summaryrefslogtreecommitdiff
path: root/tools
AgeCommit message (Collapse)Author
2026-07-15selftests/ftrace: Add test case for a symbol in a module without module nameMasami Hiramatsu (Google)
Add a test case for probing on a symbol in a module without module name. When probing on a symbol in a module, ftrace accepts both the syntax that <MODNAME>:<SYMBOL> and <SYMBOL>. Current test case only checks the former syntax. This adds a test for the latter one. Link: https://lore.kernel.org/all/169846405196.88147.17766692778800222203.stgit@devnote2/ Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
2026-07-14nvdimm: ndtest: remove redundant NULL check before vfree()Mohammad Shahid
vfree() safely handles NULL pointers, so the explicit NULL check before calling vfree() is unnecessary. This issue was reported by ifnullfree.cocci. Signed-off-by: Mohammad Shahid <mdshahid03@gmail.com> Reviewed-by: Dave Jiang <dave.jiang@intel.com> Link: https://patch.msgid.link/20260703135513.75840-1-mdshahid03@gmail.com Signed-off-by: Alison Schofield <alison.schofield@intel.com>
2026-07-14nvdimm: nfit: remove redundant NULL check before vfree()Mohammad Shahid
vfree() safely handles NULL pointers, so the explicit NULL check before calling vfree() is unnecessary. This issue was reported by ifnullfree.cocci. Signed-off-by: Mohammad Shahid <mdshahid03@gmail.com> Reviewed-by: Dave Jiang <dave.jiang@intel.com> Link: https://patch.msgid.link/20260703144851.80309-1-mdshahid03@gmail.com Signed-off-by: Alison Schofield <alison.schofield@intel.com>
2026-07-14selftests/cgroup: fix missing TAP output in test_hugetlb_memcgSong Hu
main() in test_hugetlb_memcg never calls ksft_print_header(), ksft_set_plan(), or ksft_finished(), so its output has no TAP plan and is not valid TAP, unlike the sibling test_memcontrol and test_kmem tests. Add the header/plan/finished calls following the same pattern. Signed-off-by: Song Hu <husong@kylinos.cn> Reviewed-by: Tao Cui <cuitao@kylinos.cn> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-07-14tools/sched_ext: scx_qmap: Fix stale API name in commentLiang Luo
The comment above dispatch_highpri() still references scx_bpf_dispatch[_vtime]_from_dsq(), which was renamed to scx_bpf_dsq_move[_vtime]() in v6.13 to unload the overloaded "dispatch" verb. The code below already uses the new names; only the comment was left behind during the rename. Fixes: 5cbb302880f5 ("sched_ext: Rename scx_bpf_dispatch[_vtime]_from_dsq*() -> scx_bpf_dsq_move[_vtime]*()") Signed-off-by: Liang Luo <luoliang@kylinos.cn> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-07-14KVM: selftests: Fix a spelling error in an xapic_ipi_test commentWang Yan
Fix typo "usefull" -> "useful" in xAPIC IPI test comment. Signed-off-by: Wang Yan <wangyan01@kylinos.cn> Link: https://patch.msgid.link/20260702015739.367597-1-wangyan01@kylinos.cn Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-14Merge tag 'sound-7.2-rc4' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small fixes. All are device-specific fixes (including regression fixes) or quirks accumulated since the last update. Some highlights: USB-audio: - Fix per-channel volume imbalance regression for sticky mixers - Validate input packet length in caiaq driver - Quirks for iBasso DC-Elite, Musical Fidelity M6s DAC, and Redragon H510-PRO Wireless headset HD-audio: - Fix a long-standing bug of cached processing coefficient verbs - Make cs35l56 driver failing with missing firmware - Fix cirrus codec Kconfig dependency, update MAINTAINERS - Remove unneeded mic bias threshold override on Conexant - Realtek codec quirks for ASUS ROG Ally X (headphone & mic), Dell QCM1255, Legion Pro 7, HP/Victus laptops, Framework, and TongFang laptops ASoC: - Add Eliza audio support on Qualcomm sc8280xp/sm8250 SoCs - Fix SDCA linker error with ACP on AMD - A few fixes for AMD ACP PCI driver - Add TAS2783 support on AMD ACP 7.0 platforms - Reset RT712-SDCA codec to fix silent headphone issue - Soft reset S/PDIF datapath on Meson AIU FIFO - Jack report fix for cs42l43 - TAS2562 shutdown GPIO clearing fix - Sidecar amps quirk for Lenovo laptop in SOF SDW driver Misc: - Drop redundant mod_devicetable.h includes from FireWire drivers - Fix memory leak and format mismatch in mixer kselftest" * tag 'sound-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (36 commits) ALSA: usb-audio: Add delay quirk for iBasso DC-Elite ALSA: hda: conexant: Remove mic bias threshold override ALSA: hda/realtek: Fix speakers on Legion Pro 7 16ARX8H with codec SSID 17aa:38a7 ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series ALSA: hda: cs35l56: Fail if wmfw file is missing ALSA: usb-audio: Skip DSD quirk for Musical Fidelity M6s DAC ALSA: hda: MAINTAINERS: Fix missing cirrus* file reference ALSA: hda/cirrus_scodec: Make Kconfig visible if KUNIT ALSA: hda/realtek: Add quirk for TongFang X6xx45xU ALSA: hda/realtek - Fixed Headphone noise issue for Dell QCM1255 ASoC: tas2562: fix deprecated 'shut-down' GPIO always cleared after lookup ASoC: cs42l43: Correct report for forced microphone jack ASoC: qcom: sc8280xp: Add support for Eliza ASoC: dt-bindings: qcom,sm8250: Add Eliza sound card ASoC: dt-bindings: qcom: Add Eliza LPASS macro codecs ALSA: hda/realtek: Add mic mute LED quirk for HP Laptop 15-fd0xxx ALSA: hda/realtek - Add quirk for HP Victus 15-fa0xxx (MB 8A50) ALSA: usb-audio: Add quirk for Redragon H510-PRO Wireless headset ASoC: amd: ps: replace bitwise OR with logical OR in IRQ return check ASoC: amd: ps: fix wrong ACP version string in pci_request_regions() ...
2026-07-14cxl/test: Rework cxl_type2_mem_init() to use cxl_mock_platform_device_add()Li Ming
cxl_type2_mem_init() is used to set up mock CXL type2 memory device for cxl testing, it introduces a known bug fixed by the following commit: commit d90f236f8b9e ("cxl/test: Update mock dev array before calling platform_device_add()") Mock CXL devices require updating the mock device array prior to platform_device_add(), otherwise, the CXL subsystem could fail to recognize the newly added mock device. Switch to cxl_mock_platform_device_add() helper to resolve this ordering issue. Besides, this patch also includes two minor changes. 1. Preserve the original error code returned by cxl_mock_platform_device_add(), rather than unconditionally overriding it with -ENOMEM. 2. Drop redundant NULL check before platform_device_unregister(), as the function internally handles NULL pointer. Fixes: 6b2e585142e6 ("cxl/test: Add hierarchy enumeration support for type2 device") Signed-off-by: Li Ming <ming.li@zohomail.com> Reviewed-by: Dave Jiang <dave.jiang@intel.com> Link: https://patch.msgid.link/20260713061531.56322-1-ming.li@zohomail.com Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-07-14kunit: configs: enable GPIO kunit test cases in all_tests.configBartosz Golaszewski
Enable CONFIG_GPIOLIB in all_tests.config to ensure the kunit test cases for GPIO core can be built with this config. Link: https://lore.kernel.org/r/20260629124245.27674-1-bartosz.golaszewski@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Reviewed-by: David Gow <david@davidgow.net> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2026-07-14tracing/probes: Eliminate recursion in parse_probe_arg()Masami Hiramatsu
To avoid potential stack overflows on limited kernel stacks, convert parse_probe_arg() from a recursive function into a loop-based implementation with a simple local state stack. Since recursion is eliminated using a loop with a fixed-size stack in the context, this restricts the dereference nesting depth. The maximum nesting depth of dereferences is now restricted to the same limit as typecasts (TRACEPROBE_MAX_NESTED_LEVEL, which is 8) and reports the same TOO_MANY_NESTED error. Update ftrace selftests to reflect this restriction and simplify the checks. Note that this change slightly alters the behavior of nested dereferencing in fetcharg. Previously, dereferencing without BTF allowed for up to 14 levels of nesting, whereas dereferencing with BTF was limited to 3 levels. With this change, the nesting depth is now limited to 8 levels in both cases. Link: https://lore.kernel.org/all/178399141396.27810.5390060618628718661.stgit@devnote2/ Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
2026-07-14tracing/probes: Extend max length of argument stringMasami Hiramatsu
To support BTF argument parsing (such as accessing fields within nested structures via typecasting), the maximum argument string length needs to be extended. Extend MAX_ARGSTR_LEN from 63 to 255. Since MAX_ARGSTR_LEN was previously reused to format command heads in trace_*probe_match_command_head() functions, introduce a dedicated MAX_COMMON_HEAD_LEN (63) macro for matching command heads and switch these functions to use the new macro. Link: https://lore.kernel.org/all/178399140457.27810.11387684872148824707.stgit@devnote2/ Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
2026-07-14tracing/probes: Add a new testcase for BTF typecastsMasami Hiramatsu (Google)
With the introduction of container_of-style BTF typecasting and per-CPU variable access support in trace probes, we need a way to verify their functionality and prevent regressions. Add a new ftrace kselftest and update the trace event sample module to test and validate these features. Specifically, update the trace-events-sample module to set up a periodic timer whose callback accesses a per-CPU counter. Introduce a new sample trace event, foo_timer_fn, to trace this callback and log the current counter value. Then, add a new test case, btf_probe_event.tc, which defines a dynamic probe on the timer callback. The probe uses BTF typecasting to recover the parent structure from the timer argument and this_cpu_read() to fetch the per-CPU counter. The test verifies the integrity of the implementation by ensuring the values recorded by the dynamic probe match those from the static tracepoint. Link: https://lore.kernel.org/all/178271368625.1176915.13502654445483530822.stgit@devnote2/ Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
2026-07-14tools/bootconfig: Ignore comment lines in dynamic_events/kprobe_events fileMasami Hiramatsu (Google)
Since dynamic_events/kprobe_events files show the fetcharg debug information as comment lines, its reader needs to ignore it. Link: https://lore.kernel.org/all/178271360563.1176915.423090353815990910.stgit@devnote2/ Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
2026-07-13tools/sched_ext: scx_qmap - Add sub-sched cap fault injectionTejun Heo
Add a fault-injection mode to the scx_qmap sub-scheduler that deliberately dispatches one of its own tasks to a cid it does not hold. The kernel cap check must reject it and re-enqueue with SCX_TASK_REENQ_CAP, so the nr_inject_attempts counter tracks nr_reenq_cap one to one, exercising the delivery-time cap enforcement. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-07-13tools/sched_ext: scx_qmap - Expand hierarchical sub-schedulingTejun Heo
sched_ext sub-scheduling began as dispatch delegation only: a parent could call into a child cgroup sub-scheduler's ops.dispatch() from its own dispatch path, but could not delegate cpus to the child for enqueue and the other paths. sched_ext has since gained cap-based cid delegation, where a parent grants and revokes a child's per-cid caps. Expand scx_qmap to demonstrate it. scx_qmap can now delegate the cids it holds exclusively, split among itself and its children by cpu.weight. Each gets the floor of its share as dedicated cids. The leftover from rounding forms a shared pool, round-robined among them as an ENQ_IMMED time-share. This shape is deliberate. Exclusive cids exercise the basic grant and revoke of ownership, and the shared pool exercises time-sharing one cid across several schedulers. The implemented policy is impractical, but it covers most of what a practical sub-scheduler would need without overcomplicating qmap. Delegation nests. A cid a node receives from its parent only as a round-robin share stays self-local and is never re-delegated. A node left with no exclusive cid, e.g. after its cpus went offline, evicts its children. v5: Highpri dispatch masked with self_cids, single-read dispatch cgroup_id, feed_weights race comment. (sashiko AI) v4: Track all idle cids and mask with self_cids at the dispatch pick, dropping the reseed. (sashiko AI) v3: Dispatch IMMED flags, repartition accounting order, partition-input snapshot. (sashiko AI) v2: Use __sync_fetch_and_add() for the shared nr_dsps counter. (sashiko AI) Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-07-13tools/sched_ext: Add three-mask cmask intersection iteratorTejun Heo
Add cmask_next_and2_set() and its round-robin wrap, extending cmask_next_and_set() to a three-mask intersection: the next cid set in all three masks at or after @start. A caller iterating the intersection of three cmasks can then scan it in one pass, folding the third mask into the word-level AND rather than skipping non-members one candidate at a time. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-07-13sched_ext: Add scx_bpf_sub_kill() to evict a child sub-schedulerTejun Heo
A cid-form scheduler can grant caps to and revoke them from its child sub-schedulers but has no way to tear one down. Add scx_bpf_sub_kill() to evict a direct child with a printf-style reason that reaches the child's scx_exit_info. No exit code is taken because the child is a separate scheduler whose exit-code semantics the parent cannot know. The child and its subtree are disabled through the usual async path under a new exit kind, SCX_EXIT_PARENT_KILL. The bstr formatting infrastructure in ext.c is exposed through internal.h with scx_ prefixes so the kfunc, which lives in sub.c, can format the reason. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-07-13sched_ext: Add per-shard cap delegation for sub-schedulersTejun Heo
Caps are per-cid permissions parents delegate to direct children via scx_bpf_sub_grant() / scx_bpf_sub_revoke(). A child's cap set is always a subset of its parent's. Sub-scheds check their caps locally, and cross-sched communication is needed only when the delegation set itself changes. Caps will be used to implement sub-sched scheduling on the enqueue path. Picking a cid for a task at a leaf depends on which cids the leaf is allowed to use, and resolving that programmatically on every enqueue would mean a cross-sched round-trip call chain, possibly retrying if the request can't be granted as-is. The dispatch path is different - it runs as top-down recursion via scx_bpf_sub_dispatch(). Locking is per shard. cid space is split into shards, and each sub-sched has its own pshard->lock for each shard. Operations are broken up on shard boundaries. Different shards never contend. Shards are expected to be topology-aligned and likely to serve as the locality unit when cids are allocated to schedulers, so per-shard lock granularity scales naturally with the allocation pattern. This patch adds the framework with a single dummy cap. Real caps land in later patches. The enable path is reordered for pshards. scx_arena_pool_init() moves ahead of scx_link_sched() so the pshards are allocated before the sched becomes reachable - scx_alloc_pshards() skips allocation when the arena pool isn't initialized. - scx_bpf_sub_grant(): Per-cid all-or-nothing grant to direct child. - scx_bpf_sub_revoke(): Clear caps on @cmask across @child and its subtree. - scx_bpf_sub_caps(): Lockless snapshot of caps on a cid range. /sys/kernel/sched_ext/SCHED/caps shows the caps each scheduler currently holds. v4: Move the pshard[] full build/publish and the err_disable scx_error() recording to earlier patches. (sashiko AI) v3: Build pshard[] fully before publishing it, read it with READ_ONCE. (sashiko AI) v2: Validate ops before scx_link_sched() publishes the sub. (sashiko AI) Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-07-13sched_ext: Add shard boundaries to scx_bpf_cid_override()Tejun Heo
An overridden cid mapping invalidates the auto-generated shard layout, so the override call has to provide both. Extend scx_bpf_cid_override() with a shard_start[] array that lists the first cid of each shard (starting at 0, strictly increasing, last shard implicitly extends to num_possible_cpus()). A scheduler that wants only custom shards with the auto-generated cid mapping can read the current mapping and pass it back unchanged. Overridden shards can span NUMA nodes, so scx_shard_node[] is rebuilt by majority count: each shard is assigned to the node that owns the most cpus in it. v2: Snapshot the caller's cpu_to_cid/shard_start arrays before validating. (sashiko AI) Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-07-13sched_ext: Add ops.init_cids() to finalize the cid layout before initTejun Heo
A cid-form scheduler that calls scx_bpf_cid_override() to install a custom cid layout can only do so from ops.init(). Enable-path setup that depends on the cid layout thus has to run after ops.init(), and ops.init() itself can't use anything derived from the final layout, which turned out to be too restrictive. Add an ops.init_cids() callback dedicated to finalizing the cid layout. It runs before the rest of the enable-path setup, so the final layout is in effect for everything that follows including ops.init(), which now runs after the arena pool and cmask scratch allocations. scx_bpf_cid_override() is restricted to ops.init_cids() at load time. It sits in a kfunc set gated by SCX_KF_ALLOW_INIT_CIDS, a flag set only on the init_cids op, so the verifier rejects a call from any other context. The runtime root-only check is dropped as ops.init_cids() only runs during root enable. The qmap demo moves its override into a dedicated qmap_init_cids() and, while at it, introduces an enum for the cid override modes instead of hard-coded integers. Signed-off-by: Tejun Heo <tj@kernel.org> Reviewed-by: Andrea Righi <arighi@nvidia.com>
2026-07-13Merge tag 'sched_ext-for-7.2-rc3-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext fixes from Tejun Heo: - Lifecycle fixes for the new sub-scheduler support: two use-after-frees and an enable-failure path that left a half-initialized sub-scheduler linked. - Two dispatch-path locking bugs: a spurious scheduler abort from a migration race, and a lockdep splat from stale runqueue-lock tracking. - Callback and task-state fixes: stale scheduler-owned state on a task leaving SCX, a weight callback running after disable, and a bogus warning on core-scheduling forced idle. - On nohz_full, finite-slice tasks could miss the tick that expires their slice. Enable it when such a task is picked, with a selftest. - Smaller fixes: userspace CPU-mask helpers, ratelimited deprecation warnings, docs and a sparse annotation. * tag 'sched_ext-for-7.2-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: sched_ext: Skip ops.set_weight() for disabled tasks tools/sched_ext: scx - Fix cmask_subset(), cmask_equal() and cmask_weight() sched_ext: Fix premature ops->priv publication in scx_alloc_and_add_sched() sched_ext: Record an error on errno-only sub-enable failure selftests/sched_ext: Verify nohz_full tick behavior sched_ext: Enable tick for finite slices on nohz_full sched_ext: Preserve rq tracking across local DSQ dispatch sched_ext: Documentation: Fix ops table header reference sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx() sched_ext: Pin parent scx_sched across a child sub-scheduler's lifetime sched_ext: Annotate ksyncs with __rcu in alloc/free_kick_syncs() sched_ext: Check remote rq eligibility under task's rq lock sched_ext: Reset dsq_vtime and slice when a task leaves SCX sched_ext: Avoid flooding the log with deprecation warnings
2026-07-13Merge tag 'trace-tools-v7.2-rc2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull RTLA fixes from Steven Rostedt: - Fix missing unistd include A missing #include <unistd.h> broke build on uclibc systems. Add the include to fix it. - Fix missing tools/lib/ctype.c dependency RTLA links tools/lib/string.c as a dependency of libsubcmd, some of its functions require _ctype. Link tools/lib/ctype.c as well, to fix build without GCC LTO. * tag 'trace-tools-v7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: rtla: Also link in ctype.c rtla: Fix missing unistd include
2026-07-13perf record: Fix multiple PERF_RECORD_COMPRESSED2 records per pushDmitry Ilvokhin
With Zstd compression enabled ('perf record -z'), a single mmap push whose compressed output exceeds the maximum record size makes zstd_compress_stream_to_records() emit several PERF_RECORD_COMPRESSED2 records back to back. record__pushfn() however rewrote only the first record's header to describe the whole blob as one record: event->data_size = compressed - sizeof(struct perf_record_compressed2); event->header.size = PERF_ALIGN(compressed, sizeof(u64)); padding = event->header.size - compressed; ... record__write(rec, map, &pad, padding); perf_event_header::size is a __u16, so once the compressed blob no longer fits in it the header.size assignment truncates and 'padding' (size_t) underflows. write() is then handed that bogus length and fails with EFAULT, aborting the recording: failed to write perf data, error: Bad address The bytes that did reach the file are mis-framed, so reading it back cannot be decompressed. This is easy to hit with a high event rate and a large buffer, e.g.: perf record -z -F max -m 32M --per-thread -- perf test -w thloop 5 1 The single-record fixup is wrong by construction: because header.size is 16 bits a compressed record cannot exceed 64KB, so the compressor must split a push into a chain of records, and the session reader already consumes them as such. Frame each record where it is produced instead: make process_comp_header() set the per-record data_size, 8-byte-align header.size and zero the trailing padding, and let record__pushfn() write the resulting blob, as the AIO path already does. Reduce max_record_size by sizeof(u64) so the per-record alignment padding cannot push header.size past its u16 field. process_comp_header() returns -1 when that padding would not fit the space left in 'dst', so the compressor stops instead of overrunning the output buffer. There is no on-disk format change; a perf.data written by the fixed tool is still read by existing perf. Fixes: 208c0e168344 ("perf record: Add 8-byte aligned event type PERF_RECORD_COMPRESSED2") Reported-by: Farid Zakaria <fmzakari@meta.com> Signed-off-by: Dmitry Ilvokhin <d@ilvokhin.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-13perf record: Return the written size from process_comp_header()Dmitry Ilvokhin
process_comp_header() is called from zstd_compress_stream_to_records() twice per record: once with data_size == 0 to write the record header, and once with the payload size to finalize it. It returns the increment it was passed, and the loop separately decides whether a record still fits by comparing the remaining 'dst_size' against the header size. With the fit check split from the code that writes the record, process_comp_header() cannot reject a record on its own, so any bytes it writes into 'dst' have to be bounds-checked by the caller instead of where they are produced. Pass the space left in 'dst' to process_comp_header(), let it return the number of bytes written or -1 when the header does not fit, and account the compressed payload in the loop. No functional change intended. Signed-off-by: Dmitry Ilvokhin <d@ilvokhin.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-13perf build: Do not pass -static to dlfiltersNamhyung Kim
The recent commit caused a failure in make build-test for static builds. Let's not pass -static the option to dlfilters which is dynamically loaded as it's hard-coded with -shared even for static builds. Tested-by: Leo Yan <leo.yan@arm.com> Cc: Trevor Allison <tallison@redhat.com> Fixes: e1065ed188cf ("perf build: Add LDFLAGS to dlfilters .so link") Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-13tools/sched_ext: scx_flatcg: Fix uninitialized stats on allocation failureLiang Luo
In fcg_read_stats(), the memset() that zeroes the output @stats array sits after the calloc() failure check. When calloc() fails, the function returns without writing @stats. The caller in main() declares acc_stats uninitialized, passes it as the @stats argument, and then reads it unconditionally: __u64 acc_stats[FCG_NR_STATS]; fcg_read_stats(skel, acc_stats); stats[i] = acc_stats[i] - last_stats[i]; // reads garbage Because fcg_read_stats() returns void, the caller cannot detect the failure. Reading the uninitialized array is undefined behavior, and the garbage is further copied into last_stats via memcpy(), corrupting the baseline used by the next interval. This regression was introduced by commit cabd76bbc036 ("tools/sched_ext: scx_flatcg: fix potential stack overflow from VLA in fcg_read_stats"), which replaced the VLA with calloc() and inserted the failure check before the existing memset(). Move the memset() above the calloc() failure check so @stats is always zeroed regardless of allocation outcome. Fixes: cabd76bbc036 ("tools/sched_ext: scx_flatcg: fix potential stack overflow from VLA in fcg_read_stats") Signed-off-by: Liang Luo <luoliang@kylinos.cn> Reviewed-by: Andrea Righi <arighi@nvidia.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2026-07-13x86/alternative: Drop smp_locks glueBorislav Petkov (AMD)
This was there to be able to patch out locking instructions when running a SMP kernel build on a UP CPU. The times are long gone when single-CPU x86 machines were relevant so drop that machinery and simplify the code considerably. LOCK_PREFIX needs to stay for when one wants to do a UP build for whatever reason. That'll go away when CONFIG_SMP becomes unconditional. Kill a bunch of leftover, unused prototypes while at it. Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org> Link: https://lore.kernel.org/r/20260328081634.797552-1-rppt@kernel.org
2026-07-12Merge tag 'usb-7.2-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are a number of small USB driver fixes for many reported issues. Included in here are: - usb serial driver corruption and use-after-free fixes - usb gadget rndis bugfixes for malicious/buggy host connections - typec driver fixes for a load of different tiny reported issues - typec mux driver revert for a broken patch in -rc1 - usb gadget driver fixes for many different reported problems - new usb device quirks added - usbip tool fixes and some core usbip fixes as well - dwc3 driver fixes for minor issues - xhci driver fixes for reported problems - lots of other tiny usb driver fixes for many tiny issues All of these have been in linux-next with no reported issues" * tag 'usb-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (56 commits) USB: core: ratelimit cabling message usb: misc: usbio: fix disconnect UAF in client teardown Revert "usb: typec: mux: avoid duplicated mux switches" USB: chaoskey: Fix slab-use-after-free in chaoskey_release() usb: ucsi: huawei_gaokun: move typec_altmode off stack usb: typec: tcpci_rt1711h: unregister TCPCI port with devres usb: typec: tcpm: Fix VDM type for Enter Mode commands usb: typec: ucsi: cancel pending work on system suspend usb: typec: class: drop PD lookup reference usb: typec: ps883x: Fix DP+USB3 configuration usb: xhci: Fix sleep in atomic context in xhci_free_streams() xhci: sideband: fix ring sg table pages leak usb: gadget: udc: Fix use-after-free in gadget_match_driver usb: dwc3: run gadget disconnect from sleepable suspend context usb: sl811-hcd: disable controller wakeup on remove usb: typec: anx7411: use devm_pm_runtime_enable() usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup() USB: misc: uss720: unregister parport on probe failure usb: gadget: function: rndis: add length check for header usb: gadget: function: rndis: add length check to response query ...
2026-07-12Merge tag 'riscv-for-linus-7.2-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: "The most notable change involves the rseq kselftest common Makefile (as it is not RISC-V-specific). The basic approach in the patch appears similar to one used in the KVM and S390 selftests (grep for LINUX_TOOL_ARCH_INCLUDE and SUBARCH), and the rseq kselftests pass a quick build test on x86 after this. - Avoid a null pointer deference in machine_kexec_prepare() that the IMA subsystem can trigger - Bypass libc in part of the ptrace_v_not_enabled kselftest to avoid noise from child atfork handlers that libc might run - Include Kconfig support for UltraRISC SoCs, already referenced by some device drivers; and enable it in our defconfig - Fix the build of the rseq kselftest for RISC-V by borrowing a technique from the KVM and S390 kselftests that includes arch-specific header files from tools/arch/<arch>/include - Fix some memory leaks in the RISC-V vector ptrace kselftests - Clean up some DT bindings and hwprobe documentation" * tag 'riscv-for-linus-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: selftests/riscv: ptrace: Fix memory leak of regset_data in vector tests selftests/rseq: Fix a building error for riscv arch riscv: defconfig: enable ARCH_ULTRARISC riscv: add UltraRISC SoC family Kconfig support riscv: hwprobe.rst: Document EXT_ZICFISS and EXT_ZICFILP riscv: hwprobe.rst: Make indentation consistent dt-bindings: riscv: sort multi-letter Z extensions alphanumerically selftests: riscv: Bypass libc in inactive vector ptrace test riscv: Prevent NULL pointer dereference in machine_kexec_prepare()
2026-07-12Merge tag 'trace-v7.2-rc2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Free field in error path of synthetic event parse In __create_synth_event() the field was allocated but was not freed in the error path - Fix ring_buffer_event_length() on 8 byte aligned architectures On architectures with CONFIG_HAVE_64BIT_ALIGNED_ACCESS set to y, the ring_buffer_event_length() may return the wrong size. This is because archs with that config set will always use the "big event meta header" as that is 8 bytes keeping the payload 8 bytes aligned, even when a 4 byte header could hold the size of the event But ring_buffer_event_length() doesn't take this into account and only subtracts 4 bytes for the meta header in the length when it should have subtracted 8 bytes - Have osnoise wait for a full rcu synchronization on unregister osnoise_unregister_instance() used to call synchronize_rcu() before freeing its copy of the instance but was switched to kfree_rcu(). The osniose tracer has code that traverses the instances that it uses, and inst is just a pointer to that instance. By using kfree_rcu() instead of synchronize_rcu(), the instance that the inst pointer is pointing to can be freed while the osnoise code is still referencing it That is, a rmdir on an instance first unregisters the tracer. When the unregister finishes, the rmdir expects that the tracer is finished with the instance that it is using. By putting back the synchronize_rcu() in osnoise_unregister_instance() the unregistering of osnoise will now return when all the users of the instance have finished - Remove an unused setting of "ret" in tracing_set_tracer() - Fix ring_buffer_read_page() copying events The commit that changed ring_buffer_read_page() to show dropped events from the buffer itself, split the "commit" variable between the commit value (with flags) and "size" that holds the size of the sub-buffer. A cut and paste error changed the test of the reading from checking the size of the buffer to the size of the event causing reads to only read one event at a time - Make tracepoint_printk a static variable When the tracing sysctl knobs were move from sysctl.c to trace.c, the variable tracepoint_printk no longer needed to be global. Make it static - Fix some typos - Fix NULL pointer dereference in func_set_flag() The flags update of the function tracer first checks if the value of the flag is the same and exits if they are, and then it checks if the current tracer is the function tracer and exits if it isn't. The problem is that these checks need to be in a reversed order, as if the tracer isn't the function tracer, then the flag being checked may not exist. Reverse the order of these checks - Fix ufs core trace events to not dereference a pointer in TP_printk() The TP_printk() part of the TRACE_EVENT() macro is called when the user reads the "trace" file. This can be seconds, minutes, hours, days, weeks, and even months after the data was recorded into the ring buffer. Thus, saving a pointer to an object into the ring buffer and then dereferencing it from TP_printk() can cause harm as the object the pointer is pointing to may no longer exist Fix all the trace events in ufs core to save the device name in the ring buffer instead of dereferencing the device descriptor from TP_printk() - Prevent out-of-bound reads in glob matching of trace events The filter logic of events allows simple glob logic to add wild cards to filter on strings. But some events have fields that may not have a terminating 'nul' character. This may cause the glob matching to go beyond the string. Change the logic to always pass in the length of the field that is being matched - Add no-rcu-check version of trace_##event##_enabled() The trace_##event##_enabled() usually wraps trace events to do extra work that is only needed when the trace event is enabled. But this can hide events that are placed in locations where RCU is not watching, and can make lockdep not see these bugs when the event is not enabled The trace_##event##_enabled() was updated to always test to make sure RCU is watching to catch locations that may call events without RCU being active This caused a false positive for the irq_disabled() and related events. As that use trace_irq_disabled_enabled() to force RCU to be watching when the event is enabled via the ct_irq_enter() function, calls the event, and then calls ct_irq_exit() to put RCU back to its original state The trace_irq_disabled_enabled() should not trigger a warning when RCU is not watching because the code within its block handles the case properly. Make a __trace_##event##_enabled() version for this event to use that doesn't check RCU is watching as it handles the case when it isn't - Fix use-after-free in user_event_mm_dup() When the enabler is removed from the link list, it is freed immediately. But it is protected via RCU and needs to be freed after an RCU grace period. Use queue_rcu_work() so that the event_mutex can also be taken as user_event_put() takes the mutex on the last reference is released - Free type string in error path of parse_synth_field() There's an error path in parse_synth_field() where the allocated type string is not freed - Add selftest that tests deferred event teardown - Fix leak in error path of trace_remote_alloc_buffer() If page allocation fails, the desc->nr_cpus is not incremented for the current CPU and the allocations done for it are not freed - Fix allocation length in trace_remote_alloc_buffer() The logic to calculate the struct_len was doing a double count and setting the value too large. Calculate the size upfront to fix the error and simplify the logic - Fix sparse CPU masks in ring_buffer_desc() If there are sparse CPUs (gaps in the numbering), the ring_buffer_desc() will fail as it tests the CPU number against the number of CPUs that are used * tag 'trace-v7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ring-buffer: Allow sparse CPU masks in ring_buffer_desc() tracing/remotes: Fix struct_len in trace_remote_alloc_buffer() tracing/remotes: Fix leak in trace_remote_alloc_buffer() error path selftests/user_events: Wait for deferred event teardown after unregister tracing/synthetic: Free type string on error path tracing/user_events: Fix use-after-free in user_event_mm_dup() tracing: Add a no-rcu-check version of trace_##event##_enabled() tracing: Prevent out-of-bounds read in glob matching ufs: core: tracing: Do not dereference pointers in TP_printk() tracing: Fix NULL pointer dereference in func_set_flag() samples: ftrace: Fix typos in benchmark comment tracing: Make tracepoint_printk static as not exported ring-buffer: Fix ring_buffer_read_page() copying only one event per page tracing: Remove unused ret assignment in tracing_set_tracer() tracing/osnoise: Call synchronize_rcu() when unregistering ring-buffer: Fix event length with forced 8-byte alignment tracing/synthetic: Free pending field on error path
2026-07-12selftests/nolibc: add debug informationThomas Weißschuh
When working on nolibc, debug information is very valuable. I find myself adding this flag in many patchsets. Enable debug information unconditionally, as there is no downside to it. Signed-off-by: Thomas Weißschuh <linux@weissschuh.net> Acked-by: Willy Tarreau <w@1wt.eu> Link: https://patch.msgid.link/20260707-nolibc-debug-v1-1-31619ec94bbd@weissschuh.net
2026-07-12selftests/bpf: Test fentry link after tracing_multi linkLeon Hwang
Verify that there's no any issue to attach tracing_multi link, then attach fentry link. Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Acked-by: Jiri Olsa <jolsa@kernel.org> Link: https://lore.kernel.org/bpf/20260711124822.29406-3-leon.hwang@linux.dev Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-12selftests/bpf: Test bpf_cpumask_populate() rejects a borrowed cpumaskNicholas Dudar
bpf_cpumask_populate() now takes a struct bpf_cpumask *, so update the kfunc declaration and drop the struct cpumask * casts in the existing populate tests. Add test_populate_borrowed_destination, which passes a borrowed task->cpus_ptr and asserts the verifier rejects it as a writable destination. Signed-off-by: Nicholas Dudar <main.kalliope@gmail.com> Acked-by: Tejun Heo <tj@kernel.org> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/bpf/20260709182800.2037938-3-main.kalliope@gmail.com Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-12bpf: Require a BPF cpumask for bpf_cpumask_populate()Nicholas Dudar
bpf_cpumask_populate() writes to its destination with bitmap_copy(), but the destination is typed as struct cpumask *. That allows the verifier to accept borrowed cpumask pointers returned by read-only kfuncs, such as scx_bpf_get_online_cpumask(), as a writable destination. Make the destination a struct bpf_cpumask * so populate follows the same ownership rule as the other mutating cpumask kfuncs. Query kfuncs continue to accept const struct cpumask * inputs. Fixes: 950ad93df2fc ("bpf: add kfunc for populating cpumask bits") Signed-off-by: Nicholas Dudar <main.kalliope@gmail.com> Acked-by: Tejun Heo <tj@kernel.org> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/bpf/20260709182800.2037938-2-main.kalliope@gmail.com Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-11objtool/rust: add one more `noreturn` Rust function for Rust 1.99.0Miguel Ojeda
Starting with Rust 1.99.0 (expected 2026-10-01), under `CONFIG_RUST_DEBUG_ASSERTIONS=y`, `objtool` may report: rust/kernel.o: warning: objtool: _R..._6kernel12module_param9set_paramaEB4_() falls through to next function _R..._6kernel12module_param9set_paramhEB4_() (and many others) due to calls to the `noreturn` symbol [1]: core::panicking::panic_null_reference_constructed Thus add the mangled one to the list so that `objtool` knows it is actually `noreturn`. See commit 56d680dd23c3 ("objtool/rust: list `noreturn` Rust functions") for more details. Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs). Cc: Josh Poimboeuf <jpoimboe@kernel.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Petr Pavlu <petr.pavlu@suse.com> Link: https://github.com/rust-lang/rust/pull/158796 [1] Reported-by: Alice Ryhl <aliceryhl@google.com> Closes: https://lore.kernel.org/rust-for-linux/alEBInX9gD1M5NAr@google.com/ Reviewed-by: Alice Ryhl <aliceryhl@google.com> Tested-by: Alice Ryhl <aliceryhl@google.com> Link: https://patch.msgid.link/20260710173252.191781-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-07-10perf metricgroup: Fix metric expression copy leaksYu Peng
metricgroup__copy_metric_events() allocates a new metric expression and duplicates metric_name before linking the expression into the destination metric event. Free new_expr when strdup() fails, and free the duplicated metric_name on the later error paths. Fixes: b85a4d61d302 ("perf metric: Allow modifiers on metrics") Signed-off-by: Yu Peng <pengyu@kylinos.cn> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-10perf clang-format: Prioritize Python.h and expand other categoriesIan Rogers
This commit updates the .clang-format rules for the perf tools. It prioritizes Python.h sorting and expands the regex lists for C standard library and OS specific headers. - Prioritize Python.h by sorting it first (Priority -1), ensuring it is sorted before even the main header (Priority 0). - Keep other header priorities (1 and 2) to maintain their relative order. - Sanity check and complete "C Standard Library Headers" up to C23 (added stdbit.h, stdckdint.h). - Sanity check and complete "OS/System-Specific Headers" based on actual usage in tools/perf (added asm-generic, uapi, and various flat POSIX/system headers). Signed-off-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-10perf record: Fix teardown hang on system-wide multi-threaded sessionsIan Rogers
Under system-wide (-a) parallel streaming mode (--threads=cpu), background recording threads can be inundated by a continuous firehose of hardware samples generated by the OS. In this state, a background thread's local hit count remains unequal to its sample count, causing it to bypass the blocking fdarray__poll() call entirely on each iteration of its recording loop. Because the termination check relies on the POLLHUP event status populated specifically by fdarray__poll(), bypassing it prevents the background thread from ever recognizing that its control pipe was closed by the main thread. This traps the background thread in an infinite recording loop, hanging the main thread indefinitely as it awaits a termination acknowledgment that never arrives. Ensure teardown completion by adding explicit evlist__disable() calls in the main thread's cleanup paths at out_child: and out_child_no_flush:. Additionally, patch fdarray__filter() to respect the fdarray_flag__nonfilterable flag, preventing it from incorrectly setting the background thread's control pipe file descriptor to -1 and clearing its revents mask upon processing termination POLLHUP signals. Fixes: f94563fac269 ("perf record: fix poll storm when monitored threads exit") Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Ian Rogers <irogers@google.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-10libbpf: Fix double-free of distilled base BTF on .BTF.ext parse errorNaveed Khan
When btf_parse_elf() is called without a caller-supplied base_btf (i.e. via the public btf__parse_elf()) and the object file carries a .BTF.base (distilled base) section, a dist_base_btf object is created and used as the base of the split BTF built from the .BTF section. Because base_btf is NULL, the relocation block that would otherwise free and clear dist_base_btf is skipped, and ownership of dist_base_btf is instead transferred to the split btf by setting btf->owns_base = true. That ownership transfer was performed before the fallible btf_ext__new() call that parses the .BTF.ext section. If .BTF.ext is malformed, btf_ext__new() fails and the function jumps to the error path, which frees dist_base_btf directly and then frees btf. Since owns_base is already set, btf__free(btf) also frees btf->base_btf, which is the same dist_base_btf object. The result is a use-after-free read followed by a double free of the base BTF, driven entirely by a crafted object file (a .BTF + .BTF.base + malformed .BTF.ext combination) passed to btf__parse_elf(), as used by bpftool, pahole and similar tools. Transfer ownership only after .BTF.ext has been parsed successfully, so that any earlier failure leaves dist_base_btf owned solely by the local cleanup path and it is freed exactly once. Signed-off-by: Naveed Khan <naveed@digiscrypt.com> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Link: https://lore.kernel.org/bpf/178345549172.94179.7948304165383170781@digiscrypt.com
2026-07-10selftests/bpf: veristat: Minimize map size during verificationEmil Tsalapatis
The veristat tool verifies that BPF objects along with their maps pass verification for a given kernel version. To do so, veristat loads the objects and maps into the kernel in order to pass them through the verifier. Currently, veristat sizes the maps according to the max_entries field provided by the program author. Depending on the map type this field may be irrelevant to the verification process. However, loading a large map can fail because of -ENOMEM errors. This is a problem when the map is supposed to run on large machines, but veristat tests it machines with significantly less RAM (e.g., CI). In that case veristat fails even if the program verifies. Expand veristat to resize maps whose max_entries are not relevant to verification. Set the max_entries value as low as possible to avoid -ENOMEM errors. Suggested-by: Andrii Nakryiko <andrii@kernel.org> Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Link: https://lore.kernel.org/bpf/20260708193239.5063-1-emil@etsalapatis.com
2026-07-10selftests/ftrace: fix spelling error in poll test commentWang Yan
Fix typo "happned" -> "happened" in ftrace poll test comment. Link: https://lore.kernel.org/r/20260702015634.366201-1-wangyan01@kylinos.cn Signed-off-by: Wang Yan <wangyan01@kylinos.cn> Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2026-07-10Merge tag 'arm64-fixes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: - Fix crash when using SMT hotplug on ACPI systems in conjunction with maxcpus= - Fix 30% kswapd performance regression introduced by C1-Pro SME erratum workaround - Fix TLB over-invalidation regression during memory hotplug - Fix incorrect encoding of FEAT_BWE2 value in ID_AA64DFR2_EL1.BWE - Typo fixes in the arm64 selftests * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: selftests/arm64: fix spelling errors in comments arm64/sysreg: Fix BWE field encoding in ID_AA64DFR2_EL1 arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range() arm64: Avoid eager DVMSync reclaim batches with C1-Pro SME erratum cpu/hotplug: Fix NULL kobject warning in cpuhp_smt_enable() arm64: smp: Fix hot-unplug tearing by forcing unregistration
2026-07-10Merge tag 'gpio-fixes-for-v7.2-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - provide the missing .get_direction() callback in gpio-palmas - fix interrupt handling in gpio-dwapb - add a GPIO self-test program binary to .gitignore - fix a resource leak in gpio-mvebu - make the GPIO sharing heuristic more adaptable * tag 'gpio-fixes-for-v7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: mvebu: free generic chips on unbind selftests: gpio: add gpio-cdev-uaf to .gitignore gpio: dwapb: Mask interrupts at hardware initialization gpio: dwapb: Defer clock gating until noirq gpio: shared: make the voting mechanism adaptable gpios: palmas: add .get_direction() op
2026-07-10selftests/tracing: Have trigger-hist-poll.tc use sched_process_exitSteven Rostedt
Currently trigger-hist-poll.tc uses sched_process_free to test the polling of the histogram file. The way it does that is to run sleep, then execute the poll.c code that polls on the sched_process_free for up to 4 seconds to test that when sleep triggers the sched_process_free trace event, it will update the histogram and wake the poll.c code up. The issue is that sched_process_free trace event is called by delayed_put_task_struct() which is called after a RCU grace period has ended. If CONFIG_RCU_LAZY is enabled, RCU callbacks are batched together and do not execute right away. This causes the delayed_put_task_struct() to be called after the poll.c function finishes and it will report an error that it did not wake up on the event. That's because the event didn't trigger during its wait time. Use sched_process_exit instead, which is called when a process exits and doesn't depend on RCU callbacks that may be delayed. Link: https://lore.kernel.org/r/20260708163436.058cc3df@gandalf.local.home Signed-off-by: Steven Rostedt <rostedt@goodmis.org> Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2026-07-10selftests/ftrace: Fix reading enabled_functions in add_remove_fprobe_module testSteven Rostedt
The add_remove_fprobe_module test checks the number of functions added to the enabled_functions file to make sure that the functions added or removed is as expected. The issue is that it expects this file to be empty on start up. Now that systemd uses BPF that attaches to functions via ftrace, this file is not empty in several systems: # cat /sys/kernel/tracing/enabled_functions bpf_lsm_file_open (1) R D M tramp: ftrace_regs_caller+0x0/0x61 (call_direct_funcs+0x0/0x50) direct(jmp)-->bpf_trampoline_6442529439+0x0/0xe9 Change the test to read the number of lines in enabled_functions at the start of the test and subtract that from the value of the count for the checks within the test. Link: https://lore.kernel.org/r/20260708153239.055d56dd@gandalf.local.home Signed-off-by: Steven Rostedt <rostedt@goodmis.org> Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2026-07-10KVM: selftests: Randomize pCPU in steal time testSean Christopherson
Pin the steal time test's tasks to a random pCPU in the system instead of hardcoding the test to always run on pCPU0 as a cheap way of increasing test coverage, and to do the "right thing" if the parent task of the test doesn't have pCPU0 in its CPU affinity mask. Link: https://patch.msgid.link/20260707150706.1198541-3-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-10KVM: selftests: Drop superfluous use of pthread_attr_setaffinity_np()Sean Christopherson
In the steal time test, don't explicitly set the CPU affinity mask of the worker child and instead rely on the child inheriting the affinity of the main thread. Per the pthread_create()[1] and pthread_setaffinity_np()[2] documentation, new threads inherit the parent's affinity mask. Linux-specific details The new thread inherits copies of the calling thread's capability sets (see capabilities(7)) and CPU affinity mask (see sched_setaffinity(2)). Out of an abundance of caution, assert that the child did indeed inherit the CPU affinity mask, as the test will hang indefinitely if the system is under light load. Dropping use of pthread_attr_setaffinity_np() allows building the steal time test against non-glibc C libraries that don't implement that GNU extension. Link: https://man7.org/linux/man-pages/man3/pthread_setaffinity_np.3.html [1] Link: https://man7.org/linux/man-pages/man3/pthread_create.3.html [1] Cc: Hisam Mehboob <hisamshar@gmail.com> Reported-by: Aqib Faruqui <aqibaf@amazon.com> Closes: https://lore.kernel.org/all/20250829142556.72577-4-aqibaf@amazon.com Link: https://patch.msgid.link/20260707150706.1198541-2-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-10KVM: selftests: Verify SNP VMs are rejected from migration and mirroringAtish Patra
Migration and mirroring of SEV-SNP VMs are not supported yet. Add two selftests that verify KVM rejects intra-host migration and mirroring when the source VM is an SNP VM, so the restriction stays enforced until proper SNP state transfer is implemented. Signed-off-by: Atish Patra <atishp@meta.com> Link: https://patch.msgid.link/20260602-sev_snp_fixes-v3-2-24bfd3ae047c@meta.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-10selftests/riscv: ptrace: Fix memory leak of regset_data in vector testsWang Yan
The regset_data buffer allocated with calloc() in the parent process of several vector ptrace tests is never freed before returning, causing memory leaks in: - ptrace_v_not_enabled - ptrace_v_early_debug - ptrace_v_syscall_clobbering - v_csr_invalid/ptrace_v_invalid_values - v_csr_valid/ptrace_v_valid_values Add free(regset_data) before kill(pid, SIGKILL) to release the allocated buffer. Signed-off-by: Wang Yan <wangyan01@kylinos.cn> Reviewed-by: Sergey Matyukevich <geomatsi@gmail.com> Link: https://patch.msgid.link/20260710083437.489648-1-wangyan01@kylinos.cn [pjw@kernel.org: Fixed Sergey's E-mail address] Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-07-10selftests: netfilter: add bridge tunnel flowtable regressionZhengyang Chen
Add a nft_flowtable.sh regression test for the bridge direct-xmit plus IPIP/IP6IP6 underlay configuration that reproduces the reachable DIRECT+tunnel tuple combination exercised by the flowtable fix. The test reuses the existing bridge and tunnel topology, installs flow rules for the tunnel egress and bridge reply path, verifies IPv4 and IPv6 forwarding, and checks the flowtable counters after the transfer. Signed-off-by: Zhengyang Chen <chzhengyang2023@lzu.edu.cn> Signed-off-by: Ren Wei <n05ec@lzu.edu.cn> Signed-off-by: Florian Westphal <fw@strlen.de>