Merge tag 'wq-for-7.3-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq
Pull workqueue fixes from Tejun Heo:
- An unbound worker pool could be freed while still reachable through
the pending-activation list, leading to a use-after-free. Unlink
before dropping the reference
- On PREEMPT_RT, the BH workqueue kick raised softirqs from preemptible
context, tripping a lockdep assertion and possibly losing
concurrently raised softirq bits
- Draining BH work off a dead CPU nests two pools' callback locks,
which lockdep misreported as recursive locking. The nesting cannot
deadlock. Annotate it
- Reject watchdog thresholds that overflow the conversion to jiffies
- Make the drgn workqueue dump script work again on kernels and vmcores
[8 lines not shown]
Merge tag 'cgroup-for-7.3-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
Pull cgroup fixes from Tejun Heo:
- After cgroup.kill was written to a cgroup, every child cloned into it
with CLONE_INTO_CGROUP was spuriously killed because the fork path
snapshotted the kill counter before resolving the target cgroup
- Releasing an isolated cpuset partition dropped the isolation of CPUs
isolated on the kernel command line
- Selftest and documentation fixes
* tag 'cgroup-for-7.3-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
selftests/cgroup: test clone3() into a previously killed cgroup
cgroup: fix spurious SIGKILL of CLONE_INTO_CGROUP children
selftests/cgroup: Add test for preserving boot-isolated CPUs
cgroup/cpuset: Preserve boot-isolated CPUs on partition release
selftests/cgroup: Drop invalid boot isolation comparison
[3 lines not shown]
tools/workqueue/wq_dump.py: Support backward compatibility for wq->attrs rename
Commit 464e454e1cb4 ("workqueue: rename wq->unbound_attrs to wq->attrs")
renamed wq->unbound_attrs to wq->attrs. When running wq_dump.py against
older running kernels or vmcores where struct workqueue_struct still
contains unbound_attrs, drgn raises an AttributeError.
Add a wq_attrs() helper to allow wq_dump.py to inspect both older and newer
kernel versions seamlessly.
Fixes: 464e454e1cb4 ("workqueue: rename wq->unbound_attrs to wq->attrs")
Signed-off-by: Aaron Tomlin <atomlin at atomlin.com>
Signed-off-by: Tejun Heo <tj at kernel.org>
Merge tag 'sched_ext-for-7.3-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext
Pull sched_ext fixes from Tejun Heo:
- The task ownership check in the dispatch queue move operation raced
against the task exiting or moving to a different sub-scheduler,
spuriously triggering scheduler aborts. Fix by moving the check under
the queue lock
- The cgroup bandwidth change callback runs in a sleepable context but
sleepable implementations were rejected at load time. Allow them and
add a marker so userspace can detect the capability
- Sync tooling headers with the scx repo for accumulated compatibility
improvements
- Example scheduler fixes: ignored timer re-arm failures and vtime
credit loss on cgroup migration
[15 lines not shown]
Merge tag 'xfs-fixes-7.3-rc2' of gitolite.kernel.org:/pub/scm/fs/xfs/xfs-linux
Pull xfs fixes from Carlos Maiolino:
"This contains a few fixes for the zoned storage support, a possible
deadlock vector fix, some code refactoring patches and a quota evasion
fix on XFS while exporting it via NFS.
Please note that for the quota evasion fix, a couple patches for the
capability subsystem are included in the pull request. Those have been
ack'ed by the respective maintainer which also agreed to have them
going through the xfs tree.
This also includes a patch for the quota subsystem to stop issuing
audit messages during quota enforcing. Quota maintainer also ack'ed
and agreed with this going through xfs tree"
* tag 'xfs-fixes-7.3-rc2' of gitolite.kernel.org:/pub/scm/fs/xfs/xfs-linux:
capability: unexport has_capability_noaudit
xfs: replace ns_capable_noaudit
[14 lines not shown]
workqueue: reject watchdog thresholds that overflow jiffies
The watchdog threshold is supplied in seconds but is multiplied by HZ
before being used as a jiffies interval. Reject values that exceed
MAX_JIFFY_OFFSET / HZ so the multiplication cannot wrap and the
time_after() comparisons remain within their supported range.
The check is performed before changing the threshold or watchdog timer.
Zero remains the value used to disable the watchdog.
Fixes: 82607adcf9cdf ("workqueue: implement lockup detector")
Signed-off-by: Jiacheng Xu <stitch at zju.edu.cn>
Signed-off-by: Tejun Heo <tj at kernel.org>
sched_ext: Fix missing @slice and @vtime descriptions in finish_dispatch() kernel-doc
Commit 13f1eae3b662 ("sched_ext: Synchronize slice and dsq_vtime
writes") added the slice and vtime parameters to finish_dispatch() but
did not update its kernel-doc, which produces warnings:
Warning: function parameter 'slice' not described in 'finish_dispatch'
Warning: function parameter 'vtime' not described in 'finish_dispatch'
Describe both parameters using the same wording as
dispatch_to_local_dsq(), which receives the same values.
Signed-off-by: Liang Luo <luoliang at kylinos.cn>
Signed-off-by: Tejun Heo <tj at kernel.org>
sched_ext: Fix several comment issues
Fix several comment issues found during review:
__setschduler_prio() -> __setscheduler_class()
scx_iter_scx_dsq_new() -> bpf_iter_scx_dsq_new()
scx_next_task_scx() -> set_next_task_scx()
Signed-off-by: Wanwu Li <liwanwu at kylinos.cn>
Signed-off-by: Tejun Heo <tj at kernel.org>
sched_ext: Check bpf_timer_start return values in scx_qmap
monitor_timerfn(), lowpri_timerfn() and round_robin_timerfn() ignore
bpf_timer_start()'s return value: a failed re-arm silently stops the
periodic heartbeat, starving every task parked in LOWPRI_DSQ (lowpri)
or freezing cid rotation (round-robin). Check the returns and raise
scx_bpf_error(), matching the init paths.
Signed-off-by: Wanwu Li <liwanwu at kylinos.cn>
Signed-off-by: Tejun Heo <tj at kernel.org>
sched_ext: Fix vtime delta loss in scx_flatcg cgroup migration
fcg_cgroup_move() lost the signed vtime offset across cgroup
migration in the mechanical conversion to time helpers:
time_delta() clamps negative deltas to 0, so a queued task (whose
dsq_vtime is normally behind the source frontier) loses its
accumulated vtime credit and lands exactly at the destination
frontier instead of keeping its relative position. Restore the
wrapping signed subtraction.
Fixes: 62addc6dbf36 ("sched_ext: Use time helpers in BPF schedulers")
Signed-off-by: Wanwu Li <liwanwu at kylinos.cn>
Signed-off-by: Tejun Heo <tj at kernel.org>
sched_ext: Fix timer pinning and return value in scx_central
central_timerfn() re-arms the timer with a hardcoded
BPF_F_TIMER_CPU_PIN flag and ignores the return value, defeating
start_central_timer()'s -EINVAL fallback for kernels without the flag
(<6.7): on such kernels the first tick kills the timer permanently
with no diagnostic. Honor timer_pinned and check the return like
the initial arm does.
Fixes: 22a920209ab6 ("sched_ext: Implement tickless support")
Signed-off-by: Wanwu Li <liwanwu at kylinos.cn>
Signed-off-by: Tejun Heo <tj at kernel.org>
selftests/cgroup: test clone3() into a previously killed cgroup
Once cgroup.kill had been written to a cgroup, a stale kill_seq
snapshot (taken in cgroup_css_set_fork() before the target cgroup was
resolved) caused every child subsequently cloned into that cgroup with
clone3(CLONE_INTO_CGROUP) to be SIGKILLed on the spot.
Add a regression test: create a cgroup, kill it while it is empty,
then clone a child into it and check that the child runs and exits
cleanly. On a kernel without the fix, the test fails:
not ok 4 test_cgkill_clone_into_killed
The test is skipped on kernels without clone3() or without
CLONE_INTO_CGROUP.
Cc: Shakeel Butt <shakeel.butt at linux.dev>
Assisted-by: LLM
Signed-off-by: Etienne Perot <eperot at google.com>
Signed-off-by: Tejun Heo <tj at kernel.org>
cgroup: fix spurious SIGKILL of CLONE_INTO_CGROUP children
Since commit b69bb476dee9 ("cgroup: fix race between fork and
cgroup.kill"), the fork path snapshots the kill_seq of the child's
future cgroup into kargs->kill_seq, and cgroup_post_fork() SIGKILLs
the child if that cgroup's kill_seq has changed in the meantime, to
catch forks racing with a cgroup.kill sweep.
For CLONE_INTO_CGROUP, however, the snapshot in cgroup_css_set_fork()
is taken before the target cgroup has been resolved: kargs->cgrp is
always NULL at this point (it is only set at the end of the function).
So the "if (kargs->cgrp)" branch is dead code and the snapshot always
records the kill_seq of the parent's cgroup. cgroup_post_fork() then
compares it with the kill_seq of the target cgroup, so the child gets
SIGKILLed whenever the two cgroups have been killed a different number
of times.
As a result, once cgroup.kill has been written to a cgroup, every
child subsequently cloned into it with clone3(CLONE_INTO_CGROUP) is
[20 lines not shown]
Merge tag 'i2c-fixes-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux
Pull i2c fixes from Andi Shyti:
"Fixes mainly for teardown and resource handling, runtime PM and
hardware-specific controller issues:
- fix debugfs use-after-free when removing the adapter
- designware: apply interrupt mask quirk for HJMC3001
- imx-lpi2c: avoid target accesses on master-only controllers
- mux: release channel node when adapter registration fails
- qcom-cci: fix autosuspend and runtime PM cleanup on removal
- qcom-geni: fix timing parameters for 32 MHz clock"
* tag 'i2c-fixes-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux:
[6 lines not shown]
Merge tag 'cocci-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux
Pull Coccinelle updates from Julia Lawall:
- Clean up a number of the semantic patches in the scripts/coccinelle
directory, particularly with respect to functions that no longer
exist in the kernel (Sang-Heon Jeon)
He and I have also done some reorganizations that improve
performance.
- Eliminate some false positives (me)
- Fix an out of date URL (相浦彰)
* tag 'cocci-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux:
coccinelle: ifnulldev_put: update error message
coccinelle: ifnulldev_put: update outdated helper names
coccinelle: atomic_as_refcounter: drop atomic_long_dec_and_lock
[15 lines not shown]
CREDITS/mailmap: add some info about Darrick J. Wong
Add myself to CREDITS because apparently I've never done that; and
update mailmap so that all my old email addresses get remapped to the
kernel.org redirector.
Signed-off-by: "Darrick J. Wong" <djwong at kernel.org>
Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
Merge tag 'timers-urgent-2026-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull timer fix from Ingo Molnar:
- Fix UM build regression caused by the removal of the UM
specific timex.h header (Thomas Weißschuh)
* tag 'timers-urgent-2026-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
um: Use asm-generic/timex.h over the host architecture one
Merge tag 'locking-urgent-2026-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull locking fix from Ingo Molnar:
- Revert a commit to spinlock cleanup guards that got caught up
in the subtle limitations & fragility of guards (again...) and
caused a regression (Peter Zijlstra)
* tag 'locking-urgent-2026-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
locking: Revert switching guards to _irq_{disable,enable}()
Merge tag 'rust-fixes-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux
Pull Rust fixes from Miguel Ojeda:
"Toolchain and infrastructure:
- Fix KCFI failures, such as in Rust doctests, by disabling function
merging when CFI is enabled. Gary reported the LLVM bug to upstream
and it is now fixed in their mainline.
- Fix 'objtool' fallthrough warnings under the experimental
'CONFIG_RUST_INLINE_HELPERS' by passing (for the combined Rust and
helpers code) the LLVM options needed to preserve the unreachable
traps that 'rustc' normally emits.
In addition, fix 'objtool' errors when LTO is enabled on top, by
also filtering out the LTO flags (for the combined Rust and helpers
code) so that the traps are kept in place.
- Fix 'objtool' warnings by adding one more 'noreturn' function.
[23 lines not shown]
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux
Pull arm updates from Russell King:
"Updates for 7.3:
- add module description for kprobes testing module
- remove references to CONFIG_CPU_ARM92x_CPU_IDLE options
- expand comment in ARM's __switch_to()
Also a number of fixes that missed 7.2:
- disable broken eBPF on RiscPC
- more BKPT fixes (guys, it's a *very* bad idea when everyone uses
the BKPT instruction for their own differing purposes)
- another preempt-rt fix, this time for siglock / CPU timers
[15 lines not shown]
Merge tag 'for-linus' of https://github.com/openrisc/linux
Pull OpenRISC updates from Stafford Horne:
"One small trivial macro cleanup and one bug fix.
The bug fix is to fix an unchecked access in our or1k_atomic syscall,
I am debating if we should just deprecate this as there is minimal
need for it"
* tag 'for-linus' of https://github.com/openrisc/linux:
openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
openrisc: drop unneeded semicolon
Merge tag 'trace-v7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull tracing fixes from Steven Rostedt:
- Fix error output of boot instance creation failure
Currently if a boot instance creation fails, instead of printing out
the name of the instance that failed, it prints "(null)". That is
because it prints "cur_str" that had already been processed by
strsep(). Print the saved name instead.
While at it, print the error code of the failure.
- Fix use-after-free for same named historgrams
Histograms can be named so that they can be used in multiple events.
But if the named histogram has a variable attached, the second event
that uses the named histogram which duplicates it and needs to free
the original after duplication leaves the old variable in place and
[81 lines not shown]
coccinelle: ifnulldev_put: update error message
Update the report and org mode messages to reflect the new
function names.
Signed-off-by: Julia Lawall <Julia.Lawall at inria.fr>
coccinelle: ifnulldev_put: update outdated helper names
dev_put_track() and dev_hold_track() were renamed to netdev_put() and
netdev_hold() by commit d62607c3fe45 ("net: rename reference+tracking
helpers").
So update the names.
Signed-off-by: Sang-Heon Jeon <ekffu200098 at gmail.com>
Signed-off-by: Julia Lawall <Julia.Lawall at inria.fr>
coccinelle: atomic_as_refcounter: drop atomic_long_dec_and_lock
atomic_long_dec_and_lock() has never existed. So drop it from the rules.
No functional change.
Signed-off-by: Sang-Heon Jeon <ekffu200098 at gmail.com>
Signed-off-by: Julia Lawall <Julia.Lawall at inria.fr>
coccinelle: kfree_mismatch: drop vmalloc_exec
vmalloc_exec() was removed by commit 7a0e27b2a0ce ("mm: remove
vmalloc_exec").
So drop it from the rules.
No functional change.
Signed-off-by: Sang-Heon Jeon <ekffu200098 at gmail.com>
Signed-off-by: Julia Lawall <Julia.Lawall at inria.fr>
coccinelle: pool_zalloc-simple: drop the pci_pool_alloc rules
pci_pool_alloc() and pci_pool_zalloc() were removed by commit
88dee3b0efe4 ("PCI: Remove unused pci_pool wrappers").
So drop the pci_pool_alloc rules.
No functional change.
Signed-off-by: Sang-Heon Jeon <ekffu200098 at gmail.com>
Signed-off-by: Julia Lawall <Julia.Lawall at inria.fr>
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi
Pull more SCSI updates from Martin Petersen:
"Remaining updates for the 7.3 merge window. The only core change is
enabling context analysis for the SCSI layer and UFS.
The remaining changes are either bug fixes or hardening"
* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi: (26 commits)
scsi: snic: Fix SCSI host leak on workqueue allocation failure
scsi: MAINTAINERS: Update my email address
scsi: MAINTAINERS: Leave the cumana_1 and oak drivers to the RISCPC maintainers
scsi: leapraid: Standardize NCQ priority sysfs attributes
scsi: leapraid: Serialize firmware log mmap with teardown
scsi: leapraid: Balance host references for firmware log VMAs
scsi: lpfc: Remove unnnecessary NULL check
scsi: qla2xxx: Fix an loop timeout test
scsi: qla2xxx: Fix an error code in qla_get_tmf()
scsi: ibmvfc: Fix use of uninitialized rport in ibmvfc_do_work()
[11 lines not shown]
