Linux kernel stable tree https://git.rulkc.org/pub/scm/linux/kernel/git/stable/linux.git/atom?h=linux-7.2.y 2026-06-23T22:32:24+00:00 2026-06-23T22:32:24+00:00 Bjorn Helgaas bhelgaas@google.com 2026-06-23T22:32:24+00:00 urn:sha1:2c2fb7a8aa10e9ca7f2a49d426469ec89e3b267a - Fix typos in documentation (josh ziegler) - Use FIELD_MODIFY() instead of open-coding it (Hans Zhang) * pci/misc: PCI: Use FIELD_MODIFY() instead of open-coding it Documentation: PCI: Fix typos 2026-06-23T22:32:02+00:00 Bjorn Helgaas bhelgaas@google.com 2026-06-23T22:32:02+00:00 urn:sha1:131618da3a0716d10d47645214e32d75fe19efa8 - Improve resource claim logging for debuggability (Ilpo Järvinen) - Rename 'added' to 'add_list' for naming consistency (Ilpo Järvinen) - Consolidate 'add_list' sanity checks (Ilpo Järvinen) - Clean up several uses of const parameters (Ilpo Järvinen) - Move pci_resource_alignment() from header to setup-res.c file (Ilpo Järvinen) * pci/resource: PCI: Move pci_resource_alignment() to setup-res.c file PCI: Convert pci_resource_alignment() input parameters to const PCI: Make pci_sriov_resource_alignment() pci_dev const powerpc/pseries: Make pseries_get_iov_fw_value() & pnv_iov_get() pci_dev const resource: Make resource_alignment() input const resource PCI: Remove const removal cast PCI: Consolidate add_list (aka realloc_head) empty sanity checks PCI: Rename 'added' to 'add_list' PCI: Log all resource claims 2026-06-23T17:08:51+00:00 Ilpo Järvinen ilpo.jarvinen@linux.intel.com 2026-04-29T12:26:13+00:00 urn:sha1:79a648209dadcc0f2ff0f27100fd79d1c890ccf8 pci_sriov_resource_alignment() inputs struct pci_dev which it should not need to alter to calculate alignment. Make pci_dev pci_sriov_resource_alignment() inputs const. It requires making pci_iov_resource_size() input const as well. Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20260429122617.7324-8-ilpo.jarvinen@linux.intel.com 2026-05-05T16:48:13+00:00 Hans Zhang 18255117159@163.com 2026-04-30T16:24:05+00:00 urn:sha1:42ec65b46a4fc7565d48daa42bf025fdc67800eb Use FIELD_MODIFY() to remove open-coded bit manipulation. No functional change intended. Signed-off-by: Hans Zhang <18255117159@163.com> [bhelgaas: squash together] Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> # pcie-nxp-s32g.c Link: https://patch.msgid.link/20260430162420.42839-2-18255117159@163.com Link: https://patch.msgid.link/20260430162420.42839-3-18255117159@163.com Link: https://patch.msgid.link/20260430162420.42839-4-18255117159@163.com Link: https://patch.msgid.link/20260430162420.42839-5-18255117159@163.com Link: https://patch.msgid.link/20260430162420.42839-6-18255117159@163.com Link: https://patch.msgid.link/20260430162420.42839-7-18255117159@163.com Link: https://patch.msgid.link/20260430162420.42839-8-18255117159@163.com Link: https://patch.msgid.link/20260430162420.42839-9-18255117159@163.com Link: https://patch.msgid.link/20260430162420.42839-10-18255117159@163.com Link: https://patch.msgid.link/20260430162420.42839-11-18255117159@163.com Link: https://patch.msgid.link/20260430162420.42839-12-18255117159@163.com Link: https://patch.msgid.link/20260430162420.42839-13-18255117159@163.com Link: https://patch.msgid.link/20260430162420.42839-14-18255117159@163.com Link: https://patch.msgid.link/20260430162420.42839-15-18255117159@163.com Link: https://patch.msgid.link/20260430162420.42839-16-18255117159@163.com Link: https://patch.msgid.link/20260430162420.42839-17-18255117159@163.com 2026-04-27T14:47:04+00:00 Marco Nenciarini mnencia@kcore.it 2026-04-17T13:24:37+00:00 urn:sha1:f34f1712229d71ce4286440fef12526fd4590b37 sriov_restore_vf_rebar_state() uses the VF Resizable BAR Control register to decide how many VF BARs to restore (nbars) and which VF BAR each iteration addresses (bar_idx). bar_idx indexes into dev->sriov->barsz[], which has only PCI_SRIOV_NUM_BARS (6) entries. When a device does not respond, config reads typically return PCI_ERROR_RESPONSE (~0). Both fields are 3 bits wide, so nbars and bar_idx both evaluate to 7. The barsz[] access then goes out of bounds. UBSAN reports this as: UBSAN: array-index-out-of-bounds in drivers/pci/iov.c:948:51 index 7 is out of range for type 'resource_size_t [6]' Observed on an NVIDIA RTX PRO 1000 GPU (GB207GLM) that stopped responding during a failed GC6 power state exit. The subsequent pci_restore_state() invoked sriov_restore_vf_rebar_state() while config reads returned 0xffffffff, triggering the splat. Bail out if any VF Resizable BAR Control read returns PCI_ERROR_RESPONSE. No further VF BARs are touched, which is safe because a config read that returns PCI_ERROR_RESPONSE indicates the device is unreachable and restoration is pointless. This mirrors the guard in pci_restore_rebar_state(). Fixes: 5a8f77e24a30 ("PCI/IOV: Restore VF resizable BAR state after reset") Signed-off-by: Marco Nenciarini <mnencia@kcore.it> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/44a4ae53ec2825816b816c85cd378430d9a95cc6.1776429882.git.mnencia@kcore.it 2026-02-22T01:09:51+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-02-22T00:37:42+00:00 urn:sha1:bf4afc53b77aeaa48b5409da5c8da6bb4eff7f43 This was done entirely with mindless brute force, using git grep -l '\<k[vmz]*alloc_objs*(.*, GFP_KERNEL)' | xargs sed -i 's/\(alloc_objs*(.*\), GFP_KERNEL)/\1)/' to convert the new alloc_obj() users that had a simple GFP_KERNEL argument to just drop that argument. Note that due to the extreme simplicity of the scripting, any slightly more complex cases spread over multiple lines would not be triggered: they definitely exist, but this covers the vast bulk of the cases, and the resulting diff is also then easier to check automatically. For the same reason the 'flex' versions will be done as a separate conversion. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> 2026-02-21T09:02:28+00:00 Kees Cook kees@kernel.org 2026-02-21T07:49:23+00:00 urn:sha1:69050f8d6d075dc01af7a5f2f550a8067510366f This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook <kees@kernel.org> 2026-02-01T22:05:42+00:00 Niklas Schnelle schnelle@linux.ibm.com 2025-12-16T22:14:03+00:00 urn:sha1:a5338e365c4559d7b4d7356116b0eb95b12e08d5 Commit 05703271c3cd ("PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV") tried to fix a race between the VF removal inside sriov_del_vfs() and concurrent hot unplug by taking the PCI rescan/remove lock in sriov_del_vfs(). Similarly the PCI rescan/remove lock was also taken in sriov_add_vfs() to protect addition of VFs. This approach however causes deadlock on trying to remove PFs with SR-IOV enabled because PFs disable SR-IOV during removal and this removal happens under the PCI rescan/remove lock. So the original fix had to be reverted. Instead of taking the PCI rescan/remove lock in sriov_add_vfs() and sriov_del_vfs(), fix the race that occurs with SR-IOV enable and disable vs hotplug higher up in the callchain by taking the lock in sriov_numvfs_store() before calling into the driver's sriov_configure() callback. Fixes: 05703271c3cd ("PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV") Reported-by: Benjamin Block <bblock@linux.ibm.com> Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Reviewed-by: Benjamin Block <bblock@linux.ibm.com> Reviewed-by: Gerd Bayer <gbayer@linux.ibm.com> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251216-revert_sriov_lock-v3-2-dac4925a7621@linux.ibm.com 2026-02-01T22:03:39+00:00 Niklas Schnelle schnelle@linux.ibm.com 2025-12-16T22:14:02+00:00 urn:sha1:2fa119c0e5e528453ebae9e70740e8d2d8c0ed5a This reverts commit 05703271c3cd ("PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV"), which causes a deadlock by recursively taking pci_rescan_remove_lock when sriov_del_vfs() is called as part of pci_stop_and_remove_bus_device(). For example with the following sequence of commands: $ echo <NUM> > /sys/bus/pci/devices/<pf>/sriov_numvfs $ echo 1 > /sys/bus/pci/devices/<pf>/remove A trimmed trace of the deadlock on a mlx5 device is as below: zsh/5715 is trying to acquire lock: 000002597926ef50 (pci_rescan_remove_lock){+.+.}-{3:3}, at: sriov_disable+0x34/0x140 but task is already holding lock: 000002597926ef50 (pci_rescan_remove_lock){+.+.}-{3:3}, at: pci_stop_and_remove_bus_device_locked+0x24/0x80 ... Call Trace: [<00000259778c4f90>] dump_stack_lvl+0xc0/0x110 [<00000259779c844e>] print_deadlock_bug+0x31e/0x330 [<00000259779c1908>] __lock_acquire+0x16c8/0x32f0 [<00000259779bffac>] lock_acquire+0x14c/0x350 [<00000259789643a6>] __mutex_lock_common+0xe6/0x1520 [<000002597896413c>] mutex_lock_nested+0x3c/0x50 [<00000259784a07e4>] sriov_disable+0x34/0x140 [<00000258f7d6dd80>] mlx5_sriov_disable+0x50/0x80 [mlx5_core] [<00000258f7d5745e>] remove_one+0x5e/0xf0 [mlx5_core] [<00000259784857fc>] pci_device_remove+0x3c/0xa0 [<000002597851012e>] device_release_driver_internal+0x18e/0x280 [<000002597847ae22>] pci_stop_bus_device+0x82/0xa0 [<000002597847afce>] pci_stop_and_remove_bus_device_locked+0x5e/0x80 [<00000259784972c2>] remove_store+0x72/0x90 [<0000025977e6661a>] kernfs_fop_write_iter+0x15a/0x200 [<0000025977d7241c>] vfs_write+0x24c/0x300 [<0000025977d72696>] ksys_write+0x86/0x110 [<000002597895b61c>] __do_syscall+0x14c/0x400 [<000002597896e0ee>] system_call+0x6e/0x90 This alone is not a complete fix as it restores the issue the cited commit tried to solve. A new fix will be provided as a follow on. Fixes: 05703271c3cd ("PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV") Reported-by: Benjamin Block <bblock@linux.ibm.com> Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Reviewed-by: Benjamin Block <bblock@linux.ibm.com> Acked-by: Gerd Bayer <gbayer@linux.ibm.com> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251216-revert_sriov_lock-v3-1-dac4925a7621@linux.ibm.com 2025-11-14T18:34:22+00:00 Ilpo Järvinen ilpo.jarvinen@linux.intel.com 2025-11-13T18:00:53+00:00 urn:sha1:bf0a90fc907e47344f88e5b9b241082184dbac27 PCIe r7.0, sec 7.8.6, defines resizable BAR sizes beyond the currently supported maximum of 128TB, which will require more than u32 to store the entire bitmask. Convert Resizable BAR related functions to use u64 bitmask for BAR sizes to make the typing more future-proof. The support for the larger BAR sizes themselves is not added at this point. Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Reviewed-by: Christian König <christian.koenig@amd.com> Link: https://patch.msgid.link/20251113180053.27944-12-ilpo.jarvinen@linux.intel.com