summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-01-16fuse: make sure dentry is evicted if staleMiklos Szeredi
d_dispose_if_unused() may find the dentry with a positive refcount, in which case it won't be put on the dispose list even though it has already timed out. "Reinstall" the d_delete() callback, which was optimized out in fuse_dentry_settime(). This will result in the dentry being evicted as soon as the refcount hits zero. Fixes: ab84ad597386 ("fuse: new work queue to periodically invalidate expired dentries") Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Link: https://patch.msgid.link/20260114145344.468856-3-mszeredi@redhat.com Signed-off-by: Christian Brauner <brauner@kernel.org>
2026-01-16fuse: fix race when disposing stale dentriesMiklos Szeredi
In fuse_dentry_tree_work() just before d_dispose_if_unused() the dentry could get evicted, resulting in UAF. Move unlocking dentry_hash[i].lock to after the dispose. To do this, fuse_dentry_tree_del_node() needs to be moved from fuse_dentry_prune() to fuse_dentry_release() to prevent an ABBA deadlock. The lock ordering becomes: -> dentry_bucket.lock -> dentry.d_lock Reported-by: Al Viro <viro@zeniv.linux.org.uk> Closes: https://lore.kernel.org/all/20251206014242.GO1712166@ZenIV/ Fixes: ab84ad597386 ("fuse: new work queue to periodically invalidate expired dentries") Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Link: https://patch.msgid.link/20260114145344.468856-2-mszeredi@redhat.com Signed-off-by: Christian Brauner <brauner@kernel.org>
2026-01-16driver-core: improve driver binding documentationDanilo Krummrich
The driver binding documentation (still) mentions that "When a driver is attached to a device, the device is inserted into the driver's list of devices.". While it is true that the driver-core keeps track of all the devices that are attached to a driver, this is purely for internal purposes (i.e. it is an implementation detail) and has no relevance for user facing documentation. In fact, it is even misleading, since it could be read as if it were valid for driver implementations to keep track of all the devices bound to it. Instead, drivers operate on a per-device basis, with a separate per-device instance created when the driver is bound to a device. Hence, remove the mention of a driver's list of devices and instead add some documentation of the relationship between drivers and devices. Signed-off-by: Danilo Krummrich <dakr@kernel.org> Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Jonathan Corbet <corbet@lwn.net> Message-ID: <20260115215718.6405-1-dakr@kernel.org>
2026-01-16Documentation: Fix typos and grammatical errorsNauman Sabir
Fix various typos and grammatical errors across documentation files: - Fix missing preposition 'in' in process/changes.rst - Correct 'result by' to 'result from' in admin-guide/README.rst - Fix 'before hand' to 'beforehand' in cgroup-v1/hugetlb.rst - Correct 'allows to limit' to 'allows limiting' in hugetlb.rst, cgroup-v2.rst, and kconfig-language.rst - Fix 'needs precisely know' to 'needs to precisely know' - Correct 'overcommited' to 'overcommitted' in hugetlb.rst - Fix subject-verb agreement: 'never causes' to 'never cause' - Fix 'there is enough' to 'there are enough' in hugetlb.rst - Fix 'metadatas' to 'metadata' in filesystems/erofs.rst - Fix 'hardwares' to 'hardware' in scsi/ChangeLog.sym53c8xx Signed-off-by: Nauman Sabir <officialnaumansabir@gmail.com> Acked-by: Tejun Heo <tj@kernel.org> Message-ID: <20260115230110.7734-1-officialnaumansabir@gmail.com> Signed-off-by: Jonathan Corbet <corbet@lwn.net>
2026-01-16Merge branch 'bpf-fix-linked-register-tracking'Alexei Starovoitov
Puranjay Mohan says: ==================== bpf: Fix linked register tracking This patch fixes the linked register tracking when multiple links from the same register are created with a sync between the creation of these links. The sync corrupts the id of the register and therefore the second link is not created properly. See the patch description to understand more. The fix is to preserve the id while doing the sync similar to the off. ==================== Link: https://patch.msgid.link/20260115151143.1344724-1-puranjay@kernel.org Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-01-16selftests: bpf: Add test for multiple syncs from linked registerPuranjay Mohan
Before the last commit, sync_linked_regs() corrupted the register whose bounds are being updated by copying known_reg's id to it. The ids are the same in value but known_reg has the BPF_ADD_CONST flag which is wrongly copied to reg. This later causes issues when creating new links to this reg. assign_scalar_id_before_mov() sees this BPF_ADD_CONST and gives a new id to this register and breaks the old links. This is exposed by the added selftest. Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Tested-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260115151143.1344724-3-puranjay@kernel.org Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-01-16bpf: Preserve id of register in sync_linked_regs()Puranjay Mohan
sync_linked_regs() copies the id of known_reg to reg when propagating bounds of known_reg to reg using the off of known_reg, but when known_reg was linked to reg like: known_reg = reg ; both known_reg and reg get same id known_reg += 4 ; known_reg gets off = 4, and its id gets BPF_ADD_CONST now when a call to sync_linked_regs() happens, let's say with the following: if known_reg >= 10 goto pc+2 known_reg's new bounds are propagated to reg but now reg gets BPF_ADD_CONST from the copy. This means if another link to reg is created like: another_reg = reg ; another_reg should get the id of reg but assign_scalar_id_before_mov() sees BPF_ADD_CONST on reg and assigns a new id to it. As reg has a new id now, known_reg's link to reg is broken. If we find new bounds for known_reg, they will not be propagated to reg. This can be seen in the selftest added in the next commit: 0: (85) call bpf_get_prandom_u32#7 ; R0=scalar() 1: (57) r0 &= 255 ; R0=scalar(smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff)) 2: (bf) r1 = r0 ; R0=scalar(id=1,smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff)) R1=scalar(id=1,smin=smin32=0,smax=umax=smax32=umax32=255,var_off=(0x0; 0xff)) 3: (07) r1 += 4 ; R1=scalar(id=1+4,smin=umin=smin32=umin32=4,smax=umax=smax32=umax32=259,var_off=(0x0; 0x1ff)) 4: (a5) if r1 < 0xa goto pc+4 ; R1=scalar(id=1+4,smin=umin=smin32=umin32=10,smax=umax=smax32=umax32=259,var_off=(0x0; 0x1ff)) 5: (bf) r2 = r0 ; R0=scalar(id=2,smin=umin=smin32=umin32=6,smax=umax=smax32=umax32=255) R2=scalar(id=2,smin=umin=smin32=umin32=6,smax=umax=smax32=umax32=255) 6: (a5) if r1 < 0xe goto pc+2 ; R1=scalar(id=1+4,smin=umin=smin32=umin32=14,smax=umax=smax32=umax32=259,var_off=(0x0; 0x1ff)) 7: (35) if r0 >= 0xa goto pc+1 ; R0=scalar(id=2,smin=umin=smin32=umin32=6,smax=umax=smax32=umax32=9,var_off=(0x0; 0xf)) 8: (37) r0 /= 0 div by zero When 4 is verified, r1's bounds are propagated to r0 but r0 also gets BPF_ADD_CONST (bug). When 5 is verified, r0 gets a new id (2) and its link with r1 is broken. After 6 we know r1 has bounds [14, 259] and therefore r0 should have bounds [10, 255], therefore the branch at 7 is always taken. But because r0's id was changed to 2, r1's new bounds are not propagated to r0. The verifier still thinks r0 has bounds [6, 255] before 7 and execution can reach div by zero. Fix this by preserving id in sync_linked_regs() like off and subreg_def. Fixes: 98d7ca374ba4 ("bpf: Track delta between "linked" registers.") Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/r/20260115151143.1344724-2-puranjay@kernel.org Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-01-16Merge tag 'gpio-fixes-for-v6.19-rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: "Two more GPIO fixes addressing an issue uncovered by the shared GPIO management changes in v6.19: - implement the missing .get_direction() callback for gpio-davinci - remove redundant check in GPIO core which can also propagate an invalid errno to user-space" * tag 'gpio-fixes-for-v6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpiolib: remove redundant callback check gpio: davinci: implement .get_direction()
2026-01-16sysfs(2): fs_index() argument is _not_ a pathnameAl Viro
... it's a filesystem type name. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16alpha: switch osf_mount() to strndup_user()Al Viro
... same as native mount(2) is doing for devname argument. While we are at it, fix misspelling ufs_args as cdfs_args in osf_ufs_mount() - layouts are identical, so it doesn't change anything, but the current variant is confusing for no reason. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16ksmbd: use CLASS(filename_kernel)Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16mqueue: switch to CLASS(filename)Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16user_statfs(): switch to CLASS(filename)Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16statx: switch to CLASS(filename_maybe_null)Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16quotactl_block(): switch to CLASS(filename)Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16chroot(2): switch to CLASS(filename)Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16move_mount(2): switch to CLASS(filename_maybe_null)Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16namei.c: switch user pathname imports to CLASS(filename{,_flags})Al Viro
filename_flags is used by user_path_at(). I suspect that mixing LOOKUP_EMPTY with real lookup flags had been a mistake all along; the former belongs to pathname import, the latter - to pathwalk. Right now none of the remaining in-tree callers of user_path_at() are getting LOOKUP_EMPTY in flags, so user_path_at() could probably be switched to CLASS(filename)... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16namei.c: convert getname_kernel() callers to CLASS(filename_kernel)Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16do_f{chmod,chown,access}at(): use CLASS(filename_uflags)Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16do_readlinkat(): switch to CLASS(filename_flags)Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16do_sys_truncate(): switch to CLASS(filename)Al Viro
Note that failures from filename_lookup() are final - ESTALE returned by it means that retry had been done by filename_lookup() and it failed there. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16do_utimes_path(): switch to CLASS(filename_uflags)Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16chdir(2): unspaghettify a bit...Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16do_fchownat(): unspaghettify a bit...Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16fspick(2): use CLASS(filename_flags)Al Viro
That kills the last place where we mix LOOKUP_EMPTY with lookup flags proper. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16name_to_handle_at(): use CLASS(filename_uflags)Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16vfs_open_tree(): use CLASS(filename_uflags)Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16do_open_execat(): don't care about LOOKUP_EMPTYAl Viro
do_file_open() doesn't. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16mount_setattr(2): don't mess with LOOKUP_EMPTYAl Viro
just use CLASS(filename_uflags) + filename_lookup() Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16file_[gs]etattr(2): switch to CLASS(filename_maybe_null)Al Viro
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16filename_...xattr(): don't consume filename referenceAl Viro
Callers switched to CLASS(filename_maybe_null) (in fs/xattr.c) and CLASS(filename_complete_delayed) (in io_uring/xattr.c). Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16non-consuming variants of do_{unlinkat,rmdir}()Al Viro
similar to previous commit; replacements are filename_{unlinkat,rmdir}() Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16non-consuming variant of do_mknodat()Al Viro
similar to previous commit; replacement is filename_mknodat() Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16non-consuming variant of do_mkdirat()Al Viro
similar to previous commit; replacement is filename_mkdirat() Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16non-consuming variant of do_symlinkat()Al Viro
similar to previous commit; replacement is filename_symlinkat() Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16non-consuming variant of do_linkat()Al Viro
similar to previous commit; replacement is filename_linkat() Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16Merge tag 'printk-for-6.19-rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux Pull printk fix from Petr Mladek: - Prevent softlockup by restoring IRQs in atomic flush after each record * tag 'printk-for-6.19-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: printk/nbcon: Restore IRQ in atomic flush after each emitted record
2026-01-16non-consuming variant of do_renameat2()Al Viro
filename_renameat2() replaces do_renameat2(); unlike the latter, it does not drop filename references - these days it can be just as easily arranged in the caller. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2026-01-16iio: pressure: mprls0025pa: add copyright linePetre Rodan
Add copyright line to the core driver. Signed-off-by: Petre Rodan <petre.rodan@subdimension.ro> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-01-16iio: pressure: mprls0025pa: change measurement sequencePetre Rodan
Implement a measurement sequence that does not involve a one byte read of the status byte before reading the conversion. The sensor's conversions should be read either once the EoC interrupt has triggered or 5ms after the 0xaa command. See Options 1 and 2 respectively in Tables 16 (page 15) and 18 (page 18) of the datasheet. Note that Honeywell's example code also covered in the datasheet follows Option 2 for both i2c and SPI. The datasheet does not specify any of the retry parameters that are currently implemented in the driver. A simple 5+ms sleep as specified in Option 2 is enough for a valid measurement sequence. The change also gets rid of the code duplication tied to the verification of the status byte. This change only affects users that do not define the EoC interrupt in the device tree. Datasheet: https://prod-edam.honeywell.com/content/dam/honeywell-edam/sps/siot/en-us/products/sensors/pressure-sensors/board-mount-pressure-sensors/micropressure-mpr-series/documents/sps-siot-mpr-series-datasheet-32332628-ciid-172626.pdf?download=false Signed-off-by: Petre Rodan <petre.rodan@subdimension.ro> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-01-16iio: pressure: mprls0025pa: stricter checks for the status bytePetre Rodan
Make sure a valid conversion comes with a status byte that only has the MPR_ST_POWER bit set. Return -EBUSY if also MPR_ST_BUSY is set or -EIO otherwise. Reviewed-by: Marcelo Schmitt <marcelo.schmitt1@gmail.com> Signed-off-by: Petre Rodan <petre.rodan@subdimension.ro> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-01-16iio: pressure: mprls0025pa: move memset to corePetre Rodan
Move memset() from the bus specific code into core. Zeroing out the buffer is performed because the sensor has noticeable latch-up sensitivity and in some cases it clamps the MISO signal to GND in sync with SCLK [1]. A raw conversion of zero is out of bounds since valid values have to be between output_min and output_max (and the smallest output_min is 2.5% of 2^24 = 419430). The user is expected to discard out of bounds pressure values. Given the fact that we can't follow the behaviour of all SPI controllers when faced to this clamping of an output signal, a raw conversion of zero is used as an early warning in case the low level SPI API reacts unexpectedly. Link: https://e2e.ti.com/support/processors-group/processors/f/processors-forum/1588325/am3358-spi-tx-data-corruption [1] Signed-off-by: Petre Rodan <petre.rodan@subdimension.ro> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-01-16iio: pressure: mprls0025pa: introduce tx bufferPetre Rodan
Use a tx_buf that is part of the priv struct for transferring data to the sensor instead of relying on a devm_kzalloc()-ed array. Remove the .init operation in the process. Reviewed-by: Marcelo Schmitt <marcelo.schmitt1@gmail.com> Signed-off-by: Petre Rodan <petre.rodan@subdimension.ro> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-01-16iio: pressure: mprls0025pa: rename buffer variablePetre Rodan
For the reason of better naming consistency rename priv->buffer into priv->rx_buf since tx_buf will get introduced in the next patch. Signed-off-by: Petre Rodan <petre.rodan@subdimension.ro> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-01-16iio: pressure: mprls0025pa: remove redundant declarationsPetre Rodan
Remove the iio_chan_spec and iio_dev structs which are already defined in the included iio.h header. Signed-off-by: Petre Rodan <petre.rodan@subdimension.ro> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-01-16iio: pressure: mprls0025pa: cleanup includesPetre Rodan
Remove unused headers and add required headers as needed. Signed-off-by: Petre Rodan <petre.rodan@subdimension.ro> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-01-16iio: pressure: mprls0025pa: fix pressure calculationPetre Rodan
A sign change is needed for proper calculation of the pressure. This is a minor fix since it only affects users that might have custom silicon from Honeywell that has honeywell,pmin-pascal != 0. Also due to the fact that raw pressure values can not be lower than output_min (400k-3.3M) there is no need to calculate a decimal for the offset. Fixes: 713337d9143e ("iio: pressure: Honeywell mprls0025pa pressure sensor") Signed-off-by: Petre Rodan <petre.rodan@subdimension.ro> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-01-16iio: pressure: mprls0025pa: fix scan_type structPetre Rodan
Fix the scan_type sign and realbits assignment. The pressure is a 24bit unsigned int between output_min and output_max. transfer function A: 10% to 90% of 2^24 transfer function B: 2.5% to 22.5% of 2^24 transfer function C: 20% to 80% of 2^24 [MPR_FUNCTION_A] = { .output_min = 1677722, .output_max = 15099494 } [MPR_FUNCTION_B] = { .output_min = 419430, .output_max = 3774874 } [MPR_FUNCTION_C] = { .output_min = 3355443, .output_max = 13421773 } Fixes: 713337d9143e ("iio: pressure: Honeywell mprls0025pa pressure sensor") Signed-off-by: Petre Rodan <petre.rodan@subdimension.ro> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2026-01-16iio: pressure: mprls0025pa: fix interrupt flagPetre Rodan
Interrupt falling/rising flags should only be defined in the device tree. Fixes: 713337d9143e ("iio: pressure: Honeywell mprls0025pa pressure sensor") Signed-off-by: Petre Rodan <petre.rodan@subdimension.ro> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
generated by cgit v1.2.3 (git 2.51.0) at 2026-11-08 15:14:53 +0000