc,free}_node() which allocate and free the table pages. They use slab_is_available() to decide which allocator to use. While slab_is_available() indicates availability of the slab allocator, it gets initialized right after buddy so it serves the same practical purpose. Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com> Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org> Link: https://patch.msgid.link/20260801084833.1897543-11-pratyush@kernel.org Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-08-04kho: add data argument to radix walk callbackPratyush Yadav (Google)
Add an opaque data pointer argument to kho_radix_walk_cb_t. This can be used by callers to pass extra information to the callback. Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com> Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org> Link: https://patch.msgid.link/20260801084833.1897543-10-pratyush@kernel.org Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-08-04kho: add callback for table pagesPratyush Yadav (Google)
The KHO memory preservation radix tree does not mark the table pages themselves as preserved. This is done to avoid a circular dependency where preserving a page can lead of allocating other preserved pages. This means any walker looking for free ranges of memory outside of scratch areas will ignore the table Add a table callback that is invoked for each table page. The callback is given the physical address of the table page. This is useful for the upcoming mechanism that discovers blocks of memory with no preserved pages and lets them be used for boot memory. Another use case is for users of the radix tree other than KHO itself. The radix tree does not preserve its own pages due to the circular dependency described above. But external users of the radix tree would need to preserve and restore their pages for the radix tree to survive past early boot. They can use this callback to do so. Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org> Link: https://patch.msgid.link/20260801084833.1897543-9-pratyush@kernel.org Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-08-04kho: add a struct for radix callbacksPratyush Yadav (Google)
A future commit will add more callbacks for the KHO radix tree. Add a struct for collecting the callbacks. Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org> Link: https://patch.msgid.link/20260801084833.1897543-8-pratyush@kernel.org Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-08-04kho: move all memory retrieval logic to kho_mem_retrieve()Pratyush Yadav (Google)
The memory retrieval logic is spread out across kho_mem_retrieve() and kho_memory_init(). The incoming scratch area is initialized at kho_memory_init(), and the error handling is done there too. Consolidate all this logic into kho_mem_retrieve() to make the code cleaner. Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org> Link: https://patch.msgid.link/20260801084833.1897543-7-pratyush@kernel.org Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-08-04kho: store incoming radix tree in kho_inPratyush Yadav (Google)
This allows other functions to also use the radix tree. While at it, add kho_get_mem_map() helper to get the virtual address of the preserved memory map and use that helper instead of duplicating the code to get the preserved memory map from the FDT. Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org> Link: https://patch.msgid.link/20260801084833.1897543-6-pratyush@kernel.org Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-08-04arm64: dts: Correct white-space styleKrzysztof Kozlowski
Correct a few white-space issues, like missing space before bracket '{' character or spurious space, which will be flagged by dt-check-style ("redundant-whitespace" warning). No functional changes. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Reviewed-by: Michal Simek <michal.simek@amd.com> # Versal NET Acked-by: Sven Peter <sven@kernel.org> # for apple dts Link: https://patch.msgid.link/20260801210210.383417-4-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2026-08-04ARM: dts: Correct white-space styleKrzysztof Kozlowski
Correct a few white-space issues, like missing space before bracket '{' character or spurious space, which will be flagged by dt-check-style ("redundant-whitespace" warning). No functional changes. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Reviewed-by: Michal Simek <michal.simek@amd.com> # Zynq Link: https://patch.msgid.link/20260801210210.383417-3-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2026-08-04arm64: dts: exynos: Correct white-space styleKrzysztof Kozlowski
Correct a few white-space issues, like missing space before bracket '{' character or spurious space, which will be flagged by dt-check-style ("redundant-whitespace" warning). No functional changes. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20260801210353.383880-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2026-08-03dma-buf/udmabuf: Disable the size limit by defaultRobert Mader
As udmabuf increasingly enjoys popularity - being used in projects like libcamera, Gstreamer, Mesa, KWin and Weston - users more frequently encounter cases where the current default size limit of 64MB is too low. Examples include allocating video buffers at a 8K resolution - and even 4K is affected when using non-subsampled video formats and high bit depths. In its current form the size limit for individual buffers does not seem to provide any additional level of protection - such as limiting the amount of memory a process can pin - as the later can just allocate multiple buffers. If additional guardrails are desired, they would likely require some kind accounting not limited to individual buffers. Therefor let's disable the size limit by default by setting it to the maximal possible value, INT_MAX. Signed-off-by: Robert Mader <robert.mader@collabora.com> Acked-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Link: https://lore.kernel.org/dri-devel/20260711144814.8205-1-robert.mader@collabora.com/ Link: https://lore.kernel.org/dri-devel/6764ca6f-b4d8-4baa-9d27-2ca867ac2d41@amd.com/ Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Link: https://patch.msgid.link/20260722110145.36641-1-robert.mader@collabora.com
2026-08-03Input: focaltech - use signed coordinates to prevent underflowDmitry Torokhov
focaltech_finger_state stores finger coordinates x and y as unsigned int. When processing relative packets, negative deltas can cause unsigned integer underflow if the finger moves past the left or bottom boundary of the touchpad, wrapping the coordinates to values near UINT_MAX. When clamping the coordinates in focaltech_report_state(), these underflowed values are clamped against priv->x_max / priv->y_max instead of 0, causing the cursor to jump erratically to the opposite edge of the touchpad. Change the coordinate variables and limits to signed int so that negative values resulting from relative movements clamp correctly to 0, and write the clamped values back to state in focaltech_report_state() to prevent coordinate wind-up accumulation at the touchpad boundaries. Fixes: 05be1d079ec0 ("Input: psmouse - support for the FocalTech PS/2 protocol extensions") Reported-by: sashiko-bot@kernel.org Link: https://patch.msgid.link/am_tH_F938rK6ask@google.com Assisted-by: Antigravity:gemini-3.6-flash Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-08-03Input: hynitron_cstxxx - validate touch count and finger IDsJianing Li
The driver allocates max_touch_num input slots, which are indexed from zero through max_touch_num - 1. The current check allows a finger ID equal to max_touch_num to reach cst3xx_report_contact(). While the input core ignores out-of-range slot indices, reporting touch data without a valid slot change corrupts the touch state of the previously active slot. The touch count is read from the controller's report and is used to index the fixed-size report buffer without first checking its range. Reject counts larger than the supported number of touch slots before checking the trailing byte or parsing touch data. Reject finger IDs equal to or greater than max_touch_num, and return immediately when an invalid finger ID is encountered so that corrupt touch frames are discarded instead of reporting partial contact state. The V821 Avaota F1 board configures the vendor driver with one touch slot, so finger ID 1 is already invalid on that device. Fixes: 66603243f528 ("Input: add driver for Hynitron cstxxx touchscreens") Signed-off-by: Jianing Li <m13940358460@163.com> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260804031339.2379-1-m13940358460@163.com Assisted-by: Antigravity:gemini-3.6-flash Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-08-04MAINTAINERS: add Ryan Chen and Billy Tsai as reviewer for ARM/ASPEEDBilly Tsai
Add Ryan Chen and myself as a reviewer for the ARM/ASPEED MACHINE SUPPORT entry to reflect ongoing review and contribution work on AST2xxx/AST27xx platform support. Signed-off-by: Billy Tsai <billy_tsai@aspeedtech.com> Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>
2026-08-04soc: aspeed: add missing MODULE_DEVICE_TABLE()Pengpeng Hou
The driver has an OF match table wired to .of_match_table, but does not export the table with MODULE_DEVICE_TABLE(). Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias information is generated for OF based module autoloading. This is a source-level fix. It does not claim dynamic hardware reproduction; the evidence is the driver-owned match table, its use by the platform driver, and the missing module alias publication. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>
2026-08-03selftests: ipc: change operation not supported error numberPaul White
The application doesn't know what ENOTSUPP means, as it is a kernelspace error code and the application doesn't have access to kernelspace error codes.I used EOPNOTSUPP in its place as that is an error number the application will recognize and know an operation is being attempted that it cannot support. Link: https://lore.kernel.org/20260720204001.1663473-1-paul.white.kernel@gmail.com Signed-off-by: Paul White <paul.white.kernel@gmail.com> Cc: Shuah Khan <shuah@kernel.org> Cc: Wei Yang <richard.weiyang@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03ocfs2: validate directory-index entry counts when reading metadataDoruk Tan Ozturk
ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() check the ECC and signature of an indexed-directory block before it reaches higher-level callers, but neither validator bounds the ocfs2_dx_entry_list counts against the capacity of the block that holds them. ocfs2_dx_dir_search() then walks for (i = 0; i < le16_to_cpu(entry_list->de_num_used); i++) dx_entry = &entry_list->de_entries[i]; over de_num_used entries with no bounds check. entry_list is either dx_leaf->dl_list (from ocfs2_read_dx_leaf) or, for an inline root, dx_root->dr_entries. A crafted on-disk image can set de_num_used (and de_count, which is the __counted_by_le() bound of de_entries) to 0xffff and make the walk read far past the end of the 4KB metadata block, giving a slab out-of-bounds read reachable from any path lookup, stat() or open() on an indexed directory once the image is mounted. Commit 775c17386a6f ("ocfs2: validate dx_root extent list fields during block read") already bounds dr_list for the non-inline dx_root, but left the inline dr_entries path and the dx_leaf dl_list unchecked. Add the same read-time validation for both entry lists: de_count must equal the capacity of the block (ocfs2_dx_entries_per_leaf()/per_root()) and de_num_used must not exceed de_count, rejecting corrupted metadata with -EFSCORRUPTED before ocfs2_dx_dir_search() can walk an out-of-range entry array. de_count is always written as exactly the block capacity when a leaf or inline root is formatted, so the equality check does not reject any valid image. Found by 0sec automated security-research tooling (https://0sec.ai). Link: https://lore.kernel.org/20260713205625.92391-1-doruk@0sec.ai Fixes: 9b7895efac90 ("ocfs2: Add a name indexed b-tree to directory inodes") Fixes: 4ed8a6bb083b ("ocfs2: Store dir index records inline") Assisted-by: 0sec:claude-opus-4-8 Signed-off-by: Doruk Tan Ozturk <doruk@0sec.ai> Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com> Cc: Joel Becker <jlbec@evilplan.org> Cc: Kees Cook <kees@kernel.org> Cc: Mark Fasheh <mark@fasheh.com> Cc: Junxiao Bi <junxiao.bi@oracle.com> Cc: Changwei Ge <gechangwei@live.cn> Cc: Jun Piao <piaojun@huawei.com> Cc: Heming Zhao <heming.zhao@suse.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03tools/accounting: fix macro typos in getdelaysShivank Sharma
Correct the spelling of PRINT_FILED_DELAY and PRINT_FILED_DELAY_WITH_TS to PRINT_FIELD_DELAY and PRINT_FIELD_DELAY_WITH_TS respectively. This resolves typo naming errors across the macro definitions and their matching inside print_delayacct(). Link: https://lore.kernel.org/20260716141545.1292951-1-shivanksharma2376543@gmail.com Signed-off-by: Shivank Sharma <shivanksharma2376543@gmail.com> Cc: Fan Yu <fan.yu9@zte.com.cn> Cc: Wang Yaxin <wang.yaxin@zte.com.cn> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03fat: release buffer head after rebuilding parentYichong Chen
fat_scan_logstart() leaves the matching directory entry's buffer head in sinfo.bh for the caller to release, just like fat_scan(). fat_rebuild_parent() uses the directory entry to rebuild the parent inode for the nostale_ro NFS export path, but does not release sinfo.bh after a successful scan. Release it once fat_build_inode() has consumed the directory entry data. Link: https://lore.kernel.org/20260715020957.1096309-1-chenyichong@uniontech.com Fixes: f1e6fb0ab451 ("fat (exportfs): rebuild directory-inode if fat_dget()") Signed-off-by: Yichong Chen <chenyichong@uniontech.com> Acked-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp> Cc: Christian Brauner <brauner@kernel.org> Cc: Amit Sahrawat <a.sahrawat@samsung.com> Cc: chenyichong <chenyichong@uniontech.com> Cc: Namjae Jeon <namjae.jeon@samsung.com> Cc: Ravishankar N <ravi.n1@samsung.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03raid6/kunit: add a benchmarkChristoph Hellwig
Add a benchmark to test the RAID 6 P/Q functions for more representative block sizes and numbers of disks. This splits the maximum alloc size used for the benchmark from the max size for the kunit test because recovery is currently limited to a single page at a time. Hopefully this will be fixed soon. The runtime numbers are reported in GB/s as the numbers of modern implementations are basically unreadable as MB/s. This means retro-architectures could report 0, but that is an easy tradeoff. Link: https://lore.kernel.org/20260715144825.95432-9-hch@lst.de Signed-off-by: Christoph Hellwig <hch@lst.de> Cc: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03raid6: improve the runtime selection benchmarkChristoph Hellwig
Use plain ktime_get_ns for the timing, use 8 + 2 disks for a realistic load, and report the throughput on the data disks as that is what storage systems are measured on. Link: https://lore.kernel.org/20260715144825.95432-8-hch@lst.de Signed-off-by: Christoph Hellwig <hch@lst.de> Cc: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03raid6: defer implementation selection when built-inChristoph Hellwig
Don't hold up early boot and defer the selection just like we've been doing for the RAID5 XOR code since commit 524ccdbdfb52 ("crypto: xor - defer load time benchmark to a later time"). This will also allow full use of the timing subsystem for benchmarking. Link: https://lore.kernel.org/20260715144825.95432-7-hch@lst.de Signed-off-by: Christoph Hellwig <hch@lst.de> Cc: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03raid6: enable lock context analysisChristoph Hellwig
The code doesn't have any locking, so this is trivial. Link: https://lore.kernel.org/20260715144825.95432-6-hch@lst.de Signed-off-by: Christoph Hellwig <hch@lst.de> Cc: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03xor/kunit: add a benchmarkChristoph Hellwig
Add a benchmark to test the XOR functions for more representative block sizes and numbers of disks. Including 64k would be useful here, but increasing the test buffer size increases the runtime of the functional kunit test too much unfortunately. The runtime numbers are reported in GB/s as the numbers of modern implementations are basically unreadable as MB/s. This means retro-architectures could report 0, but that is an easy tradeoff. Link: https://lore.kernel.org/20260715144825.95432-5-hch@lst.de Signed-off-by: Christoph Hellwig <hch@lst.de> Cc: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03xor/kunit: fix a spelling errorChristoph Hellwig
Link: https://lore.kernel.org/20260715144825.95432-4-hch@lst.de Signed-off-by: Christoph Hellwig <hch@lst.de> Cc: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03xor: improve the runtime selection benchmarkChristoph Hellwig
Use plain ktime_get_ns for the timing, use 4 + 1 disks for a realistic load, and report the throughput on the data disks instead of the that on the parity disk, which isn't all that useful. Link: https://lore.kernel.org/20260715144825.95432-3-hch@lst.de Signed-off-by: Christoph Hellwig <hch@lst.de> Cc: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03xor: enable lock context analysisChristoph Hellwig
Patch series "misc lib/raid/ improvements v2". This series improves the benchmark-based algorithm selection and adds kunit benchmarks for both the XOR and raid6 libraries, and tidies up a few very minor other bits. This patch (of 8): The code doesn't have any locking, so this is trivial. Link: https://lore.kernel.org/20260715144825.95432-1-hch@lst.de Link: https://lore.kernel.org/20260715144825.95432-2-hch@lst.de Signed-off-by: Christoph Hellwig <hch@lst.de> Cc: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03FAT: allow 0xE9 near jump in fat_read_static_bpb()Ziran Zhang
fat_read_static_bpb() only accepts a short jump as a valid bootstrap code signature for DOS 1.x volumes when the dos1xfloppy mount option is used. However, according to the Microsoft fatgen103.doc, the BS_jmpBoot field has two allowed forms: 0xEB 0x?? 0x90 (short jump + NOP) and 0xE9 0x?? 0x?? (near jump). The specification explicitly states that either form is acceptable. This patch relaxes the check to also accept 0xE9 as the first byte of the jump instruction. Link: https://lore.kernel.org/20260412070109.5197-1-zhangcoder@yeah.net Signed-off-by: Ziran Zhang <zhangcoder@yeah.net> Acked-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp> Cc: Christian Brauner <brauner@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03selftests/acct: share netlink helpersYiyang Chen
Extract the duplicated generic netlink boilerplate (netlink_open, send_request, get_family_id, and NLA walker macros) from cgroupstats.c and taskstats_fill_stats_tgid.c into a shared netlink_helper.{h,c}. Link: https://lore.kernel.org/a2adf27308b5cd90d50b59e8519b87da49486bee.1783876192.git.cyyzero16@gmail.com Signed-off-by: Yiyang Chen <cyyzero16@gmail.com> Suggested-by: Andrew Morton <akpm@linux-foundation.org> Acked-by: Balbir Singh <balbirs@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03ocfs2: cluster: use an on-stack bio for the heartbeat writeJoseph Qi
The disk heartbeat write always covers this node's own single slot, i.e. one heartbeat block that lives within a single page. It is submitted by o2hb_issue_node_write() and waited on by the caller before the ctxt goes out of scope, so its lifetime is well bounded. Turn it into an on-stack bio embedded in struct o2hb_bio_wait_ctxt rather than allocating one from the mempool. This removes any allocation from the fence-critical write path entirely: a delayed or blocked heartbeat write is what leads to the local node being fenced, so it should not depend on the state of a shared bio pool. Because the bio is embedded rather than allocated, add a dedicated o2hb_write_bio_end_io() that does not call bio_put(), and tear the bio down with bio_uninit() once the caller has waited on the I/O. The read path still allocates via o2hb_setup_one_bio() with GFP_NOFS, since it issues a variable number of bios in a loop. Link: https://lore.kernel.org/20260710071756.3586797-2-joseph.qi@linux.alibaba.com Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com> Cc: Mark Fasheh <mark@fasheh.com> Cc: Joel Becker <jlbec@evilplan.org> Cc: Junxiao Bi <junxiao.bi@oracle.com> Cc: Changwei Ge <gechangwei@live.cn> Cc: Jun Piao <piaojun@huawei.com> Cc: Heming Zhao <heming.zhao@suse.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03ocfs2: cluster: use GFP_NOFS for heartbeat bio allocationJoseph Qi
o2hb_setup_one_bio() allocates the heartbeat bio with GFP_ATOMIC. The disk heartbeat runs in the o2hb kernel thread (o2hb_do_disk_heartbeat), which is process context and can sleep, so there is no atomicity requirement here. GFP_ATOMIC lacks __GFP_DIRECT_RECLAIM, so the allocation is not served from the fs_bio_set mempool reserve and can return NULL under memory pressure. A failed heartbeat allocation aborts the heartbeat and can lead to the local node being fenced, which is exactly what the old comment worried about. Use GFP_NOFS instead. It keeps __GFP_DIRECT_RECLAIM so the allocation is backed by the fs_bio_set mempool and cannot fail, while avoiding recursion back into the filesystem during heartbeat I/O. As the allocation can no longer fail, drop the dead ERR_PTR(-ENOMEM) path in o2hb_setup_one_bio() and the now-redundant IS_ERR() handling in its callers. Link: https://lore.kernel.org/20260710071756.3586797-1-joseph.qi@linux.alibaba.com Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com> Cc: Mark Fasheh <mark@fasheh.com> Cc: Joel Becker <jlbec@evilplan.org> Cc: Junxiao Bi <junxiao.bi@oracle.com> Cc: Changwei Ge <gechangwei@live.cn> Cc: Jun Piao <piaojun@huawei.com> Cc: Heming Zhao <heming.zhao@suse.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03selftests/acct: add cgroupstats functional testYiyang Chen
Add a self-contained test for the CGROUPSTATS_CMD_GET genl command that covers three cases: - querying a cgroup v1 hierarchy and verifying the response contains non-zero task counts - rejecting an invalid fd without NLM_F_ACK - rejecting an invalid fd with NLM_F_ACK Link: https://lore.kernel.org/2a56921276f0962f97f00863e8c7d3c3f6893d5a.1783713230.git.cyyzero16@gmail.com Signed-off-by: Yiyang Chen <cyyzero16@gmail.com> Cc: Balbir Singh <balbirs@nvidia.com> Cc: Dr. Thomas Orgis <thomas.orgis@uni-hamburg.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03taskstats: return -EBADF when cgroupstats receives an invalid fdYiyang Chen
Patch series "taskstats: fix cgroupstats invalid fd handling and add selftests". This series fixes an issue where cgroupstats mishandles invalid file descriptors, and introduces a functional kselftest to prevent regressions. When an invalid file descriptor is passed via CGROUPSTATS_CMD_ATTR_FD, cgroupstats_user_cmd() returns 0 instead of an error code. This leads to two broken behaviors depending on netlink flags: - Callers without NLM_F_ACK block indefinitely on recv(). - Callers with NLM_F_ACK receive a misleading success ACK (errno == 0) but no actual statistics payload. The first patch addresses this by returning -EBADF when the fd cannot be resolved. The second patch adds a comprehensive kselftest covering both the valid cgroup v1 query and the invalid fd paths (with and without NLM_F_ACK) to ensure the fixes work as intended. This patch (of 2): cgroupstats_user_cmd() returns 0 without sending a reply or a netlink error when the fd passed via CGROUPSTATS_CMD_ATTR_FD does not resolve to an open file in the caller's table. As a result: - clients that did not set NLM_F_ACK block on recv() indefinitely waiting for a CGROUPSTATS_CMD_NEW message that is never emitted; - clients that set NLM_F_ACK receive a misleading "success" ACK (errno == 0) with no statistics payload. Return -EBADF instead so the netlink layer propagates the error to userspace as expected. Link: https://lore.kernel.org/cover.1783713230.git.cyyzero16@gmail.com Link: https://lore.kernel.org/b4fd9e288e4a48efebaf41b4ffcdb204b06675c4.1783713230.git.cyyzero16@gmail.com Signed-off-by: Yiyang Chen <cyyzero16@gmail.com> Acked-by: Balbir Singh <balbirs@nvidia.com> Cc: Dr. Thomas Orgis <thomas.orgis@uni-hamburg.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03ocfs2: validate rl_used against rl_count in refcount block validatorIbrahim Hashimov
ocfs2_find_refcount_rec_in_rl() walks the on-disk refcount record array with: for (; i < le16_to_cpu(rb->rf_records.rl_used); i++) { rec = &rb->rf_records.rl_recs[i]; ... rl_recs[] lives in a single metadata block (4096 bytes on the common configuration), so its real capacity is fixed by ocfs2_refcount_recs_per_rb(sb) (247 records for a 4K block with the 16-byte ocfs2_refcount_rec). rl_used and rl_count are both read directly off disk by ocfs2_validate_refcount_block() and are never checked against that capacity, nor against each other, before any refcount/reflink/CoW operation walks the array. A crafted (or corrupted) refcount block with rl_used == 0xffff makes the loop above walk far past the end of the block, dereferencing rl_recs[i] for i up to 65534. The resulting index is then handed to the sibling ocfs2_insert_refcount_rec(), whose insert-shift does: if (index < le16_to_cpu(rf_list->rl_used)) memmove(&rf_list->rl_recs[index + 1], &rf_list->rl_recs[index], (le16_to_cpu(rf_list->rl_used) - index) * sizeof(struct ocfs2_refcount_rec)); i.e. a memmove() of up to (0xffff - index) * 16 bytes (~1 MiB) from an offset already past the block. This is reachable from an ordinary reflink (FICLONE) against a crafted/corrupted ocfs2 image: attaching an extent whose cpos sorts past every real record in the leaf forces the lookup to run off the end instead of returning early on a match. The attacker model is local: CAP_SYS_ADMIN mounting a crafted or corrupted ocfs2 image, or a raw write to the block device backing an already-mounted ocfs2 filesystem. ocfs2_validate_refcount_block() already validates the block's ECC, signature, rf_blkno and rf_fs_generation, but never rl_count/rl_used against the block's actual on-disk capacity. This is the same class of gap that ocfs2_validate_extent_block() (fs/ocfs2/alloc.c) already closes for the sibling extent-list header, which checks both the record capacity and the "used" bound before any code walks h_list.l_recs[]: if (le16_to_cpu(eb->h_list.l_count) != ocfs2_extent_recs_per_eb(sb)) { rc = ocfs2_error(...); goto bail; } if (le16_to_cpu(eb->h_list.l_next_free_rec) > le16_to_cpu(eb->h_list.l_count)) { rc = ocfs2_error(...); goto bail; } Add the equivalent pair of checks to ocfs2_validate_refcount_block(): reject a refcount block whose rl_count does not match the fixed per-block capacity returned by ocfs2_refcount_recs_per_rb(), and reject rl_used > rl_count. Both checks are skipped when OCFS2_REFCOUNT_TREE_FL is set, because in that case the same union bytes hold an ocfs2_extent_list (rf_list), not the refcount record list (rf_records) -- that layout is already validated separately by ocfs2_validate_extent_block() when the referenced extent block is read. This mirrors the existing "!(rb->rf_flags & OCFS2_REFCOUNT_TREE_FL)" guard used elsewhere in this file (e.g. ocfs2_get_refcount_rec()) to decide whether rf_records or rf_list is the live member of the union. With this in place, a forged rl_used/rl_count is caught at block validation time (ocfs2_error()), consistent with every other corruption check in this function, instead of driving an out-of-bounds read in ocfs2_find_refcount_rec_in_rl() and a subsequent out-of-bounds memmove() in ocfs2_insert_refcount_rec(). Verified against a crafted image on a v6.19 KASAN (KASAN_GENERIC) build: replaying the same reflink (FICLONE) reliably hit a KASAN report in __ocfs2_increase_refcount()/ocfs2_insert_refcount_rec() before this patch, and triggers no report once ocfs2_validate_refcount_block() rejects the forged rl_used/rl_count. Link: https://lore.kernel.org/20260709132609.44233-1-security@auditcode.ai Fixes: f2c870e3b12e ("ocfs2: Add ocfs2_read_refcount_block.") Signed-off-by: Ibrahim Hashimov <security@auditcode.ai> Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com> Cc: Mark Fasheh <mark@fasheh.com> Cc: Joel Becker <jlbec@evilplan.org> Cc: Junxiao Bi <junxiao.bi@oracle.com> Cc: Changwei Ge <gechangwei@live.cn> Cc: Jun Piao <piaojun@huawei.com> Cc: Heming Zhao <heming.zhao@suse.com> Assisted-by: AuditCode-AI:2026.07 Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03rapidio: clear mport->net when rio_add_net() failsGuangshuo Li
rio_alloc_net() stores the newly allocated rio_net in mport->net before rio_scan_alloc_net() registers the device. If rio_add_net() fails, rio_scan_alloc_net() drops the device reference with put_device(), which releases the rio_net through the device release callback. However, mport->net is left pointing at the freed object. A later mport unregister path can then dereference the dangling mport->net pointer and may try to free the same rio_net again. Clear mport->net in the rio_add_net() failure path, matching the cleanup done for the destID table allocation failure path. Link: https://lore.kernel.org/20260708070628.721010-1-lgs201920130244@gmail.com Fixes: e842f9a1edf3 ("rapidio: add check for rio_add_net() in rio_scan_alloc_net()") Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com> Cc: Alexandre Bounine <alex.bou9@gmail.com> Cc: Matt Porter <mporter@kernel.crashing.org> Cc: Yang yingliang <yangyingliang@huawei.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03ocfs2: do not use make_bad_inode() in ocfs2_read_inode_block_full()Dmitry Antipov
This reverts commit 58b6fcd2ab34 ("ocfs2: mark inode bad upon validation failure during read"). Since 'make_bad_inode()' resets inode type to S_IFREG, doing this for directory inode during active VFS lookup is likely to confuse the latter, including VFS_BUG_ON_INODE() triggered in this case. Link: https://lore.kernel.org/20260709060101.207262-1-dmantipov@yandex.ru Fixes: 58b6fcd2ab34 ("ocfs2: mark inode bad upon validation failure during read") Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Suggested-by: Al Viro <viro@zeniv.linux.org.uk> Reported-by: syzbot+d222f4b7129379c3d5bc@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d222f4b7129379c3d5bc Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com> Cc: Mark Fasheh <mark@fasheh.com> Cc: Joel Becker <jlbec@evilplan.org> Cc: Junxiao Bi <junxiao.bi@oracle.com> Cc: Changwei Ge <gechangwei@live.cn> Cc: Jun Piao <piaojun@huawei.com> Cc: Heming Zhao <heming.zhao@suse.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03mailmap: add entry for Charlie JenkinsCharlie Jenkins
My Rivos email started bouncing so redirect to my personal email. Link: https://lore.kernel.org/20260709-mailmap-v1-1-74d98b8149d6@gmail.com Signed-off-by: Charlie Jenkins <thecharlesjenkins@gmail.com> Cc: Paul Walmsley <pjw@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03checkpatch: don't emit warnings for ID-base USB & PCI DT compatiblesChen-Yu Tsai
The USB and PCI device bindings define some compatible patterns based on device IDs that use the comma to separate vendor and product IDs. These prefix patterns include: - ^usb(if)?[0-9a-f]{1,4}, - ^pci[0-9a-f]{2,4}, - ^pciclass, These are not real vendor prefixes. Don't emit warnings for them. Instead just skip over the DT compatible check altogether, and leave the real check to the DT validator. This avoids false positive warnings about undocumented DT vendor prefixes and compatibles. Note that the script mostly only checks the first compatible string of each node, as it processes the source file line-by-line, and the check only matches on the line with 'compatible = "..."'. Otherwise there would be more warnings from arch/mips/boot/dts/loongson/ls7a-pch.dtsi since that file also includes compatibles like "pciclass0c0310" and "pciclass0c03" which are not accepted either. "pci0014,7a24.0" is not valid either, but this patch leaves the real check to the DT validator. Link: https://lore.kernel.org/20260707074629.3132930-1-wenst@chromium.org Signed-off-by: Chen-Yu Tsai <wenst@chromium.org> Reviewed-by: Brian Norris <briannorris@chromium.org> Tested-by: Brian Norris <briannorris@chromium.org> Cc: Andy Whitcroft <apw@canonical.com> Cc: Dwaipayan Ray <dwaipayanray1@gmail.com> Cc: Joe Perches <joe@perches.com> Cc: Lukas Bulwahn <lukas.bulwahn@gmail.com> Cc: Rob Herring <robh@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03.get_maintainer.ignore: add Nathan ChancellorNathan Chancellor
I do work all over the tree as part of ClangBuiltLinux and Kbuild, which ultimately results in a lot of irrelevant CCs when submitters run get_maintainer.pl with the default git fallback enabled. Add myself to .get_maintainer.ignore so I only get CC'd through explicitly maintained files/patterns or a submitter intentionally adding me to the list. Link: https://lore.kernel.org/20260707-add-nathan-to-get_maintainers-ignore-v1-1-810926e8eea3@kernel.org Signed-off-by: Nathan Chancellor <nathan@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03kernel/fork: declare max_threads __read_mostlyJianChunfu
max_threads is initialized once by fork_init()->set_max_threads(), and thereafter is mostly read in hot path, such as copy_process(). The fact that it is mostly read and not written to makes it candidates for __read_mostly declarations. I have already tested on my machine(arm64,256core,kernel-7.1.3) with 'hackbench -P -l 500 -g 100/500/1000/2000' and the results show that there is an average of 13% improvement in performance. before patch: hackbench -g 100 500 1000 2000 1.094 4.651 13.305 36.322 after patch: hackbench -g 100 500 1000 2000 0.823 4.487 11.107 32.987 Above data are the average values obtained from multiple tests, and there was indeed some fluctuation in the data during the tests. Link: https://lore.kernel.org/20260707092354.465847-1-jansef.jian@hj-micro.com Signed-off-by: JianChunfu <jansef.jian@hj-micro.com> Reviewed-by: Lorenzo Stoakes <ljs@kernel.org> Cc: Dietmar Eggemann <dietmar.eggemann@arm.com> Cc: Ingo Molnar <mingo@redhat.com> Cc: Kees Cook <kees@kernel.org> Cc: Liam R. Howlett <liam@infradead.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03Revert "printf: Compile the kunit test with DISABLE_BRANCH_PROFILING ↵Petr Mladek
DISABLE_BRANCH_PROFILING" This reverts commit 8901ac9d2c7eb8ed7ae5e749bf13ecb3b6062488. The commit 94bfc7f3b0c7 ("err.h: use __always_inline on all error pointer helpers") fixes the problem with a dead code elimination by always inlining IS_ERR() function. It prevents the related linker failures as well. The workaround with disabling branch profiling is not longer necessary. Link: https://lore.kernel.org/20260707135522.120447-1-pmladek@suse.com Signed-off-by: Petr Mladek <pmladek@suse.com> Suggested-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Closes: https://lore.kernel.org/r/ah6WDkwO8eYY5f2a@ashevche-desk.local Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Cc: Aleksander Lobakin <aleksander.lobakin@intel.com> Cc: Arnd Bergmann <arnd@arndb.de> Cc: David Laight <david.laight.linux@gmail.com> Cc: Nathan Chancellor <nathan@kernel.org> Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk> Cc: Sergey Senozhatsky <senozhatsky@chromium.org> Cc: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03taskstats: remove dead taskstats_exit_mutex declarationYiyang Chen
The extern declaration of taskstats_exit_mutex has never been defined nor referenced anywhere now. Just remove it. Link: https://lore.kernel.org/98948e69094b73d6dfa63dcf0770067b57f3becf.1783435695.git.cyyzero16@gmail.com Signed-off-by: Yiyang Chen <cyyzero16@gmail.com> Cc: Balbir Singh <balbirs@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-03ocfs2: validate external xattr entries when reading metadataCen Zhang
ocfs2_validate_xattr_block() checks the xattr block header before the block reaches higher-level xattr users, but it does not verify that a non-indexed block's xh_count and entry offsets fit inside the block. Indexed buckets likewise reach list/get consumers after ECC without an entry-bounds check. Use the flat xattr entry validator for non-indexed external xattr blocks, and use a bucket-specific validator for indexed buckets at metadata read time. The bucket validator keeps the entry array bounded by the first bucket block while checking name/value offsets against the bucket block they target. Reject corrupted external xattr metadata before listxattr() or getxattr() can walk out-of-range entry arrays or name/value offsets. Validation reproduced this kernel report: BUG: KASAN: use-after-free in ocfs2_xattr_list_entries+0xd7/0x190 Read of size 1 at addr ffff88810a654007 by task ocfs2_xattr_lis/630 Call Trace: dump_stack_lvl+0x66/0xa0 print_report+0xce/0x630 kasan_report+0xe0/0x110 ocfs2_xattr_list_entries+0xd7/0x190 ocfs2_listxattr+0x3f6/0x610 listxattr+0x90/0xe0 path_listxattrat+0xed/0x220 do_syscall_64+0x115/0x6a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Link: https://lore.kernel.org/20260705025311.3429854-3-zzzccc427@gmail.com Fixes: cf1d6c763fbc ("ocfs2: Add extended attribute support") Fixes: 0c044f0b24b9 ("ocfs2: Add xattr bucket iteration for large numbers of EAs") Signed-off-by: Cen Zhang <zzzccc427@gmail.com> Assisted-by: Codex:gpt-5.5 Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com> Cc: Mark Fasheh <mark@fasheh.com> Cc: Joel Becker <jlbec@evilplan.org> Cc: Junxiao Bi <junxiao.bi@oracle.com> Cc: Changwei Ge <gechangwei@live.cn> Cc: Jun Piao <piaojun@huawei.com> Cc: Heming Zhao <heming.zhao@suse.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>