kernel/git/next/linux-next.git/arch/powerpc, branch master

Merge branch 'headers' of git://git.infradead.org/users/willy/pagecache.git

2026-09-16T13:34:13+00:00

# Conflicts: # net/ceph/osd_client.c

Merge branch 'master' of https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git

2026-09-16T12:29:31+00:00

Merge branch 'fs-next' of linux-next

2026-09-16T12:07:10+00:00

Merge branch 'mm-nonmm-unstable' of https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2026-09-16T11:51:57+00:00

next-20260914/vfs-brauner

2026-09-16T11:09:16+00:00

powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba

2026-09-16T08:13:58+00:00

The commit b1af23d836f8 ("KVM: PPC: iommu: Unify TCE checking") unified IOBA parameter checking across KVM and VFIO into iommu_tce_check_ioba(). While doing so, the passed in argument npages is ignored and constant value '1' is used leaving out a possible overflow as the callers can legitimately be using npages > 1 for H_STUFF_TCE or H_PUT_TCE_INDIRECT cases. Fix this by accounting for 'npages', checking for arithmetic overflow, and verifying that the entire requested range (ioba - offset + npages) does not exceed the table capacity 'size'. Fixes: b1af23d836f8 ("KVM: PPC: iommu: Unify TCE checking") Reviewed-by: Ritesh Harjani (IBM) Tested-by: R Nageswara Sastry Signed-off-by: Shivaprasad G Bhat Signed-off-by: Gautam Menghani Signed-off-by: Madhavan Srinivasan

KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure

2026-09-16T08:13:54+00:00

In kvmppc_svm_page_in(), if uv_page_in() fails after kvmppc_uvmem_get_page() has succeeded, the secure device page is never released. kvmppc_uvmem_get_page() sets a bit in kvmppc_uvmem_bitmap, allocates a kvmppc_uvmem_page_pvt struct, marks the GFN as KVMPPC_GFN_UVMEM_PFN, and calls zone_device_page_init() which sets refcount=1 and locks the page. The subsequent goto out_finalize skips the *mig.dst assignment, so migrate_vma_finalize() is a no-op for the page, and none of those resources are ever reclaimed. Each occurrence permanently consumes one entry from the firmware-bounded secure memory pool (kvmppc_uvmem_bitmap), leaks pvt, and leaves the GFN marked as secure — making it unusable for the lifetime of the VM. The twin __kvmppc_svm_page_out() already handles the analogous uv_page_out() failure correctly with unlock_page(dpage); __free_page(dpage). Apply the same pattern here: unlock_page() followed by put_page(), which chains through free_zone_device_folio() into kvmppc_uvmem_folio_free() to clear the bitmap bit, free pvt, and reset the GFN state. Reachable whenever uv_page_in() returns an error (e.g. UV pool exhaustion) on any POWER9/10 + Ultravisor/PEF system. Fixes: ca9f4942670c ("KVM: PPC: Book3S HV: Support for running secure guests") Reviewed-by: Ritesh Harjani (IBM) Tested-by: R Nageswara Sastry Signed-off-by: Amit Machhiwal Signed-off-by: Gautam Menghani Signed-off-by: Madhavan Srinivasan

KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()

2026-09-16T08:13:50+00:00

kvmhv_emulate_tlbie_all_lpid() iterates the nested-guest IDR and drops mmu_lock before calling kvmhv_emulate_tlbie_lpid(), but does not hold a reference on the kvm_nested_guest pointer obtained from the IDR. A concurrent vCPU issuing a single-LPID tlbie (is=2, ric=2) can race through kvmhv_flush_nested() -> kvmhv_remove_nested() -> idr_remove / --refcnt -> kvmhv_release_nested() -> kfree(gp) in that window, leaving the iterating vCPU with a dangling pointer. The subsequent mutex_lock(&gp->tlb_lock) and accesses to gp->shadow_pgtable, gp->shadow_lpid and gp->l1_host all touch freed memory. The free path is fully L1-controlled. Fix this by incrementing gp->refcnt inside the loop before dropping mmu_lock, mirroring what kvmhv_get_nested() does, and releasing the reference with kvmhv_put_nested() after the per-guest work completes. This is the same get/put discipline already used at every other call site that drops mmu_lock while holding a nested-guest pointer. Fixes: e3b6b4661527 ("KVM: PPC: Book3S HV: Implement H_TLB_INVALIDATE hcall") Reviewed-by: Ritesh Harjani (IBM) Tested-by: R Nageswara Sastry Signed-off-by: Amit Machhiwal Signed-off-by: Gautam Menghani Signed-off-by: Madhavan Srinivasan

Merge branch into tip/master: 'sched/core'

2026-09-16T06:58:34+00:00

# New commits in sched/core: e81ee0630837 ("sched/fair: Reset NUMA fault locality after scan period update") ef9293b3b797 ("sched: dynamic: Fix preemption model strings") 879eaa76e608 ("sched: Remove unneeded function type cast in do_balance_callbacks()") f549101187c8 ("sched/deadline: check start_dl_timer expiry with ktime_before()") 2a672daa4b27 ("sched/feat: Use the new static key API for sched_feat") a5576ebce920 ("sched: Convert paravirt_steal to new static key APIs") 9650ce11f2e3 ("sched: dynamic: Simplify preempt model accessors") 5b9a28eeed37 ("sched: dynamic: Remove HAVE_PREEMPT_DYNAMIC_{CALL,KEY}") aa4178f63847 ("sched: dynamic: Simplify irqentry_exit_cond_resched()") b9d267b9d632 ("sched: dynamic: Simplify preempt_schedule{,_notrace}()") 88e0b3bb9930 ("sched: dynamic: Simplify {cond,might}_resched()") d3d16750693b ("sched: dynamic: Make PREEMPT_DYNAMIC depend on ARCH_HAS_PREEMPT_LAZY") 772d9ffbfd26 ("sched: Migrate whole chain in proxy_migrate_task()") 6b73a09e943f ("sched: Break out core of attach_tasks() helper into sched.h") 1f8805138593 ("sched: Switch rq->next_class in proxy_reset_donor()") 09351db90a28 ("sched/core: Don't proxy-exec unmatched cookie lock owners") 9be817f991e2 ("sched/core: Avoid migrating blocked_on tasks") 3dd95f077371 ("sched/core: Don't steal a proxy-exec donor") Signed-off-by: Ingo Molnar

Merge branch into tip/master: 'perf/core'

2026-09-16T06:58:33+00:00

# New commits in perf/core: 68aca309e49c ("perf/x86/intel: Add sanity check for PEBS record/fragment size") c34db2f95094 ("perf/x86: Activate back-to-back NMI detection for arch-PEBS induced NMIs") 00cf8daabe2b ("perf/x86/intel: Advertise PERF_PMU_CAP_SIMD_REGS capability") c4fabb67a47f ("perf/x86/intel: Support arch-PEBS based SIMD/eGPRs sampling") 098cdd582a9b ("perf/x86: Support SSP sampling using sample_regs_* fields") 578460d9af8d ("perf/x86: Support eGPRs sampling using sample_regs_* fields") a2c64c74c029 ("perf: Enhance perf_reg_validate() with simd_enabled argument") 74d55a827e31 ("perf/x86: Support OPMASK sampling using sample_simd_pred_reg_* fields") 3807f6996a0b ("perf/x86: Support ZMM sampling using sample_simd_vec_reg_* fields") b76210d32147 ("perf/x86: Support YMM sampling using sample_simd_vec_reg_* fields") e9d76ada769c ("perf/x86: Support XMM sampling using sample_simd_vec_reg_* fields") 918b7d6d1729 ("perf: Add sampling support for SIMD registers") edd9aec51213 ("perf/x86: Enable XMM register sampling for REGS_USER case") b84c96283684 ("perf/x86: Enable XMM register sampling for non-PEBS events") c09466807467 ("perf/x86/intel: Centralize PERF_PMU_CAP_EXTENDED_REGS updates") 05fe8825796e ("perf: Move and enhance has_extended_regs() for arch-specific use") 450d73dc5f91 ("x86/fpu: Add update_fpu_state_and_flag() helper") 03b89c9f202e ("x86/fpu/xstate: Add xsaves_nmi() helper") 9c05620b4971 ("perf/x86: Use x86_perf_regs in NMI handlers") cb388bd530cc ("perf: Eliminate duplicate arch-specific function definitions") bbdf84fcedfa ("perf/x86/intel: Convert x86_perf_regs to per-cpu variables") 62e074f55f41 ("perf/x86/intel: Enable large PEBS sampling for XMMs") 9106892e27ca ("perf/x86: Move hybrid PMU initialization before x86_pmu_starting_cpu()") Signed-off-by: Ingo Molnar