| Age | Commit message (Collapse) | Author |
|---|
|
Daniel Machon says:
====================
net: sparx5: misc fixes for sparx5 and lan969x
This series fixes various issues in the sparx5 driver, which also
serves lan969x.
Details are in the individual commit descriptions.
====================
Link: https://patch.msgid.link/20260817-misc-fixes-sparx5-lan969x-v3-0-c7c7fef723a8@microchip.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
sparx5_set_rx_mode() runs with netif_addr_lock_bh held and iterates
dev->mc via __dev_mc_sync(), which per address calls sparx5_mc_sync() /
sparx5_mc_unsync() -> sparx5_mact_learn() / sparx5_mact_forget(). These
take sparx5->lock, a mutex, and then poll the MAC access command
register with readx_poll_timeout(). A mutex may block, which is not
allowed from atomic context.
Convert the driver to the new .ndo_set_rx_mode_async callback introduced
in commit 3554b4345d85 ("net: introduce ndo_set_rx_mode_async and
netdev_rx_mode_work"). The async callback is invoked from process
context, so the mutex and sleeping completion poll can remain.
Observed with CONFIG_PROVE_LOCKING, CONFIG_DEBUG_SPINLOCK,
CONFIG_DEBUG_MUTEXES and CONFIG_DEBUG_ATOMIC_SLEEP enabled:
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:591
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 217, name: ip
preempt_count: 201, expected: 0
Call trace:
__might_resched+0x144/0x248
__might_sleep+0x48/0x7c
__mutex_lock+0x74/0x850
mutex_lock_nested+0x24/0x30
sparx5_mact_learn+0x78/0x100
sparx5_mc_sync+0x40/0x54
__hw_addr_sync_dev+0xc4/0x170
sparx5_set_rx_mode+0x4c/0x58
__dev_set_rx_mode+0x64/0xa4
__dev_open+0x1ec/0x26c
Fixes: d6fce5141929 ("net: sparx5: add switching support")
Signed-off-by: Daniel Machon <daniel.machon@microchip.com>
Link: https://patch.msgid.link/20260817-misc-fixes-sparx5-lan969x-v3-2-c7c7fef723a8@microchip.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
sparx5_vcap_init() runs before sparx5_register_netdevs() in probe, and
its debugfs setup calls vcap_port_debugfs() for every port using
netdev_name(ndev) as the debugfs file name. At that point the netdevs
have only been allocated, not registered, so dev->name still holds the
"eth%d" template and netdev_name() returns "(unnamed net_device)".
Every port tries to create the same file under vcaps/, producing a
flood of warnings at boot:
debugfs: '(unnamed net_device)' already exists in 'vcaps'
debugfs: '(unnamed net_device)' already exists in 'vcaps'
...
Add vcap_port_debugfs_portno(), a variant of vcap_port_debugfs() that
takes the port's stable hardware port number and uses "p%u" as the
debugfs file name instead of netdev_name(ndev). This makes the file
name independent of registration order; the file still stores and
later dereferences the netdev itself, same as before. sparx5 already
reports the same "p%d" string via ndo_get_phys_port_name(), so the
debugfs name now matches that.
Only sparx5 (and lan969x, which shares this code) is switched to the
new function. lan966x keeps calling vcap_port_debugfs() unchanged, so
this fix does not rename any of its existing debugfs files.
Fixes: b8909aad5b8d ("net: sparx5: move netdev and notifier block registration to probe")
Signed-off-by: Daniel Machon <daniel.machon@microchip.com>
Link: https://patch.msgid.link/20260817-misc-fixes-sparx5-lan969x-v3-1-c7c7fef723a8@microchip.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
PDP contexts can be deleted through GTP_CMD_DELPDP or while the GTP
network device is being unregistered. The latter is serialized by RTNL,
but the generic-netlink delete path only holds RCU.
Running both paths concurrently can therefore make both paths delete the
same PDP context. The issue was found through static analysis and
reproduced on a KASAN-enabled kernel by a simple two-thread program
racing GTP_CMD_DELPDP against RTM_DELLINK:
Oops: general protection fault, probably for non-canonical address
KASAN: maybe wild-memory-access in range
[0xdead000000000120-0xdead000000000127]
RIP: gtp_genl_del_pdp+0x1c1/0x420 [gtp]
RBP: dead000000000122
The second deletion dereferenced the poisoned hlist pprev pointer.
Serialize gtp_pdp_add(), gtp_genl_del_pdp(), and gtp_dellink() with a
shared mutex. Keep the mutex held until the final use of a PDP context in
the NEWPDP path, and keep the RCU read-side section around the complete
PDP context use in the DELPDP path.
Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)")
Cc: stable@vger.kernel.org
Signed-off-by: Qing Ming <a0yami@mailbox.org>
Link: https://patch.msgid.link/20260818150000.7670-1-a0yami@mailbox.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
xdp_convert_zc_to_xdp_frame() clones an XSK packet into an order-0 page
and advertises PAGE_SIZE as its frame size. It allows the copied frame
to occupy the page tail needed by skb_shared_info and records zero
headroom even when metadata separates the frame header from packet data.
An AF_XDP zero-copy packet redirected through cpumap can therefore make
the skb overlap skb_shared_info or place it beyond the allocated page.
Limit the copied layout to SKB_WITH_OVERHEAD(PAGE_SIZE) and include the
metadata length in frame headroom. Redirect callers already handle a
NULL conversion result.
BUG: KASAN: slab-out-of-bounds in skb_gro_receive
Write of size 4 at addr ffff88800cf37004 by task cpumap/1/map:1/146
Call Trace:
skb_gro_receive (net/core/gro.c:174)
udp_gro_receive (net/ipv4/udp_offload.c:812)
inet_gro_receive (net/ipv4/af_inet.c:1539)
dev_gro_receive (net/core/gro.c:515)
gro_receive_skb (net/core/gro.c:633)
cpu_map_kthread_run (kernel/bpf/cpumap.c:395)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:164)
ret_from_fork_asm (arch/x86/entry/entry_64.S:255)
Kernel panic - not syncing: KASAN: panic_on_warn set ...
Fixes: b0d1beeff2a9 ("xdp: implement convert_to_xdp_frame for MEM_TYPE_ZERO_COPY")
Cc: stable@vger.kernel.org
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Link: https://patch.msgid.link/20260818154516.793517-1-bestswngs@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
Koichiro Den says:
====================
net: ntb_netdev: Fix RX statistics accounting
This series addresses Jakub's comment on ntb_netdev RX statistics
accounting:
https://lore.kernel.org/r/20260818092938.4121c220@kernel.org/
It fixes the double counting and also the related packet/byte accounting
on RX refill failure.
====================
Link: https://patch.msgid.link/20260819172539.1450821-1-den@valinux.co.jp
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
When replacement skb allocation fails, ntb_netdev drops a packet that
was received successfully and requeues the original buffer. The drop is
counted, but rx_packets and rx_bytes are not.
Count every good packet before allocating its replacement.
Fixes: d2121faf133a ("NTB: ntb_netdev: Preserve RX queue depth on allocation failure")
Cc: stable@vger.kernel.org
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Link: https://patch.msgid.link/20260819172539.1450821-3-den@valinux.co.jp
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
netif_rx() already accounts packets it drops in the core rx_dropped
counter. ntb_netdev counts them again as both errors and drops.
Leave netif_rx() drops to the core. Count the packet and bytes
unconditionally since it was received successfully by the driver.
Fixes: 548c237c0a99 ("net: Add support for NTB virtual ethernet device")
Cc: stable@vger.kernel.org
Suggested-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Koichiro Den <den@valinux.co.jp>
Link: https://patch.msgid.link/20260819172539.1450821-2-den@valinux.co.jp
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
tcp_select_initial_window() assumes that callers never pass an MSS
smaller than 1, but route-derived advmss values can violate that
assumption.
A too-small explicit RTAX_ADVMSS is one way to get there, but it is not
the only one. The same divide-by-zero can also be reached through the
"default advmss" path when RTAX_ADVMSS is left at 0 and the effective
advmss is later driven down by route MTU and min_adv_mss.
Introduce a tcp_dst_advmss() helper that clamps route advmss to
TCP_MIN_MSS before TCP consumes it, and use it in the TCP paths that
derive advmss from dst metrics. This keeps the effective MSS from
dropping to zero before tcp_select_initial_window() rounds the receive
window.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Signed-off-by: Yong Wang <edragain@163.com>
Signed-off-by: Ren Wei <weir@nebusec.ai>
Link: https://patch.msgid.link/251eaf8277fa7c66364c9815c5da01662d269181.1787074852.git.edragain@163.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
In collect_md mode ipip_tunnel_rcv() returns 0 without freeing the skb
when ip_tun_rx_dst() fails to allocate the metadata_dst. ipip_rcv() and
mplsip_rcv() are registered as xfrm_tunnel handlers, so tunnel4_rcv()
and tunnelmpls4_rcv() read the zero return as "the packet has been
consumed" and do not free it either. The skb is leaked.
The other tunnel drivers all dispose of the packet at this point:
ip6_tunnel.c jumps to its drop label, ip_gre.c and ip6_gre.c return
PACKET_REJECT, which makes gre_rcv() free the skb. Only ipip returns 0.
Jump to the existing drop label instead. It frees the skb and still
returns 0, so the packet keeps being reported as consumed, which is what
we want here: the outer header has already been pulled, and neither the
remaining handlers nor an ICMP unreachable have any use for it.
Triggering this needs an ipip or mplsip tunnel in collect_md mode and an
atomic allocation failure, which is why it has gone unnoticed.
Fixes: cfc7381b3002 ("ip_tunnel: add collect_md mode to IPIP tunnel")
Cc: stable@vger.kernel.org
Signed-off-by: Anton Danilov <littlesmilingcloud@gmail.com>
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
Link: https://patch.msgid.link/20260819104338.432631-2-littlesmilingcloud@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
Allocations in the tc classifier *_change() paths (filter objects,
per-CPU counters, and per-filter aux data) use plain GFP_KERNEL without
__GFP_ACCOUNT, allowing unprivileged users to pin kernel memory outside
memcg charging. The shared tcf_exts_init_ex() action array allocation in
cls_api.c was also uncharged; this patch closes it along with the
per-classifier filter-object/percpu/aux allocations that remain
unaccounted.
Add GFP_KERNEL_ACCOUNT to:
- the shared tcf_exts_init_ex() action array (cls_api.c), common to every
filter of every classifier (32 pointers, 256 bytes);
- the filter-object, per-CPU-counter, and per-filter aux allocations in
cls_basic, cls_bpf, cls_cgroup, cls_flow, cls_flower, cls_fw,
cls_matchall, cls_route and cls_u32;
- the u32_init_knode() replace-path knode allocation (cls_u32.c), which
allocates the same struct tc_u_knode + sel.keys on every replace of an
existing knode and was missed by the create-path-only conversion.
Also fix the cls_basic error path: basic_change() inserts fnew into the
IDR before allocating the per-CPU counter. If alloc_percpu() fails the
errout path kfree'd fnew without idr_remove, leaving a dangling pointer
in the IDR. With GFP_KERNEL_ACCOUNT the percpu alloc becomes failable
on demand (memcg at memory.max), making the dead path attacker-reachable
and burning the handle permanently. Add the idr_remove on the percpu
failure path, matching the basic_set_parms failure-path pattern.
Note: vega@nebusec.ai provided a poc for basic_cls, but it was easy to
extend to the other classifiers.
Conditions to recreate the bug:
- CONFIG_NET_SCHED, CONFIG_NET_CLS_* (the classifier being used),
CONFIG_NET_CLS_ACT, CONFIG_MEMCG, CONFIG_USER_NS, CONFIG_NET_NS.
- Unprivileged user in a fresh user+network namespace (unshare -Urn),
or root with CAP_NET_ADMIN.
- Create a large number of tc filters (e.g. tc filter add dev lo
ingress ... <classifier> ...) while watching a memcg-limited cgroup:
system slab grows far faster than memory.current, pinning kernel
memory outside memcg charging.
Fixes: 0da974f4f303 ("[NET]: Conversions from kmalloc+memset to k(z|c)alloc.")
Reported-by: vega@nebusec.ai
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Breno Leitao <leitao@debian.org>
Link: https://patch.msgid.link/20260819143733.57538-1-jhs@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
Simon Wunderlich says:
====================
Here are a few batman-adv bugfixes:
- fix stale receive device on merged fragments, by Zhiling Zou
the others are written by Sven Eckelmann:
- bla: fix potential CRC corruption issues (2 patches)
- dat: avoid unaligned fault in IP extraction
- dat: atomically update mac addresses
- mcast: fix TX priority extraction for BATADV_FORW_MCAST
- mcast: fix skb sharing and linearization (2 patches)
- bla: fix freeing of claims on meshif deletion
* tag 'batadv-net-pullrequest-20260821' of https://git.open-mesh.org/batadv:
batman-adv: bla: fix freeing of claims on meshif deletion
batman-adv: mcast: linearize skbuff for packet generation
batman-adv: mcast: ensure unshared skb for multicast packets
batman-adv: fix TX priority extraction for BATADV_FORW_MCAST
batman-adv: dat: atomically update mac addresses
batman-adv: dat: avoid unaligned fault in IP extraction
batman-adv: bla: prevent CRC corruptions after claim flush
batman-adv: bla: avoid CRC corruption due to parallel claim add
batman-adv: fix stale receive device on merged fragments
====================
Link: https://patch.msgid.link/20260821094813.201800-1-sw@simonwunderlich.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
The max_period bound in net_timer_enable_perout() was computed as:
max_period = (u64)NETC_TMR_DEFAULT_FIPER + integral_period;
which exceeds U32_MAX when integral_period > 0 (e.g. 0x100000002 for
the default 333333333 Hz clock). A period_ns that passes this check but
exceeds U32_MAX is then silently truncated when stored into the u32
struct netc_pp::period field.
A truncated value of zero can reach netc_timer_set_perout_alarm(), where
the local u32 period variable would also be 0, causing a divide-by-zero
in roundup_u64(delta, period) whenever the stime < min_time branch is
taken (which always happens for a start time of {0, 0}).
Additionally, netc_timer_enable_periodic_pulse() and
netc_timer_enable_fiper() both compute:
fiper = pp->period - integral_period;
A zero pp->period results in an unsigned wraparound to 0xFFFFFFFD,
mis-programming the FIPER hardware register.
Fix all three issues by capping max_period at NETC_TMR_DEFAULT_FIPER
(0xFFFFFFFF). This ensures that any period_ns passing the range check
fits in a u32 without truncation, so the stored value is always valid
and non-zero. The accepted range is reduced by integral_period ns
(typically only a few nanoseconds), which is negligible in practice.
Fixes: 671e266835b8 ("ptp: netc: add periodic pulse output support")
Signed-off-by: Wei Fang <wei.fang@nxp.com>
Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Link: https://patch.msgid.link/20260821032449.1235065-1-wei.fang@oss.nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
In bnxt_request_irq(), pcie_enable_tph() is called unconditionally to
enable PCIe TPH when setting up interrupts.
If the NIC hardware or firmware capabilities do not support queue ops,
attempting to enable TPH during bnxt_request_irq() is unnecessary.
As a result a flood of "RX queue restart failed: err=-95" messages is
seen upon boot.
Older NICs (pre-Thor / BCM57414) do not support TPH or queue management.
TPH requires queue management to restart the queue. NICs that support
queue management (with updated FW) all support TPH.
Gate the call to pcie_enable_tph() and setting of bp->tph_mode
behind BNXT_SUPPORTS_QUEUE_API(bp) to ensure TPH is only initialized
on devices capable of supporting queue ops. This prevents a guaranteed
-EOPNOTSUPP error from occurring due to NULL operations.
Fixes: c214410c47d6 ("bnxt_en: Add TPH support in BNXT driver")
Suggested-by: Michal Schmidt <mschmidt@redhat.com>
Signed-off-by: Thomas Walsh <thwalsh@redhat.com>
Reviewed-by: Michael Chan <michael.chan@broadcom.com>
Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
Link: https://patch.msgid.link/20260820220544.1240879-1-thwalsh@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
The first parameter of hwmon_notify_event() is supposed to be the hardware
monitoring device. The bnxt driver calls it with the platform device as
first parameter instead. This API break results in undefined behavior and
may result in a crash.
Pass the hardware monitoring device as parameter instead to fix the
problem.
Fixes: a19b4801457b0 ("bnxt_en: Event handler for Thermal event")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Link: https://patch.msgid.link/20260821044512.663941-1-linux@roeck-us.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
scx_dsq_move() verifies that the task belongs to the calling scheduler
before taking any locks and aborts the scheduler on mismatch. The task can
lose the sched association at any point: It can run and fully exit, which
clears the association, or get rehomed to a different sub-sched. Both are
benign races, but the early ownership check escalates them into scheduler
aborts.
Move the ownership check below the cursor-lost check. Every ownership change
dequeues the task first, so a task that is still on the iterated DSQ under
the lock while owned elsewhere indicates a genuine violation and should
abort.
Also fix two stale comments still referencing sched_ext_free(), which has
been renamed to sched_ext_dead().
Fixes: bb4d9fd55158 ("sched_ext: scx_dsq_move() should validate the task belongs to the right scheduler")
Signed-off-by: Tejun Heo <tj@kernel.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/sergeh/linux
Pull capabilities update from Serge Hallyn:
"Just one trivial patch which corrects two comments to avoid kernel-doc
warnings"
* tag 'caps-pr-20260820' of git://git.kernel.org/pub/scm/linux/kernel/git/sergeh/linux:
capability: remove non-kernel-doc comments
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat
Pull exfat updates from Namjae Jeon:
"A set of exfat fixes covering shared writable mappings, entry error
handling, allocation cleanup, FITRIM bounds, and locking:
- Fix valid_size extension over shared writable mappings by lazily
zeroing page-cache gaps and ensuring racing stores cannot be
overwritten or extend beyond valid_size
- Clean up partially written directory entries on add-entry failure
and safely free new directory clusters
- Free a newly allocated directory cluster when zeroing it fails
- Write the destination entry before removing the source entry during
rename, preserving the source if the destination write fails
- Keep FITRIM within the requested range, even when the free-space
search wraps around the allocation bitmap
- Fix truncated FS_IOC_GETFSLABEL results by passing the destination
buffer size in bytes to the UTF-16-to-NLS conversion
- Fix overflow in the cluster-to-dentry calculation, which could
cause readdir to stop early on large volumes
- Replace the per-inode truncate_lock with inode_lock, using shared
locking in bmap to serialize against concurrent truncation
- Update the exfat mailing list address in MAINTAINERS"
* tag 'exfat-for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat:
exfat: replace truncate_lock with inode_lock
exfat: keep FITRIM within the requested range
exfat: fix truncated volume labels returned by FS_IOC_GETFSLABEL
exfat: fix overflow in cluster-to-dentry conversion
exfat: clean up new entry on add entry failure
exfat: free new directory cluster if zeroing fails
exfat: write moved entry before removing source
MAINTAINERS: update mailing list address for exfat
exfat: fix valid_size extension over a shared writable mapping
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools
Pull perf tools updates from Namhyung Kim:
"perf c2c:
- Add 'function view' in perf c2c report TUI (switched by pressing
'TAB' in the cacheline view) to organize samples around functions
rather than cachelines in 3-level hierarchy:
Level 1: Read-side function (sorted by estimated Cycles %)
Level 2: Contending writer functions (sorted by Store count)
Level 3: Shared cacheline addresses
Users can navigate the entries and fold/unfold using 'e' key. An
example output would look like below:
Shared Data Functions Table (19 entries, sorted on Cycles %)
Cycles Store
% count Function / Contending function / Cacheline
----------------------------------------------------------------------
+ 35.67% 876 + [k] cpupri_set
+ 24.31% 424 + [k] pull_rt_task
- 16.53% 555 - [k] dequeue_pushable_task
145 - [k] pull_rt_task
145 0xff2d0082809da080
139 - [k] enqueue_pushable_task
70 0xff2d00a2071f9640
69 0xff2d0082809da000
python module support:
- Extend "perf" python module so that it can be fully functional. The
goal is to run scripts directly, not by 'perf script' command. This
would give better performance as well as more control to build
standalone programs with UI.
- Add LiveSession helper (perf_live.py) to enable live event
collection directly from Python using perf.evlist and
perf.parse_events.
perf stat:
- Add --hide-zero-events option to suppress zero-count events
- Reject conflicting --field-separator and --json-output options
- Fix duplicate event output with --for-each-cgroup
perf sched latency:
- Add -H/--histogram and --hist-mode (log|linear) options to show
scheduler wait latency histograms
- Add --time option to filter analysis by time span in 'perf sched
latency'
ARM CoreSight:
- Synthesize callchains for instruction samples from CoreSight trace
using thread stack ('--itrace=g...')
- Support call indentation ('perf script -F +callindent') to display
call depth hierarchy on branch samples
- Decode ETE (Embedded Trace Extension) exception packets
Build system:
- Add 'make install-build-deps' target to install required packages
- Parallelize JSON and metric pre-computation in jevents.py for
faster builds
Vendor event/metric updates:
- Add Intel Nova Lake events and update tables for existing models
- Update AMD Zen 5 and Zen 6 core events
- Update Arm64 Tegra410 metrics and PowerPC hcalls
Internal changes and fixes:
- Harden trace-event and synthetic event parsing against corrupted
data
- Fix unwinding of multi-threaded processes in libdw unwinder
- Fix memory leaks in various commands and python bindings
- Speed up 'perf test' shell tests"
* tag 'perf-tools-for-v7.3-2026-08-21' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: (232 commits)
perf vendor events arm64: Fix Tegra410 Olympus event 0x0197
perf vendor events arm64: fix swapped MetricGroup for Tegra410 L1 prefetcher metrics
perf evlist: Warn when 'sleep' workload is used without system-wide (-a) option
perf c2c: document function view in perf-c2c man page
perf c2c: add function view browser UI and cacheline detail
perf c2c: build and finalize the function view hierarchy
perf c2c: add function view hierarchy entry creation
perf c2c: add function view stats merge and memory management
perf c2c: add HPP list parsing for function view columns
perf c2c: add column rendering for function view
perf c2c: add function view model skeleton
perf c2c: extract shared data structures into util/c2c.h
perf test sample-parsing: Validate PERF_FORMAT_GROUP values without LOST
perf dso: Replace assert with runtime check in dso__read_symbol()
perf dso: Guard against cache underflow on short reads in dso_cache__memcpy()
perf dso: Use stored fd error instead of stale errno in file_read() and file_size()
perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path()
perf dso: Guard against errno==0 when dso__get_filename() returns NULL
perf build: install-build-deps: add RHEL family devel package mapping
perf build: Remove leftover feature tests for removed cxx and clang support
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394
Pull firewire updates from Takashi Sakamoto:
"Error handling, a potential bug fix, and KUnit tests:
- Handle failures when generating the contents of the configuration
ROM with parameters supplied by in-kernel implementations such as
unit drivers (Sreeraj S Kurup)
- Fix potential memory leak when an invalid self-ID sequence causes
an error while building the internal node tree (Abdun Nihaal)
KUnit tests have been added to trigger this case"
* tag 'firewire-updates-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394:
firewire: core: fix memory leak in error path of build_tree()
firewire: core: validate parent port count before allocating nodes in build_tree()
firewire: core: consolidate port counting in build_tree()
firewire: core: add KUnit tests for failure of tree building
firewire: core: add KUnit tests for successful tree building
firewire: core: add KUnit test skeleton for node tree
firewire: core: validate sub-block lengths in fw_core_add_descriptor()
firewire: core: validate overall descriptor length in fw_core_add_descriptor()
|
|
When boot instance creation fails, the kernel incorrectly logs "(null)"
as the instance name because strsep() consumes curr_str entirely during
parsing.
Print the properly parsed name variable instead. And while at it log
the error code.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260807085423.4175161-1-vdonnefort@google.com
Fixes: cb1f98c5e574 ("tracing: Add creation of instances at boot command line")
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
|
|
i2c: rust: mark I2cAdapter methods as inline
A single cleanup for the Rust I2C abstractions, targeting 7.3.
`I2cAdapter::get`, `inc_ref`, and `dec_ref` are trivial wrappers around
`i2c_get_adapter`/`i2c_put_adapter` and were showing up as their own
symbols in the build. Mark them `#[inline]` so they get folded into
their callers instead.
Signed-off-by: Igor Korotin <igor.korotin@linux.dev>
* tag 'rust-i2c-for-7.3':
i2c: rust: mark I2cAdapter methods as inline
|
|
When building the kernel using llvm-19.1.7-rust-1.85.0-x86_64, the
following symbols are generated:
$ nm vmlinux | grep ' _R'.*I2cAdapter | rustfilt
ffffffff817ff380 T <kernel::i2c::I2cAdapter>::get
ffffffff817ff400 T <kernel::i2c::I2cAdapter as kernel::sync::aref::AlwaysRefCounted>::dec_ref
ffffffff817ff3e0 T <kernel::i2c::I2cAdapter as kernel::sync::aref::AlwaysRefCounted>::inc_ref
However, these Rust symbols are trivial wrappers around the
`i2c_get_adapter` and `i2c_put_adapter` functions. It doesn't make sense
to go through a trivial wrapper for these functions.
Link: https://github.com/Rust-for-Linux/linux/issues/1145
Suggested-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Nicolás Antinori <nico.antinori.7@gmail.com>
Reviewed-by: Onur Özkan <work@onurozkan.dev>
Reviewed-by: Igor Korotin <igor.korotin@linux.dev>
Signed-off-by: Igor Korotin <igor.korotin@linux.dev>
|
|
Sync common.bpf.h, compat.bpf.h and compat.h with the scx repo, which
accumulated the following:
- __COMPAT_read_enum() can now recover 64-bit scx enum values from kernel
BTF generated without BTF_KIND_ENUM64 support (pahole < 1.24 or
--skip_encoding_btf_enum64, e.g. COS/GKE kernels), substituting values
from the build-time vmlinux.h cross-checked against the low 32 bits the
kernel does provide.
- is_migration_disabled() no longer assumes the BPF prolog always disables
migration. Since 8e4f0b1ebcf2 ("bpf: use rcu_read_lock_dont_migrate() for
trampoline.c") the prolog only does so under CONFIG_PREEMPT_RCU, so the
old current-task test under-reported on v6.18+ !PREEMPT_RCU kernels. A
runtime probe on bpf_scx_reg() handles older kernels with backported
trampoline behavior.
- __COMPAT_scx_bpf_dsq_peek() is gated behind kernel v7.1 where 2f2ea7709266
("sched_ext: Use dsq->first_task instead of list_empty() in
dispatch_enqueue() FIFO-tail") fixed the kfunc spuriously returning NULL
on non-empty FIFO DSQs, and the new
scx_bpf_reenqueue_local_from_anywhere() provides a callable-from-anywhere
reenqueue which prefers the generic scx_bpf_dsq_reenq(). Both were first
posted by Gavin Guo and Changwoo Min and are picked up here with the
review feedback folded in.
- __COMPAT_scx_bpf_cpu_curr() and the scx_bpf_cpu_rq() declaration are
restored. Schedulers built from these headers still run on pre-v6.18
kernels where scx_bpf_cpu_curr() does not resolve and the scx_bpf_cpu_rq()
fallback still exists.
- scx_clock_task() and scx_clock_pelt() document their stale-read behavior
for remote idle CPUs under NO_HZ_IDLE.
Link: https://lore.kernel.org/all/20260817143126.562923-1-changwoo@igalia.com
Signed-off-by: Tejun Heo <tj@kernel.org>
|
|
Regenerate enum_defs.autogen.h against the current tree, picking up the
dispatch verdict enums and dropping the marker for the removed
SCX_RQ_IN_BALANCE. Add enums_abi.autogen.h, a table of 64-bit scx enumerator
values generated from vmlinux.h, used as the substitution source when the
running kernel's BTF truncates 64-bit enum values to 32 bits.
Signed-off-by: Tejun Heo <tj@kernel.org>
|
|
So that caller can detect any failure from f2fs_sync_fs().
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
|
|
F2FS writes long symlink data with page_symlink() and then flushes the
symlink mapping to reduce the chance of exposing a broken symlink.
That flush result is currently ignored. If the writeback fails, symlink()
still returns success even though the symlink is not durable and the same
operation can already surface -EIO through syncfs().
Return the writeback error to userspace and skip the dirsync flush once the
symlink data flush has failed.
Fixes: d0cae97cb600 ("f2fs: flush symlink path to avoid broken symlink after POR")
Cc: stable@kernel.org
Signed-off-by: Wenjie Qi <qiwenjie@xiaomi.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
|
|
In f2fs_rename() and f2fs_unlink(), directly returning -EPERM when
encountering a device aliasing file bypasses the cleanup path.
Fix this by setting err to -EPERM and jumping to the proper cleanup
labels (out_dir and out) instead of returning immediately.
Reported-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Daeho Jeong <daehojeong@google.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
|
|
Otherwise, the pinned status may affect latter flow of fggc.
Cc: stable@kernel.org
Fixes: 9703d69d9d15 ("f2fs: support file pinning for zoned devices")
Cc: Daeho Jeong <daehojeong@google.com>
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
|
|
Under heavy workloads or during background GC/fallocate operations,
nat_tree_lock can experience high lock contention between background
readers (e.g. f2fs_get_node_info() in gc_data_segment) and writers
(e.g. flush_nat_entries, set_node_addr, shrinker).
[375067.327986][T13777] schedule+0x4c/0x114
[375067.327997][T13777] f2fs_get_node_info+0x438/0x5c4
[375067.328002][T13777] f2fs_get_inode_page+0x1e0/0x3f0
[375067.328013][T13777] f2fs_iget+0x88/0x1180
[375067.328024][T13777] f2fs_lookup+0x168/0x3a8
[375067.328035][T13777] path_openat+0xa28/0x1b04
[375067.328046][T13777] do_filp_open+0xac/0x130
[375067.328056][T13777] do_sys_openat2+0x140/0x21c
[375067.328066][T13777] __arm64_sys_openat+0x70/0x9c
[375067.330299][T13777] schedule+0x4c/0x114
[375067.330310][T13777] schedule_preempt_disabled+0x24/0x40
[375067.330321][T13777] rwsem_down_write_slowpath+0x3b4/0x9d0
[375067.330332][T13777] down_write+0x98/0x170
[375067.330343][T13777] set_node_addr+0x74/0x4b4
[375067.330354][T13777] f2fs_new_node_page+0xb0/0x280
[375067.330444][T13777] f2fs_new_inode_page+0x3c/0x64
[375067.330455][T13777] f2fs_init_inode_metadata+0x4c/0x47c
[375067.330461][T13777] f2fs_add_regular_entry+0x258/0x5b8
[375067.330471][T13777] f2fs_add_dentry+0x100/0x158
[375067.330476][T13777] f2fs_do_add_link+0x84/0x140
[375067.330487][T13777] f2fs_create+0xec/0x250
[375067.331759][T13777] schedule+0x4c/0x114
[375067.331770][T13777] f2fs_down_read+0x9c/0xc4
[375067.331781][T13777] f2fs_need_inode_block_update+0x20/0x10c
[375067.331792][T13777] f2fs_do_sync_file+0x478/0x830
[375067.331802][T13777] f2fs_sync_file+0x2c/0x40
This patch converts nat_tree_lock to use the f2fs_{down,up}_{read,write}_trace
infrastructure.
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
|
|
Add binding document for the haptics module inside Qualcomm PMIC
PMIH0108.
Assisted-by: Claude:claude-4-8-opus
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Fenglin Wu <fenglin.wu@oss.qualcomm.com>
Link: https://patch.msgid.link/20260806-qcom-spmi-haptics-v6-1-19fcecd5204f@oss.qualcomm.com
[robh: Drop example]
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
|
|
SND_MPC52xx_SOC_PCM030 and SND_MPC52xx_SOC_EFIKA both select
SND_SOC_MPC5200_AC97 without ensuring its dependency on PPC_BESTCOMM is
met. This causes unmet dependencies such as:
WARNING: unmet direct dependencies detected for SND_SOC_MPC5200_AC97
Depends on [n]: SOUND [=m] && SND [=m] && SND_SOC [=m] && SND_POWERPC_SOC [=m] && PPC_BESTCOMM [=n]
Selected by [m]:
- SND_MPC52xx_SOC_PCM030 [=m] && SOUND [=m] && SND [=m] && SND_SOC [=m] && SND_POWERPC_SOC [=m] && PPC_MPC5200_SIMPLE [=y]
In v1, Rosen pointed out that the import of "mpc5200_dma.h" is actually
unnecessary, and Arnd suggested that the 'select' of SND_SOC_MPC5200_AC97
be changed to 'depends on'.
This resolves all 3 unmet dependencies.
These unmet dependency bugs were detected by kconfirm, a static analysis tool
for Kconfig.
Fixes: a9262c4fd404 ("ASoC: Support for AC97 on Phytec pmc030 base board.")
Fixes: 6ffee43ecf8b ("ASoC: Fabric bindings for STAC9766 on the Efika")
Suggested-by: Arnd Bergmann <arnd@arndb.de>
Suggested-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Julian Braha <julianbraha@gmail.com>
Link: https://patch.msgid.link/20260821175410.179631-1-julianbraha@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
* At boot time, when the registers are accessed by asoc
layer while trying to enable a DAPM path, while the device
is still being attached, -EBUSY error will be thown by
regmap_read and regmap_udpate_bits. Because the regmap will
be in cache only mode. Add default values for these registers
so that, the cached values are returned instead of error.
* Also remove writing default values once again for first
attach.
Signed-off-by: Niranjan H Y <niranjan.hy@ti.com>
Link: https://patch.msgid.link/20260820115114.1203-3-niranjan.hy@ti.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
Rename gain and volume macros to match the hardware intent. Currently,
both TAC_SDCA_CHANNEL_GAIN and TAC_SDCA_CHANNEL_VOLUME are defined as 0x02.
Keep only TAC_SDCA_CHANNEL_VOLUME and reposition TAC_SDCA_CHANNEL_GAIN to
0x0B. Remove the now-redundant TAC_SDCA_MASTER_GAIN alias (also 0x0B),
replacing its single use with TAC_SDCA_CHANNEL_GAIN.
Signed-off-by: Niranjan H Y <niranjan.hy@ti.com>
Link: https://patch.msgid.link/20260820115114.1203-2-niranjan.hy@ti.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
* With component_name set in the codec_info_list DAI entries,
"amixer -D hw:<card> info" includes the 'spk' identifier for
each tac5xx2 speaker component. This allows userspace to
identify the speaker codec at runtime and enables UCM
card matching for the tac5xx2 family.
* Set component_name for the speaker, mic, and UAJ DAI
entries for all tac5xx2 family variants.
Signed-off-by: Niranjan H Y <niranjan.hy@ti.com>
Link: https://patch.msgid.link/20260820115114.1203-1-niranjan.hy@ti.com
Signed-off-by: Mark Brown <broonie@kernel.org>
|
|
- Fix typos in documentation (D'Orus Tsitera)
- Use %pe format specifier to print error pointers so we get symbolic
errname when available (Krzysztof Wilczyński)
* pci/misc:
PCI: Use %pe format specifier to print error pointers
Documentation: PCI: Fix sysfs-bus-pci typo
|
|
- Use common wait time definitions for PCIe link monitoring instead of
defining driver-private duplicates (Thierry Reding)
- Add LECARC PMU IDs to the DWC RAS/DES VSEC list so it can take advantage
of the existing debugfs support for silicon debug, error injection, and
event counters (Brett Zhou)
* pci/controller/misc:
PCI: dwc: Add PCI ID for LECARC PCIe PMU
PCI: Use standard wait times for PCIe link monitoring
|
|
- Drop unnecessary OF node reference (Yuho Choi)
* pci/controller/xgene:
PCI: xgene: Drop unnecessary OF node reference
|
|
- Support device ID 0x28C1 and assume that BIOS has already enumerated the
hierarchy below VMD and stored bus range info for OS to use (Nirmal
Patel)
- Add support for VMCONFIG BUS_RESTRICT_CFG=3, which makes it possible to
enumerate downstream devices on Intel Arrow Lake-HX systems and probably
others (Ali Alaei)
- Observe _OSC negotiation for VMD hierarchy only when running on bare
metal, not when running in a VM (Nirmal Patel)
- Add Nova Lake (NVL) and Dunlow (DNL) Device IDs (Szymon Durawa)
* pci/controller/vmd:
PCI: vmd: Add Nova Lake (NVL) and Dunlow (DNL) Device IDs
PCI: vmd: Only copy root bridge _OSC control flags in bare metal OS
PCI: vmd: Handle BUS_RESTRICT_CFG value 3 for Arrow Lake-HX
PCI: vmd: Add feature to scan BIOS-enumerated devices
|
|
- Distinguish Tegra264 C0 PCIe controller for internal GPU from C1-C5
controllers so the unit address matches the first 'reg' entry (Thierry
Reding)
- Add Tegra264 Root Port stanzas to prepare for generic WAKE# handling
(Thierry Reding)
- Add NVIDIA Tegra264 driver (Thierry Reding)
* pci/controller/tegra264:
PCI: tegra264: Add Tegra264 support
dt-bindings: PCI: tegra264: Switch to PCIe Root Port bindings
dt-bindings: PCI: tegra264: Strictly distinguish C0 from C1-C5
|
|
- Add DT binding and driver support for RZ/V2H(P) SoC, which contains two
PCIe controllers, configured either as a single x4 link or two
independent x2 link controllers (Lad Prabhakar)
* pci/controller/rzg3s-host:
PCI: rzg3s-host: Add support for RZ/V2H(P) SoC
PCI: rzg3s-host: Prepare System Controller handling for multiple controllers
PCI: rzg3s-host: Use shared reset controls for power domain resets
dt-bindings: PCI: renesas,r9a08g045-pcie: Add RZ/V2H(P) support
|
|
- Add support for PCIe controller in EcoNet EN7528 and EN751221 SoCs (Caleb
James DeLisle)
* pci/controller/mediatek:
PCI: mediatek: Add support for EcoNet EN7528 SoC
|
|
- Fix resource leaks on error paths in host_init() (Ali Tariq)
- Fix runtime PM handling and teardown ordering to avoid register access
while power or clocks are disabled (Ali Tariq)
- Check for runtime PM resume failure to avoid register access while power
or clocks are disabled (Ali Tariq)
* pci/controller/plda-starfive:
PCI: starfive: Fix unchecked pm_runtime_get_sync() in probe
PCI: starfive: Fix Runtime PM handling and teardown ordering
PCI: starfive: Fix resource leaks on error paths in host_init()
|
|
- Fix event IRQ user-after-free issues (Ali Tariq)
- Fix IRQ domain leaks in error paths (Ali Tariq)
* pci/controller/plda-host:
PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts()
PCI: plda: Fix use-after-free of event IRQs during teardown
|
|
- Add 'core', 'dbi', and 'aux' clocks to DT binding and manage them in the
driver (Jia Wang)
- Use module_platform_driver() since this may be built as a module, though
not removable because IRQs can't be safely disposed (Jia Wang)
* pci/controller/dwc-ultrarisc:
PCI: ultrarisc: Use module_platform_driver()
PCI: ultrarisc: Get and enable DP1000 PCIe controller clocks
dt-bindings: PCI: ultrarisc: Add required DP1000 PCIe clocks
|
|
- Add missing MODULE_DEVICE_TABLE() to generate module alias info for
OF-based module autoloading (Pengpeng Hou)
* pci/controller/dwc-spacemit-k1:
PCI: spacemit: Add missing MODULE_DEVICE_TABLE()
|
|
- When MSI is enabled but iMSI-RX is not used, configure AXIINTC to allow
GIT ITS to handle MSI (Marek Vasut)
- Refactor GIC600 implementation to make it easier to add platforms that
only support 32-bit addressing (Marek Vasut)
- Add Renesas R-Car Gen4 S4/V4H/V4M to the list of GIC600 integrations that
only support 32-bit addressing (Marek Vasut)
* pci/controller/dwc-rcar-gen4:
irqchip/gic-v3: Add Renesas R-Car Gen4 erratum workaround
irqchip/gic-v3: Refactor GIC600 limited to 32bit PA erratum handling
PCI: rcar-gen4: Configure AXIINTC if iMSI-RX is not used
PCI: dwc: Move iMSI-RX check before calling 'pp->ops->init()'
|
|
- Add DT binding and driver support for Hawi SoC (Matthew Leung)
- Skip PERST# GPIOs provided by downstream PCIe devices, which should be
handled by drivers of those devices (Manivannan Sadhasivam)
- Stop advertising Attention Button Present (no Qcom SoCs support Attention
Buttons) so pciehp can use Presence Detect Changed events (Qiang Yu)
* pci/controller/dwc-qcom:
PCI: qcom: Clear Attention Button Present in Slot Capabilities
PCI: qcom: Rename qcom_pcie_set_slot_nccs() to qcom_pcie_set_slot_cap()
PCI: qcom: Skip PERST# GPIOs provided by downstream PCIe devices
PCI: qcom: Add support for Hawi
dt-bindings: PCI: qcom: Document Hawi and Maili PCIe Controllers
|
|
- Correct the PERST# GPIO state so it remains asserted until power and
REFCLK become stable to fix enumeration failure (Ronald Claveau)
* pci/controller/dwc-meson:
PCI: meson: Fix GPIO state while requesting PERST#
|
|
- Fix OF node reference leak in init (Yuho Choi)
* pci/controller/dwc-keystone:
PCI: keystone: Fix OF node reference leak in init
|
