)]}' { "log": [ { "commit": "9cc63f8bcd560c760d0b12e15bba8f81c86237cf", "tree": "3b5269b1bcf6714171754946367c51e0590f64da", "parents": [ "31b780b23f8f4c14db7892a2db29527afb521c4b", "301d28fefd141d1504b4226e8fa87db6a31f3ca1", "0f5fe218d9d4e23d47a49873c9bfacd717b9c145", "78a38cbf6f20bc8247e93d1149f97c12dba9fbfb", "20ed97cfde0536991fcb1785453a7748fb131620" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Aug 14 15:43:51 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Aug 14 15:43:51 2026 -0700" }, "message": "Merge branches \u0027expcb.2026.07.24a\u0027, \u0027misc.2026.07.30a\u0027, \u0027rcu-tasks.2026.07.30a\u0027, \u0027srcu.2026.08.11a\u0027 and \u0027torture.2026.08.14a\u0027 into HEAD\n\nChanges:\n\nMake expedited grace periods expedite normal RCU callbacks\n\nMiscellaneous fixes:\n * Improve diagnostic output with character task states.\n * Mark accesses to inform KCSAN of concurrency design.\n * Move from kmalloc() to kmalloc_obj().\n * Documentation updates.\n * Improve handling of RCU deferred quiescent states.\n * Clean up unused function arguments and structure fields.\n * Reduce show_rcu_gp_kthreads() stack space.\n\nTasks RCU updates:\n * Clean up after SRCU re-implementation of Tasks Trace RCU.\n * Mark accesses to inform KCSAN of concurrency design.\n * Add -\u003elazy_timer status to diagnostic output.\n * Remove an unnecessary memory barrier.\n * Fix a data race, courtesy of KCSAN.\n * Documentation updates.\n * Convert cond_resched_tasks_rcu_qs() from macro to static inline\n function.\n\nSRCU updates:\n * Add Rust helpers for SRCU.\n * Avoid losing queued work at cleanup_srcu_struct() time.\n\nTorture-test updates:\n * Preparation work for immediate RCU priority deboosting.\n * Test RCU readers from real interrupt handlers (as opposed to softirq).\n * Simplify code through use of cpumask_next_wrap().\n * Improve diagnostic output with character task states.\n * Add rcutorture.nwriters parameter to allow lightweight stall testing,\n and rcutorture.stall_only to make doing so easier.\n * Test an RCU Tasks Trace grace period implying an RCU grace period.\n * Make RCU Tasks Trace torturing track reader batches.\n * Fix a data race, courtesy of KCSAN.\n * Plug a shuffle_tmp_mask memory leak on kthread spawn failure.\n" }, { "commit": "301d28fefd141d1504b4226e8fa87db6a31f3ca1", "tree": "a57473b4e2afebc8dc9c82d6dba808442bb3ae3d", "parents": [ "76892716e187e1bb4be30c8c980204b501c28555" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Aug 14 15:37:15 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Aug 14 15:42:27 2026 -0700" }, "message": "rcu: Add closing parenthesis in comment in rcu_read_unlock_strict()\n\nThis comment is missing a closing parenthesis:\n\n\t * The in_atomic_preempt_off() check ensures that we come here holding\n\t * the last preempt_count (which will get dropped once we return to\n\t * __rcu_read_unlock().\n\nThis commit therefore adds it at the end of the sentence.\n\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "20ed97cfde0536991fcb1785453a7748fb131620", "tree": "c5299c2c23598711e4917e7732fe157068e885d7", "parents": [ "6c22d640117c3da7fa7fffa0b1ddebc667507ad9" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Tue Jul 28 14:58:49 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Aug 14 14:59:21 2026 -0700" }, "message": "rcutorture: Make {,s}rcu_read_delay() better handle forward-progress testing\n\nThe rcu_read_delay() and srcu_read_delay() functions are suppose to\navoid (or at least to minimize) read-side delays during call_rcu()-based\nforward-progress testing. Although rcu_read_delay() does account for\nthis by testing rcu_fwd_cb_nodelay, it only does so in some cases, and\nsrcu_read_delay() does not bother at all. And rcutorture testing does\noccasionally turn up the MIN_FWD_CBS_LAUNDERED failure when running\nforward-progress tests on Tree SRCU flavors.\n\nThis commit therefore makes both rcu_read_delay() and srcu_read_delay()\ntake an immediate exit if rcu_fwd_cb_nodelay is set.\n\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "6c22d640117c3da7fa7fffa0b1ddebc667507ad9", "tree": "aba59d64699e47715f3e2a7384d180cd4f5768c3", "parents": [ "aaf43c458c491748ae79f8e6afc39fd09a36e77b" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Tue Jul 28 13:55:15 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Aug 14 14:59:21 2026 -0700" }, "message": "rcutorture: Announce declining to forward-progress test\n\nCurrently, rcu_torture_fwd_prog_cr() announces function entry,\nbut silently exits if rcu_fwd_emergency_stop is set or if there is no\n-\u003ecall() function available. This could cause confusion, leading people\nto believe that rcu_torture_fwd_prog_cr() is on the job when it is not.\nThis commit therefore also announces the early exits from this function.\n\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "aaf43c458c491748ae79f8e6afc39fd09a36e77b", "tree": "915c912fe98028fa4d6b99d6a152efa6422109d1", "parents": [ "ed55bb915047934acd28e2f0ea1ef9586b254bf0" ], "author": { "name": "Joel Fernandes", "email": "joelagnelf@nvidia.com", "time": "Sat Jul 18 13:15:35 2026 -0400" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Aug 14 14:59:21 2026 -0700" }, "message": "torture: Don\u0027t leak shuffle_tmp_mask when shuffler kthread fails to start\n\nIf torture_shuffle_init() successfully allocates shuffle_tmp_mask but\nthen fails to create the torture_shuffle kthread, the cpumask is never\nfreed.\n\nFree the cpumask directly on the kthread-creation error path.\n\nSigned-off-by: Joel Fernandes \u003cjoelagnelf@nvidia.com\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "ed55bb915047934acd28e2f0ea1ef9586b254bf0", "tree": "bd726fed2b95340e247dd09560d75f03aba52de1", "parents": [ "86fa5387b473c160c26b781dff55014c4e1b3db0" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Sat Jul 11 16:51:41 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Aug 14 14:59:21 2026 -0700" }, "message": "rcutorture: Use this_cpu_inc() for rcu_torture_count[] and rcu_torture_batch[]\n\nCurrently __this_cpu_inc() is used to increment elements of both\nthe rcu_torture_count[] and rcu_torture_batch[] arrays. However,\nthis can fail when the increments can happen in interrupt handlers,\nas recently became possible. This commit therefore upgrades the uses\nof __this_cpu_inc() to the interrupt-safe this_cpu_inc().\n\nKCSAN located this issue.\n\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "86fa5387b473c160c26b781dff55014c4e1b3db0", "tree": "24c51c64d1789d6179ac13183cce4ce6883b603c", "parents": [ "560b35bd7c8aa1b7cd20adf28c401e93da567400" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Wed Jul 08 17:34:07 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Aug 14 14:59:20 2026 -0700" }, "message": "rcutorture: Make RCU Tasks Trace track Reader Batches\n\nThis commit adds the -\u003eget_sp_seq and -\u003egp_diff fields to the\ntasks_tracing_ops structure so that RCU Tasks Trace rcutorture runs will\ntrack Reader Batch.\n\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "560b35bd7c8aa1b7cd20adf28c401e93da567400", "tree": "1f6ee0776fb17c226f75fc1806b984bb5cb43b1d", "parents": [ "d1ff05605db14d8d6d1578f289595210c60b385f" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Wed Jul 08 13:50:35 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Aug 14 14:59:20 2026 -0700" }, "message": "rcutorture: Test RCU Tasks Trace GP implying RCU GP\n\nAn RCU Tasks Trace grace period is supposed to imply an RCU grace period,\nand this implication is relied on by BPF. But this is not currently\ntested. This commit therefore makes tasks_tracing_torture_read_lock()\nsometimes use rcu_read_lock() instead of rcu_read_lock_trace(), thus\ntesting the required implication.\n\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "d1ff05605db14d8d6d1578f289595210c60b385f", "tree": "8f70f8ca1d52fedb1f7ff23eeddcdddfdf1c0446", "parents": [ "75a88fe00b67b2a065461940b5392dc5487acfff" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Jun 26 12:44:20 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Aug 14 14:59:20 2026 -0700" }, "message": "rcutorture: Add a stall_only module parameter\n\nThis commit adds a stall_only module parameter that shuts off all\nrcutorture kthreads other than the RCU CPU stall-warning test kthreads.\nThe purpose of this is to test production applictions\u0027 reactions to\nCPU stalls, and with minimal additional overhead. Or you can omit the\nstall-warning tests as well and get a heavy no-op, your choice!\n\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "75a88fe00b67b2a065461940b5392dc5487acfff", "tree": "c000122f66c383bc4e69eb9c9288be37f5de5f4c", "parents": [ "e7b6d505c7080d6d40e5dbbeb01b612de9f08a78" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Jun 25 10:57:06 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Aug 14 14:59:20 2026 -0700" }, "message": "rcutorture: Add nwriters module parameter\n\nBelieve it or not, there are people who would like to run rcutorture\nwithout actually torturing RCU. For example, some people would like to\ninduce various types of stall warnings without placing any unnecessary\nadditional overhead on their systems running in production. And\nrcutorture provides the stall_cpu, stall_cpu_holdoff, stall_no_softlockup,\nstall_cpu_irqsoff, stall_cpu_block, and stall_cpu_repeat module parameters\nin order to allow the user to force numerous types of stalls. In addition,\nrcutorture provides a great number of other module parameters to allow the\nuser to reduce other overhead.\n\nBut unfortunately, there is no way to turn of the rcu_torture_writer()\nportion of this torture test, which on my x86 laptop consumes somewhere\nbetween 40% and 45% of a CPU. Although this is quite lightweight for a\ntorture test, it is not welcome on systems running production workloads.\nThis commit therefore adds an nwriters module parameter that defaults\nto 1 but can be set to 0 in order to disable the rcu_torture_writer()\nportion of the torture test, but that cannot be set to any other value\n(that is what the fakewriters module parameter is for!). This reduces\nthe overhead to well under 1% of a CPU, which is much more likely to be\ncompatible with production workloads.\n\nReported-by: Breno Leitao \u003cleitao@debian.org\u003e\nReported-by: Puranjay Mohan \u003cpuranjay@kernel.org\u003e\nReported-by: Usama Arif \u003cusama.arif@linux.dev\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "e7b6d505c7080d6d40e5dbbeb01b612de9f08a78", "tree": "bc57a952858b4b89b5e2ba7aa6075004d2b1d494", "parents": [ "f424566105c946ef42f2643230362598c06a29f1" ], "author": { "name": "Kunwu Chan", "email": "kunwu.chan@gmail.com", "time": "Fri Jun 12 10:34:13 2026 +0800" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Aug 14 14:59:20 2026 -0700" }, "message": "rcutorture: Use task_state_to_char() for task-state reporting\n\nUse the kernel\u0027s standard symbolic task-state representation instead of\nprinting raw hexadecimal task-state values.\n\nSuggested-by: Zqiang \u003cqiang.zhang@linux.dev\u003e\nCo-developed-by: Wang Lian \u003clianux.mm@gmail.com\u003e\nSigned-off-by: Wang Lian \u003clianux.mm@gmail.com\u003e\nSigned-off-by: Kunwu Chan \u003ckunwu.chan@gmail.com\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "f424566105c946ef42f2643230362598c06a29f1", "tree": "de2164e310071c83e75a087b8312d6fef9eae7a6", "parents": [ "5ac693414b51acb8c4b92813ca3ab4fc6686ddf9" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Jun 04 20:42:58 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Aug 14 14:59:20 2026 -0700" }, "message": "rcutorture: Use cpumask_next_wrap() in rcu_torture_preempt()\n\nThe rcu_torture_preempt() function uses cpumask_next(), and if that\nreturns an out-of-bounds result, re-invokes cpumask_next() on -1.\nWhich is exactly what cpumask_next_wrap() does. This commit therefore\nsaves a couple of lines by instead using cpumask_next_wrap().\n\nThis was reported by metacode when asked to look for opportunities\nto use cpumask_next_wrap() in kernel/rcu.\n\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "5ac693414b51acb8c4b92813ca3ab4fc6686ddf9", "tree": "4082e28bab21b22ee8b041c38504d3ffa15748b9", "parents": [ "50df5afa6d410ddfa32f58cdb2976d16fc3785b3" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu May 07 15:03:21 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Aug 14 14:59:20 2026 -0700" }, "message": "rcutorture: Test RCU readers from hardware interrupt handlers\n\nAlthough rcutorture has long had the irqreader module parameter, this\nparameter results only in RCU readers in softirq handlers, specifically,\ntimers. This commit therefore uses smp_call_function_single() to test\nRCU readers in real hardware interrupt handlers, thus providing the full\neffect from the irqreader module parameter.\n\nHowever, consistency/debug checks must account for the possibility that\nthe smp_call_function_single() handler function is directly invoked\nfrom the idle loop, in which case, for example, in_hardirq() will\nreturn false. This commit uses a per-CPU variable to record being in\nthe rcu_torture_irq() smp_call_function_single() handler function.\n\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "50df5afa6d410ddfa32f58cdb2976d16fc3785b3", "tree": "244716ad46009b41c8ab08e9bed7eaf0d5b077b2", "parents": [ "bc892f8249780cacf65636f9a57cc9736b410490" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Sat Apr 25 10:50:57 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Aug 14 14:56:49 2026 -0700" }, "message": "rcutorture: Check for immediate deboosting at reader end\n\nThis commit adds a check for failure to have fully deboosted a\nmulti-segmented RCU reader at the end of the full read-side critical\nsection. This check only happens for fully task-level readers, because\na a handler might have interrupted an already-boosted task-level RCU\nreader, and a reader in that handler could then cause false positives.\nThe first failed check (due to an RCU reader that was not immediately\ndeboosted) causes a splat, but only when the disabled-by-default\ndeboost_timeliness_check module parameter is enabled. Regardless of the\nvalue of this parameter, it produces a list of the segments making up that\nRCU reader following a \"Slow-deboost rcutorture reader segments\" heading.\nSubsequent failures fail silently, all in the name of keeping console\noutput down to a dull roar.\n\nAlthough most uses of RCU priority boosting serve as debugging aids,\nthis might change, and in fact might already have changed. And allowing\n(for example) RCU priority boosting to persist until the next scheduler\ntick could cause an aggressively real-time system to miss sub-millisecond\ndeadlines. So we do need to find this sort of problem during testing,\nand preferably not in the field.\n\nThe name and type of the newly added rcu_torture_ops function pointer\n(named \"-\u003eis_task_rcu_boosted()\") may need to change should other\nend-of-reader checks be needed. But let\u0027s start simple.\n\nOh, and Claude figured out that rcu_is_task_rcu_boosted() could be\nlockless. Perhaps there is hope for AI yet! ;-)\n\n[ paulmck: Apply Akira Yokosawa feedback. ]\n\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "78a38cbf6f20bc8247e93d1149f97c12dba9fbfb", "tree": "6ac7eb6c0266b5f3c473875935941cabdf31a821", "parents": [ "3f90d04303c11a5006059016fc1ebedcbbff682d" ], "author": { "name": "Zqiang", "email": "qiang.zhang@linux.dev", "time": "Thu Jul 09 18:06:02 2026 +0800" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Tue Aug 11 17:29:38 2026 -0700" }, "message": "srcu: Queue sdp-\u003ework when the delay timer is successfully deleted\n\nIn the cleanup_srcu_struct() function, when iterating over per-cpu\u0027s\nsrcu_data, timer_delete_sync(\u0026sdp-\u003edelay_work) is called to cancel the\ndelayed work before doing flush_work(\u0026sdp-\u003ework).\n\nHowever, suppose that timer_delete_sync() returns 1, which means that it\nsuccessfully deleted an pending timer before it had a chance to fire.\nBut this also means that the sdp-\u003ework will not be queued, so that the\nsubsequent flush_work(\u0026sdp-\u003ework) will returns immediately without waiting\nfor anything. Taken together, all of this means that any recently queued\nSRCU callbacks to not be invoked, which can result in memory leaks,\nhangs, or worse.\n\nFix this by checking the return value of timer_delete_sync(), if it\nreturns 1, explicitly queue sdp-\u003ework so that the callbacks will be\ninvoked and the following flush_work() will correctly wait for all of\nthose callbacks to finish executing.\n\n[ Zqiang: Apply feedback from Breno Leitao and kernel test robot. ]\n\nSigned-off-by: Zqiang \u003cqiang.zhang@linux.dev\u003e\nTested-by: kernel test robot \u003coliver.sang@intel.com\u003e\nReviewed-by: Frederic Weisbecker \u003cfrederic@kernel.org\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "0f5fe218d9d4e23d47a49873c9bfacd717b9c145", "tree": "1fd10587caa3e4252bd1ccf6494db9d3cde5d43a", "parents": [ "885d8314e5706ce7d176f2029454246c2d940bb3" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Mon Jul 27 15:11:04 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Jul 31 11:59:12 2026 -0700" }, "message": "rcu-tasks: Convert cond_resched_tasks_rcu_qs() to static inline\n\nIn order to make \"cc -E\" output less annoying, this commit converts\ncond_resched_tasks_rcu_qs() to static inline. You know, the READ_ONCE()\nand WRITE_ONCE() macros used to be *so* simple. ;-)\n\nReported-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "885d8314e5706ce7d176f2029454246c2d940bb3", "tree": "6ec5f3fa37df9ed45e7e1caeeebb96f3fac7531b", "parents": [ "ed61912b40dda92ef24014fb0daca7de852f9407" ], "author": { "name": "Zqiang", "email": "qiang.zhang@linux.dev", "time": "Tue Jul 21 17:48:07 2026 +0800" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Jul 30 11:21:56 2026 -0700" }, "message": "rcu-tasks: Fix some comments for call_rcu_tasks() and call_rcu_tasks_rude()\n\nThe comments for call_rcu_tasks() and call_rcu_tasks_rude() referred\nto \"RCU read-side critical sections\", which is ambiguous. specify\n\"rcu-tasks\" and \"rcu-tasks rude\" respectively to match the actual\nflavor being described.\n\nSigned-off-by: Zqiang \u003cqiang.zhang@linux.dev\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "ed61912b40dda92ef24014fb0daca7de852f9407", "tree": "e61e7a54cf3630e93c9eb9b26704e27f5ec9a58c", "parents": [ "f99dc9e288c5a2e191cca8a9af59113a8bc2768a" ], "author": { "name": "Zqiang", "email": "qiang.zhang@linux.dev", "time": "Mon Jul 20 17:49:58 2026 +0800" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Jul 30 11:21:55 2026 -0700" }, "message": "rcu-tasks: Rename tasks_rcu_exit_srcu_stall_timer to tasks_rcu_exit_stall_timer\n\nThis \u0027commit 1612160b9127 (\"rcu-tasks: Eliminate deadlocks involving\ndo_exit() and RCU tasks\")\u0027 has reimplemented the rcu_tasks_postscan(),\nand the synchronize_srcu() has been removed, this commit therefore\nrename tasks_rcu_exit_srcu_stall_timer to tasks_rcu_exit_stall_timer.\n\nSigned-off-by: Zqiang \u003cqiang.zhang@linux.dev\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "76892716e187e1bb4be30c8c980204b501c28555", "tree": "39439b5add31b678f05947f0190d5cba7fa8ba7b", "parents": [ "df0ecbc497de851891847260f45805ca6ccb393f" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Jul 24 14:44:15 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Jul 30 11:21:14 2026 -0700" }, "message": "rcu: Mark interrupts-enabled accesses to rdp-\u003ecpu_no_qs.s\n\nThe rdp-\u003ecpu_no_qs.s field is accessed only by the current CPU,\nbut can be accessed both at task level and from interrupt handlers.\nAll accesses from interrupts-enabled code must therefore be marked.\nThis commit therefore converts from __this_cpu_read() to this_cpu_read(),\nbut only in interrupts-enabled code, that is, the rcu_qs() function.\n\nKCSAN located this issue.\n\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "df0ecbc497de851891847260f45805ca6ccb393f", "tree": "8f8b5820a05160fa7b292a3b1746a08c19125c70", "parents": [ "27d73e81195b395270117ff77c47be2ed9b09b12" ], "author": { "name": "Zqiang", "email": "qiang.zhang@linux.dev", "time": "Thu Jul 23 18:04:30 2026 +0800" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Jul 30 11:21:14 2026 -0700" }, "message": "rcu: Reduce stack usage in show_rcu_gp_kthreads()\n\nWhen CONFIG_KASAN\u003dy and CONFIG_KASAN_STACK\u003dy builds, the\nshow_rcu_gp_kthreads() exceeds the 1024-byte frame-size limit:\n\nmake kernel/rcu/tree.o KCFLAGS\u003d\"-fstack-usage\"\n DESCEND objtool\n DESCEND bpf/resolve_btfids\n INSTALL libsubcmd_headers\n CC kernel/rcu/tree.o\nIn file included from kernel/rcu/tree.c:4998:\nkernel/rcu/tree_stall.h: In function \u0027show_rcu_gp_kthreads\u0027:\nkernel/rcu/tree_stall.h:994:1: warning: the frame size of 1656 bytes is larger than 1024 bytes [-Wframe-larger-than\u003d]\n\ngrep show_rcu kernel/rcu/tree.su\ntree_nocb.h:1622:13:show_rcu_nocb_state 896 dynamic,bounded\ntree_stall.h:933:6:show_rcu_gp_kthreads 1784 dynamic,bounded\ntree_stall.h:1102:13:sysrq_show_rcu 16 static\n\nWrap the pr_info() into two noinline_for_stack helpers function:\nshow_rcu_state() print rcu_state status, and show_rcu_node()\nprint single rcu_node status.\n\nAfter apply this change:\n\ngrep show_rcu kernel/rcu/tree.su\ntree_stall.h:955:22:show_rcu_node\t696\tdynamic,bounded\ntree_stall.h:930:22:show_rcu_state\t872\tdynamic,bounded\ntree_nocb.h:1622:13:show_rcu_nocb_state\t896\tdynamic,bounded\ntree_stall.h:972:6:show_rcu_gp_kthreads\t544\tstatic\ntree_stall.h:1113:13:sysrq_show_rcu\t16\tstatic\n\nSigned-off-by: Zqiang \u003cqiang.zhang@linux.dev\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "27d73e81195b395270117ff77c47be2ed9b09b12", "tree": "b3080c0a4f14d6076b1c5602f08e796e2c9b69c1", "parents": [ "7f28a4c8f3f723a3b99cc59425e906b429108c48" ], "author": { "name": "Itai Handler", "email": "itai.handler@gmail.com", "time": "Thu Jul 23 10:41:38 2026 +0300" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Jul 30 11:21:14 2026 -0700" }, "message": "rcu: Mark accesses to -\u003ercu_urgent_qs and -\u003ercu_need_heavy_qs\n\nrcu_all_qs() and rcu_note_context_switch() read/clear the per-CPU\n-\u003ercu_urgent_qs and -\u003ercu_need_heavy_qs flags with plain raw_cpu_read()\nand this_cpu_write(), while the RCU core clears them with WRITE_ONCE() in\nrcu_disable_urgency_upon_qs(). KCSAN flags the resulting same-CPU race:\n\n BUG: KCSAN: data-race in rcu_all_qs / rcu_disable_urgency_upon_qs\n\nIt is benign -- the flags are advisory and rcu_all_qs() re-reads\n-\u003ercu_urgent_qs with smp_load_acquire() before acting on it -- but these\nare the last unmarked accesses to the two flags; every other access\nalready uses READ_ONCE()/WRITE_ONCE()/smp_*. Mark them to match. No\nfunctional change.\n\nReproduced on a PREEMPT_NONE, CONFIG_KCSAN_INTERRUPT_WATCHER\u003dy kernel with\na pthreads program whose threads (two per CPU) loop reading a large file:\n\n\tfor (;;) {\n\t\tint fd \u003d open(\"/proc/kallsyms\", O_RDONLY);\n\t\twhile (read(fd, buf, sizeof(buf)) \u003e 0)\n\t\t\t;\n\t\tclose(fd);\n\t}\n\nThe read()s drive cond_resched() -\u003e rcu_all_qs() while the busy CPUs keep\nthe grace period urgent, so the RCU core clears the flags concurrently.\n\nFixes: 2dba13f0b6c2 (\"rcu: Switch urgent quiescent-state requests to rcu_data structure\")\nSigned-off-by: Itai Handler \u003citai.handler@gmail.com\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "7f28a4c8f3f723a3b99cc59425e906b429108c48", "tree": "4e37d28cac3ecdc8e9d9eac52d20b3639447ff5b", "parents": [ "8fe479568cddbe7f2023069a539d4040e05f3f87" ], "author": { "name": "Zqiang", "email": "qiang.zhang@linux.dev", "time": "Wed Jul 22 18:23:47 2026 +0800" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Jul 30 11:21:14 2026 -0700" }, "message": "rcu: Remove unused rdp parameter from rcu_check_gp_start_stall()\n\nThe rcu_check_gp_start_stall() works entirely on rnp parameter,\nand never uses it\u0027s rdp parameter. this commit therefore drop it,\nupdating both callers and the declaration.\n\nNo functional change.\n\nSigned-off-by: Zqiang \u003cqiang.zhang@linux.dev\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "8fe479568cddbe7f2023069a539d4040e05f3f87", "tree": "c810a39fc151f1257aff1b2ea5f657d20df3bc2b", "parents": [ "2aaee3fc84e10c5949e24a8778414ade2db44a55" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Tue Jul 21 21:03:06 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Jul 30 11:21:14 2026 -0700" }, "message": "rcu: Mark interrupts-enabled accesses to rdp-\u003ecpu_no_qs.b.norm\n\nThe rdp-\u003ecpu_no_qs.b.norm field is accessed only by the current CPU,\nbut can be accessed both at task level and from interrupt handlers.\nAll accesses from interrupts-enabled code must therefore be marked.\nThis commit therefore converts from __this_cpu_read() to this_cpu_read(),\nfrom __this_cpu_write() to this_cpu_write(), and plain C-language accesses\nto READ_ONCE() and WRITE_ONCE(), but only in interrupts-enabled code.\n\nKCSAN located this issue.\n\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "f99dc9e288c5a2e191cca8a9af59113a8bc2768a", "tree": "5499823301badb43dd560d04ae6f56e57a3f2192", "parents": [ "7a455d3caef8c1cae44b0b0ea103d1d9fb197aa6" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Mon Jul 20 08:27:59 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Jul 24 17:00:47 2026 -0700" }, "message": "rcu-tasks: Fix IRQ read lock/unlock data race\n\nAs noted by Marco Elver:\n\nrcu_read_lock_trace()\n ....\nt-\u003etrc_reader_scp \u003d __srcu_read_lock_fast(\u0026rcu_tasks_trace_srcu_struct);\n\t\u003cinterrupt\u003e\n\t\t\t\t\trcu_read_unlock_trace()\n\t\t\t\t\t\u003c ... var decls only ... \u003e\n\t\t\t\t\tscp \u003d t-\u003etrc_reader_scp;\n\nThis constitutes a data race between these two accesses to\nt-\u003etrc_reader_scp. If rcu_read_lock_trace() were to tear its store,\nthis value would be corrupted.\n\nThis commit therefore defers the rcu_read_lock_untrace() function\u0027s\nload from t-\u003etrc_reader_scp until after it has verified that this is\nthe outermost rcu_read_unlock_trace(). With this change, the interrupt\nhandler increments and decrements t-\u003etrc_reader_nesting and does not\naccess t-\u003etrc_reader_scp, thus avoiding the data race.\n\nKCSAN located this issue.\n\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "7a455d3caef8c1cae44b0b0ea103d1d9fb197aa6", "tree": "68780087ad39fc766a05a358ec0fa1a946b3bbce", "parents": [ "5976694882f6ebccd0cf7c81a6fdf5c1e08d9d67" ], "author": { "name": "Zqiang", "email": "qiang.zhang@linux.dev", "time": "Thu Jul 16 17:57:54 2026 +0800" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Jul 24 17:00:47 2026 -0700" }, "message": "rcu-tasks: Dump rtpcp-\u003elazy_timer status in show_rcu_tasks_generic_gp_kthread()\n\nAdd \u0027P\u0027 flag to the diagnostic line to indicate whether any per-cpu\nrtpcp\u0027s lazy_timer is pending. this helps diagnose stalls where\nrcu-task callbacks are queued but the kthread stay sleep because\nthe lazy_timer has not yet fired and no grace period has started.\n\nThe output is as follows:\n\n[ 31.319540][ T77] call_rcu_tasks() has failed boot-time tests.\n[ 31.320205][ T77] rcu_tasks: RTGS_WAIT_CBS(11) since 7518 g:4 i:0 kCuUP l:150000\n\nSigned-off-by: Zqiang \u003cqiang.zhang@linux.dev\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "5976694882f6ebccd0cf7c81a6fdf5c1e08d9d67", "tree": "d5f798f4a911fc0626c9146d462a6111ca5b0ce7", "parents": [ "a781301250bc003dc18688d31db3e39a546b55f8" ], "author": { "name": "Zqiang", "email": "qiang.zhang@linux.dev", "time": "Mon Jul 13 18:31:26 2026 +0800" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Jul 24 17:00:24 2026 -0700" }, "message": "rcu-tasks: Update comments in call_rcu_tasks_generic()\n\nThis commit updates the comment \"We can\u0027t create the thread unless\ninterrupts are enabled.\" from \u0027commit 4929c913bda5 (\"rcu: Make\ncall_rcu_tasks() tolerate first call with irqs disabled\")\u0027 to be more\nclear and also to cover deferred wakeup and to take into account the fact\nthat kthread creation has been move to core_initcall() time by \u0027commit\nc63eb17ff06d (\"rcu: Create call_rcu_tasks() kthread at boot time\")\u0027.\n\nSigned-off-by: Zqiang \u003cqiang.zhang@linux.dev\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "2aaee3fc84e10c5949e24a8778414ade2db44a55", "tree": "09ca286fdebb1f405827abd141d950a47d15e9c4", "parents": [ "545b3ac4c1db3c455cbe1bd1ed305e54ad87512e" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Mon Jul 20 16:36:55 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Jul 24 16:59:24 2026 -0700" }, "message": "rcu: Mark accesses to rdp-\u003ercu_cpu_has_work\n\nAlthough the rdp-\u003ercu_cpu_has_work field is accessed only by the\ncorresponding CPU, it can be accessed by both interrupt handlers via\ninvoke_rcu_core_kthread() and at task level via rcu_cpu_kthread().\nThis means that we need this_cpu_read() rather than __this_cpu_read(),\nthis_cpu_write() rather than __this_cpu_write(), and READ_ONCE()\nrather than plain C-language loads. The exception is the boot-time\nrcu_spawn_core_kthreads(), which cannot race with kthreads that have\nnot yet been spawned.\n\nThis commit therefore makes it so.\n\nKCSAN located this issue.\n\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "545b3ac4c1db3c455cbe1bd1ed305e54ad87512e", "tree": "a7b4820f2d2945300546e6d7a7131ee18a2a0269", "parents": [ "4137d69124a29506a09756af0aaf0c7acd2a60f6" ], "author": { "name": "Joel Fernandes", "email": "joelagnelf@nvidia.com", "time": "Sat Jul 18 13:15:34 2026 -0400" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Jul 24 16:59:24 2026 -0700" }, "message": "rcu: Remove unused func parameter from callback-enqueue functions\n\nEver since the kvfree_rcu() tracing moved out of the callback-enqueue\npath, rcutree_enqueue() no longer looks at the callback function\npointer: By the time it is invoked, __call_rcu_common() has already\nstored the function into rhp-\u003efunc, and the enqueue path only adds\nthe rcu_head to the segmented callback list and emits tracepoints\nthat do not take the function pointer.\n\nNevertheless, the function pointer is still threaded through\ncall_rcu_core(), call_rcu_nocb(), and rcutree_enqueue(), forcing\neach level to carry a dead argument.\n\nRemove the parameter from all three functions, from the no-CBs stub,\nand from the corresponding declarations. Anything needing the\ncallback function can still get it from rhp-\u003efunc.\n\nNo functional change.\n\nSigned-off-by: Joel Fernandes \u003cjoelagnelf@nvidia.com\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "4137d69124a29506a09756af0aaf0c7acd2a60f6", "tree": "9a289f98d69263727075ee0152a857bac2848586", "parents": [ "a050e671d3545cf1890ab764387958be6c542f6c" ], "author": { "name": "Joel Fernandes", "email": "joelagnelf@nvidia.com", "time": "Sat Jul 18 13:15:32 2026 -0400" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Jul 24 16:59:23 2026 -0700" }, "message": "rcu: Remove unused expedited_need_qs field from rcu_state\n\nThe -\u003eexpedited_need_qs counter was part of the old expedited\ngrace-period machinery that spun waiting for each CPU to check in.\nThe current implementation instead tracks holdout CPUs via the\nrcu_node structures\u0027 -\u003eexpmask fields and waits on the -\u003eexp_wq[]\nwait queues, so nothing reads or writes -\u003eexpedited_need_qs any\nlonger.\n\nRemove the field to avoid wasting space in rcu_state and to keep\nreaders of the expedited code from searching for nonexistent users.\n\nSigned-off-by: Joel Fernandes \u003cjoelagnelf@nvidia.com\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "a050e671d3545cf1890ab764387958be6c542f6c", "tree": "f03d17184e549ea3f1c0ebd7a6eb421ab221829e", "parents": [ "d2282f9bc75ca39a8ea5b7fe87191609985aca30" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Jul 16 13:05:00 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Jul 24 16:59:23 2026 -0700" }, "message": "rcu: Use WRITE_ONCE() for -\u003ercu_need_heavy_qs\n\nCurrently raw_cpu_write() is used to clear the -\u003ercu_need_heavy_qs\nfield of the per-CPU rcu_data structure. However, on x86 this is a\nnormal assignment, which does not play well with concurrent accesses.\nThis commit therefore upgrades the uses of raw_cpu_write() to its\nconcurrency-safe counterpart WRITE_ONCE() of an rdp pointer obtained\nfrom this_cpu_ptr(\u0026rcu_data).\n\nKCSAN located this issue.\n\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "d2282f9bc75ca39a8ea5b7fe87191609985aca30", "tree": "6b8ee0618937a2dcba04a1fdbe437a2532a0601a", "parents": [ "d972d106965f16348f2c44035440f4926a5880d3" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Jul 16 12:53:56 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Jul 24 16:58:56 2026 -0700" }, "message": "rcu: Use this_cpu_{read,write}() for -\u003ecpu_no_qs.b.exp\n\nCurrently __this_cpu_read() and __this_cpu_write() is used to access the\n-\u003ecpu_no_qs.b.exp field of the per-CPU rcu_data structure. However,\nthis can fail when the accesses can happen in interrupt handlers, as\nrecently started being exercised by rcutorture. This commit therefore\nupgrades the uses of __this_cpu_read() and __this_cpu_write() to their\ninterrupt-safe counterparts this_cpu_read() and this_cpu_write().\n\nKCSAN located this issue.\n\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "31b780b23f8f4c14db7892a2db29527afb521c4b", "tree": "707990c8bf9d19e7b7e1a22ff1b177d35fd692bc", "parents": [ "ec5ee5417b00278fa050b38d878b76f1365420fb" ], "author": { "name": "Puranjay Mohan", "email": "puranjay@kernel.org", "time": "Wed Jun 24 06:23:53 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Jul 24 16:57:29 2026 -0700" }, "message": "rcuscale: Add concurrent expedited GP threads for callback scaling tests\n\nAdd nexp and exp_interval parameters to rcuscale that spawn kthreads\nrunning synchronize_rcu_expedited() in a loop. This generates concurrent\nexpedited GP load while the normal writers measure GP or callback\nlatency.\n\nWhen combined with gp_async\u003d1 (which uses call_rcu() for writers), this\ntests how effectively callbacks benefit from expedited grace periods.\nWith RCU callback expedited GP tracking, the async callbacks should\ncomplete faster because they piggyback on the expedited GPs rather than\nwaiting for normal GPs.\n\nReviewed-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\nSigned-off-by: Puranjay Mohan \u003cpuranjay@kernel.org\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "ec5ee5417b00278fa050b38d878b76f1365420fb", "tree": "fb6cd8c1d6a60256075a2c16b50a339ece36c724", "parents": [ "fde2b18817e4f32b92c1e9881356fbc314983a7a" ], "author": { "name": "Puranjay Mohan", "email": "puranjay@kernel.org", "time": "Wed Jun 24 06:23:52 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Jul 24 16:57:29 2026 -0700" }, "message": "rcu: Advance callbacks for expedited GP completion in rcu_core()\n\nEven when rcu_pending() triggers rcu_core(), the normal callback\nadvancement path through note_gp_changes() -\u003e __note_gp_changes() bails\nout when rdp-\u003egp_seq \u003d\u003d rnp-\u003egp_seq (no normal GP change). Since\nexpedited GPs do not update rnp-\u003egp_seq, rcu_advance_cbs() is never\ncalled and callbacks remain stuck in RCU_WAIT_TAIL.\n\nAdd a direct callback advancement block in rcu_core() that checks for GP\ncompletion via rcu_segcblist_nextgp() combined with\npoll_state_synchronize_rcu_full(). When detected, trylock rnp and call\nrcu_advance_cbs() to move completed callbacks to RCU_DONE_TAIL. Wake the\nGP kthread if rcu_advance_cbs() requests a new grace period.\n\nUses trylock to avoid adding contention on rnp-\u003elock. If the lock is\ncontended, callbacks will be advanced on the next tick.\n\nReviewed-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\nSigned-off-by: Puranjay Mohan \u003cpuranjay@kernel.org\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "fde2b18817e4f32b92c1e9881356fbc314983a7a", "tree": "fd47ed30641297d219c69d04d27ab92e94052740", "parents": [ "318606106c610714608da56cb9a2699040a26b53" ], "author": { "name": "Puranjay Mohan", "email": "puranjay@kernel.org", "time": "Wed Jun 24 06:23:51 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Jul 24 16:56:48 2026 -0700" }, "message": "rcu: Detect expedited grace period completion in rcu_pending()\n\nrcu_pending() decides whether rcu_core() should run on the current CPU\u0027s\ntimer tick. It does not account for expedited grace periods: after an\nexpedited GP completes, a non-offloaded CPU\u0027s callbacks remain in\nRCU_WAIT_TAIL (not yet advanced to RCU_DONE_TAIL) and rcu_core() is\nnever invoked to advance them.\n\nDetect that case via rcu_segcblist_nextgp() combined with a new\nmemory-ordering-free poll variant,\npoll_state_synchronize_rcu_full_unordered(). This keeps rcu_pending()\ncheap: it runs on every tick that has pending callbacks, so it must\nnot pay for the two memory barriers in\npoll_state_synchronize_rcu_full(). The check is only a hint to run\nrcu_core(); the ordered re-check and the actual callback advancement\nhappen there.\n\nSigned-off-by: Puranjay Mohan \u003cpuranjay@kernel.org\u003e\nReviewed-by: Frederic Weisbecker \u003cfrederic@kernel.org\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "318606106c610714608da56cb9a2699040a26b53", "tree": "0b213a85f9456752f67561e271dd54a08412a15e", "parents": [ "942b3e8f3f3f51011161cb728375481ebbc84e22" ], "author": { "name": "Puranjay Mohan", "email": "puranjay@kernel.org", "time": "Wed Jun 24 06:23:50 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Jul 24 16:56:20 2026 -0700" }, "message": "rcu: Wake NOCB rcuog kthreads on expedited grace period completion\n\nWhen an expedited grace period completes, rcu_exp_wait_wake() wakes\nwaiters on rnp-\u003eexp_wq[] but does not notify the NOCB rcuog kthreads. An\nrcuog kthread that is waiting for a grace period sleeps on the leaf\nrcu_node\u0027s -\u003enocb_gp_wq[] with a wait condition based on the grace-period\nstate, so without a wakeup, callbacks on offloaded CPUs that could\nbenefit from the expedited GP wait until the rcuog kthread wakes for some\nother reason (e.g. the next normal GP or a timer).\n\nMake the rcuog grace-period wait honour expedited GPs and wake it when\none completes:\n\n - nocb_gp_wait() now records the grace period to wait for as a struct\n rcu_gp_seq (both normal and expedited), tracks the earliest pending\n normal and expedited sequence across the group, and releases the wait\n via poll_state_synchronize_rcu_full() so it wakes for whichever\n completes first. -\u003enocb_gp_seq is widened to struct rcu_gp_seq\n accordingly.\n\n - rcu_exp_wait_wake() calls the new rcu_nocb_exp_cleanup() on leaf\n nodes, which wakes both -\u003enocb_gp_wq[0] and -\u003enocb_gp_wq[1] (the\n expedited sequence does not share parity with the normal -\u003egp_seq the\n waiter indexed with). Both this path and rcu_nocb_gp_cleanup() use\n the shared rcu_nocb_cleanup_wake() helper, which checks swait_active()\n first; the smp_mb() in rcu_gp_cleanup()/rcu_exp_wait_wake() orders the\n grace-period state update before that check.\n\nA stub rcu_nocb_exp_cleanup() is provided for CONFIG_RCU_NOCB_CPU\u003dn.\n\nSigned-off-by: Puranjay Mohan \u003cpuranjay@kernel.org\u003e\nReviewed-by: Frederic Weisbecker \u003cfrederic@kernel.org\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "942b3e8f3f3f51011161cb728375481ebbc84e22", "tree": "d675f282c622bed62dbdf1f8c1347a8466f34b62", "parents": [ "aaca360ebb04ccd15a733bcbd863c2aebba8c1d5" ], "author": { "name": "Puranjay Mohan", "email": "puranjay@kernel.org", "time": "Wed Jun 24 06:23:49 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Jul 24 16:54:07 2026 -0700" }, "message": "rcu: Update comments for gp_seq and expedited GP tracking\n\nUpdate documentation comments throughout the RCU callback infrastructure\nto reflect the transition from a single grace-period sequence number to\nthe full struct rcu_gp_seq that tracks both normal and expedited grace\nperiods.\n\nThe -\u003egp_seq[] array documentation in rcu_segcblist.h is updated to\ndescribe dual (normal and expedited) GP tracking. The\nrcu_segcblist_advance(), rcu_segcblist_accelerate(), and\nrcu_advance_cbs() comments are updated to refer to the struct rcu_gp_seq\nstate (gsp) instead of the old bare grace-period sequence number (seq).\n\nReviewed-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\nSigned-off-by: Puranjay Mohan \u003cpuranjay@kernel.org\u003e\nReviewed-by: Frederic Weisbecker \u003cfrederic@kernel.org\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "aaca360ebb04ccd15a733bcbd863c2aebba8c1d5", "tree": "64910bbe7f12617006fdfdf554835408827f49d3", "parents": [ "60b54875bd0ba87a7d39204e0cd494a29d22e72f" ], "author": { "name": "Puranjay Mohan", "email": "puranjay@kernel.org", "time": "Fri Jul 24 11:31:23 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Fri Jul 24 16:52:56 2026 -0700" }, "message": "rcu: Enable RCU callbacks to benefit from expedited grace periods\n\nCurrently, RCU callbacks only track normal grace-period sequence\nnumbers. This means callbacks must wait for normal grace periods to\ncomplete even when expedited grace periods have already elapsed.\n\nUse the full struct rcu_gp_seq (which tracks both the normal and\nexpedited grace-period sequences) throughout the callback\ninfrastructure.\n\nrcu_segcblist_advance() now checks both normal and expedited GP\ncompletion via poll_state_synchronize_rcu_full(), and becomes\nparameterless since it reads the grace-period state internally.\nrcu_segcblist_accelerate() stores the full state (both sequences)\ninstead of just the normal one. rcu_accelerate_cbs() and\nrcu_accelerate_cbs_unlocked() use get_state_synchronize_rcu_full() to\ncapture both sequences, and the NOCB advance checks use\npoll_state_synchronize_rcu_full() instead of comparing only the normal\nsequence.\n\nsrcu_segcblist_advance() becomes a standalone implementation because it\ncompares SRCU sequences directly and cannot use\npoll_state_synchronize_rcu_full(), which reads RCU-specific globals.\nsrcu_segcblist_accelerate() sets the -\u003eexp field to\nRCU_GET_STATE_NOT_TRACKED so that poll_state_synchronize_rcu_full()\ncompares only -\u003enorm and ignores -\u003eexp.\n\nSigned-off-by: Puranjay Mohan \u003cpuranjay@kernel.org\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "a781301250bc003dc18688d31db3e39a546b55f8", "tree": "4cb12ed8c602e4379ae8f6b6398a59a25e31e7a6", "parents": [ "647dd6e09481daa23d93e927c2b7f46a3acf8a03" ], "author": { "name": "Zqiang", "email": "qiang.zhang@linux.dev", "time": "Mon Jul 13 18:31:12 2026 +0800" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Jul 23 10:48:12 2026 -0700" }, "message": "rcu-tasks: Remove smp_mb() in rcu_spawn_tasks_kthread_generic()\n\nFor the smp_mb() after kthread_run() in rcu_spawn_tasks_kthread_generic()\nfrom these commits:\n\n\u0027commit eacd6f04a133 (\"rcu-tasks: Move Tasks RCU to its own file\")\u0027\n\u0027commit 84a8f446ffd7 (\"rcu: Defer rcu_tasks_kthread() creation till\n first call_rcu_tasks()\")\u0027\n\nthe memory order pairing as follows:\n\nrcu_spawn_tasks_kthread()\n-\u003et \u003d kthread_run(rcu_tasks_kthread, ...);\n-\u003esmp_mb(); /* Ensure others see full kthread. */\n-\u003eWRITE_ONCE(rcu_tasks_kthread_ptr, t);\n\n\t\t\t\t\t\t\tcall_rcu_tasks()\n\t\t\t\t\t \t\t-\u003eif (READ_ONCE(rcu_tasks_kthread_ptr))\n\t\t\t\t\t \t -\u003ewake_up(\u0026rcu_tasks_cbs_wq)\n\t\t\t\t\t\t\t -\u003etry_to_wake_up()\n\t\t\t\t\t\t\t lock pi_lock\n\t\t\t\t\t\t\t -\u003esmp_mb__after_spinlock()\n\t\t\t\t\t\t\t\t//see full kthread\n\nBecause the \u0027commit d119357d0743 (\"rcu-tasks: Treat only synchronous\ngrace periods urgently\")\u0027 moved the kthread_ptr assignment into the\nrcu_tasks_kthread() function, the following memory order pairings are\nsufficient:\n\nThe runq\u0027s raw_spinlock/unlock(or smp_mb__after_spinlock()) from\nwake_up_process() in kthread_run() and __schedule() provides memory order\nbarrier when the kthread is first scheduled, this ensures the kthread\u0027s\nfunc observes all of the kthread\u0027s initialization.\n\nThe kthread\u0027s smp_store_release(\u0026rtp-\u003ekthread_ptr, ...) in\nrcu_tasks_kthread() and smp_load_acquire(\u0026rtp-\u003ekthread_ptr)\nin call_rcu_tasks_generic() compose release/acquire pairing, the\ncumulativity of smp_store_release() propagates visibility of the kthread\u0027s\ninitialization through the scheduler chain.\n\nThis commit therefore remove smp_mb() in rcu_spawn_tasks_kthread_generic().\n\nSigned-off-by: Zqiang \u003cqiang.zhang@linux.dev\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "647dd6e09481daa23d93e927c2b7f46a3acf8a03", "tree": "58e7ad97a1a9a3ae19ab8c2e4591f7a85fdc6bf7", "parents": [ "ef21090071b33844f55fac7c5470729b862dad0c" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Sun Jul 12 10:50:08 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Jul 23 10:48:12 2026 -0700" }, "message": "rcu-tasks: Apply READ_ONCE() and WRITE_ONCE() to fix data race\n\nNow that rcutorture tests readers from interrupt handlers, KCSAN spotted\nan additional data race. This commit therefore fixes it by applying\nREAD_ONCE() and WRITE_ONCE().\n\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "ef21090071b33844f55fac7c5470729b862dad0c", "tree": "b94bb0946c007547911b54d160d35c527f30900d", "parents": [ "5b79f1d5d791bb41c66cbb75387a53c19f1ffe1e" ], "author": { "name": "Zqiang", "email": "qiang.zhang@linux.dev", "time": "Mon Jul 06 18:03:10 2026 +0800" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Jul 23 10:48:11 2026 -0700" }, "message": "rcu-tasks: Dump rcu tasks status when the boot-test failed\n\nThis commit adds a dump RCU task status function to rcu tasks tests,\nused to obtain more information to help debug when the RCU tasks\nboot-time tests failed.\n\nSigned-off-by: Zqiang \u003cqiang.zhang@linux.dev\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "5b79f1d5d791bb41c66cbb75387a53c19f1ffe1e", "tree": "ced85c1331aeed020eedd044cfda00cc36bf0e0c", "parents": [ "ade2e3c3aede458c8ffed62ef0320aeb60a53a92" ], "author": { "name": "Zqiang", "email": "qiang.zhang@linux.dev", "time": "Mon Jul 06 18:03:09 2026 +0800" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Jul 23 10:48:11 2026 -0700" }, "message": "rcu-tasks: Remove unused struct rcu_tasks\u0027s-\u003en_ipis_fails variables\n\nThe RCU tasks trace has been reimplemented by \u0027commit c27cea4416a3\n(\"rcu: Re-implement RCU Tasks Trace in terms of SRCU-fast\")\u0027, the\nrcu_tasks structure\u0027s-\u003en_ipis_fails is no longer used, this commit\ntherefore remove it.\n\nSigned-off-by: Zqiang \u003cqiang.zhang@linux.dev\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "d972d106965f16348f2c44035440f4926a5880d3", "tree": "088e70301a772934b05bbaa7c995843f0d3d1838", "parents": [ "67913259057e42a260456a45cfd7f1610963191a" ], "author": { "name": "Joel Fernandes", "email": "joelagnelf@nvidia.com", "time": "Thu Jun 25 20:43:00 2026 -0400" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Jul 23 10:47:10 2026 -0700" }, "message": "rcu: clear defer_qs_pending in deferred-QS bail when nesting \u003e 0\n\nPaul McKenney noted that a softirq (or irq_work) handler arming for a\ndeferred QS can fire and find rcu_preempt_depth() \u003e 0 -- the task is\nstill inside its outer reader, so rcu_preempt_need_deferred_qs() bails\nwithout reporting the QS. At that point the queued mechanism has been\nconsumed but -\u003edefer_qs_pending stays in DEFER_QS_PENDING.\n\nIn the meantime, the only remaining path back to a quiescent state on\nthis CPU may be a local_irq_disable()/_enable() pair that does not\ncall preempt_check_resched() (it is just `sti`/`cli`). patch 6\u0027s\nunconditional set_need_resched_current() makes need_resched true, but\nwithout an irq_work being raised the next outer rcu_read_unlock_special()\nhits the P-gate at the arming code:\n\n if (rdp-\u003edefer_qs_pending !\u003d DEFER_QS_PENDING) {\n rdp-\u003edefer_qs_pending \u003d DEFER_QS_PENDING;\n irq_work_queue_on(...); // \u003c-- skipped\n }\n\nso no irq_work is queued for the hardirq-exit preempt_schedule_irq()\npath either. The deferred QS now waits until the next timer tick (or\nsimilar preempt-safe boundary), needlessly extending expedited grace\nperiod latency.\n\nClear -\u003edefer_qs_pending in the bail-out path of rcu_preempt_deferred_qs()\nwhen rcu_preempt_depth() \u003e 0. The recursion guard semantics introduced\nby commit b41642c87716 (\"rcu: Fix rcu_read_unlock() deadloop due to IRQ\nwork\").\n\nThe clear is also safe against fresh recursion at this exact program\npoint: rcu_preempt_depth() \u003e 0 guarantees we are still inside an outer\nreader, so any inner rcu_read_unlock() from tracing infrastructure\nbrings nesting back to outer (\u003e0), never to 0. The slow path of\nrcu_read_unlock_special() is structurally unreachable under that\ncondition, so no recursive raise_softirq_irqoff()/irq_work_queue_on()\ncan be triggered by the clear. Essentially, the mechanism will work to\nprevent the following recursion which Xiongfeng had previously reported:\n\nirq_exit() -\u003e __irq_exit_rcu()\n -\u003e tick_irq_exit() -\u003e tick_nohz_irq_exit() -\u003e tick_nohz_stop_sched_tick()\n -\u003e trace_tick_stop() // BPF prog hooked here\n -\u003e rcu_read_unlock_special()\n -\u003e irq_work_queue_on(\u0026rdp-\u003edefer_qs_iw, rdp-\u003ecpu) // self-IPI re-enters irq_exit\n\nReported-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\nSigned-off-by: Joel Fernandes \u003cjoelagnelf@nvidia.com\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "67913259057e42a260456a45cfd7f1610963191a", "tree": "d2e836e81028df479bc10f3884e7b80efa34136b", "parents": [ "2b109eccd80b660e58d4523e8b80ce11bc3e532e" ], "author": { "name": "Joel Fernandes", "email": "joelagnelf@nvidia.com", "time": "Thu Jun 25 20:42:54 2026 -0400" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Jul 23 10:47:10 2026 -0700" }, "message": "rcu: introduce rcu_defer_qs_clear() helper\n\nCurrently rdp-\u003edefer_qs_pending transitions from DEFER_QS_PENDING to\nDEFER_QS_IDLE at two sites: rcu_preempt_deferred_qs_irqrestore() and\nrcu_preempt_deferred_qs_handler() (depth\u003e0 reset). Both write the\nIDLE value directly.\n\nIntroduce a single inline helper rcu_defer_qs_clear() in tree.h and\nroute both sites through it. This becomes the single\nPENDING-\u003eIDLE transition point for upcoming work.\n\nSigned-off-by: Joel Fernandes \u003cjoelagnelf@nvidia.com\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "2b109eccd80b660e58d4523e8b80ce11bc3e532e", "tree": "63dbb4cf4fe212ec1fc8e78b92acbf769722fc76", "parents": [ "dc7e119abd58297408d2ca34d216242715eda7b7" ], "author": { "name": "Manuel Ebner", "email": "manuelebner@mailbox.org", "time": "Sat Jun 27 11:26:45 2026 +0200" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Jul 23 10:47:10 2026 -0700" }, "message": "doc: RCU: Fix brackets\n\nRemove needless brackets and add missing brackets.\n\nSigned-off-by: Manuel Ebner \u003cmanuelebner@mailbox.org\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "dc7e119abd58297408d2ca34d216242715eda7b7", "tree": "fc715103600082933312a63c89f961996695619c", "parents": [ "573d76f7db5ba050bc7c7c73d30e1364fcee269b" ], "author": { "name": "Manuel Ebner", "email": "manuelebner@mailbox.org", "time": "Sat Jun 27 11:06:06 2026 +0200" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Jul 23 10:47:10 2026 -0700" }, "message": "doc: RCU: Adopt new coding style of type-aware kmalloc-family - part 2/2\n\nUpdate Documentation/RCU/* to suggest using the new type-aware\nkmalloc_obj() per commit 2932ba8d9c99 (\"slab: Introduce kmalloc_obj()\nand family\")\n\np \u003d kmalloc(...);\n -\u003e p \u003d kmalloc_obj(...);\n\nSigned-off-by: Manuel Ebner \u003cmanuelebner@mailbox.org\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "573d76f7db5ba050bc7c7c73d30e1364fcee269b", "tree": "d430efa7e98c14258d9ec1336686a54da1a0bae6", "parents": [ "1384ea908e5de451061b50b4eb76c4440c4d4a0d" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Sun Jun 28 09:00:01 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Jul 23 10:47:10 2026 -0700" }, "message": "rcu: Mark __rcu_access_pointer() as context_unsafe()\n\nA simple comparison of a pointer returned by rcu_access_pointer() results\nin a context-analysis warning for lockless inspection of the RCU-protected\n(also known as __rcu-protected) pointer. This can be suppressed by\nplacing context_unsafe() calls around calls rcu_access_pointer(),\nbut this is messy and distracting. This commit therefore wraps the\nunderlying __rcu_access_pointer() macro with a call to context_unsafe(),\nthereby informing the context-analysis code that rcu_access_pointer()\nmay safely be invoked outside of an RCU read-side critical section.\n\nReported-by: Christoph Hellwig \u003chch@lst.de\u003e\nSuggested-by: Marco Elver \u003celver@google.com\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\nTested-by: Nilay Shroff \u003cnilay@linux.ibm.com\u003e\nReviewed-by: Marco Elver \u003celver@google.com\u003e\n" }, { "commit": "1384ea908e5de451061b50b4eb76c4440c4d4a0d", "tree": "90e431bdcb77de549fd092da649d3ae3a2c56b8b", "parents": [ "a13c140cc289c0b7b3770bce5b3ad42ab35074aa" ], "author": { "name": "Kunwu Chan", "email": "kunwu.chan@gmail.com", "time": "Fri Jun 12 10:34:12 2026 +0800" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Jul 23 10:47:10 2026 -0700" }, "message": "rcu: Use task_state_to_char() in stall-warning prints\n\nRCU stall warnings currently print task states as raw hexadecimal\nvalues, requiring developers to manually decode them.\n\nUse task_state_to_char() so that stall warnings show the same symbolic\ntask-state representation used elsewhere in the kernel.\n\nFor example:\n\t-\u003estate\u003d0x402 becomes -\u003estate\u003dI\n\t-\u003estate\u003d0x0 becomes -\u003estate\u003dR\n\t-\u003estate\u003d0x2 becomes -\u003estate\u003dD\n\nThis improves readability while preserving the underlying diagnostic\ninformation.\n\nSuggested-by: Zqiang \u003cqiang.zhang@linux.dev\u003e\nCo-developed-by: Wang Lian \u003clianux.mm@gmail.com\u003e\nSigned-off-by: Wang Lian \u003clianux.mm@gmail.com\u003e\nSigned-off-by: Kunwu Chan \u003ckunwu.chan@gmail.com\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "60b54875bd0ba87a7d39204e0cd494a29d22e72f", "tree": "d078e2b2d7575a05164c5d2ee0fdf5784a60b43f", "parents": [ "fb5c815f12b5c17ed6c8c5879b3acb1407e5bac4" ], "author": { "name": "Puranjay Mohan", "email": "puranjay@kernel.org", "time": "Wed Jun 24 06:23:47 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Jul 23 10:46:09 2026 -0700" }, "message": "rcu: Add RCU_GET_STATE_NOT_TRACKED for subsystems without expedited GPs\n\nSRCU and Tasks RCU do not track expedited grace periods. When their\ncallback state is checked via poll_state_synchronize_rcu_full(), the\nuninitialized or zeroed exp field could cause false-positive\ncompletion detection.\n\nThis commit adds an RCU_GET_STATE_NOT_TRACKED sentinel value (0x2) that\nthese subsystems can place into exp to indicate that expedited GP\ntracking is not applicable. The expedited sequence check in\npoll_state_synchronize_rcu_full() is guarded to skip entries marked with\nthis sentinel.\n\nThis is needed to allow rcu_segcblist_advance() and rcu_accelerate_cbs()\nto work with both normal and expedited grace periods via\nget_state_synchronize_rcu_full() and poll_state_synchronize_rcu_full().\n\nReviewed-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\nSigned-off-by: Puranjay Mohan \u003cpuranjay@kernel.org\u003e\nReviewed-by: Frederic Weisbecker \u003cfrederic@kernel.org\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "fb5c815f12b5c17ed6c8c5879b3acb1407e5bac4", "tree": "75a60c1174a4b6a1c4a16dd1796dd1814b147ecd", "parents": [ "97b4c6b933f28a34f549c2e87852c83eede3ccc0" ], "author": { "name": "Puranjay Mohan", "email": "puranjay@kernel.org", "time": "Wed Jun 24 06:23:46 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Jul 23 10:46:09 2026 -0700" }, "message": "rcu/segcblist: Track segment grace periods with struct rcu_gp_seq\n\nChange the type of the per-segment -\u003egp_seq[] array in struct\nrcu_segcblist from unsigned long to struct rcu_gp_seq. This prepares the\ncallback tracking infrastructure to record both normal and expedited\ngrace periods per segment.\n\nThe rcu_segcblist_nextgp(), rcu_segcblist_advance(), and\nrcu_segcblist_accelerate() helpers now take a struct rcu_gp_seq * instead\nof an unsigned long, and all callers use the .norm field for comparisons\nand assignments. The SRCU and Tasks RCU wrappers construct a struct\nrcu_gp_seq with only .norm set and forward to the core helpers.\n\nNo functional change: only the .norm field is used.\n\nSigned-off-by: Puranjay Mohan \u003cpuranjay@kernel.org\u003e\nReviewed-by: Frederic Weisbecker \u003cfrederic@kernel.org\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "97b4c6b933f28a34f549c2e87852c83eede3ccc0", "tree": "f7aac74fa22733e50290236cc51271bf2c65459d", "parents": [ "ca1f962a82692aecb06e92c2609200d918d57dbd" ], "author": { "name": "Puranjay Mohan", "email": "puranjay@kernel.org", "time": "Wed Jun 24 06:23:45 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Jul 23 10:46:09 2026 -0700" }, "message": "rcu/segcblist: Factor out rcu_segcblist_advance_compact() helper\n\nThis commit extracts the tail-pointer cleanup and segment compaction\nlogic from rcu_segcblist_advance() into a new static helper function,\nrcu_segcblist_advance_compact(). This shared logic will be reused by the\nupcoming srcu_segcblist_advance() standalone implementation, which\ncannot call the core rcu_segcblist_advance() because that function will\nuse RCU-specific globals.\n\nNo functional change.\n\nReviewed-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\nSigned-off-by: Puranjay Mohan \u003cpuranjay@kernel.org\u003e\nReviewed-by: Frederic Weisbecker \u003cfrederic@kernel.org\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "ca1f962a82692aecb06e92c2609200d918d57dbd", "tree": "61ecaaa8566e864b1ca582bc61f8e6954931aeed", "parents": [ "736084507faa3596caad181a2ba6aa2a96197c52" ], "author": { "name": "Puranjay Mohan", "email": "puranjay@kernel.org", "time": "Wed Jun 24 06:23:44 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Jul 23 10:46:09 2026 -0700" }, "message": "rcu/segcblist: Add SRCU and Tasks RCU wrapper functions\n\nAdd srcu_segcblist_advance() and srcu_segcblist_accelerate() wrappers\nthat forward to the core rcu_segcblist_advance() and\nrcu_segcblist_accelerate() functions, and switch all SRCU (srcutree.c)\nand Tasks RCU (tasks.h) callers to use these wrappers.\n\nThis isolates SRCU and Tasks RCU from upcoming changes to the core\nadvance/accelerate functions, which will switch to struct\nrcu_gp_seq for dual normal/expedited GP tracking. Because SRCU and\nTasks RCU use only normal GP sequences, their wrappers will maintain the\nexisting unsigned long interface.\n\nNo functional change.\n\nReviewed-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\nSigned-off-by: Puranjay Mohan \u003cpuranjay@kernel.org\u003e\nReviewed-by: Frederic Weisbecker \u003cfrederic@kernel.org\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "736084507faa3596caad181a2ba6aa2a96197c52", "tree": "9994e8596ce335f25d923b67a86edfd566c8f633", "parents": [ "767ce74b33741c730777df5ab77bd3ab7dc2c74c" ], "author": { "name": "Puranjay Mohan", "email": "puranjay@kernel.org", "time": "Wed Jun 24 06:23:43 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Jul 23 10:46:09 2026 -0700" }, "message": "rcu: Rename struct rcu_gp_oldstate to rcu_gp_seq\n\nThe polled grace-period state structure rcu_gp_oldstate holds a snapshot\nof the normal (and, on SMP, expedited) grace-period sequence numbers.\nUpcoming changes store this structure in the callback segment list, where\nthe \"oldstate\" name reads poorly: there it represents the grace period a\nsegment is waiting on and is also compared against the current\ngrace-period state.\n\nRename struct rcu_gp_oldstate to the more neutral struct rcu_gp_seq, and\nshorten its members rgos_norm and rgos_exp to norm and exp. Local\nvariables and parameters of this type are renamed from rgosp/rgos to\ngsp/gs accordingly.\n\nWhile at it, provide a single definition of the structure in rcupdate.h\nrather than separate Tiny-RCU and Tree-RCU definitions, and give it the\n-\u003eexp field unconditionally. Tiny RCU does not track expedited grace\nperiods and leaves -\u003eexp unused, but a single definition that always has\n-\u003eexp lets the shared callback code in rcu_segcblist.c reference it\nwithout CONFIG_SMP guards, including on !SMP builds.\n\nNo functional change.\n\nSigned-off-by: Puranjay Mohan \u003cpuranjay@kernel.org\u003e\nReviewed-by: Frederic Weisbecker \u003cfrederic@kernel.org\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "767ce74b33741c730777df5ab77bd3ab7dc2c74c", "tree": "672987e99422982429dc3f24ba32768738af0460", "parents": [ "a13c140cc289c0b7b3770bce5b3ad42ab35074aa" ], "author": { "name": "Joel Fernandes", "email": "joelagnelf@nvidia.com", "time": "Sat Jul 18 13:15:33 2026 -0400" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Jul 23 10:46:09 2026 -0700" }, "message": "rcu: Remove unused rdp parameter from trace_rcu_this_gp()\n\nThe trace_rcu_this_gp() wrapper forwards only the rcu_node structure\u0027s\nfields and the requested grace-period sequence number to the\nrcu_future_grace_period tracepoint. Its rcu_data pointer parameter\nhas no users, but every one of the ten call sites must nevertheless\ncome up with an rcu_data pointer to pass in.\n\nRemove the parameter and update all callers. This also allows\nrcu_future_gp_cleanup() to drop the local rcu_data pointer that\nexisted solely to feed this trace call.\n\nNo functional change.\n\nSigned-off-by: Joel Fernandes \u003cjoelagnelf@nvidia.com\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "3f90d04303c11a5006059016fc1ebedcbbff682d", "tree": "328366d7defa04dac5dc089af3d9342838ab6c27", "parents": [ "59cf3a5bda61cd3c300f0db952afcb031806e802" ], "author": { "name": "Onur Özkan", "email": "work@onurozkan.dev", "time": "Sat Jun 13 09:40:11 2026 +0300" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Wed Jul 15 15:34:26 2026 -0700" }, "message": "MAINTAINERS: add Rust SRCU files to SRCU entry\n\nInclude Rust side implementation files to the SRCU maintainer\nentry.\n\nSigned-off-by: Onur Özkan \u003cwork@onurozkan.dev\u003e\nReviewed-by: Alice Ryhl \u003caliceryhl@google.com\u003e\nReviewed-by: Boqun Feng \u003cboqun@kernel.org\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "59cf3a5bda61cd3c300f0db952afcb031806e802", "tree": "f113aa79d5f55dddf9b3e0dac1f734dce826f16b", "parents": [ "91d5185187e97611e328d03ee5e00e54b5d6d2b0" ], "author": { "name": "Onur Özkan", "email": "work@onurozkan.dev", "time": "Sat Jun 13 09:40:10 2026 +0300" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Wed Jul 15 15:34:26 2026 -0700" }, "message": "rust: sync: add SRCU abstraction\n\nAdd a Rust abstraction for sleepable RCU (SRCU), backed by C srcu_struct.\nProvide FFI helpers and a safe wrapper with a guard-based API for read-side\ncritical sections.\n\nCleanup is handled via `PinnedDrop`. It first checks for active read-side\nsections and emits a warning if any guards were leaked. In that case, it\nwaits in `synchronize_srcu()` rather than risking a UAF by freeing the\n`srcu_struct` that is still reachable from the C side. It then uses\n`srcu_barrier()` to drain pending callbacks before finally calling\n`cleanup_srcu_struct()`.\n\nSigned-off-by: Onur Özkan \u003cwork@onurozkan.dev\u003e\nReviewed-by: Gary Guo \u003cgary@garyguo.net\u003e\nReviewed-by: Alice Ryhl \u003caliceryhl@google.com\u003e\nReviewed-by: Boqun Feng \u003cboqun@kernel.org\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "91d5185187e97611e328d03ee5e00e54b5d6d2b0", "tree": "3e694b975218dbc5cb00ac042089447bab0eee06", "parents": [ "8f63d947bedfddefeb1c10f1dfc36f16407ce22c" ], "author": { "name": "Onur Özkan", "email": "work@onurozkan.dev", "time": "Sat Jun 13 09:40:09 2026 +0300" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Wed Jul 15 15:34:25 2026 -0700" }, "message": "srcu: expose srcu_readers_active()\n\nThis is needed by rust/helpers/srcu.c which now adds\nrust_helper_srcu_readers_active() as a wrapper around the SRCU helper\nfor Rust callers.\n\nTo achive this:\n\n1- Move the srcu_readers_active() implementation from\n \"kernel/rcu/srcutree.c\" to \"include/linux/srcutree.h\".\n\n2- Implement a matching srcu_readers_active() in\n \"include/linux/srcutiny.h\" and use it on the existing open-coded\n WARN_ON() check in cleanup_srcu_struct().\n\nSigned-off-by: Onur Özkan \u003cwork@onurozkan.dev\u003e\nReviewed-by: Gary Guo \u003cgary@garyguo.net\u003e\nReviewed-by: Alice Ryhl \u003caliceryhl@google.com\u003e\nReviewed-by: Boqun Feng \u003cboqun@kernel.org\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "8f63d947bedfddefeb1c10f1dfc36f16407ce22c", "tree": "70192e38877d0eea22f4a7b750a83fc3b9fa52ff", "parents": [ "a47dea1baa3b445365ad0757e6dee4ef8fde49e6" ], "author": { "name": "Onur Özkan", "email": "work@onurozkan.dev", "time": "Sat Jun 13 09:40:08 2026 +0300" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Wed Jul 15 15:34:25 2026 -0700" }, "message": "rust: helpers: add SRCU helpers\n\nAdd helper wrappers for SRCU functions that are exposed to Rust\nthrough generated bindings.\n\nSigned-off-by: Onur Özkan \u003cwork@onurozkan.dev\u003e\nReviewed-by: Gary Guo \u003cgary@garyguo.net\u003e\nReviewed-by: Alice Ryhl \u003caliceryhl@google.com\u003e\nReviewed-by: Boqun Feng \u003cboqun@kernel.org\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "a47dea1baa3b445365ad0757e6dee4ef8fde49e6", "tree": "4881d786cda2f1c5dc29eb1f5ac289c4e08ed762", "parents": [ "a13c140cc289c0b7b3770bce5b3ad42ab35074aa" ], "author": { "name": "Onur Özkan", "email": "work@onurozkan.dev", "time": "Sat Jun 13 09:40:07 2026 +0300" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Wed Jul 15 15:34:25 2026 -0700" }, "message": "srcu: make init_srcu_struct() consistently wrap __init_srcu_struct()\n\nRestructure the SRCU initialization functions so it always follows\none direction:\n\n init_srcu_struct() -\u003e __init_srcu_struct() -\u003e lockdep or generic\n\nThis uses the same wrapper style as mutex. It avoids the old confusing\nstyle where init_srcu_struct() and __init_srcu_struct() called each\nother in different configs. It also helps Rust side to have simpler\nhelper for SRCU initialization.\n\nSigned-off-by: Onur Özkan \u003cwork@onurozkan.dev\u003e\nReviewed-by: Gary Guo \u003cgary@garyguo.net\u003e\nReviewed-by: Alice Ryhl \u003caliceryhl@google.com\u003e\nReviewed-by: Boqun Feng \u003cboqun@kernel.org\u003e\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "bc892f8249780cacf65636f9a57cc9736b410490", "tree": "5b24d45538589e1443f6adb75ffffcd986c6fb09", "parents": [ "a13c140cc289c0b7b3770bce5b3ad42ab35074aa" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu Apr 30 17:05:35 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Wed Jul 15 15:33:46 2026 -0700" }, "message": "rcutorture: Abstract reader-segment dump into rcu_torture_dump_read_segs()\n\nThis commit abstracts the open-coded dumping of reader segments in the\nrcu_torture_cleanup() function into a new rcu_torture_dump_read_segs()\nfunction. This abstraction will allow reader segments to be dumped for\nother purposes.\n\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "ade2e3c3aede458c8ffed62ef0320aeb60a53a92", "tree": "d090d7a15675a9ada34f4fcc25ff1b8a81df2c3f", "parents": [ "a13c140cc289c0b7b3770bce5b3ad42ab35074aa" ], "author": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Thu May 07 16:00:18 2026 -0700" }, "committer": { "name": "Paul E. McKenney", "email": "paulmck@kernel.org", "time": "Wed Jul 15 15:28:41 2026 -0700" }, "message": "rcu-tasks: TASKS_TRACE_RCU doesn\u0027t need IRQ_WORK\n\nNow that Tasks Trace RCU is implemented in terms of SRCU, it no longer\nhas any particular need for the IRQ_WORK Kconfig option. This commit\ntherefore removes the \"select IRQ_WORK\" from the TASKS_TRACE_RCU Kconfig\noption.\n\nSigned-off-by: Paul E. McKenney \u003cpaulmck@kernel.org\u003e\n" }, { "commit": "a13c140cc289c0b7b3770bce5b3ad42ab35074aa", "tree": "d9437e736cf07ba277c13260966ff39c45a58767", "parents": [ "f20d61c22bcaf172d6790b6500e3838e532e71c8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 14:16:39 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 14:16:39 2026 -0700" }, "message": "Linux 7.2-rc3\n" }, { "commit": "f20d61c22bcaf172d6790b6500e3838e532e71c8", "tree": "8761b3acd1f27a380e7a3ad9b9ebc93d717c82ad", "parents": [ "940d91caf09cc849ac514043bbf5c0e1b43aea0b" ], "author": { "name": "Jaewon Yang", "email": "yong010301@gmail.com", "time": "Mon Jul 13 02:11:47 2026 +0900" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 12:52:34 2026 -0700" }, "message": "tpm: Make the TPM character devices non-seekable\n\nThe TPM character devices expose a sequential command/response\ninterface, but their open handlers leave FMODE_PREAD and FMODE_PWRITE\nenabled.\n\nAfter a command leaves a response pending, pread(fd, buf, 16, 0x1400)\npasses 0x1400 as *off to tpm_common_read(). The transfer length is\nbounded by response_length, but the offset is used unchecked when\nforming data_buffer + *off. A sufficiently large offset therefore causes\nan out-of-bounds heap read through copy_to_user() and, if the copy\nsucceeds, an out-of-bounds zero-write through the following memset().\n\nPositional I/O does not provide coherent semantics for this interface.\nAn arbitrary pread offset cannot represent how much of a response has\nbeen consumed sequentially. The write callback always stores a command\nat the start of data_buffer, while pwrite() does not update file-\u003ef_pos\nand can leave the sequential read cursor stale.\n\nCall nonseekable_open() from both open handlers. This removes\nFMODE_PREAD and FMODE_PWRITE, causing positional reads and writes to\nfail with -ESPIPE before reaching the TPM callbacks, and explicitly\nmarks the files non-seekable. Normal read() and write() continue to use\nthe existing sequential f_pos cursor, leaving the response state machine\nunchanged.\n\nTested on Linux 6.12 with KASAN and a swtpm TPM2 device:\n\n - sequential partial reads returned the complete response\n - pread() and preadv() with offset 0x1400 returned -ESPIPE\n - pwrite() and pwritev() with offset zero returned -ESPIPE\n - the pending response remained intact after the rejected operations\n - a subsequent normal command/response cycle completed normally\n - no KASAN report was produced.\n\nFixes: 9488585b21be (\"tpm: add support for partial reads\")\nLink: https://lore.kernel.org/all/20260710090217.191289-1-yong010301@gmail.com/\nCc: stable@vger.kernel.org\nSigned-off-by: Jaewon Yang \u003cyong010301@gmail.com\u003e\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "940d91caf09cc849ac514043bbf5c0e1b43aea0b", "tree": "ed20cdf5a34e7608cda8b4cedc74dfe93ff8ac08", "parents": [ "bffa972b3f66d28732f09d67db09711ac2f93ebe", "1463ca3ec6601cbb097d8d87dbf5dcf1cb86a344" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 12:43:26 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 12:43:26 2026 -0700" }, "message": "Merge tag \u0027staging-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging\n\nPull staging driver fixes from Greg KH:\n \"Here are some staging driver fixes for 7.2-rc3 for some reported bugs\n in the vme_user and rtl8723bs drivers. These include:\n\n - many rtl8723bs OOB fixes for when connecting to \"bad\" wifi hosts\n\n - vme_user bugfixes to correctly validate some user-provided data\n\n All of these have been in linux-next for a while with no reported\n issues\"\n\n* tag \u0027staging-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:\n staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()\n staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop\n staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop\n staging: rtl8723bs: fix OOB write in HT_caps_handler()\n staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()\n staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()\n staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop\n staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()\n staging: vme_user: fix location monitor leak in tsi148 bridge\n staging: vme_user: fix location monitor leak in fake bridge\n staging: vme_user: bound slave read/write to the kern_buf size\n staging: rtl8723bs: don\u0027t drop short TX frames in _rtw_pktfile_read()\n" }, { "commit": "bffa972b3f66d28732f09d67db09711ac2f93ebe", "tree": "a32d462bc81254dedf4681fd2d83b627a76d0489", "parents": [ "8a65af0e39da4f8bfb594c331450bdba8db04add", "3585cfd4563731a8ae406b32807613c667c2b887" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 12:37:28 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 12:37:28 2026 -0700" }, "message": "Merge tag \u0027char-misc-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc\n\nPull Android/IIO fixes from Greg KH:\n \"Here is a set of bugfixes for 7.2-rc3 that resolve a bunch of reported\n issues in just the binder and iio codebases. Included in here are:\n\n - binder driver bugfixes for both the rust and c versions for\n reported problems\n\n - lots and lots of iio driver bugfixes for lots of reported issues\n (including a hid sensor driver bugfix)\n\n Full details are in the shortlog, all of these have been in linux-next\n with no reported issues\"\n\n* tag \u0027char-misc-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (36 commits)\n iio: event: Fix event FIFO reset race\n iio: imu: inv_icm42600: fix timestamp clock period by using lower value\n iio: light: al3010: fix incorrect scale for the highest gain range\n iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for()\n iio: light: tsl2591: return actual error from probe IRQ failure\n iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading\n iio: imu: st_lsm6dsx: deselect shub page before reading whoami\n rust_binder: clear freeze listener on node removal\n rust_binder: reject context manager self-transaction\n rust_binder: use a u64 stride when cleaning up the offsets array\n binder: fix UAF in binder_free_transaction()\n binder: fix UAF in binder_thread_release()\n rust_binder: synchronize Rust Binder stats with freeze commands\n binder: cache secctx size before release zeroes it\n rust_binder: fix BINDER_GET_EXTENDED_ERROR\n iio: adc: ad7779: add missing \u0027select IIO_TRIGGERED_BUFFER\u0027 to Kconfig\n iio: adc: ad4130: add missing `select IIO_TRIGGERED_BUFFER` to Kconfig\n iio: adc: ti-ads124s08: Return reset GPIO lookup errors\n iio: temperature: Build mlx90635 with CONFIG_MLX90635\n iio: light: al3320a: add missing REGMAP_I2C to Kconfig\n ...\n" }, { "commit": "8a65af0e39da4f8bfb594c331450bdba8db04add", "tree": "00bec4501a5f4edcba339a61a2490431fcf4ce3a", "parents": [ "534f8f051e5e1cd9a0cb9e8e0314810f9f9dc069", "302fbbb4fcbdeac2dc8c63a56c1c4e38c4781958" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 12:29:38 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 12:29:38 2026 -0700" }, "message": "Merge tag \u0027tty-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty\n\nPull tty/serial fixes from Greg KH:\n \"Here are some small tty/serial/vt fixes for 7.2-rc3 that resolve some\n reported problems. Included in here are:\n\n - vt spurious modifier issue that showed up in -rc1 (reported a\n bunch)\n\n - 8250 driver bugfixes\n\n - msm serial driver bugfix\n\n - max310x serial driver bugfix\n\n All of these have been in linux-next with no reported issues\"\n\n* tag \u0027tty-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:\n serial: 8250: Ignore flow control on suspend/resume with no_console_suspend\n serial: 8250_mid: Disable DMA for selected platforms\n serial: 8250_omap: clear rx_running on zero-length DMA completes\n vt: fix spurious modifier in CSI/cursor key sequences\n serial: msm: Disable DMA for kernel console UART\n serial: max310x: implement gpio_chip::get_direction()\n" }, { "commit": "534f8f051e5e1cd9a0cb9e8e0314810f9f9dc069", "tree": "c5f05dec207c4cf2b23a8a0866795cf32da0f24b", "parents": [ "f4fb100039e96211609dfc44fb24b9e4a8a0f2f9", "6df47500b557e01737eef6f6b07b12f97a35d841" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 12:12:41 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 12:12:41 2026 -0700" }, "message": "Merge tag \u0027usb-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb\n\nPull USB fixes from Greg KH:\n \"Here are a number of small USB driver fixes for many reported issues.\n Included in here are:\n\n - usb serial driver corruption and use-after-free fixes\n\n - usb gadget rndis bugfixes for malicious/buggy host connections\n\n - typec driver fixes for a load of different tiny reported issues\n\n - typec mux driver revert for a broken patch in -rc1\n\n - usb gadget driver fixes for many different reported problems\n\n - new usb device quirks added\n\n - usbip tool fixes and some core usbip fixes as well\n\n - dwc3 driver fixes for minor issues\n\n - xhci driver fixes for reported problems\n\n - lots of other tiny usb driver fixes for many tiny issues\n\n All of these have been in linux-next with no reported issues\"\n\n* tag \u0027usb-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (56 commits)\n USB: core: ratelimit cabling message\n usb: misc: usbio: fix disconnect UAF in client teardown\n Revert \"usb: typec: mux: avoid duplicated mux switches\"\n USB: chaoskey: Fix slab-use-after-free in chaoskey_release()\n usb: ucsi: huawei_gaokun: move typec_altmode off stack\n usb: typec: tcpci_rt1711h: unregister TCPCI port with devres\n usb: typec: tcpm: Fix VDM type for Enter Mode commands\n usb: typec: ucsi: cancel pending work on system suspend\n usb: typec: class: drop PD lookup reference\n usb: typec: ps883x: Fix DP+USB3 configuration\n usb: xhci: Fix sleep in atomic context in xhci_free_streams()\n xhci: sideband: fix ring sg table pages leak\n usb: gadget: udc: Fix use-after-free in gadget_match_driver\n usb: dwc3: run gadget disconnect from sleepable suspend context\n usb: sl811-hcd: disable controller wakeup on remove\n usb: typec: anx7411: use devm_pm_runtime_enable()\n usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup()\n USB: misc: uss720: unregister parport on probe failure\n usb: gadget: function: rndis: add length check for header\n usb: gadget: function: rndis: add length check to response query\n ...\n" }, { "commit": "f4fb100039e96211609dfc44fb24b9e4a8a0f2f9", "tree": "7555e2168fff55bf38ecfe9ee989bba34a2e1a6e", "parents": [ "2f9eb0c54a834009a22f08903d4fdff48be62e28", "7d5c2f679147859c1db97d9f66366ff16909abee" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 11:38:00 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 11:38:00 2026 -0700" }, "message": "Merge tag \u0027s390-7.2-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux\n\nPull s390 fixes from Vasily Gorbik:\n\n - Fix missing array_index_nospec() call in diag310 memory topology code\n to prevent speculative execution with a user controlled array index\n\n - Fix get_align_mask() return type to match vm_unmapped_area_info\n align_mask, avoiding possible truncation for future larger masks\n\n - Remove empty zcrypt CEX2 files left over after CEX2 and CEX3 driver\n removal\n\n - Add build salt to the vDSO so it gets a unique build id, similar to\n the kernel and modules\n\n* tag \u0027s390-7.2-4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:\n s390: Add build salt to the vDSO\n s390/zcrypt: Remove the empty file\n s390/mm: Fix type mismatch in get_align_mask().\n s390/diag: Add missing array_index_nospec() call to memtop_get_page_count()\n" }, { "commit": "2f9eb0c54a834009a22f08903d4fdff48be62e28", "tree": "323aa05a37d29c36fa4e8f931d005da23aebc45b", "parents": [ "f4bf75d4e8d278f101254cc7e7f147d4158c0a01", "58a37e7317b06665e21609a2f867a9962e9e2919" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 11:25:40 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 11:25:40 2026 -0700" }, "message": "Merge tag \u0027riscv-for-linus-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux\n\nPull RISC-V fixes from Paul Walmsley:\n \"The most notable change involves the rseq kselftest common Makefile\n (as it is not RISC-V-specific). The basic approach in the patch\n appears similar to one used in the KVM and S390 selftests (grep for\n LINUX_TOOL_ARCH_INCLUDE and SUBARCH), and the rseq kselftests pass a\n quick build test on x86 after this.\n\n - Avoid a null pointer deference in machine_kexec_prepare() that the\n IMA subsystem can trigger\n\n - Bypass libc in part of the ptrace_v_not_enabled kselftest to avoid\n noise from child atfork handlers that libc might run\n\n - Include Kconfig support for UltraRISC SoCs, already referenced by\n some device drivers; and enable it in our defconfig\n\n - Fix the build of the rseq kselftest for RISC-V by borrowing a\n technique from the KVM and S390 kselftests that includes\n arch-specific header files from tools/arch/\u003carch\u003e/include\n\n - Fix some memory leaks in the RISC-V vector ptrace kselftests\n\n - Clean up some DT bindings and hwprobe documentation\"\n\n* tag \u0027riscv-for-linus-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:\n selftests/riscv: ptrace: Fix memory leak of regset_data in vector tests\n selftests/rseq: Fix a building error for riscv arch\n riscv: defconfig: enable ARCH_ULTRARISC\n riscv: add UltraRISC SoC family Kconfig support\n riscv: hwprobe.rst: Document EXT_ZICFISS and EXT_ZICFILP\n riscv: hwprobe.rst: Make indentation consistent\n dt-bindings: riscv: sort multi-letter Z extensions alphanumerically\n selftests: riscv: Bypass libc in inactive vector ptrace test\n riscv: Prevent NULL pointer dereference in machine_kexec_prepare()\n" }, { "commit": "f4bf75d4e8d278f101254cc7e7f147d4158c0a01", "tree": "ad79e8c2b0dd968b2795fb3135990b56a7982781", "parents": [ "6205562c5904ee23786239298299043876b1a977", "f47b6b313df9a17010a72b3f389f0a5e9e49db3b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 10:16:25 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 10:16:25 2026 -0700" }, "message": "Merge tag \u0027m68knommu-fixes-on-top-off-7.2-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu\n\nPull m68knommu fix from Greg Ungerer:\n \"Fix incorrectly updated local SoC IO access function names.\n\n Testing didn\u0027t pick them up because there was no specific defconfig\n for these particular SoC parts. New defconfigs will be introduced in\n the next merge cycle to remedy that\"\n\n* tag \u0027m68knommu-fixes-on-top-off-7.2-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu:\n m68k: coldfire: fix breakage of missed IO access updates\n" }, { "commit": "6205562c5904ee23786239298299043876b1a977", "tree": "64ebf8fe15902607dd06155c9a1f81d498bc3748", "parents": [ "44696aa3a489d2baf58efa61b37833f100072bee", "601ddaceb861be7eb557278109966320a6f3478c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 09:46:37 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sun Jul 12 09:46:37 2026 -0700" }, "message": "Merge tag \u0027trace-v7.2-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull tracing fixes from Steven Rostedt:\n\n - Free field in error path of synthetic event parse\n\n In __create_synth_event() the field was allocated but was not freed\n in the error path\n\n - Fix ring_buffer_event_length() on 8 byte aligned architectures\n\n On architectures with CONFIG_HAVE_64BIT_ALIGNED_ACCESS set to y, the\n ring_buffer_event_length() may return the wrong size. This is because\n archs with that config set will always use the \"big event meta\n header\" as that is 8 bytes keeping the payload 8 bytes aligned, even\n when a 4 byte header could hold the size of the event\n\n But ring_buffer_event_length() doesn\u0027t take this into account and\n only subtracts 4 bytes for the meta header in the length when it\n should have subtracted 8 bytes\n\n - Have osnoise wait for a full rcu synchronization on unregister\n\n osnoise_unregister_instance() used to call synchronize_rcu() before\n freeing its copy of the instance but was switched to kfree_rcu(). The\n osniose tracer has code that traverses the instances that it uses,\n and inst is just a pointer to that instance. By using kfree_rcu()\n instead of synchronize_rcu(), the instance that the inst pointer is\n pointing to can be freed while the osnoise code is still referencing\n it\n\n That is, a rmdir on an instance first unregisters the tracer. When\n the unregister finishes, the rmdir expects that the tracer is\n finished with the instance that it is using. By putting back the\n synchronize_rcu() in osnoise_unregister_instance() the unregistering\n of osnoise will now return when all the users of the instance have\n finished\n\n - Remove an unused setting of \"ret\" in tracing_set_tracer()\n\n - Fix ring_buffer_read_page() copying events\n\n The commit that changed ring_buffer_read_page() to show dropped\n events from the buffer itself, split the \"commit\" variable between\n the commit value (with flags) and \"size\" that holds the size of the\n sub-buffer. A cut and paste error changed the test of the reading\n from checking the size of the buffer to the size of the event causing\n reads to only read one event at a time\n\n - Make tracepoint_printk a static variable\n\n When the tracing sysctl knobs were move from sysctl.c to trace.c, the\n variable tracepoint_printk no longer needed to be global. Make it\n static\n\n - Fix some typos\n\n - Fix NULL pointer dereference in func_set_flag()\n\n The flags update of the function tracer first checks if the value of\n the flag is the same and exits if they are, and then it checks if the\n current tracer is the function tracer and exits if it isn\u0027t. The\n problem is that these checks need to be in a reversed order, as if\n the tracer isn\u0027t the function tracer, then the flag being checked may\n not exist. Reverse the order of these checks\n\n - Fix ufs core trace events to not dereference a pointer in TP_printk()\n\n The TP_printk() part of the TRACE_EVENT() macro is called when the\n user reads the \"trace\" file. This can be seconds, minutes, hours,\n days, weeks, and even months after the data was recorded into the\n ring buffer. Thus, saving a pointer to an object into the ring buffer\n and then dereferencing it from TP_printk() can cause harm as the\n object the pointer is pointing to may no longer exist\n\n Fix all the trace events in ufs core to save the device name in the\n ring buffer instead of dereferencing the device descriptor from\n TP_printk()\n\n - Prevent out-of-bound reads in glob matching of trace events\n\n The filter logic of events allows simple glob logic to add wild cards\n to filter on strings. But some events have fields that may not have a\n terminating \u0027nul\u0027 character. This may cause the glob matching to go\n beyond the string. Change the logic to always pass in the length of\n the field that is being matched\n\n - Add no-rcu-check version of trace_##event##_enabled()\n\n The trace_##event##_enabled() usually wraps trace events to do extra\n work that is only needed when the trace event is enabled. But this\n can hide events that are placed in locations where RCU is not\n watching, and can make lockdep not see these bugs when the event is\n not enabled\n\n The trace_##event##_enabled() was updated to always test to make sure\n RCU is watching to catch locations that may call events without RCU\n being active\n\n This caused a false positive for the irq_disabled() and related\n events. As that use trace_irq_disabled_enabled() to force RCU to be\n watching when the event is enabled via the ct_irq_enter() function,\n calls the event, and then calls ct_irq_exit() to put RCU back to its\n original state\n\n The trace_irq_disabled_enabled() should not trigger a warning when\n RCU is not watching because the code within its block handles the\n case properly. Make a __trace_##event##_enabled() version for this\n event to use that doesn\u0027t check RCU is watching as it handles the\n case when it isn\u0027t\n\n - Fix use-after-free in user_event_mm_dup()\n\n When the enabler is removed from the link list, it is freed\n immediately. But it is protected via RCU and needs to be freed after\n an RCU grace period. Use queue_rcu_work() so that the event_mutex can\n also be taken as user_event_put() takes the mutex on the last\n reference is released\n\n - Free type string in error path of parse_synth_field()\n\n There\u0027s an error path in parse_synth_field() where the allocated type\n string is not freed\n\n - Add selftest that tests deferred event teardown\n\n - Fix leak in error path of trace_remote_alloc_buffer()\n\n If page allocation fails, the desc-\u003enr_cpus is not incremented for\n the current CPU and the allocations done for it are not freed\n\n - Fix allocation length in trace_remote_alloc_buffer()\n\n The logic to calculate the struct_len was doing a double count and\n setting the value too large. Calculate the size upfront to fix the\n error and simplify the logic\n\n - Fix sparse CPU masks in ring_buffer_desc()\n\n If there are sparse CPUs (gaps in the numbering), the\n ring_buffer_desc() will fail as it tests the CPU number against the\n number of CPUs that are used\n\n* tag \u0027trace-v7.2-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n ring-buffer: Allow sparse CPU masks in ring_buffer_desc()\n tracing/remotes: Fix struct_len in trace_remote_alloc_buffer()\n tracing/remotes: Fix leak in trace_remote_alloc_buffer() error path\n selftests/user_events: Wait for deferred event teardown after unregister\n tracing/synthetic: Free type string on error path\n tracing/user_events: Fix use-after-free in user_event_mm_dup()\n tracing: Add a no-rcu-check version of trace_##event##_enabled()\n tracing: Prevent out-of-bounds read in glob matching\n ufs: core: tracing: Do not dereference pointers in TP_printk()\n tracing: Fix NULL pointer dereference in func_set_flag()\n samples: ftrace: Fix typos in benchmark comment\n tracing: Make tracepoint_printk static as not exported\n ring-buffer: Fix ring_buffer_read_page() copying only one event per page\n tracing: Remove unused ret assignment in tracing_set_tracer()\n tracing/osnoise: Call synchronize_rcu() when unregistering\n ring-buffer: Fix event length with forced 8-byte alignment\n tracing/synthetic: Free pending field on error path\n" }, { "commit": "44696aa3a489d2baf58efa61b37833f100072bee", "tree": "51cd96451c8fa4ffa1829c86ffbf09cbcbbf3f05", "parents": [ "59dee6d28756c629f3a0bb56266f80e36ef7c99c", "adea84ee6cdea611146c4251d3c1616f5a09feca" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 11 15:42:55 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 11 15:42:55 2026 -0700" }, "message": "Merge tag \u0027input-for-v7.2-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input\n\nPull input fixes from Dmitry Torokhov:\n\n - fix MELFAS MMS114 touchscreen driver to reject invalid touch IDs and\n avoid multi-touch slot corruption\n\n - fix a crash in the Sega Dreamcast (Maple) mouse driver when opening\n the device, caused by missing driver data\n\n - fixes for Maple drivers (keyboard, mouse, joystick) to properly order\n setting driver data and device registration to avoid races\n\n* tag \u0027input-for-v7.2-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:\n Input: mms114 - fix multi-touch slot corruption\n Input: maple_keyb - set driver data before registering input device\n Input: maplecontrol - set driver data before registering input device\n Input: maplemouse - set driver data before registering input device\n Input: maplemouse - fix NULL pointer dereference in open()\n" }, { "commit": "59dee6d28756c629f3a0bb56266f80e36ef7c99c", "tree": "f3f0c7acbcf3570973a7d6d5287269c5fa585837", "parents": [ "cab9e339cfbc1a4e075e53e281dfb00391e1a6bb", "4b22d0801fadfcae2e106e6ba32e49439c7c7ebf" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 11 13:06:05 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 11 13:06:05 2026 -0700" }, "message": "Merge tag \u0027for-7.2/dm-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm\n\nPull device mapper fixes from Mikulas Patocka:\n\n - dm-log: fix overflow on 32-bit machines\n\n - dm-era: fix out of bounds memory access; fix crashes on invalid args\n\n - dm-verity: fix buffer overflow in forward error correction\n\n - dm-thin: fix misbehavior on I/O failures\n\n - dm-pcache: fix NULL pointer dereference on invalid arguments\n\n - dm-inlinecrypt: fix memory leak on error handling\n\n - dm-integrity: fix ignoring the \u0027fix_hmac\u0027 option on device open\n\n - dm: don\u0027t store the keyring in memory for a long term\n\n - 12 miscellaneous fixes for bugs found by Claude Opus 4.6\n\n* tag \u0027for-7.2/dm-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: (23 commits)\n dm thin metadata: fix superblock refcount leak on snapshot shadow failure\n dm-stats: fix dm_jiffies_to_msec64\n dm-stats: fix merge accounting\n dm-bufio: fix wrong count calculation in dm_bufio_issue_discard\n dm-verity: make error counter atomic\n dm-verity: increase sprintf buffer size\n dm-verity: fix a possible NULL pointer dereference\n dm-verity: avoid double increment of \u0026use_bh_wq_enabled\n dm-ioctl: fix a possible overflow in list_version_get_info\n dm_early_create: fix freeing used table on dm_resume failure\n dm-integrity: fix a bug if the bio is out of limits\n dm-integrity: don\u0027t increment hash_offset twice\n dm-integrity: fix leaking uninitialized kernel memory\n dm-integrity: fix the \u0027fix_hmac\u0027 option\n dm era: fix error code propagation in era_ctr()\n dm era: fix NULL pointer dereference in metadata_open()\n dm: avoid leaking the caller\u0027s thread keyring via the table device file\n dm-inlinecrypt: Fix an error handling path in inlinecrypt_ctr()\n dm-pcache: reject option groups without values\n dm thin metadata: fix metadata snapshot consistency on commit failure\n ...\n" }, { "commit": "cab9e339cfbc1a4e075e53e281dfb00391e1a6bb", "tree": "442d42b30a69feb7979458c5090053d9d0a06a32", "parents": [ "b37fa0d0a3cd39413355d4f748d2caf8002635f2", "47915e855fb38b42133e31ba917d99565f862154" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 11 10:11:45 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 11 10:11:45 2026 -0700" }, "message": "Merge tag \u0027perf-urgent-2026-07-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull perf events fixes from Ingo Molnar:\n\n - Fix SVM #GP on AMD CPUs that LBR but not BRS (Sandipan Das)\n\n - Fix UAF bug in the perf AUX code (Lee Jia Jie)\n\n - Fix address leakage in the AMD LBR code (Sandipan Das)\n\n - Fix address leakage in the AMD BRS code (Sandipan Das)\n\n* tag \u0027perf-urgent-2026-07-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n perf/x86/amd/brs: Fix kernel address leakage\n perf/x86/amd/lbr: Fix kernel address leakage\n perf/aux: Fix page UAF in map_range()\n perf/x86/amd/core: Avoid enabling BRS from the SVM reload path\n" }, { "commit": "b37fa0d0a3cd39413355d4f748d2caf8002635f2", "tree": "45aa3d512197ca58600e23a1e220b4741ca93cc0", "parents": [ "767707a53ef7d7cfe7d1b1f22c37fe4af17efc5e", "4c2509f3b79756679a02bea649c6a7501b58f52c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 11 10:09:23 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 11 10:09:23 2026 -0700" }, "message": "Merge tag \u0027x86-urgent-2026-07-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull x86 fixes from Ingo Molnar:\n\n - Fix resctrl resource leak (Tony Luck)\n\n - Fix resctrl umount race (Tony Luck)\n\n - Fix resctrl double-free (Reinette Chatre)\n\n - Fix x86 VGA display fallback logic during bootup on\n certain multi-GPU systems (Mario Limonciello)\n\n - Re-add a WBINVD call to the SNP bootstrap path to\n fix an SNP regression (Tycho Andersen)\n\n* tag \u0027x86-urgent-2026-07-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n x86/virt/sev: Revert \"Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN\"\n x86/video: Only fall back to vga_default_device() without screen info\n fs/resctrl: Fix double-add of pseudo-locked region\u0027s RMID to free list\n fs/resctrl: Fix use-after-free during unmount\n fs/resctrl: Free mon_data structures on rdt_get_tree() failure\n" }, { "commit": "767707a53ef7d7cfe7d1b1f22c37fe4af17efc5e", "tree": "ae2178a06ecffbf4eb2fadf26a05e321529bd29d", "parents": [ "64d9ca4b44f0c08db832e61df84921f9d1687bb7", "920f893f735e92ba3a1cd9256899a186b161928d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 11 09:54:05 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 11 09:54:05 2026 -0700" }, "message": "Merge tag \u0027timers-urgent-2026-07-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip\n\nPull timer fix from Ingo Molnar:\n\n - Fix a subtle posix-cpu-timers vs. exec() race, which\n unearthed other races in the area (Thomas Gleixner)\n\n* tag \u0027timers-urgent-2026-07-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:\n posix-cpu-timers: Prevent UAF caused by non-leader exec() race\n" }, { "commit": "64d9ca4b44f0c08db832e61df84921f9d1687bb7", "tree": "8fd0c39b72dac0da6c18fa5e94fe349826d550e3", "parents": [ "596d603126e4fe6857e5e39b6d5433c3f6ab5cdd", "181bb9c9eae4f69fe510a62a42c2932d0314a800" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 11 09:35:33 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 11 09:35:33 2026 -0700" }, "message": "Merge tag \u0027block-7.2-20260710\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull block fixes from Jens Axboe:\n\n - Limit blk_hctx_poll() to one jiffy. Prevents buggy drivers from\n spinning for too long, hence triggering a stalled RCU read section\n warning\n\n - Avoid a potential deadlock on zone revalidation failure, which could\n otherwise trigger a lockdep circular locking splat during a SCSI disk\n rescan\n\n - Remove a redundant GD_NEED_PART_SCAN set in add_disk_final()\n\n - Make writes to queue/wbt_lat_usec honor the WBT enable state\n\n - ublk fix to snapshot the batch commands before preparing IO, so that\n userspace can\u0027t change an already processed tag and trip the\n WARN_ON_ONCE() in the rollback path\n\n - xen-blkfront fix for a double completion of split requests on resume\n\n - drbd fix to reject data replies with an out-of-range payload size\n\n* tag \u0027block-7.2-20260710\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n block: remove redundant GD_NEED_PART_SCAN in add_disk_final()\n drbd: reject data replies with an out-of-range payload size\n xen-blkfront: fix double completion of split requests on resume\n ublk: snapshot batch commands before preparing I/O\n block: Make WBT latency writes honor enable state\n block: avoid potential deadlock on zone revalidation failure\n blk-mq: bound blk_hctx_poll() to one jiffy\n" }, { "commit": "596d603126e4fe6857e5e39b6d5433c3f6ab5cdd", "tree": "0524799989fc4f52c445c85146779fd036222469", "parents": [ "dd3210c47e8d3ac6b4e9141fc68acc03b38c0ba3", "f3176c8ac4217c88fe1147ab084c47092921ffc4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 11 09:24:38 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Sat Jul 11 09:24:38 2026 -0700" }, "message": "Merge tag \u0027io_uring-7.2-20260710\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux\n\nPull io_uring fixes from Jens Axboe:\n\n - Restore full RCU read section in io_req_local_work_add(), which was\n mistakenly dropped with the DEFER_TASKRUN rework in this merge\n window. Revert the commit that grabbed the RCU read lock in\n io_ctx_mark_taskrun(), as that\u0027s no longer required with the previous\n fix.\n\n - Fix a dangling iovec after a provided-buffer bundle grow failure,\n also an issue introduced in this merge window.\n\n - Reject IORING_CQE_F_32 flag pass-through in MSG_RING to rings that\n weren\u0027t setup with CQE32 or CQE_MIXED.\n\n - Return -EINVAL rather than -ENOMEM from get_unmapped_area() when mmap\n validation fails, matching io_uring_mmap().\n\n* tag \u0027io_uring-7.2-20260710\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:\n Revert \"io_uring: grab RCU read lock marking task run\"\n io_uring: restore RCU read section in io_req_local_work_add()\n io_uring: fix dangling iovec after provided-buffer bundle grow failure\n io_uring/uring_cmd: fix uring_cmd.c comments\n io_uring/msg_ring: reject CQE32 flag pass-through to normal rings\n io_uring/memmap: return -EINVAL from get_unmapped_area() on bad mmap\n" }, { "commit": "4b22d0801fadfcae2e106e6ba32e49439c7c7ebf", "tree": "07a60ca856b0d5ebce79047ef0cf7772e89695c2", "parents": [ "386df1a57b631c456d14f857cb0c0c2e11c16bef" ], "author": { "name": "Genjian Zhang", "email": "zhanggenjian@kylinos.cn", "time": "Sat Jul 11 18:05:26 2026 +0800" }, "committer": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Sat Jul 11 15:18:51 2026 +0200" }, "message": "dm thin metadata: fix superblock refcount leak on snapshot shadow failure\n\n__reserve_metadata_snap() increments THIN_SUPERBLOCK_LOCATION in the\nmetadata space map before shadowing it. When dm_tm_shadow_block()\nfails, a reference is leaked in the metadata space map.\n\nFix by adding the missing dm_sm_dec_block().\n\nSigned-off-by: Genjian Zhang \u003czhanggenjian@kylinos.cn\u003e\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nFixes: cc8394d86f04 (\"dm thin: provide userspace access to pool metadata\")\nCc: stable@vger.kernel.org\n" }, { "commit": "47915e855fb38b42133e31ba917d99565f862154", "tree": "1b9ab27b70a86fd9f311b9835aec2016104d6c49", "parents": [ "2a892294b83f541115c94b0bb637f39bef187657" ], "author": { "name": "Sandipan Das", "email": "sandipan.das@amd.com", "time": "Fri Jul 10 22:04:49 2026 +0530" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Sat Jul 11 12:19:28 2026 +0200" }, "message": "perf/x86/amd/brs: Fix kernel address leakage\n\nA user-only branch stack can contain branches that originate from\nthe kernel. As a result, kernel addresses are exposed to user space\neven when PERF_SAMPLE_BRANCH_USER is requested. On AMD processors\nsupporting X86_FEATURE_BRS (Zen 3 only), perf can still report entries\nsuch as SYSRET/interrupt returns for which the branch-from addresses\nare in the kernel.\n\nE.g.\n\n $ perf record -j any,u -c 4000 -e branch-brs -o - -- \\\n perf bench syscall basic --loop 1000 | \\\n perf script -i - -F brstack|tr \u0027 \u0027 \u0027\\n\u0027| \\\n grep -E \u00270x[89a-f][0-9a-f]{15}\u0027\n\n ...\n 0xffffffff810001c4/0x72e2e32955eb/-/-/-/0//-\n 0xffffffff810001c4/0x72e2d94a9821/-/-/-/0//-\n 0xffffffff810001c4/0x72e2d94ffa1b/-/-/-/0//-\n ...\n\nBRS provides no hardware branch filtering, so privilege level\nfiltering is performed entirely in software. However, amd_brs_match_plm()\nonly validates the branch-to address against the requested privilege\nlevels. For branches from the kernel to user space, the branch-from\naddress is left unchecked and is leaked. Extend the software filter to\nalso validate the branch-from address, so that any branch record whose\nbranch-from address is in the kernel is dropped when\nPERF_SAMPLE_BRANCH_USER is requested.\n\nFixes: 8910075d61a3 (\"perf/x86/amd: Enable branch sampling priv level filtering\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nSigned-off-by: Sandipan Das \u003csandipan.das@amd.com\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: stable@vger.kernel.org\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nCc: Stephane Eranian \u003ceranian@google.com\u003e\nLink: https://patch.msgid.link/f05931c4f89a146c364bd5dc6b8170b1ac611c65.1783701239.git.sandipan.das@amd.com\nCloses: https://lore.kernel.org/all/20260710110235.F3FD81F000E9@smtp.kernel.org/\n" }, { "commit": "adea84ee6cdea611146c4251d3c1616f5a09feca", "tree": "0490fdd052d99d6bc7bd75ac0d24672f03940c4c", "parents": [ "536394ec81419b67d9f4f0028812c4372397be1b" ], "author": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Fri Jul 03 23:01:12 2026 -0700" }, "committer": { "name": "Dmitry Torokhov", "email": "dmitry.torokhov@gmail.com", "time": "Fri Jul 10 21:37:51 2026 -0700" }, "message": "Input: mms114 - fix multi-touch slot corruption\n\nIf the touchscreen controller reports a touch ID of 0, the driver\ncalculates the slot ID as touch-\u003eid - 1, which underflows to UINT_MAX.\nThis is passed to input_mt_slot() as -1.\n\nSince the input core ignores negative slot values, the active slot remains\nunchanged. The driver then reports the touch coordinates for the previously\nactive slot, corrupting its state.\n\nFix this by rejecting touch reports with ID 0.\n\nFixes: 07b8481d4aff (\"Input: add MELFAS mms114 touchscreen driver\")\nCc: stable@vger.kernel.org\nReported-by: sashiko-bot@kernel.org\nAssisted-by: Antigravity:gemini-3.5-flash\nLink: https://patch.msgid.link/20260704060115.353049-1-dmitry.torokhov@gmail.com\nSigned-off-by: Dmitry Torokhov \u003cdmitry.torokhov@gmail.com\u003e\n" }, { "commit": "dd3210c47e8d3ac6b4e9141fc68acc03b38c0ba3", "tree": "fbb912c5ef418f57529a40a886a0e7e6ca2ca0d9", "parents": [ "bf124bae08c35cb8b5392ec8005f9890833b9056", "d38f8bd771c4999b797d7074b348cf201414bd34" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 19:07:24 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 19:07:24 2026 -0700" }, "message": "Merge tag \u0027regulator-fix-v7.2-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator\n\nPull regulator fixes from Mark Brown:\n \"A couple of straightforward fixes for device loading, plus a fix for\n the core support for keeping multiple regulators with voltages close\n to each other that was sadly introduced due to one of the more\n beautiful corners of our API design\"\n\n* tag \u0027regulator-fix-v7.2-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:\n regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK\n regulator: mt6363: add missing MODULE_DEVICE_TABLE()\n regulator: mt6316: add missing MODULE_DEVICE_TABLE()\n" }, { "commit": "bf124bae08c35cb8b5392ec8005f9890833b9056", "tree": "fd4eaffef5c5821ba8c31a00e4f7df043b8c798b", "parents": [ "ccce5f6e7c86f103d76534e2d06d1c903dce551c", "65dfde57d1e29ce2b76fc23dd565eccd5c0bc0f0" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 19:03:37 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 19:03:37 2026 -0700" }, "message": "Merge tag \u0027audit-pr-20260710\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit\n\nPull audit fixes from Paul Moore:\n \"Two relatively small audit patches to fix potential data races with\n the main audit backlog queue as well as possible integer overflows\n when logging data as hex strings\"\n\n* tag \u0027audit-pr-20260710\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:\n audit: fix potential integer overflow in audit_log_n_hex()\n audit: Fix data races of skb_queue_len() readers on audit_queue\n" }, { "commit": "ccce5f6e7c86f103d76534e2d06d1c903dce551c", "tree": "9833a14b8c64137afb2e0f7ec74b201e7a2f2e7a", "parents": [ "61c03dfde8540c7274d9a30dc576bc32951187cd", "56acfeb10019e200ab6787d01f8d7cbe0f01526f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 18:59:29 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 18:59:29 2026 -0700" }, "message": "Merge tag \u0027selinux-pr-20260710\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux\n\nPull selinux fixes from Paul Moore:\n \"Two small SELinux patches to fix a missing permission check for TCP\n Fast Open operations and fix a socket lookup issue with SCTP ASCONF\n operations\"\n\n* tag \u0027selinux-pr-20260710\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:\n selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()\n selinux: check connect-related permissions on TCP Fast Open\n" }, { "commit": "61c03dfde8540c7274d9a30dc576bc32951187cd", "tree": "200ab0d1d5a4530bdeebe37e7e2ca3ed7eec6864", "parents": [ "58d9f84279a86b1b24239107a3d1c4d8dccb41e6", "0ebe8f625ab0520217a425d7cd366e4670484941" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 18:20:15 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 18:20:15 2026 -0700" }, "message": "Merge tag \u0027ntfs-for-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs\n\nPull ntfs fixes from Namjae Jeon:\n\n - fix stale runlist element dereferences in MFT writeback and fallocate\n\n - fix mrec_lock ABBA deadlock in rename\n\n - prevent userspace modification of NTFS system files\n\n - avoid inode eviction/writeback self-deadlocks\n\n - reject malformed resident attributes in non-resident runlist mapping\n\n - avoid post_write_mst_fixup() on invalid index blocks\n\n - fix a hole runlist leak in insert-range error handling\n\n - sanitize directory lookup MFT references from disk\n\n - fail attribute-list updates after SB_ACTIVE is cleared during\n teardown\n\n* tag \u0027ntfs-for-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs:\n ntfs: fail attrlist updates when the superblock is inactive\n ntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name()\n ntfs: fix hole runlist memory leak in insert range error path\n ntfs: avoid calling post_write_mst_fixup() for invalid index_block\n ntfs: fix WARN_ON for resident attribute in ntfs_map_runlist_nolock()\n ntfs: avoid self-deadlock during inode eviction\n ntfs: make system files immutable to prevent corruption\n ntfs: fix mrec_lock ABBA deadlock in rename\n ntfs: avoid stale runlist element dereference in fallocate\n ntfs: avoid stale runlist element dereference in MFT writeback\n" }, { "commit": "58d9f84279a86b1b24239107a3d1c4d8dccb41e6", "tree": "92515cb9263a93a1b45325fd430b0987628c47e9", "parents": [ "8eae393cbfd79311c0736a5012d2c5b546d3b817", "27934d02cbeb8a957dd11c985a579e58d30c5270" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 18:15:26 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 18:15:26 2026 -0700" }, "message": "Merge tag \u0027nfs-for-7.2-2\u0027 of git://git.linux-nfs.org/projects/anna/linux-nfs\n\nPull NFS client fixes from Anna Schumaker:\n\n - SUNRPC:\n - Release lower rpc_clnt if killed waiting for XPRT_LOCKED\n - Pin upper rpc_clnt across the TLS connect_worker\n\n - NFS:\n - Include MAY_WRITE in open permission mask for O_TRUNC\n - Charge unstable writes by request size, not folio size\n\n* tag \u0027nfs-for-7.2-2\u0027 of git://git.linux-nfs.org/projects/anna/linux-nfs:\n NFS: Charge unstable writes by request size, not folio size\n NFSv4: include MAY_WRITE in open permission mask for O_TRUNC\n SUNRPC: pin upper rpc_clnt across the TLS connect_worker\n SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED\n" }, { "commit": "8eae393cbfd79311c0736a5012d2c5b546d3b817", "tree": "4beaf6c2d3024449ec7c3f76a5d868e152cbc4cc", "parents": [ "d96fcfe1b7f94ac742984ae7986b94a116abff1b", "d2c46c9f7a9baf80a322eb1d4494a70e535b637c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 18:11:20 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 18:11:20 2026 -0700" }, "message": "Merge tag \u0027v7.2-rc2-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6\n\nPull smb client fixes from Steve French:\n - DFS cache allocation fix\n - DFS referral bounds check fix\n - Fix absolute symlinks when mounting with POSIX extensions\n - Fixes for incorrect nlink returned by fstat\n - Fix atime in read completion\n - Fix busy dentry on umount\n - ioctl_query_info buffer overflow fix\n - Two fixes for creating special files with SFU\n - Fix mode mask in parse_dacl\n - SMB1 is_path_accessible wildcard fix and minor SMB1 cleanup\n - smb2_check_message fix\n - Debug message improvement\n - Minor cleanup\n\n* tag \u0027v7.2-rc2-smb3-client-fixes\u0027 of git://git.samba.org/sfrench/cifs-2.6:\n cifs: Remove CIFSSMBSetPathInfoFB() fallback function\n cifs: Fix and improve cifs_is_path_accessible() function\n smb: client: mask server-provided mode to 07777 in modefromsid\n cifs: Show reason why autodisabling serverino support\n smb/client: fix incorrect nlink returned by fstat()\n smb/client: zero-initialize stack-allocated cifs_open_info_data\n smb/client: pass cifs_open_info_data to SMB2_open()\n smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink()\n smb: client: fix overflow in passthrough ioctl bounds check\n smb: client: fix busy dentry warning on unmount after DIO\n cifs: Fix support for creating SFU fifo\n cifs: Fix support for creating SFU socket\n smb: client: fix atime clamp check in read completion\n cifs: validate DFS referral string offsets\n smb: client: use GFP_KERNEL for DFS cache allocations\n smb: client: restrict implied bcc[0] exemption to responses without data area\n smb: client: preserve leading slash for POSIX absolute symlink targets\n smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit()\n" }, { "commit": "601ddaceb861be7eb557278109966320a6f3478c", "tree": "14491826df18472040757bc8c1abebb66bd69487", "parents": [ "d471d4f86e8689ad15309e49da8e5e4e9bb9ce87" ], "author": { "name": "Vincent Donnefort", "email": "vdonnefort@google.com", "time": "Thu Jul 09 17:00:17 2026 +0100" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Jul 10 14:04:26 2026 -0400" }, "message": "ring-buffer: Allow sparse CPU masks in ring_buffer_desc()\n\nNo user currently relies on sparse CPU masks, but the descriptor logic already\nsupports them via linear fallback. Remove the arbitrary limitation.\n\nLink: https://patch.msgid.link/20260709160017.1729517-4-vdonnefort@google.com\nFixes: 2e67fabd8b77 (\"ring-buffer: Introduce ring-buffer remotes\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nSigned-off-by: Vincent Donnefort \u003cvdonnefort@google.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "d471d4f86e8689ad15309e49da8e5e4e9bb9ce87", "tree": "aa31951f43c640f190372eb59f48d129d547284d", "parents": [ "ec082d0b978b5fb4c11205ccce63587ac94c74e1" ], "author": { "name": "Vincent Donnefort", "email": "vdonnefort@google.com", "time": "Thu Jul 09 17:00:16 2026 +0100" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Jul 10 14:04:26 2026 -0400" }, "message": "tracing/remotes: Fix struct_len in trace_remote_alloc_buffer()\n\nPre-calculate desc-\u003estruct_len up-front in trace_remote_alloc_buffer()\nwith trace_buffer_desc_size() to fix double-counting.\n\nWhile at it, use the accessor __first_ring_buffer_desc().\n\nLink: https://patch.msgid.link/20260709160017.1729517-3-vdonnefort@google.com\nFixes: 96e43537af54 (\"tracing: Introduce trace remotes\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nSigned-off-by: Vincent Donnefort \u003cvdonnefort@google.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "ec082d0b978b5fb4c11205ccce63587ac94c74e1", "tree": "13311750e22d84e82464f58e72755888b1bc7af3", "parents": [ "42e74d8f21ce448fe12ba3dd59db817b3e977f49" ], "author": { "name": "Vincent Donnefort", "email": "vdonnefort@google.com", "time": "Thu Jul 09 17:00:15 2026 +0100" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Fri Jul 10 14:04:26 2026 -0400" }, "message": "tracing/remotes: Fix leak in trace_remote_alloc_buffer() error path\n\nIf page allocation fails in trace_remote_alloc_buffer(), desc-\u003enr_cpus\nis not yet incremented for the current CPU. As a consequence, on error,\nhalf-allocated rb_desc will not be freed in trace_remote_free_buffer().\n\nIncrement desc-\u003enr_cpus as soon as the first allocation for the current\nCPU has succeeded.\n\nLink: https://patch.msgid.link/20260709160017.1729517-2-vdonnefort@google.com\nFixes: 96e43537af54 (\"tracing: Introduce trace remotes\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nSigned-off-by: Vincent Donnefort \u003cvdonnefort@google.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "d96fcfe1b7f94ac742984ae7986b94a116abff1b", "tree": "0cd70ac5584238e6c65eb544104082ab1fc8a374", "parents": [ "1f0fe3220fcfe0b71793b84ef78f0c6d9a1f2e08", "a52d6c7160f7e2f8c56adf29146385b8f2868d3d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 09:59:55 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 09:59:55 2026 -0700" }, "message": "Merge tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux\n\nPull arm64 fixes from Will Deacon:\n\n - Fix crash when using SMT hotplug on ACPI systems in conjunction with\n maxcpus\u003d\n\n - Fix 30% kswapd performance regression introduced by C1-Pro SME\n erratum workaround\n\n - Fix TLB over-invalidation regression during memory hotplug\n\n - Fix incorrect encoding of FEAT_BWE2 value in ID_AA64DFR2_EL1.BWE\n\n - Typo fixes in the arm64 selftests\n\n* tag \u0027arm64-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:\n selftests/arm64: fix spelling errors in comments\n arm64/sysreg: Fix BWE field encoding in ID_AA64DFR2_EL1\n arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range()\n arm64: Avoid eager DVMSync reclaim batches with C1-Pro SME erratum\n cpu/hotplug: Fix NULL kobject warning in cpuhp_smt_enable()\n arm64: smp: Fix hot-unplug tearing by forcing unregistration\n" }, { "commit": "1f0fe3220fcfe0b71793b84ef78f0c6d9a1f2e08", "tree": "22161646ade1121b0e8767a41b38e24fb128bc52", "parents": [ "f827c27e573b475863d87bd2bab0b06f75aef5cd", "2726b5758f80a546a4ddeec5019e72035a7fa166" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 09:51:45 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 09:51:45 2026 -0700" }, "message": "Merge tag \u0027platform-drivers-x86-v7.2-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86\n\nPull x86 platform driver fixes from Ilpo Järvinen:\n\n - amd/pmc:\n - Use correct IP block table for AMD 1Ah M80H SoC\n - Avoid logging \"(null)\" for missing DMI values\n\n - asus-armoury: update power limits for G614PR\n\n - bitland-mifs-wmi: Fix NULL pointer dereference during suspend/resume\n\n* tag \u0027platform-drivers-x86-v7.2-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86:\n platform/x86: amd-pmc: Use correct IP block table for AMD 1Ah M80H SoC\n platform/x86: asus-armoury: update power limits for G614PR\n platform/x86: bitland-mifs-wmi: Fix NULL pointer dereference during suspend/resume\n platform/x86/amd/pmc: Avoid logging \"(null)\" for DMI values\n" }, { "commit": "386df1a57b631c456d14f857cb0c0c2e11c16bef", "tree": "ebca59da99310d9f074a5d3ee7b167e31c6bf145", "parents": [ "1917eb2db750ecbdf710f79a8042eaa545a063c7" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri Jul 10 18:37:15 2026 +0200" }, "committer": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri Jul 10 18:40:27 2026 +0200" }, "message": "dm-stats: fix dm_jiffies_to_msec64\n\nThere were wrong calculations in dm_jiffies_to_msec64 that produced\nincorrect output when HZ was different from 1000. This commit fixes them.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nAssisted-by: Claude:claude-opus-4-6\nFixes: fd2ed4d25270 (\"dm: add statistics support\")\nCc: stable@vger.kernel.org\n" }, { "commit": "1917eb2db750ecbdf710f79a8042eaa545a063c7", "tree": "813f61e17603e24df1b1d5e3132aec13973bb538", "parents": [ "422f1d4f141eaa3a6e4199ceec86cc6b9bf26570" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri Jul 10 18:35:49 2026 +0200" }, "committer": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri Jul 10 18:40:00 2026 +0200" }, "message": "dm-stats: fix merge accounting\n\nThere were wrong parentheses when setting stats_aux-\u003emerged, so that\nmerging was never properly accounted. This commit fixes it.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nAssisted-by: Claude:claude-opus-4-6\nFixes: fd2ed4d25270 (\"dm: add statistics support\")\nCc: stable@vger.kernel.org\n" }, { "commit": "422f1d4f141eaa3a6e4199ceec86cc6b9bf26570", "tree": "76bd7c98c3d7925da3c095e4f0dc91914d06aba3", "parents": [ "8ec4d9c5a5cf4b61fc087f871465b1f79b393325" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri Jul 10 18:32:49 2026 +0200" }, "committer": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Fri Jul 10 18:39:17 2026 +0200" }, "message": "dm-bufio: fix wrong count calculation in dm_bufio_issue_discard\n\nblock_to_sector converts a block number to a sector number and adds\nc-\u003estart to the result. It is inappropriate to use this function for\nconverting the number of blocks to a number to sectors because c-\u003estart\nwould be incorrectly added to the result.\n\nLuckily, the only target that uses dm_bufio_issue_discard is dm-ebs,\nwhich sets c-\u003estart to 0, so this bug is latent.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nAssisted-by: Claude:claude-opus-4-6\nFixes: 6fbeb0048e6b (\"dm bufio: implement discard\")\nCc: stable@vger.kernel.org\n" }, { "commit": "f827c27e573b475863d87bd2bab0b06f75aef5cd", "tree": "ea08b002b29739c642f071fda9df5374dd3e1329", "parents": [ "8f964d992ee0ea1c0aca689b8b7d5607300f5e2a", "b11c513ad943f35cf5e8007d3a56279c79b7ed4b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 09:36:25 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 09:36:25 2026 -0700" }, "message": "Merge tag \u0027gpio-fixes-for-v7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull gpio fixes from Bartosz Golaszewski:\n\n - provide the missing .get_direction() callback in gpio-palmas\n\n - fix interrupt handling in gpio-dwapb\n\n - add a GPIO self-test program binary to .gitignore\n\n - fix a resource leak in gpio-mvebu\n\n - make the GPIO sharing heuristic more adaptable\n\n* tag \u0027gpio-fixes-for-v7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:\n gpio: mvebu: free generic chips on unbind\n selftests: gpio: add gpio-cdev-uaf to .gitignore\n gpio: dwapb: Mask interrupts at hardware initialization\n gpio: dwapb: Defer clock gating until noirq\n gpio: shared: make the voting mechanism adaptable\n gpios: palmas: add .get_direction() op\n" }, { "commit": "8f964d992ee0ea1c0aca689b8b7d5607300f5e2a", "tree": "11664c69d7582d9514e3e1eda7dc5457a17f3593", "parents": [ "ba0b7c62cea942cd0afa35a3768a9f4874874b2f", "793bf193b18e9bff6c4280268bbffd16a5b533e5" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 09:17:00 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 09:17:00 2026 -0700" }, "message": "Merge tag \u0027ata-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux\n\nPull ata fixes from Damien Le Moal:\n\n - Fix handling of security locked drive revalidation. This prevents\n such drives from being dropped when locked on resume (Terrence)\n\n* tag \u0027ata-7.2-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:\n ata: libata-core: Allow capacity transition to zero for locked drives\n ata: libata-core: Skip HPA resize for locked drives\n" }, { "commit": "ba0b7c62cea942cd0afa35a3768a9f4874874b2f", "tree": "ba34dc3b1e1074b1a32c44dad26bc32ae812eb42", "parents": [ "a635d6748234582ea287c5ffeae28b9b23f91c7e", "6763a0aea6d658d69b9215ab9151d7bd4c1c314b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 08:53:32 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Jul 10 08:53:32 2026 -0700" }, "message": "Merge tag \u0027drm-fixes-2026-07-10\u0027 of https://gitlab.freedesktop.org/drm/kernel\n\nPull drm fixes from Dave Airlie:\n \"Weekly fixes pull for drm, amdgpu, amdxdna, xe leading the way, some\n small core fixes and a nouveau stability fix along with some minor\n changes in other drivers.\n\n Seems to be a bit quiter than last week at least.\n\n fb-helper:\n - Sync on first active crtc in fb_dirty, rather than first crtc\n\n drm_exec:\n - Use direct label in drm_exec\n\n buddy:\n - Rework try_harder in the buddy allocator\n\n i915:\n - fix underrun on panthor lake\n - LT PHY SSC programming fix\n - fix some NULL derefs and leaks\n\n nouveau:\n - fix a vmm large/small page table update race\n\n xe:\n - Fix PTE index in xe_vm_populate_pgtable for chunked binds\n - Wait on external BO kernel fences in exec IOCTL\n - Remove duplicate include\n - Free madvise VMA array on L2 flush failure\n - Stub notifier_lock helpers when DRM_GPUSVM\u003dn\n\n amdgpu:\n - PSP 15.0.9 update\n - SMU 15.0.9 update\n - VCN 5.3 fix\n - VI ASPM fix\n - Userq fix\n - lifetime fix for amdgpu_vm_get_task_info_pasid()\n - Gfx10 fix\n - SMU 14 fix\n\n amdkfd:\n - CRIU bounds checking fixes\n - secondary context id fix\n - Event bounds checking fix\n\n amdxdna:\n - Fix uaf in mmap failure path\n - A lot of deadlocks, access races and return value fixes\n\n analogix_dp:\n - Fix analogix_dp bitshifts during link training\n\n v3d:\n - Fix absent indirect bo handling\n\n imagination:\n - Make function static to solve compiler warning\n - Fix error checking\"\n\n* tag \u0027drm-fixes-2026-07-10\u0027 of https://gitlab.freedesktop.org/drm/kernel: (44 commits)\n nouveau/vmm: fix another SPT/LPT race\n drm/imagination: fix error checking of pvr_vm_context_lookup()\n drm/imagination: make pvr_fw_trace_init_mask_ops static\n gpu/buddy: bail out of try_harder when alignment cannot be honoured\n drm/xe/userptr: Stub notifier_lock helpers when DRM_GPUSVM\u003dn\n drm/xe: free madvise VMA array on L2 flush failure\n drm/xe: remove duplicate \u003ckunit/test-bug.h\u003e include\n drm/xe: Wait on external BO kernel fences in exec IOCTL\n drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds\n drm/fb-helper: Only consider active CRTCs for vblank sync\n drm/amdkfd: Check bounds on CRIU restore queue type and mqd size\n drm/amd/pm: fix smu14 power limit range calculation\n drm/amdkfd: Check bounds in allocate_event_notification_slot\n amdkfd: properly free secondary context id\n drm/amdkfd: Don\u0027t acquire buffers during CRIU queue restore\n drm/amdkfd: Check bounds on CRIU restore event id\n drm/gfx10: Program DB_RING_CONTROL\n drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid()\n drm/amdgpu: trigger GPU recovery when userq destroy fails to unmap a hung queue\n drm/amd/amdgpu: disable ASPM on VI if pcie dpm is disabled\n ...\n" }, { "commit": "58a37e7317b06665e21609a2f867a9962e9e2919", "tree": "294cd332db44cd3169fe9d6cea88b3aa921bd795", "parents": [ "a2ac823d8a228e392bc6a79ea63b550ab84a55b2" ], "author": { "name": "Wang Yan", "email": "wangyan01@kylinos.cn", "time": "Fri Jul 10 16:34:37 2026 +0800" }, "committer": { "name": "Paul Walmsley", "email": "pjw@kernel.org", "time": "Fri Jul 10 09:32:35 2026 -0600" }, "message": "selftests/riscv: ptrace: Fix memory leak of regset_data in vector tests\n\nThe regset_data buffer allocated with calloc() in the parent process\nof several vector ptrace tests is never freed before returning,\ncausing memory leaks in:\n\n- ptrace_v_not_enabled\n- ptrace_v_early_debug\n- ptrace_v_syscall_clobbering\n- v_csr_invalid/ptrace_v_invalid_values\n- v_csr_valid/ptrace_v_valid_values\n\nAdd free(regset_data) before kill(pid, SIGKILL) to release the\nallocated buffer.\n\nSigned-off-by: Wang Yan \u003cwangyan01@kylinos.cn\u003e\nReviewed-by: Sergey Matyukevich \u003cgeomatsi@gmail.com\u003e\nLink: https://patch.msgid.link/20260710083437.489648-1-wangyan01@kylinos.cn\n[pjw@kernel.org: Fixed Sergey\u0027s E-mail address]\nSigned-off-by: Paul Walmsley \u003cpjw@kernel.org\u003e" }, { "commit": "181bb9c9eae4f69fe510a62a42c2932d0314a800", "tree": "37782d57a51f74dc88d8364feec6fbcbd9438fa9", "parents": [ "bd910a7660d280595ef94cb6d193951d855d330f" ], "author": { "name": "Connor Williamson", "email": "connordw@amazon.com", "time": "Mon Jun 15 13:07:15 2026 +0000" }, "committer": { "name": "Jens Axboe", "email": "axboe@kernel.dk", "time": "Fri Jul 10 09:08:50 2026 -0600" }, "message": "block: remove redundant GD_NEED_PART_SCAN in add_disk_final()\n\nadd_disk_final() sets GD_NEED_PART_SCAN before calling bdev_add(),\nthen calls disk_scan_partitions() which sets the flag itself. The\nearly set is redundant and introduces a race.\n\nBetween bdev_add() and disk_scan_partitions(), concurrent openers\n(multipathd, blkid, LVM) see the flag in blkdev_get_whole() and\ntrigger bdev_disk_changed(). When disk_scan_partitions() then runs,\nit calls bdev_disk_changed() again, dropping the partitions the\nconcurrent opener already created before re-adding them, which can\nresult in transient partition disappearances.\n\nThe race is observable by inserting an msleep() between bdev_add()\nand disk_scan_partitions() while running concurrent open() calls\nduring device bind. Without artificial delay, it manifests under\nscheduling pressure during boot on systems with aggressive device\nscanners (multipathd, systemd-udevd).\n\nTherefore, do not set GD_NEED_PART_SCAN in add_disk_final(). Other\nGD_NEED_PART_SCAN consumers (blkdev_get_whole(),\nsd_need_revalidate()) should not be affected as the flag\nis set internally by disk_scan_partitions().\n\nThe retry-on-next-open intention from commit e5cfefa97bcc\n(\"block: fix scan partition for exclusively open device again\")\nshould also not be affected as the early return paths in\ndisk_scan_partitions() should be unreachable at device registration\ntime (bd_holder is NULL and open_partitions is zero).\n\nFixes: e5cfefa97bcc (\"block: fix scan partition for exclusively open device again\")\nCc: stable@vger.kernel.org\nSigned-off-by: Connor Williamson \u003cconnordw@amazon.com\u003e\nReviewed-by: Christoph Hellwig \u003chch@lst.de\u003e\nLink: https://patch.msgid.link/20260615130715.53693-1-connordw@amazon.com\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n" }, { "commit": "2a892294b83f541115c94b0bb637f39bef187657", "tree": "aa7021f41d40c8e9f65cb2a68e3cd7f42e8b1bd4", "parents": [ "5948aaf64f81f217a25dcc2bf6c0779bca19566c" ], "author": { "name": "Sandipan Das", "email": "sandipan.das@amd.com", "time": "Fri Jul 10 16:15:27 2026 +0530" }, "committer": { "name": "Ingo Molnar", "email": "mingo@kernel.org", "time": "Fri Jul 10 15:37:53 2026 +0200" }, "message": "perf/x86/amd/lbr: Fix kernel address leakage\n\nA user-only branch stack can contain branches that originate from\nthe kernel. As a result, kernel addresses are exposed to user space\neven when PERF_SAMPLE_BRANCH_USER is requested. On AMD processors\nsupporting X86_FEATURE_AMD_LBR_V2, perf can still report SYSRET/ERET\nentries for which the branch-from addresses are in the kernel.\n\nE.g.\n\n $ perf record -e cycles -o - -j any,save_type,u -- \\\n perf bench syscall basic --loop 1000 | \\\n perf script -i - -F brstack|tr \u0027 \u0027 \u0027\\n\u0027| \\\n grep -E \u00270x[89a-f][0-9a-f]{15}\u0027\n\n ...\n 0xffffffff81001268/0x717a90a38f1a/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH\n 0xffffffff81001268/0x717a90a39157/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH\n 0xffffffff81001268/0x717a90a2c628/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH\n 0xffffffff81001268/0x717a90a41b60/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH\n 0xffffffff81001268/0x717a90a260db/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH\n 0xffffffff81001268/0x717a90a260db/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH\n 0xffffffff81001268/0x717a8bef1c30/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH\n 0xffffffff81001268/0x717a8e4d3c90/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH\n ...\n\nThe reason is that the hardware filter only considers the privilege\nlevel applicable to the branch target. Extend software filtering to\nalso validate the branch-from addresses against br_sel, so that any\nbranch record whose branch-from address is in the kernel is dropped\nwhen PERF_SAMPLE_BRANCH_USER is requested.\n\nFixes: f4f925dae741 (\"perf/x86/amd/lbr: Add LbrExtV2 hardware branch filter support\")\nReported-by: Ian Rogers \u003cirogers@google.com\u003e\nSigned-off-by: Sandipan Das \u003csandipan.das@amd.com\u003e\nSigned-off-by: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: stable@vger.kernel.org\nCc: Peter Zijlstra \u003cpeterz@infradead.org\u003e\nLink: https://patch.msgid.link/a898a29725f6b2f30518354cdc2e432db66c43cf.1783680119.git.sandipan.das@amd.com\n" } ], "next": "bd910a7660d280595ef94cb6d193951d855d330f" }