November 2024 - Linux-stable-mirror

[PATCH] Drivers: hv: kvp/vss: Avoid accessing a ringbuffer not initialized yet

by Dexuan Cui

If the KVP (or VSS) daemon starts before the VMBus channel's ringbuffer is fully initialized, we can hit the panic below: hv_utils: Registering HyperV Utility Driver hv_vmbus: registering driver hv_utils ... BUG: kernel NULL pointer dereference, address: 0000000000000000 CPU: 44 UID: 0 PID: 2552 Comm: hv_kvp_daemon Tainted: G E 6.11.0-rc3+ #1 RIP: 0010:hv_pkt_iter_first+0x12/0xd0 Call Trace: ... vmbus_recvpacket hv_kvp_onchannelcallback vmbus_on_event tasklet_action_common tasklet_action handle_softirqs irq_exit_rcu sysvec_hyperv_stimer0 </IRQ> <TASK> asm_sysvec_hyperv_stimer0 ... kvp_register_done hvt_op_read vfs_read ksys_read __x64_sys_read This can happen because the KVP/VSS channel callback can be invoked even before the channel is fully opened: 1) as soon as hv_kvp_init() -> hvutil_transport_init() creates /dev/vmbus/hv_kvp, the kvp daemon can open the device file immediately and register itself to the driver by writing a message KVP_OP_REGISTER1 to the file (which is handled by kvp_on_msg() ->kvp_handle_handshake()) and reading the file for the driver's response, which is handled by hvt_op_read(), which calls hvt->on_read(), i.e. kvp_register_done(). 2) the problem with kvp_register_done() is that it can cause the channel callback to be called even before the channel is fully opened, and when the channel callback is starting to run, util_probe()-> vmbus_open() may have not initialized the ringbuffer yet, so the callback can hit the panic of NULL pointer dereference. To reproduce the panic consistently, we can add a "ssleep(10)" for KVP in __vmbus_open(), just before the first hv_ringbuffer_init(), and then we unload and reload the driver hv_utils, and run the daemon manually within the 10 seconds. Fix the panic by checking the channel state in the channel callback. To avoid the race condition with __vmbus_open(), we disable and enable the channel callback temporarily in __vmbus_open(). The channel callbacks of the other VMBus devices don't need to check the channel state since they can't run before the channels are fully initialized. Note: we would also need to fix the fcopy driver code, but that has been removed in commit ec314f61e4fc ("Drivers: hv: Remove fcopy driver") in the mainline kernel since v6.10. For old 6.x LTS kernels, and the 5.x and 4.x LTS kernels, the fcopy driver needs to be fixed when the fix is backported to the stable kernel branches. Fixes: e0fa3e5e7df6 ("Drivers: hv: utils: fix a race on userspace daemons registration") Cc: stable(a)vger.kernel.org Signed-off-by: Dexuan Cui <decui(a)microsoft.com> --- drivers/hv/channel.c | 11 +++++++++++ drivers/hv/hv_kvp.c | 3 +++ drivers/hv/hv_snapshot.c | 3 +++ 3 files changed, 17 insertions(+) diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c index fb8cd8469328..685e407a3fdf 100644 --- a/drivers/hv/channel.c +++ b/drivers/hv/channel.c @@ -657,6 +657,14 @@ static int __vmbus_open(struct vmbus_channel *newchannel, return -ENOMEM; } + /* + * The channel callbacks of KVP/VSS may run before __vmbus_open() + * finishes (see kvp_register_done() -> ... -> kvp_poll_wrapper()), so + * they check newchannel->state to tell the ringbuffer has been fully + * initialized or not. Disable and enable the tasklet to avoid the race. + */ + tasklet_disable(&newchannel->callback_event); + newchannel->state = CHANNEL_OPENING_STATE; newchannel->onchannel_callback = onchannelcallback; newchannel->channel_callback_context = context; @@ -750,6 +758,8 @@ static int __vmbus_open(struct vmbus_channel *newchannel, } newchannel->state = CHANNEL_OPENED_STATE; + tasklet_enable(&newchannel->callback_event); + kfree(open_info); return 0; @@ -766,6 +776,7 @@ static int __vmbus_open(struct vmbus_channel *newchannel, hv_ringbuffer_cleanup(&newchannel->inbound); vmbus_free_requestor(&newchannel->requestor); newchannel->state = CHANNEL_OPEN_STATE; + tasklet_enable(&newchannel->callback_event); return err; } diff --git a/drivers/hv/hv_kvp.c b/drivers/hv/hv_kvp.c index d35b60c06114..ec098067e579 100644 --- a/drivers/hv/hv_kvp.c +++ b/drivers/hv/hv_kvp.c @@ -662,6 +662,9 @@ void hv_kvp_onchannelcallback(void *context) if (kvp_transaction.state > HVUTIL_READY) return; + if (channel->state != CHANNEL_OPENED_STATE) + return; + if (vmbus_recvpacket(channel, recv_buffer, HV_HYP_PAGE_SIZE * 4, &recvlen, &requestid)) { pr_err_ratelimited("KVP request received. Could not read into recv buf\n"); return; diff --git a/drivers/hv/hv_snapshot.c b/drivers/hv/hv_snapshot.c index 0d2184be1691..f7924c2fc62e 100644 --- a/drivers/hv/hv_snapshot.c +++ b/drivers/hv/hv_snapshot.c @@ -301,6 +301,9 @@ void hv_vss_onchannelcallback(void *context) if (vss_transaction.state > HVUTIL_READY) return; + if (channel->state != CHANNEL_OPENED_STATE) + return; + if (vmbus_recvpacket(channel, recv_buffer, VSS_MAX_PKT_SIZE, &recvlen, &requestid)) { pr_err_ratelimited("VSS request received. Could not read into recv buf\n"); return; -- 2.25.1

41 minutes

3
6
0 0

[PATCH v3] tpm: Lock TPM chip in tpm_pm_suspend() first

by Jarkko Sakkinen

Setting TPM_CHIP_FLAG_SUSPENDED in the end of tpm_pm_suspend() can be racy according, as this leaves window for tpm_hwrng_read() to be called while the operation is in progress. The recent bug report gives also evidence of this behaviour. Aadress this by locking the TPM chip before checking any chip->flags both in tpm_pm_suspend() and tpm_hwrng_read(). Move TPM_CHIP_FLAG_SUSPENDED check inside tpm_get_random() so that it will be always checked only when the lock is reserved. Cc: stable(a)vger.kernel.org # v6.4+ Fixes: 99d464506255 ("tpm: Prevent hwrng from activating during resume") Reported-by: Mike Seo <mikeseohyungjin(a)gmail.com> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219383 Signed-off-by: Jarkko Sakkinen <jarkko(a)kernel.org> --- v3: - Check TPM_CHIP_FLAG_SUSPENDED inside tpm_get_random() so that it is also done under the lock (suggested by Jerry Snitselaar). v2: - Addressed my own remark: https://lore.kernel.org/linux-integrity/D59JAI6RR2CD.G5E5T4ZCZ49W@kernel.or… --- drivers/char/tpm/tpm-chip.c | 4 ---- drivers/char/tpm/tpm-interface.c | 32 ++++++++++++++++++++++---------- 2 files changed, 22 insertions(+), 14 deletions(-) diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c index 1ff99a7091bb..7df7abaf3e52 100644 --- a/drivers/char/tpm/tpm-chip.c +++ b/drivers/char/tpm/tpm-chip.c @@ -525,10 +525,6 @@ static int tpm_hwrng_read(struct hwrng *rng, void *data, size_t max, bool wait) { struct tpm_chip *chip = container_of(rng, struct tpm_chip, hwrng); - /* Give back zero bytes, as TPM chip has not yet fully resumed: */ - if (chip->flags & TPM_CHIP_FLAG_SUSPENDED) - return 0; - return tpm_get_random(chip, data, max); } diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c index 8134f002b121..b1daa0d7b341 100644 --- a/drivers/char/tpm/tpm-interface.c +++ b/drivers/char/tpm/tpm-interface.c @@ -370,6 +370,13 @@ int tpm_pm_suspend(struct device *dev) if (!chip) return -ENODEV; + rc = tpm_try_get_ops(chip); + if (rc) { + /* Can be safely set out of locks, as no action cannot race: */ + chip->flags |= TPM_CHIP_FLAG_SUSPENDED; + goto out; + } + if (chip->flags & TPM_CHIP_FLAG_ALWAYS_POWERED) goto suspended; @@ -377,21 +384,19 @@ int tpm_pm_suspend(struct device *dev) !pm_suspend_via_firmware()) goto suspended; - rc = tpm_try_get_ops(chip); - if (!rc) { - if (chip->flags & TPM_CHIP_FLAG_TPM2) { - tpm2_end_auth_session(chip); - tpm2_shutdown(chip, TPM2_SU_STATE); - } else { - rc = tpm1_pm_suspend(chip, tpm_suspend_pcr); - } - - tpm_put_ops(chip); + if (chip->flags & TPM_CHIP_FLAG_TPM2) { + tpm2_end_auth_session(chip); + tpm2_shutdown(chip, TPM2_SU_STATE); + goto suspended; } + rc = tpm1_pm_suspend(chip, tpm_suspend_pcr); + suspended: chip->flags |= TPM_CHIP_FLAG_SUSPENDED; + tpm_put_ops(chip); +out: if (rc) dev_err(dev, "Ignoring error %d while suspending\n", rc); return 0; @@ -440,11 +445,18 @@ int tpm_get_random(struct tpm_chip *chip, u8 *out, size_t max) if (!chip) return -ENODEV; + /* Give back zero bytes, as TPM chip has not yet fully resumed: */ + if (chip->flags & TPM_CHIP_FLAG_SUSPENDED) { + rc = 0; + goto out; + } + if (chip->flags & TPM_CHIP_FLAG_TPM2) rc = tpm2_get_random(chip, out, max); else rc = tpm1_get_random(chip, out, max); +out: tpm_put_ops(chip); return rc; } -- 2.47.0

43 minutes

1
2
0 0

Linux 6.11.6

by Greg Kroah-Hartman

I'm announcing the release of the 6.11.6 kernel. All users of the 6.11 kernel series must upgrade. The updated 6.11.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.11.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/devicetree/bindings/sound/davinci-mcasp-audio.yaml | 18 Makefile | 2 arch/arm/boot/dts/broadcom/bcm2837-rpi-cm3-io3.dts | 2 arch/arm64/Makefile | 2 arch/arm64/kvm/arm.c | 3 arch/arm64/kvm/sys_regs.c | 2 arch/arm64/kvm/vgic/vgic-init.c | 28 + arch/arm64/net/bpf_jit_comp.c | 12 arch/loongarch/include/asm/bootinfo.h | 4 arch/loongarch/include/asm/kasan.h | 2 arch/loongarch/kernel/process.c | 16 arch/loongarch/kernel/setup.c | 3 arch/loongarch/kernel/traps.c | 5 arch/riscv/net/bpf_jit_comp64.c | 8 arch/s390/include/asm/perf_event.h | 1 arch/s390/pci/pci_event.c | 17 arch/x86/Kconfig | 1 arch/x86/events/rapl.c | 47 ++ arch/x86/include/asm/runtime-const.h | 4 arch/x86/include/asm/uaccess_64.h | 45 +- arch/x86/kernel/amd_nb.c | 6 arch/x86/kernel/cpu/common.c | 10 arch/x86/kernel/cpu/resctrl/ctrlmondata.c | 23 - arch/x86/kernel/vmlinux.lds.S | 1 arch/x86/kvm/svm/nested.c | 6 arch/x86/lib/getuser.S | 9 arch/x86/virt/svm/sev.c | 2 block/elevator.c | 17 drivers/accel/qaic/qaic_control.c | 2 drivers/accel/qaic/qaic_data.c | 6 drivers/acpi/button.c | 11 drivers/acpi/cppc_acpi.c | 22 - drivers/acpi/prmt.c | 29 + drivers/acpi/resource.c | 7 drivers/ata/libata-eh.c | 1 drivers/cdrom/cdrom.c | 2 drivers/clk/rockchip/clk.c | 2 drivers/cpufreq/amd-pstate.c | 10 drivers/firewire/core-topology.c | 2 drivers/firmware/arm_scmi/driver.c | 4 drivers/firmware/arm_scmi/mailbox.c | 32 + drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 15 drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c | 5 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c | 13 drivers/gpu/drm/amd/display/modules/power/power_helpers.c | 2 drivers/gpu/drm/bridge/aux-bridge.c | 3 drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 16 drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 20 drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 68 ++- drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c | 7 drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_wb.c | 5 drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c | 19 drivers/gpu/drm/msm/dsi/dsi_host.c | 4 drivers/gpu/drm/panel/panel-himax-hx83102.c | 12 drivers/gpu/drm/vboxvideo/hgsmi_base.c | 10 drivers/gpu/drm/vboxvideo/vboxvideo.h | 4 drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c | 4 drivers/gpu/drm/xe/xe_device.c | 4 drivers/gpu/drm/xe/xe_exec.c | 12 drivers/gpu/drm/xe/xe_gpu_scheduler.h | 2 drivers/gpu/drm/xe/xe_gt_mcr.c | 2 drivers/gpu/drm/xe/xe_gt_tlb_invalidation.c | 29 - drivers/gpu/drm/xe/xe_gt_tlb_invalidation.h | 1 drivers/gpu/drm/xe/xe_guc_submit.c | 7 drivers/gpu/drm/xe/xe_vm.c | 8 drivers/hwmon/jc42.c | 2 drivers/iio/accel/bma400_core.c | 3 drivers/iio/adc/Kconfig | 2 drivers/iio/frequency/Kconfig | 33 - drivers/infiniband/core/addr.c | 2 drivers/infiniband/hw/bnxt_re/hw_counters.c | 2 drivers/infiniband/hw/bnxt_re/ib_verbs.h | 1 drivers/infiniband/hw/bnxt_re/main.c | 29 - drivers/infiniband/hw/bnxt_re/qplib_fp.c | 16 drivers/infiniband/hw/bnxt_re/qplib_fp.h | 3 drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 2 drivers/infiniband/hw/bnxt_re/qplib_res.c | 21 - drivers/infiniband/hw/bnxt_re/qplib_sp.c | 11 drivers/infiniband/hw/bnxt_re/qplib_sp.h | 1 drivers/infiniband/hw/cxgb4/cm.c | 9 drivers/infiniband/hw/irdma/cm.c | 2 drivers/infiniband/ulp/srpt/ib_srpt.c | 80 +++ drivers/irqchip/irq-renesas-rzg2l.c | 16 drivers/irqchip/irq-riscv-imsic-platform.c | 2 drivers/md/raid10.c | 7 drivers/net/dsa/microchip/ksz_common.c | 21 - drivers/net/dsa/mv88e6xxx/chip.c | 2 drivers/net/dsa/mv88e6xxx/chip.h | 6 drivers/net/dsa/mv88e6xxx/port.c | 1 drivers/net/dsa/mv88e6xxx/ptp.c | 108 +++-- drivers/net/dsa/vitesse-vsc73xx-core.c | 1 drivers/net/ethernet/aeroflex/greth.c | 3 drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c | 1 drivers/net/ethernet/broadcom/bcmsysport.c | 1 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 22 - drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 70 ++- drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.h | 12 drivers/net/ethernet/emulex/benet/be_main.c | 10 drivers/net/ethernet/freescale/fman/mac.c | 68 ++- drivers/net/ethernet/freescale/fman/mac.h | 6 drivers/net/ethernet/i825xx/sun3_82586.c | 1 drivers/net/ethernet/marvell/octeon_ep/octep_rx.c | 82 ++-- drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 4 drivers/net/ethernet/mediatek/mtk_eth_soc.c | 2 drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 8 drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 4 drivers/net/ethernet/mellanox/mlx5/core/eq.c | 6 drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 5 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 9 drivers/net/ethernet/microchip/sparx5/sparx5_mirror.c | 12 drivers/net/ethernet/realtek/r8169_main.c | 4 drivers/net/ethernet/renesas/ravb_main.c | 25 - drivers/net/ethernet/renesas/rtsn.c | 1 drivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c | 14 drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 2 drivers/net/hyperv/netvsc_drv.c | 30 + drivers/net/macsec.c | 18 drivers/net/netdevsim/dev.c | 15 drivers/net/phy/dp83822.c | 4 drivers/net/plip/plip.c | 2 drivers/net/pse-pd/pse_core.c | 4 drivers/net/usb/usbnet.c | 4 drivers/net/virtio_net.c | 2 drivers/net/vmxnet3/vmxnet3_xdp.c | 2 drivers/net/wwan/wwan_core.c | 2 drivers/nvme/host/pci.c | 19 drivers/pci/probe.c | 2 drivers/pci/pwrctl/pci-pwrctl-pwrseq.c | 58 ++ drivers/platform/x86/dell/dell-wmi-base.c | 9 drivers/platform/x86/dell/dell-wmi-sysman/sysman.c | 1 drivers/platform/x86/intel/pmc/core_ssram.c | 4 drivers/powercap/dtpm_devfreq.c | 2 drivers/reset/starfive/reset-starfive-jh71x0.c | 3 drivers/soundwire/intel_ace2x.c | 19 drivers/target/target_core_device.c | 2 drivers/target/target_core_user.c | 2 drivers/usb/host/xhci-dbgcap.h | 2 drivers/usb/host/xhci-dbgtty.c | 73 ++- drivers/usb/typec/class.c | 3 drivers/video/fbdev/Kconfig | 1 fs/9p/v9fs.h | 34 + fs/9p/v9fs_vfs.h | 2 fs/9p/vfs_inode.c | 129 ++++-- fs/9p/vfs_inode_dotl.c | 112 ++++- fs/9p/vfs_super.c | 2 fs/backing-file.c | 8 fs/btrfs/block-group.c | 2 fs/btrfs/dir-item.c | 4 fs/btrfs/disk-io.c | 2 fs/btrfs/extent_map.c | 31 - fs/btrfs/inode.c | 7 fs/btrfs/qgroup.c | 2 fs/btrfs/qgroup.h | 2 fs/btrfs/super.c | 12 fs/fuse/passthrough.c | 8 fs/jfs/jfs_dmap.c | 2 fs/namespace.c | 4 fs/nfsd/nfs4state.c | 50 ++ fs/nfsd/state.h | 2 fs/nilfs2/page.c | 6 fs/notify/fsnotify.c | 21 - fs/notify/inotify/inotify_user.c | 2 fs/notify/mark.c | 8 fs/open.c | 2 fs/overlayfs/file.c | 9 fs/select.c | 4 fs/smb/client/cifsfs.c | 2 fs/smb/client/fs_context.c | 7 fs/smb/client/reparse.c | 23 + fs/smb/client/smb2ops.c | 3 fs/smb/client/smb2pdu.c | 9 fs/udf/balloc.c | 38 + fs/udf/directory.c | 23 - fs/udf/inode.c | 202 ++++++---- fs/udf/partition.c | 6 fs/udf/super.c | 3 fs/udf/truncate.c | 43 +- fs/udf/udfdecl.h | 15 fs/xfs/scrub/repair.c | 8 include/linux/backing-file.h | 2 include/linux/bpf.h | 14 include/linux/bpf_types.h | 1 include/linux/huge_mm.h | 18 include/linux/netdevice.h | 12 include/linux/shmem_fs.h | 11 include/linux/task_work.h | 5 include/linux/uaccess.h | 7 include/net/bluetooth/bluetooth.h | 1 include/net/genetlink.h | 3 include/net/sock.h | 5 include/net/xfrm.h | 28 - include/uapi/linux/bpf.h | 16 include/uapi/sound/asoc.h | 2 kernel/bpf/btf.c | 15 kernel/bpf/devmap.c | 11 kernel/bpf/helpers.c | 10 kernel/bpf/inode.c | 5 kernel/bpf/log.c | 3 kernel/bpf/ringbuf.c | 14 kernel/bpf/syscall.c | 31 + kernel/bpf/task_iter.c | 2 kernel/bpf/verifier.c | 107 ++--- kernel/sched/core.c | 4 kernel/task_work.c | 15 kernel/time/posix-clock.c | 6 kernel/trace/bpf_trace.c | 42 -- kernel/trace/fgraph.c | 15 kernel/trace/ring_buffer.c | 44 +- kernel/trace/trace_eprobe.c | 7 kernel/trace/trace_fprobe.c | 6 kernel/trace/trace_kprobe.c | 6 kernel/trace/trace_probe.c | 2 kernel/trace/trace_uprobe.c | 13 lib/Kconfig.debug | 2 lib/objpool.c | 2 lib/strncpy_from_user.c | 9 lib/strnlen_user.c | 9 mm/huge_memory.c | 24 - mm/memory.c | 9 mm/shmem.c | 55 +- net/bluetooth/af_bluetooth.c | 22 + net/bluetooth/bnep/core.c | 3 net/bluetooth/hci_core.c | 24 - net/bluetooth/hci_sync.c | 12 net/bluetooth/iso.c | 18 net/bluetooth/sco.c | 18 net/core/filter.c | 50 -- net/core/sock_map.c | 8 net/ipv4/devinet.c | 35 + net/ipv4/inet_connection_sock.c | 21 - net/ipv4/xfrm4_policy.c | 40 - net/ipv6/xfrm6_policy.c | 31 - net/l2tp/l2tp_netlink.c | 4 net/netfilter/nf_bpf_link.c | 7 net/netfilter/xt_NFLOG.c | 2 net/netfilter/xt_TRACE.c | 1 net/netfilter/xt_mark.c | 2 net/netlink/genetlink.c | 28 - net/sched/act_api.c | 23 + net/sched/sch_generic.c | 8 net/sched/sch_taprio.c | 21 - net/smc/smc_pnet.c | 2 net/smc/smc_wr.c | 6 net/vmw_vsock/virtio_transport_common.c | 14 net/vmw_vsock/vsock_bpf.c | 8 net/wireless/nl80211.c | 8 net/xfrm/xfrm_device.c | 11 net/xfrm/xfrm_policy.c | 50 +- net/xfrm/xfrm_user.c | 10 sound/firewire/amdtp-stream.c | 3 sound/pci/hda/Kconfig | 2 sound/pci/hda/patch_cs8409.c | 5 sound/pci/hda/patch_realtek.c | 48 +- sound/soc/amd/yc/acp6x-mach.c | 7 sound/soc/codecs/lpass-rx-macro.c | 2 sound/soc/codecs/max98388.c | 1 sound/soc/fsl/fsl_micfil.c | 43 ++ sound/soc/fsl/fsl_sai.c | 5 sound/soc/fsl/fsl_sai.h | 1 sound/soc/loongson/loongson_card.c | 1 sound/soc/qcom/Kconfig | 2 sound/soc/qcom/lpass-cpu.c | 2 sound/soc/qcom/sc7280.c | 10 sound/soc/qcom/sdm845.c | 7 sound/soc/qcom/sm8250.c | 1 sound/soc/sh/rcar/core.c | 7 sound/soc/soc-dapm.c | 4 sound/soc/sof/intel/hda-dai-ops.c | 23 - sound/soc/sof/intel/hda-dai.c | 37 + sound/soc/sof/intel/hda-loader.c | 17 sound/soc/sof/ipc4-topology.c | 15 tools/include/uapi/linux/bpf.h | 3 tools/testing/selftests/bpf/Makefile | 2 tools/testing/selftests/bpf/prog_tests/fill_link_info.c | 9 274 files changed, 2654 insertions(+), 1268 deletions(-) Abel Vesa (1): drm/bridge: Fix assignment of the of_node of the parent to aux bridge Abhishek Mohapatra (1): RDMA/bnxt_re: Fix the max CQ WQEs for older adapters Aleksa Sarai (1): openat2: explicitly return -E2BIG for (usize > PAGE_SIZE) Aleksandr Mishin (4): octeon_ep: Implement helper for iterating packets in Rx queue octeon_ep: Add SKB allocation failures handling in __octep_oq_process_rx() fsl/fman: Save device references taken in mac_probe() fsl/fman: Fix refcount handling of fman-related devices Alexander Zubkov (1): RDMA/irdma: Fix misspelling of "accept*" Alexey Klimov (3): ASoC: codecs: lpass-rx-macro: add missing CDC_RX_BCL_VBAT_RF_PROC2 to default regs values ASoC: qcom: sm8250: add qrb4210-rb2-sndcard compatible string ASoC: qcom: sdm845: add missing soundwire runtime stream alloc Amadeusz Sławiński (1): ASoC: topology: Bump minimal topology ABI version Amir Goldstein (2): fs: pass offset and result to backing_file end_write() callback fuse: update inode size after extending passthrough write Andrea Parri (1): riscv, bpf: Make BPF_CMPXCHG fully ordered Andrew Jones (1): irqchip/riscv-imsic: Fix output text of base address Andrey Shumilin (1): ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() Andrii Nakryiko (1): bpf: fix do_misc_fixups() for bpf_get_branch_snapshot() Anumula Murali Mohan Reddy (2): RDMA/core: Fix ENODEV error for iWARP test over vlan RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP Armin Wolf (1): platform/x86: dell-wmi: Ignore suspend notifications Arnd Bergmann (1): fbdev: wm8505fb: select CONFIG_FB_IOMEM_FOPS Ashish Kalra (1): x86/sev: Ensure that RMP table fixups are reserved Aurabindo Pillai (1): drm/amd/display: temp w/a for DP Link Layer compliance Baolin Wang (2): mm: shmem: rename shmem_is_huge() to shmem_huge_global_enabled() mm: shmem: move shmem_huge_global_enabled() into shmem_allowable_huge_orders() Bart Van Assche (1): RDMA/srpt: Make slab cache names unique Bartosz Golaszewski (2): PCI: Hold rescan lock while adding devices during host probe PCI/pwrctl: Abandon QCom WCN probe on pre-pwrseq device-trees Benjamin Bara (1): ASoC: dapm: avoid container_of() to get component Bhargava Chenna Marreddy (1): RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages Binbin Zhou (1): ASoC: loongson: Fix component check failed on FDT systems Boris Burkov (1): btrfs: fix read corruption due to race with extent map merging Breno Leitao (2): elevator: do not request_module if elevator exists elevator: Remove argument from elevator_find_get Chancel Liu (1): ASoC: fsl_micfil: Add a flag to distinguish with different volume control types Chandramohan Akula (1): RDMA/bnxt_re: Change the sequence of updating the CQ toggle value Changhuang Liang (1): reset: starfive: jh71x0: Fix accessing the empty member on JH7110 SoC Christian Brauner (1): fs: don't try and remove empty rbtree node Christian Heusel (1): ACPI: resource: Add LG 16T90SP to irq1_level_low_skip_override[] Colin Ian King (2): octeontx2-af: Fix potential integer overflows on integer shifts ASoC: max98388: Fix missing increment of variable slot_found Cong Yang (1): drm/panel: himax-hx83102: Adjust power and gamma to optimize brightness Cosmin Ratiu (2): net/mlx5: Unregister notifier on eswitch init failure net/mlx5e: Don't call cleanup on profile rollback failure Crag Wang (1): platform/x86: dell-sysman: add support for alienware products Dan Carpenter (1): ACPI: PRM: Clean up guid type in struct prm_handler_info Daniel Borkmann (6): vmxnet3: Fix packet corruption in vmxnet3_xdp_xmit_frame bpf: Fix incorrect delta propagation between linked registers bpf: Fix print_reg_state's constant scalar dump bpf: Add MEM_WRITE attribute bpf: Fix overloading of MEM_UNINIT's meaning bpf: Remove MEM_UNINIT from skb/xdp MTU helpers Daniel Machon (1): net: sparx5: fix source port register when mirroring Darrick J. Wong (1): xfs: don't fail repairs on metadata files with no attr fork Dave Kleikamp (1): jfs: Fix sanity check in dbMount David Hildenbrand (1): mm: don't install PMD mappings when THPs are disabled by the hw/process/vma David Lawrence Glanzman (1): ASoC: amd: yc: Add quirk for HP Dragonfly pro one Dhananjay Ugwekar (2): cpufreq/amd-pstate: Fix amd_pstate mode switch on shared memory systems perf/x86/rapl: Fix the energy-pkg event for AMD CPUs Dimitar Kanaliev (1): bpf: Fix truncation bug in coerce_reg_to_size_sx() Dmitry Antipov (2): net: sched: fix use-after-free in taprio_change() net: sched: use RCU read-side critical section in taprio_dump() Dmitry Baryshkov (3): drm/msm/dpu: make sure phys resources are properly initialized drm/msm/dpu: move CRTC resource assignment to dpu_encoder_virt_atomic_check drm/msm/dpu: check for overflow in _dpu_crtc_setup_lm_bounds() Dominique Martinet (4): Revert " fs/9p: mitigate inode collisions" Revert "fs/9p: remove redundant pointer v9ses" Revert "fs/9p: fix uaf in in v9fs_stat2inode_dotl" Revert "fs/9p: simplify iget to remove unnecessary paths" Douglas Anderson (2): drm/msm: Avoid NULL dereference in msm_disp_state_print_regs() drm/msm: Allocate memory for disp snapshot with kvzalloc() Eduard Zingerman (1): bpf: sync_linked_regs() must preserve subreg_def Eric Biggers (1): ALSA: hda/tas2781: select CRC32 instead of CRC32_SARWATE Eric Dumazet (3): netdevsim: use cond_resched() in nsim_dev_trap_report_work() genetlink: hold RCU in genlmsg_mcast() net: fix races in netdev_tx_sent_queue()/dev_watchdog() Eyal Birger (2): xfrm: extract dst lookup parameters into a struct xfrm: respect ip protocols rules criteria when performing dst lookups Fabrizio Castro (1): irqchip/renesas-rzg2l: Fix missing put_device Felix Fietkau (1): net: ethernet: mtk_eth_soc: fix memory corruption during fq dma init Filipe Manana (1): btrfs: clear force-compress on remount when compress mount option is given Florian Kauer (1): bpf: devmap: provide rxq after redirect Florian Klink (1): ARM: dts: bcm2837-rpi-cm3-io3: Fix HDMI hpd-gpio pin Florian Westphal (1): netfilter: bpf: must hold reference on net namespace Gal Pressman (1): ravb: Remove setting of RX software timestamp Gianfranco Trad (1): udf: fix uninit-value use in udf_get_fileshortad Greg Kroah-Hartman (1): Linux 6.11.6 Gustavo Sousa (1): drm/xe/mcr: Use Xe2_LPM steering tables for Xe2_HPM Haiyang Zhang (1): hv_netvsc: Fix VF namespace also in synthetic NIC NETDEV_REGISTER event Hans de Goede (1): drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA Heiko Carstens (1): s390: Initialize psw mask in perf_arch_fetch_caller_regs() Heiner Kallweit (1): r8169: avoid unsolicited interrupts Henrique Carvalho (1): smb: client: Handle kstrdup failures for passwords Hongguang Gao (1): RDMA/bnxt_re: Get the toggle bits from SRQ events Hou Tao (3): bpf: Check the remaining info_cnt before repeating btf fields bpf: Preserve param->string when parsing mount options bpf: Add the missing BPF_LINK_TYPE invocation for sockmap Huacai Chen (3): LoongArch: Get correct cores_per_package for SMT systems LoongArch: Enable IRQ if do_ale() triggered in irq-enabled context LoongArch: Make KASAN usable for variable cpu_vabits Ian Forbes (1): drm/vmwgfx: Handle possible ENOMEM in vmw_stdu_connector_atomic_check Ilkka Koskinen (1): KVM: arm64: Fix shift-out-of-bounds bug Jakub Boehm (1): net: plip: fix break; causing plip to never transmit Jan Kara (1): fsnotify: Avoid data race between fsnotify_recalc_mask() and fsnotify_object_watched() Javier Carrasco (3): iio: frequency: {admv4420,adrf6780}: format Kconfig entries iio: frequency: admv4420: fix missing select REMAP_SPI in Kconfig iio: adc: ti-lmp92064: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig Jean Delvare (1): [PATCH} hwmon: (jc42) Properly detect TSE2004-compliant devices again Jessica Zhang (2): drm/msm/dpu: Don't always set merge_3d pending flush drm/msm/dpu: don't always program merge_3d block Jinjie Ruan (1): posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime() Jiri Olsa (2): bpf: Fix memory leak in bpf_core_apply bpf,perf: Fix perf_event_detach_bpf_prog error handling Jiri Slaby (SUSE) (2): xhci: dbgtty: remove kfifo_out() wrapper xhci: dbgtty: use kfifo from tty_port struct Jonathan Marek (2): drm/msm/dsi: improve/fix dsc pclk calculation drm/msm/dsi: fix 32-bit signed integer extension in pclk_rate calculation Jordan Rome (1): bpf: Fix iter/task tid filtering Josh Poimboeuf (1): cdrom: Avoid barrier_nospec() in cdrom_ioctl_media_changed() José Relvas (1): ALSA: hda/realtek: Add subwoofer quirk for Acer Predator G9-593 Justin Chen (1): firmware: arm_scmi: Queue in scmi layer for mailbox implementation Kai Shen (1): net/smc: Fix memory leak when using percpu refs Kai Vehmanen (1): ASoC: SOF: Intel: hda-loader: do not wait for HDaudio IOC Kailang Yang (1): ALSA: hda/realtek: Update default depop procedure Kalesh AP (5): RDMA/bnxt_re: Fix a possible memory leak RDMA/bnxt_re: Add a check for memory allocation RDMA/bnxt_re: Fix out of bound check RDMA/bnxt_re: Return more meaningful error RDMA/bnxt_re: Fix the GID table length Kashyap Desai (1): RDMA/bnxt_re: Fix incorrect dereference of srq in async event Kefeng Wang (1): mm: huge_memory: add vma_thp_disabled() and thp_disabled_by_hw() Koba Ko (1): ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context Konrad Dybcio (1): PCI/pwrctl: Add WCN6855 support Kory Maincent (1): net: pse-pd: Fix out of bound for loop Krzysztof Kozlowski (2): ASoC: qcom: sc7280: Fix missing Soundwire runtime stream alloc ASoC: qcom: Select missing common Soundwire module code on SDM845 Kuniyuki Iwashima (1): tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). Lad Prabhakar (1): ASoC: rsnd: Fix probe failure on HiHope boards due to endpoint parsing Leo Yan (1): tracing: Consider the NULL character when validating the event length Li Huafei (1): fgraph: Fix missing unlock in register_ftrace_graph() Li RongQing (1): net/smc: Fix searching in list of known pnetids in smc_pnet_add_pnetid Lin Ma (1): net: wwan: fix global oob in wwan_rtnl_policy Linus Torvalds (3): x86: support user address masking instead of non-speculative conditional x86: fix whitespace in runtime-const assembler output x86: fix user address masking non-canonical speculation issue Luiz Augusto von Dentz (3): Bluetooth: hci_core: Disable works on hci_unregister_dev Bluetooth: SCO: Fix UAF on sco_sock_timeout Bluetooth: ISO: Fix UAF on iso_sock_timeout Maher Sanalla (1): net/mlx5: Check for invalid vector index on EQ creation Marc Zyngier (1): KVM: arm64: Don't eagerly teardown the vgic on init error Mario Limonciello (2): drm/amd: Guard against bad data for ATIF ACPI method drm/amd/display: Disable PSR-SU on Parade 08-01 TCON too Mark Rutland (1): arm64: Force position-independent veneers Martin Kletzander (1): x86/resctrl: Avoid overflow in MB settings in bw_validate() Mathias Nyman (1): xhci: dbc: honor usb transfer size boundaries. Matthew Auld (2): drm/xe: fix unbalanced rpm put() with fence_fini() drm/xe: fix unbalanced rpm put() with declare_wedged() Matthew Brost (3): drm/xe: Take job list lock in xe_sched_add_pending_job drm/xe: Don't free job in TDR drm/xe: Use bookkeep slots for external BO's in exec IOCTL Maurizio Lombardi (1): nvme-pci: fix race condition between reset and nvme_dev_disable() Michael S. Tsirkin (1): virtio_net: fix integer overflow in stats Michal Luczaj (4): bpf, sockmap: SK_DROP on attempted redirects of unsupported af_vsock vsock: Update rx_bytes on read_skb() vsock: Update msg_count on read_skb() bpf, vsock: Drop static vsock_bpf_prot initialization Michel Alex (1): net: phy: dp83822: Fix reset pin definitions Mikel Rychliski (1): tracing/probes: Fix MAX_TRACE_ARGS limit handling Mikhail Lobanov (1): iio: accel: bma400: Fix uninitialized variable field_value in tap event handling. Miquel Raynal (2): ASoC: dt-bindings: davinci-mcasp: Fix interrupts property ASoC: dt-bindings: davinci-mcasp: Fix interrupt properties Murad Masimov (1): ALSA: hda/cs8409: Fix possible NULL dereference Naohiro Aota (1): btrfs: zoned: fix zone unusable accounting for freed reserved extent Niklas Cassel (1): ata: libata: Set DID_TIME_OUT for commands that actually timed out Niklas Schnelle (1): s390/pci: Handle PCI error codes other than 0x3a Niklas Söderlund (1): net: ravb: Only advertise Rx/Tx timestamps if hardware supports it Olga Kornievskaia (1): nfsd: fix race between laundromat and free_stateid Oliver Neukum (2): net: usb: usbnet: fix race in probe failure net: usb: usbnet: fix name regression Oliver Upton (1): KVM: arm64: Unregister redistributor for failed vCPU creation Pablo Neira Ayuso (1): netfilter: xtables: fix typo causing some targets not to load on IPv6 Pali Rohár (1): cifs: Validate content of NFS reparse point buffer Paritosh Dixit (1): net: stmmac: dwmac-tegra: Fix link bring-up sequence Paulo Alcantara (1): smb: client: fix OOBs when building SMB2_IOCTL request Pawan Gupta (1): x86/lam: Disable ADDRESS_MASKING in most cases Peter Collingbourne (1): bpf, arm64: Fix address emission with tag-based KASAN enabled Peter Rashleigh (2): net: dsa: mv88e6xxx: Fix the max_vid definition for the MV88E6361 net: dsa: mv88e6xxx: Fix error when setting port policy on mv88e6393x Petr Pavlu (1): ring-buffer: Fix reader locking when changing the sub buffer order Petr Vaganov (1): xfrm: fix one more kernel-infoleak in algo dumping Pranjal Ramajor Asha Kanojiya (1): accel/qaic: Fix the for loop used to walk SG table Pu Lehui (1): riscv, bpf: Fix possible infinite tailcall when CONFIG_CFI_CLANG is enabled Qiao Ma (1): uprobe: avoid out-of-bounds memory access of fetching args Qu Wenruo (2): btrfs: qgroup: set a more sane default value for subtree drop threshold btrfs: reject ro->rw reconfiguration if there are hard ro requirements Ranjani Sridharan (4): ASoC: SOF: Intel: hda: Handle prepare without close for non-HDA DAI's ASoC: SOF: Intel: hda: Always clean up link DMA during stop ASoC: SOF: ipc4-topology: Do not set ALH node_id for aggregated DAIs soundwire: intel_ace2x: Send PDI stream number during prepare Richard Gong (2): x86/amd_nb: Add new PCI IDs for AMD family 1Ah model 60h-70h x86/amd_nb: Add new PCI ID for AMD family 1Ah model 20h Rob Clark (1): drm/msm/a6xx+: Insert a fence wait before SMMU table update Ryusuke Konishi (1): nilfs2: fix kernel bug due to missing clearing of buffer delay flag Sabrina Dubroca (2): macsec: don't increment counters for an unrelated SA xfrm: validate new SA's prefixlen using SA family when sel.family is unset Saravanan Vajravel (1): RDMA/bnxt_re: Fix incorrect AVID type in WQE structure Sean Christopherson (1): KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory Selvin Xavier (1): RDMA/bnxt_re: Avoid CPU lockups due fifo occupancy check loop Shay Drory (1): net/mlx5: Fix command bitmask initialization Shenghao Yang (3): net: dsa: mv88e6xxx: group cycle counter coefficients net: dsa: mv88e6xxx: read cycle counter period from hardware net: dsa: mv88e6xxx: support 4000ps cycle counter period Shengjiu Wang (1): ASoC: fsl_sai: Enable 'FIFO continue on error' FCONT bit Shubham Panwar (1): ACPI: button: Add DMI quirk for Samsung Galaxy Book2 to fix initial lid detection issue Srinivasan Shanmugam (1): drm/amd/amdgpu: Fix double unlock in amdgpu_mes_add_ring Steven Rostedt (2): fgraph: Allocate ret_stack_list with proper size fgraph: Change the name of cpuhp state to "fgraph:online" Su Hui (2): firmware: arm_scmi: Fix the double free in scmi_debugfs_common_setup() smb: client: fix possible double free in smb2_set_ea() Takashi Sakamoto (1): firewire: core: fix invalid port index for parent device Thadeu Lima de Souza Cascardo (1): usb: typec: altmode should keep reference to parent Thomas Weißschuh (1): LoongArch: Don't crash in stack_top() for tasks without vDSO Tim Harvey (1): net: dsa: microchip: disable EEE for KSZ879x/KSZ877x/KSZ876x Timo Grautstueck (1): lib/Kconfig.debug: fix grammar in RUST_BUILD_ASSERT_ALLOW Toke Høiland-Jørgensen (2): bpf: Make sure internal and UAPI bpf_redirect flags don't overlap bpf: fix kfunc btf caching for modules Tony Ambardar (1): selftests/bpf: Fix cross-compiling urandom_read Tyrone Wu (4): bpf: fix unpopulated name_len field in perf_event link info selftests/bpf: fix perf_event link info name_len assertion bpf: Fix unpopulated path_size when uprobe_multi fields unset bpf: Fix link info netfilter flags to populate defrag flag Vadim Fedorenko (1): bnxt_en: replace ptp_lock with irqsave variant Vamsi Krishna Brahmajosyula (1): platform/x86/intel/pmc: Fix pmc_core_iounmap to call iounmap for valid addresses Viktor Malik (1): objpool: fix choosing allocation for percpu slots Vladimir Oltean (2): net: dsa: vsc73xx: fix reception from VLAN-unaware bridges net/sched: act_api: deny mismatched skip_sw/skip_hw flags for actions created by classifiers Waiman Long (1): sched/core: Disable page allocation in task_tick_mm_cid() Wander Lairson Costa (1): bpf: Use raw_spinlock_t in ringbuf Wang Hai (8): net: ethernet: aeroflex: fix potential memory leak in greth_start_xmit_gbit() net: xilinx: axienet: fix potential memory leak in axienet_start_xmit() net: ethernet: rtsn: fix potential memory leak in rtsn_start_xmit() net: systemport: fix potential memory leak in bcm_sysport_xmit() net: bcmasp: fix potential memory leak in bcmasp_xmit() scsi: target: core: Fix null-ptr-deref in target_alloc_device() net/sun3_82586: fix potential memory leak in sun3_82586_send_packet() be2net: fix potential memory leak in be_xmit() Xin Long (1): ipv4: give an IPv4 dev to blackhole_netdev Yang Erkun (1): nfsd: cancel nfsd_shrinker_work using sync mode in nfs4_state_shutdown_net Yao Zi (1): clk: rockchip: fix finding of maximum clock ID Ye Bin (2): Bluetooth: bnep: fix wild-memory-access in proto_unregister cifs: fix warning when destroy 'cifs_io_request_pool' Yu Kuai (1): md/raid10: fix null ptr dereference in raid10_size() Yuan Can (2): mlxsw: spectrum_router: fix xa_store() error checking powercap: dtpm_devfreq: Fix error check against dev_pm_qos_add_request() Yue Haibing (1): btrfs: fix passing 0 to ERR_PTR in btrfs_search_dir_index_item() Zhao Mengmeng (3): udf: refactor udf_current_aext() to handle error udf: refactor udf_next_aext() to handle error udf: refactor inode_bmap() to handle error Zichen Xie (1): ASoC: qcom: Fix NULL Dereference in asoc_qcom_lpass_cpu_platform_probe() liwei (1): cpufreq: CPPC: fix perf_to_khz/khz_to_perf conversion exception

53 minutes

1
1
0 0

Linux 6.6.59

by Greg Kroah-Hartman

I'm announcing the release of the 6.6.59 kernel. All users of the 6.6 kernel series must upgrade. The updated 6.6.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.6.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/devicetree/bindings/sound/davinci-mcasp-audio.yaml | 18 Makefile | 2 arch/arm/boot/dts/broadcom/bcm2837-rpi-cm3-io3.dts | 2 arch/arm64/Makefile | 2 arch/arm64/kvm/arm.c | 3 arch/arm64/kvm/sys_regs.c | 2 arch/arm64/kvm/vgic/vgic-init.c | 6 arch/loongarch/include/asm/bootinfo.h | 4 arch/loongarch/include/asm/kasan.h | 2 arch/loongarch/kernel/process.c | 16 arch/loongarch/kernel/setup.c | 3 arch/loongarch/kernel/traps.c | 5 arch/riscv/net/bpf_jit_comp64.c | 4 arch/s390/include/asm/perf_event.h | 1 arch/s390/pci/pci_event.c | 17 arch/x86/Kconfig | 1 arch/x86/kernel/cpu/resctrl/ctrlmondata.c | 23 arch/x86/kvm/svm/nested.c | 6 drivers/accel/qaic/qaic_control.c | 2 drivers/accel/qaic/qaic_data.c | 6 drivers/acpi/button.c | 11 drivers/acpi/cppc_acpi.c | 116 ++++ drivers/acpi/prmt.c | 29 - drivers/acpi/resource.c | 7 drivers/ata/libata-eh.c | 1 drivers/cdrom/cdrom.c | 2 drivers/cpufreq/amd-pstate.c | 10 drivers/cpufreq/cppc_cpufreq.c | 139 ----- drivers/firmware/arm_scmi/driver.c | 4 drivers/firmware/arm_scmi/mailbox.c | 32 - drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 15 drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c | 5 drivers/gpu/drm/amd/display/modules/power/power_helpers.c | 2 drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 17 drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 9 drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c | 2 drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c | 19 drivers/gpu/drm/msm/dsi/dsi_host.c | 4 drivers/gpu/drm/vboxvideo/hgsmi_base.c | 10 drivers/gpu/drm/vboxvideo/vboxvideo.h | 4 drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c | 4 drivers/iio/accel/bma400_core.c | 3 drivers/iio/adc/Kconfig | 2 drivers/iio/frequency/Kconfig | 33 - drivers/infiniband/core/addr.c | 2 drivers/infiniband/hw/bnxt_re/hw_counters.c | 6 drivers/infiniband/hw/bnxt_re/ib_verbs.c | 48 + drivers/infiniband/hw/bnxt_re/main.c | 42 - drivers/infiniband/hw/bnxt_re/qplib_fp.c | 4 drivers/infiniband/hw/bnxt_re/qplib_fp.h | 2 drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 4 drivers/infiniband/hw/bnxt_re/qplib_res.c | 23 drivers/infiniband/hw/bnxt_re/qplib_res.h | 20 drivers/infiniband/hw/bnxt_re/qplib_sp.c | 22 drivers/infiniband/hw/bnxt_re/qplib_sp.h | 1 drivers/infiniband/hw/cxgb4/cm.c | 9 drivers/infiniband/hw/irdma/cm.c | 2 drivers/infiniband/ulp/srpt/ib_srpt.c | 80 ++- drivers/irqchip/irq-renesas-rzg2l.c | 94 +++ drivers/net/dsa/mv88e6xxx/chip.c | 2 drivers/net/dsa/mv88e6xxx/chip.h | 6 drivers/net/dsa/mv88e6xxx/port.c | 1 drivers/net/dsa/mv88e6xxx/ptp.c | 108 ++-- drivers/net/ethernet/aeroflex/greth.c | 3 drivers/net/ethernet/broadcom/asp2/bcmasp_intf.c | 1 drivers/net/ethernet/broadcom/bcmsysport.c | 1 drivers/net/ethernet/emulex/benet/be_main.c | 10 drivers/net/ethernet/freescale/fman/mac.c | 68 +- drivers/net/ethernet/freescale/fman/mac.h | 6 drivers/net/ethernet/i825xx/sun3_82586.c | 1 drivers/net/ethernet/marvell/octeon_ep/octep_rx.c | 82 ++- drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 4 drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 8 drivers/net/ethernet/mellanox/mlx5/core/eq.c | 6 drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 5 drivers/net/ethernet/realtek/r8169_main.c | 4 drivers/net/ethernet/renesas/ravb_main.c | 25 drivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c | 14 drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 2 drivers/net/hyperv/netvsc_drv.c | 30 + drivers/net/macsec.c | 18 drivers/net/netdevsim/dev.c | 15 drivers/net/phy/dp83822.c | 4 drivers/net/plip/plip.c | 2 drivers/net/usb/usbnet.c | 4 drivers/net/vmxnet3/vmxnet3_xdp.c | 2 drivers/net/wwan/wwan_core.c | 2 drivers/nvme/host/pci.c | 21 drivers/platform/x86/dell/dell-wmi-base.c | 9 drivers/platform/x86/dell/dell-wmi-sysman/sysman.c | 1 drivers/powercap/dtpm_devfreq.c | 2 drivers/target/target_core_device.c | 2 drivers/target/target_core_user.c | 2 drivers/usb/dwc3/core.c | 19 drivers/usb/dwc3/core.h | 3 drivers/usb/gadget/function/f_uac2.c | 13 drivers/usb/host/xhci-caps.h | 85 +++ drivers/usb/host/xhci-dbgcap.h | 2 drivers/usb/host/xhci-dbgtty.c | 73 ++ drivers/usb/host/xhci-port.h | 176 ++++++ drivers/usb/host/xhci.h | 262 ---------- drivers/usb/typec/class.c | 3 fs/btrfs/block-group.c | 2 fs/btrfs/dir-item.c | 4 fs/btrfs/inode.c | 7 fs/exec.c | 21 fs/jfs/jfs_dmap.c | 2 fs/nfsd/nfs4state.c | 2 fs/nilfs2/page.c | 6 fs/open.c | 2 fs/smb/client/fs_context.c | 7 fs/smb/client/reparse.c | 23 fs/smb/client/smb2ops.c | 3 fs/smb/client/smb2pdu.c | 9 fs/udf/balloc.c | 38 - fs/udf/directory.c | 23 fs/udf/inode.c | 202 +++++-- fs/udf/partition.c | 6 fs/udf/super.c | 3 fs/udf/truncate.c | 43 + fs/udf/udfdecl.h | 15 include/acpi/cppc_acpi.h | 2 include/linux/bpf.h | 14 include/linux/memcontrol.h | 14 include/linux/netdevice.h | 12 include/linux/task_work.h | 6 include/linux/trace_events.h | 6 include/net/bluetooth/bluetooth.h | 1 include/net/genetlink.h | 3 include/net/sock.h | 5 include/net/xfrm.h | 28 - include/trace/events/huge_memory.h | 10 include/uapi/linux/bpf.h | 20 kernel/bpf/btf.c | 1 kernel/bpf/devmap.c | 11 kernel/bpf/helpers.c | 10 kernel/bpf/ringbuf.c | 2 kernel/bpf/syscall.c | 47 + kernel/bpf/task_iter.c | 2 kernel/bpf/verifier.c | 99 +-- kernel/sched/core.c | 4 kernel/task_work.c | 43 + kernel/time/posix-clock.c | 6 kernel/trace/bpf_trace.c | 11 kernel/trace/trace.c | 1 kernel/trace/trace_eprobe.c | 15 kernel/trace/trace_fprobe.c | 65 +- kernel/trace/trace_kprobe.c | 78 ++ kernel/trace/trace_probe.c | 189 ++++++- kernel/trace/trace_probe.h | 30 + kernel/trace/trace_probe_tmpl.h | 10 kernel/trace/trace_uprobe.c | 114 ++-- lib/Kconfig.debug | 2 mm/khugepaged.c | 127 ++-- net/bluetooth/af_bluetooth.c | 22 net/bluetooth/bnep/core.c | 3 net/bluetooth/iso.c | 18 net/bluetooth/sco.c | 18 net/core/filter.c | 50 - net/core/sock_map.c | 8 net/ipv4/devinet.c | 35 - net/ipv4/inet_connection_sock.c | 21 net/ipv4/xfrm4_policy.c | 40 - net/ipv6/xfrm6_policy.c | 31 - net/l2tp/l2tp_netlink.c | 4 net/netfilter/nf_bpf_link.c | 7 net/netfilter/xt_NFLOG.c | 2 net/netfilter/xt_TRACE.c | 1 net/netfilter/xt_mark.c | 2 net/netlink/genetlink.c | 28 - net/sched/act_api.c | 23 net/sched/sch_generic.c | 17 net/sched/sch_taprio.c | 21 net/smc/smc_pnet.c | 2 net/smc/smc_wr.c | 6 net/vmw_vsock/virtio_transport_common.c | 14 net/vmw_vsock/vsock_bpf.c | 8 net/wireless/nl80211.c | 8 net/xfrm/xfrm_device.c | 11 net/xfrm/xfrm_policy.c | 50 + net/xfrm/xfrm_user.c | 10 security/selinux/selinuxfs.c | 30 - sound/firewire/amdtp-stream.c | 3 sound/pci/hda/Kconfig | 2 sound/pci/hda/patch_cs8409.c | 5 sound/pci/hda/patch_realtek.c | 48 + sound/soc/amd/yc/acp6x-mach.c | 7 sound/soc/codecs/lpass-rx-macro.c | 2 sound/soc/codecs/max98388.c | 1 sound/soc/fsl/fsl_micfil.c | 43 + sound/soc/fsl/fsl_sai.c | 5 sound/soc/fsl/fsl_sai.h | 1 sound/soc/loongson/loongson_card.c | 1 sound/soc/qcom/lpass-cpu.c | 2 sound/soc/qcom/sm8250.c | 1 sound/soc/sh/rcar/core.c | 7 tools/include/uapi/linux/bpf.h | 7 tools/testing/selftests/bpf/Makefile | 2 tools/testing/selftests/bpf/prog_tests/fill_link_info.c | 69 +- tools/testing/selftests/bpf/progs/verifier_helper_value_access.c | 8 tools/testing/selftests/bpf/progs/verifier_raw_stack.c | 2 tools/testing/selftests/ftrace/test.d/dynevent/fprobe_syntax_errors.tc | 4 tools/testing/selftests/ftrace/test.d/kprobe/kprobe_syntax_errors.tc | 2 203 files changed, 2729 insertions(+), 1460 deletions(-) Abhishek Mohapatra (1): RDMA/bnxt_re: Fix the max CQ WQEs for older adapters Aleksa Sarai (1): openat2: explicitly return -E2BIG for (usize > PAGE_SIZE) Aleksandr Mishin (4): octeon_ep: Implement helper for iterating packets in Rx queue octeon_ep: Add SKB allocation failures handling in __octep_oq_process_rx() fsl/fman: Save device references taken in mac_probe() fsl/fman: Fix refcount handling of fman-related devices Alexander Zubkov (1): RDMA/irdma: Fix misspelling of "accept*" Alexey Klimov (2): ASoC: codecs: lpass-rx-macro: add missing CDC_RX_BCL_VBAT_RF_PROC2 to default regs values ASoC: qcom: sm8250: add qrb4210-rb2-sndcard compatible string Andrea Parri (1): riscv, bpf: Make BPF_CMPXCHG fully ordered Andrei Matei (1): bpf: Simplify checking size of helper accesses Andrey Shumilin (1): ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() Andrii Nakryiko (3): uprobes: encapsulate preparation of uprobe args buffer uprobes: prepare uprobe args buffer lazily uprobes: prevent mutex_lock() under rcu_read_lock() Anumula Murali Mohan Reddy (2): RDMA/core: Fix ENODEV error for iWARP test over vlan RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP Armin Wolf (1): platform/x86: dell-wmi: Ignore suspend notifications Bart Van Assche (1): RDMA/srpt: Make slab cache names unique Bhargava Chenna Marreddy (1): RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages Binbin Zhou (1): ASoC: loongson: Fix component check failed on FDT systems Chancel Liu (1): ASoC: fsl_micfil: Add a flag to distinguish with different volume control types Christian Heusel (1): ACPI: resource: Add LG 16T90SP to irq1_level_low_skip_override[] Claudiu Beznea (3): irqchip/renesas-rzg2l: Align struct member names to tabs irqchip/renesas-rzg2l: Document structure members irqchip/renesas-rzg2l: Add support for suspend to RAM Colin Ian King (2): octeontx2-af: Fix potential integer overflows on integer shifts ASoC: max98388: Fix missing increment of variable slot_found Cosmin Ratiu (1): net/mlx5: Unregister notifier on eswitch init failure Crag Wang (1): platform/x86: dell-sysman: add support for alienware products Dan Carpenter (1): ACPI: PRM: Clean up guid type in struct prm_handler_info Daniel Borkmann (4): vmxnet3: Fix packet corruption in vmxnet3_xdp_xmit_frame bpf: Add MEM_WRITE attribute bpf: Fix overloading of MEM_UNINIT's meaning bpf: Remove MEM_UNINIT from skb/xdp MTU helpers Dave Kleikamp (1): jfs: Fix sanity check in dbMount David Lawrence Glanzman (1): ASoC: amd: yc: Add quirk for HP Dragonfly pro one Dhananjay Ugwekar (1): cpufreq/amd-pstate: Fix amd_pstate mode switch on shared memory systems Dimitar Kanaliev (1): bpf: Fix truncation bug in coerce_reg_to_size_sx() Dmitry Antipov (2): net: sched: fix use-after-free in taprio_change() net: sched: use RCU read-side critical section in taprio_dump() Dmitry Baryshkov (2): drm/msm/dpu: make sure phys resources are properly initialized drm/msm/dpu: check for overflow in _dpu_crtc_setup_lm_bounds() Douglas Anderson (2): drm/msm: Avoid NULL dereference in msm_disp_state_print_regs() drm/msm: Allocate memory for disp snapshot with kvzalloc() Eric Biggers (1): ALSA: hda/tas2781: select CRC32 instead of CRC32_SARWATE Eric Dumazet (3): netdevsim: use cond_resched() in nsim_dev_trap_report_work() genetlink: hold RCU in genlmsg_mcast() net: fix races in netdev_tx_sent_queue()/dev_watchdog() Eyal Birger (2): xfrm: extract dst lookup parameters into a struct xfrm: respect ip protocols rules criteria when performing dst lookups Fabrizio Castro (1): irqchip/renesas-rzg2l: Fix missing put_device Florian Kauer (1): bpf: devmap: provide rxq after redirect Florian Klink (1): ARM: dts: bcm2837-rpi-cm3-io3: Fix HDMI hpd-gpio pin Florian Westphal (1): netfilter: bpf: must hold reference on net namespace Frank Li (1): XHCI: Separate PORT and CAPs macros into dedicated file Gal Pressman (1): ravb: Remove setting of RX software timestamp Gianfranco Trad (1): udf: fix uninit-value use in udf_get_fileshortad Greg Kroah-Hartman (1): Linux 6.6.59 Haiyang Zhang (1): hv_netvsc: Fix VF namespace also in synthetic NIC NETDEV_REGISTER event Hans de Goede (1): drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA Heiko Carstens (1): s390: Initialize psw mask in perf_arch_fetch_caller_regs() Heiner Kallweit (1): r8169: avoid unsolicited interrupts Henrique Carvalho (1): smb: client: Handle kstrdup failures for passwords Huacai Chen (3): LoongArch: Get correct cores_per_package for SMT systems LoongArch: Enable IRQ if do_ale() triggered in irq-enabled context LoongArch: Make KASAN usable for variable cpu_vabits Ian Forbes (1): drm/vmwgfx: Handle possible ENOMEM in vmw_stdu_connector_atomic_check Ilkka Koskinen (1): KVM: arm64: Fix shift-out-of-bounds bug Jakub Boehm (1): net: plip: fix break; causing plip to never transmit Javier Carrasco (3): iio: frequency: {admv4420,adrf6780}: format Kconfig entries iio: frequency: admv4420: fix missing select REMAP_SPI in Kconfig iio: adc: ti-lmp92064: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig Jessica Zhang (1): drm/msm/dpu: don't always program merge_3d block Jinjie Ruan (1): posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime() Jiri Olsa (6): bpf: Fix memory leak in bpf_core_apply bpf: Add missed value to kprobe perf link info bpf: Add cookie to perf_event bpf_link_info records selftests/bpf: Use bpf_link__destroy in fill_link_info tests selftests/bpf: Add cookies check for perf_event fill_link_info test bpf,perf: Fix perf_event_detach_bpf_prog error handling Jiri Slaby (SUSE) (2): xhci: dbgtty: remove kfifo_out() wrapper xhci: dbgtty: use kfifo from tty_port struct John Keeping (1): usb: gadget: f_uac2: fix non-newline-terminated function name Jonathan Marek (2): drm/msm/dsi: improve/fix dsc pclk calculation drm/msm/dsi: fix 32-bit signed integer extension in pclk_rate calculation Jordan Rome (1): bpf: Fix iter/task tid filtering Josh Poimboeuf (1): cdrom: Avoid barrier_nospec() in cdrom_ioctl_media_changed() José Relvas (1): ALSA: hda/realtek: Add subwoofer quirk for Acer Predator G9-593 Justin Chen (1): firmware: arm_scmi: Queue in scmi layer for mailbox implementation Kai Shen (1): net/smc: Fix memory leak when using percpu refs Kailang Yang (1): ALSA: hda/realtek: Update default depop procedure Kalesh AP (7): RDMA/bnxt_re: Fix a possible memory leak RDMA/bnxt_re: Add a check for memory allocation RDMA/bnxt_re: Fix out of bound check RDMA/bnxt_re: Return more meaningful error RDMA/bnxt_re: Fix the GID table length RDMA/bnxt_re: Avoid creating fence MR for newer adapters RDMA/bnxt_re: Fix unconditional fence for newer adapters Kevin Groeneveld (1): usb: gadget: f_uac2: fix return value for UAC2_ATTRIBUTE_STRING store Koba Ko (1): ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context Kuniyuki Iwashima (1): tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). Lad Prabhakar (1): ASoC: rsnd: Fix probe failure on HiHope boards due to endpoint parsing Lee Jones (1): usb: gadget: f_uac2: Replace snprintf() with the safer scnprintf() variant Leo Yan (1): tracing: Consider the NULL character when validating the event length Li RongQing (1): net/smc: Fix searching in list of known pnetids in smc_pnet_add_pnetid Lin Ma (1): net: wwan: fix global oob in wwan_rtnl_policy Linus Torvalds (1): task_work: make TWA_NMI_CURRENT handling conditional on IRQ_WORK Luiz Augusto von Dentz (2): Bluetooth: SCO: Fix UAF on sco_sock_timeout Bluetooth: ISO: Fix UAF on iso_sock_timeout Maher Sanalla (1): net/mlx5: Check for invalid vector index on EQ creation Marc Zyngier (1): KVM: arm64: Don't eagerly teardown the vgic on init error Mario Limonciello (2): drm/amd: Guard against bad data for ATIF ACPI method drm/amd/display: Disable PSR-SU on Parade 08-01 TCON too Mark Rutland (1): arm64: Force position-independent veneers Martin Kletzander (1): x86/resctrl: Avoid overflow in MB settings in bw_validate() Masami Hiramatsu (Google) (4): tracing/fprobe-event: cleanup: Fix a wrong comment in fprobe event tracing/probes: cleanup: Set trace_probe::nr_args at trace_probe_init tracing/probes: Support $argN in return probe (kprobe and fprobe) tracing: probes: Fix to zero initialize a local variable Mateusz Guzik (1): exec: don't WARN for racy path_noexec check Mathias Nyman (1): xhci: dbc: honor usb transfer size boundaries. Matthew Wilcox (Oracle) (5): mm: convert collapse_huge_page() to use a folio mm/khugepaged: use a folio more in collapse_file() khugepaged: inline hpage_collapse_alloc_folio() khugepaged: convert alloc_charge_hpage to alloc_charge_folio khugepaged: remove hpage from collapse_file() Maurizio Lombardi (1): nvme-pci: fix race condition between reset and nvme_dev_disable() Michal Luczaj (4): bpf, sockmap: SK_DROP on attempted redirects of unsupported af_vsock vsock: Update rx_bytes on read_skb() vsock: Update msg_count on read_skb() bpf, vsock: Drop static vsock_bpf_prot initialization Michel Alex (1): net: phy: dp83822: Fix reset pin definitions Mikel Rychliski (1): tracing/probes: Fix MAX_TRACE_ARGS limit handling Mikhail Lobanov (1): iio: accel: bma400: Fix uninitialized variable field_value in tap event handling. Miquel Raynal (2): ASoC: dt-bindings: davinci-mcasp: Fix interrupts property ASoC: dt-bindings: davinci-mcasp: Fix interrupt properties Murad Masimov (1): ALSA: hda/cs8409: Fix possible NULL dereference Naohiro Aota (1): btrfs: zoned: fix zone unusable accounting for freed reserved extent Niklas Cassel (1): ata: libata: Set DID_TIME_OUT for commands that actually timed out Niklas Schnelle (1): s390/pci: Handle PCI error codes other than 0x3a Niklas Söderlund (1): net: ravb: Only advertise Rx/Tx timestamps if hardware supports it Oliver Neukum (2): net: usb: usbnet: fix race in probe failure net: usb: usbnet: fix name regression Pablo Neira Ayuso (1): netfilter: xtables: fix typo causing some targets not to load on IPv6 Pali Rohár (1): cifs: Validate content of NFS reparse point buffer Paritosh Dixit (1): net: stmmac: dwmac-tegra: Fix link bring-up sequence Paul Moore (1): selinux: improve error checking in sel_write_load() Paulo Alcantara (1): smb: client: fix OOBs when building SMB2_IOCTL request Pawan Gupta (1): x86/lam: Disable ADDRESS_MASKING in most cases Peter Rashleigh (2): net: dsa: mv88e6xxx: Fix the max_vid definition for the MV88E6361 net: dsa: mv88e6xxx: Fix error when setting port policy on mv88e6393x Petr Vaganov (1): xfrm: fix one more kernel-infoleak in algo dumping Pranjal Ramajor Asha Kanojiya (1): accel/qaic: Fix the for loop used to walk SG table Praveen Kumar Kannoju (1): net/sched: adjust device watchdog timer to detect stopped queue at right time Qiao Ma (1): uprobe: avoid out-of-bounds memory access of fetching args Roger Quadros (1): usb: dwc3: core: Fix system suspend on TI AM62 platforms Ryusuke Konishi (1): nilfs2: fix kernel bug due to missing clearing of buffer delay flag Sabrina Dubroca (2): macsec: don't increment counters for an unrelated SA xfrm: validate new SA's prefixlen using SA family when sel.family is unset Saravanan Vajravel (1): RDMA/bnxt_re: Fix incorrect AVID type in WQE structure Sean Christopherson (1): KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory Sebastian Andrzej Siewior (1): task_work: Add TWA_NMI_CURRENT as an additional notify mode. Selvin Xavier (3): RDMA/bnxt_re: Support new 5760X P7 devices RDMA/bnxt_re: Update the BAR offsets RDMA/bnxt_re: Fix the offset for GenP7 adapters for user applications Shay Drory (1): net/mlx5: Fix command bitmask initialization Shenghao Yang (3): net: dsa: mv88e6xxx: group cycle counter coefficients net: dsa: mv88e6xxx: read cycle counter period from hardware net: dsa: mv88e6xxx: support 4000ps cycle counter period Shengjiu Wang (1): ASoC: fsl_sai: Enable 'FIFO continue on error' FCONT bit Shubham Panwar (1): ACPI: button: Add DMI quirk for Samsung Galaxy Book2 to fix initial lid detection issue Srinivasan Shanmugam (1): drm/amd/amdgpu: Fix double unlock in amdgpu_mes_add_ring Su Hui (2): firmware: arm_scmi: Fix the double free in scmi_debugfs_common_setup() smb: client: fix possible double free in smb2_set_ea() Thadeu Lima de Souza Cascardo (1): usb: typec: altmode should keep reference to parent Thomas Weißschuh (1): LoongArch: Don't crash in stack_top() for tasks without vDSO Timo Grautstueck (1): lib/Kconfig.debug: fix grammar in RUST_BUILD_ASSERT_ALLOW Toke Høiland-Jørgensen (2): bpf: Make sure internal and UAPI bpf_redirect flags don't overlap bpf: fix kfunc btf caching for modules Tony Ambardar (1): selftests/bpf: Fix cross-compiling urandom_read Tyrone Wu (3): bpf: fix unpopulated name_len field in perf_event link info selftests/bpf: fix perf_event link info name_len assertion bpf: Fix link info netfilter flags to populate defrag flag Vincent Guittot (1): cpufreq/cppc: Move and rename cppc_cpufreq_{perf_to_khz|khz_to_perf}() Vishal Moola (Oracle) (1): mm/khugepaged: convert alloc_charge_hpage() to use folios Vladimir Oltean (1): net/sched: act_api: deny mismatched skip_sw/skip_hw flags for actions created by classifiers Waiman Long (1): sched/core: Disable page allocation in task_tick_mm_cid() Wang Hai (7): net: ethernet: aeroflex: fix potential memory leak in greth_start_xmit_gbit() net: xilinx: axienet: fix potential memory leak in axienet_start_xmit() net: systemport: fix potential memory leak in bcm_sysport_xmit() net: bcmasp: fix potential memory leak in bcmasp_xmit() scsi: target: core: Fix null-ptr-deref in target_alloc_device() net/sun3_82586: fix potential memory leak in sun3_82586_send_packet() be2net: fix potential memory leak in be_xmit() William Butler (1): nvme-pci: set doorbell config before unquiescing Xin Long (1): ipv4: give an IPv4 dev to blackhole_netdev Yang Erkun (1): nfsd: cancel nfsd_shrinker_work using sync mode in nfs4_state_shutdown_net Yang Shi (1): mm: khugepaged: fix the arguments order in khugepaged_collapse_file trace point Ye Bin (1): Bluetooth: bnep: fix wild-memory-access in proto_unregister Yuan Can (1): powercap: dtpm_devfreq: Fix error check against dev_pm_qos_add_request() Yue Haibing (1): btrfs: fix passing 0 to ERR_PTR in btrfs_search_dir_index_item() Zhao Mengmeng (3): udf: refactor udf_current_aext() to handle error udf: refactor udf_next_aext() to handle error udf: refactor inode_bmap() to handle error Zichen Xie (1): ASoC: qcom: Fix NULL Dereference in asoc_qcom_lpass_cpu_platform_probe() liwei (1): cpufreq: CPPC: fix perf_to_khz/khz_to_perf conversion exception

53 minutes

1
1
0 0

Linux 6.1.115

by Greg Kroah-Hartman

I'm announcing the release of the 6.1.115 kernel. All users of the 6.1 kernel series must upgrade. The updated 6.1.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.1.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/devicetree/bindings/sound/davinci-mcasp-audio.yaml | 18 Documentation/networking/driver.rst | 97 ++- Makefile | 2 arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts | 2 arch/arm64/Makefile | 2 arch/arm64/include/asm/uprobes.h | 12 arch/arm64/kernel/probes/uprobes.c | 4 arch/arm64/kvm/arm.c | 3 arch/arm64/kvm/vgic/vgic-init.c | 6 arch/loongarch/Kconfig | 1 arch/loongarch/include/asm/bootinfo.h | 4 arch/loongarch/include/asm/page.h | 1 arch/loongarch/include/asm/vdso/gettimeofday.h | 9 arch/loongarch/include/asm/vdso/vdso.h | 32 + arch/loongarch/kernel/process.c | 16 arch/loongarch/kernel/setup.c | 3 arch/loongarch/kernel/vdso.c | 98 +++ arch/loongarch/vdso/vgetcpu.c | 2 arch/riscv/net/bpf_jit_comp64.c | 4 arch/s390/include/asm/perf_event.h | 1 arch/s390/pci/pci_event.c | 17 arch/x86/kernel/cpu/resctrl/ctrlmondata.c | 23 arch/x86/kvm/svm/nested.c | 6 block/bfq-iosched.c | 37 - drivers/acpi/button.c | 11 drivers/acpi/cppc_acpi.c | 116 ++++ drivers/acpi/prmt.c | 29 - drivers/acpi/resource.c | 7 drivers/cpufreq/cppc_cpufreq.c | 139 ----- drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 15 drivers/gpu/drm/amd/amdgpu/amdgpu_mes.c | 5 drivers/gpu/drm/amd/display/modules/power/power_helpers.c | 2 drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 9 drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_cmd.c | 1 drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c | 3 drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c | 19 drivers/gpu/drm/msm/dsi/dsi_host.c | 2 drivers/gpu/drm/vboxvideo/hgsmi_base.c | 10 drivers/gpu/drm/vboxvideo/vboxvideo.h | 4 drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c | 4 drivers/iio/accel/bma400_core.c | 3 drivers/iio/frequency/Kconfig | 33 - drivers/infiniband/hw/bnxt_re/qplib_fp.h | 2 drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 2 drivers/infiniband/hw/bnxt_re/qplib_res.c | 21 drivers/infiniband/hw/cxgb4/cm.c | 9 drivers/infiniband/hw/irdma/cm.c | 2 drivers/infiniband/ulp/srpt/ib_srpt.c | 80 ++- drivers/irqchip/irq-renesas-rzg2l.c | 94 +++ drivers/net/dsa/mv88e6xxx/port.c | 1 drivers/net/ethernet/aeroflex/greth.c | 3 drivers/net/ethernet/broadcom/bcmsysport.c | 1 drivers/net/ethernet/emulex/benet/be_main.c | 10 drivers/net/ethernet/i825xx/sun3_82586.c | 1 drivers/net/ethernet/marvell/octeon_ep/octep_rx.c | 82 ++- drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 4 drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 138 ++--- drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 5 drivers/net/ethernet/mellanox/mlx5/core/main.c | 15 drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h | 2 drivers/net/ethernet/realtek/r8169_main.c | 4 drivers/net/ethernet/renesas/ravb_main.c | 25 drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 2 drivers/net/hyperv/netvsc_drv.c | 30 + drivers/net/macsec.c | 18 drivers/net/netdevsim/dev.c | 15 drivers/net/phy/dp83822.c | 4 drivers/net/plip/plip.c | 2 drivers/net/usb/usbnet.c | 4 drivers/net/wwan/wwan_core.c | 2 drivers/platform/x86/dell/dell-wmi-base.c | 9 drivers/platform/x86/dell/dell-wmi-sysman/sysman.c | 1 drivers/powercap/dtpm_devfreq.c | 2 drivers/pps/clients/pps-ldisc.c | 6 drivers/target/target_core_device.c | 2 drivers/target/target_core_user.c | 2 drivers/tty/serial/imx.c | 17 drivers/tty/serial/max3100.c | 2 drivers/tty/serial/max310x.c | 3 drivers/tty/serial/serial_core.c | 32 - drivers/tty/serial/sunhv.c | 8 drivers/usb/dwc3/core.c | 19 drivers/usb/dwc3/core.h | 3 drivers/usb/gadget/composite.c | 40 + drivers/usb/gadget/function/f_uac2.c | 13 drivers/usb/host/xhci-caps.h | 85 +++ drivers/usb/host/xhci-dbgcap.h | 2 drivers/usb/host/xhci-dbgtty.c | 73 ++ drivers/usb/host/xhci-port.h | 176 ++++++ drivers/usb/host/xhci.h | 262 ---------- drivers/usb/typec/class.c | 3 fs/btrfs/block-group.c | 2 fs/btrfs/dir-item.c | 4 fs/btrfs/inode.c | 7 fs/exec.c | 21 fs/jfs/jfs_dmap.c | 2 fs/nilfs2/page.c | 6 fs/ntfs3/record.c | 67 ++ fs/open.c | 2 fs/smb/client/smb2pdu.c | 9 fs/udf/inode.c | 49 + fs/udf/truncate.c | 10 fs/udf/udfdecl.h | 5 include/acpi/cppc_acpi.h | 2 include/linux/netdevice.h | 13 include/linux/serial_core.h | 6 include/linux/tty_ldisc.h | 4 include/linux/usb/composite.h | 6 include/linux/usb/gadget.h | 1 include/net/bluetooth/bluetooth.h | 1 include/net/genetlink.h | 3 include/net/netdev_queues.h | 144 +++++ include/net/xfrm.h | 28 - include/uapi/linux/bpf.h | 13 kernel/bpf/btf.c | 1 kernel/bpf/devmap.c | 11 kernel/bpf/ringbuf.c | 12 kernel/bpf/task_iter.c | 2 kernel/bpf/verifier.c | 8 kernel/time/posix-clock.c | 6 kernel/trace/bpf_trace.c | 2 kernel/trace/trace_probe.c | 2 net/bluetooth/af_bluetooth.c | 22 net/bluetooth/bnep/core.c | 3 net/bluetooth/iso.c | 18 net/bluetooth/sco.c | 18 net/core/filter.c | 8 net/ipv4/devinet.c | 35 - net/ipv4/inet_connection_sock.c | 21 net/ipv4/xfrm4_policy.c | 40 - net/ipv6/xfrm6_policy.c | 31 - net/l2tp/l2tp_netlink.c | 4 net/netfilter/xt_NFLOG.c | 2 net/netfilter/xt_TRACE.c | 1 net/netfilter/xt_mark.c | 2 net/netlink/genetlink.c | 28 - net/sched/act_api.c | 23 net/sched/sch_generic.c | 17 net/sched/sch_taprio.c | 3 net/smc/smc_pnet.c | 2 net/wireless/nl80211.c | 8 net/xfrm/xfrm_device.c | 11 net/xfrm/xfrm_policy.c | 50 + net/xfrm/xfrm_user.c | 10 security/selinux/selinuxfs.c | 27 - sound/firewire/amdtp-stream.c | 3 sound/pci/hda/patch_cs8409.c | 5 sound/pci/hda/patch_realtek.c | 48 + sound/soc/codecs/lpass-rx-macro.c | 2 sound/soc/fsl/fsl_sai.c | 5 sound/soc/fsl/fsl_sai.h | 1 sound/soc/qcom/lpass-cpu.c | 2 sound/soc/qcom/sm8250.c | 1 tools/testing/selftests/bpf/Makefile | 2 154 files changed, 1985 insertions(+), 1067 deletions(-) Aleksa Sarai (1): openat2: explicitly return -E2BIG for (usize > PAGE_SIZE) Aleksandr Mishin (2): octeon_ep: Implement helper for iterating packets in Rx queue octeon_ep: Add SKB allocation failures handling in __octep_oq_process_rx() Alexander Zubkov (1): RDMA/irdma: Fix misspelling of "accept*" Alexey Klimov (2): ASoC: codecs: lpass-rx-macro: add missing CDC_RX_BCL_VBAT_RF_PROC2 to default regs values ASoC: qcom: sm8250: add qrb4210-rb2-sndcard compatible string Andrea Parri (1): riscv, bpf: Make BPF_CMPXCHG fully ordered Andrey Shumilin (1): ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() Anumula Murali Mohan Reddy (1): RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP Armin Wolf (1): platform/x86: dell-wmi: Ignore suspend notifications Bart Van Assche (1): RDMA/srpt: Make slab cache names unique Bhargava Chenna Marreddy (1): RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages Christian Heusel (1): ACPI: resource: Add LG 16T90SP to irq1_level_low_skip_override[] Claudiu Beznea (3): irqchip/renesas-rzg2l: Align struct member names to tabs irqchip/renesas-rzg2l: Document structure members irqchip/renesas-rzg2l: Add support for suspend to RAM Colin Ian King (1): octeontx2-af: Fix potential integer overflows on integer shifts Cosmin Ratiu (1): net/mlx5: Unregister notifier on eswitch init failure Crag Wang (1): platform/x86: dell-sysman: add support for alienware products Dan Carpenter (1): ACPI: PRM: Clean up guid type in struct prm_handler_info Dave Kleikamp (1): jfs: Fix sanity check in dbMount Dmitry Antipov (1): net: sched: fix use-after-free in taprio_change() Dmitry Baryshkov (1): drm/msm/dpu: make sure phys resources are properly initialized Douglas Anderson (2): drm/msm: Avoid NULL dereference in msm_disp_state_print_regs() drm/msm: Allocate memory for disp snapshot with kvzalloc() Elson Roy Serrao (1): usb: gadget: Add function wakeup support Eric Dumazet (3): netdevsim: use cond_resched() in nsim_dev_trap_report_work() genetlink: hold RCU in genlmsg_mcast() net: fix races in netdev_tx_sent_queue()/dev_watchdog() Eyal Birger (2): xfrm: extract dst lookup parameters into a struct xfrm: respect ip protocols rules criteria when performing dst lookups Fabrizio Castro (1): irqchip/renesas-rzg2l: Fix missing put_device Florian Kauer (1): bpf: devmap: provide rxq after redirect Florian Klink (1): ARM: dts: bcm2837-rpi-cm3-io3: Fix HDMI hpd-gpio pin Frank Li (1): XHCI: Separate PORT and CAPs macros into dedicated file Gal Pressman (1): ravb: Remove setting of RX software timestamp Gianfranco Trad (1): udf: fix uninit-value use in udf_get_fileshortad Greg Kroah-Hartman (1): Linux 6.1.115 Haiyang Zhang (1): hv_netvsc: Fix VF namespace also in synthetic NIC NETDEV_REGISTER event Hans de Goede (1): drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA Heiko Carstens (1): s390: Initialize psw mask in perf_arch_fetch_caller_regs() Heiner Kallweit (1): r8169: avoid unsolicited interrupts Huacai Chen (1): LoongArch: Get correct cores_per_package for SMT systems Ian Forbes (1): drm/vmwgfx: Handle possible ENOMEM in vmw_stdu_connector_atomic_check Ilpo Järvinen (2): tty/serial: Make ->dcd_change()+uart_handle_dcd_change() status bool active serial: Make uart_handle_cts_change() status param bool active Jakub Boehm (1): net: plip: fix break; causing plip to never transmit Jakub Kicinski (2): docs: net: reformat driver.rst from a list to sections net: provide macros for commonly copied lockless queue stop/wake code Javier Carrasco (2): iio: frequency: {admv4420,adrf6780}: format Kconfig entries iio: frequency: admv4420: fix missing select REMAP_SPI in Kconfig Jessica Zhang (1): drm/msm/dpu: don't always program merge_3d block Jinjie Ruan (1): posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime() Jiri Olsa (2): bpf: Fix memory leak in bpf_core_apply bpf,perf: Fix perf_event_detach_bpf_prog error handling Jiri Slaby (SUSE) (3): xhci: dbgtty: remove kfifo_out() wrapper xhci: dbgtty: use kfifo from tty_port struct serial: protect uart_port_dtr_rts() in uart_shutdown() too John Keeping (1): usb: gadget: f_uac2: fix non-newline-terminated function name Jonathan Marek (1): drm/msm/dsi: fix 32-bit signed integer extension in pclk_rate calculation Jordan Rome (1): bpf: Fix iter/task tid filtering José Relvas (1): ALSA: hda/realtek: Add subwoofer quirk for Acer Predator G9-593 Kailang Yang (1): ALSA: hda/realtek: Update default depop procedure Kalesh AP (2): RDMA/bnxt_re: Add a check for memory allocation RDMA/bnxt_re: Return more meaningful error Kevin Groeneveld (1): usb: gadget: f_uac2: fix return value for UAC2_ATTRIBUTE_STRING store Koba Ko (1): ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context Konstantin Komarov (1): fs/ntfs3: Add more attributes checks in mi_enum_attr() Kuniyuki Iwashima (1): tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). Lee Jones (1): usb: gadget: f_uac2: Replace snprintf() with the safer scnprintf() variant Leo Yan (1): tracing: Consider the NULL character when validating the event length Li RongQing (1): net/smc: Fix searching in list of known pnetids in smc_pnet_add_pnetid Lin Ma (1): net: wwan: fix global oob in wwan_rtnl_policy Luiz Augusto von Dentz (2): Bluetooth: SCO: Fix UAF on sco_sock_timeout Bluetooth: ISO: Fix UAF on iso_sock_timeout Marc Zyngier (1): KVM: arm64: Don't eagerly teardown the vgic on init error Marek Vasut (1): serial: imx: Update mctrl old_status on RTSD interrupt Marijn Suijten (1): drm/msm/dpu: Wire up DSC mask for active CTL configuration Mario Limonciello (2): drm/amd: Guard against bad data for ATIF ACPI method drm/amd/display: Disable PSR-SU on Parade 08-01 TCON too Mark Rutland (2): arm64: probes: Fix uprobes for big-endian kernels arm64: Force position-independent veneers Martin Kletzander (1): x86/resctrl: Avoid overflow in MB settings in bw_validate() Mateusz Guzik (1): exec: don't WARN for racy path_noexec check Mathias Nyman (1): xhci: dbc: honor usb transfer size boundaries. Michel Alex (1): net: phy: dp83822: Fix reset pin definitions Mikhail Lobanov (1): iio: accel: bma400: Fix uninitialized variable field_value in tap event handling. Miquel Raynal (2): ASoC: dt-bindings: davinci-mcasp: Fix interrupts property ASoC: dt-bindings: davinci-mcasp: Fix interrupt properties Murad Masimov (1): ALSA: hda/cs8409: Fix possible NULL dereference Naohiro Aota (1): btrfs: zoned: fix zone unusable accounting for freed reserved extent Niklas Schnelle (1): s390/pci: Handle PCI error codes other than 0x3a Niklas Söderlund (1): net: ravb: Only advertise Rx/Tx timestamps if hardware supports it Oliver Neukum (2): net: usb: usbnet: fix race in probe failure net: usb: usbnet: fix name regression Pablo Neira Ayuso (1): netfilter: xtables: fix typo causing some targets not to load on IPv6 Paul Moore (1): selinux: improve error checking in sel_write_load() Paulo Alcantara (1): smb: client: fix OOBs when building SMB2_IOCTL request Peter Rashleigh (1): net: dsa: mv88e6xxx: Fix error when setting port policy on mv88e6393x Petr Vaganov (1): xfrm: fix one more kernel-infoleak in algo dumping Praveen Kumar Kannoju (1): net/sched: adjust device watchdog timer to detect stopped queue at right time Roger Quadros (1): usb: dwc3: core: Fix system suspend on TI AM62 platforms Ryusuke Konishi (1): nilfs2: fix kernel bug due to missing clearing of buffer delay flag Sabrina Dubroca (2): macsec: don't increment counters for an unrelated SA xfrm: validate new SA's prefixlen using SA family when sel.family is unset Saravanan Vajravel (1): RDMA/bnxt_re: Fix incorrect AVID type in WQE structure Sean Christopherson (1): KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory Shay Drory (3): net/mlx5: Remove redundant cmdif revision check net/mlx5: split mlx5_cmd_init() to probe and reload routines net/mlx5: Fix command bitmask initialization Shengjiu Wang (1): ASoC: fsl_sai: Enable 'FIFO continue on error' FCONT bit Shubham Panwar (1): ACPI: button: Add DMI quirk for Samsung Galaxy Book2 to fix initial lid detection issue Srinivasan Shanmugam (1): drm/amd/amdgpu: Fix double unlock in amdgpu_mes_add_ring Thadeu Lima de Souza Cascardo (1): usb: typec: altmode should keep reference to parent Thomas Weißschuh (1): LoongArch: Don't crash in stack_top() for tasks without vDSO Tiezhu Yang (1): LoongArch: Add support to clone a time namespace Toke Høiland-Jørgensen (2): bpf: Make sure internal and UAPI bpf_redirect flags don't overlap bpf: fix kfunc btf caching for modules Tony Ambardar (1): selftests/bpf: Fix cross-compiling urandom_read Vincent Guittot (1): cpufreq/cppc: Move and rename cppc_cpufreq_{perf_to_khz|khz_to_perf}() Vladimir Oltean (1): net/sched: act_api: deny mismatched skip_sw/skip_hw flags for actions created by classifiers Wander Lairson Costa (1): bpf: Use raw_spinlock_t in ringbuf Wang Hai (6): net: ethernet: aeroflex: fix potential memory leak in greth_start_xmit_gbit() net: xilinx: axienet: fix potential memory leak in axienet_start_xmit() net: systemport: fix potential memory leak in bcm_sysport_xmit() scsi: target: core: Fix null-ptr-deref in target_alloc_device() net/sun3_82586: fix potential memory leak in sun3_82586_send_packet() be2net: fix potential memory leak in be_xmit() Xin Long (1): ipv4: give an IPv4 dev to blackhole_netdev Ye Bin (1): Bluetooth: bnep: fix wild-memory-access in proto_unregister Yu Kuai (1): block, bfq: fix procress reference leakage for bfqq in merge chain Yuan Can (1): powercap: dtpm_devfreq: Fix error check against dev_pm_qos_add_request() Yue Haibing (1): btrfs: fix passing 0 to ERR_PTR in btrfs_search_dir_index_item() Zhao Mengmeng (1): udf: refactor udf_current_aext() to handle error Zichen Xie (1): ASoC: qcom: Fix NULL Dereference in asoc_qcom_lpass_cpu_platform_probe() junhua huang (2): arm64:uprobe fix the uprobe SWBP_INSN in big-endian arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning liwei (1): cpufreq: CPPC: fix perf_to_khz/khz_to_perf conversion exception

53 minutes

1
1
0 0

Linux 5.15.170

by Greg Kroah-Hartman

I'm announcing the release of the 5.15.170 kernel. All users of the 5.15 kernel series must upgrade. The updated 5.15.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.15.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts | 2 arch/arm64/Makefile | 2 arch/arm64/include/asm/uprobes.h | 12 arch/arm64/kernel/probes/uprobes.c | 4 arch/s390/include/asm/perf_event.h | 1 arch/s390/kvm/gaccess.c | 162 +++++++----- arch/s390/kvm/gaccess.h | 14 - arch/x86/kernel/cpu/resctrl/ctrlmondata.c | 23 + arch/x86/kvm/svm/nested.c | 6 block/bfq-iosched.c | 37 +- drivers/acpi/button.c | 11 drivers/acpi/resource.c | 7 drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 15 - drivers/gpu/drm/msm/disp/msm_disp_snapshot_util.c | 19 - drivers/gpu/drm/msm/dsi/dsi_host.c | 2 drivers/gpu/drm/vboxvideo/hgsmi_base.c | 10 drivers/gpu/drm/vboxvideo/vboxvideo.h | 4 drivers/infiniband/hw/bnxt_re/qplib_fp.h | 2 drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 2 drivers/infiniband/hw/bnxt_re/qplib_res.c | 21 - drivers/infiniband/hw/cxgb4/cm.c | 9 drivers/infiniband/hw/irdma/cm.c | 2 drivers/net/dsa/mv88e6xxx/port.c | 1 drivers/net/ethernet/aeroflex/greth.c | 3 drivers/net/ethernet/broadcom/bcmsysport.c | 1 drivers/net/ethernet/emulex/benet/be_main.c | 10 drivers/net/ethernet/i825xx/sun3_82586.c | 1 drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 4 drivers/net/ethernet/realtek/r8169_main.c | 4 drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 2 drivers/net/hyperv/netvsc_drv.c | 30 ++ drivers/net/macsec.c | 18 - drivers/net/phy/dp83822.c | 4 drivers/net/plip/plip.c | 2 drivers/net/usb/usbnet.c | 4 drivers/net/wwan/wwan_core.c | 2 drivers/platform/x86/dell/dell-wmi-base.c | 9 drivers/platform/x86/dell/dell-wmi-sysman/sysman.c | 1 drivers/target/target_core_device.c | 2 drivers/target/target_core_user.c | 2 drivers/tty/serial/serial_core.c | 16 - drivers/usb/dwc3/core.c | 19 + drivers/usb/dwc3/core.h | 3 drivers/usb/gadget/composite.c | 40 +++ drivers/usb/host/xhci-caps.h | 85 ++++++ drivers/usb/host/xhci-port.h | 176 +++++++++++++ drivers/usb/host/xhci.h | 262 -------------------- drivers/usb/typec/class.c | 3 fs/btrfs/block-group.c | 2 fs/cifs/smb2pdu.c | 9 fs/exec.c | 21 - fs/jfs/jfs_dmap.c | 2 fs/nilfs2/page.c | 6 fs/open.c | 2 fs/udf/inode.c | 9 include/linux/usb/composite.h | 6 include/linux/usb/gadget.h | 1 include/net/genetlink.h | 3 include/net/xfrm.h | 28 +- include/uapi/linux/bpf.h | 13 kernel/bpf/devmap.c | 11 kernel/time/posix-clock.c | 6 kernel/trace/bpf_trace.c | 2 kernel/trace/trace_probe.c | 2 net/bluetooth/bnep/core.c | 3 net/core/filter.c | 8 net/ipv4/devinet.c | 35 +- net/ipv4/inet_connection_sock.c | 21 + net/ipv4/xfrm4_policy.c | 40 +-- net/ipv6/xfrm6_policy.c | 31 +- net/l2tp/l2tp_netlink.c | 4 net/netfilter/xt_NFLOG.c | 2 net/netfilter/xt_TRACE.c | 1 net/netfilter/xt_mark.c | 2 net/netlink/genetlink.c | 28 +- net/sched/sch_taprio.c | 3 net/smc/smc_pnet.c | 2 net/wireless/nl80211.c | 8 net/xfrm/xfrm_device.c | 11 net/xfrm/xfrm_policy.c | 50 ++- net/xfrm/xfrm_user.c | 10 security/selinux/selinuxfs.c | 27 +- sound/firewire/amdtp-stream.c | 3 sound/pci/hda/patch_cs8409.c | 5 sound/pci/hda/patch_realtek.c | 48 ++- sound/soc/codecs/lpass-rx-macro.c | 2 sound/soc/fsl/fsl_sai.c | 5 sound/soc/fsl/fsl_sai.h | 1 sound/soc/qcom/lpass-cpu.c | 2 sound/soc/qcom/sm8250.c | 1 91 files changed, 905 insertions(+), 644 deletions(-) Aleksa Sarai (1): openat2: explicitly return -E2BIG for (usize > PAGE_SIZE) Alexander Zubkov (1): RDMA/irdma: Fix misspelling of "accept*" Alexey Klimov (2): ASoC: codecs: lpass-rx-macro: add missing CDC_RX_BCL_VBAT_RF_PROC2 to default regs values ASoC: qcom: sm8250: add qrb4210-rb2-sndcard compatible string Andrey Shumilin (1): ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() Anumula Murali Mohan Reddy (1): RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP Armin Wolf (1): platform/x86: dell-wmi: Ignore suspend notifications Bhargava Chenna Marreddy (1): RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages Christian Heusel (1): ACPI: resource: Add LG 16T90SP to irq1_level_low_skip_override[] Colin Ian King (1): octeontx2-af: Fix potential integer overflows on integer shifts Crag Wang (1): platform/x86: dell-sysman: add support for alienware products Dave Kleikamp (1): jfs: Fix sanity check in dbMount Dmitry Antipov (1): net: sched: fix use-after-free in taprio_change() Douglas Anderson (2): drm/msm: Avoid NULL dereference in msm_disp_state_print_regs() drm/msm: Allocate memory for disp snapshot with kvzalloc() Elson Roy Serrao (1): usb: gadget: Add function wakeup support Eric Dumazet (1): genetlink: hold RCU in genlmsg_mcast() Eyal Birger (2): xfrm: extract dst lookup parameters into a struct xfrm: respect ip protocols rules criteria when performing dst lookups Florian Kauer (1): bpf: devmap: provide rxq after redirect Florian Klink (1): ARM: dts: bcm2837-rpi-cm3-io3: Fix HDMI hpd-gpio pin Frank Li (1): XHCI: Separate PORT and CAPs macros into dedicated file Gianfranco Trad (1): udf: fix uninit-value use in udf_get_fileshortad Greg Kroah-Hartman (1): Linux 5.15.170 Haiyang Zhang (1): hv_netvsc: Fix VF namespace also in synthetic NIC NETDEV_REGISTER event Hans de Goede (1): drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA Heiko Carstens (1): s390: Initialize psw mask in perf_arch_fetch_caller_regs() Heiner Kallweit (1): r8169: avoid unsolicited interrupts Jakub Boehm (1): net: plip: fix break; causing plip to never transmit Janis Schoetterl-Glausch (3): KVM: s390: gaccess: Refactor gpa and length calculation KVM: s390: gaccess: Refactor access address range check KVM: s390: gaccess: Cleanup access to guest pages Jinjie Ruan (1): posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime() Jiri Olsa (1): bpf,perf: Fix perf_event_detach_bpf_prog error handling Jiri Slaby (SUSE) (1): serial: protect uart_port_dtr_rts() in uart_shutdown() too Jonathan Marek (1): drm/msm/dsi: fix 32-bit signed integer extension in pclk_rate calculation José Relvas (1): ALSA: hda/realtek: Add subwoofer quirk for Acer Predator G9-593 Kailang Yang (1): ALSA: hda/realtek: Update default depop procedure Kalesh AP (2): RDMA/bnxt_re: Add a check for memory allocation RDMA/bnxt_re: Return more meaningful error Kuniyuki Iwashima (1): tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). Leo Yan (1): tracing: Consider the NULL character when validating the event length Li RongQing (1): net/smc: Fix searching in list of known pnetids in smc_pnet_add_pnetid Lin Ma (1): net: wwan: fix global oob in wwan_rtnl_policy Mario Limonciello (1): drm/amd: Guard against bad data for ATIF ACPI method Mark Rutland (2): arm64: probes: Fix uprobes for big-endian kernels arm64: Force position-independent veneers Martin Kletzander (1): x86/resctrl: Avoid overflow in MB settings in bw_validate() Mateusz Guzik (1): exec: don't WARN for racy path_noexec check Michel Alex (1): net: phy: dp83822: Fix reset pin definitions Murad Masimov (1): ALSA: hda/cs8409: Fix possible NULL dereference Naohiro Aota (1): btrfs: zoned: fix zone unusable accounting for freed reserved extent Nico Boehr (1): KVM: s390: gaccess: Check if guest address is in memslot Oliver Neukum (2): net: usb: usbnet: fix race in probe failure net: usb: usbnet: fix name regression Pablo Neira Ayuso (1): netfilter: xtables: fix typo causing some targets not to load on IPv6 Paul Moore (1): selinux: improve error checking in sel_write_load() Paulo Alcantara (1): smb: client: fix OOBs when building SMB2_IOCTL request Peter Rashleigh (1): net: dsa: mv88e6xxx: Fix error when setting port policy on mv88e6393x Petr Vaganov (1): xfrm: fix one more kernel-infoleak in algo dumping Roger Quadros (1): usb: dwc3: core: Fix system suspend on TI AM62 platforms Ryusuke Konishi (1): nilfs2: fix kernel bug due to missing clearing of buffer delay flag Sabrina Dubroca (2): macsec: don't increment counters for an unrelated SA xfrm: validate new SA's prefixlen using SA family when sel.family is unset Saravanan Vajravel (1): RDMA/bnxt_re: Fix incorrect AVID type in WQE structure Sean Christopherson (1): KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory Shengjiu Wang (1): ASoC: fsl_sai: Enable 'FIFO continue on error' FCONT bit Shubham Panwar (1): ACPI: button: Add DMI quirk for Samsung Galaxy Book2 to fix initial lid detection issue Thadeu Lima de Souza Cascardo (1): usb: typec: altmode should keep reference to parent Toke Høiland-Jørgensen (1): bpf: Make sure internal and UAPI bpf_redirect flags don't overlap Wang Hai (6): net: ethernet: aeroflex: fix potential memory leak in greth_start_xmit_gbit() net: xilinx: axienet: fix potential memory leak in axienet_start_xmit() net: systemport: fix potential memory leak in bcm_sysport_xmit() scsi: target: core: Fix null-ptr-deref in target_alloc_device() net/sun3_82586: fix potential memory leak in sun3_82586_send_packet() be2net: fix potential memory leak in be_xmit() Xin Long (1): ipv4: give an IPv4 dev to blackhole_netdev Ye Bin (1): Bluetooth: bnep: fix wild-memory-access in proto_unregister Yu Kuai (1): block, bfq: fix procress reference leakage for bfqq in merge chain Zichen Xie (1): ASoC: qcom: Fix NULL Dereference in asoc_qcom_lpass_cpu_platform_probe() junhua huang (2): arm64:uprobe fix the uprobe SWBP_INSN in big-endian arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning

53 minutes

1
1
0 0

+ mm-damon-core-avoid-overflow-in-damon_feed_loop_next_input.patch added to mm-hotfixes-unstable branch

by Andrew Morton

The patch titled Subject: mm/damon/core: avoid overflow in damon_feed_loop_next_input() has been added to the -mm mm-hotfixes-unstable branch. Its filename is mm-damon-core-avoid-overflow-in-damon_feed_loop_next_input.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-hotfixes-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via the mm-everything branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there every 2-3 working days ------------------------------------------------------ From: SeongJae Park <sj(a)kernel.org> Subject: mm/damon/core: avoid overflow in damon_feed_loop_next_input() Date: Thu, 31 Oct 2024 09:12:03 -0700 damon_feed_loop_next_input() is inefficient and fragile to overflows. Specifically, 'score_goal_diff_bp' calculation can overflow when 'score' is high. The calculation is actually unnecessary at all because 'goal' is a constant of value 10,000. Calculation of 'compensation' is again fragile to overflow. Final calculation of return value for under-achiving case is again fragile to overflow when the current score is under-achieving the target. Add two corner cases handling at the beginning of the function to make the body easier to read, and rewrite the body of the function to avoid overflows and the unnecessary bp value calcuation. Link: https://lkml.kernel.org/r/20241031161203.47751-1-sj@kernel.org Fixes: 9294a037c015 ("mm/damon/core: implement goal-oriented feedback-driven quota auto-tuning") Signed-off-by: SeongJae Park <sj(a)kernel.org> Reported-by: Guenter Roeck <linux(a)roeck-us.net> Closes: https://lore.kernel.org/944f3d5b-9177-48e7-8ec9-7f1331a3fea3@roeck-us.net Tested-by: Guenter Roeck <linux(a)roeck-us.net> Cc: <stable(a)vger.kernel.org> [6.8.x] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/damon/core.c | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-) --- a/mm/damon/core.c~mm-damon-core-avoid-overflow-in-damon_feed_loop_next_input +++ a/mm/damon/core.c @@ -1456,17 +1456,31 @@ static unsigned long damon_feed_loop_nex unsigned long score) { const unsigned long goal = 10000; - unsigned long score_goal_diff = max(goal, score) - min(goal, score); - unsigned long score_goal_diff_bp = score_goal_diff * 10000 / goal; - unsigned long compensation = last_input * score_goal_diff_bp / 10000; /* Set minimum input as 10000 to avoid compensation be zero */ const unsigned long min_input = 10000; + unsigned long score_goal_diff, compensation; + bool over_achieving = score > goal; - if (goal > score) + if (score == goal) + return last_input; + if (score >= goal * 2) + return min_input; + + if (over_achieving) + score_goal_diff = score - goal; + else + score_goal_diff = goal - score; + + if (last_input < ULONG_MAX / score_goal_diff) + compensation = last_input * score_goal_diff / goal; + else + compensation = last_input / goal * score_goal_diff; + + if (over_achieving) + return max(last_input - compensation, min_input); + if (last_input < ULONG_MAX - compensation) return last_input + compensation; - if (last_input > compensation + min_input) - return last_input - compensation; - return min_input; + return ULONG_MAX; } #ifdef CONFIG_PSI _ Patches currently in -mm which might be from sj(a)kernel.org are mm-damon-core-handle-zero-aggregationops_update-intervals.patch mm-damon-core-handle-zero-schemes-apply-interval.patch mm-damon-core-avoid-overflow-in-damon_feed_loop_next_input.patch selftests-damon-huge_count_read_write-remove-unnecessary-debugging-message.patch selftests-damon-_debugfs_common-hide-expected-error-message-from-test_write_result.patch selftests-damon-debugfs_duplicate_context_creation-hide-errors-from-expected-file-write-failures.patch mm-damon-kconfig-update-dbgfs_kunit-prompt-copy-for-sysfs_kunit.patch mm-damon-tests-dbgfs-kunit-fix-the-header-double-inclusion-guarding-ifdef-comment.patch

1 hour, 9 minutes

1
0
0 0

+ mm-multi-gen-lru-use-pteppmdp_clear_young_notify.patch added to mm-hotfixes-unstable branch

by Andrew Morton

The patch titled Subject: mm: multi-gen LRU: use {ptep,pmdp}_clear_young_notify() has been added to the -mm mm-hotfixes-unstable branch. Its filename is mm-multi-gen-lru-use-pteppmdp_clear_young_notify.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-hotfixes-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via the mm-everything branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there every 2-3 working days ------------------------------------------------------ From: Yu Zhao <yuzhao(a)google.com> Subject: mm: multi-gen LRU: use {ptep,pmdp}_clear_young_notify() Date: Sat, 19 Oct 2024 01:29:39 +0000 When the MM_WALK capability is enabled, memory that is mostly accessed by a VM appears younger than it really is, therefore this memory will be less likely to be evicted. Therefore, the presence of a running VM can significantly increase swap-outs for non-VM memory, regressing the performance for the rest of the system. Fix this regression by always calling {ptep,pmdp}_clear_young_notify() whenever we clear the young bits on PMDs/PTEs. Link: https://lkml.kernel.org/r/20241019012940.3656292-3-jthoughton@google.com Fixes: bd74fdaea146 ("mm: multi-gen LRU: support page table walks") Signed-off-by: Yu Zhao <yuzhao(a)google.com> Signed-off-by: James Houghton <jthoughton(a)google.com> Reported-by: David Stevens <stevensd(a)google.com> Cc: Axel Rasmussen <axelrasmussen(a)google.com> Cc: David Matlack <dmatlack(a)google.com> Cc: David Rientjes <rientjes(a)google.com> Cc: Oliver Upton <oliver.upton(a)linux.dev> Cc: Paolo Bonzini <pbonzini(a)redhat.com> Cc: Sean Christopherson <seanjc(a)google.com> Cc: Wei Xu <weixugc(a)google.com> Cc: <stable(a)vger.kernel.org> Cc: kernel test robot <lkp(a)intel.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- include/linux/mmzone.h | 5 +- mm/rmap.c | 9 +-- mm/vmscan.c | 91 +++++++++++++++++++++------------------ 3 files changed, 55 insertions(+), 50 deletions(-) --- a/include/linux/mmzone.h~mm-multi-gen-lru-use-pteppmdp_clear_young_notify +++ a/include/linux/mmzone.h @@ -555,7 +555,7 @@ struct lru_gen_memcg { void lru_gen_init_pgdat(struct pglist_data *pgdat); void lru_gen_init_lruvec(struct lruvec *lruvec); -void lru_gen_look_around(struct page_vma_mapped_walk *pvmw); +bool lru_gen_look_around(struct page_vma_mapped_walk *pvmw); void lru_gen_init_memcg(struct mem_cgroup *memcg); void lru_gen_exit_memcg(struct mem_cgroup *memcg); @@ -574,8 +574,9 @@ static inline void lru_gen_init_lruvec(s { } -static inline void lru_gen_look_around(struct page_vma_mapped_walk *pvmw) +static inline bool lru_gen_look_around(struct page_vma_mapped_walk *pvmw) { + return false; } static inline void lru_gen_init_memcg(struct mem_cgroup *memcg) --- a/mm/rmap.c~mm-multi-gen-lru-use-pteppmdp_clear_young_notify +++ a/mm/rmap.c @@ -885,13 +885,10 @@ static bool folio_referenced_one(struct return false; } - if (pvmw.pte) { - if (lru_gen_enabled() && - pte_young(ptep_get(pvmw.pte))) { - lru_gen_look_around(&pvmw); + if (lru_gen_enabled() && pvmw.pte) { + if (lru_gen_look_around(&pvmw)) referenced++; - } - + } else if (pvmw.pte) { if (ptep_clear_flush_young_notify(vma, address, pvmw.pte)) referenced++; --- a/mm/vmscan.c~mm-multi-gen-lru-use-pteppmdp_clear_young_notify +++ a/mm/vmscan.c @@ -56,6 +56,7 @@ #include <linux/khugepaged.h> #include <linux/rculist_nulls.h> #include <linux/random.h> +#include <linux/mmu_notifier.h> #include <asm/tlbflush.h> #include <asm/div64.h> @@ -3294,7 +3295,8 @@ static bool get_next_vma(unsigned long m return false; } -static unsigned long get_pte_pfn(pte_t pte, struct vm_area_struct *vma, unsigned long addr) +static unsigned long get_pte_pfn(pte_t pte, struct vm_area_struct *vma, unsigned long addr, + struct pglist_data *pgdat) { unsigned long pfn = pte_pfn(pte); @@ -3306,13 +3308,20 @@ static unsigned long get_pte_pfn(pte_t p if (WARN_ON_ONCE(pte_devmap(pte) || pte_special(pte))) return -1; + if (!pte_young(pte) && !mm_has_notifiers(vma->vm_mm)) + return -1; + if (WARN_ON_ONCE(!pfn_valid(pfn))) return -1; + if (pfn < pgdat->node_start_pfn || pfn >= pgdat_end_pfn(pgdat)) + return -1; + return pfn; } -static unsigned long get_pmd_pfn(pmd_t pmd, struct vm_area_struct *vma, unsigned long addr) +static unsigned long get_pmd_pfn(pmd_t pmd, struct vm_area_struct *vma, unsigned long addr, + struct pglist_data *pgdat) { unsigned long pfn = pmd_pfn(pmd); @@ -3324,9 +3333,15 @@ static unsigned long get_pmd_pfn(pmd_t p if (WARN_ON_ONCE(pmd_devmap(pmd))) return -1; + if (!pmd_young(pmd) && !mm_has_notifiers(vma->vm_mm)) + return -1; + if (WARN_ON_ONCE(!pfn_valid(pfn))) return -1; + if (pfn < pgdat->node_start_pfn || pfn >= pgdat_end_pfn(pgdat)) + return -1; + return pfn; } @@ -3335,10 +3350,6 @@ static struct folio *get_pfn_folio(unsig { struct folio *folio; - /* try to avoid unnecessary memory loads */ - if (pfn < pgdat->node_start_pfn || pfn >= pgdat_end_pfn(pgdat)) - return NULL; - folio = pfn_folio(pfn); if (folio_nid(folio) != pgdat->node_id) return NULL; @@ -3394,20 +3405,16 @@ restart: total++; walk->mm_stats[MM_LEAF_TOTAL]++; - pfn = get_pte_pfn(ptent, args->vma, addr); + pfn = get_pte_pfn(ptent, args->vma, addr, pgdat); if (pfn == -1) continue; - if (!pte_young(ptent)) { - continue; - } - folio = get_pfn_folio(pfn, memcg, pgdat, walk->can_swap); if (!folio) continue; - if (!ptep_test_and_clear_young(args->vma, addr, pte + i)) - VM_WARN_ON_ONCE(true); + if (!ptep_clear_young_notify(args->vma, addr, pte + i)) + continue; young++; walk->mm_stats[MM_LEAF_YOUNG]++; @@ -3473,21 +3480,22 @@ static void walk_pmd_range_locked(pud_t /* don't round down the first address */ addr = i ? (*first & PMD_MASK) + i * PMD_SIZE : *first; - pfn = get_pmd_pfn(pmd[i], vma, addr); - if (pfn == -1) - goto next; - - if (!pmd_trans_huge(pmd[i])) { - if (!walk->force_scan && should_clear_pmd_young()) + if (pmd_present(pmd[i]) && !pmd_trans_huge(pmd[i])) { + if (!walk->force_scan && should_clear_pmd_young() && + !mm_has_notifiers(args->mm)) pmdp_test_and_clear_young(vma, addr, pmd + i); goto next; } + pfn = get_pmd_pfn(pmd[i], vma, addr, pgdat); + if (pfn == -1) + goto next; + folio = get_pfn_folio(pfn, memcg, pgdat, walk->can_swap); if (!folio) goto next; - if (!pmdp_test_and_clear_young(vma, addr, pmd + i)) + if (!pmdp_clear_young_notify(vma, addr, pmd + i)) goto next; walk->mm_stats[MM_LEAF_YOUNG]++; @@ -3545,24 +3553,18 @@ restart: } if (pmd_trans_huge(val)) { - unsigned long pfn = pmd_pfn(val); struct pglist_data *pgdat = lruvec_pgdat(walk->lruvec); + unsigned long pfn = get_pmd_pfn(val, vma, addr, pgdat); walk->mm_stats[MM_LEAF_TOTAL]++; - if (!pmd_young(val)) { - continue; - } - - /* try to avoid unnecessary memory loads */ - if (pfn < pgdat->node_start_pfn || pfn >= pgdat_end_pfn(pgdat)) - continue; - - walk_pmd_range_locked(pud, addr, vma, args, bitmap, &first); + if (pfn != -1) + walk_pmd_range_locked(pud, addr, vma, args, bitmap, &first); continue; } - if (!walk->force_scan && should_clear_pmd_young()) { + if (!walk->force_scan && should_clear_pmd_young() && + !mm_has_notifiers(args->mm)) { if (!pmd_young(val)) continue; @@ -4036,13 +4038,13 @@ static void lru_gen_age_node(struct pgli * the PTE table to the Bloom filter. This forms a feedback loop between the * eviction and the aging. */ -void lru_gen_look_around(struct page_vma_mapped_walk *pvmw) +bool lru_gen_look_around(struct page_vma_mapped_walk *pvmw) { int i; unsigned long start; unsigned long end; struct lru_gen_mm_walk *walk; - int young = 0; + int young = 1; pte_t *pte = pvmw->pte; unsigned long addr = pvmw->address; struct vm_area_struct *vma = pvmw->vma; @@ -4058,12 +4060,15 @@ void lru_gen_look_around(struct page_vma lockdep_assert_held(pvmw->ptl); VM_WARN_ON_ONCE_FOLIO(folio_test_lru(folio), folio); + if (!ptep_clear_young_notify(vma, addr, pte)) + return false; + if (spin_is_contended(pvmw->ptl)) - return; + return true; /* exclude special VMAs containing anon pages from COW */ if (vma->vm_flags & VM_SPECIAL) - return; + return true; /* avoid taking the LRU lock under the PTL when possible */ walk = current->reclaim_state ? current->reclaim_state->mm_walk : NULL; @@ -4071,6 +4076,9 @@ void lru_gen_look_around(struct page_vma start = max(addr & PMD_MASK, vma->vm_start); end = min(addr | ~PMD_MASK, vma->vm_end - 1) + 1; + if (end - start == PAGE_SIZE) + return true; + if (end - start > MIN_LRU_BATCH * PAGE_SIZE) { if (addr - start < MIN_LRU_BATCH * PAGE_SIZE / 2) end = start + MIN_LRU_BATCH * PAGE_SIZE; @@ -4084,7 +4092,7 @@ void lru_gen_look_around(struct page_vma /* folio_update_gen() requires stable folio_memcg() */ if (!mem_cgroup_trylock_pages(memcg)) - return; + return true; arch_enter_lazy_mmu_mode(); @@ -4094,19 +4102,16 @@ void lru_gen_look_around(struct page_vma unsigned long pfn; pte_t ptent = ptep_get(pte + i); - pfn = get_pte_pfn(ptent, vma, addr); + pfn = get_pte_pfn(ptent, vma, addr, pgdat); if (pfn == -1) continue; - if (!pte_young(ptent)) - continue; - folio = get_pfn_folio(pfn, memcg, pgdat, can_swap); if (!folio) continue; - if (!ptep_test_and_clear_young(vma, addr, pte + i)) - VM_WARN_ON_ONCE(true); + if (!ptep_clear_young_notify(vma, addr, pte + i)) + continue; young++; @@ -4136,6 +4141,8 @@ void lru_gen_look_around(struct page_vma /* feedback from rmap walkers to page table walkers */ if (mm_state && suitable_to_scan(i, young)) update_bloom_filter(mm_state, max_seq, pvmw->pmd); + + return true; } /****************************************************************************** _ Patches currently in -mm which might be from yuzhao(a)google.com are mm-multi-gen-lru-remove-mm_leaf_old-and-mm_nonleaf_total-stats.patch mm-multi-gen-lru-use-pteppmdp_clear_young_notify.patch mm-page_alloc-keep-track-of-free-highatomic.patch

1 hour, 10 minutes

1
0
0 0

+ mm-multi-gen-lru-remove-mm_leaf_old-and-mm_nonleaf_total-stats.patch added to mm-hotfixes-unstable branch

by Andrew Morton

The patch titled Subject: mm: multi-gen LRU: remove MM_LEAF_OLD and MM_NONLEAF_TOTAL stats has been added to the -mm mm-hotfixes-unstable branch. Its filename is mm-multi-gen-lru-remove-mm_leaf_old-and-mm_nonleaf_total-stats.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-hotfixes-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via the mm-everything branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there every 2-3 working days ------------------------------------------------------ From: Yu Zhao <yuzhao(a)google.com> Subject: mm: multi-gen LRU: remove MM_LEAF_OLD and MM_NONLEAF_TOTAL stats Date: Sat, 19 Oct 2024 01:29:38 +0000 Patch series "mm: multi-gen LRU: Have secondary MMUs participate in MM_WALK". Today, the MM_WALK capability causes MGLRU to clear the young bit from PMDs and PTEs during the page table walk before eviction, but MGLRU does not call the clear_young() MMU notifier in this case. By not calling this notifier, the MM walk takes less time/CPU, but it causes pages that are accessed mostly through KVM / secondary MMUs to appear younger than they should be. We do call the clear_young() notifier today, but only when attempting to evict the page, so we end up clearing young/accessed information less frequently for secondary MMUs than for mm PTEs, and therefore they appear younger and are less likely to be evicted. Therefore, memory that is *not* being accessed mostly by KVM will be evicted *more* frequently, worsening performance. ChromeOS observed a tab-open latency regression when enabling MGLRU with a setup that involved running a VM: Tab-open latency histogram (ms) Version p50 mean p95 p99 max base 1315 1198 2347 3454 10319 mglru 2559 1311 7399 12060 43758 fix 1119 926 2470 4211 6947 This series replaces the final non-selftest patchs from this series[1], which introduced a similar change (and a new MMU notifier) with KVM optimizations. I'll send a separate series (to Sean and Paolo) for the KVM optimizations. This series also makes proactive reclaim with MGLRU possible for KVM memory. I have verified that this functions correctly with the selftest from [1], but given that that test is a KVM selftest, I'll send it with the rest of the KVM optimizations later. Andrew, let me know if you'd like to take the test now anyway. [1]: https://lore.kernel.org/linux-mm/20240926013506.860253-18-jthoughton@google… This patch (of 2): The removed stats, MM_LEAF_OLD and MM_NONLEAF_TOTAL, are not very helpful and become more complicated to properly compute when adding test/clear_young() notifiers in MGLRU's mm walk. Link: https://lkml.kernel.org/r/20241019012940.3656292-1-jthoughton@google.com Link: https://lkml.kernel.org/r/20241019012940.3656292-2-jthoughton@google.com Fixes: bd74fdaea146 ("mm: multi-gen LRU: support page table walks") Signed-off-by: Yu Zhao <yuzhao(a)google.com> Signed-off-by: James Houghton <jthoughton(a)google.com> Cc: Axel Rasmussen <axelrasmussen(a)google.com> Cc: David Matlack <dmatlack(a)google.com> Cc: David Rientjes <rientjes(a)google.com> Cc: David Stevens <stevensd(a)google.com> Cc: Oliver Upton <oliver.upton(a)linux.dev> Cc: Paolo Bonzini <pbonzini(a)redhat.com> Cc: Sean Christopherson <seanjc(a)google.com> Cc: Wei Xu <weixugc(a)google.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- include/linux/mmzone.h | 2 -- mm/vmscan.c | 14 +++++--------- 2 files changed, 5 insertions(+), 11 deletions(-) --- a/include/linux/mmzone.h~mm-multi-gen-lru-remove-mm_leaf_old-and-mm_nonleaf_total-stats +++ a/include/linux/mmzone.h @@ -458,9 +458,7 @@ struct lru_gen_folio { enum { MM_LEAF_TOTAL, /* total leaf entries */ - MM_LEAF_OLD, /* old leaf entries */ MM_LEAF_YOUNG, /* young leaf entries */ - MM_NONLEAF_TOTAL, /* total non-leaf entries */ MM_NONLEAF_FOUND, /* non-leaf entries found in Bloom filters */ MM_NONLEAF_ADDED, /* non-leaf entries added to Bloom filters */ NR_MM_STATS --- a/mm/vmscan.c~mm-multi-gen-lru-remove-mm_leaf_old-and-mm_nonleaf_total-stats +++ a/mm/vmscan.c @@ -3399,7 +3399,6 @@ restart: continue; if (!pte_young(ptent)) { - walk->mm_stats[MM_LEAF_OLD]++; continue; } @@ -3552,7 +3551,6 @@ restart: walk->mm_stats[MM_LEAF_TOTAL]++; if (!pmd_young(val)) { - walk->mm_stats[MM_LEAF_OLD]++; continue; } @@ -3564,8 +3562,6 @@ restart: continue; } - walk->mm_stats[MM_NONLEAF_TOTAL]++; - if (!walk->force_scan && should_clear_pmd_young()) { if (!pmd_young(val)) continue; @@ -5254,11 +5250,11 @@ static void lru_gen_seq_show_full(struct for (tier = 0; tier < MAX_NR_TIERS; tier++) { seq_printf(m, " %10d", tier); for (type = 0; type < ANON_AND_FILE; type++) { - const char *s = " "; + const char *s = "xxx"; unsigned long n[3] = {}; if (seq == max_seq) { - s = "RT "; + s = "RTx"; n[0] = READ_ONCE(lrugen->avg_refaulted[type][tier]); n[1] = READ_ONCE(lrugen->avg_total[type][tier]); } else if (seq == min_seq[type] || NR_HIST_GENS > 1) { @@ -5280,14 +5276,14 @@ static void lru_gen_seq_show_full(struct seq_puts(m, " "); for (i = 0; i < NR_MM_STATS; i++) { - const char *s = " "; + const char *s = "xxxx"; unsigned long n = 0; if (seq == max_seq && NR_HIST_GENS == 1) { - s = "LOYNFA"; + s = "TYFA"; n = READ_ONCE(mm_state->stats[hist][i]); } else if (seq != max_seq && NR_HIST_GENS > 1) { - s = "loynfa"; + s = "tyfa"; n = READ_ONCE(mm_state->stats[hist][i]); } _ Patches currently in -mm which might be from yuzhao(a)google.com are mm-multi-gen-lru-remove-mm_leaf_old-and-mm_nonleaf_total-stats.patch mm-multi-gen-lru-use-pteppmdp_clear_young_notify.patch mm-page_alloc-keep-track-of-free-highatomic.patch

1 hour, 10 minutes

1
0
0 0

[merged mm-hotfixes-stable] mm-multi-gen-lru-use-pteppmdp_clear_young_notify.patch removed from -mm tree

by Andrew Morton

The quilt patch titled Subject: mm: multi-gen LRU: use {ptep,pmdp}_clear_young_notify() has been removed from the -mm tree. Its filename was mm-multi-gen-lru-use-pteppmdp_clear_young_notify.patch This patch was dropped because it was merged into the mm-hotfixes-stable branch of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm ------------------------------------------------------ From: Yu Zhao <yuzhao(a)google.com> Subject: mm: multi-gen LRU: use {ptep,pmdp}_clear_young_notify() Date: Sat, 19 Oct 2024 01:29:39 +0000 When the MM_WALK capability is enabled, memory that is mostly accessed by a VM appears younger than it really is, therefore this memory will be less likely to be evicted. Therefore, the presence of a running VM can significantly increase swap-outs for non-VM memory, regressing the performance for the rest of the system. Fix this regression by always calling {ptep,pmdp}_clear_young_notify() whenever we clear the young bits on PMDs/PTEs. Link: https://lkml.kernel.org/r/20241019012940.3656292-3-jthoughton@google.com Fixes: bd74fdaea146 ("mm: multi-gen LRU: support page table walks") Signed-off-by: Yu Zhao <yuzhao(a)google.com> Signed-off-by: James Houghton <jthoughton(a)google.com> Reported-by: David Stevens <stevensd(a)google.com> Cc: Axel Rasmussen <axelrasmussen(a)google.com> Cc: David Matlack <dmatlack(a)google.com> Cc: David Rientjes <rientjes(a)google.com> Cc: Oliver Upton <oliver.upton(a)linux.dev> Cc: Paolo Bonzini <pbonzini(a)redhat.com> Cc: Sean Christopherson <seanjc(a)google.com> Cc: Wei Xu <weixugc(a)google.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- include/linux/mmzone.h | 5 +- mm/rmap.c | 9 +-- mm/vmscan.c | 91 +++++++++++++++++++++------------------ 3 files changed, 55 insertions(+), 50 deletions(-) --- a/include/linux/mmzone.h~mm-multi-gen-lru-use-pteppmdp_clear_young_notify +++ a/include/linux/mmzone.h @@ -555,7 +555,7 @@ struct lru_gen_memcg { void lru_gen_init_pgdat(struct pglist_data *pgdat); void lru_gen_init_lruvec(struct lruvec *lruvec); -void lru_gen_look_around(struct page_vma_mapped_walk *pvmw); +bool lru_gen_look_around(struct page_vma_mapped_walk *pvmw); void lru_gen_init_memcg(struct mem_cgroup *memcg); void lru_gen_exit_memcg(struct mem_cgroup *memcg); @@ -574,8 +574,9 @@ static inline void lru_gen_init_lruvec(s { } -static inline void lru_gen_look_around(struct page_vma_mapped_walk *pvmw) +static inline bool lru_gen_look_around(struct page_vma_mapped_walk *pvmw) { + return false; } static inline void lru_gen_init_memcg(struct mem_cgroup *memcg) --- a/mm/rmap.c~mm-multi-gen-lru-use-pteppmdp_clear_young_notify +++ a/mm/rmap.c @@ -885,13 +885,10 @@ static bool folio_referenced_one(struct return false; } - if (pvmw.pte) { - if (lru_gen_enabled() && - pte_young(ptep_get(pvmw.pte))) { - lru_gen_look_around(&pvmw); + if (lru_gen_enabled() && pvmw.pte) { + if (lru_gen_look_around(&pvmw)) referenced++; - } - + } else if (pvmw.pte) { if (ptep_clear_flush_young_notify(vma, address, pvmw.pte)) referenced++; --- a/mm/vmscan.c~mm-multi-gen-lru-use-pteppmdp_clear_young_notify +++ a/mm/vmscan.c @@ -56,6 +56,7 @@ #include <linux/khugepaged.h> #include <linux/rculist_nulls.h> #include <linux/random.h> +#include <linux/mmu_notifier.h> #include <asm/tlbflush.h> #include <asm/div64.h> @@ -3294,7 +3295,8 @@ static bool get_next_vma(unsigned long m return false; } -static unsigned long get_pte_pfn(pte_t pte, struct vm_area_struct *vma, unsigned long addr) +static unsigned long get_pte_pfn(pte_t pte, struct vm_area_struct *vma, unsigned long addr, + struct pglist_data *pgdat) { unsigned long pfn = pte_pfn(pte); @@ -3306,13 +3308,20 @@ static unsigned long get_pte_pfn(pte_t p if (WARN_ON_ONCE(pte_devmap(pte) || pte_special(pte))) return -1; + if (!pte_young(pte) && !mm_has_notifiers(vma->vm_mm)) + return -1; + if (WARN_ON_ONCE(!pfn_valid(pfn))) return -1; + if (pfn < pgdat->node_start_pfn || pfn >= pgdat_end_pfn(pgdat)) + return -1; + return pfn; } -static unsigned long get_pmd_pfn(pmd_t pmd, struct vm_area_struct *vma, unsigned long addr) +static unsigned long get_pmd_pfn(pmd_t pmd, struct vm_area_struct *vma, unsigned long addr, + struct pglist_data *pgdat) { unsigned long pfn = pmd_pfn(pmd); @@ -3324,9 +3333,15 @@ static unsigned long get_pmd_pfn(pmd_t p if (WARN_ON_ONCE(pmd_devmap(pmd))) return -1; + if (!pmd_young(pmd) && !mm_has_notifiers(vma->vm_mm)) + return -1; + if (WARN_ON_ONCE(!pfn_valid(pfn))) return -1; + if (pfn < pgdat->node_start_pfn || pfn >= pgdat_end_pfn(pgdat)) + return -1; + return pfn; } @@ -3335,10 +3350,6 @@ static struct folio *get_pfn_folio(unsig { struct folio *folio; - /* try to avoid unnecessary memory loads */ - if (pfn < pgdat->node_start_pfn || pfn >= pgdat_end_pfn(pgdat)) - return NULL; - folio = pfn_folio(pfn); if (folio_nid(folio) != pgdat->node_id) return NULL; @@ -3394,20 +3405,16 @@ restart: total++; walk->mm_stats[MM_LEAF_TOTAL]++; - pfn = get_pte_pfn(ptent, args->vma, addr); + pfn = get_pte_pfn(ptent, args->vma, addr, pgdat); if (pfn == -1) continue; - if (!pte_young(ptent)) { - continue; - } - folio = get_pfn_folio(pfn, memcg, pgdat, walk->can_swap); if (!folio) continue; - if (!ptep_test_and_clear_young(args->vma, addr, pte + i)) - VM_WARN_ON_ONCE(true); + if (!ptep_clear_young_notify(args->vma, addr, pte + i)) + continue; young++; walk->mm_stats[MM_LEAF_YOUNG]++; @@ -3473,21 +3480,22 @@ static void walk_pmd_range_locked(pud_t /* don't round down the first address */ addr = i ? (*first & PMD_MASK) + i * PMD_SIZE : *first; - pfn = get_pmd_pfn(pmd[i], vma, addr); - if (pfn == -1) - goto next; - - if (!pmd_trans_huge(pmd[i])) { - if (!walk->force_scan && should_clear_pmd_young()) + if (pmd_present(pmd[i]) && !pmd_trans_huge(pmd[i])) { + if (!walk->force_scan && should_clear_pmd_young() && + !mm_has_notifiers(args->mm)) pmdp_test_and_clear_young(vma, addr, pmd + i); goto next; } + pfn = get_pmd_pfn(pmd[i], vma, addr, pgdat); + if (pfn == -1) + goto next; + folio = get_pfn_folio(pfn, memcg, pgdat, walk->can_swap); if (!folio) goto next; - if (!pmdp_test_and_clear_young(vma, addr, pmd + i)) + if (!pmdp_clear_young_notify(vma, addr, pmd + i)) goto next; walk->mm_stats[MM_LEAF_YOUNG]++; @@ -3545,24 +3553,18 @@ restart: } if (pmd_trans_huge(val)) { - unsigned long pfn = pmd_pfn(val); struct pglist_data *pgdat = lruvec_pgdat(walk->lruvec); + unsigned long pfn = get_pmd_pfn(val, vma, addr, pgdat); walk->mm_stats[MM_LEAF_TOTAL]++; - if (!pmd_young(val)) { - continue; - } - - /* try to avoid unnecessary memory loads */ - if (pfn < pgdat->node_start_pfn || pfn >= pgdat_end_pfn(pgdat)) - continue; - - walk_pmd_range_locked(pud, addr, vma, args, bitmap, &first); + if (pfn != -1) + walk_pmd_range_locked(pud, addr, vma, args, bitmap, &first); continue; } - if (!walk->force_scan && should_clear_pmd_young()) { + if (!walk->force_scan && should_clear_pmd_young() && + !mm_has_notifiers(args->mm)) { if (!pmd_young(val)) continue; @@ -4036,13 +4038,13 @@ static void lru_gen_age_node(struct pgli * the PTE table to the Bloom filter. This forms a feedback loop between the * eviction and the aging. */ -void lru_gen_look_around(struct page_vma_mapped_walk *pvmw) +bool lru_gen_look_around(struct page_vma_mapped_walk *pvmw) { int i; unsigned long start; unsigned long end; struct lru_gen_mm_walk *walk; - int young = 0; + int young = 1; pte_t *pte = pvmw->pte; unsigned long addr = pvmw->address; struct vm_area_struct *vma = pvmw->vma; @@ -4058,12 +4060,15 @@ void lru_gen_look_around(struct page_vma lockdep_assert_held(pvmw->ptl); VM_WARN_ON_ONCE_FOLIO(folio_test_lru(folio), folio); + if (!ptep_clear_young_notify(vma, addr, pte)) + return false; + if (spin_is_contended(pvmw->ptl)) - return; + return true; /* exclude special VMAs containing anon pages from COW */ if (vma->vm_flags & VM_SPECIAL) - return; + return true; /* avoid taking the LRU lock under the PTL when possible */ walk = current->reclaim_state ? current->reclaim_state->mm_walk : NULL; @@ -4071,6 +4076,9 @@ void lru_gen_look_around(struct page_vma start = max(addr & PMD_MASK, vma->vm_start); end = min(addr | ~PMD_MASK, vma->vm_end - 1) + 1; + if (end - start == PAGE_SIZE) + return true; + if (end - start > MIN_LRU_BATCH * PAGE_SIZE) { if (addr - start < MIN_LRU_BATCH * PAGE_SIZE / 2) end = start + MIN_LRU_BATCH * PAGE_SIZE; @@ -4084,7 +4092,7 @@ void lru_gen_look_around(struct page_vma /* folio_update_gen() requires stable folio_memcg() */ if (!mem_cgroup_trylock_pages(memcg)) - return; + return true; arch_enter_lazy_mmu_mode(); @@ -4094,19 +4102,16 @@ void lru_gen_look_around(struct page_vma unsigned long pfn; pte_t ptent = ptep_get(pte + i); - pfn = get_pte_pfn(ptent, vma, addr); + pfn = get_pte_pfn(ptent, vma, addr, pgdat); if (pfn == -1) continue; - if (!pte_young(ptent)) - continue; - folio = get_pfn_folio(pfn, memcg, pgdat, can_swap); if (!folio) continue; - if (!ptep_test_and_clear_young(vma, addr, pte + i)) - VM_WARN_ON_ONCE(true); + if (!ptep_clear_young_notify(vma, addr, pte + i)) + continue; young++; @@ -4136,6 +4141,8 @@ void lru_gen_look_around(struct page_vma /* feedback from rmap walkers to page table walkers */ if (mm_state && suitable_to_scan(i, young)) update_bloom_filter(mm_state, max_seq, pvmw->pmd); + + return true; } /****************************************************************************** _ Patches currently in -mm which might be from yuzhao(a)google.com are mm-page_alloc-keep-track-of-free-highatomic.patch

1 hour, 10 minutes

2
2
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror November 2024