summaryrefslogtreecommitdiff
path: root/tools/testing
AgeCommit message (Collapse)Author
2026-08-07selftests/bpf: Add load-acquire test for probe-memory pointer typesDaniel Borkmann
Add a verifier test that a BPF_LOAD_ACQ from a rdonly_untrusted_mem pointer (PTR_TO_MEM | MEM_RDONLY | PTR_UNTRUSTED, obtained via bpf_rdonly_cast()) is rejected. Such a source requires BPF_PROBE_MEM fault protection which is not applied to atomic loads; without the verifier fix the load is accepted and would crash the kernel on a fault. # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t verifier_load_acquire [...] #621/1 verifier_load_acquire/load-acquire, 8-bit:OK #621/2 verifier_load_acquire/load-acquire, 8-bit @unpriv:OK #621/3 verifier_load_acquire/load-acquire, 16-bit:OK #621/4 verifier_load_acquire/load-acquire, 16-bit @unpriv:OK #621/5 verifier_load_acquire/load-acquire, 32-bit:OK #621/6 verifier_load_acquire/load-acquire, 32-bit @unpriv:OK #621/7 verifier_load_acquire/load-acquire, 64-bit:OK #621/8 verifier_load_acquire/load-acquire, 64-bit @unpriv:OK [...] #621/19 verifier_load_acquire/load-acquire from rdonly_untrusted_mem pointer:OK #621/20 verifier_load_acquire/load-acquire with invalid register R15:OK #621/21 verifier_load_acquire/load-acquire with invalid register R15 @unpriv:OK #621/22 verifier_load_acquire/load-acquire from pkt pointer:OK #621/23 verifier_load_acquire/load-acquire from flow_keys pointer:OK #621/24 verifier_load_acquire/load-acquire from sock pointer:OK #621 verifier_load_acquire:OK Summary: 1/24 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20260806201047.333389-6-daniel@iogearbox.net Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-07selftests/bpf: Add arena fault test for load-acquireDaniel Borkmann
Add stream_arena_load_acquire_fault, which performs a load-acquire from an unmapped arena address, next to the existing read and write fault tests. The test covers both halves of the JIT bug that treated a load-acquire as a store when populating its exception table entry: - the fault has to be reported as a READ, and at the address held by the source register, which __stderr() and test_address() check, and - the destination register has to be cleared by the fault handler, which the program checks by poisoning it before the load-acquire and returning it, so __retval(0) fails if it is left untouched Note, load-acquire is open coded since linux/filter.h cannot be included alongside vmlinux.h. # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t stream_arena_fault_address [...] #462/1 stream_arena_fault_address/read_fault:OK #462/2 stream_arena_fault_address/write_fault:OK #462/3 stream_arena_fault_address/load_acquire_fault:OK #462 stream_arena_fault_address:OK Summary: 1/3 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20260806201047.333389-5-daniel@iogearbox.net Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-06selftests/bpf: Verify decl tags emission in resolve_btfids testIhor Solodrai
Extend test_resolve_btfids() to assert that resolve_btfids emits a BTF_KIND_DECL_TAG named "bpf_kfunc" for every kfunc, and "bpf_fastcall" for kfuncs marked KF_FASTCALL. Add a btf_has_decl_tag() helper that scans the output BTF for a decl tag matching name and target. Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://patch.msgid.link/20260807032029.78092-6-ihor.solodrai@linux.dev Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-06selftests/bpf: Verify arena type tags in resolve_btfids testIhor Solodrai
Extend test_resolve_btfids() to assert that resolve_btfids emits the address_space(1) type attribute (a BTF_KIND_TYPE_TAG with kflag=1) on the return type and/or arguments of kfuncs marked KF_ARENA_RET, KF_ARENA_ARG1 or KF_ARENA_ARG2. Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://patch.msgid.link/20260807032029.78092-4-ihor.solodrai@linux.dev Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-06selftests/mm: unpoison pages in memory-failure teardownMuhammad Usama Anjum
The memory-failure tests call cleanup() only after all result checks. A failed ASSERT_* invokes fixture teardown and aborts the test, so it skips cleanup() and leaves the injected page hardware-poisoned. Invoke cleanup() from FIXTURE_TEARDOWN() instead. Guard it with self->injection_attempted so tests that exit before injection do not try to unpoison a page when no injection was attempted. Injection can poison a page before returning an error or delivering SIGBUS, so teardown must clean up after every injection attempt. This runs the existing HWPoison and HardwareCorrupted checks on both normal and assertion-failure paths. Link: https://lore.kernel.org/20260729091127.1001179-1-usama.anjum@arm.com Fixes: ff4ef2fbd101 ("selftests/mm: add memory failure anonymous page test") Signed-off-by: Muhammad Usama Anjum <usama.anjum@arm.com> Reviewed-by: David Hildenbrand (Arm) <david@kernel.org> Acked-by: Miaohe Lin <linmiaohe@huawei.com> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Naoya Horiguchi <nao.horiguchi@gmail.com> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06selftests/mm: fix gup_longterm EINVAL error messagezhaozhengzhuo
The gup_longterm test prints a literal "n" when PIN_LONGTERM_TEST_START fails with EINVAL because the string is missing the newline escape sequence. Print a newline instead. Link: https://lore.kernel.org/23557F4CB8CF36FF+20260724074603.1479243-1-zhaozhengzhuo@uniontech.com Signed-off-by: zhaozhengzhuo <zhaozhengzhuo@uniontech.com> Reviewed-by: Sarthak Sharma <sarthak.sharma@arm.com> Reviewed-by: Dev Jain <dev.jain@arm.com> Acked-by: David Hildenbrand (arm) <david@kernel.org> Cc: Jason Gunthorpe <jgg@ziepe.ca> Cc: John Hubbard <jhubbard@nvidia.com> Cc: Peter Xu <peterx@redhat.com> Cc: Shuah Khan <shuah@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06selftests/mm/pagemap_ioctl: fix missing NULL checks after calloc()longlong yan
The pagemap_ioctl selftest allocates memory via calloc() in several places but does not check the return values. If calloc() fails, the subsequent code will dereference a NULL pointer and crash. Additionally, in sanity_tests(), the calloc() failure check incorrectly uses MAP_FAILED (the mmap() error constant) instead of NULL. Since calloc() returns NULL on failure, the check never triggers and a failed allocation goes undetected. Add NULL checks after each calloc() call, and fix the wrong error constant in sanity_tests(). Use ksft_exit_fail_msg() consistent with the existing error handling pattern in the file. Link: https://lore.kernel.org/20260721063611.342-1-yanlonglong@kylinos.cn Signed-off-by: longlong yan <yanlonglong@kylinos.cn> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Reviewed-by: SJ Park <sj@kernel.org> Cc: Shuah Khan <shuah@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06selftests/mm: use MAP_FAILED for mmap error checklonglong yan
Replace the direct comparison with (void *)-1 with the standard MAP_FAILED macro when checking mmap() Link: https://lore.kernel.org/20260720063439.522-1-yanlonglong@kylinos.cn Signed-off-by: longlong yan <yanlonglong@kylinos.cn> Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Cc: Liam R. Howlett <liam@infradead.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06selftests/mm: fix BUG_ON checking wrong variable in mremap_dontunmapHongfu Li
In mremap_dontunmap_partial_mapping_overwrite(), mremap() stores its returned remapped address into remapped_mapping, while the BUG_ON incorrectly checks dest_mapping instead. If mremap() fails, dest_mapping still holds a valid pointer obtained from the prior mmap() call, making this BUG_ON never trigger at all. Correct the check to validate the actual mremap() return value stored in remapped_mapping. Link: https://lore.kernel.org/20260717070251.73212-1-hongfu.li@linux.dev Signed-off-by: Hongfu Li <lihongfu@kylinos.cn> Reviewed-by: SJ Park <sj@kernel.org> Cc: David Hildenbrand <david@kernel.org> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06selftests/mm: add PAGEMAP_SCAN test for THP PMD holesKiryl Shutsemau (Meta)
Add coverage for the PMD-hole case fixed by "fs/proc/task_mmu: fix PAGEMAP_SCAN written state for PMD holes": a MAP_PRIVATE|MAP_ANON THP that is uffd-wp'd and then dropped with MADV_DONTNEED leaves a pmd_none hole with no page table, which PAGEMAP_SCAN must still report as written. Factor the populate/drop/scan-both-paths sequence out of unpopulated_scan_test() into a helper, and add unpopulated_thp_scan_test() that reuses it with a THP. Include <linux/mman.h> for MADV_COLLAPSE; <sys/mman.h> lacks it on older glibc (e.g. 2.34). Same approach as commit fd5295afae91 ("selftests/mm: hmm-tests: include linux/mman.h to access MADV_COLLAPSE"). Link: https://lore.kernel.org/aljWYfPRCVc6IB2b@thinkstation Link: https://lore.kernel.org/20260715144234.442721-3-kirill@shutemov.name Signed-off-by: Kiryl Shutsemau <kas@kernel.org> Cc: Muhammad Usama Anjum <usama.anjum@arm.com> Cc: Peter Xu <peterx@redhat.com> Cc: Zenghui Yu <zenghui.yu@linux.dev> Cc: David Hildenbrand <david@kernel.org> Cc: Jann Horn <jannh@google.com> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Pedro Falcato <pfalcato@suse.de> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Assisted-by: Claude:claude-fable-5 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm/vma: update create_init_stack_vma() to use vma_flags_tLorenzo Stoakes
Replace use of the legacy vm_flags_t flags with vma_flags_t values in create_init_stack_vma(). As part of this change we add VMA_STACK_EARLY and VMA_STACK_INCOMPLETE vma_flags_t defines, and slightly rework create_init_stack_vma() for clarity. No functional change intended. Link: https://lore.kernel.org/20260711-b4-vma-flags-mm-v2-9-0fa2357d5431@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Zi Yan <ziy@nvidia.com> Reviewed-by: Lance Yang <lance.yang@linux.dev> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Baolin Wang <baolin.wang@linux.alibaba.com> Cc: Barry Song <baohua@kernel.org> Cc: Christian Brauner <brauner@kernel.org> Cc: Dave Airlie <airlied@gmail.com> Cc: David Hildenbrand <david@kernel.org> Cc: Dev Jain <dev.jain@arm.com> Cc: Jani Nikula <jani.nikula@intel.com> Cc: Jan Kara <jack@suse.cz> Cc: Jann Horn <jannh@google.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Muchun Song <muchun.song@linux.dev> Cc: Nico Pache <npache@redhat.com> Cc: Oscar Salvador <osalvador@suse.de> Cc: Pedro Falcato <pfalcato@suse.de> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm: introduce vma_get_page_prot() and use itLorenzo Stoakes
There's a large number of vm_get_page_prot(vma->vm_flags) invocations. Make life easier by introducing vma_get_page_prot() parameterised by the VMA. This also makes converting vm_get_page_prot() to vma_flags_t easier. Also update the userland VMA tests to reflect the change. No functional change intended. Link: https://lore.kernel.org/20260711-b4-vma-flags-mm-v2-8-0fa2357d5431@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Acked-by: Zi Yan <ziy@nvidia.com> Acked-by: Jani Nikula <jani.nikula@intel.com> # for i915 Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de> [DRM] Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Baolin Wang <baolin.wang@linux.alibaba.com> Cc: Barry Song <baohua@kernel.org> Cc: Christian Brauner <brauner@kernel.org> Cc: Dave Airlie <airlied@gmail.com> Cc: David Hildenbrand <david@kernel.org> Cc: Dev Jain <dev.jain@arm.com> Cc: Jan Kara <jack@suse.cz> Cc: Jann Horn <jannh@google.com> Cc: Lance Yang <lance.yang@linux.dev> Cc: Mike Rapoport <rppt@kernel.org> Cc: Muchun Song <muchun.song@linux.dev> Cc: Nico Pache <npache@redhat.com> Cc: Oscar Salvador <osalvador@suse.de> Cc: Pedro Falcato <pfalcato@suse.de> Cc: Suren Baghdasaryan <surenb@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06mm/vma: rename vma_get_page_prot to vma_flags_to_page_protLorenzo Stoakes
Having vma_get_page_prot() refer to VMA flags and vma_set_page_prot() refer to a VMA is confusing. Rename vma_get_page_prot() to vma_flags_to_page_prot() to resolve this confusion. No functional change intended. Link: https://lore.kernel.org/20260711-b4-vma-flags-mm-v2-7-0fa2357d5431@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Lance Yang <lance.yang@linux.dev> Reviewed-by: Zi Yan <ziy@nvidia.com> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Baolin Wang <baolin.wang@linux.alibaba.com> Cc: Barry Song <baohua@kernel.org> Cc: Christian Brauner <brauner@kernel.org> Cc: Dave Airlie <airlied@gmail.com> Cc: David Hildenbrand <david@kernel.org> Cc: Dev Jain <dev.jain@arm.com> Cc: Jani Nikula <jani.nikula@intel.com> Cc: Jan Kara <jack@suse.cz> Cc: Jann Horn <jannh@google.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Muchun Song <muchun.song@linux.dev> Cc: Nico Pache <npache@redhat.com> Cc: Oscar Salvador <osalvador@suse.de> Cc: Pedro Falcato <pfalcato@suse.de> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Thomas Zimmermann <tzimmermann@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06selftests/dax: add dax/kmem hotplug sysfs regression testGregory Price
Add a kselftest for the dax/kmem whole-device "state" sysfs attribute (/sys/bus/dax/devices/daxX.Y/state), which transitions a kmem-backed dax device between "unplugged", "online" and "online_movable". The kselftest also includes a test to demonstrate the force-unbind does not deadlock - but this is destructive (the dax device can never be rebound), so it only runs when DAX_KMEM_TEST_UNBIND=1 is set. Provisioning a devdax device and binding it to kmem needs daxctl/ndctl out of scope for an in-tree selftest. As the test mutates a device's memory, the operator opts in by naming it in DAX_KMEM_TEST_DEV (or "auto" to pick the first kmem-bound device); it SKIPs when unset, when no device is present, or when the memory cannot be freed to a baseline. When a device is available it validates the interface contract: - online / online_movable actually add memory (MemTotal grows), - online is idempotent, - switching between online types without unplug is rejected, - unplug removes memory and the reported state is "unplugged" - invalid input is rejected, - unplug and unbind tolerate blocks toggled out-of-band through the per-block memoryX/state interface. One specific regression test: online -> unplug -> online_movable -> unplug Re-online must re-reserve per-range resources so subsequent unplug actually offlines and removes instead of silently reporting success while the memory stays online. Link: https://lore.kernel.org/20260712154505.3564379-11-gourry@gourry.net Signed-off-by: Gregory Price <gourry@gourry.net> Cc: Alison Schofield <alison.schofield@intel.com> Cc: Danilo Krummrich <dakr@kernel.org> Cc: Dave Jiang <dave.jiang@intel.com> Cc: David Hildenbrand (Arm) <david@kernel.org> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Hannes Reinecke <hare@suse.de> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Oscar Salvador <osalvador@suse.de> Cc: Pankaj Gupta <pankaj.gupta@amd.com> Cc: "Rafael J. Wysocki" <rafael@kernel.org> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vishal Verma <vishal.l.verma@intel.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06selftests/mm: factor out hmm_buffer_alloc() to consolidate buffer setupHongfu Li
Each HMM test open-codes the same buffer initialization sequence: allocate main buffer, assign file descriptor and size, allocate mirror buffer, then perform mmap mapping. Factor out this repeated logic into a standalone hmm_buffer_alloc() helper to eliminate ~35 open-coded copies. The new helper supports distinct mmap_size and mirror_size parameters to fit scenarios with THP alignment padding or per-page snapshot flags. It also exposes prot, flags and fd arguments, enabling support for MAP_SHARED, MAP_HUGETLB and file-backed mappings. Eliminates ~360 lines of redundant boilerplate code. Fixes a missing NULL pointer check bug in the hmm_buffer_alloc() previously used only by the migration benchmark, now subsumed by this new unified helper. Link: https://lore.kernel.org/20260713033209.280435-1-lihongfu@kylinos.cn Signed-off-by: Hongfu Li <lihongfu@kylinos.cn> Cc: David Hildenbrand <david@kernel.org> Cc: Jason Gunthorpe <jgg@ziepe.ca> Cc: Leon Romanovsky <leon@kernel.org> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06selftests/mm: fix on-fault-limit false failure under sudo-rsInjae Ryou
run_vmtests.sh runs on-fault-limit as the nobody user via "sudo -u nobody ./on-fault-limit", guarded by a check that nobody can access the binary ("sudo -u nobody ls ./on-fault-limit"). The guard resolves the relative path from the inherited working directory, which only requires search permission on the test directory itself. Classic sudo passes the relative path through to execve() the same way, so the two agree. However, sudo-rs (the default sudo implementation since Ubuntu 25.10) canonicalizes the command to an absolute path before executing it, which requires search permission on every ancestor directory. When the kernel tree lives under a private home directory (mode 0750, the Ubuntu default for new users since 21.04), the guard passes but the execution fails with "command not found", and the test is reported as a false FAIL: # running sudo -u nobody ./on-fault-limit sudo: './on-fault-limit': command not found # [FAIL] Wrap the command in "sh -c" so that sudo only resolves the shell binary, and the relative path is resolved by nobody's shell from the inherited working directory, matching what the guard checks. This is the only "sudo -u nobody" invocation in the script; uid, cwd, rlimits (including RLIMIT_MEMLOCK, which this test exercises) and the exit status are unchanged through sh. Verified on Ubuntu 26.04 (sudo-rs 0.2.13): the test now runs and passes instead of failing. Verified on Ubuntu 24.04 (sudo 1.9.15p5): behavior is unchanged. Link: https://lore.kernel.org/20260713092700.464376-1-injaeryou@gmail.com Fixes: 5d2146a3354f ("selftests/mm: skip mlock tests if nobody user can't read it") Signed-off-by: Injae Ryou <injaeryou@gmail.com> Cc: Brendan Jackman <jackmanb@google.com> Cc: Brendan Jackman <brendan.jackman@linux.dev> Cc: David Hildenbrand <david@kernel.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06selftests: mincore: count file-mmap readahead on both sidesYijia Wang
check_file_mmap() faults a page in the middle of a file mapping and expects the mmap read-around path to make neighbouring pages resident. The test currently counts only pages after the faulted page. That misses valid read-around on systems with large base page sizes. On arm64 with 64K pages and the default 128K readahead setting, the read-around window is two pages wide and centred on the faulting page. Faulting page 32 makes pages 31 and 32 resident, so the forward-only scan from page 33 reports ra_pages == 0 even though a neighbouring page was brought in. Keep the existing readahead assertion, but count resident neighbouring pages on both sides of the faulted page. This fixes the 64K-page false failure without teaching the selftest to compute the expected readahead window from sysfs or other implementation details. Link: https://lore.kernel.org/20260713094319.771550-1-wangyijia.yeah@bytedance.com Signed-off-by: Yijia Wang <wangyijia.yeah@bytedance.com> Cc: "Matthew Wilcox (Oracle)" <willy@infradead.org> Cc: Jan Kara <jack@suse.cz> Cc: Muchun Song <muchun.song@linux.dev> Cc: Shuah Khan <shuah@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-06Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.2-rc7). No conflicts, or adjacent changes. Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-06Merge tag 'net-7.2-rc7' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from netfilter. Looks like our attempt to keep the PRs smaller have only prevented this one from getting even bigger. In the last 9 days there were 405 postings explicitly tagged with [PATCH net], vs 687 with [PATCH net-next]. 37% of posted patches being fixes is pretty crazy, and that's likely undercounting because LLM "researchers" more often post fixes without knowing to tag the patches for specific trees. I don't have historic data. In any case, we keep adjusting the criteria. The next PR will be smaller. Current release - regressions: - net: defer netdev KOBJ_ADD uevent until the device is published, previously rtnl_lock would serialize the accesses vs publishing - net: explicitly cancel work to avoid races with ref tracker exit - qrtr: ns: raise lookup limit to 128 - eth: hns3: fix speed configuration residue after driver reload Previous releases - regressions: - tcp: do not change rcv_ssthresh in tcp_measure_rcv_mss(), regressed flows with MSS and scaling_ratio variability - Revert "net: thunderbolt: Enable end-to-end flow control also in transmit", broke some platforms (no packets coming thru) - eth: stmmac: resume PHY before hardware setup when opening the interface Previous releases - always broken: - another pile of fixes for less common protocols (SCTP, TLS, SMC etc.) - close a couple of AF_PACKET bugs and ways it can build skbs problematic for the rest of the stack - bridge: mrp: fix uninitialised bytes on the wire - net: devmem: prevent net-iov / page mixing, avoid crashes - eth: atlantic: free RX pages of consumed but not refilled buffers" * tag 'net-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (116 commits) igc: fix netdev not re-attached after resume if interface is down tls: don't abort the connection on signal-interrupted sends net: avoid theoretical races with ref drain net: Defer netdev KOBJ_ADD uevent until the device is published MAINTAINERS: dpll: zl3073x: replace Prathosh Satish with Min Li sctp: clear control chunk transport if it is being removed net/atm: fix slab-out-of-bounds read in vcc_setsockopt() s390/ism: Fix UAF of sba and ieq during ism_dev_exit() packet: use consistent hard_header_len in TX_RING send path packet: use consistent hard_header_len in non-ring send paths net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header bnge: Fix resource leak in bnge_init_nic() error path ptp: ocp: Fix board ID over-read tls: rx: restore msg_iter before TLS 1.3 optimistic retry selftests: tls: add a test for splicing onto a full plaintext record tls: don't leave a full plaintext sk_msg ring unpushed xdp: reject clones that overrun skb_shared_info tailroom mptcp: reclaim forward-allocated memory on RX path errors mptcp: fastopen: only mark MPTFO subflows with SYN data mptcp: pm: fix memory leak from alloc-during-teardown race ...
2026-08-06tls: rx: restore msg_iter before TLS 1.3 optimistic retryJérémy Jean
tls_decrypt_sg() advances msg->msg_iter when it maps user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record turns out not to be unpadded application data, tls_decrypt_sw() retries into a kernel skb, but leaves the iterator advanced. The subsequent copy from the skb then writes decrypted bytes again at a later point in the caller iovecs while recvmsg() reports only the post-retry length. A TLS peer can trigger this after the receiver enables TLS_RX_EXPECT_NO_PAD. Revert the iterator by the number of bytes consumed by the optimistic mapping before retrying without zero-copy. Add a selftest which sends a TLS 1.3 control record with TLS_RX_EXPECT_NO_PAD enabled and verifies that recvmsg() does not overwrite later iovecs beyond the returned length. Fixes: ce61327ce989 ("tls: rx: support optimistic decrypt to user buffer with TLS 1.3") Cc: stable@vger.kernel.org Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr> Link: https://patch.msgid.link/20260804125528.2139928-1-Jeremy.Jean@oss.cyber.gouv.fr Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-06selftests: tls: add a test for splicing onto a full plaintext recordchanyoung
Splicing onto a plaintext sk_msg ring that is already full used to wrap the ring and make the kernel oops in the scatterwalk once the record was pushed. Only the copy path leaves the ring full without pushing it, so splice until the ring is one fragment short, add the last fragment with a one-byte MSG_MORE send, and splice once more before pushing the record. CONFIG_MAX_SKB_FRAGS is 17..45, so that last fragment follows between 16 and 44 splices; sweep that range to trigger the bug on any build. Signed-off-by: chanyoung <ppoo1220@gmail.com> Link: https://patch.msgid.link/20260804052837.49015-3-ppoo1220@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-06selftests: mptcp: join: mark tests with data corruption as failedGang Yan
check_transfer() compares the input and output files byte-by-byte using `cmp -l "$in" "$out" | while read ...`. Because the while-loop body runs in a subshell (the script sets neither lastpipe nor pipefail), the fail_test call inside it -- which sets the global ret/last_test_failed -- and the `return 1` both act on the subshell, not on check_transfer(). check_transfer() thus always falls through to `return 0`, and any data corruption affecting only the payload (leaving the subflow/PM counters untouched) is silently reported as PASS. Fixes: 8117dac3e7c3 ("selftests: mptcp: add invert check in check_transfer") Cc: stable@vger.kernel.org Signed-off-by: Gang Yan <yangang@kylinos.cn> Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260803-net-mptcp-misc-fixes-7-2-rc6-v2-5-b8f496d71664@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-06selftests/bpf: Test overlapping RCU protectionNing Ding
Add task kptr tests that keep RCU protection active after a spin or RCU unlock when preemption or IRQs remain disabled. Also test the reverse order with explicit RCU. Verify that task kptrs are rejected after leaving the final preemption-disabled or IRQ-disabled region. Signed-off-by: Ning Ding <dingning04@gmail.com> Link: https://lore.kernel.org/bpf/20260805233940.3966981-3-dingning04@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-06bpf: Account for preempt and IRQ state in RCU protectionNing Ding
Disabling preemption or local IRQs keeps the current CPU in an RCU read-side critical section, but in_rcu_cs() does not account for either state. The verifier therefore rejects safe kptr accesses and invalidates pointers when another RCU source ends. Include preemption-disabled and IRQ-disabled state in in_rcu_cs(). Invalidate RCU-protected pointers on RCU unlock, preempt enable, or IRQ restore only after the final protection ends. Signed-off-by: Ning Ding <dingning04@gmail.com> Link: https://lore.kernel.org/bpf/20260805233940.3966981-2-dingning04@gmail.com [ kkd: Simplify was_in_rcu_cs on spin unlock and adjust the selftest. ] Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-06selftests/tc-testing: add qdisc hierarchy depth testsZijie Huang
Add tdc coverage for the qdisc hierarchy depth limit. The tests verify that the deepest allowed hierarchy can still be created and that adding another child qdisc below it is rejected. Signed-off-by: Zijie Huang <milkory@outlook.com> Assisted-by: Codex:gpt-5.4 Signed-off-by: Ren Wei <enjou1224z@gmail.com> Reviewed-by: Victor Nogueira <victor@mojatatu.com> Link: https://patch.msgid.link/5cc2d26a7c8e553759cdd29a3116f843fabc25ba.1785434373.git.milkory@outlook.com Acked-by: Jamal Hadi Salim <jhs@mojatatu.com> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-06kselftest/arm64: Fix abi test compilation errorsJinjie Ruan
The arm64 ABI selftests fail to compile due to missing include paths for kernel headers, causing errors like incomplete type struct sock_filter and implicit BPF macro declarations. Add $(KHDR_INCLUDES) and -I$(top_srcdir)/tools/include to CFLAGS to resolve the header search path. Also remove the hardcoded __NR_write macro and include <asm/unistd.h> to obtain the correct syscall number. Fixes: 21e37da12071 ("kselftest/arm64: Add testcase for SECCOMP_RET_TRACE orig_x0 bypass") Fixes: 2fcbc4adf997 ("kselftest/arm64: Add seccomp ptrace x0 bypass test") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/r/202608021842.jp6IBrFi-lkp@intel.com/ Suggested-by: Mark Brown <broonie@kernel.org> Reviewed-by: Mark Brown <broonie@kernel.org> Tested-by: Mark Brown <broonie@kernel.org> Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06openvswitch: remove support for legacy tunnel typesIlya Maximets
ovs-vswitchd doesn't use OVS_VPORT_TYPE_GRE/VXLAN/GENEVE with the Linux kernel module since adding support for standard tunnel devices with COLLECT_METADATA back in 2017. The code to use them was only activated as a fallback for old kernels, so not used in practice. And it is now fully removed in the upcoming OVS 4.0 release. Modern way to use tunnels with OVS is to create standard tunnel ports with RTM_NEWLINK + COLLECT_METADATA and add them as OVS_VPORT_TYPE_NETDEV. Device reference management and the netlink options parsing for these legacy port types is complicated and was a CVE magnet in the previous release cycles. Existence of these modules also makes locking analysis for geneve module and other core tunnel devices unnecessarily more complicated, especially in light of migration to per-netns locking. Since there are no actual users for these port types for a very long time, let's just remove the support entirely. There is no practical reason to run OVS from 2017 on a recent kernel. While it's technically a uAPI change in some sense, from the user's perspective this removal looks indistinguishable from the kernel built with CONFIG_OPENVSWITCH_GENEVE/VXLAN/GRE disabled. And it seems like removal of unused drivers/modules is not a rare event these days. A comment is added to the uAPI header noting that standard RTM_NEWLINK with COLLECT_METADATA followed by OVS_VPORT_CMD_NEW with the simple OVS_VPORT_TYPE_NETDEV should be used instead. Modules responsible for these tunnel ports are removed as well as selftests covering this functionality. Further cleanups will follow. Signed-off-by: Ilya Maximets <i.maximets@ovn.org> Link: https://patch.msgid.link/20260804182049.2289754-2-i.maximets@ovn.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-06selftests/bpf: Test module kfunc calls under spin lockKaitao Cheng
The verifier uses kfunc registration flags to decide whether a kfunc may be called while a BPF program holds a bpf_spin_lock. Mark bpf_testmod_test_mod_kfunc() as KF_SPINLOCK_SAFE and verify that it can be called while holding a bpf_spin_lock. Also attempt to call the unmarked bpf_kfunc_trigger_ctx_check() under the lock and verify that the program is rejected. Signed-off-by: Kaitao Cheng <chengkaitao@kylinos.cn> Acked-by: Leon Hwang <leon.hwang@linux.dev> Link: https://lore.kernel.org/bpf/20260805153340.34776-4-kaitao.cheng@linux.dev Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-05selftests: drv-net: print device info at the startJakub Kicinski
When a reviewer asks a developer to run an upstream test during code review, it's often ambiguous whether the test was actually run against a real device, or just against netdevsim. Print the driver name and ifname at the start of the test, e.g.: # Interface: enp0s13f0u1u4, driver: r8152 TAP version 13 1..1 ok 1 ... Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260803211944.2166211-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05selftests: drv-net: hw: reset HDS mode after netkit devmem testsJakub Kicinski
HDS mode has confusing semantics. On GET kernel reports effective mode. On SET kernel expects explicit config. Effective mode on GET means that we know the current state, but we don't know if it's a driver default or user setting. This matter because driver default can change automatically when e.g. XDP is attached. Explicit user setting must not be lost. With that in mind, we can't restore the HDS setting like we restore other NIC config. We should always reset to default ("unknown"). This fixes an issue with tests running after the devmem test not being able to attach XDP, e.g. Exception| File "./xdp_metadata.py", line 105, in test_xdp_rss_hash [...] Exception| net.lib.py.utils.CmdExitFailure: Command failed Exception| CMD: ip link set dev ens9np0 xdpdrv pinned /sys/fs/bpf/xdp_metadata_test/xdp_rss_hash Exception| EXIT: 2 Exception| STDERR: Error: unable to install XDP to device using tcp-data-split. not ok 1 xdp_metadata.test_xdp_rss_hash.tcp Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Breno Leitao <leitao@debian.org> Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com> Link: https://patch.msgid.link/20260804151040.2755153-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-05KVM: x86/pmu: Clean up vPMU comments and stray blank linesLike Xu
Tidy up the x86 vPMU emulation code and its selftests by fixing comments that no longer reflect the code along with assorted spelling and grammar mistakes, and by dropping redundant blank lines reported by checkpatch. No functional change intended. Signed-off-by: Like Xu <likexu@tencent.com> Link: https://patch.msgid.link/20260625090155.6326-1-likexu@tencent.com [sean: keep quotes around "hit", shove sequences fix into separate patch] Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-08-05KVM: selftests: Test one random GP counter in PMU arch events testcaseSean Christopherson
To significantly reduce the PMU counter test's runtime, without sacrificing test coverage in the aggregate, test a random GP counter in the arch events testcase instead of testing every possible GP counter. Testing every PMC in every run of the test significantly increases the runtime of the test, without providing an equivalent increase in validation coverage, as the odds of a KVM having a bug that only affected a subset of counters and only when testing all other counters are extremely low. Opportunistically clean up kvm_random_u64_in_range() to eliminate unnecessary newlines. Link: https://patch.msgid.link/20260804210046.3413149-2-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-08-05Merge branch 'for-7.3/cxl-misc' into cxl-for-nextDave Jiang
cxl/test: Assign one mock memdev a full-width serial number cxl/core: Format the memdev serial number as unsigned in TP_printk cxl/pmem: Format the nvdimm serial number as unsigned decimal
2026-08-05cxl/test: Assign one mock memdev a full-width serial numberAlison Schofield
Mock memdev serial numbers have historically been derived from pdev->id, leaving them single-digit. As a result they never exercised either the decimal-vs-hex security-key lookup or unsigned formatting of large serial numbers. Give one mock memdev a full-width serial with bit 63 set. This mirrors real hardware (for example, Montage devices) and provides a test device that exposes both the hexadecimal-vs-decimal and signed-vs- unsigned formatting differences. pdev->id 7 is unused by the auto-region topology so the larger serial does not affect existing tests. This enables adding a new test case to cxl-security.sh that verify auto-unlock using a mock device whose serial exposes both formatting differences. Signed-off-by: Alison Schofield <alison.schofield@intel.com> Link: https://patch.msgid.link/3e569a748fce4424b8622032fbffc298d92153b9.1784924949.git.alison.schofield@intel.com Signed-off-by: Dave Jiang <dave.jiang@intel.com>
2026-08-05selftests/bpf: Verify rejection of sleepable tracing progLeon Hwang
Add a test to verify that the sleepable tracing prog cannot attach to a '__x64_sys' prefix prog target. When CONFIG_FUNCTION_ERROR_INJECTION is disabled, without the fix, the test would trigger the BUG: [ 3.460756] BUG: sleeping function called from invalid context at kernel/bpf/trampoline.c:1324 Signed-off-by: Leon Hwang <leon.hwang@linux.dev> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Link: https://lore.kernel.org/bpf/20260805150810.34907-3-leon.hwang@linux.dev
2026-08-05selftests/bpf: Add bpf_for() benchmarkPuranjay Mohan
Add a bpf_for() benchmark modelled on bench_bpf_loop so the per-iteration iterator cost can be measured and compared against bpf_loop. It runs an empty bpf_for(i, 0, nr_loops) loop 1000 times per trigger and accounts nr_loops hits per outer iteration: $ ./bench -p 1 --nr_loops 1000 bpf-for Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Link: https://lore.kernel.org/bpf/20260804134601.2305303-7-puranjay@kernel.org
2026-08-05selftests/bpf: Verify inlined numeric iterator shape with __xlatedPuranjay Mohan
Add an __xlated test pinning the inlined bpf_iter_num_{new,next,destroy}() shapes. The program is __naked, so there is no compiler glue and the whole sequence is matched instruction for instruction. Gate it to x86_64 and arm64 (bpf_jit_needs_zext() == false); elsewhere the verifier interleaves "wN = wN" zero-extensions that would not match. The inlining is arch independent, so these two are enough. Suggested-by: Eduard Zingerman <eddyz87@gmail.com> Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Link: https://lore.kernel.org/bpf/20260804134601.2305303-6-puranjay@kernel.org
2026-08-05sysctl: remove CONFIG_PROC_SYSCTL, it just mirrors CONFIG_SYSCTLOleg Nesterov
CONFIG_SYSCTL used to make sense as a separate hidden bool before commit 61a47c1ad3a4 ("sysctl: Remove the sysctl system call"); it was selected by both CONFIG_SYSCTL_SYSCALL and CONFIG_PROC_SYSCTL. Today CONFIG_PROC_SYSCTL is the only selector, so the two are always equal. Kill the hidden bool, rename the PROC_SYSCTL prompt to SYSCTL, and s/CONFIG_PROC_SYSCTL/CONFIG_SYSCTL/ tree-wide. Signed-off-by: Oleg Nesterov <oleg@redhat.com> Signed-off-by: Joel Granados <joel.granados@kernel.org>
2026-08-05selftests/bpf: Add load-acquire test for dst_reg == src_reg from ctxDaniel Borkmann
Add a verifier test that a load-acquire fetching into its own source register (dst_reg == src_reg) from a ctx pointer is rejected. # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t verifier_load_acquire [...] #614/1 verifier_load_acquire/load-acquire, 8-bit:OK #614/2 verifier_load_acquire/load-acquire, 8-bit @unpriv:OK #614/3 verifier_load_acquire/load-acquire, 16-bit:OK #614/4 verifier_load_acquire/load-acquire, 16-bit @unpriv:OK #614/5 verifier_load_acquire/load-acquire, 32-bit:OK #614/6 verifier_load_acquire/load-acquire, 32-bit @unpriv:OK #614/7 verifier_load_acquire/load-acquire, 64-bit:OK #614/8 verifier_load_acquire/load-acquire, 64-bit @unpriv:OK #614/9 verifier_load_acquire/load-acquire with uninitialized src_reg:OK #614/10 verifier_load_acquire/load-acquire with uninitialized src_reg @unpriv:OK #614/11 verifier_load_acquire/load-acquire with non-pointer src_reg:OK #614/12 verifier_load_acquire/load-acquire with non-pointer src_reg @unpriv:OK #614/13 verifier_load_acquire/misaligned load-acquire:OK #614/14 verifier_load_acquire/misaligned load-acquire @unpriv:OK #614/15 verifier_load_acquire/load-acquire from ctx pointer:OK #614/16 verifier_load_acquire/load-acquire from ctx pointer @unpriv:OK #614/17 verifier_load_acquire/load-acquire from ctx pointer, same dst and src register:OK #614/18 verifier_load_acquire/load-acquire from ctx pointer, same dst and src register @unpriv:OK #614/19 verifier_load_acquire/load-acquire with invalid register R15:OK #614/20 verifier_load_acquire/load-acquire with invalid register R15 @unpriv:OK #614/21 verifier_load_acquire/load-acquire from pkt pointer:OK #614/22 verifier_load_acquire/load-acquire from flow_keys pointer:OK #614/23 verifier_load_acquire/load-acquire from sock pointer:OK #614 verifier_load_acquire:OK Summary: 1/23 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Eduard Zingerman <eddyz87@gmail.com> Link: https://lore.kernel.org/bpf/20260804201917.253491-2-daniel@iogearbox.net Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-08-04selftests/mm: remove obsolete hugetlb vmemmap testMuchun Song
The hugetlb vmemmap selftest was added to check the old HVO layout where tail vmemmap pages reused the head page. That assumption no longer matches the current HVO mapping layout. HVO now keeps a private backing page for the head vmemmap page and remaps redundant tail vmemmap pages to a shared read-only backing page. The old page flag check is therefore testing an obsolete implementation detail rather than the current ABI or behavior. Remove the stale test and its build and run entries. [akpm@linux-foundation.org: don't clean old executables out of .gitignore] Link: https://lore.kernel.org/CAHk-=wiHK5_oBUdUiNAaevmN9f-ORe+QBqbRefAZaw-RbgEn3w@mail.gmail.com Link: https://lore.kernel.org/20260710092427.3459121-1-songmuchun@bytedance.com Signed-off-by: Muchun Song <songmuchun@bytedance.com> Reviewed-by: Lorenzo Stoakes <ljs@kernel.org> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Reviewed-by: SJ Park <sj@kernel.org> Cc: Liam R. Howlett <liam@infradead.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Muchun Song <muchun.song@linux.dev> Cc: Shuah Khan <shuah@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-04tools/testing/vma: output compared expression on ASSERT_[EQ, NE]()Lorenzo Stoakes
Update the macros to output the compared values at hex for easier debugging when test asserts fail. We have to be careful not to re-evaluate expressions as they may have side-effects. So update the code to take local copies and use these for both the test and the debug output. Also remove unused IS_SET() macro. Link: https://lore.kernel.org/20260710-b4-pre-scalable-cow-v2-33-2a5aa403d977@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Gregory Price <gourry@gourry.net> Cc: Ackerley Tng <ackerleytng@google.com> Cc: David Hildenbrand (Arm) <david@kernel.org> Cc: Kai Huang <kai.huang@intel.com> Cc: Marek Szyprowski <m.szyprowski@samsung.com> Cc: Pedro Falcato <pfalcato@suse.de> Cc: SJ Park <sj@kernel.org> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Liam R. Howlett (Oracle) <liam@infradead.org> Cc: Zi Yan <ziy@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-04tools/testing/vma: default VMA, mm flag bits to 64-bitLorenzo Stoakes
With all of the sanitisers turned on, setting the VMA and mm flag bits depth to 128 by default results in overly long build times. Reduce this to 64 - we can always manipulate these later for testing of larger bitmaps as needed. Link: https://lore.kernel.org/20260710-b4-pre-scalable-cow-v2-32-2a5aa403d977@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Gregory Price <gourry@gourry.net> Cc: Ackerley Tng <ackerleytng@google.com> Cc: David Hildenbrand (Arm) <david@kernel.org> Cc: Kai Huang <kai.huang@intel.com> Cc: Marek Szyprowski <m.szyprowski@samsung.com> Cc: Pedro Falcato <pfalcato@suse.de> Cc: SJ Park <sj@kernel.org> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Liam R. Howlett (Oracle) <liam@infradead.org> Cc: Zi Yan <ziy@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-04mm/vma: introduce and use vma_set_pgoff()Lorenzo Stoakes
In order to lay the foundation for work that permits us to track the virtual page offset of MAP_PRIVATE file-backed mappings, we abstract the assignment of vma->vm_pgoff to vma_set_pgoff(). We additionally add a lock check here using the newly introduced vma_assert_can_modify(). This asserts the VMA write lock if the VMA is attached. We also assert that, if this is an anonymous VMA and unfaulted, that its (virtual) page offset is equal to the page offset of the VMA's address. We must be careful about MAP_PRIVATE-/dev/zero which violates fundamental assumptions about anonymous memory, so we check for !vma->vm_file after using vma_is_anonymous() which these mappings satisfy. Additionally, we only perform the assert if CONFIG_MMU is defined, as nommu does not set vma->vm_pgoff = addr >> PAGE_SHIFT. This isn't really relevant to rmap as it has no anon rmap (nor needs it), but we must avoid it asserting falsely. All of this logic is kept in assert_sane_pgoff() to keep things clear. In order to maintain correctness given this assert, we also update __install_special_mapping() to invoke vma_set_range() after it's set vma->vm_ops (which determine whether the VMA is anonymous or not). We do not use vma_set_pgoff() in vm_area_init_from(), as at the point of forking, we don't necessarily have correct locking state. Updating vma_set_range() covers most cases, but in addition to this we also update insert_vm_struct(), compat_set_vma_from_desc() and nommu callers. We also update vma_add_pgoff() and vma_sub_pgoff() to use vma_set_pgoff(). While we're here, we drop a BUG_ON() and update insert_vm_struct()'s comment to reflect the fact anonymous mappings can be added here. Finally, we update the CONFIG_MMU, CONFIG_PER_VMA_LOCK defines in the VMA userland tests so IS_ENABLED() will work correctly with them. No functional change intended. Link: https://lore.kernel.org/20260710-b4-pre-scalable-cow-v2-29-2a5aa403d977@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Pedro Falcato <pfalcato@suse.de> Reviewed-by: Gregory Price <gourry@gourry.net> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Ackerley Tng <ackerleytng@google.com> Cc: David Hildenbrand (Arm) <david@kernel.org> Cc: Kai Huang <kai.huang@intel.com> Cc: Marek Szyprowski <m.szyprowski@samsung.com> Cc: SJ Park <sj@kernel.org> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Liam R. Howlett (Oracle) <liam@infradead.org> Cc: Zi Yan <ziy@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-04mm/vma: update vma_shrink() to not pass start, pgoff parametersLorenzo Stoakes
vma_shrink() is only used by relocate_vma_down() to shrink the tail of a VMA. Therefore neither the start nor the pgoff parameters make any sense. It seemed we were passing the pgoff parameter solely to satisfy vma_set_range()'s requirement for pgoff being specified. Since vma_set_range() is now isolated to vma.c, we can simply introduce __vma_set_range() which sets only vma->vm_[start, end], and invoke this instead, removing start and pgoff from vma_shrink() altogether. No functional change intended. Link: https://lore.kernel.org/20260710-b4-pre-scalable-cow-v2-26-2a5aa403d977@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Pedro Falcato <pfalcato@suse.de> Reviewed-by: Gregory Price <gourry@gourry.net> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Ackerley Tng <ackerleytng@google.com> Cc: David Hildenbrand (Arm) <david@kernel.org> Cc: Kai Huang <kai.huang@intel.com> Cc: Marek Szyprowski <m.szyprowski@samsung.com> Cc: SJ Park <sj@kernel.org> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Liam R. Howlett (Oracle) <liam@infradead.org> Cc: Zi Yan <ziy@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-04mm/vma: make vma_set_range() static, drop insert_vm_struct() declLorenzo Stoakes
With __install_special_mapping() moved to vma.c, vma_set_range() can be made into a static function there and is now completely isolated from the rest of mm. While we're here, we can also remove the insert_vm_struct() declaration from mm.h - the function is implemented in vma.c and already declared in vma.h, and has no users outside of mm. Also update the VMA userland tests to reflect this change. No functional change intended. Link: https://lore.kernel.org/20260710-b4-pre-scalable-cow-v2-25-2a5aa403d977@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Pedro Falcato <pfalcato@suse.de> Reviewed-by: Gregory Price <gourry@gourry.net> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Ackerley Tng <ackerleytng@google.com> Cc: David Hildenbrand (Arm) <david@kernel.org> Cc: Kai Huang <kai.huang@intel.com> Cc: Marek Szyprowski <m.szyprowski@samsung.com> Cc: SJ Park <sj@kernel.org> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Liam R. Howlett (Oracle) <liam@infradead.org> Cc: Zi Yan <ziy@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-04mm/vma: introduce vma_assert_can_modify()Lorenzo Stoakes
vma_assert_write_locked() and vma_assert_attached() are useful for their own purposes, however VMA code absolutely does allow the modification of non-write locked VMAs if they are at that point detached (i.e. unreachable from anywhere). It's therefore useful to be able to assert that a VMA is either detached (modification doesn't matter) or write locked (you're explicitly locked for modification). Therefore introduce vma_assert_can_modify() for this purpose. While we're here, make vma_is_attached() available generally - if !CONFIG_PER_VMA_LOCK, then there's no sense in which a VMA is detached (vma_mark_detached() is a noop), so have this default to true in this case. Also update VMA userland tests to reflect this change, correcting the previously open-coded vma_assert_[attached,detached]() there. Link: https://lore.kernel.org/20260710-b4-pre-scalable-cow-v2-22-2a5aa403d977@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Gregory Price <gourry@gourry.net> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Ackerley Tng <ackerleytng@google.com> Cc: David Hildenbrand (Arm) <david@kernel.org> Cc: Kai Huang <kai.huang@intel.com> Cc: Marek Szyprowski <m.szyprowski@samsung.com> Cc: Pedro Falcato <pfalcato@suse.de> Cc: SJ Park <sj@kernel.org> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Liam R. Howlett (Oracle) <liam@infradead.org> Cc: Zi Yan <ziy@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-04mm/vma: remove duplicative vma_pgoff_offset() helperLorenzo Stoakes
This is doing what linear_page_index() does, so eliminate it and replace it with linear_page_index(). Update the VMA userland tests to reflect this change. No functional change intended. Link: https://lore.kernel.org/20260710-b4-pre-scalable-cow-v2-20-2a5aa403d977@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Pedro Falcato <pfalcato@suse.de> Reviewed-by: Gregory Price <gourry@gourry.net> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Ackerley Tng <ackerleytng@google.com> Cc: David Hildenbrand (Arm) <david@kernel.org> Cc: Kai Huang <kai.huang@intel.com> Cc: Marek Szyprowski <m.szyprowski@samsung.com> Cc: SJ Park <sj@kernel.org> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Liam R. Howlett (Oracle) <liam@infradead.org> Cc: Zi Yan <ziy@nvidia.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-04mm/rmap: rename anon_vma_interval_tree_*() to anon_rmap_tree_*()Lorenzo Stoakes
To be consistent with the newly renamed mapping_rmap_tree_*(), rename the anon_vma_interval_tree_*() helpers to anon_rmap_tree_*(). No functional change intended. Link: https://lore.kernel.org/20260710-b4-pre-scalable-cow-v2-11-2a5aa403d977@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Gregory Price <gourry@gourry.net> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Reviewed-by: Zi Yan <ziy@nvidia.com> Cc: Ackerley Tng <ackerleytng@google.com> Cc: David Hildenbrand (Arm) <david@kernel.org> Cc: Kai Huang <kai.huang@intel.com> Cc: Marek Szyprowski <m.szyprowski@samsung.com> Cc: Pedro Falcato <pfalcato@suse.de> Cc: SJ Park <sj@kernel.org> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Liam R. Howlett (Oracle) <liam@infradead.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-04mm/rmap: parameterise anon_vma_interval_tree_*() by anon_vmaLorenzo Stoakes
Similar to what we did with mapping_rmap_tree*(), let's declare anon_vma_interval_tree*() in terms of anon_vma rather than rb_root_cached. In each case the rb tree referenced is &anon_vma->rb_root, so just pass anon_vma and the functions can figure this out themselves. Also update the VMA userland tests to reflect the change. No functional change intended. Link: https://lore.kernel.org/20260710-b4-pre-scalable-cow-v2-9-2a5aa403d977@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Pedro Falcato <pfalcato@suse.de> Reviewed-by: Gregory Price <gourry@gourry.net> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Reviewed-by: Zi Yan <ziy@nvidia.com> Cc: Ackerley Tng <ackerleytng@google.com> Cc: David Hildenbrand (Arm) <david@kernel.org> Cc: Kai Huang <kai.huang@intel.com> Cc: Marek Szyprowski <m.szyprowski@samsung.com> Cc: SJ Park <sj@kernel.org> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Liam R. Howlett (Oracle) <liam@infradead.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-08-04mm/rmap: rename vma_interval_tree_*() to mapping_rmap_tree_*()Lorenzo Stoakes
The family of vma_interval_tree_() functions manipulate the address_space (which, of course, is generally referred to as 'mapping') reverse mapping, but are named the 'VMA' interval tree. VMAs may be mapped by an anon_vma, an address_space, or both. Therefore calling the mapping interval tree a 'VMA' interval tree is rather confusing. This is also inconsistent with the anon_vma_interval_tree_*() functions which explicitly reference the rmap object to which they pertain. Rename the vma_interval_tree_*() functions to mapping_rmap_tree_*() to correct this. We will rename the anon rmap functions similarly in a subsequent patch. No functional change intended. Link: https://lore.kernel.org/20260710-b4-pre-scalable-cow-v2-8-2a5aa403d977@kernel.org Signed-off-by: Lorenzo Stoakes <ljs@kernel.org> Reviewed-by: Gregory Price <gourry@gourry.net> Reviewed-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Reviewed-by: Zi Yan <ziy@nvidia.com> Cc: Ackerley Tng <ackerleytng@google.com> Cc: David Hildenbrand (Arm) <david@kernel.org> Cc: Kai Huang <kai.huang@intel.com> Cc: Marek Szyprowski <m.szyprowski@samsung.com> Cc: Pedro Falcato <pfalcato@suse.de> Cc: SJ Park <sj@kernel.org> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: Liam R. Howlett (Oracle) <liam@infradead.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
generated by cgit v1.2.3 (git 2.39.1) at 2026-09-14 00:54:01 +0000