kernel/git/next/linux-next.git/drivers/pps, branch master

Merge branch 'mm-nonmm-unstable' of https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2026-07-06T13:18:24+00:00

pps: don't allow PPS_KC_BIND on removed devices

2026-07-05T23:24:23+00:00

If userspace holds its file descriptor open, it can call PPS_KC_BIND on a device which has been unplugged, leaving pps_kc_hardpps_dev as a dangling pointer after close(). After that sequence, PPS_KC_BIND is broken until the system is rebooted, because the pointer comparison in pps_kc_bind() can never be true. calling pps_ktimer_init+0x0/0x1000 [pps_ktimer] @ 1081 initcall pps_ktimer_init+0x0/0x1000 [pps_ktimer] returned 0 after 811 usecs pps pps0: bound kernel consumer: edge=0x1 pps pps0: unbound kernel consumer on device removal pps pps0: bound kernel consumer: edge=0x1 calling pps_ktimer_init+0x0/0x1000 [pps_ktimer] @ 1085 initcall pps_ktimer_init+0x0/0x1000 [pps_ktimer] returned 0 after 340 usecs pps pps0: another kernel consumer is already bound Here is a short reproducer, which uses rmmod of the pps-ktimer testcase to simulate a device being unplugged: #include #include #include #include #include #include #include #include int main(void) { while (1) { int fd; if (system("insmod ./pps-ktimer.ko")) err(1, "insmod failed"); fd = open("/dev/pps0", O_RDWR); if (fd == -1) err(1, "open failed"); struct pps_bind_args args = { .tsformat = PPS_TSFMT_TSPEC, .edge = PPS_CAPTUREASSERT, .consumer = PPS_KC_HARDPPS, }; if (ioctl(fd, PPS_KC_BIND, &args)) err(1, "first PPS_KC_BIND failed"); if (system("rmmod pps-ktimer")) err(1, "rmmod failed"); if (ioctl(fd, PPS_KC_BIND, &args)) { if (errno != ENODEV) err(1, "second PPS_KC_BIND failed"); else puts("Got ENODEV, kernel is patched"); } close(fd); } } Fix this by setting a flag when the device is unplugged, returning -ENODEV from PPS_KC_BIND if the flag is set. For userspace to encounter this new behavior, it must do something which breaks the interface today, so this fix shouldn't cause any observable behavior change for working programs. Link: https://lore.kernel.org/672778c177ac9b6fdcb445e35c97ac4ca7d1149f.1780506611.git.calvin@wbinvd.org Signed-off-by: Calvin Owens Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/cover.1779733602.git.calvin%40wbinvd.org?part=1 Acked-by: Rodolfo Giometti Cc: Greg Kroah-Hartman Signed-off-by: Andrew Morton

pps: don't try to wait for negative timeouts in PPS_FETCH

2026-07-05T23:24:22+00:00

If userspace passes a negative timeout to PPS_FETCH, it triggers a kernel splat from schedule_timeout(): schedule_timeout: wrong timeout value fffffffffff0bfb4 CPU: 17 UID: 0 PID: 4720 Comm: a.out Not tainted 7.1.0-rc5-x86-kvm-00150-g331d97e36b37 #1 PREEMPT_RT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-20240910_120124-localhost 04/01/2014 Call Trace: dump_stack_lvl+0x4b/0x70 schedule_timeout+0xb7/0xe0 pps_cdev_pps_fetch.isra.0+0x93/0x150 pps_cdev_ioctl+0x70/0x310 __x64_sys_ioctl+0x7b/0xc0 do_syscall_64+0xb6/0xfc0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Here is a trivial reproducer that works with the PPS_CLIENT_KTIMER test device enabled in the kernel: #include #include #include #include #include #include int main() { struct pps_fdata fdata; int fd; fd = open("/dev/pps0", O_RDWR); if (fd == -1) err(1, "Failed to open /dev/pps0"); fdata.timeout.sec = -1; fdata.timeout.nsec = 0; if (ioctl(fd, PPS_FETCH, &fdata)) err(2, "PPS_FETCH failed"); close(fd); return 0; } Sashiko imagines this to be some sort of security problem, which is obviously really silly. But I think it is still worth fixing, so buggy userspace code can't trigger the splat. Silence the splat by using timespec64_to_jiffies(), which hard limits the timeout to LONG_MAX jiffies. To be safe, explicitly preserve the -ETIMEDOUT return value userspace sees today if it passes a negative timeout. If you really squint, this is still a slight behavior change in that there are "denormalized" combinations of tv_sec and tv_nsec which used to work but will now return -ETIMEDOUT. I can't imagine anybody will care about that... Link: https://lore.kernel.org/c5c97c3b3c9d66010382094fd538e59a38f4aacf.1781289959.git.calvin@wbinvd.org Fixes: eae9d2ba0cfc ("LinuxPPS: core support") Signed-off-by: Calvin Owens Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/cover.1779733602.git.calvin%40wbinvd.org?part=3 Acked-by: Rodolfo Giometti Cc: Greg Kroah-Hartman Signed-off-by: Andrew Morton

pps: pps-gpio: split IRQ handler into hardirq timestamper + threaded handler

2026-07-05T23:24:22+00:00

Split the pps-gpio interrupt handler into a primary (hardirq) handler that captures the PPS timestamp at interrupt entry, and a threaded handler that processes the event. This produces the same two-part handler structure on both PREEMPT_RT and non-RT kernels. On non-RT kernels the threaded portion runs immediately after the primary, with no behavioral change compared to the previous single-handler implementation. On PREEMPT_RT, where interrupt handlers are force-threaded by default, the previous single-handler implementation captured the timestamp inside the threaded portion, after IRQ-thread scheduling delay. With the split, the timestamp is captured in true hardirq context as it is on non-RT kernels, eliminating a significant source of PPS jitter on RT systems. Link: https://lore.kernel.org/2e32729029fbf6977ecf04665eb00f2efd3e2c17.1780359378.git.calvin@wbinvd.org Signed-off-by: Michael Byczkowski Signed-off-by: Calvin Owens Reviewed-by: Sebastian Andrzej Siewior Tested-by: Michael Byczkowski Tested-by: Calvin Owens Acked-by: Rodolfo Giometti Signed-off-by: Andrew Morton

Replace by more specific (c files)

2026-07-03T05:38:17+00:00

Replace the #include of by the more specific where applicable. For most cases the include can be dropped completely, only a few drivers need one or two headers added. Acked-by: Danilo Krummrich Acked-by: Takashi Sakamoto Acked-by: Bjorn Helgaas Link: https://patch.msgid.link/1a3f2007c5c5dcf555c09a4035ce3ae8ef1b6c49.1782808461.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König (The Capable Hub)

pps: generators: Use ktime_get_real_ts64() instead of ktime_get_snapshot()

2026-06-02T09:39:58+00:00

There is no reason to use the more complex ktime_get_snapshot() for retrieving CLOCK_REALTIME. Just use ktime_get_real_ts64(), which avoids the extra timespec64 conversion as a bonus. No functional change intended. Signed-off-by: Thomas Gleixner Tested-by: Arthur Kiyanovski Reviewed-by: David Woodhouse Reviewed-by: Thomas Weißschuh Reviewed-by: Jacob Keller Acked-by: Rodolfo Giometti Link: https://patch.msgid.link/20260529195557.074439049@kernel.org

pps: change pps_class to a const struct

2026-04-02T14:33:00+00:00

The class_create() call has been deprecated in favor of class_register() as the driver core now allows for a struct class to be in read-only memory. Change pps_class to be a const struct class and drop the class_create() call. Suggested-by: Greg Kroah-Hartman Signed-off-by: Jori Koolstra Acked-by: Rodolfo Giometti Reviewed-by: Greg Kroah-Hartman Link: https://patch.msgid.link/20260302151132.3302993-1-jkoolstra@xs4all.nl Signed-off-by: Greg Kroah-Hartman

pps: change pps_gen_class to a const struct

2026-04-02T14:32:52+00:00

The class_create() call has been deprecated in favor of class_register() as the driver core now allows for a struct class to be in read-only memory. Change pps_gen_class to be a const struct class and drop the class_create() call. Signed-off-by: Jori Koolstra Reviewed-by: Greg Kroah-Hartman Acked-by: Rodolfo Giometti Link: https://patch.msgid.link/20260302142436.3292766-1-jkoolstra@xs4all.nl Signed-off-by: Greg Kroah-Hartman

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-22T01:09:51+00:00

This was done entirely with mindless brute force, using git grep -l '\

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21T09:02:28+00:00

This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook