Skip to content

Test master (regular, SELF kvm)#1626

Open
kdave wants to merge 10000 commits into
ci-kvmfrom
master
Open

Test master (regular, SELF kvm)#1626
kdave wants to merge 10000 commits into
ci-kvmfrom
master

Conversation

@kdave

@kdave kdave commented Apr 2, 2026

Copy link
Copy Markdown
Member

No description provided.

@kdave kdave changed the title Test master (SELF kvm) Test master (regular, SELF kvm) Apr 2, 2026
Marius Cristea and others added 29 commits June 10, 2026 12:49
This is the hwmon driver for Microchip EMC1812/13/14/15/33
Multichannel Low-Voltage Remote Diode Sensor Family.

EMC1812 has one external remote temperature monitoring channel.
EMC1813 has two external remote temperature monitoring channels.
EMC1814 has three external remote temperature monitoring channels,
channels 2 and 3 support anti parallel diode.
EMC1815 has four external remote temperature monitoring channels and
channels 1/2  and 3/4 support anti parallel diode.
EMC1833 has two external remote temperature monitoring channels and
channels 1 and 2 support anti parallel diode.
Resistance Error Correction is supported on channels 1/2 and 3/4.

Signed-off-by: Marius Cristea <marius.cristea@microchip.com>
Link: https://lore.kernel.org/r/20260610-hw_mon-emc1812-v11-2-cef809af5c19@microchip.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
A user reported that the Dell Latitude 7530 needs to be whitelisted
for the special SMM calls necessary for globally enabling/disabling
BIOS fan control.

Closes: Wer-Wolf/i8kutils#17
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Acked-by: Pali Rohár <pali@kernel.org>
Link: https://lore.kernel.org/r/20260610180141.311503-1-W_Armin@gmx.de
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Add kernel-doc documentation for the struct members that were previously
undocumented. This fixes warnings when building with W=1 and ensures
the struct is fully documented per kernel-doc conventions.

Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/20260603031135.289302-1-rosenp@gmail.com
The EC firmware is expected to return values in [1, pwm_max]. A read of 0
is illegal and would cause underflow in the conversion formula. Explicitly
check for 0 and return -EIO.

Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
Link: https://lore.kernel.org/r/1c2ffa0d832ae3a74f6d4ffa7cc7b7e6cced69e3.1781138459.git.xiaopei01@kylinos.cn
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
The generic RSA key parser (rsa_helper.c) bounds each CRT component (p,
q, dp, dq, qinv) by the modulus size n_sz, but qat_rsa_setkey_crt()
allocates half-size DMA buffers (key_sz / 2) and right-aligns each
component with:

    memcpy(dst + half_key_sz - len, src, len)

When a CRT component is larger than half_key_sz the subtraction
underflows and memcpy writes past the DMA buffer, causing memory
corruption.

Add a len > half_key_sz check next to the existing !len check for each
of the five CRT components so the driver falls back to the non-CRT path
instead of writing out of bounds.

Fixes: 879f77e ("crypto: qat - Add RSA CRT mode")
Cc: stable@vger.kernel.org
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Ahsan Atta <ahsan.atta@intel.com>
Reviewed-by: Laurent M Coquerel <laurent.m.coquerel@intel.com>
Tested-by: Laurent M Coquerel <laurent.m.coquerel@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Remove crypto4xx_rng, as it is insecure and unused:

- It has only a 64-bit security strength, which is highly inadequate.
  This can be seen by the fact that crypto4xx_hw_init() seeds it with
  only 64 bits of entropy, and the fact that the original commit
  mentions that it implements ANSI X9.17 Annex C.

  Another issue was that this driver didn't implement the crypto_rng API
  correctly, as crypto4xx_prng_generate() didn't return 0 on success.

- No user of this code is known.  It's usable only theoretically via the
  "rng" algorithm type of AF_ALG.  But userspace actually just uses the
  actual Linux RNG (/dev/random etc) instead.  And rng_algs don't
  contribute entropy to the actual Linux RNG either.  (This may have
  been confused with hwrng, which does contribute entropy.)

Fixes: d072bfa ("crypto: crypto4xx - add prng crypto support")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Acked-by: Christian Lamparter <chunkeey@gmail.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
The loongson-rng rng_alg has several vulnerabilities, including not
providing forward security, and a use-after-free bug due to the use of
wait_for_completion_interruptible().

Meanwhile, the rng_alg framework doesn't really have any purpose in the
first place other than to access the software algorithms crypto/drbg.c
and crypto/jitterentropy.c.  Hardware-specific rng_algs have no
in-kernel user, and unlike hwrng there's no feed into the actual Linux
RNG.  As such, there's really no point to this code.  There are of
course other rng_alg drivers that are similarly unused, but they're
similarly in the process of being phased out, e.g.
https://lore.kernel.org/r/20260529193648.18172-1-ebiggers@kernel.org and
https://lore.kernel.org/r/20260529220430.34135-1-ebiggers@kernel.org

Given that, there's no point in fixing forward these vulnerabilities,
and it makes much more sense to simply roll back the addition of this
driver.  If this platform provides TRNG (not PRNG) functionality, it
could make sense to add a hwrng driver, but it would be quite different.

Link: https://lore.kernel.org/linux-crypto/20260525145939.GC2018@quark/
Fixes: 766b2d7 ("crypto: loongson - add Loongson RNG driver support")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
drivers/crypto/hisilicon/trng/trng.c exposes the same hardware through
two completely separate interfaces, crypto_rng and hwrng.  However, the
implementation of this is buggy because it permits generation operations
from these interfaces to run concurrently with each other, accessing the
same registers.  That is, hisi_trng_generate() synchronizes with itself
but not with hisi_trng_read().  This results in potential repetition of
output from the RNG, output of non-random values, etc.

Fortunately, there's actually no point in hardware RNG drivers
implementing the crypto_rng interface.  It's not actually used by
anything besides the "rng" algorithm type of AF_ALG, which in turn is
not actually used in practice.  Other crypto_rng hardware drivers are
likewise being phased out, leaving just the hwrng support.

Thus, remove it to simplify the code and avoid conflict (and confusion)
with the hwrng interface which is the one that actually matters.

Fixes: e4d9d10 ("crypto: hisilicon/trng - add support for PRNG")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Since this file just implements a hwrng driver, move it into
drivers/char/hw_random/.  Rename the kconfig option accordingly as well.

Note that this moves the file back to its original location.

Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
This driver has no purpose.  It doesn't feed into the Linux RNG, nor
does it implement the hwrng interface.  It is accessible only via the
"rng" algorithm type of AF_ALG, which isn't used in practice.  Everyone
uses either the Linux RNG, or rarely /dev/hwrng.

Moreover, this is a PRNG whose only source of entropy is the 160-bit
seed the user passes in.  So this can be used only by a user who already
has a source of cryptographically secure random numbers, such as
/dev/random.  Which they can, and do, just use in the first place.

Just remove this driver.  There's no need to keep useless code around.

Note that the other crypto_rng drivers in drivers/crypto/ are similarly
unused and are being removed too.  This commit just handles exynos-rng.

Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Implementing the crypto_rng interface has no purpose, as it isn't used
in practice.  It's being removed from other drivers too.  Just remove
it.  This leaves hwrng, which is actually used.

Tagging with 'Cc stable' due to the bugs that this removes:

  - xtrng_trng_generate() sometimes returned success even when it didn't
    fill in all the bytes.

  - It was possible for xtrng_trng_generate() and
    xtrng_hwrng_trng_read() to run concurrently and interfere with each
    other, as the locking code in xtrng_hwrng_trng_read() was broken.

Fixes: 8979744 ("crypto: xilinx - Add TRNG driver for Versal")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Implementations of hwrng::read are expected to return the number of
bytes generated.  Update xtrng_hwrng_trng_read() to match that.

Fixes: 8979744 ("crypto: xilinx - Add TRNG driver for Versal")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
This code is just trying to condition 48 bytes of random data.  This can
be done easily using HKDF-SHA512-Extract, saving 300 lines of code.

This commit also fixes forward security (in this particular case) by
clearing the entropy from memory after it's used.

Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Just like for the other two Rust proc macros, remove the artifacts in
`mrproper`.

This should have been part of commit 5060549 ("rust: zerocopy-derive:
enable support in kbuild").

Link: https://patch.msgid.link/20260610143025.368801-1-ojeda@kernel.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
mvpp2 programs the RX queue packet offset, so hardware writes received
data at dma_addr + MVPP2_SKB_HEADROOM. The current CPU sync starts at
dma_addr and only covers rx_bytes + MVPP2_MH_SIZE bytes, which syncs the
unused headroom and misses the same number of bytes at the packet tail.

On non-coherent DMA systems this can leave the CPU reading stale cache
contents for the end of the received frame.

Use dma_sync_single_range_for_cpu() with MVPP2_SKB_HEADROOM as the range
offset so the sync covers the Marvell header and packet data actually
written by hardware.

Fixes: e192116 ("mvpp2: sync only the received frame")
Signed-off-by: Til Kaiser <mail@tk154.de>
Link: https://patch.msgid.link/20260607134943.21996-2-mail@tk154.de
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
mvpp2 has short and long BM pools, and short pool buffers can be smaller
than PAGE_SIZE. The XDP path nevertheless initializes every xdp_buff with
PAGE_SIZE as frame size.

XDP helpers use frame_sz to validate tail growth and to derive the hard
end of the data area. Advertising PAGE_SIZE for short buffers can let
bpf_xdp_adjust_tail() grow a packet past the real allocation, corrupting
memory or later tripping skb tailroom checks.

Initialize the XDP buffer with bm_pool->frag_size so XDP tailroom matches
the actual buffer backing the packet.

Fixes: 07dd0a7 ("mvpp2: add basic XDP support")
Signed-off-by: Til Kaiser <mail@tk154.de>
Link: https://patch.msgid.link/20260607134943.21996-3-mail@tk154.de
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
The RX error path returns the current descriptor buffer to the hardware
BM pool. That is only valid while the driver still owns the buffer.

mvpp2_rx_refill() can fail after the current buffer has been handed to
XDP or attached to an skb. In those cases mvpp2_run_xdp() may have
recycled, redirected, or queued the page for XDP_TX, and an skb free also
retires the data buffer. Returning such a buffer to BM lets hardware DMA
into memory that is no longer owned by the RX ring.

Refill the BM pool before handing the current buffer to XDP or to the
skb. If the allocation fails there, drop the packet and return the
still-owned current buffer to BM, preserving the pool depth. Once the
refill succeeds, later local drops retire/free the current buffer instead
of returning it to BM.

Fixes: 07dd0a7 ("mvpp2: add basic XDP support")
Fixes: d652692 ("net: mvpp2: fix memory leak in mvpp2_rx")
Signed-off-by: Til Kaiser <mail@tk154.de>
Link: https://patch.msgid.link/20260607134943.21996-4-mail@tk154.de
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
When an XDP program uses bpf_xdp_adjust_head() or bpf_xdp_adjust_tail()
and then returns XDP_PASS, mvpp2 still builds the skb from fixed offsets
derived from the original RX descriptor. Packet geometry changes made by
the XDP program are therefore discarded before the skb reaches the stack.

Update rx_offset and rx_bytes from xdp.data and xdp.data_end for
XDP_PASS. This makes skb_reserve() and skb_put() reflect the packet seen
by XDP, and makes RX byte accounting for XDP_PASS follow the length of the
skb passed to the network stack.

Keep a separate rx_sync_size for page-pool recycling on skb allocation
failure, which must stay tied to the received buffer range.

Non-PASS verdicts continue to account the descriptor length because no skb
is passed up in those cases.

Fixes: 07dd0a7 ("mvpp2: add basic XDP support")
Signed-off-by: Til Kaiser <mail@tk154.de>
Link: https://patch.msgid.link/20260607134943.21996-5-mail@tk154.de
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Til Kaiser says:

====================
net: mvpp2: fix XDP RX buffer handling

This is v5 of the earlier XDP_PASS fix. The XDP_PASS change is
retained, and the series also fixes related RX/XDP buffer handling
issues found during review.

Tested with tools/testing/selftests/drivers/net/xdp.py on mvpp2
hardware.
====================

Link: https://patch.msgid.link/20260607134943.21996-1-mail@tk154.de
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Now that the Kconfig space always enables CONFIG_X86_TSC (on x86),
remove !CONFIG_X86_TSC code from the x86 arch code.

We still keep the Kconfig option to catch any eventual code still
pending in maintainer or non-mainline trees, plus some drivers
have raw TSC timestamping hacks that use CONFIG_X86_TSC.

It's also still possible to disable TSC support runtime.

Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Ahmed S . Darwish <darwi@linutronix.de>
Cc: Andrew Cooper <andrew.cooper3@citrix.com>
Cc: Ard Biesheuvel <ardb@kernel.org>
Cc: H . Peter Anvin <hpa@zytor.com>
Cc: John Ogness <john.ogness@linutronix.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://lore.kernel.org/r/20250425084216.3913608-13-mingo@kernel.org
I.e. from now on it's a boot time requirement for the CPU to support it.

( This was preceded by the removal of all non-CX8 platform build
  options, so it should have no functional effects in theory. )

Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Ahmed S . Darwish <darwi@linutronix.de>
Cc: Andrew Cooper <andrew.cooper3@citrix.com>
Cc: Ard Biesheuvel <ardb@kernel.org>
Cc: H . Peter Anvin <hpa@zytor.com>
Cc: John Ogness <john.ogness@linutronix.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://lore.kernel.org/r/20250425084216.3913608-14-mingo@kernel.org
DB8540 support was removed in commit b6d09f7 ("pinctrl: nomadik:
Drop U8540/9540 support"), but a couple small pieces of related code
remained in <gpio/gpio-nomadik.h>. Remove them.

Discovered while searching for CONFIG_* symbols referenced in code but
not defined in any Kconfig file.

Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260610205007.44881-1-enelsonmoore@gmail.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
The module info buffer should be initialized to 0 before the firmware
returns information. Otherwise, there is a risk that the buffer field
not filled by the firmware is random value.

Fixes: 3439297 ("net: txgbe: Support to handle GPIO IRQs for AML devices")
Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com>
Link: https://patch.msgid.link/20260608070842.36504-2-jiawenwu@trustnetic.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Rework txgbe_identify_module() to validate module identifiers through
explicit type checks instead of relying on transceiver_type heuristics.
When using the SFP module, transceiver_type could be a random value,
because it was read from an invalid register.

Fixes: 57d39fa ("net: txgbe: improve functions of AML 40G devices")
Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com>
Link: https://patch.msgid.link/20260608070842.36504-3-jiawenwu@trustnetic.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
DECLARE_PHY_INTERFACE_MASK() does not guarantee zeroed contents. Add a
new macro DECLARE_PHY_INTERFACE_MASK_ZERO(), make the stack variable to
be zeroed before setting supported interfaces.

Fixes: 57d39fa ("net: txgbe: improve functions of AML 40G devices")
Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com>
Link: https://patch.msgid.link/20260608070842.36504-4-jiawenwu@trustnetic.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Jiawen Wu says:

====================
net: txgbe: fix module identification

For AML devices, there are some issues where the wrong module
indentified then configure PHY failed.

The module info buffers should be initialized to 0 before the firmware
returns information. And DECLARE_PHY_INTERFACE_MASK() does not guarantee
zeroed contents, so explicitly clear the temporary interface masks before
setting supported interfaces.

Rework txgbe_identify_module() to validate module identifiers through
explicit type checks instead of relying on transceiver_type heuristics.
When using the SFP module, transceiver_type could be a random value,
because it was read from an invalid register.
====================

Link: https://patch.msgid.link/20260608070842.36504-1-jiawenwu@trustnetic.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
addrconf_get_prefix_route() can return the fib6_null_entry sentinel
entry which has a NULL fib6_table pointer. Therefore, before setting the
route's expiration time, check that we are not working with this entry,
as otherwise a NPD will be triggered [1].

Note that the other callers of addrconf_get_prefix_route() are not
susceptible to this bug:

1. addrconf_prefix_rcv(): Requests a route with the 'RTF_ADDRCONF |
   RTF_PREFIX_RT' flags which are not set on fib6_null_entry.

2. modify_prefix_route(): Fixed by commit a747e02 ("ipv6: avoid
   possible NULL deref in modify_prefix_route()").

3. __ipv6_ifa_notify(): Calls ip6_del_rt() which specifically checks for
   fib6_null_entry and returns an error.

[1]
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
[...]
Call Trace:
<TASK>
__kasan_check_byte (mm/kasan/common.c:573)
lock_acquire.part.0 (kernel/locking/lockdep.c:5842 (discriminator 1))
_raw_spin_lock_bh (kernel/locking/spinlock.c:182 (discriminator 1))
cleanup_prefix_route (net/ipv6/addrconf.c:1280)
ipv6_del_addr (net/ipv6/addrconf.c:1342)
inet6_addr_del.isra.0 (net/ipv6/addrconf.c:3119)
inet6_rtm_deladdr (net/ipv6/addrconf.c:4812)
rtnetlink_rcv_msg (net/core/rtnetlink.c:6997)
netlink_rcv_skb (net/netlink/af_netlink.c:2555)
netlink_unicast (net/netlink/af_netlink.c:1344)
netlink_sendmsg (net/netlink/af_netlink.c:1899)
__sock_sendmsg (net/socket.c:802 (discriminator 4))
____sys_sendmsg (net/socket.c:2698)
___sys_sendmsg (net/socket.c:2752)
__sys_sendmsg (net/socket.c:2784)
do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)

Fixes: 5eb902b ("net/ipv6: Remove expired routes with a separated list of routes.")
Reported-by: Ji'an Zhou <eilaimemedsnaimel@gmail.com>
Reviewed-by: David Ahern <dahern@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260609145448.768318-1-idosch@nvidia.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
…rnel/git/klassert/ipsec

Steffen Klassert says:

====================
pull request (net): ipsec 2026-06-10

1) xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()
   Propagate SKBFL_SHARED_FRAG when paged fragments are moved between
   skbs so ESP can decide whether in-place crypto is safe.

2) xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload
   Replace the unlocked read of xtfs->ra_newskb with a local flag so a
   concurrent reassembly can no longer free first_skb between
   spin_unlock and the post-loop check.

3) xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
   Prune the inexact bin under xfrm_policy_lock so a concurrent
   xfrm_hash_rebuild() can no longer free it before xfrm_policy_kill()
   dereferences it.

4) xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()
   Move hrtimer_cancel() for the output and drop timers ahead of their
   spinlocks, breaking the softirq/lock cycle that could deadlock
   against the timer callbacks on SMP.

5) xfrm: espintcp: do not reuse an in-progress partial send
   Fail a new send when espintcp_push_msgs() returns with emsg->len
   still set, so a blocking caller can no longer overwrite ctx->partial
   while a previous transfer still owns it.

6) esp: fix page frag reference leak on skb_to_sgvec failure
   Add a flag to esp_ssg_unref() to unconditionally unref the source
   scatterlist, releasing the old page references that are otherwise
   leaked when the second skb_to_sgvec() in esp_output_tail() fails.

Please pull or let me know if there are problems.

ipsec-2026-06-10

* tag 'ipsec-2026-06-10' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec:
  esp: fix page frag reference leak on skb_to_sgvec failure
  xfrm: espintcp: do not reuse an in-progress partial send
  xfrm: iptfs: fix ABBA deadlock in iptfs_destroy_state()
  xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
  xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload
  xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags()
====================

Link: https://patch.msgid.link/20260610140800.2562818-1-steffen.klassert@secunet.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
The "invalid position" error occurred when the DMA position descriptor
returned an invalid address value (e.g., pos = -1048838144). This happened
because the `bytes_to_frames()` function returns a signed value, but when
`addr < runtime->dma_addr`, the subtraction produces a negative result that
gets interpreted as a large unsigned integer in comparisons.
when the addr is abnormal, for example,the DMA controller is abnormal in
hardware,x=0 should not be a point(x == runtime->buffer_size),but a range,
which includes the addr address being less than runtime ->dma1-adr, and
the addr exceeding the DMA address range.the value of pos should not better
a negative,return 0, maybe better.

[   32.834431][ 2]  soc-audio soc-audio: invalid position: , pos = -1048838144
[   32.845019][ 2]  soc-audio soc-audio: invalid position: , pos = -1048838144
[   32.855588][ 2]  soc-audio soc-audio: invalid position: , pos = -1048838144
[   32.866145][ 2]  soc-audio soc-audio: invalid position: , pos = -1048838144
[   32.995394][ 2]  soc-audio soc-audio: invalid position: , pos = -1048838144
[   33.006025][ 2]  soc-audio soc-audio: invalid position: , pos = -1048838144
[   33.016748][ 2]  soc-audio soc-audio: invalid position: , pos = -1048838144

Signed-off-by: Li Jun <lijun01@kylinos.cn>
[Remove XRUN reporting I'd mistakenly avised adding on prior review -- broonie]
Link: https://patch.msgid.link/20260611010045.3668574-1-lijun01@kylinos.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
torvalds added 30 commits June 16, 2026 07:43
…l/git/andi.shyti/linux

Pull i2c updates from Andi Shyti:
 "This pull request is mostly made of cleanups and small infrastructure
  improvements across the I2C core, drivers and bindings. It also adds
  support for three drivers and a few new compatibles.

  Two major cleanup across drivers and core code:
   - use named initializers in device ID tables
   - replace dev_err() with dev_err_probe()

  Drivers:
   - at24: use named initializers for arrays of i2c_device_data
   - at91: add MCHP_LAN966X_PCI dependency
   - cadence: add shutdown callback
   - k1: enable by default on SpacemiT
   - mxs: improve documentation
   - qcom-geni: use pm_runtime_force_suspend/resume for system sleep
   - tegra:
       - disable fair arbitration on non-MCTP buses
       - allocate DMA buffers from the correct DMA device
   - designware:
       - handle active target shutdown cleanly
       - add shutdown callbacks for platform and PCI drivers
       - adopt the new PM_RUNTIME_ACQUIRE() helpers

  DT bindings:
   - convert davinci bindings to DT schema

  Core and muxes:
   - acpi: report missing I2C resources as -ENOENT
   - gpiolib: add gpiod_is_single_ended() helper for I2C GPIO users
   - i2c-mux-reg: add generic firmware node support
   - a set of 10 patches from Johan Hovold fixing adapter registration
     races, cleanup paths and resource management issues

  New support:
   - DesignWare LECA0003 (ACPI ID)
   - Loongson LS2K0300 I2C controller (new driver)
   - Qualcomm CCI Glymur and Shikra compatibles"

* tag 'i2c-7.2-part1' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux: (46 commits)
  i2c: mxs: add missing kernel-doc for struct mxs_i2c_dev members
  i2c: qcom-geni: Use pm_runtime_force_{suspend,resume} helpers
  dt-bindings: i2c: qcom-cci: Document Glymur compatible
  dt-bindings: i2c: qcom-cci: Document Shikra compatible
  i2c: mux: reg: use device property accessors
  i2c: acpi: Return -ENOENT when no resources found in i2c_acpi_client_count()
  i2c: at91: Add MCHP_LAN966X_PCI dependency
  i2c: eg20t: Consistently define pci_device_ids using named initializers
  i2c: designware-pcidrv: Consistently define pci_device_ids using named initializers
  i2c: bcm-kona: fix spelling mistake in timeout-check comment
  i2c: cadence: Add shutdown handler
  i2c: tegra: Disable fair arbitration for non-MCTP buses
  i2c: tegra: use dmaengine_get_dma_device() for DMA buffer allocation
  i2c: busses: make K1 driver default for SpacemiT platforms
  i2c: Use named initializers for arrays of i2c_device_data
  i2c: core: clean up adapter registration error label
  i2c: core: clean up bus id allocation
  i2c: core: fix adapter deregistration race
  i2c: core: fix adapter registration race
  i2c: core: disable runtime PM on adapter registration failure
  ...
…git/broonie/regmap

Pull regmap update from Mark Brown:
 "This time around we just have a single fix for a sparse warning"

* tag 'regmap-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
  regmap-i2c: fix sparse warning in regmap_smbus_word_write_reg16
…el/git/broonie/regulator

Pull regulator updates from Mark Brown:
 "The development of the regulator subsystem continues to be quite
  quiet, we've got several new devices, removal of one old device and
  some kernel wide cleanup of platform devices but nothing in the core.

   - Cleanups of platform_device_id usage

   - Filling out and fixing of the description of the MediaTek MT6359

   - Removal of the PCAP regulator driver, the MFD has been removed

   - New device support for Qualcomm Nord RPMH, PM8109, PM8150 and
     PMAU0102, and SG Micro SGM3804"

* tag 'regulator-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (23 commits)
  regulator: dt-bindings: mt6311: Convert to DT schema
  regulator: qcom_smd-regulator: Add PM8019
  regulator: dt-bindings: qcom,smd-rpm-regulator: Add PM8019
  regulator: mt6359: Fix vbbck default internal supply name
  regulator: bq257xx: drop confusing configuration of_node
  regulator: Unify usage of space and comma in platform_device_id arrays
  regulator: Use named initializers for platform_device_id arrays
  regulator: Drop unused assignment of platform_device_id driver data
  regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
  regulator: remove used pcap regulator driver
  regulator: add SGM3804 Dual Output driver
  regulator: dt-bindings: document the SGM3804 Dual Output regulator
  regulator: mt6359: Add proper ldo_vcn33_[12] regulators
  regulator: mt6359: Add regulator supply names
  regulator: mt6359: const-ify regulator descriptions
  regulator: dt-bindings: mt6359: Deprecate bogus vcn33_[12]_* split regulators
  regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions
  regulator: palmas: Move MODULE_DEVICE_TABLE next to the table itself
  regulator: qcom_smd: Add PM8150 regulators
  regulator: dt-bindings: qcom,smd-rpm-regulator: Document PM8150 IC
  ...
…/broonie/spi

Pull spi updates from Mark Brown:
 "This has been quite a busy release, mainly due to the subsystem wide
  work Johan Hovold has done to modernise resource allocation for the
  subsystem on probe, the subsystem did some very clever allocation
  management pre devm which didn't quite mesh comfortably with managed
  allocations and made it far too easy to introduce error handling and
  removal bugs.

   - Cleanup and simplification of controller struct allocation, moving
     everything over to devm and making the devm APIs more robust, from
     Johan Hovold

   - Support for spi-mem devices that don't assert chip select and
     support for a secondary read command for memory mapped flashes,
     some commits for this are shared with mtd.

   - Support for SpacemiT K1"

* tag 'spi-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (118 commits)
  spi: Fix mismatched DT property access types
  spi: xilinx: use FIFO occupancy register to determine buffer size
  spi: spi-mem: Fix spi_controller_mem_ops kdoc
  spi: xilinx: let transfers timeout in case of no IRQ
  spi: dt-bindings: nuvoton,npcm750-fiu: Convert to DT schema
  spi: meson-spifc: fix runtime PM leak on remove
  spi: Use named initializers for platform_device_id arrays
  spi: rzv2h-rspi: Add suspend/resume support
  spi: dw-pci: remove redundant pci_free_irq_vectors() calls
  spi: ep93xx: fix double-free of zeropage on DMA setup failure
  spi: cadence-xspi: Revert COMPILE_TEST support
  spi: cadence-xspi: Support 32bit and 64bit slave dma interface
  spi: tegra210-quad: Allocate DMA memory for DMA engine
  spi: imx: replace dmaengine_terminate_all() with dmaengine_terminate_sync()
  spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
  spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync()
  spi: atmel: fix DMA channel and bounce buffer leaks
  spi: omap2-mcspi: Use of_device_get_match_data()
  spi: Use named initializers for arrays of i2c_device_data
  spi: aspeed: Replace VLA parameter with flat pointer in calibration helper
  ...
…ernel/git/groeck/linux-staging

Pull watchdog updates and fixes from Guenter Roeck:
 "Subsystem:
   - Unregister PM notifier on watchdog unregister
   - Various documentation fixes and improvements

  Removed drivers:
   - Remove AMD Elan SC520 processor watchdog driver
   - Drop SMARC-sAM67 support
   - Remove driver for integrated WDT of ZFx86 486-based SoC

  New drivers:
   - Driver for Andes ATCWDT200
   - Driver for Gunyah Watchdog

  Added support to existing drivers:
   - Add "apple,t8103-wdt" and "apple,t8122-wdt" compatibles to Apple
     watchdog driver
   - Add rockchip,rk3528-wdt and rockchip,rv1103b-wdt to snps,dw-wdt.yaml
   - Document IPQ9650, IPQ5210, Shikra, Nord, and Hawi in qcom-wdt.yaml
     Also document sram property and add support to get the bootstatus
     to qcom wdt driver
   - lenovo_se10_wdt: Fix use-after-rfree and add support for SE10 Gen 2
     platform
   - ti,rti-wdt: Add ti,am62l-rti-wdt compatible
   - renesas: Document RZ/G3L support and rework example for
     renesas,r9a09g057-wdt

  Other bug fixes and improvements:
   - Use named initializers (sc1200, ziirave_wdt)
   - Allow pic32-dmt and pic32-wdt to be built with COMPILE_TEST
   - realtek-otto: enable clock before using I/O, and prevent PHASE2 underflows
   - rti_wdt: Add reaction control
   - renesas,rzn1-wdt: Drop interrupt support and other cleanup
   - gpio_wdt: Add ACPI support
   - imx7ulp_wdt: Keep WDOG running until A55 enters WFI on i.MX94
   - sprd_wdt: Remove redundant sprd_wdt_disable() on register failure
   - bcm2835_wdt: Switch to new sys-off handler API
   - sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5
   - hpwdt: Refine hpwdt message for UV platform
   - Convert TS-4800 bindings to DT schema
   - menz069_wdt: drop unneeded MODULE_ALIAS
   - sp5100_tco: Use EFCH MMIO for newer Hygon FCH"

* tag 'watchdog-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (58 commits)
  watchdog: sc1200: Drop unused assignment of pnp_device_id driver data
  watchdog: unregister PM notifier on watchdog unregister
  dt-bindings: watchdog: qcom-wdt: Document IPQ5210 watchdog
  watchdog: dev: convert to kernel-doc comments
  watchdog: core: clean up some comments
  watchdog: uapi: add comments for what bit masks apply to
  watchdog: linux/watchdog.h: repair kernel-doc comments
  watchdog: add devm_watchdog_register_device() to watchdog-kernel-api
  watchdog: ziirave_wdt: Use named initializers for struct i2c_device_id
  watchdog: realtek-otto: enable clock before using I/O
  watchdog: realtek-otto: prevent PHASE2 underflows
  dt-bindings: watchdog: qcom-wdt: Document IPQ9650 watchdog
  dt-bindings: watchdog: renesas,rzn1-wdt: interrupts are not required
  dt-bindings: watchdog: apple,wdt: Add t8122 compatible
  watchdog: apple: Add "apple,t8103-wdt" compatible
  watchdog: rzn1: remove now obsolete interrupt support
  dt-bindings: watchdog: Add watchdog compatible for RK3528
  watchdog: convert the Kconfig dependency on OF_GPIO to OF
  watchdog: Remove AMD Elan SC520 processor watchdog driver
  watchdog: lenovo_se10_wdt: Fix use-after-free and resource leak risk
  ...
…el/git/groeck/linux-staging

Pull hwmon updates from Guenter Roeck:
 "New drivers for the following chips:
   - Analog Devices LTC4283 Swap Controller
   - Analog Devices MAX20830
   - Analog Devices MAX20860A
   - ARCTIC Fan Controller
   - Delta E50SN12051
   - Luxshare LX1308
   - Microchip EMC1812/13/14/15/33
   - Monolithic MP2985
   - Murata D1U74T PSU

  New chip support added to existing drivers:
   - asus-ec-sensors: Support for ROG MAXIMUS Z790 EXTREME, ROG STRIX
     B850-E GAMING WIFI, and ROG STRIX B650E-E GAMING WIFI
   - dell-smm: Add Dell Latitude 7530 to fan control whitelist
   - nct6683: Support for ASRock Z890 Pro-A
   - pmbus: Support for Flex BMR316, BMR321, BMR350 and BMR351
   - pmbus/max34440: Support for ADPM12250
   - pmbus/xdp720: Support for Infineon xdp730, and fix driver issues
     reported by Sashiko

  New functionality:
   - Add support for update_interval_us chip attribute, and support it
     in ina238 driver
   - Add support for guard() and scoped_guard() for subsystem locks, and
     use it in adt7411, ina2xx, and lm90 drivers
   - emc2305: Support configurable fan PWM at shutdown
   - lm63: Expose PWM frequency and LUT hysteresis as writable
   - lm75: Support active-high alert polarity
   - nct7802: Add time step attributes for tweaking responsiveness
   - pmbus/adm1266: Add rtc debugfs entries for rtc, powerup_counter,
     clear_blackbox, and firmware_revision
   - raspberrypi: Fix delayed-work teardown race, add voltage input
     support as well as voltage domain IDs
   - mcp9982: Add support for reporting external diode faults

  Miscellaneous bug fixes, changes and improvements:
   - Use named initializers for platform_device_id arrays and
     i2c_device_data, and remove unused driver data
   - Various drivers: Move MODULE_DEVICE_TABLE next to the table itself
   - ads7871: Convert to hwmon_device_register_with_info(), and use
     DMA-safe buffer for SPI writes
   - adt7411: document supported sysfs attributes
   - adt7462: Add of_match_table to support devicetree
   - adt7475: Add explicit header include
   - coretemp; Fix outdated documentation, coding style issues, and
     replace hardcoded core count with dynamic value
   - cros_ec: Drop unused assignment of platform_device_id driver data
   - emc2305: Fix fan channel index handling
   - gpd-fan: Reject EC PWM value 0 as invalid, fix race condition
     between device removal and sysfs access, upgrade log level from
     warn to err for platform device creation failure, initialize EC
     before registering hwmon device, drop global driver data and use
     per-device allocation
   - htu31: document debugfs serial_number
   - ina238: Add support for samples and update_interval
   - it87: Clamp negative values to zero in set_fan()
   - lm75: Add explicit header include, Add explicit default cases in
     lm75_is_visible(), and add section for sysfs interface to
     documentation
   - pmbus/lm25066: Fix PMBus coefficients for LM5064/5066/5066i
   - tmp102: Use device_property_read_string API
   - tmp401: Read "ti,n-factor" as signed
   - Convert zyxel,nsa320-mcu to DT schema"

* tag 'hwmon-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (81 commits)
  hwmon: tmp401: Read "ti,n-factor" as signed
  hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i
  hwmon: (gpd-fan) Reject EC PWM value 0 as invalid
  hwmon: (dell-smm) Add Dell Latitude 7530 to fan control whitelist
  hwmon: temperature: add support for EMC1812
  dt-bindings: hwmon: temperature: add support for EMC1812
  hwmon: (gpd-fan): fix race condition between device removal and sysfs access
  hwmon: (gpd-fan): upgrade log level from warn to err for platform device creation failure
  hwmon: (gpd-fan): Initialize EC before registering hwmon device
  hwmon: (gpd-fan): drop global driver data and use per-device allocation
  hwmon: (pmbus/max34440): add support adpm12250
  hwmon: (ina238) Add update_interval_us attribute
  hwmon: Add update_interval_us chip attribute
  hwmon: (ina238) Add support for samples and update_interval
  gpio: gpio-ltc4283: Add support for the LTC4283 Swap Controller
  hwmon: ltc4283: Add support for the LTC4283 Swap Controller
  dt-bindings: hwmon: Document the LTC4283 Swap Controller
  hwmon: (pmbus/xdp720) Fix driver issues xdp720/730
  hwmon: (pmbus/xdp720) Add support for efuse xdp730
  dt-bindings: hwmon/pmbus: Add Infineon xdp730
  ...
…/ulfh/mmc

Pull MMC updates from Ulf Hansson:
 "MMC core:
   - Validate host's max_segs to fail gracefully

  MMC host:
   - davinci:
       - Avoid potential NULL dereference in the IRQ handler
       - Call mmc_add_host() in the correct order during probe
   - dw_mmc-exynos:
       - Increase DMA threshold for exynos7870
   - renesas_sdhi:
       - Add support for RZ/G2E, RZ/G2N and R-Car M3Le variants
   - sdhci-msm:
       - Add support for Hawi, Eliza and Shikra variants
   - sdhci-of-k1:
       - Add support for SD UHS-I modes
       - Add support for tuning for eMMC HS200 and SD UHS-I"

* tag 'mmc-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (24 commits)
  mmc: dw_mmc: Add desc_num field for clarity
  dt-bindings: mmc: sdhci-msm: Rename the binding to include 'qcom' prefix
  mmc: sdhci-of-dwcmshc: use dev_err_probe() to simplify error paths
  mmc: sdhci-of-dwcmshc: remove redundant IS_ERR() check
  dt-bindings: mmc: sdhci-msm: qcom: Add Hawi compatible
  mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC
  mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC
  dt-bindings: mmc: sdhci-msm: Add Eliza compatible
  mmc: davinci: fix mmc_add_host order in probe
  dt-bindings: mmc: sdhci-msm: Document the Shikra compatible
  mmc: sdhci-of-k1: add comprehensive SDR tuning support
  mmc: sdhci-of-k1: add regulator and pinctrl voltage switching support
  mmc: sdhci-of-k1: enable essential clock infrastructure for SD operation
  dt-bindings: mmc: spacemit,sdhci: add pinctrl support for voltage switching
  mmc: via-sdmmc: Simplify initialisation of pci_device_id array
  mmc: davinci: avoid NULL deref of host->data in IRQ handler
  memstick: Constify the driver id_table
  mmc: host: Move MODULE_DEVICE_TABLE next to the table itself
  mmc: renesas_sdhi: add R-Car M3Le compatibility string
  dt-bindings: mmc: renesas,sdhi: Document R-Car M3Le support
  ...
…ernel/git/deller/linux-fbdev

Pull fbdev updates from Helge Deller:
 "Beside the removal of the Hercules monochrome ISA graphics driver and
  the corresponding text console driver, there is just the typical
  maintanance with smaller driver fixes and cleanups:

  Removal of drivers:
   - Hercules monochrome ISA graphics adapter driver (Ethan Nelson-Moore)
   - Hercules mdacon console driver (Ethan Nelson-Moore)

  Changes affecting many drivers at once:
   - possible memory leak fixes in various drivers (Abdun Nihaal)
   - many conversions to use strscpy() (David Laight)
   - Use named initializers in drivers (Uwe Kleine-König)

  Code fixes:
   - fbcon: don't suspend/resume when vc is graphics mode (Lu Yao)
   - modedb: fix a possible UAF in fb_find_mode() (Tuo Li)
   - modedb: Fix entry for 1920x1080-60 mode (Steffen Persvold)
   - arm: Export acorndata_8x8 font symbol for bootloader (Helge Deller)
   - omap2: fix use-after-free in omapfb_mmap (Hongling Zeng)

  Cleanups:
   - pxa168fb: use devm_ioremap_resource() (Alberto Arostegui)
   - provice helpers for fb_set_var() and fb_blank() and fbcon updates
     (Thomas Zimmermann)
   - fbcon: Use correct type for vc_resize() return value (Jiacheng Yu)
   - chipsfb: add missing MODULE_DESCRIPTION() macro (Rahman Mahmutović)
   - sunxvr2500: replace printk with device-aware logging functions
     (Rahman Mahmutović)
   - sm712: Fix operator precedence in big_swap macro (Li RongQing)
   - imxfb: Use of_device_get_match_data() (Rosen Penev)
   - atmel_lcdfb: Use of_device_get_match_data() (Rosen Penev)

  Documentation fixes:
   - grvga: Fix CLUT register address offset in comment (Eduardo Silva)
   - omap/dss: Fix stale modedb.c path (Costa Shulyupin)
   - correct CONFIG_FB_TILEBLITTING macro name in #endif comment (Ethan
     Nelson-Moore)"

* tag 'fbdev-for-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: (43 commits)
  fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode
  fbdev: modedb: fix a possible UAF in fb_find_mode()
  fbdev: s3fb: Use strscpy() to copy strings into arrays
  fbdev: sm501fb: Fix buffer errors in OF binding code
  fbcon: correct CONFIG_FB_TILEBLITTING macro name in #endif comment
  fbdev/arm: Export acorndata_8x8 font symbol for bootloader
  fbdev: mmpfb: Use strscpy() to copy device name
  fbdev: sisfb: Replace strlen() strcpy() pair with strscpy()
  fbdev: rivafb: Use strscpy() to copy device name
  fbdev: cyber2000fb: Use strscpy() to copy device name
  fbdev: atmel_lcdfb: Use strscpy() to copy device name
  fbdev: Do not export fbcon from fbdev
  fbdev: Wrap fbcon updates from vga-switcheroo in helper
  fbdev: Wrap user-invoked calls to fb_blank() in helper
  fbdev: Wrap user-invoked calls to fb_set_var() in helper
  fbdev: omap2: fix use-after-free in omapfb_mmap
  docs: omap/dss: Fix stale modedb.c path
  fbdev: pxa168fb: use devm_ioremap_resource() for MMIO
  fbdev: grvga: Fix CLUT register address offset in comment
  fbdev: sunxvr2500: replace printk with device-aware logging functions
  ...
…/docs/linux

Pull documentation updates from Jonathan Corbet:
 "Things have calmed down a bit on the docs front, with no earthshaking
  changes this time around:

   - Ongoing work on the Japanese and Portuguese translations

   - Better integration of the MAINTAINERS file into the rendered
     documents, including a search interface

   - A seemingly infinite supply of fixes for typos, minor grammatical
     issues, and related problems that LLMs find with abandon"

* tag 'docs-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux: (93 commits)
  docs: pt_BR: Translate 3.Early-stage.rst into Portuguese
  docs: pt_BR: update "Purpose of Defconfigs" section in maintainer-soc.rst
  Documentation: bug-hunting.rst: fix grammar
  docs/ja_JP: translate submitting-patches.rst (interleaved-replies)
  docs: Fix minor grammatical error
  docs/{it_it,sp_SP,zh_CN,zh_TW}: update references to removed CONFIG_DEBUG_SLAB
  Documentation: process: fix brackets
  Documentation: arch: fix brackets
  docs/dyndbg: explain flags parse 1st
  docs/dyndbg: update examples \012 to \n
  docs: kernel-parameters: Fix stale sticore file paths
  docs: real-time: Fix duplicated sched(7) text
  docs: kgdb: Fix stale source file paths
  docs: sonypi: Fix stale header file path
  docs: kernel-parameters: Remove sa1100ir IrDA parameter
  iommu: Documentation: rearrange, update kernel-parameters
  docs: md: fix grammar in speed_limit description
  docs: changes.rst: restore pahole 1.26 minimum (regressed by sort)
  Documentation: Fix syntax of kmalloc_objs example in coding style doc
  docs: pt_BR: update maintainer-handbooks
  ...
…/git/vbabka/slab

Pull slab updates from Vlastimil Babka:

 - Support for "allocation tokens" (currently available in Clang 22+)
   for smarter partitioning of kmalloc caches based on the allocated
   object type, which can be enabled instead of the "random"
   per-caller-address-hash partitioning.

   It should be able to deterministically separate types containing a
   pointer from those that do not (Marco Elver)

 - Improvements and simplification of the kmem_cache_alloc_bulk() and
   mempool_alloc_bulk() API. This includes adaptation of callers
   (Christoph Hellwig)

 - Performance improvements and cleanups related mostly to sheaves
   refill (Hao Li, Shengming Hu, Vlastimil Babka)

 - Several fixups for the slabinfo tool (Xuewen Wang)

* tag 'slab-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab:
  mm/slab: do not limit zeroing to orig_size when only red zoning is enabled
  mm/slub: preserve original size in _kmalloc_nolock_noprof retry path
  mm: simplify the mempool_alloc_bulk API
  mm/slab: improve kmem_cache_alloc_bulk
  mm/slub: detach and reattach partial slabs in batch
  mm/slub: introduce helpers for node partial slab state
  mm/slub: use empty sheaf helpers for oversized sheaves
  tools/mm/slabinfo: remove redundant slab->partial assignment
  tools/mm/slabinfo: remove dead assignment in get_obj_and_str()
  tools/mm/slabinfo: Fix trace disable logic inversion
  MAINTAINERS: add slab-related scripts and tools to SLAB ALLOCATOR
  mm/slub: fix typo in sheaves comment
  mm, slab: simplify returning slab in __refill_objects_node()
  mm, slab: add an optimistic __slab_try_return_freelist()
  slab: fix kernel-docs for mm-api
  slab: improve KMALLOC_PARTITION_RANDOM randomness
  slab: support for compiler-assisted type-based slab cache partitioning
  mm/slub: defer freelist construction until after bulk allocation from a new slab
…herbert/crypto-2.6

Pull crypto updates from Herbert Xu:
 "API:
   - Drop support for off-CPU cryptography in af_alg
   - Document that af_alg is *always* slower
   - Document the deprecation of af_alg
   - Remove zero-copy support from skcipher and aead in af_alg
   - Cap AEAD AD length to 0x80000000 in af_alg
   - Free default RNG on module exit

  Algorithms:
   - Fix vli multiplication carry overflow in ecc
   - Drop unused cipher_null crypto_alg
   - Remove unused variants of drbg
   - Use lib/crypto in drbg
   - Use memcpy_from/to_sglist in authencesn
   - Allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode
   - Disallow RSA PKCS#1 SHA-1 sig algs in FIPS mode
   - Filter out async aead implementations at alloc in krb5
   - Fix non-parallel fallback by rstoring callback in pcrypt
   - Validate poly1305 template argument in chacha20poly1305

  Drivers:
   - Add sysfs PCI reset support to qat
   - Add KPT support for GEN6 devices to qat
   - Remove unused character device and ioctls from qat
   - Add support for hw access via SMCC to mtk
   - Remove prng support from crypto4xx
   - Remove prng support from hisi-trng
   - Remove prng support from sun4i-ss
   - Remove prng support from xilinx-trng
   - Remove loongson-rng
   - Remove exynos-rng

  Others:
   - Remove support for AIO on sockets"

* tag 'v7.2-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (196 commits)
  crypto: tegra - fix refcount leak in tegra_se_host1x_submit()
  crypto: rng - Free default RNG on module exit
  crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode
  hwrng: jh7110 - fix refcount leak in starfive_trng_read()
  crypto: atmel-ecc - drop dead code in atmel_ecdh_max_size
  crypto: cavium/cpt - fix DMA cleanup using wrong loop index
  crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
  MAINTAINERS: make myself the maintainer of the Qualcomm QCE driver
  crypto: amcc - convert irq_of_parse_and_map to platform_get_irq
  crypto: sun4i-ss - Remove insecure and unused rng_alg
  hwrng: xilinx - Move xilinx-rng into drivers/char/hw_random/
  crypto: xilinx-trng - Replace crypto_drbg_ctr_df() with HMAC-SHA512
  crypto: xilinx-trng - Fix return value of xtrng_hwrng_trng_read()
  crypto: xilinx-trng - Remove crypto_rng interface
  crypto: exynos-rng - Remove exynos-rng driver
  hwrng: hisi-trng - Move hisi-trng into drivers/char/hw_random/
  crypto: hisi-trng - Remove crypto_rng interface
  crypto: loongson - Remove broken and unused loongson-rng
  crypto: crypto4xx - Remove insecure and unused rng_alg
  crypto: qat - validate RSA CRT component lengths
  ...
…l/git/ebiggers/linux

Pull CRC updates from Eric Biggers:
 "Accelerate CRC64-NVME for 32-bit ARM by refactoring the arm64 NEON
  intrinsics implementation to be shared by 32-bit and 64-bit.

  Also apply a similar cleanup to the 32-bit ARM NEON implementation of
  xor_gen(), where it now reuses code from the 64-bit implementation"

* tag 'crc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux:
  crypto: aegis128 - Use neon-intrinsics.h on ARM too
  lib/crc: arm: Enable arm64's NEON intrinsics implementation of crc64
  lib/crc: Turn NEON intrinsics crc64 implementation into common code
  xor/arm64: Use shared NEON intrinsics implementation from 32-bit ARM
  xor/arm: Replace vectorized implementation with arm64's intrinsics
  ARM: Add a neon-intrinsics.h header like on arm64
…/kernel/git/ebiggers/linux

Pull crypto library updates from Eric Biggers:

 - Drop the last architecture-specific implementation of MD5

 - Mark clmul32() as noinline_for_stack to improve codegen in some cases

* tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux:
  lib/crypto: gf128hash: mark clmul32() as noinline_for_stack
  lib/crypto: powerpc/md5: Drop powerpc optimized MD5 code
…kernel/git/kees/linux

Pull hardening updates from Kees Cook:

 - lkdtm:
     - Add case to provoke a crash in EFI runtime services (Ard Biesheuvel)
     - add PPC_RADIX_TLBIEL test and missed isync (Sayali Patil)

 - stddef: Document designated initializer semantics for
   __TRAILING_OVERLAP() (Gustavo A. R. Silva)

 - strarray: drop redundant allocation, add __counted_by_ptr (Thorsten
   Blum)

* tag 'hardening-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  lkdtm/powerpc: add PPC_RADIX_TLBIEL test for radix MCE validation
  lkdtm/powerpc: add isync after slbmte to enforce SLB update ordering
  lkdtm: Add case to provoke a crash in EFI runtime services
  lib/string_helpers: annotate struct strarray with __counted_by_ptr
  lib/string_helpers: drop redundant allocation in kasprintf_strarray
  MAINTAINERS: add kernel hardening keyword __counted_by_ptr
  stddef: Document designated initializer semantics for __TRAILING_OVERLAP()
…linux

Pull xfs updates from Carlos Maiolino:
 "The main highlight is the removal of experimental tag of the zone
  allocator feature.

  Besides that, this contains a collection of bug fixes and code
  refactoring but no new features have been added"

* tag 'xfs-merge-7.2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (29 commits)
  xfs: shut down the filesystem on a failed mount
  xfs: skip inode inactivation on a shut down mount
  xfs: move XFS_LSN_CMP to xfs_log_format.h
  xfs: shut down zoned file systems on writeback errors
  xfs: cleanup xfs_growfs_compute_deltas
  xfs: pass back updated nb from xfs_growfs_compute_deltas
  xfs: fix pointer arithmetic error on 32-bit systems
  xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap
  xfs: only log freed extents for the current RTG in zoned growfs
  xfs: add newly added RTGs to the free pool in growfs
  xfs: factor out a xfs_zone_mark_free helper
  xfs: mark struct xfs_imap as __packed
  xfs: store an agbno in struct xfs_imap
  xfs: massage xfs_imap_to_bp into xfs_read_icluster
  xfs: remove im_len field in struct xfs_imap
  xfs: cleanup xfs_imap
  xfs: remove the call to xfs_buf_reverify in xfs_trans_read_buf_map
  xfs: remove the i_ino field in struct xfs_inode
  xfs: remove xfs_setup_existing_inode
  xfs: convert xchk_inode_xref_set_corrupt to xchk_ip_xref_set_corrupt
  ...
…ux/kernel/git/jack/linux-fs

Pull fsnotify updates from Jan Kara:

 - fanotify improvements for pidfd reporting

 - small cleanup in fanotify_error_event_equal

* tag 'fsnotify_for_v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
  fanotify: allow reporting pidfds for reaped tasks
  fanotify: report thread pidfds for FAN_REPORT_TID
  fanotify: simplify fanotify_error_event_equal
…nel/git/jack/linux-fs

Pull udf, isofs, ext2, and quota updates from Jan Kara:

 - Assorted udf & isofs fixes for maliciously formatted devices

 - Cleanups to use kmalloc() instead of __get_free_page()

 - Removal of deprecated DAX code from ext2

* tag 'fs_for_v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
  udf: validate VAT inode size for old VAT format
  udf: validate VAT header length against the VAT inode size
  udf: validate sparing table length as an entry count, not a byte count
  isofs: bound Rock Ridge symlink components to the SL record
  ext2: fix ignored return value of generic_write_sync()
  ext2: Remove deprecated DAX support
  isofs: replace __get_free_page() with kmalloc()
  quota: allocate dquot_hash with kmalloc()
  udf: validate free block extents against the partition length
…teigland/linux-dlm

Pull dlm updates from David Teigland:
 "There are four fixes/cleanups in this series; none are likely to be
  issues in real usage:

   - improve debugfs error exit path

   - fix sequence number ordering in an artificial test case

   - fix usercopy_abort for lvb data

   - use hlist_for_each_entry_srcu for srcu lists"

* tag 'dlm-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm:
  dlm: init per node debugfs before add to node hash
  dlm: fix add msg handle in send_queue ordered
  dlm: add usercopy whitelist to dlm_cb cache
  dlm: use hlist_for_each_entry_srcu for SRCU protected lists
…git/kdave/linux

Pull btrfs updates from David Sterba:
 "The most noticeable change is to enable large folios by default, it's
  been in testing for a few releases. Related to that is huge folio
  support (still under experimental config). Otherwise a few ioctl
  updates, performance improvements and usual fixes and core changes.

  User visible changes:

   - enable large folios by default, added in 6.17 (under experimental
     build), no feature limitations, a big change internally

   - new ioctl to return raw checksums to userspace (a bit tricky given
     compression and tail extents), can be used for mkfs and
     deduplication optimizations

   - provide stable UUID for e.g. overlayfs and temp_fsid, also
     reflected in statvfs() field f_fsid, internal dev_t is hashed in to
     allow cloning

   - add 32bit compat version of GET_SUBVOL_INFO ioctl

   - in experimental build, support huge folios (up to 2M)

  Performance related improvements/changes:

   - limit bio size to the estimated optimum derived from the queue,
     this prevents build up of too much data for writeback, which could
     cause latency spikes (reported improvement 15% on sequential
     writes)

   - don't force direct IO to be serialized, forgotten change during
     mount API port, brings back +60% of throughput

   - lockless calculation of number of shrinkable extent maps, improve
     performance with many memcg allocated objects

  Notable fixes:

   - in zoned mode, fix a deadlock due to zone reclaim and relocation
     when space needs to be flushed

   - don't trim device which is internally not tracked as writeable
     (e.g. when missing device is being rescanned)

   - fix deadlock when cloning inline extent and mounted with
     flushoncommit

   - fix false IO failures after direct IO falls back to buffered write
     in some cases

  Core:

   - remove COW fixup mechanism completely; detect and fix changes to
     pages outside of filesystem tracking, guaranteed since 5.8, grace
     period is over

   - remove 2K block size support, experimental to test subpage code on
     x86_64 but now it would block folio changes

   - tree-checker improvements of:
      - free-space cache and tree items
      - root reference and backref items
      - extent state exceptions in reloc tree

   - subpage mode updates:
      - code optimizations, simplify tracking bitmaps
      - re-enable readahead of compressed extent
      - extend bitmap size to cover huge folios

   - add tracepoints related to sync, tree-log and transactions

   - device stats item tracking unification, remove item if there are no
     stats recorded, also don't leave stale stats on replaced device

   - allow extent buffer pages to be allocated as movable, to help page
     migration

   - added checks for proper extent buffer release

   - btrfs.ko code size reduction due to transaction abort call
     simplifications

   - several struct size reductions

   - more auto free conversions

   - more verbose assertions"

* tag 'for-7.2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: (130 commits)
  btrfs: fix use-after-free after relocation failure with concurrent COW
  btrfs: move WARN_ON on unexpected error in __add_tree_block()
  btrfs: move locking into btrfs_get_reloc_bg_bytenr()
  btrfs: lzo: reject compressed segment that overflows the compressed input
  btrfs: retry faulting in the pages after a zero sized short direct write
  btrfs: fix incorrect buffered IO fallback for append direct writes
  btrfs: fix false IO failure after falling back to buffered write
  btrfs: use verbose assertions in backref.c
  btrfs: print a message when a missing device re-appears
  btrfs: do not trim a device which is not writeable
  btrfs: return real error after lookup failure in btrfs_ioctl_default_subvol()
  btrfs: use mapping shared locking for reading super block
  btrfs: use lockless read in nr_cached_objects shrinker callback
  btrfs: switch local indicator variables to bools
  btrfs: send: pass bool for pending_move and refs_processed parameters
  btrfs: use shifts for sectorsize and nodesize
  btrfs: fix deadlock cloning inline extent when using flushoncommit
  btrfs: allocate eb-attached btree pages as movable
  btrfs: add 32-bit compat ioctl for BTRFS_IOC_GET_SUBVOL_INFO
  btrfs: derive f_fsid from on-disk fsid and dev_t
  ...
…rnel/git/vdubeyko/nilfs2

Pull nilfs2 updates from Viacheslav Dubeyko:
 "Fixes of syzbot reported issue and various small fixes in NILFS2
  functionality.

   - fix hung task in nilfs_transaction_begin() (Deepanshu Kartikey)

     Reported by syzbot. The root cause is that user-supplied segment
     numbers were not validated before nilfs_clean_segments() began
     doing work; the range check on each segnum was performed deep
     inside the call chain by nilfs_sufile_updatev(), which emits a
     nilfs_warn() per invalid entry while still holding the segctor lock
     and the sufile mi_sem.

     Fix it by validating the contents of kbufs[4] in
     nilfs_clean_segments() immediately after acquiring ns_segctor_sem
     via nilfs_transaction_lock().

   - fix a smatch warning in nilfs_mkdir() warn (Hongling Zeng)

     This corrects a semantic issue related to the use of the
     ERR_PTR macro that arose from a recent VFS change.

   - fix a backing_dev_info reference leak (Shuangpeng Bai)

     setup_bdev_super() initializes sb->s_bdev and takes a reference on
     the block device backing_dev_info when assigning sb->s_bdi.

     nilfs_fill_super() takes another reference to the same
     backing_dev_info and stores it in sb->s_bdi again. The extra
     reference is not paired with a matching bdi_put(), since
     generic_shutdown_super() releases sb->s_bdi only once.

     Drop the redundant bdi_get() in nilfs_fill_super(). The single
     reference taken by setup_bdev_super() is enough and is released
     during superblock shutdown"

* tag 'nilfs2-v7.2-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/nilfs2:
  nilfs2: Fix return in nilfs_mkdir
  nilfs2: fix backing_dev_info reference leak
  nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers
…l/git/vdubeyko/hfs

Pull hfs/hfsplus updates from Viacheslav Dubeyko:
 "Several fixes in HFS/HFS+ of syzbot reported issues and HFS//HFS+
  fixes of xfstests failures.

   - fix a null-ptr-deref issue reported by syzbot (Edward Adam Davis)

     If the attributes file is not loaded during system mount
     hfsplus_create_attributes_file can dereference a NULL pointer.

     Also, add a b-tree node size check in hfs_btree_open() with the
     goal to prevent an uninit-value bug reported by syzbot for the case
     of corrupted HFS+ image.

   - fix __hfs_bnode_create() by using kzalloc_flex() instead of
     kzalloc() (Rosen Penev)

   - fix early return in hfs_bnode_read() (Tristan Madani)

     hfs_bnode_read() can return early without writing to the output
     buffer when is_bnode_offset_valid() fails or when
     check_and_correct_requested_ length() corrects the length to zero.
     Callers such as hfs_bnode_read_ u16() and hfs_bnode_read_u8() pass
     stack-allocated buffers and use the result unconditionally, leading
     to KMSAN uninit-value reports.

  The rest fix (1) generic/637, generic/729 issue for the case of HFS+
  file system, (2) generic/003, generic/637 for the case of HFS file
  system"

* tag 'hfs-v7.2-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs:
  hfs: rework hfsplus_readdir() logic
  hfs: disable the updating of file access times (atime)
  hfs: fix incorrect inode ID assignment in hfs_new_inode()
  hfsplus: rework hfsplus_readdir() logic
  hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
  hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
  hfsplus: Add a sanity check for btree node size
  hfsplus: fix issue of direct writes beyond end-of-file
  hfs/hfxplus: use kzalloc_flex()
  hfsplus: Remove the duplicate attr inode dirty marking action
…/linux/kernel/git/axboe/linux

Pull io_uring updates from Jens Axboe:

 - Rework the task_work infrastructure.

   Both the local (DEFER_TASKRUN) and the normal (tctx) task_work lists
   were llist based, which is LIFO ordered, and hence each run had to do
   an O(n) list reversal pass first to restore queue order.
   Additionally, to cap the amount of task_work run, each method needed
   a retry list as well.

   Add a lockless MPCS FIFO queue (based on Dmitry Vyukov's intrusive
   MPSC algorithm) and switch both task_work lists to it. It performs
   better than llists and we can then also ditch the retry lists as well
   as entries are popped one-at-the-time.

   On top of those changes, run the tctx fallback task_work directly and
   remove the now-unused per-ctx fallback machinery entirely.

 - zcrx user notifications.

   Add a mechanism for zcrx to communicate conditions back to userspace
   via a dedicated CQE, with the initial users being notification on
   running out of buffers and on a frag copy fallback, plus
   shared-memory notification statistics.

   Alongside that, a series of zcrx reliability and cleanup fixes: more
   reliable scrubbing, poisoning pointers on unregistration, dropping an
   extra ifq close, adding a ctx back-pointer, reordering fd allocation
   in the export path, and killing a dead 'sock' member.

 - Allow using io_uring registered buffers for plain SEND and RECV, not
   just for the zero-copy send path.

   This enables targets like ublk's NBD backend to push/pull IO data
   directly to/from a registered buffer over a plain send/recv on a TCP
   socket.

 - Registered buffer improvements: account huge pages correctly, bump
   the io_mapped_ubuf length field to size_t, and raise the previous 1GB
   registered buffer size limit.

 - Restrict the ctx access exposed to io_uring BPF struct_ops programs
   by handing them an opaque type rather than the full io_ring_ctx, and
   add a separate MAINTAINERS entry for the bpf-ops code.

 - Allow opcode filtering on IORING_OP_CONNECT.

 - Validate ring-provided buffer addresses with access_ok(), and align
   the legacy buffer add limit with MAX_BIDS_PER_BGID.

 - Various other cleanups and minor fixes, including avoiding msghdr
   async data on connect/bind, dropping async_size for OP_LISTEN, making
   the POLL_FIRST receive side checks consistent, re-checking
   IO_WQ_BIT_EXIT for each linked work item, and using
   trace_call__##name() at guarded tracepoint call sites.

* tag 'for-7.2/io_uring-20260615' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (31 commits)
  io_uring/bpf-ops: add a separate maintainer entry
  io_uring/net: make POLL_FIRST receive side checks consistent
  io_uring: remove the per-ctx fallback task_work machinery
  io_uring: run the tctx task_work fallback directly
  io_uring: switch normal task_work to a mpscq
  io_uring: switch local task_work to a mpscq
  io_uring/mpscq: add lockless multi-producer, single-consumer FIFO queue
  io_uring: grab RCU read lock marking task run
  io_uring/zcrx: kill dead 'sock' member in struct io_zcrx_args
  io_uring/kbuf: validate ring provided buffer addresses with access_ok()
  io_uring/net: support registered buffer for plain send and recv
  io_uring/nop: Drop a wrong comment in struct io_nop
  io_uring/net: Remove async_size for OP_LISTEN
  io_uring/net: Avoid msghdr on op_connect/op_bind async data
  io_uring/bpf-ops: restrict ctx access to BPF
  io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item
  io_uring/kbuf: align legacy buffer add limit with MAX_BIDS_PER_BGID
  io_uring/zcrx: add shared-memory notification statistics
  io_uring/zcrx: notify user on frag copy fallback
  io_uring/zcrx: notify user when out of buffers
  ...
…nux/kernel/git/axboe/linux

Pull block updates from Jens Axboe:

 - NVMe pull request via Keith:
     - Per-controller admin and IO timeout sysfs attributes, and
       letting the block layer set request timeouts (Maurizio,
       Maximilian)
     - Multipath passthrough iostats, and PCI P2PDMA enablement for
       multipath devices (Keith, Kiran)
     - A new diag sysfs attribute group exporting per-controller
       counters (retries, multipath failover, error counters, requeue
       and failure counts, reset and reconnect events) (Nilay)
     - FDP configuration validation and bounds check fixes (liuxixin)
     - Various nvmet fixes, including a pre-auth out-of-bounds read in
       the Discovery Get Log Page handler, auth payload bounds
       validation, and tcp error-path leak fixes (Bryam, Tianchu,
       Geliang)
     - nvme-tcp lockdep and workqueue fixes (Shin'ichiro, Kuniyuki,
       Eric)
     - Assorted other fixes and cleanups (John, Yao, Chao, Mateusz,
       Achkinazi, Wentao)

 - MD pull request via Yu Kuai:
     - raid1/raid10 fixes for a deadlock in the read error recovery
       path, error-path detection and bio accounting with cloned bios,
       and an nr_pending leak in the REQ_ATOMIC bad-block error path
       (Abd-Alrhman)
     - PCI P2PDMA propagation from member devices to the RAID device
       (Kiran)
     - dm-raid bio requeue fix, and various smaller fixes and cleanups
       (Benjamin, Chen, Li, Thorsten)

 - Enable Clang lock context analysis for the block layer, with the
   accompanying annotations across queue limits, the blk_holder_ops
   callbacks, crypto, cgroup, iocost, kyber and mq-deadline (Bart)

 - Block status code infrastructure work: a tagged status table, a
   str_to_blk_op() helper, a bio_endio_status() helper, and on top of
   that a new configurable block-layer error injection facility
   (Christoph)

 - DRBD netlink rework, replacing the genl_magic machinery with explicit
   netlink serialization and moving the DRBD UAPI headers to
   include/uapi/linux/ (Christoph Böhmwalder)

 - bvec improvements: a bvec_folio() helper and making the bvec_iter
   helpers proper inline functions (Willy, Christoph)

 - ublk cleanups and a canceling-flag fix for the disk-not-allocated
   case (Caleb, Ming)

 - Partition handling fixes: bound the AIX pp_count scan, fix an of_node
   refcount leak, and replace __get_free_page() with kmalloc() (Bryam,
   Wentao, Mike)

 - Convert numa_node to int in blk_mq_hw_ctx and ->init_request, and add
   WQ_PERCPU to the block workqueue users (Mateusz, Marco)

 - Block statistics and tracing: propagate in-flight to the whole disk
   on partition IO, export passthrough stats, and a new
   block_rq_tag_wait tracepoint (Tang, Keith, Aaron)

 - A round of removals, unexports and cleanups across bio, direct-io and
   the bvec helpers (Christoph)

 - Various driver fixes (mtip32xx use-after-free, rbd snap_count
   validation and strscpy conversion, nbd socket lockdep reclassify,
   virtio-blk zone report clamp, floppy) and a batch of MAINTAINERS
   email/list updates (Coly, Li, Yu, Christoph Böhmwalder)

 - Other little fixes and cleanups all over

* tag 'for-7.2/block-20260615' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (117 commits)
  MAINTAINERS: Update Coly Li's email address
  block: check bio split for unaligned bvec
  nbd: Reclassify sockets to avoid lockdep circular dependency
  block: add configurable error injection
  block: add a str_to_blk_op helper
  block: add a "tag" for block status codes
  block: add a macro to initialize the status table
  floppy: Drop unused pnp driver data
  block: propagate in_flight to whole disk on partition I/O
  virtio-blk: clamp zone report to the report buffer capacity
  block: optimize I/O merge hot path with unlikely() hints
  drivers/block/rbd: Use strscpy() to copy strings into arrays
  partitions: aix: bound the pp_count scan to the ppe array
  block: Enable lock context analysis
  block/mq-deadline: Make the lock context annotations compatible with Clang
  block/Kyber: Make the lock context annotations compatible with Clang
  block/blk-mq-debugfs: Improve lock context annotations
  block/blk-iocost: Inline iocg_lock() and iocg_unlock()
  block/blk-iocost: Split ioc_rqos_throttle()
  block/crypto: Annotate the crypto functions
  ...
…kernel/git/device-mapper/linux-dm

Pull device mapper updates from Mikulas Patocka:

 - small cleanups in dm-vdo, dm-raid, dm-cache, dm-zoned-metadata

 - rework of dm-ima

 - introduce dm-inlinecrypt

 - fix wrong return value in dm-ioctl

 - fix rcu stall when polling

* tag 'for-7.2/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
  dm-zoned-metadata: Use strscpy() to copy device name
  dm cache: make smq background work limit configurable
  dm-inlinecrypt: add support for hardware-wrapped keys
  dm: limit target bio polling to one shot
  dm-ioctl: report an error if a device has no table
  dm: add documentation for dm-inlinecrypt target
  dm-inlinecrypt: add target for inline block device encryption
  block: export blk-crypto symbols required by dm-inlinecrypt
  dm-ima: use active table's size if available
  dm-ima: Fail more gracefully in dm_ima_measure_on_*
  dm-ima: Handle race between rename and table swap
  dm-ima: Fix issues with dm_ima_measure_on_device_rename
  dm-ima: remove new_map from dm_ima_measure_on_device_clear
  dm-ima: Fix UAF errors and measuring incorrect context
  dm-ima: don't copy the active table to the inactive table
  dm-ima: Remove status_flags from dm_ima_measure_on_table_load()
  dm-ima: remove broken last_target_measured logic
  dm-ima: remove dm_ima_reset_data()
  dm-raid: only requeue bios when dm is suspending
  dm vdo: use get_random_u32() where appropriate
…/scm/linux/kernel/git/shuah/linux-kselftest

Pull kunit updates from Shuah Khan:
 "Fixes to tool and kunit core and new features to both to support JUnit
  XML (primitive) and backtrace suppression API:
   - Core support for suppressing warning backtraces
   - Parse and print the reason tests are skipped
   - Add (primitive) support for outputting JUnit XML
   - Don't write to stdout when it should be disabled
   - Add backtrace suppression self-tests
   - Suppress intentional warning backtraces in scaling unit tests
   - Add documentation for warning backtrace suppression API
   - Fix spelling mistakes in comments and messages
   - gen_compile_commands: Ignore libgcc.a
   - qemu_configs: Add or1k / openrisc configuration"

* tag 'linux_kselftest-kunit-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
  kunit:tool: Don't write to stdout when it should be disabled
  kunit: tool: Add (primitive) support for outputting JUnit XML
  kunit: tool: Parse and print the reason tests are skipped
  kunit: Add documentation for warning backtrace suppression API
  drm: Suppress intentional warning backtraces in scaling unit tests
  kunit: Add backtrace suppression self-tests
  bug/kunit: Core support for suppressing warning backtraces
  kunit: Fix spelling mistakes in comments and messages
  kunit: qemu_configs: Add or1k / openrisc configuration
  gen_compile_commands: Ignore libgcc.a
…scm/linux/kernel/git/shuah/linux-kselftest

Pull kselftest updates from Shuah Khan:
 "Several fixes and improvements to resctrl tests and a change to
  kselftest document to clarify the use of FORCE_TARGETS build variable"

* tag 'linux_kselftest-next-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
  kselftest: fix doc for ksft_test_result_report()
  selftests/resctrl: Reduce L2 impact on CAT test
  selftests/resctrl: Simplify perf usage in CAT test
  selftests/resctrl: Remove requirement on cache miss rate
  selftests/resctrl: Raise threshold at which MBM and PMU values are compared
  selftests/resctrl: Increase size of buffer used in MBM and MBA tests
  selftests/resctrl: Support multiple events associated with iMC
  selftests/resctrl: Prepare for parsing multiple events per iMC
  selftests/resctrl: Do not store iMC counter value in counter config structure
  selftests/resctrl: Reduce interference from L2 occupancy during cache occupancy test
  selftests/resctrl: Improve accuracy of cache occupancy test
  docs: kselftest: Document the FORCE_TARGETS build variable
…nel/git/trace/linux-trace

Pull bootconfig updates from Masami Hiramatsu:

 - bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c

   Move the xbc_snprint_cmdline() function and its buffer from
   main.c to the shared lib/bootconfig.c parser library so it
   can be reused by userspace tools.

 - render kernel.* subtree as cmdline string with -C

   Add a new -C option to print the kernel.* subtree as a flat
   command-line string at build time, allowing early parameter
   injection without runtime parsing.

* tag 'bootconfig-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  tools/bootconfig: render kernel.* subtree as cmdline string with -C
  bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c
…git/trace/linux-trace

Pull probes updates from Masami Hiramatsu:

 - BTF support for dereferencing pointers

   Add syntax to the parsing of eprobes to typecast structure pointer
   trace event fields, enabling BTF-based dereferencing instead of
   relying on manual offsets.

 - Improvements and robustness enhancements

    - Use flexible array for entry fetch code.

      Store probe entry fetch instructions in the probe_entry_arg
      allocation via a flexible array member to simplify memory
      allocation and lifetime management.

    - Replace BUG_ON with lockdep_assert_held in uprobe_buffer functions

      Replace BUG_ON() calls with lockdep_assert_held() in uprobe buffer
      enable/disable paths to prevent kernel crashes and better verify
      lock ownership.

    - Ensure the uprobe buffer size is bigger than event size.

      Add a BUILD_BUG_ON() assertion to guarantee that the per-CPU
      uprobe working buffer size is always larger than the maximum probe
      event size.

* tag 'probes-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  tracing/eprobes: Allow use of BTF names to dereference pointers
  tracing: Replace BUG_ON with lockdep_assert_held in uprobe_buffer functions
  tracing: Use flexible array for entry fetch code
  tracing/probes: Ensure the uprobe buffer size is bigger than event size
…kernel/git/trace/linux-trace

Pull tracing latency updates from Steven Rostedt:

 - Dump the stack to the buffer on timerlat uret threashold event

   Record the stack trace in the buffer for THREAD_URET as well as
   THREAD_CONTEXT when the threshold is hit. Otherwise, if the threshold
   was not hit at task wakeup, but was at task return, it will not
   produce a stack trace making it harder to debug.

 - Have osnoise trace prints print to all buffers

   The osnoise tracer is allowed to print to the main buffer. Add a
   osnoise_print() helper function and use trace_array_vprintk() to
   print osnoise output.

* tag 'trace-latency-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  tracing/osnoise: Array printk init and cleanup
  tracing/osnoise: Dump stack on timerlat uret threshold event
…rnel/git/trace/linux-trace

Pull RTLA tool updates from Steven Rostedt:

 - Fix discrepancy in --dump-tasks option

   Due to a mistake, rtla-timerlat-hist used the CLI syntax
   "--dump-task" instead of the documented "--dump-tasks". Change the
   option to match both documentation and the other timerlat tool,
   rtla-timerlat-top.

 - Extend coverage of runtime tests

   Cover both top and hist tools in all applicable test cases, add tests
   for a few uncovered options, and extend checks for some existing
   tests.

 - Add unit tests for actions

   rtla's actions feature is implemented in its source file and contains
   non-trivial parsing logic. Cover it with unit tests.

 - Stop record trace on interrupt

   Fix a bug where an interval exists after receiving a signal in which
   the main instance is stopped but the record instance is not, leading
   to discrepancies in reported results and sometimes rtla hanging.

 - Restore continue flag in actions_perform()

   Fix a bug where rtla always continues tracing after hitting a
   threshold even if the continue action was triggered just once, and
   add tests verifying that the flag is reset properly.

 - Migrate command line interface to libsubcmd

   Replace rtla's argument parsing using getopt_long() with libsubcmd,
   used by perf and objtool, to reuse existing code and auto-generate
   better help messages. Extensive unit tests are included to detect
   regressions.

 - Add -A/--aligned option to timerlat tools

   Add an option to align timerlat threads, based on the recently
   introduced TIMERLAT_ALIGN option of the timerlat tracer, together
   with unit tests and documentation.

 - Document tests in README

   Document how to run unit and runtime tests in rtla's README.txt,
   including the dependencies needed to run them.

* tag 'trace-tools-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (26 commits)
  rtla: Document tests in README
  Documentation/rtla: Add -A/--aligned option
  rtla/tests: Add unit tests for -A/--aligned option
  rtla/timerlat: Add -A/--aligned CLI option
  rtla/tests: Add unit tests for CLI option callbacks
  rtla/tests: Add unit tests for _parse_args() functions
  rtla: Parse cmdline using libsubcmd
  tools subcmd: allow parsing distinct --opt and --no-opt
  tools subcmd: support optarg as separate argument
  rtla: Add libsubcmd dependency
  rtla/tests: Add runtime tests for restoring continue flag
  rtla/tests: Run runtime tests in temporary directory
  rtla/tests: Add unit test for restoring continue flag
  rtla/actions: Restore continue flag in actions_perform()
  rtla: Stop the record trace on interrupt
  rtla/tests: Add unit tests for actions module
  rtla/tests: Add runtime tests for -C/--cgroup
  rtla/tests: Add runtime test for -k and -u options
  rtla/tests: Add runtime test for -H/--house-keeping
  rtla/tests: Cover all hist options in runtime tests
  ...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.