summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-02-17selftests: forwarding: bridge_mdb_max: add tests for mdb_n_entries warningNikolay Aleksandrov
Recently we were able to trigger a warning in the mdb_n_entries counting code. Add tests that exercise different ways which used to trigger that warning. Reviewed-by: Ido Schimmel <idosch@nvidia.com> Signed-off-by: Nikolay Aleksandrov <nikolay@nvidia.com> Link: https://patch.msgid.link/20260213070031.1400003-3-nikolay@nvidia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-17net: bridge: mcast: always update mdb_n_entries for vlan contextsNikolay Aleksandrov
syzbot triggered a warning[1] about the number of mdb entries in a context. It turned out that there are multiple ways to trigger that warning today (some got added during the years), the root cause of the problem is that the increase is done conditionally, and over the years these different conditions increased so there were new ways to trigger the warning, that is to do a decrease which wasn't paired with a previous increase. For example one way to trigger it is with flush: $ ip l add br0 up type bridge vlan_filtering 1 mcast_snooping 1 $ ip l add dumdum up master br0 type dummy $ bridge mdb add dev br0 port dumdum grp 239.0.0.1 permanent vid 1 $ ip link set dev br0 down $ ip link set dev br0 type bridge mcast_vlan_snooping 1 ^^^^ this will enable snooping, but will not update mdb_n_entries because in __br_multicast_enable_port_ctx() we check !netif_running $ bridge mdb flush dev br0 ^^^ this will trigger the warning because it will delete the pg which we added above, which will try to decrease mdb_n_entries Fix the problem by removing the conditional increase and always keep the count up-to-date while the vlan exists. In order to do that we have to first initialize it on port-vlan context creation, and then always increase or decrease the value regardless of mcast options. To keep the current behaviour we have to enforce the mdb limit only if the context is port's or if the port-vlan's mcast snooping is enabled. [1] ------------[ cut here ]------------ n == 0 WARNING: net/bridge/br_multicast.c:718 at br_multicast_port_ngroups_dec_one net/bridge/br_multicast.c:718 [inline], CPU#0: syz.4.4607/22043 WARNING: net/bridge/br_multicast.c:718 at br_multicast_port_ngroups_dec net/bridge/br_multicast.c:771 [inline], CPU#0: syz.4.4607/22043 WARNING: net/bridge/br_multicast.c:718 at br_multicast_del_pg+0x1bbe/0x1e20 net/bridge/br_multicast.c:825, CPU#0: syz.4.4607/22043 Modules linked in: CPU: 0 UID: 0 PID: 22043 Comm: syz.4.4607 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 RIP: 0010:br_multicast_port_ngroups_dec_one net/bridge/br_multicast.c:718 [inline] RIP: 0010:br_multicast_port_ngroups_dec net/bridge/br_multicast.c:771 [inline] RIP: 0010:br_multicast_del_pg+0x1bbe/0x1e20 net/bridge/br_multicast.c:825 Code: 41 5f 5d e9 04 7a 48 f7 e8 3f 73 5c f7 90 0f 0b 90 e9 cf fd ff ff e8 31 73 5c f7 90 0f 0b 90 e9 16 fd ff ff e8 23 73 5c f7 90 <0f> 0b 90 e9 60 fd ff ff e8 15 73 5c f7 eb 05 e8 0e 73 5c f7 48 8b RSP: 0018:ffffc9000c207220 EFLAGS: 00010293 RAX: ffffffff8a68042d RBX: ffff88807c6f1800 RCX: ffff888066e90000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: ffff888066e90000 R09: 000000000000000c R10: 000000000000000c R11: 0000000000000000 R12: ffff8880303ef800 R13: dffffc0000000000 R14: ffff888050eb11c4 R15: 1ffff1100a1d6238 FS: 00007fa45921b6c0(0000) GS:ffff8881256f5000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa4591f9ff8 CR3: 0000000081df2000 CR4: 00000000003526f0 Call Trace: <TASK> br_mdb_flush_pgs net/bridge/br_mdb.c:1525 [inline] br_mdb_flush net/bridge/br_mdb.c:1544 [inline] br_mdb_del_bulk+0x5e2/0xb20 net/bridge/br_mdb.c:1561 rtnl_mdb_del+0x48a/0x640 net/core/rtnetlink.c:-1 rtnetlink_rcv_msg+0x77e/0xbe0 net/core/rtnetlink.c:6967 netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0xa68/0xad0 net/socket.c:2592 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2646 __sys_sendmsg net/socket.c:2678 [inline] __do_sys_sendmsg net/socket.c:2683 [inline] __se_sys_sendmsg net/socket.c:2681 [inline] __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2681 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fa45839aeb9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fa45921b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007fa458615fa0 RCX: 00007fa45839aeb9 RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000004 RBP: 00007fa458408c1f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fa458616038 R14: 00007fa458615fa0 R15: 00007fff0b59fae8 </TASK> Fixes: b57e8d870d52 ("net: bridge: Maintain number of MDB entries in net_bridge_mcast_port") Reported-by: syzbot+d5d1b7343531d17bd3c5@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/aYrWbRp83MQR1ife@debil/T/#t Reviewed-by: Ido Schimmel <idosch@nvidia.com> Signed-off-by: Nikolay Aleksandrov <nikolay@nvidia.com> Link: https://patch.msgid.link/20260213070031.1400003-2-nikolay@nvidia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-17net: arcnet: com20020-pci: fix support for 2.5Mbit cardsEthan Nelson-Moore
Commit 8c14f9c70327 ("ARCNET: add com20020 PCI IDs with metadata") converted the com20020-pci driver to use a card info structure instead of a single flag mask in driver_data. However, it failed to take into account that in the original code, driver_data of 0 indicates a card with no special flags, not a card that should not have any card info structure. This introduced a null pointer dereference when cards with no flags were probed. Commit bd6f1fd5d33d ("net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()") then papered over this issue by rejecting cards with no driver_data instead of resolving the problem at its source. Fix the original issue by introducing a new card info structure for 2.5Mbit cards that does not set any flags and using it if no driver_data is present. Fixes: 8c14f9c70327 ("ARCNET: add com20020 PCI IDs with metadata") Fixes: bd6f1fd5d33d ("net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()") Cc: stable@vger.kernel.org Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com> Link: https://patch.msgid.link/20260213045510.32368-1-enelsonmoore@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-17net/rds: rds_sendmsg should not discard payload_lenAllison Henderson
Commit 3db6e0d172c9 ("rds: use RCU to synchronize work-enqueue with connection teardown") modifies rds_sendmsg to avoid enqueueing work while a tear down is in progress. However, it also changed the return value of rds_sendmsg to that of rds_send_xmit instead of the payload_len. This means the user may incorrectly receive errno values when it should have simply received a payload of 0 while the peer attempts a reconnections. So this patch corrects the teardown handling code to only use the out error path in that case, thus restoring the original payload_len return value. Fixes: 3db6e0d172c9 ("rds: use RCU to synchronize work-enqueue with connection teardown") Reviewed-by: Simon Horman <horms@kernel.org> Signed-off-by: Allison Henderson <achender@kernel.org> Link: https://patch.msgid.link/20260213035409.1963391-1-achender@kernel.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-17xen-netback: reject zero-queue configuration from guestZiyi Guo
A malicious or buggy Xen guest can write "0" to the xenbus key "multi-queue-num-queues". The connect() function in the backend only validates the upper bound (requested_num_queues > xenvif_max_queues) but not zero, allowing requested_num_queues=0 to reach vzalloc(array_size(0, sizeof(struct xenvif_queue))), which triggers WARN_ON_ONCE(!size) in __vmalloc_node_range(). On systems with panic_on_warn=1, this allows a guest-to-host denial of service. The Xen network interface specification requires the queue count to be "greater than zero". Add a zero check to match the validation already present in xen-blkback, which has included this guard since its multi-queue support was added. Fixes: 8d3d53b3e433 ("xen-netback: Add support for multiple queues") Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu> Reviewed-by: Juergen Gross <jgross@suse.com> Link: https://patch.msgid.link/20260212224040.86674-1-n7l8m4@u.northwestern.edu Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-17net: usb: catc: enable basic endpoint checkingZiyi Guo
catc_probe() fills three URBs with hardcoded endpoint pipes without verifying the endpoint descriptors: - usb_sndbulkpipe(usbdev, 1) and usb_rcvbulkpipe(usbdev, 1) for TX/RX - usb_rcvintpipe(usbdev, 2) for interrupt status A malformed USB device can present these endpoints with transfer types that differ from what the driver assumes. Add a catc_usb_ep enum for endpoint numbers, replacing magic constants throughout. Add usb_check_bulk_endpoints() and usb_check_int_endpoints() calls after usb_set_interface() to verify endpoint types before use, rejecting devices with mismatched descriptors at probe time. Similar to - commit 90b7f2961798 ("net: usb: rtl8150: enable basic endpoint checking") which fixed the issue in rtl8150. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Suggested-by: Simon Horman <horms@kernel.org> Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu> Link: https://patch.msgid.link/20260212214154.3609844-1-n7l8m4@u.northwestern.edu Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-17ovpn: tcp - don't deref NULL sk_socket member after tcp_close()Antonio Quartulli
When deleting a peer in case of keepalive expiration, the peer is removed from the OpenVPN hashtable and is temporary inserted in a "release list" for further processing. This happens in: ovpn_peer_keepalive_work() unlock_ovpn(release_list) This processing includes detaching from the socket being used to talk to this peer, by restoring its original proto and socket ops/callbacks. In case of TCP it may happen that, while the peer is sitting in the release list, userspace decides to close the socket. This will result in a concurrent execution of: tcp_close(sk) __tcp_close(sk) sock_orphan(sk) sk_set_socket(sk, NULL) The last function call will set sk->sk_socket to NULL. When the releasing routine is resumed, ovpn_tcp_socket_detach() will attempt to dereference sk->sk_socket to restore its original ops member. This operation will crash due to sk->sk_socket being NULL. Fix this race condition by testing-and-accessing sk->sk_socket atomically under sk->sk_callback_lock. Link: https://lore.kernel.org/netdev/176996279620.3109699.15382994681575380467@eldamar.lan/ Link: https://github.com/OpenVPN/ovpn-net-next/issues/29 Signed-off-by: Antonio Quartulli <antonio@openvpn.net> Fixes: 11851cbd60ea ("ovpn: implement TCP transport") Link: https://patch.msgid.link/20260212213130.11497-1-antonio@openvpn.net Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-17Merge tag 'ovpn-net-20260212' of https://github.com/OpenVPN/ovpn-net-nextPaolo Abeni
Antonio Quartulli says: ==================== This batch includes the following fixes: * set sk_user_data before installing callbacks, to avoid dropping early packets * fix use-after-free in ovpn_net_xmit when accessing shared skbs that got released * fix TX bytes stats by adding-up every positively processed GSO segment ==================== Link: https://patch.msgid.link/20260212210340.11260-1-antonio@openvpn.net Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-17Merge branch 'eth-fbnic-fix-and-improve-header-data-split-configuration'Paolo Abeni
Bobby Eshleman says: ==================== eth: fbnic: fix and improve header/data split configuration This series fixes TCP HDS configuration in the fbnic driver and adds a devmem selftest for the intended behavior. The issues fixed include setting the correct CSR for EN_HDR_SPLIT, adjusting the hds threshold clamp to avoid long headers overflowing into the payload page, and configuring the device to use L4/L3/L2 header boundaries when present by programming the DMA hint bit unconditionally for all steering rule types. Prior to these fixes, small payloads fail devmem.check_rx_hds(). Testing: IFC0=enp1s0 IFC1=eth0 export REMOTE_TYPE=netns export REMOTE_ARGS=ns-remote export NETIF=$IFC0 export LOCAL_V4=192.0.3.1 export REMOTE_V4=192.0.3.2 sysctl -w net.ipv6.conf.$IFC0.keep_addr_on_down=1 ./tools/testing/selftests/drivers/net/hw/devmem.py TAP version 13 1..4 ok 1 devmem.check_rx ok 2 devmem.check_tx ok 3 devmem.check_tx_chunks ok 4 devmem.check_rx_hds To: Alexander Duyck <alexanderduyck@fb.com> To: Jakub Kicinski <kuba@kernel.org> To: kernel-team@meta.com To: Andrew Lunn <andrew+netdev@lunn.ch> To: David S. Miller <davem@davemloft.net> To: Eric Dumazet <edumazet@google.com> To: Paolo Abeni <pabeni@redhat.com> To: Mohsin Bashir <mohsin.bashr@gmail.com> To: Shuah Khan <shuah@kernel.org> Cc: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: linux-kselftest@vger.kernel.org Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com> ==================== Link: https://patch.msgid.link/20260211-fbnic-tcp-hds-fixes-v1-0-55d050e6f606@meta.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-17selftests: drv-net: add HDS payload sweep test for devmem TCPBobby Eshleman
Add check_rx_hds test that verifies header/data split works across payload sizes. The test sweeps payload sizes from 1 byte to 8KB, if any data propagates up to userspace as SCM_DEVMEM_LINEAR, then the test fails. This shows that regardless of payload size, ncdevmem's configuration of hds-thresh to 0 is respected. Add -L (--fail-on-linear) flag to ncdevmem that causes the receiver to fail if any SCM_DEVMEM_LINEAR cmsg is received. Use socat option for fixed block sizing and tcp nodelay to disable nagle's algo to avoid buffering. Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com> Link: https://patch.msgid.link/20260211-fbnic-tcp-hds-fixes-v1-4-55d050e6f606@meta.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-17eth: fbnic: set DMA_HINT_L4 for all flowsBobby Eshleman
fbnic always advertises ETHTOOL_TCP_DATA_SPLIT_ENABLED via ethtool .get_ringparam. To enable proper splitting for all flow types, even for IP/Ethernet flows, this patch sets DMA_HINT_L4 unconditionally for all RSS and NFC flow steering rules. According to the spec, L4 falls back to L3 if no valid L4 is found, and L3 falls back to L2 if no L3 is found. This makes sure that the correct header boundary is used regardless of traffic type. This is important for zero-copy use cases where we must ensure that all ZC packets are split correctly. Fixes: 2b30fc01a6c7 ("eth: fbnic: Add support for HDS configuration") Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com> Link: https://patch.msgid.link/20260211-fbnic-tcp-hds-fixes-v1-3-55d050e6f606@meta.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-17eth: fbnic: increase FBNIC_HDR_BYTES_MIN from 128 to 256 bytesBobby Eshleman
Increase FBNIC_HDR_BYTES_MIN from 128 to 256 bytes. The previous minimum was too small to guarantee that very long L2+L3+L4 headers always fit within the header buffer. When EN_HDR_SPLIT is disabled and a packet exceeds MAX_HEADER_BYTES, splitting occurs at that byte offset instead of the header boundary, resulting in some of the header landing in the payload page. The increased minimum ensures headers always fit with the MAX_HEADER_BYTES cut off and land in the header page. Fixes: 2b30fc01a6c7 ("eth: fbnic: Add support for HDS configuration") Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com> Acked-by: Mohsin Bashir <mohsin.bashr@gmail.com> Link: https://patch.msgid.link/20260211-fbnic-tcp-hds-fixes-v1-2-55d050e6f606@meta.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-17eth: fbnic: set FBNIC_QUEUE_RDE_CTL0_EN_HDR_SPLIT on RDE_CTL0Bobby Eshleman
Fix EN_HDR_SPLIT configuration by writing the field to RDE_CTL0 instead of RDE_CTL1. Because drop mode configuration and header splitting enablement both use RDE_CTL0, we consolidate these configurations into the single function fbnic_config_drop_mode. Fixes: 2b30fc01a6c7 ("eth: fbnic: Add support for HDS configuration") Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com> Acked-by: Mohsin Bashir <mohsin.bashr@gmail.com> Link: https://patch.msgid.link/20260211-fbnic-tcp-hds-fixes-v1-1-55d050e6f606@meta.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-02-16kbuild: rpm-pkg: Disable automatic requires for manual debuginfo packageNathan Chancellor
Stefano reports that after commit 62089b804895 ("kbuild: rpm-pkg: Generate debuginfo package manually"), building with an rpm package using rpm 4.20.0 fails with: RPM build errors: Dependency tokens must begin with alpha-numeric, '_' or '/': #�) = 0x0d000002 Dependency tokens must begin with alpha-numeric, '_' or '/': �) = 0x0d000000 Dependency tokens must begin with alpha-numeric, '_' or '/': ) = 0x7c0e000000 Unknown rich dependency op 'Hat': (Red Hat 15.2.1-7)) = 0x3130363230322000 Unknown rich dependency op 'Hat': (Red Hat 15.2.1-7)) = 0x4728203a43434800 Unknown rich dependency op 'Hat': (Red Hat 15.2.1-7)) = 0x3130363230322000 Unknown rich dependency op 'Hat': (Red Hat 15.2.1-7)) = 0x4728203a43434800 This error comes from the automatic requirements feature of rpm. The -debuginfo subpackage has no dependencies, so disable this feature with 'AutoReq: 0' for this subpackage, avoiding the error. This matches the official %_debug_template macro that rpm provides. While automatic provides should be default enabled, be explicit like %_debug_template does. Additionally, while in the area, add the manual debug information package to the Development/Debug group, further aligning with %_debug_template. Cc: stable@vger.kernel.org Fixes: 62089b804895 ("kbuild: rpm-pkg: Generate debuginfo package manually") Reported-by: Stefano Garzarella <sgarzare@redhat.com> Closes: https://lore.kernel.org/CAGxU2F7FFNgb781_A7a1oL63n9Oy8wsyWceKhUpeZ6mLk=focw@mail.gmail.com/ Tested-by: Stefano Garzarella <sgarzare@redhat.com> Link: https://patch.msgid.link/20260216-improve-manual-debuginfo-template-v1-1-e584b3f8d3be@kernel.org Signed-off-by: Nathan Chancellor <nathan@kernel.org>
2026-02-16io_uring/bpf_filter: pass in expected filter payload sizeJens Axboe
It's quite possible that opcodes that have payloads attached to them, like IORING_OP_OPENAT/OPENAT2 or IORING_OP_SOCKET, that these paylods can change over time. For example, on the openat/openat2 side, the struct open_how argument is extensible, and could be extended in the future to allow further arguments to be passed in. Allow registration of a cBPF filter to give the size of the filter as seen by userspace. If that filter is for an opcode that takes extra payload data, allow it if the application payload expectation is the same size than the kernels. If that is the case, the kernel supports filtering on the payload that the application expects. If the size differs, the behavior depends on the IO_URING_BPF_FILTER_SZ_STRICT flag: 1) If IO_URING_BPF_FILTER_SZ_STRICT is set and the size expectation differs, fail the attempt to load the filter. 2) If IO_URING_BPF_FILTER_SZ_STRICT isn't set, allow the filter if the userspace pdu size is smaller than what the kernel offers. 3) Regardless if IO_URING_BPF_FILTER_SZ_STRICT, fail loading the filter if the userspace pdu size is bigger than what the kernel supports. An attempt to load a filter due to sizing will error with -EMSGSIZE. For that error, the registration struct will have filter->pdu_size populated with the pdu size that the kernel uses. Reported-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-16io_uring/bpf_filter: move filter size and populate helper into structJens Axboe
Rather than open-code this logic in io_uring_populate_bpf_ctx() with a switch, move it to the issue side definitions. Outside of making this easier to extend in the future, it's also a prep patch for using the pdu size for a given opcode filter elsewhere. Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-16Merge tag 'slab-for-7.0-part2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull more slab updates from Vlastimil Babka: - Two stable fixes for kmalloc_nolock() usage from NMI context (Harry Yoo) - Allow kmalloc_nolock() allocations to be freed with kfree() and thus also kfree_rcu() and simplify slabobj_ext handling - we no longer need to track how it was allocated to use the matching freeing function (Harry Yoo) * tag 'slab-for-7.0-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: mm/slab: drop the OBJEXTS_NOSPIN_ALLOC flag from enum objext_flags mm/slab: allow freeing kmalloc_nolock()'d objects using kfree[_rcu]() mm/slab: use prandom if !allow_spin mm/slab: do not access current->mems_allowed_seq if !allow_spin
2026-02-16io_uring/cancel: de-unionize file and user_data in struct io_cancel_dataJens Axboe
By having them share the same space in struct io_cancel_data, it ends up disallowing IORING_ASYNC_CANCEL_FD|IORING_ASYNC_CANCEL_USERDATA from working. Eg you cannot match on both a file and user_data for cancelation purposes. This obviously isn't a common use case as nobody has reported this, but it does result in -ENOENT potentially being returned when trying to match on both, rather than actually doing what the API says it would. Fixes: 4bf94615b888 ("io_uring: allow IORING_OP_ASYNC_CANCEL with 'fd' key") Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-16Merge tag 'vfs-7.0-rc1.misc.2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull more misc vfs updates from Christian Brauner: "Features: - Optimize close_range() from O(range size) to O(active FDs) by using find_next_bit() on the open_fds bitmap instead of linearly scanning the entire requested range. This is a significant improvement for large-range close operations on sparse file descriptor tables. - Add FS_XFLAG_VERITY file attribute for fs-verity files, retrievable via FS_IOC_FSGETXATTR and file_getattr(). The flag is read-only. Add tracepoints for fs-verity enable and verify operations, replacing the previously removed debug printk's. - Prevent nfsd from exporting special kernel filesystems like pidfs and nsfs. These filesystems have custom ->open() and ->permission() export methods that are designed for open_by_handle_at(2) only and are incompatible with nfsd. Update the exportfs documentation accordingly. Fixes: - Fix KMSAN uninit-value in ovl_fill_real() where strcmp() was used on a non-null-terminated decrypted directory entry name from fscrypt. This triggered on encrypted lower layers when the decrypted name buffer contained uninitialized tail data. The fix also adds VFS-level name_is_dot(), name_is_dotdot(), and name_is_dot_dotdot() helpers, replacing various open-coded "." and ".." checks across the tree. - Fix read-only fsflags not being reset together with xflags in vfs_fileattr_set(). Currently harmless since no read-only xflags overlap with flags, but this would cause inconsistencies for any future shared read-only flag - Return -EREMOTE instead of -ESRCH from PIDFD_GET_INFO when the target process is in a different pid namespace. This lets userspace distinguish "process exited" from "process in another namespace", matching glibc's pidfd_getpid() behavior Cleanups: - Use C-string literals in the Rust seq_file bindings, replacing the kernel::c_str!() macro (available since Rust 1.77) - Fix typo in d_walk_ret enum comment, add porting notes for the readlink_copy() calling convention change" * tag 'vfs-7.0-rc1.misc.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: fs: add porting notes about readlink_copy() pidfs: return -EREMOTE when PIDFD_GET_INFO is called on another ns nfsd: do not allow exporting of special kernel filesystems exportfs: clarify the documentation of open()/permission() expotrfs ops fsverity: add tracepoints fs: add FS_XFLAG_VERITY for fs-verity files rust: seq_file: replace `kernel::c_str!` with C-Strings fs: dcache: fix typo in enum d_walk_ret comment ovl: use name_is_dot* helpers in readdir code fs: add helpers name_is_dot{,dot,_dotdot} ovl: Fix uninit-value in ovl_fill_real fs: reset read-only fsflags together with xflags fs/file: optimize close_range() complexity from O(N) to O(Sparse)
2026-02-16Merge tag 'kernel-7.0-rc1.misc' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull pidfs updates from Christian Brauner: - pid: introduce task_ppid_vnr() helper - pidfs: convert rb-tree to rhashtable Mateusz reported performance penalties during task creation because pidfs uses pidmap_lock to add elements into the rbtree. Switch to an rhashtable to have separate fine-grained locking and to decouple from pidmap_lock moving all heavy manipulations outside of it Also move inode allocation outside of pidmap_lock. With this there's nothing happening for pidfs under pidmap_lock - pid: reorder fields in pid_namespace to reduce false sharing - Revert "pid: make __task_pid_nr_ns(ns => NULL) safe for zombie callers" - ipc: Add SPDX license id to mqueue.c * tag 'kernel-7.0-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: pid: introduce task_ppid_vnr() helper pidfs: implement ino allocation without the pidmap lock Revert "pid: make __task_pid_nr_ns(ns => NULL) safe for zombie callers" pid: reorder fields in pid_namespace to reduce false sharing pidfs: convert rb-tree to rhashtable ipc: Add SPDX license id to mqueue.c
2026-02-16Merge tag 'linux-watchdog-6.20-rc1' of ↵Linus Torvalds
git://www.linux-watchdog.org/linux-watchdog Pull watchdog updates from Wim Van Sebroeck: - iTCO: Drop vendor support - s3c2410_wdt: Drop S3C2410 support - Convert mpc8xxx-wdt to YAML - Several small fixes and improvements * tag 'linux-watchdog-6.20-rc1' of git://www.linux-watchdog.org/linux-watchdog: dt-bindings: watchdog: qcom-wdt: Document Glymur watchdog dt-bindings: watchdog: Convert mpc8xxx-wdt to YAML dt-bindings: watchdog: samsung-wdt: Split if:then: and constrain more dt-bindings: watchdog: samsung-wdt: Drop S3C2410 watchdog: s3c2410_wdt: Drop S3C2410 support dt-bindings: watchdog: samsung-wdt: Define cluster constraints top-level watchdog: rzv2h_wdt: Discard pm_runtime_put() return value watchdog: rz: Discard pm_runtime_put() return values watchdog: Make API functions const correct watchdog: imx7ulp_wdt: handle the nowayout option watchdog: sbsa: Update the W_IIDR Implementer bit mask to 0xFFF watchdog: Always return time left until watchdog times out watchdog: iTCO: Drop vendor support watchdog: starfive-wdt: Fix PM reference leak in probe error path fix it87_wdt early reboot by reporting running timer
2026-02-16Merge tag 'leds-next-6.20' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds Pull LED updates from Lee Jones: "New Support & Features: - Add support for the TI LP5812 4x3 matrix RGB LED driver, including autonomous animation engine control and extensive scan multiplexing modes - Add a new driver for the ams Osram AS3668 4-channel I2C LED controller - Extend the is31fl32xx driver to support the is31fl3293 variant, which features 3 channels and 12-bit PWM resolution Improvements & Fixes: - Prevent the ExpressWire KTD2801 chip from entering an undefined state by disabling interrupts during time-sensitive communication - Ensure the Qualcomm LPG driver detects hardware write failures by checking the return value of regmap_bulk_write() during LUT programming - Fix kernel-doc warnings in the lm3692x driver by documenting missing struct members and standardizing the comment style - Update the ExpressWire library to use fsleep() and unexport internal-only functions - Improve the is31fl32xx driver by reordering code to eliminate unnecessary forward declarations Cleanups & Refactoring: - Simplify the LP55XX common LED driver by utilizing the for_each_available_child_of_node_scoped() macro for more concise node iteration Device Tree Bindings Updates: - Add new YAML bindings for the TI LP5860 and LP5812 LED controllers, and the ams Osram AS3668 - Convert the TI LM3697 white LED driver binding to DT schema format - Allow multicolor LED nodes to be named with numeric suffixes (e.g., multi-led-0) to handle multiple instances without unit addresses - Document support for the PMH0101 variant in the Qualcomm LPG PWM and SPMI Flash LED bindings - Add the issi,is31fl3293 compatible string to the is31fl32xx binding" * tag 'leds-next-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds: dt-bindings: leds: Convert ti,lm3697 to DT schema leds: as3668: Driver for the ams Osram 4-channel i2c LED driver dt-bindings: leds: Add new as3668 support docs: leds: Document TI LP5812 LED driver leds: Add basic support for TI/National Semiconductor LP5812 LED Driver leds: qcom-lpg: Check the return value of regmap_bulk_write() dt-bindings: leds: qcom,spmi-flash-led: Add PMH0101 compatible dt-bindings: leds: leds-qcom-lpg: Add support for PMH0101 PWM dt-bindings: leds: Allow differently named multicolor LEDs leds: lp55xx: Simplify with scoped for each OF child loop dt-bindings: leds: add TI/National Semiconductor LP5812 LED Driver leds: is31f132xx: Add support for is31fl3293 leds: is31f132xx: Re-order code to remove forward declarations dt-bindings: leds: Add issi,is31fl3293 to leds-is31fl32xx leds: expresswire: Fix chip state breakage dt-bindings: leds: Add LP5860 LED controller leds: lm3692x: Fix kernel-doc for struct lm3692x_led
2026-02-16Merge tag 'backlight-next-6.20' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight Pull backlight updates from Lee Jones: "New Support & Features: - Add a new driver for the Congatec Board Controller (CGBC) backlight, providing brightness control via the board controller's PWM interface Improvements & Fixes: - Resolve build failures in the Awinic AW99706 driver by switching to the correct GPIO consumer header - Extend the Qualcomm WLED driver to support the specific over-voltage protection (OVP) values required for the PMI8994 and PMI8950 variants Device Tree Bindings Updates: - Document the device-specific over-voltage protection (OVP) millivolt ranges and default values for Qualcomm PMI8994 and PMI8950 WLED controllers" * tag 'backlight-next-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight: backlight: qcom-wled: Change PM8950 WLED configurations dt-bindings: backlight: qcom-wled: Document ovp values for PMI8950 backlight: qcom-wled: Support ovp values for PMI8994 dt-bindings: backlight: qcom-wled: Document ovp values for PMI8994 backlight: aw99706: Fix build errors caused by wrong gpio header backlight: Add Congatec Board Controller (CGBC) backlight support
2026-02-16Merge tag 'mfd-next-6.20' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD updates from Lee Jones: "New Support & Features: - Add comprehensive support for the ROHM BD72720 PMIC, including core MFD, regulator, GPIO, clock gate, RTC, and power-supply drivers - Add support for the Rockchip RK801 PMIC, including core MFD and regulator drivers - Add support for the ROHM BD73900 PMIC by leveraging existing common drivers - Wire up RTC, hwmon, and input sub-devices for the Apple SMC (macsmc) driver - Add support for the Delta Networks TN48M switch CPLD via the simple-mfd-i2c driver - Add support for the TS133 variant to the QNAP MCU driver - Provide support for the sama7d65 XLCD controller in the Atmel HLCDC driver - Add backlight sub-device support to the Congatec Board Controller (cgbc) - Add Intel Nova Lake-S (NVL-S) PCI IDs to the Intel LPSS driver Improvements & Fixes: - Implement a "wrapper regmap" for the ROHM BD72720 to handle dual I2C slave addresses (0x4b and 0x4c) transparently for child devices - Introduce mutex locking around 'mfd_of_node_list' in the MFD core to ensure safe concurrent access - Fix a potential regulator resource leak in the Arizona core driver during boot sequence failures - Resolve child device duplication issues on driver rebind for Qualcomm PM8xxx and OMAP USB host drivers by using of_platform_depopulate() - Fix IRQ domain name duplication for the Samsung S2MPG10 by adding a unique domain suffix - Implement LOCK register handling for the TI TPS65214 variant to unlock registers at probe time - Fully convert the Loongson-2K BMC driver to use managed resources (pcim) and the standard PCI resource API - Ensure the Apple SMC mutex is correctly initialized during probe to prevent NULL pointer dereferences - Expand the ROHM BD71828 power-supply driver to support 9-bit register addresses - Simplify the Samsung S5M RTC driver by querying platform device IRQ resources directly - Revert an incorrect read-to-write mask change in the DA9052 SPI driver to restore default OTP behavior - Fix kernel-doc warnings in the TI TPS6105x driver - Cleanups & Refactoring - Simplify the MFD core by utilizing the scoped for_each_child_of_node_scoped() macro and streamlining device_node storage - Rename ROHM BD71828 IC-specific entities to use consistent prefixes for better extensibility - Refactor ROHM BD71828 regmap definitions using the regmap_reg_range() macro - Update the ROHM BD71828 driver to use standard C-style comment headers - Remove the now unused 'irq_data' field from the Samsung SEC core structure - Drop unnecessary use of irqd_get_trigger_type() in the Maxim MAX77759 driver - Default MFD_SPACEMIT_P1 to 'm' if ARCH_SPACEMIT is selected - Add missing charger-related registers to the ROHM BD71828 core header and Type-C CC registers to the AXP717 Device Tree Binding Updates: - Add new bindings for the ROHM BD72720 PMIC, Rockchip RK801 PMIC, Bitmain BM1880 System Controller, and NXP LPC32xx System Control Block - Clarify trickle-charge terminology and add properties for voltage drop (VDR) correction and upper charge limits to the generic battery binding - Document GPR syscon for NXP S32 SoCs and the smp-memram subnode for Aspeed SCU - Document numerous new Qualcomm SPMI PMIC compatibles (pmcx0102, pmh0101, pmk8850, etc) - Add compatibles for the sama7d65 XLCD (Atmel), LAN9691 Flexcom (Microchip), and various MediaTek SCPSYS and regulator components - Fix a dead link to the audio codec binding in the DA9055 documentation" * tag 'mfd-next-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (41 commits) dt-bindings: mfd: da9055: Fix dead link to codec binding mfd: cgbc: Add support for backlight dt-bindings: mfd: qcom,spmi-pmic: Document PMICs present on Glymur and Kaanapali dt-bindings: mfd: Document smp-memram subnode for aspeed,ast2x00-scu mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs mfd: ls2kbmc: Use PCI API instead of direct accesses mfd: ls2kbmc: Fully convert to use managed resources dt-bindings: mfd: mediatek: mt6397: Add missing MT6331 regulator compat dt-bindings: mfd: mediatek,mt8195-scpsys: Add mediatek,mt6795-scpsys dt-bindings: mfd: atmel,sama5d2-flexcom: Add microchip,lan9691-flexcom mfd: omap-usb-host: Fix OF populate on driver rebind mfd: qcom-pm8xxx: Fix OF populate on driver rebind dt-bindings: mfd: syscon: Allow syscon compatible for mediatek,mt7981-topmisc mfd: qnap-mcu: Add driver data for TS133 variant dt-bindings: mfd: qnap,ts433-mcu: Add qnap,ts133-mcu compatible mfd: sec: Fix IRQ domain names duplication mfd: simple-mfd-i2c: Add Delta TN48M CPLD support mfd: macsmc: Initialize mutex dt-bindings: mfd: nxp: Add NXP LPC32xx System Control Block mfd: Kconfig: Default MFD_SPACEMIT_P1 to 'm' if ARCH_SPACEMIT ...
2026-02-16blk-mq: use NOIO context to prevent deadlock during debugfs creationYu Kuai
Creating debugfs entries can trigger fs reclaim, which can enter back into the block layer request_queue. This can cause deadlock if the queue is frozen. Previously, a WARN_ON_ONCE check was used in debugfs_create_files() to detect this condition, but it was racy since the queue can be frozen from another context at any time. Introduce blk_debugfs_lock()/blk_debugfs_unlock() helpers that combine the debugfs_mutex with memalloc_noio_save()/restore() to prevent fs reclaim from triggering block I/O. Also add blk_debugfs_lock_nomemsave() and blk_debugfs_unlock_nomemrestore() variants for callers that don't need NOIO protection (e.g., debugfs removal or read-only operations). Replace all raw debugfs_mutex lock/unlock pairs with these helpers, using the _nomemsave/_nomemrestore variants where appropriate. Reported-by: Yi Zhang <yi.zhang@redhat.com> Closes: https://lore.kernel.org/all/CAHj4cs9gNKEYAPagD9JADfO5UH+OiCr4P7OO2wjpfOYeM-RV=A@mail.gmail.com/ Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com> Closes: https://lore.kernel.org/all/aYWQR7CtYdk3K39g@shinmob/ Suggested-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Yu Kuai <yukuai@fnnas.com> Reviewed-by: Nilay Shroff <nilay@linux.ibm.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-16Merge tag 'pinctrl-v7.0-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control updates from Linus Walleij: "Core changes: - Drop the unused devm_pinctrl_unregister() function - Move pretended generic pin control functionality out of the core and into the Amlogic AM4 driver. We have something better coming (hopefully) New hardware support: - Spacemit K3 (RISC-V) pin control support - Atmel AT91 PIO4 (ARM32) SAMA7D65 pin control support - Exynos9610 (ARM64) pin control support - Qualcomm Mahua TLMM (ARM64) pin control support - Microchip Polarfire MSSIO (RISC-V) pin control support - Ocelot LAN9645XF (multiplatform) pin control support Improvements: - Using a few more guards for locking - Various nonurgent fixes and tweaks" * tag 'pinctrl-v7.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (73 commits) pinctrl: generic: move function to amlogic-am4 driver pinctrl: intel: Align Copyright note with corporate guidelines pinctrl: mediatek: remove unused drv_offset field pinctrl: canaan: k230: Fix NULL pointer dereference when parsing devicetree pinctrl: single: fix refcount leak in pcs_add_gpio_func() pinctrl: meson: amlogic-a4: Fix device node reference leak in bank helpers pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition pinctrl: core: Remove duplicate error messages pinctrl: core: Simplify devm_pinctrl_*() pinctrl: core: Remove unused devm_pinctrl_unregister() dt-bindings: pinctrl: spacemit: fix drive-strength check warning pinctrl: fix kismet issues with GENERIC_PINCTRL pinctrl: tangier: Join tng_pinctrl_probe() into its wrapper pinctrl: tangier: Remove duplicate error messages pinctrl: lynxpoint: Remove duplicate error messages pinctrl: cherryview: Remove duplicate error messages pinctrl: baytrail: Remove duplicate error messages pinctrl: intel: Remove duplicate error messages pinctrl: equilibrium: Fix device node reference leak in pinbank_init() dt-bindings: pinctrl: pinctrl-microchip-sgpio: add LAN969x ...
2026-02-16Merge tag 'mips_7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linuxLinus Torvalds
Pull MIPS updates from Thomas Bogendoerfer: "Cleanups and fixes" * tag 'mips_7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (28 commits) Revert "clk: microchip: core: allow driver to be compiled with COMPILE_TEST" Revert "clk: microchip: fix typo in reference to a config option" MIPS: Implement ARCH_HAS_CC_CAN_LINK MIPS: rb532: Fix MMIO UART resource registration MIPS: Work around LLVM bug when gp is used as global register variable MIPS: Loongson64: env: Fixup serial clock-frequency when using LEFI MIPS: Loongson2ef: Use pcibios_align_resource() to block io range MIPS: Loongson2ef: Register PCI controller in early stage clk: microchip: fix typo in reference to a config option MIPS: Loongson64: dts: fix phy-related definition of LS7A GMAC clk: microchip: core: allow driver to be compiled with COMPILE_TEST MIPS: drop unused pic32.h header watchdog: pic32-wdt: update include to use pic32.h from platform_data watchdog: pic32-dmt: update include to use pic32.h from platform_data serial: pic32_uart: update include to use pic32.h from platform_data rtc: pic32: update include to use pic32.h from platform_data pinctrl: pic32: update include to use pic32.h from platform_data mmc: sdhci-pic32: update include to use pic32.h from platform_data irqchip/irq-pic32-evic: update include to use pic32.h from platform_data clk: microchip: core: update include to use pic32.h from platform_data ...
2026-02-16ACPI: PM: Add unused power resource quirk for THUNDEROBOT ZEROZhai Can
On the THUNDEROBOT ZERO laptop, the second NVMe slot and the discrete NVIDIA GPU are both controlled by power-resource PXP. Due to the SSDT table bug (lack of reference), PXP will be shut dow as an "unused" power resource during initialization, making the NVMe slot #2 + NVIDIA both inaccessible. This issue was introduced by commit a1224f34d72a ("ACPI: PM: Check states of power resources during initialization"). Here are test results on the three consecutive commits: (bad again!) a1224f34d72a ACPI: PM: Check states of power resources during initialization (good) bc2836859643 ACPI: PM: Do not turn off power resources in unknown state (bad) 519d81956ee2 Linux 5.15-rc6 On commit bc2836859643 ("ACPI: PM: Do not turn off power resources in unknown state") this was not an issue because the power resource state left UNKNOWN thus being ignored. See also commit 9b04d99788cf ("ACPI: PM: Do not turn of unused power resources on the Toshiba Click Mini") which is another almost identical case to this one. Fixes: a1224f34d72a ("ACPI: PM: Check states of power resources during initialization") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221087 Signed-off-by: Zhai Can <bczhc0@126.com> Link: https://patch.msgid.link/20260214161452.2849346-1-bczhc0@126.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-02-16blk-stat: convert struct blk_stat_callback to kernel-docRandy Dunlap
Most of struct blk_stat_callback documentation is already in kernel-doc format. Convert the remaining struct members to kernel-doc to avoid kernel-doc warnings: Warning: block/blk-stat.h:62 struct member 'list' not described in 'blk_stat_callback' Warning: block/blk-stat.h:62 struct member 'timer_fn' not described in 'blk_stat_callback' Warning: block/blk-stat.h:62 struct member 'rcu' not described in 'blk_stat_callback' Warning: block/blk-stat.h:133 No description found for return value of 'blk_stat_is_active' Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-16block: fix enum descriptions kernel-docRandy Dunlap
Fix all kernel-doc warnings in blk_types.h: Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_READ' not described in enum 'req_op' Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_WRITE' not described in enum 'req_op' Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_FLUSH' not described in enum 'req_op' Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_DISCARD' not described in enum 'req_op' Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_SECURE_ERASE' not described in enum 'req_op' Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_ZONE_APPEND' not described in enum 'req_op' Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_WRITE_ZEROES' not described in enum 'req_op' Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_ZONE_OPEN' not described in enum 'req_op' Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_ZONE_CLOSE' not described in enum 'req_op' Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_ZONE_FINISH' not described in enum 'req_op' Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_ZONE_RESET' not described in enum 'req_op' Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_ZONE_RESET_ALL' not described in enum 'req_op' Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_DRV_IN' not described in enum 'req_op' Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_DRV_OUT' not described in enum 'req_op' Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_LAST' not described in enum 'req_op' Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-16fs/ntfs3: add delayed-allocation (delalloc) supportKonstantin Komarov
This patch implements delayed allocation (delalloc) in ntfs3 driver. It introduces an in-memory delayed-runlist (run_da) and the helpers to track, reserve and later convert those delayed reservations into real clusters at writeback time. The change keeps on-disk formats untouched and focuses on pagecache integration, correctness and safe interaction with fallocate, truncate, and dio/iomap paths. Key points: - add run_da (delay-allocated run tree) and bookkeeping for delayed clusters. - mark ranges as delalloc (DELALLOC_LCN) instead of immediately allocating. Actual allocation performed later (writeback / attr_set_size_ex / explicit flush paths). - direct i/o / iomap paths updated to avoid dio collisions with delalloc: dio falls back or forces allocation of delayed blocks before proceeding. - punch/collapse/truncate/fallocate check and cancel delay-alloc reservations. Sparse/compressed files handled specially. - free-space checks updated (ntfs_check_free_space) to account for reserved delalloc clusters and MFT record budgeting. - delayed allocations are committed on last writer (file release) and on explicit allocation flush paths. Tested-by: syzbot@syzkaller.appspotmail.com Reported-by: syzbot+2bd8e813c7f767aa9bb1@syzkaller.appspotmail.com Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
2026-02-16io_uring/rsrc: improve regbuf iov validationPavel Begunkov
Deduplicate io_buffer_validate() calls by moving the checks into io_sqe_buffer_register(). Now we also don't need special handling in io_buffer_validate() passing through buffer removal requests. I also was using it as a cleanup before some other changes. Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-16io_uring: remove unneeded io_send_zc accountingDylan Yudaken
zc->len and zc->buf are not actually used once you get to the retry stage. The buffer remains in kmsg->msg.msg_iter, which is setup in io_send_setup. Note: it still seems needed in io_send due to io_send_select_buffer needing it (for the len parameter). Signed-off-by: Dylan Yudaken <dyudaken@gmail.com> Reviewed-by: Pavel Begunkov <asml.silence@gmail.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-16io_uring/cmd_net: fix too strict requirement on ioctlAsbjørn Sloth Tønnesen
Attempting SOCKET_URING_OP_SETSOCKOPT on an AF_NETLINK socket resulted in an -EOPNOTSUPP, as AF_NETLINK doesn't have an ioctl in its struct proto, but only in struct proto_ops. Prior to the blamed commit, io_uring_cmd_sock() only had two cmd_op operations, both requiring ioctl, thus the check was warranted. Since then, 4 new cmd_op operations have been added, none of which depend on ioctl. This patch moves the ioctl check, so it only applies to the original operations. AFAICT, the ioctl requirement was unintentional, and it wasn't visible in the blamed patch within 3 lines of context. Cc: stable@vger.kernel.org Fixes: a5d2f99aff6b ("io_uring/cmd: Introduce SOCKET_URING_OP_GETSOCKOPT") Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.net> Reviewed-by: Gabriel Krisman Bertazi <krisman@suse.de> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-16Merge tag 'probes-v7.0' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull kprobes updates from Masami Hiramatsu: - Use a dedicated kernel thread to optimize the kprobes instead of using workqueue thread. Since the kprobe optimizer waits a long time for synchronize_rcu_task(), it can block other workers in the same queue if it uses a workqueue. - kprobe-events: return immediately if no new probe events are specified on the kernel command line at boot time. This shortens the kernel boot time. - When a kprobe is fully removed from the kernel code, retry optimizing another kprobe which is blocked by that kprobe. * tag 'probes-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: kprobes: Use dedicated kthread for kprobe optimizer tracing: kprobe-event: Return directly when trace kprobes is empty kprobes: retry blocked optprobe in do_free_cleaned_kprobes
2026-02-15Merge tag 'm68knommu-for-v7.0' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu Pull m68knommu updates from Greg Ungerer: - defconfig cleanup - fix for legacy 68000 CPU memmove() of non-aligned pointers - replace strcpy() with strscpy() for ucsimm target * tag 'm68knommu-for-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu: m68knommu: Replace deprecated strcpy with strscpy in init_ucsimm m68k: nommu: fix memmove() with differently aligned src and dest for 68000 m68k: defconfig: Clean up references to non-existing configs
2026-02-15smb: client: terminate session upon failed client required signingAaditya Kansal
Currently, when smb signature verification fails, the behaviour is to log the failure without any action to terminate the session. Call cifs_reconnect() when client required signature verification fails. Otherwise, log the error without reconnecting. Signed-off-by: Aaditya Kansal <aadityakansal390@gmail.com> Signed-off-by: Steve French <stfrench@microsoft.com>
2026-02-15cifs: some missing initializations on replayShyam Prasad N
In several places in the code, we have a label to signify the start of the code where a request can be replayed if necessary. However, some of these places were missing the necessary reinitializations of certain local variables before replay. This change makes sure that these variables get initialized after the label. Cc: stable@vger.kernel.org Reported-by: Yuchan Nam <entropy1110@gmail.com> Tested-by: Yuchan Nam <entropy1110@gmail.com> Signed-off-by: Shyam Prasad N <sprasad@microsoft.com> Signed-off-by: Steve French <stfrench@microsoft.com>
2026-02-15io_uring: delay sqarray static branch disablementPavel Begunkov
io_key_has_sqarray static branch can be easily switched on/off by the user every time patching the kernel. That can be very disruptive as it might require heavy synchronisation across all CPUs. Use deferred static keys, which can rate-limit it by deferring, batching and potentially effectively eliminating dec+inc pairs. Fixes: 9b296c625ac1d ("io_uring: static_key for !IORING_SETUP_NO_SQARRAY") Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-15io_uring/query: add query.h copyright noticePavel Begunkov
Add a copyright notice to io_uring's query uapi header. Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-15io_uring/query: return support for custom rx page sizePavel Begunkov
Add an ability to query if the zcrx rx page size setting is available. Note, even when the API is supported by io_uring, the registration can still get rejected for various reasons, e.g. when the NIC or the driver doesn't support it, when the particular specified size is unsupported, when the memory area doesn't satisfy all requirements, etc. Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-15io_uring/zcrx: check unsupported flags on importPavel Begunkov
The imoorted zcrx registration path checks for ZCRX_REG_IMPORT, as it should, but doesn't reject any unsupported flags. Fix that. Cc: stable@vger.kernel.org Fixes: 00d91481279fb ("io_uring/zcrx: share an ifq between rings") Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-02-15Merge tag 'docs-7.0-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux Pull documentation fixes from Jonathan Corbet: "A handful of small, late-arriving documentation fixes" * tag 'docs-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux: docs: toshiba_haps: fix grammar error in SSD warning Docs/mm: fix typos and grammar in page_tables.rst Docs/core-api: fix typos in rbtree.rst docs: clarify wording in programming-language.rst docs: process: maintainer-pgp-guide: update kernel.org docs link docs: kdoc_parser: allow __exit in function prototypes
2026-02-15Merge tag '9p-for-7.0-rc1' of https://github.com/martinetd/linuxLinus Torvalds
Pull 9p updates from Dominique Martinet: - 9p/xen racy double-free fix - track 9p RPC waiting time as IO * tag '9p-for-7.0-rc1' of https://github.com/martinetd/linux: 9p/xen: protect xen_9pfs_front_free against concurrent calls 9p: Track 9P RPC waiting time as IO wait: Introduce io_wait_event_killable()
2026-02-15Merge tag 'tsm-for-7.0' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm Pull TSM updates from Dan Williams: "A couple of updates to the maximum buffer sizes supported for the configfs-tsm-reports interface. This interface is a common transport that conveys the varied architecture specific launch attestation reports for confidential VMs. - Prepare the configfs-tsm-reports interface for passing larger attestation evidence blobs for "Device Identifier Composition Engine" (DICE) and Post Quantum Crypto (PQC) - Update the tdx-guest driver for DICE evidence (larger certificate chains and the CBOR Web Token schema)" * tag 'tsm-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm: configfs-tsm-report: tdx_guest: Increase Quote buffer size to 128KB configfs-tsm-report: Increase TSM_REPORT_OUTBLOB_MAX to 16MB configfs-tsm-report: Document size limits for outblob attributes
2026-02-15Merge tag 'i2c-for-7.0-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c updates from Wolfram Sang: - core: cleaner fwnode usage - tegra: timing improvements and Tegra264 support - lpi2c: fix SMBus block read NACK after byte count - amd-mp2, designware, mlxbf, rtl9300, spacemit, tegra: cleanups - designware: - use a dedicated algorithm for AMD Navi - replace magic numbers with named constants - replace min_t() with min() to avoid u8 truncation - refactor core to enable mode switching - imx-lpi2c: add runtime PM support for IRQ and clock handling - lan9691-i2c: add new driver - rtl9300: use OF helpers directly and avoid fwnode handling - spacemit: add bus reset support - units: add HZ_PER_GHZ and use it in several i2c drivers - at24 i2c eeprom: - add a set of new compatibles to DT bindings - use dev_err_probe() consistently in the driver * tag 'i2c-for-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (46 commits) i2c: imx-lpi2c: fix SMBus block read NACK after byte count i2c: designware: Remove an unnecessary condition i2c: designware: Enable mode swapping i2c: designware: Combine the init functions i2c: designware: Combine some of the common functions i2c: designware: Use device_is_compatible() instead of custom approach dt-bindings: eeprom: at24: Add compatible for Puya P24C128F drivers/i2c/busses: use min() instead of min_t() i2c: imx-lpi2c: Add runtime PM support for IRQ and clock management on i.MX8QXP/8QM i2c: amd-mp2: clean up amd_mp2_find_device() i2c: designware: Replace magic numbers with named constants i2c: rtl9300: use of instead of fwnode i2c: rtl9300: remove const cast i2c: tegra: remove unused rst i2c: designware: Remove not-going-to-be-supported code for Baikal SoC i2c: spacemit: drop useless spaces i2c: mlxbf: Use HZ_PER_KHZ in the driver i2c: mlxbf: Remove unused bus speed definitions i2c: core: Use dev_fwnode() i2c: core: Replace custom implementation of device_match_fwnode() ...
2026-02-15Merge tag 'input-for-v7.0-rc0' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: - support for FocalTech FT8112 added to i2c-hid driver - support for FocalTech FT3518 added to edt-ft5x06 driver - support for power buttons in TWL603x chips added to twl4030-pwrbutton driver - an update to gpio-decoder driver to make it usable on non-OF platforms and to clean up the code - an update to synaptics_i2c driver switching it to use managed resources and a fix to restarting polling after resume - an update to gpio-keys driver to fall back to getting IRQ from resources if not specified using other means - an update to ili210x driver to support polling mode - a number of input drivers switched to scnprintf() to suppress truncation warnings - a number of updates and conversions of device tree bindings to yaml format - fixes to spelling in comments and messages in several drivers - other assorted fixups * tag 'input-for-v7.0-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (57 commits) dt-bindings: input: qcom,pm8941-pwrkey: Document PMM8654AU dt-bindings: input: touchscreen: imagis: allow linux,keycodes for ist3038 Input: apbps2 - fix comment style and typos Input: gpio_keys - fall back to platform_get_irq() for interrupt-only keys Input: novatek-nvt-ts - drop wake_type check dt-bindings: input: touchscreen: tsc2007: document '#io-channel-cells' Input: ili210x - add support for polling mode dt-bindings: touchscreen: trivial-touch: Drop 'interrupts' requirement for old Ilitek Input: appletouch - fix potential race between resume and open HID: i2c-hid: Add FocalTech FT8112 dt-bindings: input: i2c-hid: Introduce FocalTech FT8112 Input: synaptics_i2c - switch to using managed resources Input: synaptics_i2c - guard polling restart in resume Input: gpio_decoder - don't use "proxy" headers Input: gpio_decoder - make use of the macros from bits.h Input: gpio_decoder - replace custom loop by gpiod_get_array_value_cansleep() Input: gpio_decoder - unify messages with help of dev_err_probe() Input: gpio_decoder - make use of device properties Input: serio - complete sizeof(*pointer) conversions Input: wdt87xx_i2c - switch to use dev_err_probe() ...
2026-02-15Merge tag 'clk-for-linus' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk updates from Stephen Boyd: "Not much changed in the clk framework this time except the clk.h consumer API moved the context saving APIs around to fix a build error in certain configurations. There was a change to the core framework for CLK_OPS_PARENT_ENABLE behavior during registration, but it wrecked existing drivers that didn't expect things to be turned off during clk registration so it got reverted. This cycle is really a large collection of new clk drivers, primarily for Qualcomm SoCs but also for Amlogic, SpacemiT, Google, and Aspeed. Another big change in here is support for automatic hardware clock gating on Samsung SoCs where the clks turn on and off when needed. Ideally more vendors move to this method for better power savings. The highlights are in the updates section below. Beyond all the new drivers we have a bunch of cleanups like converting drivers from divider_round_rate() to divider_determine_rate() and using scoped for each OF child loops. Otherwise it's the usual data fixes and plugging reference leaks, etc. that's all pretty ordinary but not critical enough to fix until the next release. New Drivers: - Qualcomm Kaanapali global, tcsr, rpmh, display, gpu, camera, and video clk controllers - Qualcomm SM8750 camera clk controllers - Qualcomm MSM8940 and SDM439 global clk controllers - Google GS101 Display Process Unit (DPU) clk controllers - SpacemiT K3 clk controllers - Amlogic t7 clk controllers - Aspeed AST2700 clk controllers Updates: - Convert clock dividers from round_rate() to determine_rate() - Fix sparse warnings, kernel-doc warnings, and plug leaked OF refs - Automatic hardware clk gating on Google GS101 SoCs - Amlogic s4 video clks - CAN-FD clks and resets on Renesas RZ/T2H, RZ/N2H, RZ/V2H, and RZ/V2N - Expanded Serial Peripheral Interface (xSPI) clocks and resets on Renesas RZ/T21H and RZ/N2H - DMAC, interrupt controller (ICU), SPI, and thermal (TSU) clocks and resets on Renesas RZ/V2N - More serial (RSCI) clocks and resets on Renesas RZ/V2H and RZ/V2N - CPU frequency scaling on T-HEAD TH1520" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (165 commits) clk: aspeed: Add reset for HACE/VIDEO dt-bindings: clock: aspeed: Add VIDEO reset definition clk: aspeed: add AST2700 clock driver MAINTAINERS: Add entry for ASPEED clock drivers. clk: aspeed: Move the existing ASPEED clk drivers into aspeed subdirectory. Revert "clk: Respect CLK_OPS_PARENT_ENABLE during recalc" clk: Disable KUNIT_UML_PCI dt-bindings: clk: rs9: Fix DIF pattern match clk: rs9: Convert to DEFINE_SIMPLE_DEV_PM_OPS() clk: rs9: Reserve 8 struct clk_hw slots for for 9FGV0841 clk: qcom: sm8750: Constify 'qcom_cc_desc' in SM8750 camcc clk: zynqmp: pll: Fix zynqmp_clk_divider_determine_rate kerneldoc clk: zynqmp: divider: Fix zynqmp_clk_divider_determine_rate kerneldoc clk: mediatek: Fix error handling in runtime PM setup clk: mediatek: don't select clk-mt8192 for all ARM64 builds clk: mediatek: Add mfg_eb as parent to mt8196 mfgpll clocks clk: mediatek: Refactor pllfh registration to pass device clk: mediatek: Pass device to clk_hw_register for PLLs clk: mediatek: Refactor pll registration to pass device clk: Respect CLK_OPS_PARENT_ENABLE during recalc ...
2026-02-14cifs: remove unnecessary tracing after put tconShyam Prasad N
This code was recently changed from manually decrementing tcon ref to using cifs_put_tcon. But even before that change this tracing happened after decrementing the ref count, which is wrong. With cifs_put_tcon, tracing already happens inside it. So just removing the extra tracing here. Signed-off-by: Shyam Prasad N <sprasad@microsoft.com> Signed-off-by: Steve French <stfrench@microsoft.com>
2026-02-14io_uring/zcrx: fix post open error handlingPavel Begunkov
Closing a queue doesn't guarantee that all associated page pools are terminated right away, let the refcounting do the work instead of releasing the zcrx ctx directly. Cc: stable@vger.kernel.org Fixes: e0793de24a9f6 ("io_uring/zcrx: set pp memory provider for an rx queue") Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
generated by cgit v1.3 (git 2.53.0) at 2026-11-11 21:56:05 +0000