Since currently dedicated EROFS-owned meta inodes are used for
file-backed mounts, .read_folio() checks are now redundant.
As a result, EROFS file-back mounts can now apply to tmpfs too.
Fixes: e587a984d3 ("erofs: use dedicated meta inodes for file-backed mounts")
Signed-off-by: Gao Xiang (Docker) <[email protected]>
superblock_share together with device= is rejected in
erofs_fc_fill_super():
if (test_opt(&sbi->opt, SUPERBLOCK_SHARE) &&
sbi->devs->extra_devices)
return -EINVAL;
but extra_devices is kept in sbi->devs, not in sbi->opt, and
erofs_sb_share_test_super() compares only the backing inode, the
fsoffset and sbi->opt. So once the image is mounted with
superblock_share, a second mount with superblock_share,device= matches
that superblock and get_tree_super() reuses it without calling
fill_super() at all.
The same command line therefore either fails with -EINVAL or succeeds
with device= quietly dropped, depending on whether a compatible mount
already exists.
Refuse to match a context that brought device= options, so that it gets
a superblock of its own and fill_super() decides as it does today.
Only the incoming context can be tested: a shared superblock may have
extra_devices set itself, because erofs_scan_devices() fills the device
table from the image when no device= was given.
Fixes: cd4108319b ("erofs: reuse superblock for file-backed mounts")
Signed-off-by: Zhan Xusheng <[email protected]>
Reviewed-by: Gao Xiang <[email protected]>
Signed-off-by: Gao Xiang (Docker) <[email protected]>
Commit e587a984d3 ("erofs: use dedicated meta inodes for file-backed
mounts") made erofs_read_meta_folio() read the metadata of a
file-backed mount one whole folio at a time.
However, an image only has to be a multiple of its block size. With a
block size below the page size, it can end in the middle of a page. The
read of that last page is then short, and erofs_fileio_ki_complete()
fails it with -EIO. As of now, inodes in the last page of such an image
cannot be read, and an image smaller than a page cannot be mounted.
The issue can be reproduced with util-linux 2.41, whose mount uses the
image file directly:
mkdir src
for i in $(seq 50); do echo $i > src/$i; done
mkfs.erofs -b512 test.erofs src
mount -t erofs test.erofs /mnt
ls -l /mnt
Before that commit, ls -l lists all 50 files. After it, ls -l reports
"Input/output error" for 24 of them.
This patch reads the folio only up to the end of the backing file and
zeroes the rest, as the page cache of the backing file did before. A
folio that lies wholly past the end is zeroed without a read.
Fixes: e587a984d3 ("erofs: use dedicated meta inodes for file-backed mounts")
Cc: [email protected]
Signed-off-by: Hengyu Liang <[email protected]>
Reviewed-by: Gao Xiang <[email protected]>
Signed-off-by: Gao Xiang (Docker) <[email protected]>
EROFS page cache sharing uses shared inodes. However, a mmaped VMA
keeps the shared file even after the corresponding fd is closed, while
currently the real inode is never held by any reference associated
with the shared file.
As a result, the real inode could be evicted and removed from the
shared inode's list while the page fault can still invoke on the
shared inode's address space, which causes no candidate is
successfully acquired by erofs_real_inode().
Fix this by simply keeping the original inode in the shared backing
file's private data.
Also replace confusing "realfile"/"rf" names with "sf" (sharedfile)
to unify the terms as well as nullify realinode in erofs_real_inode()
to avoid returning an uninitialized pointer.
Fixes: 5ef3208e3b ("erofs: introduce the page cache share feature")
Reported-by: YoungWoo Rim <[email protected]>
Closes: https://lore.kernel.org/r/atzSVuvqYKgmvDmO@MacBookPro
Cc: [email protected] # 7.0+
Reviewed-by: Chao Yu <[email protected]>
Signed-off-by: Gao Xiang (Docker) <[email protected]>
Iomap supports non-bdev I/O through fs-provided callbacks since
commit b2f35ac414 ("iomap: add caller-provided callbacks for read
and readahead"), making it suitable for file-backed mounts on unencoded
inodes.
Enable iomap for this case to support sub-folio buffered I/Os on
file-backed mounts and simplify the codebase.
Thanks-to: Hongbo Li <[email protected]>
Reviewed-by: Chao Yu <[email protected]>
Signed-off-by: Gao Xiang (Docker) <[email protected]>
z_erofs_load_lz4_config() rejects a valid LZ4 image when the kernel's
page size differs from the image's block size. It bounds the on-disk
max_pclusterblks with erofs_blknr(sb, Z_EROFS_PCLUSTER_MAX_SIZE), which
expands to Z_EROFS_PCLUSTER_MAX_SIZE >> sb->s_blocksize_bits.
At the point this runs, sb->s_blocksize_bits still holds PAGE_SHIFT:
erofs_fc_fill_super() seeds s_blocksize_bits to PAGE_SHIFT before
reading the superblock, and only corrects it down to the on-disk
blkszbits after erofs_read_superblock() returns. The LZ4 config is
parsed inside erofs_read_superblock(), before that correction, so the
bound is computed with the wrong shift.
On a 64K-page kernel mounting a 4K-block image (e.g. one built with
mkfs.erofs -C 262144 on a 4K-page host), the bound evaluates to
1 MiB >> 16 = 16 blocks instead of the correct 1 MiB >> 12 = 256
blocks. The image's legitimate max_pclusterblks of 64 then fails the
check, mount returns -EINVAL, and booting from such an image as the
root filesystem panics:
erofs (device dm-0): too large lz4 pclusterblks 64
Kernel panic - not syncing: VFS: Unable to mount root fs
sbi->blkszbits already holds the on-disk block size at this point, so
compute the bound from it directly. This makes the check independent of
the host page size and of superblock-parse ordering.
commit 3acea5fc33 ("erofs: avoid hardcoded blocksize for subpage block
support") already handled the same ordering hazard for the superblock
checksum path by using sbi->blkszbits in erofs_superblock_csum_verify();
the lz4 config path was missed.
Fixes: 3acea5fc33 ("erofs: avoid hardcoded blocksize for subpage block support")
Cc: [email protected]
Assisted-by: Kirocrew:gpt-5.6-sol
Signed-off-by: Gyokhan Kochmarla <[email protected]>
Reviewed-by: Gao Xiang <[email protected]>
Signed-off-by: Gao Xiang <[email protected]>
I recently got a new job; update my mailmap entry to indicate my
new legal work email address (though I'm not sure I will use it
in the very near future).
Signed-off-by: Gao Xiang <[email protected]>
Acked-by: Chao Yu <[email protected]>
Signed-off-by: Gao Xiang <[email protected]>
When the same file-backed image is mounted multiple times (via path or
fd) with the superblock_share mount option, reuse the existing
superblock instead of creating a new one. This allows multiple mounts
of the same image to share in-kernel data structures more efficiently.
The backing file is identified by its inode and fsoffset. If mount
options conflict or extra devices are used, a separate superblock
is created transparently as a fallback. Remount is not allowed on
shared superblocks.
Tested by mounting a 177M Fedora EROFS image 20 times with full
traversal:
#!/bin/sh
IMG=${1:-/root/fedora.erofs}
OPTS=${2:+-o $2}
N=20
DIR=$(mktemp -d)
trap "umount $DIR/m* 2>/dev/null; rm -rf $DIR" EXIT
sync; echo 3 > /proc/sys/vm/drop_caches
INODES_BEFORE=$(grep erofs_inode /proc/slabinfo | awk '{print $2}')
MEM_BEFORE=$(grep ^Slab: /proc/meminfo | awk '{print $2}')
for i in $(seq 1 $N); do
mkdir $DIR/m$i
mount -t erofs $OPTS "$IMG" $DIR/m$i
find $DIR/m$i > /dev/null
done
echo "Superblocks: $(grep $DIR /proc/self/mountinfo | \
awk '{print $3}' | sort -u | wc -l)"
echo "erofs_inode delta: +$(( $(grep erofs_inode /proc/slabinfo | \
awk '{print $2}') - INODES_BEFORE ))"
echo "Slab delta: +$(( $(grep ^Slab: /proc/meminfo | \
awk '{print $2}') - MEM_BEFORE )) kB"
without superblock_share:
# time ./test.sh /root/fedora.erofs
Superblocks: 20
erofs_inode delta: +45864
Slab delta: +37448 kB
real 0m2.311s
user 0m0.222s
sys 0m1.998s
with superblock_share:
# time ./test.sh /root/fedora.erofs superblock_share
Superblocks: 1
erofs_inode delta: +2044
Slab delta: +284 kB
real 0m0.679s
user 0m0.157s
sys 0m0.469s
The time difference shows that sharing the superblock also benefits
the page cache and inode cache, as subsequent mounts of the same image
avoid re-reading the backing file. This is particularly useful for
container hosts running multiple containers from the same base image.
Signed-off-by: Giuseppe Scrivano <[email protected]>
Reviewed-by: Gao Xiang <[email protected]>
Signed-off-by: Gao Xiang <[email protected]>
Pull 'vfs-7.4.shared.super' to support shared superblocks for EROFS
file-backed mounts, which would be better to merge through the VFS tree.
Cc: Christian Brauner <[email protected]>
Signed-off-by: Gao Xiang <[email protected]>
Rename and export it so filesystems that need a custom superblock
matching policy can reuse it directly instead of open-coding sget_fc()
+ fill_super(). No functional change.
This is a preparatory fix for the next patch.
Signed-off-by: Giuseppe Scrivano <[email protected]>
Link: https://patch.msgid.link/[email protected]
Reviewed-by: Christoph Hellwig <[email protected]>
Reviewed-by: Jan Kara <[email protected]>
Signed-off-by: Christian Brauner (Amutable) <[email protected]>
The EROFS entry lists the git tree without a branch, so tools that
derive a baseline from MAINTAINERS, e.g. sashiko, fall back to the
remote HEAD, which points to master. master only moves at -rc1, so
series developed against the dev branch fail to apply there.
Name the dev branch explicitly, where erofs patches are queued.
Signed-off-by: Chao Yu <[email protected]>
Acked-by: Gao Xiang <[email protected]>
Signed-off-by: Gao Xiang <[email protected]>
erofs_bread() reuses a cached folio on page index match without
checking folio->mapping.
xattr.c calls erofs_init_metabuf() twice on the same buffer without
erofs_put_metabuf(); the two in_metabox sources differ, so buf->mapping
can switch while buf->page still belongs to the old address_space.
The next erofs_bread() then reads the wrong mapping, dropping shared
xattrs with METABOX.
We require folio->mapping == buf->mapping in the reuse check; otherwise
drop the cached folio and re-read via the slow path.
Fixes: 414091322c ("erofs: implement metadata compression")
Cc: Bo Liu (OpenAnolis) <[email protected]>
Signed-off-by: Binglei Wang <[email protected]>
Reviewed-by: Gao Xiang <[email protected]>
Reviewed-by: Chao Yu <[email protected]>
Signed-off-by: Gao Xiang <[email protected]>
Pull i2c fixes from Andi Shyti:
"Three patches in xiic for fixing the block reads and a single cleanup
in the at91 error path:
- at91: also release DMA channels when deferring probe
- xiic: fix SMBus block reads with PEC"
* tag 'i2c-fixes-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux:
i2c: at91: release DMA channels when probe defers
i2c: xiic: don't clobber msg->len to signal block-read completion
i2c: xiic: defer RX_FULL until all trailing bytes are in FIFO
i2c: xiic: preserve PEC byte length in SMBus block read setup
Pull x86 fixes from Ingo Molnar:
- Don't apply va_align to hugetlb mappings on AMD F15h systems
that have custom va_align.bits values (Laurent Wandrebeck)
- Fix PMD teardown handling regression flagged by lockdep
(Mikhail Gavrilov)
- Hide ptrace header register offset macros behind __ASSEMBLER__ or
__FRAME_OFFSETS, to fix user-space build errors that may trigger
if they happen to shadow these short and generic macro names
(Nick Desaulniers)
* tag 'x86-urgent-2026-10-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
{x86,um}/uapi/ptrace: Guard register offset macros with __ASSEMBLER__ or __FRAME_OFFSETS
x86/mm: Drop unnecessary PMD page copy when freeing
x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h
Pull timer fix from Ingo Molnar:
- Fix task work flags management regression in the hrtimer
rearming code that can leave task work items unprocessed
(Karl Mehltretter)
* tag 'timers-urgent-2026-10-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
hrtimer: Use the mask to clear TIF_HRTIMER_REARM from the exit work
Pull perf events fixes from Ingo Molnar:
- Fix race between perf_event_exit_task() and perf_pending_task()
(Luo Gengkun)
- Fix perf header output management regressions (Ian Rogers)
- Require kernel access for text poke events (Zhengchuan Liang)
* tag 'perf-urgent-2026-10-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
perf: Require kernel access for text poke events
perf: Replace perf_event_header__init_id with full header init
perf: Fix race between perf_event_exit_task() and perf_pending_task()
Pull locking fixes from Ingo Molnar:
- Don't run refcount kunit self-test when !CONFIG_KUNIT_ALL_TESTS
(Kuan-Wei Chiu)
- Fix futex private hash use-after-free on resize (Chris Mason)
* tag 'locking-urgent-2026-10-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
futex: Fix private hash use-after-free on resize
irq: Make refcount_interrupt kunit test selectable
Pull EDAC fixes from Borislav Petkov:
"This is more of the new normal of LLM-induced fixes of error paths. Oh
well, they should be done eventually and hopefully we'll be back to
normal soon-ish... one would hope... :-P
AMD Versal NET:
- Properly release a remote processor reference which was acquired at
probe time, on memory controller instance remove
A handful of Altera EDAC driver fixes:
- Fix device node reference leaks covering both the success path and
the various error paths, and route the single-bit setup function
through the common exit label
- Fix a use-after-free by releasing the devres group before freeing
the control info structure in the error paths, since managed IRQ
handlers could reference the freed dci struct if they fire at just
the right time
- Fix a memory leak by freeing the allocated control info structure
when the devres group open fails in the Altera SDMMC setup path
- Remove the __init marking from the Altera Arria10 setup paths and
their helpers so they remain safely callable at runtime, including
after deferred or re-triggered probing
- Prevent the Altera driver from being unbound by removing their
->remove callbacks and marking them to suppress bind/unbind sysfs
attributes, since unbinding could erase active system memory"
* tag 'edac_urgent_for_v7.3_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras:
EDAC/versalnet: Drop remote processor handle refcount on driver removal
EDAC/altera: Fix device node reference leaks in the SDMMC ECC setup
EDAC/altera: Fix use-after-free in error paths
EDAC/altera: Fix memory leak on dci allocation failure
EDAC/altera: Drop __init from ECC setup paths for re-probe safety
EDAC/altera: Do not allow driver unbinding
Pull clk fixes from Brian Masney:
"Two small clk driver fixes:
- spacemit: k3: Fix an issue that will trigger a system hang due to
unavailable frequency
- ti: composite: Reverts a commit that breaks OMAP3"
* tag 'clk-fixes-for-linus-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
clk: spacemit: k3: add CPU PLL rate tables
clk: ti: composite: resolve parent clocks by name again
Pull char/misc/IIO fixes from Greg KH:
"Here is a set of char/misc/iio and other small driver subsystem fixes
for 7.3-rc6 that resolve a number of reported issues. Included in here
are:
- lots of small iio driver fixes for reported problems
- interconnect driver revert to resolve a regression
- nitro_enclaves driver fix for a use-after-free
- binder driver fixes for reported problems (in both the rust and C
versions)
All of these have been in linux-next with no reported issues"
* tag 'char-misc-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (63 commits)
iio: adc: ad_sigma_delta: fix use-after-free on unbind
iio: accel: kxcjk-1013: reject duplicate event disable
iio: buffer: serialize buffer teardown with mode claims
iio: cdc: ad7150: fix OF matching and publish module aliases
iio: adc: ade9000: fix NULL pointer dereference in clkout registration
iio: adc: ad4030: fix invalid oversampling_ratio validation
iio: adc: ad7173: Fix digital filter configuration
iio: adc: stm32-adc: fix possible division by zero in processed channel
iio: adc: stm32-adc: fix check on internal channel availability
iio: proximity: isl29501: Fix return type of isl29501_register_write
iio: imu: inv_icm42607: restore runtime PM on system resume errors
iio: imu: inv_icm42607: propagate runtime suspend errors
iio: adc: pac1934: check ACPI label duplication
rust_binderfs: add transaction_report feature entry
rust_binder: reschedule node refcount update on thread exit
rust_binder: cancel deferred work items in thread exit
binderfs: fix UAF write in binder_add_device
binder: fix is_failure flag for superseded transaction cleanup
binder: fix leaked fd fixups on TF_UPDATE_TXN supersede
Revert "interconnect: qcom: x1e80100: enable QoS configuration"
...
Pull tty/serial fixes from Greg KH:
"Here are some small tty/serial driver fixes for 7.3-rc6. Nothing major
here, just lots of small fixes for reported issues, some of them very
long-standing:
- tty hangup fixes that have been there since the BKL days and kept
tripping people up over time.
- vt selection bugfix
- other vt bugfixes (memory leaks and screen update fixes)
- n_gsm bugfix
- qcom-geni serial driver bugfix
- 8250 serial driver bugfixes
- other tiny serial driver fixes
All of these have been in linux-next, the last few only a few days but
testing here seems solid (this pull request was generated on that
tree)"
* tag 'tty-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (37 commits)
tty: add missing driver flag kernel-doc colon
vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()
vt: skip screen update for DEC alignment test on backgroup consoles
vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF
serial: sc16is7xx: reduce TX refill rate with half-FIFO trigger
serial: sc16is7xx: refill TX FIFO below trigger using fresh TXLVL
serial: tegra: don't clear the Tx FIFO on an Rx-only reset
serial: sc16is7xx: fix TX gap caused by kfifo circular buffer wrap-around
tty: fix saved termios reset race
tty: serial: mpc52xx_uart: move static declarations up.
tty: serial: max3100: shut down timer before freeing port
tty: add break_wait kernel-doc
serial: qcom-geni: keep registered console runtime active
serial: qcom-geni: Fix unbalanced runtime PM resume for no_console_suspend
serial: qcom-geni: avoid unused-function warning
tty: serial: qcom_geni_serial: Keep console RX functional after deep idle
soc: qcom: geni-se: Correct QUP Core ICC vote constants
serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()
serial: vt8500: Fix clock reference leak in vt8500_serial_probe()
kgdboc: Fix tty driver reference leak in configure_kgdboc()
...
Pull USB/Thunderbolt fixes from Greg KH:
"Here is a big set of USB and Thunderbolt driver fixes for 7.3-rc6.
They were delayed on my side due to conference travel, not the fault
of the submitters at all. Included in here are:
- lots of small thunderbolt fixes for reported issues due to more
testing and devices and a few reverts as well based on that work
- more usb-serial device ids added
- usb-serial and cdc-acm driver hangup and other fixes
- dwc3 driver fixes for reported problems
- lots of usb gadget driver fixes as people again fuzz these drivers
and send in fixes, which is nice to finally see
- typec driver fixes for reported problems
- octeon-hcd driver fixes for reported problems
- more usb-storage quirks added
- other small USB driver bugs resolved for reported problems
All of these have been in linux-next without any reported issues"
* tag 'usb-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (63 commits)
usb: dwc3: gadget: fix IRQ storm on invalid event buffer count
Revert "usb: dwc3: gadget: fix IRQ storm on invalid event buffer count"
USB: gadget: dummy-hcd: Fix wait for outstanding request completions
usb: typec: port-mapper: Only match USB4 port if host interface is available
usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe
usb: dwc3: gadget: fix IRQ storm on invalid event buffer count
usb: typec: ucsi: Get the connector fwnode based on reg value
usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd
usb: core: clear both ep_in and ep_out for non-ep0 control endpoints
USB: cdc-acm: skip URB restart in port_shutdown if disconnected
usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC
usb: gadget: aspeed-vhub: cancel wake work on device removal
thunderbolt: Disable CL states for the Anker Prime TB5 dock
thunderbolt: stream: Announce support for FMODE_NOWAIT
usb: typec: ucsi: displayport: Current CAM OOB index fixup
usb: ohci-st: disable controller wakeup on removal
usb: ohci-spear: disable controller wakeup on removal
usb: ohci-s3c2410: disable controller wakeup on removal
usb: ohci-da8xx: disable controller wakeup on cleanup
usb: cdns3: fix use-after-free in cdns3_gadget_exit()
...
Pull input fixes from Dmitry Torokhov:
- A fix for the Samsung S6SY761 touchscreen driver to power on the
controller before unmasking interrupts during resume and to re-enable
touch sensing when the device is open
- Updates to the Synaptics touchpad driver to enable SMBus/RMI4 mode on
Lenovo ThinkPad T490 and restrict the ThinkPad T440p InterTouch
disable quirk to LEN0036 so that ThinkPad L440 retains SMBus support
- A quirk for the AT keyboard driver (atkbd) to skip keyboard
deactivation on Lenovo IdeaPad Slim 3 15IWC11 so the internal
keyboard functions properly
- A DMI quirk for the i8042 controller to disable active multiplexing
on Fujitsu LIFEBOOK U7410, preventing the internal keyboard and
touchpad from dying shortly after boot.
* tag 'input-for-v7.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11
Input: s6sy761 - fix resume ordering and restore sensing
Input: synaptics - limit T440p InterTouch quirk to LEN0036
Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410
Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490
Pull drm fixes from Dave Airlie:
"Live from Brisbane airport, it's Saturday Night drm fixes.
The misc fixes tree didn't get a PR this week, so I'll probably have
that to you when I see it, there were a few patches in there.
Otherwise amdgpu is the main act, mediatek has a guest spot, and
xe/i915 bring in a fix each.
xe:
- keep VF LMEM bar size low if no VFs enabled
i915:
- Disable VRR DC balance by default to fix timing issues
mediatek:
- Add missing IS_ERR check for ovl_adaptor platform device
- Fix VID_DOWNSAMPLE_CONFIG register offset
- Fix pdev reference leak in mtk_drm_bind()
- Fix runtime PM leak in mtk_hdmi_ddc_v2_probe()
- Fix ovl adaptor platform device leak
amdgpu:
- dc_state_create_copy() fix
- HDMI RGB limited range fix
- eDP ASSR fix
- DCE 6 fixes
- DCE 8.1 fix
- SI DPM fixes
- Reset fixes
- Workaround for multiple SDMA entities with DCC
- PWM backlight fix
- GPUVM fixes
- Switcheroo fix
- Error handling leak fixes
- GC 6 unload FW leak fix
- SDMA 7.1 fix
- DML frame size limit fix
- RGB vs YCbCr 4:4:4 fix
- DP MST fix
- DC Power module fixes
- MacBookPro14,3 fix
amdkfd:
- SVM fix
radeon:
- sparc64 fix"
* tag 'drm-fixes-2026-10-03' of https://gitlab.freedesktop.org/drm/kernel: (36 commits)
drm/mediatek: Fix ovl adaptor platform device leak
drm/mediatek: Fix runtime PM leak in mtk_hdmi_ddc_v2_probe()
drm/mediatek: Fix pdev reference leak in mtk_drm_bind()
drm/amdgpu: reset VI ASIC on MacBookPro14,3
drm/amd/pm/si: Fix updating clock limits on AC/DC
drm/amd/display: Fix stale replay_events after mod_power stream removal
drm/radeon: Read the VRAM VBIOS signature with readb()
drm/amd/display: guard dc_sink dereferences in MST mode validation
drm/amd/display: Try RGB before YCbCr 4:4:4 in stream validation
drm/amd/display: Fix sanitizer check for the DML frame size limit
drm/amdgpu/gmc12.1: properly pass flush_type to gmc_v12_1_flush_vm_hub()
drm/amdgpu: drop userq callback assignment for sdma 7.1
drm/amdgpu/gfx6: fix firmware leak on teardown
drm/amdgpu: fix ACP MFD device leak on init failure
drm/amdgpu: fix IP instance memory leak on kobject add failure
drm/amdgpu: skip the noirq suspend reset for a switcheroo-parked GPU
drm/amdgpu/gmc12: properly pass flush_type to gmc_v12_0_flush_vm_hub()
drm/amd/display: map PWM brightness through custom backlight curve
drm/amdgpu: implement workaround for sdma dcc corruption
drm/amdkfd: Fix always mapped range mapping to all ACCESS GPUs
...
Pull arm64 fixes from Will Deacon:
"Half of this is broken hardware (AMU counters and TLB invalidation)
and the other half is broken software (frequency scaling and signals).
So it seems as though we're all as bad as each other.
The AMU workaround is a little noisy, as it refactors an existing
workaround so that it can more easily be applied to additional CPUs.
Summary:
- Fix handling of CPU erratum #2645198 when batching pte updates
- Fix truncation of CPU frequency calculation by using 64-bit
arithmetic in arch_freq_get_on_cpu()
- Work around AMU erratum #3821522 on Cortex-A725
- Fix panic when trying to restore an SVE sigframe on a CPU that only
supports SME"
* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems
arm64: errata: Add Cortex-A725 erratum 3821522 workaround
arm64: errata: Factor out broken AMU const counter cap
arm64: topology: fix arch_freq_get_on_cpu() overflow above 4.19 GHz
arm64: mm: Fix the break-before-make flush range for erratum 2645198
The internal keyboard on the Lenovo IdeaPad Slim 3 15IWC11 (83RR)
does not work correctly with the default i8042 settings. Using
i8042.nopnp=1 and i8042.dumbkbd=1 restores keyboard input, but prevents
the Caps Lock LED from working. Using i8042.nopnp=1 alone does not fix
the keyboard.
The laptop works correctly when atkbd_deactivate_fixup is used instead.
Add a DMI quirk for the 83RR to enable it.
This was tested without any i8042 command-line parameters. Keyboard
input and the Caps Lock LED work correctly, including after suspend
and resume and after a cold boot.
Link: https://lore.kernel.org/all/[email protected]/
Signed-off-by: Martino Papero <[email protected]>
Reviewed-by: Hans de Goede <[email protected]>
Link: https://patch.msgid.link/[email protected]
Cc: [email protected]
Signed-off-by: Dmitry Torokhov <[email protected]>
Pull probes fixes from Masami Hiramatsu:
- fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()
Exit handlers early if !rcu_is_watching() to prevent potential
use-after-free during unregistration in idle/quiescent states. Switch
to guard(rcu_sched_notrace) to avoid fast-path lockdep overhead and
recursion while ensuring safe grace period synchronization.
- kprobes: Skip disarmed probes when checking optkprobe overlap
Continue past disarmed or unprepared probes in get_optimized_kprobe()
to find active optimized probes. This avoids overwriting active jump
displacements which can lead to panic.
* tag 'probes-fixes-v7.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
kprobes: Skip disarmed probes when checking optkprobe overlap
fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()
Pull smb client fixes from Paulo Alcantara:
"Fix a series of data corruption and I/O error bugs found by running
generic/363 (fsx) in a loop against Windows Server 2022 and Samba.
- Stop data dirtied past EOF through an mmap from reappearing as file
content once the file is extended by a write, truncate, zero range,
copy range or clone range
- Flush dirty data and drain in-flight I/O before operations that
assume the pagecache and the server agree on the file: querying
allocated ranges, the O_TRUNC open, interior zero range, and
server-side copy/clone
- Stop a genuine size-extending zero range or preallocate from being
refused with -EOPNOTSUPP when the inode is not read caching, by
querying the server's authoritative EOF instead of trusting a stale
cached i_size
- Zero the untransferred tail of a short read, both in the netfs
read-gaps path (where stale folio content could otherwise be
written back to the server) and in the DIO/unbuffered read
collector, and tell a real EOF apart from a stale cached
remote_i_size after a lease downgrade
- Require stable pages on signed connections so a buffered write
can't modify a folio whose signature has already been computed and
is in flight, which the server rejected with STATUS_ACCESS_DENIED
and the client surfaced as -EIO
- Split several cifsFileInfo flags out of a shared bitfield byte so
concurrent updates taken under different locks no longer clobber
each other through a byte-level RMW"
* tag 'cifs-fixes-7.3-rc6' of https://git.manguebit.org/linux:
smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races
smb: client: require stable pages for signed connections
smb: client: distinguish real EOF from a stale remote_i_size on read
netfs: zero the tail of a short DIO/unbuffered read
smb: client: only require read lease for size-extending preallocate
netfs: zero gaps in read-gaps folio to avoid writing back stale data
smb: client: only require read lease for size-extending zero range
smb: client: drain and invalidate before server-side copy/clone
smb: client: flush dirty data before zeroing a range
smb: client: drain outstanding I/O before truncating on O_TRUNC open
smb: client: flush and commit data before querying allocated ranges
smb: client: discard post-EOF pagecache when extending a file via clone range
smb: client: discard post-EOF pagecache when extending a file via copy range
smb: client: discard post-EOF pagecache when extending a file via zero range
smb: client: clear post-EOF pagecache when extending a file via truncate
netfs: clear post-EOF pagecache when extending a file via write
Pull bpf fixes from Alexei Starovoitov:
- Fix overflow of backward jump offset in constant blinding
(Alexei Starovoitov)
- Fix packet range of packet pointers sharing an id when var_off
tightens umax of one pointer and not the other (Alexei Starovoitov)
- Fix objects stuck in free_by_rcu_ttrace list of bpf memalloc
(Alexei Starovoitov)
- Fix use-after-free of progs detached from busy trampolines: wait for
an RCU tasks grace period before freeing trampoline progs, and patch
detached progs out of trampoline images that are still in use
(Florent Revest)
- Hold map BTF for the memory allocator destructor record to fix UAF in
deferred bpf_mem_alloc destruction (Kumar Kartikeya Dwivedi)
- Fix missing migration protection in resizable hashtab
lookup_and_delete batch operation (Ömer Mete Kaya)
* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch()
selftests/bpf: Add a test for objects stuck in free_by_rcu_ttrace
bpf: Fix objects stuck in free_by_rcu_ttrace
bpf: Factor out __do_call_rcu_ttrace()
selftests/bpf: Test packet range of pointers sharing an id
bpf: Fix packet range of pointers sharing an id
selftests/bpf: Detach a trampoline prog while a task sleeps before it
bpf: Skip detached progs in trampoline images that are still in use
bpf: Wait for an RCU tasks grace period before freeing trampoline progs
bpf: Hold map BTF for the memory allocator destructor record
bpf: Fix overflow of jump offset in constant blinding
Pull PCI fix from Bjorn Helgaas:
- Allow driver to use AtomicOps if already enabled by hypervisor; fixes
regression when Root Port is not visible in a guest (Nikola Prica)
* tag 'pci-v7.3-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:
PCI: Accept AtomicOps already enabled by the hypervisor
Pull block fixes from Jens Axboe:
- NVMe fixes via Keith:
- Fix an out-of-bounds write in nvmet_auth_challenge(), where
sizeof() on a void pointer undercounted the challenge header and
let a short AUTH_RECEIVE buffer pass the check
- nvme-multipath fixes for an ANA log bounds check underflow, the
command effects log lifetime for multipath heads, and only
setting BLK_FEAT_ZONED after the zone info is known.
- nvmet fixes for ns->enabled teardown ordering, rejecting I/O
after the percpu ns reference is killed, device path preservation
on allocation failure, and too-short SGL segments in pci-epf
- nvme-tcp: revert the per-socket dynamic lockdep keys, and delay
the socket reclassification
- A DMA pool alignment quirk for the Micron 4100AT
- Controller state/reset race fixes, and -Wformat-security
workarounds
- blk-mq: set RQF_USE_SCHED when the operation is known, and allow
cached requests to be used for flush operations
- Reject polled dio with user integrity metadata
- Save the IRQ state in blkg_tryget_closest()
- Set the zone write granularity in virtio_blk
- ublk selftest fixes
* tag 'block-7.3-20261002' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (23 commits)
virtio_blk: set the zone write granularity
nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known
nvme: fix command effects log lifetime for multipath heads
nvmet: don't allow I/O admission after percpu ns reference is killed
nvmet: defer setting ns->enabled to false in nvmet_ns_disable()
nvmet: copy the hostid into the ctrl before creating PR pc_refs
nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()
nvmet: pci-epf: reject too-short SGL segments
nvme-multipath: fix underflow in ANA log bounds checks
nvme: work around all -Wformat-security warnings
nvme: work around -Wformat-security warning
nvme: do not reset controllers in NVME_CTRL_NEW state
nvme-tcp: delay nvme_tcp_reclassify_socket()
Revert "nvme-tcp: lockdep: use dynamic lockdep keys per socket instance"
drbd: remove unused drbd_nl_mcgrps[] array
blk-mq: allow cached requests to be used for flush operations
blk-mq: set RQF_USE_SCHED when the operation is known
block: reject polled dio with user integrity metadata
selftests: ublk: fix unused_result error
blk-cgroup: save IRQ state in blkg_tryget_closest()
...
Pull io_uring fixes from Jens Axboe:
- Fix a task_work add use-after-free with SQPOLL.
The sqpoll thread could pop and complete the last request while
io_req_normal_work_add() was still looking at them after the mpscq
push.
Use the same approach as DEFER_TASKRUN to protect from that, holding
an RCU read lock across the add, and have exit wait for an RCU grace
period for SQPOLL rings as well.
- CQE32 ring fixes: correct the free entry check for 32b CQEs, zero the
big_cqe for aux CQEs, and only post the dummy skip CQE on CQE_MIXED
rings
- Mark the source filter table as COW when cloning bpf filters, so
registering another filter on the source doesn't modify the shared
table in place
- Initialize the task context before running the BPF loop
- Requeue zcrx multishot receives stopped by a local resource
- End a TX_TIMESTAMP multishot cmd when the CQ is full (lollipopkit)
* tag 'io_uring-7.3-20261002' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
io_uring: fix task_work add use-after-free with SQPOLL
io_uring/cmd_net: end TX_TIMESTAMP multishot when the CQ is full
io_uring/zcrx: requeue multishot receives stopped by a local resource
io_uring: initialize task context before running the BPF loop
io_uring: zero big_cqe for aux CQEs on CQE32 rings
io_uring: fix free entry check for 32b CQEs on CQE32 rings
io_uring: only post the dummy skip CQE on CQE_MIXED rings
io_uring/bpf_filter: mark source as COW when cloning filters
Pull sound fixes from Takashi Iwai:
"A fair amount of small fixes, which became much larger as a pile of
pending homework during my vacation in the last weeks.
The majority of changes are device-specific quirks and ASoC updates,
along with a few ALSA core fixes and USB-audio hardening as well as a
few regression fixes.
ALSA Core:
- Serialize ALSA sequencer compat port-info ioctls
HD-audio:
- Fix ALC235 codec headset handling
- Fix regression on Tegra194 controller support
- Quirks / fixes for Lenovo, ASUS, Acer, Dell, Higole, HP, and IPASON
laptops
USB-audio:
- Hardening for line6 and ua101 drivers to deal with malformed
packets
- Fix input device leak on probe error in caiaq driver
- Apply quirks generically for Audient and Behringer devices
- Quirks for ASUS SupremeFX Hi-Fi, HiBy FC4 (native DSD), and MSI MAG
B850M MORTAR WIFI
ASoC:
- Runtime PM fixes for SDCA class function driver
- Fix uninitialized stream configs in RT1017 and MAX98363 SDW codecs
- AMD ACP SoundWire support for ASUS and Lenovo models
- Quirks for Intel machines (Lenovo Yoga Slim 7, Chuwi Hi8)
- Qualcomm LPASS fixes for playback constraints and WSA macro volume
- Codec / platform fixes for rt274/rt286, cs42l43, wm8903, Tegra ASRC
Misc:
- Regression fix for silent playback on Creative Titanium HD
- Error handling fix at probe via auto-cleanup in ice1712"
* tag 'sound-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (53 commits)
spi: cs42l43: Workaround for wrong speaker ID on Dell XPS 13 DX13260
ALSA: ice1712: Fix the error handling via auto-cleanup at probe
ALSA: core: Define auto-cleanup for snd_card_free()
ALSA: hda/realtek: Add ALC235 support for headset mode
ALSA: hda/realtek: Add micmute LED quirk for Acer Swift SFG16-72
ALSA: hda/realtek: Fix mute and micmute LEDs on HP ENVY x360 15-ey0xxx
ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 14-dv1001TU
ALSA: ctxfi: Fix silent playback on Titanium HD (SB1270)
ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices
ALSA: usb-audio: Apply boot quirk for Behringer models generically
ASoC: codecs: lpass-wsa-macro: rewrite the interpolator volume after enabling clocks
ALSA: hda/realtek: Fix speakers on ASUS PM3406CHA
ALSA: hda/realtek: Add quirk for HP Pavilion AiO 24 speaker
ALSA: hda/realtek: Add mute LED quirk for HP Laptop 15-fd2xxx
ASoC: amd: acp-config: Add ACP70 DMI quirk for ASUS UM5406GA
ALSA: hda/realtek: Add mute LED quirks for HP Pavilion 15-eh3174nw and HP Laptop 15-dw1xxx
ASoC: Intel: Add quirk to block match table for Lenovo Yoga Slim 7
ALSA: hda/realtek: Add mute LED quirk for HP Victus 15-fb2xxx
ALSA: hda/realtek: Add quirk for Acer Nitro AN515-45
ALSA: hda/realtek: Add quirk for Lenovo ThinkBook G8+
...
Pull random number generator fixes from Jason Donenfeld:
- VMGENID memory needs to be mapped with the decrypted tag, so that
SEV-SNP machines can boot
- A fix for an initialization race in VMGENID, followed by a cleanup
- Trivial kernel doc cleanups in siphash and random.c
- A fix for a new compilation failure with recent clang on PPC and
RISC-V, due to generating an out-of-line memset in the vDSO
* tag 'random-7.3-rc6-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random:
random: vDSO: avoid call to memset() when zeroing reserved parameter
random: fix vgetrandom_opaque_params kernel-doc
random: vDSO: fix repeated word 'to' in comment
siphash: clean up kernel-doc comments
virt: vmgenid: move to using dev_set/get_drvdata
virt: vmgenid: set driver_data before registering notification handlers
virt: vmgenid: remap memory as decrypted
Pull slab fixes from Vlastimil Babka:
- Stable fix for a potential deadlock in kfree_rcu() when called
from set_cpus_allowed_force() (Harry Yoo)
- MAINTAINERS update of the slab.git URL
* tag 'slab-for-7.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/mm/slab:
mm/slab: do not wake up kswapd in __kfree_rcu_sheaf()
MAINTAINERS: update slab.git URL
Pull HID fixes from Benjamin Tissoires:
- Revert of the Bolt integration into hid-logitech-dj (Benjamin
Tissoires)
- A couple of buffer overflow in Intel-thc-hid (Even Xu)
- A couple of Sashiko findings fixes in hid-multitouch and HID-BPF
(Aldo Ariel Panzardo and Benjamin Tissoires)
* tag 'hid-for-linus-2026100201' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
selftest/hid: add test for negative return codes for hid_bpf_hw_request
HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request
HID: Intel-thc-hid: Intel-quickspi: Fix buffer overflow
HID: Intel-thc-hid: Intel-quicki2c: Fix buffer overflow
HID: universal-pidff: Add support for Turtle Beach VelocityOne Race
HID: multitouch: stop the release timer from being rearmed on remove
Revert "HID: logitech: add Bolt receiver support for Logitech HID++ devices"
pci_enable_atomic_ops_to_root() currently fails when no Root Port is
visible. That is common in passthrough guests (ESXi, Hyper-V): the Endpoint
is assigned to the VM, but the Root Port above it is not visible in the
guest topology.
In those setups the hypervisor may already have enabled AtomicOp Requester
Enable on the device. If PCI_EXP_DEVCTL2_ATOMIC_REQ is set, treat AtomicOps
as already enabled and return success instead of failing the Root Port
walk.
After 1ae8c4ce15 ("PCI: Enable AtomicOps only if Root Port supports
them"), pci_enable_atomic_ops_to_root() always returns failure if the Root
Port is not visible, so drivers don't use atomics when they could. On
systems where the Root Port is not visible but *does* support AtomicOps,
this is a regression: prior to 1ae8c4ce15, it enabled AtomicOps in the
endpoint and returned success.
Fixes: 1ae8c4ce15 ("PCI: Enable AtomicOps only if Root Port supports them")
Signed-off-by: Nikola Prica <[email protected]>
[bhelgaas: commit log, code comment]
Signed-off-by: Bjorn Helgaas <[email protected]>
Tested-by: Gerd Bayer <[email protected]>
Reviewed-by: Christian König <[email protected]>
Reviewed-by: Gerd Bayer <[email protected]>
Link: https://patch.msgid.link/[email protected]
Pull tpm fixes from Jarkko Sakkinen.
- tpm error handling and buffer size fixes
* tag 'for-next-tpm-v7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:
tpm: Disable TPM on null key name mismatch
tpm: fix off-by-four bounds check in tpm2_get_random()
tpm: Fix auth session leak in tpm2_get_random() error path
tpm: Fix heap buffer overflow in tpm_transmit_cmd()
ASoC: Fixes for v7.3
A bigger collection of fixes than usual due to your vacation but nothing
hugely remarkable here, just fairly standard quirks and driver specific
bugfixes.
bpf_mem_cache_free_rcu() uses this_cpu_ptr() which requires migration
to be disabled. All callers of rhtab_delete_elem() disable migration
except __rhtab_map_lookup_and_delete_batch(), which calls it under
rcu_read_lock() only.
On CONFIG_PREEMPT_RCU, rcu_read_lock() does not disable preemption or
migration, so the task can migrate between CPUs during the delete loop,
causing this_cpu_ptr() to trigger:
BUG: using smp_processor_id() in preemptible [00000000] code
Fix by wrapping the delete loop in migrate_disable()/migrate_enable()
in __rhtab_map_lookup_and_delete_batch(), matching the migration
protection that the other callers already provide.
Fixes: 818e008482 ("bpf: Implement iteration ops for resizable hashtab")
Reported-by: [email protected]
Signed-off-by: Ömer Mete Kaya <[email protected]>
Signed-off-by: Alexei Starovoitov <[email protected]>
Acked-by: Mykyta Yatsenko <[email protected]>
Link: https://patch.msgid.link/[email protected]
Closes: https://syzkaller.appspot.com/bug?extid=fd7e415d891073b83e1f
poll_state_synchronize_rcu(mm->futex.phash.batches) is used by
futex_ref_drop() to check that a grace period has passed since the
current hash was published. This relies on batches referencing a grace
period which started after the hash pointer was assigned.
__futex_pivot_hash() sets mmph->batches before it replaces mmph->hash:
scoped_guard(rcu) {
mmph->batches = get_state_synchronize_rcu();
rcu_assign_pointer(mmph->hash, new);
}
The scoped_guard(rcu) doesn't stop new grace periods from starting, and
if one starts between those two assignments, futex_ref_drop() can move
forward while a reader still holds a pointer to the old hash.
Fix things by setting mmph->batches after assigning mmph->hash. The
scoped_guard(rcu) isn't needed, so let's drop that as well.
Fixes: 56180dd20c ("futex: Use RCU-based per-CPU reference counting instead of rcuref_t")
Assisted-by: kres
Signed-off-by: Chris Mason <[email protected]>
Signed-off-by: Peter Zijlstra (Intel) <[email protected]>
Reviewed-by: Paul E. McKenney <[email protected]>
Link: https://patch.msgid.link/[email protected]
Currently, refcount_interrupt_test is built unconditionally when
CONFIG_KUNIT is enabled, causing it to run unexpectedly during boot.
Fix this by introducing CONFIG_REFCOUNT_INTERRUPT_KUNIT_TEST so the
test can be configured independently, following standard kunit
practices.
Fixes: 07a88e2bcd ("irq: Add KUnit test for refcounted interrupt enable/disable")
Signed-off-by: Kuan-Wei Chiu <[email protected]>
Signed-off-by: Peter Zijlstra (Intel) <[email protected]>
Reviewed-by: Lyude Paul <[email protected]>
Reviewed-by: Radu Rendec <[email protected]>
Reviewed-by: Boqun Feng <[email protected]>
Link: https://patch.msgid.link/[email protected]
On x86, an optkprobe at A replaces five bytes with a jump. If a disabled
probe B is at A+2, get_optimized_kprobe() stops at B when arming a new
probe C at A+4. It leaves A optimized:
A A+1 A+2 A+3 A+4
A's jump | e9 | d0 | d1 | d2 | d3 |
after C | e9 | d0 | d1 | d2 | cc |
The INT3 for C overwrites the last byte of A's jump displacement, so
execution can jump to the wrong address. B can have prepared optinsns
while disarmed, but has no jump to unoptimize.
Continue past disarmed and unprepared probes to find the active optimized
probe before arming a probe in its jump.
Link: https://lore.kernel.org/all/[email protected]/
Fixes: afd66255b9 ("kprobes: Introduce kprobes jump optimization")
Cc: [email protected]
Signed-off-by: Leon Hwang <[email protected]>
Signed-off-by: Masami Hiramatsu (Google) <[email protected]>
Gao Xiang