summaryrefslogtreecommitdiff
path: root/tools/testing
AgeCommit message (Collapse)Author
2026-07-29KVM: selftests: Use __stringify() instead of custom XSTR() macrosYosry Ahmed
Drop the custom defined XSTR() macros in KVM selftests and use __stringify() instead. Include stringify.h in test_util.h to make it available for all tests instead of including it in all the tests that need it, as more tests will start using it. No functional change intended. Signed-off-by: Yosry Ahmed <yosry@kernel.org> Link: https://patch.msgid.link/20260728174232.2423257-2-yosry@kernel.org Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-29KVM: riscv: selftests: add Svadu FWFT extension to get-reg-list testInochi Amaoto
The KVM RISC-V allows Svadu FWFT for Guest/VM so add this extension to get-reg-list test. Assisted-by: YuanSheng:claude-4.7-opus Co-developed-by: Quan Zhou <zhouquan@iscas.ac.cn> Signed-off-by: Quan Zhou <zhouquan@iscas.ac.cn> Signed-off-by: Inochi Amaoto <inochiama@gmail.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260713010302.303278-3-inochiama@gmail.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-07-28Merge tag 'perf-tools-fixes-for-v7.2-1-2026-07-25' into perf-tools-nextNamhyung Kim
perf tools fixes for v7.2. - Update header copies of kernel headers, including const.h, fs.h, perf_event.h, gfp_types.h, kvm.h, cpufeatures.h, rtnetlink.hp, msr-index.h, drm.h and socket.h. - Add some build files related to BPF skels to .gitignore. Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-28selftests/damon/sysfs_refresh: test kdamond refresh_msRuslan Valiyev
Writing a non-zero value to a kdamond's 'refresh_ms' sysfs file should make DAMON periodically update the read-only sysfs files on its own, without the user writing update keywords such as 'update_schemes_stats' to the 'state' file. This behavior has no test coverage. Add a test that starts a kdamond with refresh_ms set and a 'stat' scheme whose default access pattern matches every monitored region, then polls the scheme's 'nr_tried' stats file directly, without requesting an update. The value can become non-zero only via the periodic refresh, so the test confirms refresh_ms works; with refresh_ms disabled the stat stays zero and the test fails. Link: https://lore.kernel.org/20260602131217.2210912-3-linuxoid@gmail.com Link: https://lore.kernel.org/20260629144927.134237-3-sj@kernel.org Signed-off-by: Ruslan Valiyev <linuxoid@gmail.com> Reviewed-by: SJ Park <sj@kernel.org> Signed-off-by: SJ Park <sj@kernel.org> Cc: Shuah Khan <shuah@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-07-28selftests/damon/_damon_sysfs: support kdamond refresh_msRuslan Valiyev
Patch series "selftests/damon: test kdamond refresh_ms", v2. The kdamond 'refresh_ms' sysfs file makes DAMON periodically update its read-only sysfs files (DAMOS stats, tuned monitoring intervals and the kdamond pid) on its own, so users don't have to write update keywords such as 'update_schemes_stats' to the 'state' file. It has no selftest coverage. The first patch adds refresh_ms support to the _damon_sysfs.py test control module. The second adds a test that sets refresh_ms and confirms a scheme's stats are updated under sysfs without an explicit update request; the test skips on kernels that predate the refresh_ms file. Tested on current mainline under a DAMON-enabled kernel: the new test passes and the existing DAMON selftests show no new failures. This patch (of 2): The Kdamond class has no way to set the kdamond-level 'refresh_ms' sysfs file, which makes DAMON periodically update the read-only sysfs files (DAMOS stats, tuned monitoring intervals and the kdamond pid) on its own. Add a 'refresh_ms' parameter to Kdamond. When it is set (including to zero, to disable the periodic update), write it before turning the kdamond on, so tests can exercise the auto-update behavior. Leaving it unset keeps the previous behavior of not touching the file, so callers running against kernels without the feature are unaffected. Link: https://lore.kernel.org/20260602131217.2210912-2-linuxoid@gmail.com Link: https://lore.kernel.org/20260629144927.134237-2-sj@kernel.org Signed-off-by: Ruslan Valiyev <linuxoid@gmail.com> Reviewed-by: SJ Park <sj@kernel.org> Signed-off-by: SJ Park <sj@kernel.org> Cc: Shuah Khan <shuah@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-07-28selftests/damon/sysfs.py: validate memcg_path staging readbackCheng Nie
Add a dedicated test at the end of main() that stages memcg_path via sysfs and verifies its readback. Configure the memcg filter before start(), do not call commit(), and ignore start() failures so the test does not depend on CONFIG_MEMCG or cgroup layout. Call stop() for cleanup without checking its return value. Link: https://lore.kernel.org/D2B37130D38E09AC+20260601090634.241864-1-niecheng1@uniontech.com Link: https://lore.kernel.org/20260629144812.134159-3-sj@kernel.org Signed-off-by: Cheng Nie <niecheng1@uniontech.com> Signed-off-by: SJ Park <sj@kernel.org> Reviewed-by: SJ Park <sj@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-07-28selftests/damon/_damon_sysfs.py: fix memcg_path assignmentCheng Nie
Patch series "selftests/damon: fix memcg_path staging handling", v5. Fix a bug in _damon_sysfs.py for damos_filter memcg_path setup, and add a test case of it in sysfs.py. This patch (of 2): DamosFilter stores memcg_path for sysfs staging, but the constructor assigns it with a trailing comma and therefore turns it into a tuple. Fix the assignment so memcg_path is stored as the intended string. This makes memcg filter staging and follow-up validation use the written path correctly. Link: https://lore.kernel.org/20260629144812.134159-1-sj@kernel.org Link: https://lore.kernel.org/464AE12D4BC6B6F4+20260601090519.240482-1-niecheng1@uniontech.com Link: https://lore.kernel.org/20260629144812.134159-2-sj@kernel.org Signed-off-by: Cheng Nie <niecheng1@uniontech.com> Signed-off-by: SJ Park <sj@kernel.org> Reviewed-by: SJ Park <sj@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-07-28selftests/damon: fix dead code, skipped checks, and broken lookupsKunwu Chan
'hugeapge_size' in drgn_dump_damon_status.py was a dead elif branch. $fail_reason in sysfs.sh was undefined, silently emptying the error message. 'exit' instead of 'exist' in sysfs.sh skipped a file existence check. 'nohugeapge' in sysfs.py broke an action dict lookup. Fix other wrong strings in the same files. Link: https://lore.kernel.org/20260601032314.424013-4-kunwu.chan@linux.dev Link: https://lore.kernel.org/20260629144648.134092-4-sj@kernel.org Co-developed-by: Wang Lian <lianux.mm@gmail.com> Signed-off-by: Wang Lian <lianux.mm@gmail.com> Signed-off-by: Kunwu Chan <chentao@kylinos.cn> Signed-off-by: SJ Park <sj@kernel.org> Reviewed-by: SJ Park <sj@kernel.org> Cc: Kunwu Chan <chentao@kylinos.cn> Cc: Wang Lian <lianux.mm@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-07-28selftests/damon/damos_tried_regions: fix expectation output and join TypeErrorKunwu Chan
The expectation print has wrong operator precedence: '%' binds before the conditional expression, so the else branch prints 'not met' without the prefix 'expectation (>= 14) is'. Add parentheses to fix it. Also, '\n'.join() on the list of ints raises TypeError; convert to str in the list comprehension. Link: https://lore.kernel.org/20260601032314.424013-3-kunwu.chan@linux.dev Link: https://lore.kernel.org/20260629144648.134092-3-sj@kernel.org Co-developed-by: Wang Lian <lianux.mm@gmail.com> Signed-off-by: Wang Lian <lianux.mm@gmail.com> Signed-off-by: Kunwu Chan <chentao@kylinos.cn> Signed-off-by: SJ Park <sj@kernel.org> Reviewed-by: SJ Park <sj@kernel.org> Cc: Kunwu Chan <chentao@kylinos.cn> Cc: Wang Lian <lianux.mm@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-07-28selftests/damon: prevent cross-context state pollution in DamonCtxKunwu Chan
Patch series "selftests/damon: misc fixes for test bugs", v3. This series fixes several bugs in the DAMON selftests. Most are trivial but makes test output wrong or even silently pass the one test case for 'avail_operation' file existence check. Patch 1 fixes mutable default arguments in DamonCtx.__init__() that cause state to leak between test instances. Patch 2 fixes wrong operator precedence and join TypeError in damos_tried_regions.py. Patch 3 fixes several wrong strings that produce dead elif branches, skipped file existence checks, and broken dict key lookups. This patch (of 3): DamonCtx.__init__() uses mutable default values for monitoring_attrs, targets, and schemes. In Python these are evaluated once at function definition time, so multiple DamonCtx instances can unintentionally share the same lists and DamonAttrs instance. Replace the mutable defaults with None sentinels and initialize the objects when needed. Link: https://lore.kernel.org/20260629144648.134092-1-sj@kernel.org Link: https://lore.kernel.org/20260601032314.424013-2-kunwu.chan@linux.dev Link: https://lore.kernel.org/20260629144648.134092-2-sj@kernel.org Co-developed-by: Wang Lian <lianux.mm@gmail.com> Signed-off-by: Wang Lian <lianux.mm@gmail.com> Signed-off-by: Kunwu Chan <chentao@kylinos.cn> Signed-off-by: SJ Park <sj@kernel.org> Reviewed-by: SJ Park <sj@kernel.org> Cc: Kunwu Chan <chentao@kylinos.cn> Cc: Wang Lian <lianux.mm@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-07-28selftests/mm: fix potential wild pointer access of getline due to missing initChris Gellermann
This is another occurrence of using getline where the code assumes that getline allocates memory to store the line, but the pointer passed to it is uninitialized and potentially a non-null pointer. This violates the Open Group Spec[1] and caused a segfault in a similar situation in selftest/clone3/clone3_set_tid. Fix it by initializing the line pointer to NULL. The issue has been found by simply grepping through the selftest code after running into the issue in clone3_set_tid. Whether it segfaults in its current state is unknown to me. But it's good to be addressed due to defensive reasons. Link: https://lore.kernel.org/20260722130246.2135563-3-christian.gellermann@codasip.com Link: https://pubs.opengroup.org/onlinepubs/9799919799/functions/getline.html [1] Fixes: 26b4224d9961 ("selftests: expanding more mlock selftest") Signed-off-by: Chris Gellermann <christian.gellermann@codasip.com> Acked-by: David Hildenbrand (arm) <david@kernel.org> Reviewed-by: Lorenzo Stoakes <ljs@kernel.org> Cc: Christian Brauner <brauner@kernel.org> Cc: Liam R. Howlett <liam@infradead.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-07-28selftests/clone3: fix wild pointer access of getline due to missing initChris Gellermann
Patch series "selftests: Add missing initalization of pointer passed to getline", v2. This patch (of 2): Clone3_set_tid uses getline(&line, ...) in a loop to read the child's process status. The code expects that getline allocates the buffer for the line on the first loop iteration. According to the Open Group Spec[1], char *line has to be null pointer for this: > ssize_t getline(char **restrict lineptr, ...); > If *lineptr is a null pointer or if the object pointed to by *lineptr > is of insufficient size, an object shall be allocated as if by malloc() > or the object shall be reallocated as if by realloc()[...]. However, char *line is only declared, leading to an undefined value that is potentially non-null. In an example run with Musl v1.2.6, the realloc call[2] of getdelim, which implements getline, triggers a segfault: ./run_kselftest.sh --test clone3:clone3_set_tid [ 1366.165898] kselftest: Running tests in clone3 ... [ 1367.799244] clone3_set_tid[811]: unhandled signal 11 code 0x1 at 0x0000000000000000 in libc.so[68184,3fbf69f000+4c000] [ 1367.802808] CPU: 0 UID: 0 PID: 811 Comm: clone3_set_tid Not tainted .. [ 1367.804188] epc: 0x0000003fbf6b0184 [ 1367.804188] ra : 0x0000003fbf6d4664 [ 1367.804188] sp : 0x0000003fce5f2e40 [ 1367.805314] gp : 0x0000002aaab0dfb8 [ 1367.805314] tp : 0x0000003fbf6f14a8 [ 1367.805314] t0 : 0x0000003fbf63d000 ... Looking at the realloc implementation, Musl mallocs for a null pointer memory. But for a non-null pointer, it assumes it's passed a valid pointer to the heap and tries to access its meta-data. This leads to the segfault we see: void *realloc(void *p, size_t n) { if (!p) return malloc(n); if (size_overflows(n)) return 0; struct meta *g = get_meta(p); ... } Fix this by properly initializing the line pointer to NULL. Link: https://lore.kernel.org/20260722130246.2135563-1-christian.gellermann@codasip.com Link: https://lore.kernel.org/20260722130246.2135563-2-christian.gellermann@codasip.com Link: https://pubs.opengroup.org/onlinepubs/9799919799/functions/getline.html [1] Link: https://git.musl-libc.org/cgit/musl/tree/src/stdio/getdelim.c#n38 [2] Fixes: 41585bbeeef9 ("selftests: add tests for clone3() with *set_tid") Signed-off-by: Chris Gellermann <christian.gellermann@codasip.com> Acked-by: David Hildenbrand (arm) <david@kernel.org> Reviewed-by: Lorenzo Stoakes <ljs@kernel.org> Cc: Christian Brauner <brauner@kernel.org> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-07-28Merge tag 'hardening-v7.2-rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening fixes from Kees Cook: - lkdtm: fix missed rename of STACKLEAK_ERASING to KSTACK_ERASE (Haofeng Li) - selftests/seccomp: Fix pointer type mismatch build error (Kuan-Ying Lee) - tests/fortify: Disable -Wstringop-overread (Nathan Chancellor) * tag 'hardening-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: selftests/seccomp: Fix pointer type mismatch build error selftests/lkdtm: rename STACKLEAK_ERASING to KSTACK_ERASE fortify: Disable -Wstringop-overread in tests
2026-07-28selftests/bpf: Add test for tracepoint btf_ids tracefs fileMykyta Yatsenko
Read events/bpf_testmod/bpf_testmod_test_read/btf_ids and verify the exported FUNC_PROTO matches the testmod tracepoint signature (__data, struct task_struct *task, struct bpf_testmod_test_read_ctx *ctx) and the record struct trace_event_raw_bpf_testmod_test_read carries the fields declared by TP_STRUCT__entry. Use the testmod tracepoint so the test exercises the module/split-BTF path (btf_relocate_id) rather than vmlinux only, and falls back from /sys/kernel/tracing to /sys/kernel/debug/tracing when tracefs is not mounted at the new location. Link: https://patch.msgid.link/20260518-generic_tracepoint-v2-3-b755a5cf67bb@meta.com Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-07-27selftests: net: Add a missing config optionAlice Mikityanska
Commit 5cb53743e1ff ("selftests: net: Add a test for BIG TCP in UDP tunnels") used iptables match comment, which was missed from the CI kernel config. Add the missing config option. Signed-off-by: Alice Mikityanska <alice@isovalent.com> Reviewed-by: Matthieu Baerts <matttbe@kernel.org> Link: https://patch.msgid.link/20260723140241.132120-1-alice.kernel@fastmail.im Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-28selftests/bpf: Report the real error from libarena parallel workersJiayuan Chen
Several CI runs failed in the libarena parallel tests with -4 (-EINTR) [1], which says nothing about what actually went wrong. Two workers can fail like this: worker 1: gives up, e.g. the rendezvous times out, sets test_abort and returns its own error (-ETIMEDOUT) worker 2: sees test_abort and returns -EINTR -EINTR only means "someone else already gave up", so it carries no information. Which of the two gets reported depends on the order pthread_join() collects them, because err = err ?: (long)thread_ret; keeps the first non-zero value and drops the rest. When the -EINTR worker comes first, the error describing the actual failure is lost. Skip -EINTR entirely: a worker only returns it once another worker has already reported the real error, so report and log only the real errors. It is still unclear whether the timeouts come from CI load or from a problem in the test itself. Report the error accurately first, so the next failure can be diagnosed. [1]: https://github.com/kernel-patches/bpf/actions/runs/29867905253/job/88764463566 https://github.com/kernel-patches/bpf/actions/runs/29878191901/job/88794845824 Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/bpf/20260723061347.398591-1-jiayuan.chen@linux.dev Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-27selftests: net: hsr: add PRP RedBox testXin Xie
Add a kselftest that builds a PRP RedBox (interlink) with a SAN behind the interlink and a peer DANP, and checks bidirectional unicast across the interlink, preservation of the SAN source MAC on the PRP network, and that the proxy-announce supervision frame carries the RedBox-MAC TLV (Type 30) terminated by an EOT marker. It reuses the hsr_common.sh / lib.sh helpers and skips cleanly on a kernel or iproute2 without PRP interlink support. The background ping is killed by its exact PID: ip netns exec does not isolate the PID namespace, so a pattern-based pkill could hit unrelated processes on the host. Signed-off-by: Xin Xie <xiexinet@gmail.com> Link: https://patch.msgid.link/20260717201457.54-5-xiexinet@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-27Merge tag 'mm-hotfixes-stable-2026-07-27-14-18' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "13 hotfixes. All are cc:stable. 11 are for MM. All are singletons - please see the changelogs for details" * tag 'mm-hotfixes-stable-2026-07-27-14-18' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes mm/hugetlb: fix list corruption in allocate_file_region_entries() mm: mglru: fix stale batch updates after memcg reparenting selftest: fix headers in fclog.c ocfs2: fix boundary check in ocfs2_check_dir_entry() to use buffer offset mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() mm/util: don't read __page_2 for order-1 folios in snapshot_page() mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE fs/proc/task_mmu: fix PAGEMAP_SCAN written state for unpopulated ptes userfaultfd: wait on source PMD during UFFDIO_MOVE lib: test_hmm: use device devt for coherent device range selection mm/vmstat: fold stranded per-cpu node stats when a node comes online
2026-07-27KVM: selftests: Extend set_sregs test to cover EFERYosry Ahmed
Extend the set_sregs test to cover various bits in EFER. Update TEST_INVALID_CR_BIT() to operate on EFER as well as CRx (and rename it accordingly). Add test cases to check that EFER bits are disallowed without the relevant CPUID enablement. Assisted-by: Gemini:unknown-version Signed-off-by: Yosry Ahmed <yosry@kernel.org> Link: https://patch.msgid.link/20260713180153.2728382-3-yosry@kernel.org Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-27selftests/filesystems: add failfs selftestsChristian Brauner
Test the failfs semantics and both new entry points: - fchdir(FD_FAILFS_ROOT): * working directory lookups and getcwd() fail * other sentinels are rejected * the state is recoverable while the root is untouched - fchroot() with regular fds: * chroot parity * CAP_SYS_CHROOT required * ENOTDIR/EBADF/EINVAL checks - fchroot(FD_FAILFS_ROOT): * absolute lookups, stat, statfs and opens of the root including O_PATH fail with EOPNOTSUPP * dirfd-anchored I/O keeps working * ".." walks clamp at the top of the mount tree * /proc magic links resolve but can't be stat through * absolute symlinks fail while relative symlinks keep resolving - Unprivileged entry requires no_new_privs and is rejected for chrooted callers and for a shared fs_struct - entering makes the task count as chrooted so user namespace creation fails - Nothing can be mounted on top of failfs and OPEN_TREE_CLONE is rejected; the overmount test runs in a private mount namespace so a regression cannot touch the host root - setns() to a kept mount namespace fd restores root and working directory - The failfs root is inherited across fork() and absolute exec fails - Exec by fd of a dynamically linked binary fails on opening its absolute PT_INTERP interpreter The exec tests run the exec in a child so a wrongly successful exec cannot replace the test image and masquerade as a pass. Link: https://patch.msgid.link/20260724-work-failfs-v2-6-485dabbae185@kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
2026-07-27mlx5: Deprecate latency-sensitive QPs featureLeon Romanovsky
New HW no longer implements a separate class for latency-sensitive QPs and advertises this by a new cap bit. Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-26Merge tag 'vfs-7.2-rc5.fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - vfs: Preserve the ACL_DONT_CACHE state in forget_cached_acl(). ACL_DONT_CACHE is meant to be a permanent opt-out from ACL caching which FUSE relies on for servers that don't negotiate FUSE_POSIX_ACL. The helper replaced it with ACL_NOT_CACHED, silently re-enabling the cache, and as fuse doesn't invalidate the cache for such servers a properly timed get_acl() returned stale ACLs. Comes with a fuse selftest reproducing this. - pidfs: - Preserve PIDFD_THREAD when a thread pidfd is reopened via open_by_handle_at(). PIDFD_THREAD shares the O_EXCL bit which do_dentry_open() strips after the flags have been validated, so the reopened pidfd silently became a process pidfd. Comes with a selftest. - Add a pidfs_dentry_open() helper so the regular pidfd allocation path and the file handle path share the code that forces O_RDWR and reapplies the pidfd flags that do_dentry_open() strips. - Handle FS_IOC32_GETVERSION in the compat ioctl path. - Make pidfs_ino_lock static. - iomap: - Fix the block range calculation in ifs_clear_range_dirty() so a partial clear doesn't drop the dirty state of blocks the range only partially covers. - Support invalidating partial folios so a partial truncate or hole punch with blocksize < foliosize doesn't leave stale dirty bits behind. - Only set did_zero when iomap_zero_iter() actually zeroed something. - Guard ifs_set_range_dirty() and ifs_set_range_uptodate() against zero-length ranges where the unsigned last-block calculation underflows and bitmap_set() writes far beyond the ifs->state allocation. - Don't merge ioends with different io_private values as the merge could leak or corrupt the private data of the individual ioends. - exec: - Raise bprm->have_execfd only once the binfmt_misc interpreter has actually been opened. The flag was set as soon as a matching 'O' or 'C' entry was found. If the interpreter open failed with ENOEXEC the exec fell through to the next binary format with have_execfd raised but no executable staged and begin_new_exec() NULL derefed past the point of no return. - Fix an unsigned loop counter wrap in transfer_args_to_stack() on nommu. An overlong argument or environment string pushes bprm->p below PAGE_SIZE, the stop index becomes zero, and the loop never terminates, wrapping its counter and copying garbage from in front of the page array into the new process stack. - Make binfmt_elf_fdpic only honour the first PT_INTERP like binfmt_elf does. Each additional PT_INTERP overwrote the previous interpreter, leaking the name allocation and the interpreter file reference together with the write denial open_exec() took, leaving the file unwritable for as long as the system runs. - overlayfs: - Compare the full escaped xattr prefix including the trailing dot. An xattr like "trusted.overlay.overlayfoo" was misclassified as an escaped overlay xattr. - Check read access to the copy_file_range() source with the source's mounter credentials. - super: Thawing a filesystem whose block device was frozen with bdev_freeze() deadlocked. Dropping the last block layer freeze reference from under s_umount ends up in fs_bdev_thaw() which reacquires s_umount on the same task. Pin the superblock with an active reference instead and call bdev_thaw() without holding s_umount. - procfs: Return EACCES instead of success when the ptrace access check for namespace links fails. - afs: Use afs_dir_get_block() rather than afs_dir_find_block() for block 0 in afs_edit_dir_remove(), matching afs_edit_dir_add(). - Push the memcg gating of ->nr_cached_objects() down into the btrfs and shmem callbacks instead of skipping every callback during non-root memcg reclaim. The blanket check short-circuited XFS whose inode reclaim hook is intentionally driven from per-memcg contexts to free memcg-charged slab. - eventpoll: Pin files while checking reverse paths. Since struct file became SLAB_TYPESAFE_BY_RCU a concurrent close could free and recycle the file under the check which then took and dropped the f_lock of whatever live file now occupies that slot. * tag 'vfs-7.2-rc5.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (24 commits) super: fix emergency thaw deadlock on frozen block devices pidfs: make pidfs_ino_lock static eventpoll: pin files while checking reverse paths fs: push nr_cached_objects memcg gating into individual filesystems afs: Fix afs_edit_dir_remove() to get, not find, block 0 iomap: prevent ioend merge when io_private differs iomap: add comments for ifs_clear/set_range_dirty() iomap: fix out-of-bounds bitmap_set() with zero-length range iomap: fix incorrect did_zero setting in iomap_zero_iter() iomap: support invalidating partial folios iomap: correct the range of a partial dirty clear fs/super: fix emergency thaw double-unlock of s_umount pidfs: handle FS_IOC32_GETVERSION in compat ioctl ovl: check access to copy_file_range source with src mounter creds proc: Fix broken error paths for namespace links pidfs: add pidfs_dentry_open() helper selftests/pidfd: check PIDFD_THREAD survives open_by_handle_at() pidfs: preserve thread pidfds reopened by file handle ovl: fix trusted xattr escape prefix matching selftests/fuse: add ACL_DONT_CACHE regression test ...
2026-07-26Merge tag 'char-misc-7.2-rc5' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc driver fixes from Greg KH: "Here are a number of small char/misc/etc driver fixes for 7.2-rc5 that resolve a bunch of different reported issues. Included in here are: - rust_binder error message reporting fix - stratix10-svc firmware driver fixes - mei driver fix - intel_th hardware tracing driver fix - comedi driver fix - uio_hv_generic driver fix - ntsync selftest fix - nsm misc driver fix - some MAINTAINER file updates All of these have been in linux-next for over a week with no reported issues" * tag 'char-misc-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: MAINTAINERS: Update wine-devel list address rust_binder: only print failure if error has source intel_th: fix MSC output device reference leak misc: nsm: pin the module while the device is open mei: bus: access mei_device under device_lock on cleanup misc: nsm: only unlock nsm_dev on post-lock error paths selftests: ntsync: correct CONFIG_NTSYNC name comedi: comedi_parport: deal with premature interrupt uio_hv_generic: Bind to FCopy device by default MAINTAINERS: Add Greg Kroah-Hartman to GPIB firmware: stratix10-svc: fix teardown order in remove to prevent race firmware: stratix10-svc: handle NO_RESPONSE in async poll firmware: stratix10-svc: fix FCS SMC call kernel-doc firmware: stratix10-svc: fix memory leaks and list corruption bugs
2026-07-26Merge tag 'trace-v7.2-rc4' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Move rb_desc->nr_page_va before updating dynamic array The rb_descr->page_va is a dynamic array counted by nr_page_va. But the updating of the page_va[] is done before the nr_page_va is incremented causing a build with CONFIG_UBSAN_BOUNDS to flag it as an overflow. Move the increment of the counted by value before the array element is updated. - Propagate errors from remote event bulk updates The return value of trace_remote_enable_event() was not being checked by remote_events_dir_enable_write() where it would silently fail. Have it check the return value and propagate that back up to user space. - Fix resource leak on mmiotrace trace_pipe close The mmiotrace tracer was created in 2008 before the trace_pipe had a close callback to allow tracers to do clean up from trace_pipe open. The trace_pipe close cleanup callback was added in 2009 but the mmiotrace tracer was not updated. It had a hack to do the cleanup in the read call, where it may leak if user space did not read the entire buffer. Add a callback to mmiotrace trace_pipe close do to the cleanup properly. - Fix a possible NULL pointer dereference in the mmiotrace tracer If the mmio_pipe_open() fails to find a PCI device, it will set the hiter->dev pointer to NULL. The read function will blindly dereference that pointer. Fix the read call to check to see if that pointer is populated before dereferencing it. - Fix union collision of module and refcnt for dynamic events In 'struct trace_event_call', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. The filter on module logic only checked if the 'module' was set to determine if the event belonged to the module. As dynamic events are always builtin, it doesn't need the 'module' field of the structure and used a refcount. But the module filtering logic would then mistaken these dynamic events as a module and call module_name(event->module) on it. Add a check to see if the event is a dynamic event and if so, do not check it for being part of the given module. - Reset the top level buffer in selftests before running instances The ftracetest selftest initializes each instance before executing the tests. But it does not reset the top level buffer. Dynamic events are only added and removed by the top level so any left over dynamic events will not be removed by the reset in the instances. Left over dynamic events can cause the tests to incorrectly fail. Reset the top level buffer before running the instances. - Make the context_switch counter 64 bit The code to read user space for a system call trace event or for a trace_marker will disable migration, enable preemption, read user space into a per CPU buffer, disable preemption and enable migration again. It checks if the per CPU context switch counter to see if it changed, and if it did not, it would know that the per CPU buffer was not touched by another task. But the save counter was 32 bit and it would compare it to the 64 bit context_switch variable. A long running system could have the context_switch variable greater that 1<<32 in which case the compare will always fail. The compare will promote the 32 bit int saved value to 64 bit and compare it to the full 64 bit counter. Since the top 32 bits of the saved value was zero, it would never match. - Fix a use-after-free of the event_enable trigger The event_enable trigger allows for enabling one event when another event is triggered. When the trigger is removed, it must go through a synchronization phase to make sure it is not triggered again. The trigger itself is delayed by the "bulk delay" logic that was recently added. But the code that frees the event_enable data used to rely on the trigger code to do the synchronization. Now that the code uses the call RCU functions (and a workqueue), that delay no longer is there. Add a callback private_data_free() function that allows triggers to clean up data after the synchronization phase has completed. - Move the module_ref counter into the delay callback Since an event of the event_enable trigger can enable an event for a module, it ups the module ref count for that event's module. This prevents the event from trying to enable an event that no longer exists and cause a use-after-free bug. The ref counter was set back down when the trigger was removed but not after thy synchronization phase. This could lead to the module data being accessed after module was unloaded. Move the module ref decrement into the private_data_free() callback of the event_enable trigger. - Add mutex to protect parser in ftrace filtering The set_ftrace_filter file uses a parsing descriptor that is allocated at open and modified by writes. If multiple threads were to write to the descriptor at the same time, it can corrupt the parser. Add a mutex around the modifications of the parser descriptor. - Fix possible corruption in perf syscall tracing The perf system call trace events can now read user space. To do so, the reads of user space enable preemption and disables it again. During this time that preemption is enabled, the task can migrate. The perf event list head is assigned via a per CPU pointer. It is done before the user space part is called. If the user space reading migrates the task to another CPU, then the head pointer is no longer valid. Re-assign the head pointer after the reading of user space to keep it using the correct data. * tag 'trace-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: perf: Fix stale head for perf syscall tracing ftrace: Add global mutex to serialize trace_parser access tracing: Delay module ref count for "enable_event" trigger tracing: Fix use-after-free freeing trigger private data tracing: Fix context switch counter truncation selftests/ftrace: Reset triggers at top level before instance loop tracing: Fix union collision of module and refcnt for dynamic events tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev tracing: Fix resource leak on mmiotrace trace_pipe close tracing: Propagate errors from remote event bulk updates tracing/remotes: Fix page_va[] access before counter update in trace_remote_alloc_buffer()
2026-07-26selftests/liveupdate: Move luo_test_utils.* into a reusable libraryVipin Sharma
Move luo_test_utils.[ch] into a lib/ directory and make libliveupdate library. Pull the rules to build them out into a separate libliveupdate.mk script. This will enable these utilities to be also built by and used within other selftests (such as VFIO). Update path in vmtest.sh as that one uses hardcoded path for util. No functional change intended. Co-developed-by: David Matlack <dmatlack@google.com> Signed-off-by: David Matlack <dmatlack@google.com> Acked-by: Pratyush Yadav (Google) <pratyush@kernel.org> Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com> Signed-off-by: Vipin Sharma <vipinsh@google.com> Link: https://patch.msgid.link/20260720203202.1964557-3-vipinsh@google.com Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-07-26selftests/liveupdate: Use luo_test_utils.c for liveupdate ioctl APIsVipin Sharma
Use luo_test_utils.c for all live update ioctl calls. Remove direct ioctl calls in liveupdate.c. This avoids code duplication and use common interface. While at it, make ioctl error check stricter as liveupdate APIs don't return postive numbers as a valid result. Co-developed-by: David Matlack <dmatlack@google.com> Signed-off-by: David Matlack <dmatlack@google.com> Reviewed-by: Pasha Tatashin <pasha.tatashin@soleen.com> Reviewed-by: Pratyush Yadav (Google) <pratyush@kernel.org> Signed-off-by: Vipin Sharma <vipinsh@google.com> Link: https://patch.msgid.link/20260720203202.1964557-2-vipinsh@google.com Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-07-26RDMA/selftests: Add rxe_netns_names testJiri Pirko
Add a kselftest script that exercises per-netns RDMA device naming with RXE. Cover duplicate names across namespaces, move conflict handling, move-with-rename, and same-namespace rename requests. Signed-off-by: Jiri Pirko <jiri@nvidia.com> Link: https://patch.msgid.link/20260716132316.1495242-15-jiri@resnulli.us Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-25tools/build: selftests: Remove some duplicate toolchain definitionsJames Clark
Try to remove some, but not all duplicate toolchain definitions. In these instances, their makefiles already include tools/scripts/Makefile.include which defines these in a consistent way. STRIP is the only one that was set with an '=', but I don't think it was significant so that difference can be dropped. Signed-off-by: James Clark <james.clark@linaro.org> Reviewed-by: Ian Rogers <irogers@google.com> Acked-by: Ihor Solodrai <ihor.solodrai@linux.dev> Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-24Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 7.2-rc5Eduard Zingerman
Cross-merge BPF and other fixes after downstream PR. Conflicts: net/core/filter.c Changes [2] in bpf-next conflict with a recent fix [1] from the 'net' tree. Resolved by using [1] as a base and applying same flags handling logic as in [2] in the bpf_redirect_peer() helper. [1] https://lore.kernel.org/all/20260706185609.330006-2-daniel@iogearbox.net/ [2] https://lore.kernel.org/all/20260618182035.43811-2-jordan@jrife.io/ Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-07-24Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpfLinus Torvalds
Pull bpf fixes from Eduard Zingerman: - Fix tcp_bpf_sendmsg() error path mistaking a concurrently-freed sk_psock->cork for the local temporary message and freeing it again (Chengfeng Ye) - Reject passing scalar NULL to nonnull arg of a global subprog. Previously the verifier did not account for the cases directly passing scalars to a global subprog, e.g.: 'global_func(0);' would pass even if 'global_func' argument was marked nonnull (Amery Hung) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() selftests/bpf: Test passing scalar NULL to nonnull global subprog bpf: Reject passing scalar NULL to nonnull arg of a global subprog
2026-07-24Merge tag 'nf-26-07-23' of ↵Jakub Kicinski
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter/IPVS fixes for net The following batch contains Netfilter/IPVS fixes for net. This batch includes a mix of IPVS follow ups related to Sashiko reports, as well as crash fixes for connection tracking expectation, helpers, ipset and nf_tables mostly for old bugs. This also includes a fix for the flowtable tunnel selftest. 1) Use s32 instead of s16 to calculate the remaining payload containing SIP messages, otherwise underflow is possible allowing out-of-bound memory access beyond the skb->data area. From Xiang Mei. 2) Fix the counter check in the flowtable selftest for tunnels, from Lorenzo Bianconi. 3) Add and use nf_ct_expect_related_pair() to add the RTP and RTCP expectations under the expectation lock, this is required by the SIP and H.323 NAT helpers. This fixes a possible reinsertion of an expectation with the DEAD flag set on while looping to find consecutive ports. 4) Fix ipset UaF during table resize by blocking comment updates on kernel-side adds. From David Lee. 5) Do not propagate the IP_VS_CONN_F_ONE_PACKET flag when using IPVS state synchronization, otherwise reaching stale freed from ip_vs_conn struct is possible, Zhiling Zou. 6) Adjust the hn1 hash node when the forwarding method changes between MASQ and non-MASQ for an already hashed connection. This can leave stale hash nodes pointing to a freed struct ip_vs_conn and trigger UaF while reading /proc/net/ip_vs_conn. From Julian Anastasov. 7) nft_object rhltable needs to be per table, just like chain rhltable, otherwise UaF from object lookup path while netns is being released. There is also the nlevent path that can reach stale objects. Placing this rhltable under the table hierarchy fixes this issue. 8) Reject invalid combined usage of hashlimit tables with and without XT_HASHLIMIT_RATE_MATCH flag mode, otherwise access to uninitialized .burst field of dsthash_ent is possible. 9) Fix checksum validations in IPVS performed from LOCAL_IN, from Julian Anastasov. 10) Fix incorrect packet offset to layer 4 protocol in IPVS, uncovered by Sashiko, from Julian Anastasov. 11) Skip the mangling of ICMP replies for non-first fragments, also reported by Sashiko. Also from Julian. 12) Clear ip_vs_conn flags under the spinlock to fix a possible data race. From Julian Anastasov. 13) Fix incorrect calculation of the payload bitmask in the nf_tables hardware offload support, leading to UBSAN splat. From Xiang Mei. * tag 'nf-26-07-23' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nft_payload: fix mask build for partial field offload ipvs: clear the nfct flag under lock ipvs: do not mangle ICMP replies for non-first fragments ipvs: fix places with wrong packet offsets ipvs: fix the checksum validations netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH netfilter: nf_tables: make nft_object rhltable per table ipvs: adjust double hashing when fwd method changes ipvs: do not propagate one-packet flag to synced conns netfilter: ipset: do not update comments from kernel-side hash adds netfilter: nf_conntrack_expect: add and use nf_ct_expect_related_pair() selftests: netfilter: nft_flowtable.sh: fix offload counter verification for tunnel tests netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() ==================== Link: https://patch.msgid.link/20260723163910.274695-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-24selftests/xsk: account reclaimed invalid Tx descriptorsMaciej Fijalkowski
Invalid Tx descriptors are now returned through the completion ring, regardless of whether they form a standalone packet or belong to an invalid multi-buffer packet. The selftests previously counted only descriptors belonging to valid packets, with a special exception for some invalid multi-buffer packets in verbatim streams. This undercounts completion entries when a standalone invalid descriptor or another invalid packet is reclaimed by the kernel. Keep valid_pkts as the number of packets expected on the Rx side, but count every descriptor submitted to the Tx ring in valid_frags, as every such descriptor is now expected to be returned through the completion ring. Make fragment counting in verbatim mode follow the packet boundary instead of stopping at the first invalid fragment. Update custom stream generation so an invalid middle fragment terminates the generated Rx packet while Tx completion accounting still covers the complete invalid packet. Also add explicit end fragments after invalid middle descriptors. This exercises the kernel drain logic and verifies that subsequent valid packets are not interpreted as continuations of the invalid packet. Reviewed-by: Jason Xing <kernelxing@tencent.com> Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Acked-by: Stanislav Fomichev <sdf@fomichev.me> Link: https://patch.msgid.link/20260719135609.147823-7-maciej.fijalkowski@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-24selftests/xsk: fix too-many-frags multi-buffer Tx testMaciej Fijalkowski
The too-many-frags test describes a packet that is valid from the Tx ring ownership point of view, but invalid for transmission because it exceeds the supported number of fragments. Keep the generated Tx descriptors valid so that __send_pkts() accounts them as outstanding descriptors that must be reclaimed through the CQ. Then mark the corresponding Rx packet invalid so the test still does not expect the oversized packet to appear on the receive side. Add a valid synchronization packet after the oversized packet so the test can verify that the Tx path drains the bad packet and resumes at the next packet boundary. Reviewed-by: Jason Xing <kernelxing@tencent.com> Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com> Acked-by: Stanislav Fomichev <sdf@fomichev.me> Link: https://patch.msgid.link/20260719135609.147823-6-maciej.fijalkowski@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-24selftests/net/af_unix: test listen() rejects wrong socket statesJohn Ericson
Add a regression test for the unix_listen() state check. The key case is listen() on a bound socket that has already been connected: it is no longer in TCP_CLOSE or TCP_LISTEN, so it must fail with EINVAL. A prepare_peercred() call slipped in ahead of that check once left err at 0 and made listen() silently succeed there instead; this guards against a repeat. The neighbouring outcomes are covered too so they cannot regress the same way: a bound socket in TCP_CLOSE listens fine, calling listen() again on a socket already in TCP_LISTEN is allowed, and an unbound socket fails with EINVAL. Each case runs for both listenable socket types (SOCK_STREAM and SOCK_SEQPACKET) and both pathname and abstract addresses. Fixes: fd0a109a0f6b ("net, pidfs: prepare for handing out pidfds for reaped sk->sk_peer_pid") Signed-off-by: John Ericson <mail@johnericson.me> Link: https://patch.msgid.link/20260718182903.2295560-2-John.Ericson@Obsidian.Systems Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-24selftests: drv-net: ncdevmem: Open /dev/udmabuf O_RDONLYT.J. Mercier
Write permissions on the /dev/udmabuf device file are not required to issue ioctls and allocate udmabufs. Applications should be opening this file as O_RDONLY. The BPF dmabuf_iter selftest already does this. [1] Users are pointing to these selftests as examples of how use udmabuf, and encountering permission errors on systems where write permissions are not available on /dev/udmabuf. Apply the principle of least privilege to selftests which use udmabuf by removing the write access mode from drivers/net/hw/ncdevmem.c. [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/tools/testing/selftests/bpf/prog_tests/dmabuf_iter.c?h=v7.1#n49 Signed-off-by: T.J. Mercier <tjmercier@google.com> Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com> Link: https://patch.msgid.link/20260722205442.1894665-1-tjmercier@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-24selftests/bpf: Fix memory leak on subtest_states reallocationFeng Yang
Fix memory leak in subtest_states reallocation, and revert subtest_num if allocation fails. Fixes: 0925225956bb ("bpf/selftests: Add granular subtest output for prog_test") Signed-off-by: Feng Yang <yangfeng@kylinos.cn> Link: https://lore.kernel.org/bpf/20260723085100.482147-6-yangfeng59949@163.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24selftests/bpf: Use calloc to allocate subtest_statesFeng Yang
An early return triggered by read_prog_test_msg leaves uninitialized elements, which leads to memory corruption during free_test_states cleanup. Signed-off-by: Feng Yang <yangfeng@kylinos.cn> Link: https://lore.kernel.org/bpf/20260723085100.482147-5-yangfeng59949@163.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24selftests/bpf: Fix missing allocation null checks in test_progs.cFeng Yang
Add null checks after memory allocations to prevent potential segmentation faults. Fixes: 79b453501310 ("tools/bpf: add a test for bpf_get_stack with tracepoint prog") Fixes: 0925225956bb ("bpf/selftests: Add granular subtest output for prog_test") Signed-off-by: Feng Yang <yangfeng@kylinos.cn> Link: https://lore.kernel.org/bpf/20260723085100.482147-4-yangfeng59949@163.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24selftests/bpf: Fix incorrect error checking for pthread_createFeng Yang
pthread_create returns 0 on success and a positive error code on failure; it never returns a negative value. The current conditional branch can never be taken. Failures during thread creation are silently ignored, which will lead to invalid memory access when waiting on threads or dereferencing thread handles later. Fixes: 91b2c0afd00c ("selftests/bpf: Add parallelism to test_progs") Signed-off-by: Feng Yang <yangfeng@kylinos.cn> Link: https://lore.kernel.org/bpf/20260723085100.482147-3-yangfeng59949@163.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24selftests/bpf: Fix extra free of subtest_state->nameFeng Yang
The name has already been freed in the free_subtest_state function and does not need to be freed again. The extra free is noop since the pointer was already set to NULL. Signed-off-by: Feng Yang <yangfeng@kylinos.cn> Link: https://lore.kernel.org/bpf/20260723085100.482147-2-yangfeng59949@163.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24s390/bpf: Enable atomics tests for s390Maxim Khmelevskii
Add s390 to the if statement, that defines CAN_USE_LOAD_ACQ_STORE_REL. Reuse CAN_USE_LOAD_ACQ_STORE_REL in arena_atomics selftest, to remove code duplication. Signed-off-by: Maxim Khmelevskii <max@linux.ibm.com> Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com> Link: https://lore.kernel.org/bpf/20260723140648.583055-8-max@linux.ibm.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24selftests/bpf: Add get_preempt_count() support for RISC-VTiezhu Yang
Currently, there is no RISC-V support for get_preempt_count() and its fallback path always returns 0. Add it so that bpf_in_interrupt(), bpf_in_nmi(), bpf_in_hardirq(), bpf_in_serving_softirq(), and bpf_in_task() work for RISC-V as well. Given that RISC-V has supported CONFIG_THREAD_INFO_IN_TASK since its initial commit fbe934d69eb7 ("RISC-V: Build Infrastructure") in 2017, directly retrieve preempt_count from the thread_info embedded within task_struct via bpf_get_current_task_btf(). This aligns the implementation with arm64, powerpc, and loongarch. Tested on a RISC-V virtual machine. Before: $ sudo ./test_progs -t exe_ctx ... #114 exe_ctx:FAIL Summary: 0/0 PASSED, 0 SKIPPED, 1 FAILED After: $ sudo ./test_progs -t exe_ctx #114 exe_ctx:OK Summary: 1/0 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn> Tested-by: Pu Lehui <pulehui@huawei.com> Reviewed-by: Pu Lehui <pulehui@huawei.com> Link: https://lore.kernel.org/bpf/20260722022906.8778-1-yangtiezhu@loongson.cn Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24selftests/bpf: Verify no warning when close fexit linkLeon Hwang
Add a test to verify that there's no WARNING when detaching fexit link by following the repro steps of previous commit. Without the fix, the WARNING could be triggered by this test. Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Reviewed-by: Pu Lehui <pulehui@huawei.com> Acked-by: Jiri Olsa <jolsa@kernel.org> Link: https://lore.kernel.org/bpf/20260722151909.69142-3-leon.hwang@linux.dev Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24selftests/bpf: Enable timed may_goto tests for riscv64Feng Jiang
Enable verifier_may_goto_1 (raw instruction tests), stream_cond_break (250ms timeout path), and the may_goto_interaction fastcall test on riscv64 now that the JIT supports timed may_goto. Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn> Reviewed-by: Pu Lehui <pulehui@huawei.com> Reviewed-by: Björn Töpel <bjorn@kernel.org> Acked-by: Björn Töpel <bjorn@kernel.org> Link: https://lore.kernel.org/bpf/20260723-riscv-bpf-timed-may-goto-v5-3-86acb54e5642@kylinos.cn Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24selftests/bpf: Test timed may_goto preserves R0-R5Feng Jiang
Add a test that checks R0-R5 are preserved across arch_bpf_timed_may_goto() calls. Use bpf_get_prandom_u32() to avoid the verifier removing the checks via DCE. Suggested-by: Björn Töpel <bjorn@kernel.org> Signed-off-by: Feng Jiang <jiangfeng@kylinos.cn> Reviewed-by: Pu Lehui <pulehui@huawei.com> Reviewed-by: Björn Töpel <bjorn@kernel.org> Acked-by: Björn Töpel <bjorn@kernel.org> Link: https://lore.kernel.org/bpf/20260723-riscv-bpf-timed-may-goto-v5-2-86acb54e5642@kylinos.cn Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-24selftests/ftrace: Reset triggers at top level before instance loopMasami Hiramatsu (Google)
When running instance tests, 'ftracetest' creates a new ftrace instance and runs the tests inside it. Before starting each test, it executes 'initialize_system()' to reset the ftrace state to initial-state. However, since 'initialize_system()' is executed in the context of the instance directory, it only cleans up triggers and filters of that instance. Any triggers or dynamic events left behind in the top-level instance by previous failed top-level tests, are left completely untouched. These top-level leftovers can cause subsequent instance-based tests to fail or even crash the kernel. Fix this by executing 'initialize_system()' in the top-level tracing directory once before entering the instance loop. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/178425671889.84440.9477850701738666404.stgit@devnote2 Fixes: b5b77be812de ("selftests: ftrace: Allow some tests to be run in a tracing instance") Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-07-24Merge branch 'for-7.3/cxl-type2-test' into cxl-for-nextDave Jiang
cxl_test support for type2 cxl/test: Rework cxl_type2_mem_init() to use cxl_mock_platform_device_add() cxl/test: Add cxl_test accelerator driver cxl/test: Fixup hdm init for auto region to support type2 cxl/test: Propagate -ENOMEM on platform_device_alloc() failures cxl/test: Add hierarchy enumeration support for type2 device cxl/test: Refactor platform device enumerations cxl/test: Add type2 support for mock CFMWS0 cxl/test: Add test for module parameters
2026-07-23selftests/bpf: Test passing scalar NULL to nonnull global subprogAmery Hung
Make sure the verifier reject passing a hardcoded NULL to an __arg_nonnull argument. Signed-off-by: Amery Hung <ameryhung@gmail.com> Link: https://patch.msgid.link/20260723221815.367797-2-ameryhung@gmail.com Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-07-23Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.2-rc5). Conflicts: drivers/net/amt.c 3656a79f94c47 ("amt: re-read skb header pointers after every pull") 586c4dcf28eb6 ("amt: no longer rely on RTNL in amt_fill_info()") https://lore.kernel.org/amIaJr3aOQNS_Fvl@sirena.org.uk Adjacent changes: drivers/net/geneve.c 8efb8f8bbb35 ("geneve: require CAP_NET_ADMIN in the device netns for changelink") 0ba269933f73 ("geneve: convert config to RCU-protected pointer") Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-23Merge tag 'net-7.2-rc5' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Lots of fixes, double the count even for the 'new normal'. Largely due to my time off followed by a networking conference which distracted most maintainers (less so the AI generators). Including fixes from Bluetooth and WiFi. Current release - regressions: - wifi: mt76: fix MAC address for non OF pcie cards Current release - new code bugs: - mptcp: fix BUILD_BUG_ON on legacy ARM config - wifi: cfg80211: guard optional PMSR nominal time Previous releases - regressions: - qrtr: ns: raise node count limit to 512, we arbitrarily picked 256 as a limit, turns out it was too low for real world deployments - vhost-net: fix TX stall when vhost owns virtio-net header - eth: amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN - wifi: ath12k: fix low MLO RX throughput on WCN7850 Previous releases - always broken: - number of random AI fixes for SCTP, RDS and TIPC protocols - more AI-looking fixes for WiFi drivers - number of fixes for missing pointer reloading after skb pull - reject BPF redirect use from qdisc qevent block - tcp: initialize standalone TCP-AO response padding - vsock/virtio: collapse receive queue under memory pressure to avoid client OOMing the host with tiny messages - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup, make sure the ICMP response routing follows the routing policy - gro: fix double aggregation of flush-marked skbs - ovpn: fix various refcount bugs - tls: device: push pending open record on splice EOF - eth: mlx5: - use sender devcom for MPV master-up - fix MCIA register buffer overflow on 32 dword reads" * tag 'net-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (234 commits) drop_monitor: perform u64_stats updates under IRQ-disabled section drop_monitor: fix size calculations for 64-bit attributes net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD mptcp: fix BUILD_BUG_ON on legacy ARM config selftests: mptcp: userspace_pm: fix undefined variable port mptcp: fix stale skb->sk reference on subflow close mptcp: pm: userspace: fix use-after-free in get_local_id mptcp: decrement subflows counter on failed passive join mac802154: hold an interface reference across the scan worker sctp: don't free the ASCONF's own transport in DEL-IP processing phonet: check register_netdevice_notifier() error in phonet_device_init() phonet: pep: fix use-after-free in pep_get_sb() bnge/bng_re: fix ring ID widths tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() net: airoha: fix ETS channel derivation in airoha_tc_setup_qdisc_ets() mctp: check register_netdevice_notifier() error in mctp_device_init() ptp: netc: explicitly clear TMR_OFF during initialization rds: tcp: unregister sysctl before tearing down listen socket ipv6: Change allocation flags to match rcu_read_lock section requirements net: slip: serialize receive against buffer reallocation ...
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-10 14:45:31 +0000