<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/drivers/md, branch master</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>Merge tag 'block-7.4-20261029' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux</title>
<updated>2026-10-30T16:33:23+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2026-10-30T16:33:23+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=8ebbaf8835c62d7541a6226672a6c2e8e6a5428a'/>
<id>8ebbaf8835c62d7541a6226672a6c2e8e6a5428a</id>
<content type='text'>
Pull more block updates from Jens Axboe:
 "Bigger than usual for an end-of-merge-window pull request, main reason
  being that the MD side I had missed a pull on, and both NVMe and block
  got a good pile of LLM driven fixes where some of them may as well
  just go in now rather than wait a full cycle. This contains:

   - NVMe fixes via Keith:
      - nvme-tcp fallout from the parallel queue allocation: initialize
        pf_cache_lock and the header digest before requests are set up,
        and don't dereference a NULL queue-&gt;ctrl on reconnect
      - nvme-fabrics queue mapping fixes: reset io_queues on reconnect,
        limit each queue type to the online CPUs, and clear a poll map
        with no poll queues
      - nvme-tcp io_work priority inversion with send_mutex held
        (Seiji), error recovery on read_sock failure and skipping TLS
        control records while waiting for the ICResp (Martin B), TLS
        handshake timeout validation, and an address attribute race
      - nvme-rdma NULL metadata_sgl dereference with T10-PI
      - nvme-pci early boot hang with the quirks parameter
      - nvme-multipath ANA log bounds underflow, and an nvme-fc
        discovery reference leak
      - nvmet hardening: rdma inline SGL out-of-bounds write and short
        connect requests, fc use-after-free in LS create connection and
        teardown on admin queue failure, pci-epf transport error
        reporting and SGL length checks, zns NUMD wrap, fc stale read
        data, auth state and status fixes, ports list and qid_max
        locking, rdma double puts and irq-safe locking, and a double
        free on metadata SGL allocation failure
      - nvmet fixes from Josef: big discard length truncation, NULL
        derefs for PCI endpoint targets and debugfs host_traddr, stop
        listening when a tcp port is removed, and don't BUG() in
        nvme-loop when a scan runs beside a reset

   - MD fixes via Yu Kuai:
      - raid5 validation: reject too few disks, invalid reshape disks, a
        per-device size below one chunk, and an inconsistent reshape
        state from the superblock instead of BUG(), plus journal payload
        size checks
      - raid5 error path and lifetime fixes: extra_page leak and NULL
        derefs in free_conf/setup_conf, draining released_stripes before
        destroying the cache, RCU for the big_stripe_tree lookup, and
        per-array io_unit slab names
      - md core: reject v0.90 arrays with too many devices, validate
        bblog_size, take reconfig_mutex when enabling PPL, fix the
        mddev-&gt;private NULL deref when stopping an array under IO, and
        don't hand out the array before mddev-&gt;kobj is added
      - raid10 missing barrier wakeup, raid0 device count validation, a
        bogus mddev_unlock() in lbs_store(), and shared helpers

   - blk-mq fixes from Josef:
      - don't trust the bio cookie in blk_mq_poll()
      - keep tag sharing fair after a queue update
      - don't bring back flags of a completed request from the timeout
        handler
      - honor a restarted timer
      - initialize the dma state for P2P
      - quiesce a queue joining a quiesced tag set
      - set up and exit hctxs under tag_list_lock
      - free the tag bitmaps in the SRCU callback

   - blk-cgroup and friends from Josef:
      - keep the old blkg while reassociating a bio
      - free struct ioc after a grace period
      - don't truncate v1 iops limits
      - fix root io.stat on 32-bit
      - don't free a blkg with its punt work queued
      - flush iolatency enable_work after going offline
      - pass dead group I/O counts on and make reset_stats reset them
      - don't enter reclaim under rq_qos_mutex

   - Other core fixes from Josef:
      - a disk use-after-free in sync_bdevs()
      - don't losing the status of a failed flush request
      - 64-bit sector math for mac partitions
      - apply the segment size to the integrity buffer

   - blk-iocost: abort a weight transfer on invalid donation weights,
     and publish hweights as one atomic value

   - Fix a NULL deref and use-after-free in __blk_crypto_evict_key(),
     reachable via dm-inlinecrypt

   - Fix recursive i_rwsem locking in blkdev_write_iter(), from two
     fixes for the same race landing in the window

   - Advance the iterator after copy-in for SG_DXFER_TO_FROM_DEV, fixing
     an infinite loop in blk_rq_map_user_iov()

   - Check the open mode for LOOP_SET_STATUS in the compat ioctl

   - rnbd-srv use-after-free and kobject fixes

   - drbd timer and req_lock fixes

   - zloop cleanups and error path fixes

   - cdrom header and kernel-doc cleanups"

* tag 'block-7.4-20261029' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (109 commits)
  blk-crypto: fix NULL deref and UAF in __blk_crypto_evict_key()
  zloop: check that the zone backing file support -&gt;{read,write}_iter
  zloop: fput file after failed zone init
  zloop: share more code for opening a zone backing file
  zloop: remove a duplicate call to zloop_get_block_size
  block: fix kernel-doc warnings in blk-map.c and blk-mq-dma.c
  blk-iocost: publish hweights as one atomic value
  blk-iocost: abort weight transfer on invalid donation weights
  rnbd-srv: publish the sess_dev at the end of OPEN
  rnbd-srv: fix use-after-free on two CLOSE messages
  block/rnbd-srv: drop the sess_dev kobject unlocked
  block/rnbd-srv: don't free the device on a sysfs error
  drbd: take req_lock to skip the initial sync as peer
  drbd: stop the start_resync timer of a dying device
  block: apply the segment size to the integrity buffer
  blk-mq: free the bitmaps of tags in the SRCU callback
  block: partitions/mac: compute the sectors in 64 bits
  blk-mq: set up a queue under tag_list_lock
  blk-mq: exit the hctxs of a queue under tag_list_lock
  blk-mq: quiesce a queue that joins a quiesced tag set
  ...
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Pull more block updates from Jens Axboe:
 "Bigger than usual for an end-of-merge-window pull request, main reason
  being that the MD side I had missed a pull on, and both NVMe and block
  got a good pile of LLM driven fixes where some of them may as well
  just go in now rather than wait a full cycle. This contains:

   - NVMe fixes via Keith:
      - nvme-tcp fallout from the parallel queue allocation: initialize
        pf_cache_lock and the header digest before requests are set up,
        and don't dereference a NULL queue-&gt;ctrl on reconnect
      - nvme-fabrics queue mapping fixes: reset io_queues on reconnect,
        limit each queue type to the online CPUs, and clear a poll map
        with no poll queues
      - nvme-tcp io_work priority inversion with send_mutex held
        (Seiji), error recovery on read_sock failure and skipping TLS
        control records while waiting for the ICResp (Martin B), TLS
        handshake timeout validation, and an address attribute race
      - nvme-rdma NULL metadata_sgl dereference with T10-PI
      - nvme-pci early boot hang with the quirks parameter
      - nvme-multipath ANA log bounds underflow, and an nvme-fc
        discovery reference leak
      - nvmet hardening: rdma inline SGL out-of-bounds write and short
        connect requests, fc use-after-free in LS create connection and
        teardown on admin queue failure, pci-epf transport error
        reporting and SGL length checks, zns NUMD wrap, fc stale read
        data, auth state and status fixes, ports list and qid_max
        locking, rdma double puts and irq-safe locking, and a double
        free on metadata SGL allocation failure
      - nvmet fixes from Josef: big discard length truncation, NULL
        derefs for PCI endpoint targets and debugfs host_traddr, stop
        listening when a tcp port is removed, and don't BUG() in
        nvme-loop when a scan runs beside a reset

   - MD fixes via Yu Kuai:
      - raid5 validation: reject too few disks, invalid reshape disks, a
        per-device size below one chunk, and an inconsistent reshape
        state from the superblock instead of BUG(), plus journal payload
        size checks
      - raid5 error path and lifetime fixes: extra_page leak and NULL
        derefs in free_conf/setup_conf, draining released_stripes before
        destroying the cache, RCU for the big_stripe_tree lookup, and
        per-array io_unit slab names
      - md core: reject v0.90 arrays with too many devices, validate
        bblog_size, take reconfig_mutex when enabling PPL, fix the
        mddev-&gt;private NULL deref when stopping an array under IO, and
        don't hand out the array before mddev-&gt;kobj is added
      - raid10 missing barrier wakeup, raid0 device count validation, a
        bogus mddev_unlock() in lbs_store(), and shared helpers

   - blk-mq fixes from Josef:
      - don't trust the bio cookie in blk_mq_poll()
      - keep tag sharing fair after a queue update
      - don't bring back flags of a completed request from the timeout
        handler
      - honor a restarted timer
      - initialize the dma state for P2P
      - quiesce a queue joining a quiesced tag set
      - set up and exit hctxs under tag_list_lock
      - free the tag bitmaps in the SRCU callback

   - blk-cgroup and friends from Josef:
      - keep the old blkg while reassociating a bio
      - free struct ioc after a grace period
      - don't truncate v1 iops limits
      - fix root io.stat on 32-bit
      - don't free a blkg with its punt work queued
      - flush iolatency enable_work after going offline
      - pass dead group I/O counts on and make reset_stats reset them
      - don't enter reclaim under rq_qos_mutex

   - Other core fixes from Josef:
      - a disk use-after-free in sync_bdevs()
      - don't losing the status of a failed flush request
      - 64-bit sector math for mac partitions
      - apply the segment size to the integrity buffer

   - blk-iocost: abort a weight transfer on invalid donation weights,
     and publish hweights as one atomic value

   - Fix a NULL deref and use-after-free in __blk_crypto_evict_key(),
     reachable via dm-inlinecrypt

   - Fix recursive i_rwsem locking in blkdev_write_iter(), from two
     fixes for the same race landing in the window

   - Advance the iterator after copy-in for SG_DXFER_TO_FROM_DEV, fixing
     an infinite loop in blk_rq_map_user_iov()

   - Check the open mode for LOOP_SET_STATUS in the compat ioctl

   - rnbd-srv use-after-free and kobject fixes

   - drbd timer and req_lock fixes

   - zloop cleanups and error path fixes

   - cdrom header and kernel-doc cleanups"

* tag 'block-7.4-20261029' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (109 commits)
  blk-crypto: fix NULL deref and UAF in __blk_crypto_evict_key()
  zloop: check that the zone backing file support -&gt;{read,write}_iter
  zloop: fput file after failed zone init
  zloop: share more code for opening a zone backing file
  zloop: remove a duplicate call to zloop_get_block_size
  block: fix kernel-doc warnings in blk-map.c and blk-mq-dma.c
  blk-iocost: publish hweights as one atomic value
  blk-iocost: abort weight transfer on invalid donation weights
  rnbd-srv: publish the sess_dev at the end of OPEN
  rnbd-srv: fix use-after-free on two CLOSE messages
  block/rnbd-srv: drop the sess_dev kobject unlocked
  block/rnbd-srv: don't free the device on a sysfs error
  drbd: take req_lock to skip the initial sync as peer
  drbd: stop the start_resync timer of a dying device
  block: apply the segment size to the integrity buffer
  blk-mq: free the bitmaps of tags in the SRCU callback
  block: partitions/mac: compute the sectors in 64 bits
  blk-mq: set up a queue under tag_list_lock
  blk-mq: exit the hctxs of a queue under tag_list_lock
  blk-mq: quiesce a queue that joins a quiesced tag set
  ...
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge tag 'vfs-7.4-rc1.keyring' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs</title>
<updated>2026-10-27T18:01:30+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2026-10-27T18:01:30+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=62c457528529cdcfa32bc52b331ceca10f3937b6'/>
<id>62c457528529cdcfa32bc52b331ceca10f3937b6</id>
<content type='text'>
Pull vfs keyring updates from Christian Brauner:
 "The kernel has two keyrings that userspace fills with X.509
  certificates at boot: .fs-verity for fs-verity built-in signatures
  and .dm-verity for dm-verity root hash signatures.

  Neither is linked into any process keyring. Hence, request_key() and
  KEYCTL_SEARCH can't find them. The only way for userspace to identify
  them is to read their serial number out of /proc/keys. That is not
  just a large file often the names can also be reused and appear
  multiple times which allows forging these keyrings.

  This adds two fixed special key ids, KEY_SPEC_DM_VERITY_KEYRING and
  KEY_SPEC_FS_VERITY_KEYRING next to KEY_SPEC_BPF_KEYRING. The latter
  went in through bpf-next this merge window.

  lookup_user_key() resolves the fixed key ids to the two keyrings. So
  userspace can add a dm-verity (fixed keyring id: -10) certificate with

	keyctl padd asymmetric "" -10 &lt; cert.der

  and seal the keyring with

	keyctl restrict_keyring -10

  without looking anything up first"

* tag 'vfs-7.4-rc1.keyring' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  Documentation: keys: document IDs added since KEY_SPEC_REQKEY_AUTH_KEY
  keys: add KEY_SPEC_FS_VERITY_KEYRING
  keys: add KEY_SPEC_DM_VERITY_KEYRING
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Pull vfs keyring updates from Christian Brauner:
 "The kernel has two keyrings that userspace fills with X.509
  certificates at boot: .fs-verity for fs-verity built-in signatures
  and .dm-verity for dm-verity root hash signatures.

  Neither is linked into any process keyring. Hence, request_key() and
  KEYCTL_SEARCH can't find them. The only way for userspace to identify
  them is to read their serial number out of /proc/keys. That is not
  just a large file often the names can also be reused and appear
  multiple times which allows forging these keyrings.

  This adds two fixed special key ids, KEY_SPEC_DM_VERITY_KEYRING and
  KEY_SPEC_FS_VERITY_KEYRING next to KEY_SPEC_BPF_KEYRING. The latter
  went in through bpf-next this merge window.

  lookup_user_key() resolves the fixed key ids to the two keyrings. So
  userspace can add a dm-verity (fixed keyring id: -10) certificate with

	keyctl padd asymmetric "" -10 &lt; cert.der

  and seal the keyring with

	keyctl restrict_keyring -10

  without looking anything up first"

* tag 'vfs-7.4-rc1.keyring' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  Documentation: keys: document IDs added since KEY_SPEC_REQKEY_AUTH_KEY
  keys: add KEY_SPEC_FS_VERITY_KEYRING
  keys: add KEY_SPEC_DM_VERITY_KEYRING
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge tag 'for-7.4/io_uring-dmabuf-20261023' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux</title>
<updated>2026-10-27T17:46:05+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2026-10-27T17:46:05+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=ed02f4f7ad9b5dabae2118e642cbbafe7dc9bb62'/>
<id>ed02f4f7ad9b5dabae2118e642cbbafe7dc9bb62</id>
<content type='text'>
Pull io_uring dma-buf support from Jens Axboe:
 "This adds native dma-buf support to the I/O path, exposed through
  io_uring. It's been in development for a while and should be ready to
  go now.

   - dma-buf file I/O infrastructure: a dma_buf_io_ctx created through a
     new -&gt;init_dma_buf_io_ctx file operation, and a dma_buf_io_map
     holding the device DMA mapping. The two are split so a mapping can
     be invalidated and re-established underneath a live context, with
     the map counting in-flight requests so it can be torn down safely.

   - A new iov_iter type for dmabuf maps, and a dma map backed bio type
     for the block layer, with raw block device support on top.

   - nvme-pci backend implementing dma-buf backed requests, including
     SGL support.

   - io_uring dmabuf backed registered buffers, built on a reworked
     buffer registration structure with an extended update path, regbuf
     import flags, an uncloneable flag for buffer types that can't be
     cloned, and cloning support for registered dma-bufs"

* tag 'for-7.4/io_uring-dmabuf-20261023' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring/dma-buf: don't fail fixed buffers without dma-buf support
  nvme-pci: detach dma-bufs only on removal
  block: reject dma-bufs larger than 4GiB
  io_uring/dma-buf: allow cloning registered dma-bufs
  dma-buf-io: document dma_buf_io_init_map
  dma-buf-io: fix typos in kernel docs
  block: fix indention for dma-buf checks
  io_uring/rsrc: add dmabuf backed registered buffers
  io_uring/rsrc: add regbuf import flags
  io_uring/rsrc: add uncloneable regbuf flag
  io_uring/rsrc: extend buffer update
  io_uring/rsrc: introduce buf registration structure
  nvme-pci: add SGL support for the dmabuf path
  nvme-pci: implement dma-buf backed requests
  nvme-pci: rename nvme_pci_sgl_set_data to nvme_pci_dma_iter_set_sgl
  block: add dma-buf support for raw bdev
  block: introduce dma map backed bio type
  block: always adjust bi_offset on bio_advance_iter
  iov_iter: add iterator type for dmabuf maps
  dma-buf: introduce initial file I/O infrastructure
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Pull io_uring dma-buf support from Jens Axboe:
 "This adds native dma-buf support to the I/O path, exposed through
  io_uring. It's been in development for a while and should be ready to
  go now.

   - dma-buf file I/O infrastructure: a dma_buf_io_ctx created through a
     new -&gt;init_dma_buf_io_ctx file operation, and a dma_buf_io_map
     holding the device DMA mapping. The two are split so a mapping can
     be invalidated and re-established underneath a live context, with
     the map counting in-flight requests so it can be torn down safely.

   - A new iov_iter type for dmabuf maps, and a dma map backed bio type
     for the block layer, with raw block device support on top.

   - nvme-pci backend implementing dma-buf backed requests, including
     SGL support.

   - io_uring dmabuf backed registered buffers, built on a reworked
     buffer registration structure with an extended update path, regbuf
     import flags, an uncloneable flag for buffer types that can't be
     cloned, and cloning support for registered dma-bufs"

* tag 'for-7.4/io_uring-dmabuf-20261023' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring/dma-buf: don't fail fixed buffers without dma-buf support
  nvme-pci: detach dma-bufs only on removal
  block: reject dma-bufs larger than 4GiB
  io_uring/dma-buf: allow cloning registered dma-bufs
  dma-buf-io: document dma_buf_io_init_map
  dma-buf-io: fix typos in kernel docs
  block: fix indention for dma-buf checks
  io_uring/rsrc: add dmabuf backed registered buffers
  io_uring/rsrc: add regbuf import flags
  io_uring/rsrc: add uncloneable regbuf flag
  io_uring/rsrc: extend buffer update
  io_uring/rsrc: introduce buf registration structure
  nvme-pci: add SGL support for the dmabuf path
  nvme-pci: implement dma-buf backed requests
  nvme-pci: rename nvme_pci_sgl_set_data to nvme_pci_dma_iter_set_sgl
  block: add dma-buf support for raw bdev
  block: introduce dma map backed bio type
  block: always adjust bi_offset on bio_advance_iter
  iov_iter: add iterator type for dmabuf maps
  dma-buf: introduce initial file I/O infrastructure
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge tag 'md-7.4-20261013' of https://git.kernel.org/pub/scm/linux/kernel/git/mdraid/linux into block-7.4</title>
<updated>2026-10-25T03:04:39+00:00</updated>
<author>
<name>Jens Axboe</name>
<email>axboe@kernel.dk</email>
</author>
<published>2026-10-25T03:04:39+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=f89fa411b8526a0d3706a6139b6bc99869c80dc3'/>
<id>f89fa411b8526a0d3706a6139b6bc99869c80dc3</id>
<content type='text'>
Pull MD changes from Yu Kuai:

"Bug Fixes:
- Wake RAID10 barrier waiters when a pending-count rollback satisfies
  an active array freeze. (Zizhi Wo)
- Reject v0.90 superblocks whose device count cannot fit the metadata
  format, preventing out-of-bounds access. (Jérémy Jean)
- Track RAID5 disk-array allocation size and avoid removing an
  unregistered CPU hotplug instance on setup or resize failure.
  (Cao Guanghui)
- Validate the RAID0 device count before allocating its device list.
  (Chandradhar Kumar)
- Validate RAID5 journal payload header, size, and checksum bounds
  before accessing them. (Martin Wilck)
- Reject inconsistent RAID5 reshape metadata instead of triggering a
  kernel BUG. (Yogesh Gaur)
- Reject invalid RAID4/5 disk counts before setup and invalid reshape
  disk counts in raid5_run. (Chen Cheng)
- Fix a NULL-pointer dereference in RAID5 setup error handling.
  (Zhihao Cheng)
- Reject RAID5 per-device sizes smaller than one chunk. (Zizhi Wo)
- Fix mddev_unlock() on an unacquired mutex in lbs_store().
  (Jack Wang)
- Give RAID5 io_unit slab caches per-array names to avoid duplicate
  cache names. (Yogesh Gaur)
- Validate v1.x bad-block log size when loading superblocks.
  (Yuchao Zhang)
- Take reconfig_mutex while enabling PPL on an inactive array to
  prevent a NULL PPL configuration. (Nguyen Ngoc Thang)
- Drain released RAID5 stripes before destroying the stripe cache on
  takeover setup failure. (Li Youhong)
- Protect RAID5 big_stripe_tree lookup with RCU. (Sang-Hoon Choi)
- Prevent a NULL mddev-&gt;private dereference when stopping an array
  while I/O is being submitted. (Zhihao Cheng)
- Don't publish an md array before md_alloc() finishes initializing
  mddev-&gt;kobj. (Yogesh Gaur)

Cleanups:
- Annotate intentional lockless RAID10 freeze-state accesses.
  (Zizhi Wo)
- Add shared RAID write-error and bad-block-sector helpers, and share
  flush_bio_list between RAID1 and RAID10. (Li Youhong)
- Extract RAID5 min_raid_disks() helper. (Chen Cheng)
- Use assign_bit() where applicable in MD/RAID. (Peng Fan)"

* tag 'md-7.4-20261013' of https://git.kernel.org/pub/scm/linux/kernel/git/mdraid/linux: (25 commits)
  md: don't hand out the array before md_alloc() has added mddev-&gt;kobj
  md: Fix the null-ptr-deref of 'mddev-&gt;private' while submitting IO
  md/raid5: protect big_stripe_tree lookup with RCU
  md/raid5: drain released_stripes before destroying the cache
  md: take reconfig_mutex when enabling PPL on an inactive array
  md: validate bblog_size when loading v1.x badblocks metadata
  md/raid: use assign_bit() where applicable
  md/raid5: reject invalid reshape disks in raid5_run()
  md/raid5: extract min_raid_disks()
  md/raid5: give the io_unit slab caches per-array names
  md: fix mddev_unlock() called without holding lock in lbs_store()
  md/raid1-10: share flush_bio_list between raid1 and raid10
  md/raid1-10: add rdev_bb_block_sectors() helper
  md: add rdev_record_write_error() helper
  md/raid5: reject a per-device size smaller than one chunk
  md/raid5: setup_conf: Fix null-ptr-def in error handling path
  md/raid5: reject raid4/5 arrays with too few disks
  md/raid5: don't BUG() on an inconsistent reshape state from the superblock
  md/raid5: validate payload size before calculating payload_len
  md/raid0: validate device count before allocating devlist
  ...
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Pull MD changes from Yu Kuai:

"Bug Fixes:
- Wake RAID10 barrier waiters when a pending-count rollback satisfies
  an active array freeze. (Zizhi Wo)
- Reject v0.90 superblocks whose device count cannot fit the metadata
  format, preventing out-of-bounds access. (Jérémy Jean)
- Track RAID5 disk-array allocation size and avoid removing an
  unregistered CPU hotplug instance on setup or resize failure.
  (Cao Guanghui)
- Validate the RAID0 device count before allocating its device list.
  (Chandradhar Kumar)
- Validate RAID5 journal payload header, size, and checksum bounds
  before accessing them. (Martin Wilck)
- Reject inconsistent RAID5 reshape metadata instead of triggering a
  kernel BUG. (Yogesh Gaur)
- Reject invalid RAID4/5 disk counts before setup and invalid reshape
  disk counts in raid5_run. (Chen Cheng)
- Fix a NULL-pointer dereference in RAID5 setup error handling.
  (Zhihao Cheng)
- Reject RAID5 per-device sizes smaller than one chunk. (Zizhi Wo)
- Fix mddev_unlock() on an unacquired mutex in lbs_store().
  (Jack Wang)
- Give RAID5 io_unit slab caches per-array names to avoid duplicate
  cache names. (Yogesh Gaur)
- Validate v1.x bad-block log size when loading superblocks.
  (Yuchao Zhang)
- Take reconfig_mutex while enabling PPL on an inactive array to
  prevent a NULL PPL configuration. (Nguyen Ngoc Thang)
- Drain released RAID5 stripes before destroying the stripe cache on
  takeover setup failure. (Li Youhong)
- Protect RAID5 big_stripe_tree lookup with RCU. (Sang-Hoon Choi)
- Prevent a NULL mddev-&gt;private dereference when stopping an array
  while I/O is being submitted. (Zhihao Cheng)
- Don't publish an md array before md_alloc() finishes initializing
  mddev-&gt;kobj. (Yogesh Gaur)

Cleanups:
- Annotate intentional lockless RAID10 freeze-state accesses.
  (Zizhi Wo)
- Add shared RAID write-error and bad-block-sector helpers, and share
  flush_bio_list between RAID1 and RAID10. (Li Youhong)
- Extract RAID5 min_raid_disks() helper. (Chen Cheng)
- Use assign_bit() where applicable in MD/RAID. (Peng Fan)"

* tag 'md-7.4-20261013' of https://git.kernel.org/pub/scm/linux/kernel/git/mdraid/linux: (25 commits)
  md: don't hand out the array before md_alloc() has added mddev-&gt;kobj
  md: Fix the null-ptr-deref of 'mddev-&gt;private' while submitting IO
  md/raid5: protect big_stripe_tree lookup with RCU
  md/raid5: drain released_stripes before destroying the cache
  md: take reconfig_mutex when enabling PPL on an inactive array
  md: validate bblog_size when loading v1.x badblocks metadata
  md/raid: use assign_bit() where applicable
  md/raid5: reject invalid reshape disks in raid5_run()
  md/raid5: extract min_raid_disks()
  md/raid5: give the io_unit slab caches per-array names
  md: fix mddev_unlock() called without holding lock in lbs_store()
  md/raid1-10: share flush_bio_list between raid1 and raid10
  md/raid1-10: add rdev_bb_block_sectors() helper
  md: add rdev_record_write_error() helper
  md/raid5: reject a per-device size smaller than one chunk
  md/raid5: setup_conf: Fix null-ptr-def in error handling path
  md/raid5: reject raid4/5 arrays with too few disks
  md/raid5: don't BUG() on an inconsistent reshape state from the superblock
  md/raid5: validate payload size before calculating payload_len
  md/raid0: validate device count before allocating devlist
  ...
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge tag 'for-7.4/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm</title>
<updated>2026-10-24T23:40:26+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2026-10-24T23:40:26+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=696e75b3a616649cf50a63b1d7b816c8e31b235c'/>
<id>696e75b3a616649cf50a63b1d7b816c8e31b235c</id>
<content type='text'>
Pull device mapper updates from Mikulas Patocka:
 "dm:
   - fix a bug in dm_accept_partial_bio that broke dm-writecache
     in persistent-memory mode
   - use assign_bit()

  dm-vdo:
   - fix misbehavior on invalid metadata

  dm-crypt:
   - use memzero_explicit
   - reject malformed keys
   - allow sector size up to page size

  dm-delay:
   - advertise flush support if the user wants to delay flushes

  dm-writecache:
   - reduce per-block metadata overhead by 8 bytes
   - report I/O error when flush failed
   - fix a quirk in statistics
   - fix a crash if we attempt to use a non-dax device
   - fix uncommitted_blocks underflow
   - fix REQ_FUA processing

  dm-verity:
   - add the option DM_VERITY_VERIFY_ROOTHASH_SIG_FORCE
   - clear LSM integrity state on suspend

  dm-thin:
   - remove unnecessary locking in pool_map

  dm-mpath:
   - small refactoring of the historical service time path selector

  dm-snapshot:
   - fix crash if dm_io_client_create fails
   - make the chunk list being sorted by the chunk number

  dm-bufio:
   - fix non-working memory limit
   - fix a race leading to an unsigned integer underflow
   - clean-up cache limit reading"

* tag 'for-7.4/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: (29 commits)
  dm-verity: clear LSM integrity state on suspend
  dm-bufio: clean-up cache size reading
  dm-bufio: fix a race leading to an unsigned integer underflow
  dm-bufio: fix non-working memory limit
  dm-snapshot: make the chunk list sorted by the chunk number
  dm-snapshot: fix crash if dm_io_client_create fails
  dm-crypt: allow encryption sector size up to PAGE_SIZE
  dm-mpath: check values in hst_status while holding spinlock
  dm-mpath: standardize repeat_count handling in the HST path selector
  dm-mpath: streamline setup work in the HST path selector
  dm-writecache: fix REQ_FUA processing
  dm-writecache: fix uncommitted_blocks underflow
  dm-writecache: fix a crash if we attempt to use non-dax device
  dm-writecache: fix a quirk in statistics
  dm-writecache: report I/O error if flush failed
  dm: fix a bug in dm_accept_partial_bio
  dm thin: Remove unnecessary locking from pool_map()
  dm-verity: add DM_VERITY_VERIFY_ROOTHASH_SIG_FORCE
  dm: use assign_bit() where applicable
  dm-writecache: Reduce metadata memory use by 8 bytes per cache block
  ...
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Pull device mapper updates from Mikulas Patocka:
 "dm:
   - fix a bug in dm_accept_partial_bio that broke dm-writecache
     in persistent-memory mode
   - use assign_bit()

  dm-vdo:
   - fix misbehavior on invalid metadata

  dm-crypt:
   - use memzero_explicit
   - reject malformed keys
   - allow sector size up to page size

  dm-delay:
   - advertise flush support if the user wants to delay flushes

  dm-writecache:
   - reduce per-block metadata overhead by 8 bytes
   - report I/O error when flush failed
   - fix a quirk in statistics
   - fix a crash if we attempt to use a non-dax device
   - fix uncommitted_blocks underflow
   - fix REQ_FUA processing

  dm-verity:
   - add the option DM_VERITY_VERIFY_ROOTHASH_SIG_FORCE
   - clear LSM integrity state on suspend

  dm-thin:
   - remove unnecessary locking in pool_map

  dm-mpath:
   - small refactoring of the historical service time path selector

  dm-snapshot:
   - fix crash if dm_io_client_create fails
   - make the chunk list being sorted by the chunk number

  dm-bufio:
   - fix non-working memory limit
   - fix a race leading to an unsigned integer underflow
   - clean-up cache limit reading"

* tag 'for-7.4/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: (29 commits)
  dm-verity: clear LSM integrity state on suspend
  dm-bufio: clean-up cache size reading
  dm-bufio: fix a race leading to an unsigned integer underflow
  dm-bufio: fix non-working memory limit
  dm-snapshot: make the chunk list sorted by the chunk number
  dm-snapshot: fix crash if dm_io_client_create fails
  dm-crypt: allow encryption sector size up to PAGE_SIZE
  dm-mpath: check values in hst_status while holding spinlock
  dm-mpath: standardize repeat_count handling in the HST path selector
  dm-mpath: streamline setup work in the HST path selector
  dm-writecache: fix REQ_FUA processing
  dm-writecache: fix uncommitted_blocks underflow
  dm-writecache: fix a crash if we attempt to use non-dax device
  dm-writecache: fix a quirk in statistics
  dm-writecache: report I/O error if flush failed
  dm: fix a bug in dm_accept_partial_bio
  dm thin: Remove unnecessary locking from pool_map()
  dm-verity: add DM_VERITY_VERIFY_ROOTHASH_SIG_FORCE
  dm: use assign_bit() where applicable
  dm-writecache: Reduce metadata memory use by 8 bytes per cache block
  ...
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge tag 'mm-stable-2026-10-19-21-33' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm</title>
<updated>2026-10-23T17:42:11+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2026-10-23T17:42:11+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=c5fd5e67c7812bc40cd897422c1e0d6dd9ed1e2e'/>
<id>c5fd5e67c7812bc40cd897422c1e0d6dd9ed1e2e</id>
<content type='text'>
Pull MM updates from Andrew Morton:

 - "selftests/mm: improve khugepaged coverage" (Kiryl Shutsemau):

   Give khugepaged a proper workout. Extend the tests to all supported
   mTHP orders, check exactly which windows collapsed, and make scan
   completion deterministic. Race collapse against faults, pinning, fork
   and remap; verify that the contents survive.

   Add coverage for whole-page-table zaps and memory pressure too.

 - "selftests/mm: separate GUP microbenchmarking from functional testing"
   (Sarthak Sharma):

   Untangle GUP benchmarking from correctness testing. Move the
   benchmark into tools/mm, add a standalone harness-based GUP selftest,
   and move shared helpers into tools/lib/mm. Give each tool one job
   instead of mixing timing measurements with correctness checks.

   Cover the mapping, pinning and batch-size combinations explicitly.

 - "mm: Switch device DAX to section-based vmemmap optimization" (Muchun
   Song):

   Apply section-based vmemmap optimization to device DAX. Rework the
   backing metadata layout to save memory while preserving the handling
   of device memory hotplug and its different alignment and lifetime
   requirements.

 - "mm: Introduce section-based vmemmap optimization for HugeTLB"
   (Muchun Song):

   Cut the memory consumed by HugeTLB's struct page array with
   section-based vmemmap optimization. Arrange the metadata so large
   huge pages need fewer backing pages, while keeping initialization,
   teardown and the various hugepage configurations straight.

 - "mm/huge_memory: clean up and decouple the anon and file split
   helpers" (Kairui Song):

   Separate anonymous and file-backed folio splitting, which have rather
   different locking and bookkeeping requirements. Move the work into
   separate helpers, drop dead checks and tidy swap-cache handling. Fix
   error paths, including one that could leave a folio frozen.

   Keep the swap cache cases separate from file-cache splitting.

 - "mm: Unconditional per-VMA locks and cleanups" (Dave Hansen):

   Make per-VMA locking unconditional and clean up the old conditional
   code around it. This removes configuration-dependent plumbing and
   lets callers depend on one locking model rather than carrying both
   cases along.

 - "memcg: remove the v1 soft limit" (Shakeel Butt):

   Remove the old cgroup v1 memory soft-limit machinery. This has long
   since been superseded by the newer memory-control interfaces; hauling
   around a separate reclaim scheme for it no longer buys us much.

 - "read proc/pid/smaps_rollup under per-vma lock" (Suren Baghdasaryan):

   Read /proc/PID/smaps_rollup using per-VMA locks where possible,
   rather than holding mmap_lock across the entire walk. Retain the
   contention fallback and add tearing tests. This considerably reduces
   latency when another thread is busy changing its mappings.

 - "mm/damon: introduce data access-as-a-data attribute" (SJ Park):

   Teach DAMON to expose memory access observations as data attributes,
   making them available to the probe and filtering machinery. Extend
   the interfaces, documentation and tests so the new information can be
   used rather than merely collected.

 - "Remove PG_private by using page/folio-&gt;private checks instead" (Zi
   Yan):

   Get rid of PG_private and use the folio's private pointer to say
   whether private data is attached. Convert the filesystem users,
   including erofs, f2fs and md, and clean up the old accessors and
   flags. There are a few special cases, notably swapcache and hugetlb,
   which need explicit care.

 - "mm: make userland page table freeing RCU-safe" (Lorenzo Stoakes):

   Make freeing userspace page tables safe against RCU readers. Sort out
   the page-table lifetime and locking rules so walkers cannot stumble
   over freed tables while mappings are being torn down.

 - "make unused huge shrinker memcg aware" (Qi Zheng):

   Make shmem's unused-huge-folio shrinker aware of memory cgroups, so
   reclaim can find those folios under the right memcg. Wire up the
   per-memcg tracking and its lifetime rules, and give the shrinklist
   its own lockdep class to avoid spurious dependency reports.

 - "mm: Drop pxd_ERROR()" (Anshuman Khandual):

   Remove the old pxd_ERROR() page-table checks and their
   architecture-specific baggage. Simplify the common page-table
   interfaces and callers now that these checks no longer serve a
   useful purpose.

 - "memcg: group struct fields by access pattern" (Shakeel Butt):

   Rearrange memcg's hot and cold fields according to how they're
   actually accessed. Keep frequently updated counters and their
   neighboring state from fighting over cachelines and reduce needless
   cacheline traffic.

 - "mm/damon/core: fix the size charged for a filter-trimmed region"
   (Donggeun Yoo):

   Fix DAMOS quota accounting when a filter trims a monitoring region.
   Charge only the part left after filtering, not the original region,
   and add KUnit coverage. Previously the excluded memory could eat into
   the quota and make schemes run more slowly than requested.

 - "mm/damon: add kunit and selftests for probes and probe weights" (SJ
   Park):

   Add more tests for DAMON probes and their weights, including
   validation and the results reported to userspace. This is mostly
   about catching regressions in the newer probe infrastructure before
   they become harder to diagnose.

 - "mm: memcontrol: constify the read side of the read side of the memcg
   API" (Tal Zussman):

   Mark the read-only parts of the memcg interface const, from folio and
   lruvec accessors to counters and swap helpers. Most of this is
   mechanical, but it makes the contracts clearer and lets the compiler
   catch accidental writes.

 - "mm/damon/vaddr: support {prep,apply}_probes" (SJ Park):

   Support the new prepare/apply probe operations in DAMON's
   virtual-address backend. This brings vaddr monitoring into line with
   the probe infrastructure and makes the added probe types useful there
   too.

 - "mm/mglru: clean up folio counters and flag usage" (Kairui Song):

   Simplify MGLRU's folio counters and flag handling. Remove redundant
   accounting paths and make the state transitions easier to follow
   without changing the intended reclaim policy.

 - "arch, mm/execmem: resolve confusion about set_direct_map_valid_noflush()"
   (Mike Rapoport (Microsoft)):

   Clarify and straighten out the set_direct_map_valid_noflush()
   interface across architectures and execmem. Make the requested
   mapping changes and the callers' expectations agree, rather than
   relying on subtly different architecture behavior.

 - "mm: zswap: free cold writeback folios promptly" (Alexandre Ghiti):

   Free zswap writeback folios as soon as their disk write completes.
   They are cold temporary buffers, so putting them on the LRU only
   makes reclaim rediscover them later. Extend swap-cache dropbehind and
   let zswap keep these folios off the LRU altogether.

 - "mm: gup: cleanup gup_fast call chain" (Aristeu Rozanski):

   Clean up the GUP-fast call chain and simplify how the fast-path
   helpers pass their arguments and results around. Keep the page-pin
   behavior the same while making the call sequence easier to maintain.

 - "mm: optimize zone-device memmap initialization" (Li Zhe):

   Speed up initialization of zone-device struct pages. Avoid redundant
   work when setting up large device-memory ranges, where touching every
   descriptor can get expensive.

 - "mm/zswap: shrink zswap_entry via a pool id" (Jianyue Wu):

   Reduce the size of zswap_entry by storing a compact pool identifier
   instead of a full pointer. Keep the pool lookup and lifetime handling
   correct while saving per-entry metadata.

 - "mm/damon: support access monitoring of hugetlb-backed memory"
   (Krishna Iyer):

   Let DAMON monitor hugetlb-backed memory too. Extend the relevant
   access checks and add coverage so those mappings no longer fall
   through a hole in the monitoring machinery.

 - "mm/execmem: fixes and cleanups for the ROX cache" (Mike Rapoport):

   Tidy execmem's read-only-executable cache and fix its handling of the
   awkward allocation and release cases. The aim is to make the cache's
   ownership and permission transitions more predictable.

 - "zsmallc: remove old object read API" (Sergey Senozhatsky):

   Drop zsmalloc's old object-read API and move its remaining users to
   the supported access mechanism. This removes a duplicate interface
   which we no longer need.

 - "mm/mempolicy: stop copying state in the interleave paths" (Gregory
   Price):

   Stop copying mempolicy state in the interleave paths when a reference
   to the existing policy will do. This avoids extra work and makes the
   ownership rules less obscure.

 - "mm/mglru: speed up inc_min_seq() and fix cold/hot inversions" (Barry
   Song):

   Make MGLRU's generation advancement cheaper and fix cases where cold
   and hot folios end up in the wrong order. Adjust the counter and list
   handling so reclaim doesn't keep passing over the better eviction
   candidates.

 - "mm: Fix MF_DELAYED handling on memory failure" (Lisa Wang):

   Treat MF_DELAYED as a partially completed memory-failure operation,
   not an outright failure. Propagate that result correctly through
   shmem and the generic handler, fix the extra-reference accounting,
   and add tests for the resulting SIGBUS behavior.

 - "tools/mm/page_owner_sort: fix --sort, add module filter, improve
   usage" (Ye Liu):

   Fix page_owner_sort's --sort handling, add module-based filtering and
   make the usage output more helpful. This makes the tool less
   frustrating when tracking down who is holding on to pages.

 - "mm/damon: move damos filter range arguments validation to core" (SJ
   Park):

   Move DAMOS filter range validation into the core, where all callers
   can share it. Also close the sysfs read-twice races which could pass
   inconsistent ranges, and add tests for invalid input.

 - "mm/damon: misc cleanups" (Zenghui Yu):

   Clean up a collection of small DAMON rough edges in the core,
   interfaces and tests. No large behavior change here, just simpler
   code and fewer opportunities for confusion.

 - "mm/damon: cleanup code, add test cases, and update guidances in
   docs" (SJ Park):

   Clean up DAMON's core and interfaces, add missing test cases and
   bring the documentation into line with the code. These changes should
   make the newer facilities easier to understand and maintain.

 - "mm/damon: introduce hugepage_size probe filter" (SJ Park):

   Add a DAMON probe filter for hugepage size. Let users select a range
   of folio sizes through sysfs, validate the range and document the new
   interface, so monitoring can concentrate on memory backed by the
   desired hugepage sizes.

 - "selftests/mm: pagemap_ioctl test fixes and cleanups" (Zenghui Yu):

   Fix some pagemap ioctl test assumptions and clean up their setup and
   reporting. Make failures point to the operation that went wrong
   rather than to test harness bookkeeping.

 - "mm: avoid large folio splits when swap is unavailable" (Johannes
   Weiner):

   Avoid splitting large folios merely to attempt swap when no swap
   space is available. There is little point paying for an expensive
   split when reclaim cannot actually swap the resulting pages out.

 - "mm: workingset: fix the shadow node budget under MGLRU" (Hui Zhu):

   Fix the workingset shadow-node budget with MGLRU enabled. Keep the
   shadow entries within the intended limits so refault tracking does
   not quietly consume more metadata than it should.

 - "selftests/mm: TAP output and global-state fixes" (Song Hu):

   Fix selftests which produce misleading TAP output or fail to restore
   global settings after a run. A test ought to leave the system as it
   found it, particularly when a whole suite follows behind.

 - "mm: remove page_swap_entry()" (Tal Zussman):

   Remove page_swap_entry() and convert its remaining users to the folio
   and swap-entry helpers. Lose an old page-level interface and make the
   swap paths a little more consistent.

 - "mm: refactor zonelist constructors and iterators" (Gregory Price):

   Refactor the zonelist construction and walk helpers to reduce
   duplicated logic. Keep the allocation ordering rules intact while
   making it clearer how zones are selected.

 - "mm: kmemleak: batch the struct page scan" (Breno Leitao):

   Scan adjacent struct pages in batches instead of taking kmemleak_lock
   once for every single page. This preserves scan coverage and the
   lock-hold bound, while cutting overhead substantially on debug
   kernels.

 - "mm/damon: misc improvements in tests and documents" (Zenghui Yu):

   Fix some DAMON selftests which leave kdamond running or fail under
   Python safe-path mode, and improve the KUnit coverage and
   documentation. Nothing especially glamorous, but these are worth
   doing.

 - "mm/damon: introduce probe_hits_wsum DAMOS core filter" (SJ Park):

   Add a DAMOS core filter using weighted probe-hit counts. This gives
   schemes another way to select regions based on what the monitoring
   probes observed.

 - "mm/mglru: fix ineffective memory protection for non-kswapd reclaim"
   (Ridong Chen):

   Fix MGLRU's memory protection handling for reclaim outside kswapd.
   The protection settings weren't having the intended effect in these
   paths, leaving protected memory more exposed than requested.

 - "mm/damon: improve readability, clarity and test coverage" (SJ Park):

   Simplify a handful of DAMON core helpers, clarify their behavior and
   expand test coverage. There are no intended userspace-visible changes
   in this batch.

 - "mm: replace PF_KCOMPACTD/PF_KSWAPD with kthread_func()" (Kefeng
   Wang):

   Stop identifying reclaim and compaction workers through the PF_KSWAPD
   and PF_KCOMPACTD task flags. Use their kthread functions instead and
   remove the redundant flag plumbing.

 - "mm/hugetlb: fix surplus accounting and availability checks during
   demotion" (Longlong Xia):

   Fix HugeTLB surplus accounting and availability checks when demoting
   huge pages. Keep the counters and reservation decisions consistent as
   one huge page turns into several smaller ones.

 - "mm/damon: add kunit tests for probe_hits handling and probe params
   validation" (Jason Angelov):

   Add KUnit tests for DAMON probe-hit handling and invalid probe
   parameters. These cover edge cases that were too easy to miss in
   ordinary monitoring tests.

 - "mm/damon: fix misc bugs in kunit, quota goals and sysfs refresh_ms"
   (SJ Park):

   Fix a few DAMON bugs in KUnit tests, quota-goal handling and the
   sysfs refresh interval. Small fixes, but the incorrect results and
   control behavior were real.

 - "mm: zswap: optimize zswap invalidate and store" (Kefeng Wang):

   Simplify zswap's invalidate and store paths to avoid avoidable
   lookups and work. Keep the entry lifetime rules intact while making
   those frequent operations cheaper.

 - "mm: replace custom ratelimiting logic" (Pedro Falcato):

   Replace hand-rolled MM rate limiting with the common kernel helpers.
   There is no need to maintain another local version of the same
   mechanism.

 - "mm/vmalloc: minor cleanups" (Ye Liu):

   Tidy some vmalloc initialization and reporting code, and pull
   duplicated vmap-area insertion work into a helper. No functional
   changes are intended.

 - "mm/mglru: clean up isolate_folios for readability and clarity"
   (Ridong Chen):

   Clean up MGLRU's isolate_folios() so the decisions are easier to read
   and verify. Keep reclaim behavior unchanged while removing
   unnecessary twists in the control flow.

 - "Catch automatic storage in IDA and Maple Tree definitions" (Yury
   Norov):

   Catch IDA and maple-tree definitions placed in automatic storage
   where the lifetime rules are wrong or easy to get wrong. Add checks
   so such mistakes are harder to slip through unnoticed.

 - "mm, swap: some random fixes and cleanups" (Kemeng Shi):

   Fix and simplify a few unrelated swap paths, removing redundant work
   and tidying up error handling. A small collection of things which
   were better fixed than left lying around.

 - "mm/page_io: folio conversion cleanups" (Tal Zussman):

   Finish some page-to-folio conversions in swap I/O, removing obsolete
   wrappers and using folio operations consistently. The I/O behavior is
   intended to remain the same.

 - "mm/swap: skip empty clusters in the swapoff scan" (Youngjun Park):

   Skip empty swap clusters during swapoff instead of walking slots
   which have nothing to release. This avoids pointless work on sparsely
   used swap devices.

 - "mm: trace: decode architecture-specific VMA flags" (Meijing Zhao):

   Teach the VMA trace output to decode architecture-specific flags,
   rather than leaving them as unexplained bits. That should make
   tracing a good deal more useful when debugging unusual mappings.

 - "mm, swap: don't spin on a bad swap entry" (Breno Leitao):

   Stop repeatedly retrying a swap entry which is already known to be
   bad. Make the error path terminate cleanly instead of wasting CPU
   chasing an entry that cannot be used.

 - "mm/page_isolation: fix UBSAN shift-out-of-bounds in
   isolate_single_pageblock" (Qi Xi):

   Fix an out-of-range shift in isolate_single_pageblock() and tighten
   its associated boundary handling. UBSAN found the issue; the result
   should be more robust pageblock isolation.

 - "mm: khugepaged: fix tracepoint UAF" (Vernon Yang):

   Fix a use-after-free in khugepaged tracepoint handling. Make sure the
   information recorded by tracing stays valid for as long as the trace
   event needs it.

 - "mm/damon: fix DAMOS bugs in core, paddr and vaddr" (SJ Park):

   Fix several DAMOS problems across the core and physical- and
   virtual-address backends. The changes close error cases and bring the
   implementations back into agreement.

 - "mm/hugetlb_cgroup: move the per-node usage along with the folio"
   (Hongfu Li):

   Move HugeTLB per-node usage accounting when folios migrate between
   nodes or are reparented to another cgroup. Otherwise numa_stat can
   retain stale charges and even underflow when the folio is freed.

 - "docs/core-api: memory-allocation: add k[mz]alloc_obj() and clarify
   kmalloc" (Mike Rapoport):

   Document the typed k[mz]alloc_obj() allocation helpers and clear up
   some kmalloc guidance. Make it easier for callers to choose the right
   interface.

 - "selftests/mm: Validate selections and scope memfd_secret setup"
   (Tianyi Chen):

   Check selftest selections before running and confine memfd_secret
   setup to the cases that actually need it. Avoid confusing failures
   caused by the test harness itself.

 - "mm/damon: move zero damos quota target_value handling to the core
   layer" (SJ Park):

   Handle a zero DAMOS quota goal target in the core rather than making
   each user of the interface invent its own rule. Keep quota decisions
   consistent across callers.

 - "mm/damon: Introduce a huge page collapsing mechanism using auto
   tuning" (Asier Gutierrez):

   Add an auto-tuned DAMON mechanism for collapsing huge pages. Use
   monitoring feedback to decide when collapse is worthwhile rather than
   forcing one fixed policy onto every workload.

 - "kmemleak: fix stale documentation and raise the verbose default"
   (Breno Leitao):

   Bring the kmemleak documentation up to date and require a third
   confirming scan before verbose kernels print a suspected leak. The
   extra scan helps suppress transient false positives in noisy debug
   builds.

 - "mm/memory: improve insert_pages() error handling" (Avi Weiss):

   Tighten insert_pages() error handling so partial failures are
   reported and cleaned up consistently. The caller should not have to
   guess how far the operation got.

 - "mm/damon: allow NULL or unstarted damon_ctx parameter for
   damon_call()" (SJ Park):

   Make damon_call() handle NULL and not-yet-started contexts safely.
   Simplify the rules for callers and avoid an indefinite wait on an
   invalid state.

 - "mm/damon: introduce pgidle_set probe filter type" (SJ Park):

   Add a pgidle_set DAMON probe filter, giving monitoring users another
   way to select pages by their idle-tracking state. Wire it through the
   filter interfaces and tests.

 - "mm/damon/core: remove unused helper functions" (Cheng-Han Wu):

   Remove DAMON core helpers which no longer have callers. Keep the API
   surface smaller rather than retaining dead code just in case.

 - "mm: stop calling pmd_folio() on special PMDs" (Gregory Price):

   Avoid calling pmd_folio() on special PMD mappings that have no struct
   page. The old assumption could fault in procfs walkers; use the
   normal-folio checks and handle those mappings properly.

 - "mm: remove three unused helpers from mm.h" (Tal Zussman):

   Remove three unused helpers from mm.h. Fewer obsolete interfaces for
   the next person to stumble over.

 - "mm/damon: improvements in efficiency, error handling, documents"
   (Liew Rui Yan):

   Skip needless DAMOS quota work once the quota is full, propagate a
   missing sysfs error and tidy a couple of comments. The ignored error
   could make a monitoring-start request appear successful when it
   wasn't.

 - "docs/mm/damon/design: add explanation of nr_snapshots" (Liew Rui
   Yan):

   Explain DAMON's nr_snapshots accounting in the design documentation
   and straighten out the associated terminology. Make it clearer what
   users should expect from that counter.

 - "selftests/cgroup: fixes for test_zswap on single core VM" (Wilson
   Felipe Pereira):

   Fix two test_zswap failures on single-CPU VMs. Wait for the exiting
   child's cgroup to become unpopulated before reconfiguring it, and
   avoid another test assumption which breaks under constrained
   scheduling.

 - "docs/ksm: fix advisor documentation and comment" (Jinjiang Tu):

   Correct the KSM advisor documentation and a misleading code comment.
   Keep the description aligned with how the advisor actually works.

 - "Fix bugs in HugeTLB allocation when mem_cgroup_charge_hugetlb()
   fails" (Ackerley Tng):

   Fix HugeTLB allocation cleanup when the memcg charge fails. Make sure
   failure exits undo what was allocated rather than leaving stale
   accounting or resources behind.

 - "mm, memcg: fix memory.peak reset clobbering other fds' watermark"
   (Ridong Chen):

   Fix memory.peak reset handling so resetting one file descriptor
   doesn't overwrite the watermark kept for another. Keep those per-open
   measurements independent as intended.

 - "mm: reject zone device folios in more folio walkers" (Gregory
   Price):

   Reject zone-device folios in page walkers that cannot safely handle
   them. Extend the existing checks rather than assuming every folio has
   ordinary system-memory backing.

 - "percpu: remove code with no effect" (Sang-Heon Jeon):

   Remove a few pieces of percpu code which no longer do anything. There
   is no reason to keep maintaining dead paths.

* tag 'mm-stable-2026-10-19-21-33' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (539 commits)
  mm: shmem: assign a lock class to the unused huge shrinklist
  mm: vmscan: put rotation-missed folios at the LRU tail
  mm: kmemleak: scan the struct page array in MAX_SCAN_SIZE batches
  mm: kmemleak: move the struct page scan into a helper
  mm/damon: document that a zero sample_interval is accepted
  mm/damon: fix typos in comments
  mm/damon/sysfs: propagate damon_call() error in turn_damon_on
  mm/damon/core: skip quota score setup when the quota is full
  mm/damon/tests/core-kunit: test the size charged for a filter-trimmed region
  mm/damon/core: charge only the part of a region the filter left
  mm: disallow raw PFN mappings of huge/shared zeropage
  selftests/mm: zap whole PTE tables in the khugepaged race harness
  selftests/mm: add memory-pressure threads to the khugepaged race harness
  selftests/mm: race the collapse of windows with holes
  selftests/mm: add khugepaged race harness
  selftests/mm: check that one khugepaged pass collapses one window
  selftests/mm: run every supported collapse order by default
  selftests/mm: cover a shared-source collapse write race
  selftests/mm: parameterize the mixed-source collapse case by source order
  selftests/mm: add order-parameterized khugepaged collapse cases
  ...
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Pull MM updates from Andrew Morton:

 - "selftests/mm: improve khugepaged coverage" (Kiryl Shutsemau):

   Give khugepaged a proper workout. Extend the tests to all supported
   mTHP orders, check exactly which windows collapsed, and make scan
   completion deterministic. Race collapse against faults, pinning, fork
   and remap; verify that the contents survive.

   Add coverage for whole-page-table zaps and memory pressure too.

 - "selftests/mm: separate GUP microbenchmarking from functional testing"
   (Sarthak Sharma):

   Untangle GUP benchmarking from correctness testing. Move the
   benchmark into tools/mm, add a standalone harness-based GUP selftest,
   and move shared helpers into tools/lib/mm. Give each tool one job
   instead of mixing timing measurements with correctness checks.

   Cover the mapping, pinning and batch-size combinations explicitly.

 - "mm: Switch device DAX to section-based vmemmap optimization" (Muchun
   Song):

   Apply section-based vmemmap optimization to device DAX. Rework the
   backing metadata layout to save memory while preserving the handling
   of device memory hotplug and its different alignment and lifetime
   requirements.

 - "mm: Introduce section-based vmemmap optimization for HugeTLB"
   (Muchun Song):

   Cut the memory consumed by HugeTLB's struct page array with
   section-based vmemmap optimization. Arrange the metadata so large
   huge pages need fewer backing pages, while keeping initialization,
   teardown and the various hugepage configurations straight.

 - "mm/huge_memory: clean up and decouple the anon and file split
   helpers" (Kairui Song):

   Separate anonymous and file-backed folio splitting, which have rather
   different locking and bookkeeping requirements. Move the work into
   separate helpers, drop dead checks and tidy swap-cache handling. Fix
   error paths, including one that could leave a folio frozen.

   Keep the swap cache cases separate from file-cache splitting.

 - "mm: Unconditional per-VMA locks and cleanups" (Dave Hansen):

   Make per-VMA locking unconditional and clean up the old conditional
   code around it. This removes configuration-dependent plumbing and
   lets callers depend on one locking model rather than carrying both
   cases along.

 - "memcg: remove the v1 soft limit" (Shakeel Butt):

   Remove the old cgroup v1 memory soft-limit machinery. This has long
   since been superseded by the newer memory-control interfaces; hauling
   around a separate reclaim scheme for it no longer buys us much.

 - "read proc/pid/smaps_rollup under per-vma lock" (Suren Baghdasaryan):

   Read /proc/PID/smaps_rollup using per-VMA locks where possible,
   rather than holding mmap_lock across the entire walk. Retain the
   contention fallback and add tearing tests. This considerably reduces
   latency when another thread is busy changing its mappings.

 - "mm/damon: introduce data access-as-a-data attribute" (SJ Park):

   Teach DAMON to expose memory access observations as data attributes,
   making them available to the probe and filtering machinery. Extend
   the interfaces, documentation and tests so the new information can be
   used rather than merely collected.

 - "Remove PG_private by using page/folio-&gt;private checks instead" (Zi
   Yan):

   Get rid of PG_private and use the folio's private pointer to say
   whether private data is attached. Convert the filesystem users,
   including erofs, f2fs and md, and clean up the old accessors and
   flags. There are a few special cases, notably swapcache and hugetlb,
   which need explicit care.

 - "mm: make userland page table freeing RCU-safe" (Lorenzo Stoakes):

   Make freeing userspace page tables safe against RCU readers. Sort out
   the page-table lifetime and locking rules so walkers cannot stumble
   over freed tables while mappings are being torn down.

 - "make unused huge shrinker memcg aware" (Qi Zheng):

   Make shmem's unused-huge-folio shrinker aware of memory cgroups, so
   reclaim can find those folios under the right memcg. Wire up the
   per-memcg tracking and its lifetime rules, and give the shrinklist
   its own lockdep class to avoid spurious dependency reports.

 - "mm: Drop pxd_ERROR()" (Anshuman Khandual):

   Remove the old pxd_ERROR() page-table checks and their
   architecture-specific baggage. Simplify the common page-table
   interfaces and callers now that these checks no longer serve a
   useful purpose.

 - "memcg: group struct fields by access pattern" (Shakeel Butt):

   Rearrange memcg's hot and cold fields according to how they're
   actually accessed. Keep frequently updated counters and their
   neighboring state from fighting over cachelines and reduce needless
   cacheline traffic.

 - "mm/damon/core: fix the size charged for a filter-trimmed region"
   (Donggeun Yoo):

   Fix DAMOS quota accounting when a filter trims a monitoring region.
   Charge only the part left after filtering, not the original region,
   and add KUnit coverage. Previously the excluded memory could eat into
   the quota and make schemes run more slowly than requested.

 - "mm/damon: add kunit and selftests for probes and probe weights" (SJ
   Park):

   Add more tests for DAMON probes and their weights, including
   validation and the results reported to userspace. This is mostly
   about catching regressions in the newer probe infrastructure before
   they become harder to diagnose.

 - "mm: memcontrol: constify the read side of the read side of the memcg
   API" (Tal Zussman):

   Mark the read-only parts of the memcg interface const, from folio and
   lruvec accessors to counters and swap helpers. Most of this is
   mechanical, but it makes the contracts clearer and lets the compiler
   catch accidental writes.

 - "mm/damon/vaddr: support {prep,apply}_probes" (SJ Park):

   Support the new prepare/apply probe operations in DAMON's
   virtual-address backend. This brings vaddr monitoring into line with
   the probe infrastructure and makes the added probe types useful there
   too.

 - "mm/mglru: clean up folio counters and flag usage" (Kairui Song):

   Simplify MGLRU's folio counters and flag handling. Remove redundant
   accounting paths and make the state transitions easier to follow
   without changing the intended reclaim policy.

 - "arch, mm/execmem: resolve confusion about set_direct_map_valid_noflush()"
   (Mike Rapoport (Microsoft)):

   Clarify and straighten out the set_direct_map_valid_noflush()
   interface across architectures and execmem. Make the requested
   mapping changes and the callers' expectations agree, rather than
   relying on subtly different architecture behavior.

 - "mm: zswap: free cold writeback folios promptly" (Alexandre Ghiti):

   Free zswap writeback folios as soon as their disk write completes.
   They are cold temporary buffers, so putting them on the LRU only
   makes reclaim rediscover them later. Extend swap-cache dropbehind and
   let zswap keep these folios off the LRU altogether.

 - "mm: gup: cleanup gup_fast call chain" (Aristeu Rozanski):

   Clean up the GUP-fast call chain and simplify how the fast-path
   helpers pass their arguments and results around. Keep the page-pin
   behavior the same while making the call sequence easier to maintain.

 - "mm: optimize zone-device memmap initialization" (Li Zhe):

   Speed up initialization of zone-device struct pages. Avoid redundant
   work when setting up large device-memory ranges, where touching every
   descriptor can get expensive.

 - "mm/zswap: shrink zswap_entry via a pool id" (Jianyue Wu):

   Reduce the size of zswap_entry by storing a compact pool identifier
   instead of a full pointer. Keep the pool lookup and lifetime handling
   correct while saving per-entry metadata.

 - "mm/damon: support access monitoring of hugetlb-backed memory"
   (Krishna Iyer):

   Let DAMON monitor hugetlb-backed memory too. Extend the relevant
   access checks and add coverage so those mappings no longer fall
   through a hole in the monitoring machinery.

 - "mm/execmem: fixes and cleanups for the ROX cache" (Mike Rapoport):

   Tidy execmem's read-only-executable cache and fix its handling of the
   awkward allocation and release cases. The aim is to make the cache's
   ownership and permission transitions more predictable.

 - "zsmallc: remove old object read API" (Sergey Senozhatsky):

   Drop zsmalloc's old object-read API and move its remaining users to
   the supported access mechanism. This removes a duplicate interface
   which we no longer need.

 - "mm/mempolicy: stop copying state in the interleave paths" (Gregory
   Price):

   Stop copying mempolicy state in the interleave paths when a reference
   to the existing policy will do. This avoids extra work and makes the
   ownership rules less obscure.

 - "mm/mglru: speed up inc_min_seq() and fix cold/hot inversions" (Barry
   Song):

   Make MGLRU's generation advancement cheaper and fix cases where cold
   and hot folios end up in the wrong order. Adjust the counter and list
   handling so reclaim doesn't keep passing over the better eviction
   candidates.

 - "mm: Fix MF_DELAYED handling on memory failure" (Lisa Wang):

   Treat MF_DELAYED as a partially completed memory-failure operation,
   not an outright failure. Propagate that result correctly through
   shmem and the generic handler, fix the extra-reference accounting,
   and add tests for the resulting SIGBUS behavior.

 - "tools/mm/page_owner_sort: fix --sort, add module filter, improve
   usage" (Ye Liu):

   Fix page_owner_sort's --sort handling, add module-based filtering and
   make the usage output more helpful. This makes the tool less
   frustrating when tracking down who is holding on to pages.

 - "mm/damon: move damos filter range arguments validation to core" (SJ
   Park):

   Move DAMOS filter range validation into the core, where all callers
   can share it. Also close the sysfs read-twice races which could pass
   inconsistent ranges, and add tests for invalid input.

 - "mm/damon: misc cleanups" (Zenghui Yu):

   Clean up a collection of small DAMON rough edges in the core,
   interfaces and tests. No large behavior change here, just simpler
   code and fewer opportunities for confusion.

 - "mm/damon: cleanup code, add test cases, and update guidances in
   docs" (SJ Park):

   Clean up DAMON's core and interfaces, add missing test cases and
   bring the documentation into line with the code. These changes should
   make the newer facilities easier to understand and maintain.

 - "mm/damon: introduce hugepage_size probe filter" (SJ Park):

   Add a DAMON probe filter for hugepage size. Let users select a range
   of folio sizes through sysfs, validate the range and document the new
   interface, so monitoring can concentrate on memory backed by the
   desired hugepage sizes.

 - "selftests/mm: pagemap_ioctl test fixes and cleanups" (Zenghui Yu):

   Fix some pagemap ioctl test assumptions and clean up their setup and
   reporting. Make failures point to the operation that went wrong
   rather than to test harness bookkeeping.

 - "mm: avoid large folio splits when swap is unavailable" (Johannes
   Weiner):

   Avoid splitting large folios merely to attempt swap when no swap
   space is available. There is little point paying for an expensive
   split when reclaim cannot actually swap the resulting pages out.

 - "mm: workingset: fix the shadow node budget under MGLRU" (Hui Zhu):

   Fix the workingset shadow-node budget with MGLRU enabled. Keep the
   shadow entries within the intended limits so refault tracking does
   not quietly consume more metadata than it should.

 - "selftests/mm: TAP output and global-state fixes" (Song Hu):

   Fix selftests which produce misleading TAP output or fail to restore
   global settings after a run. A test ought to leave the system as it
   found it, particularly when a whole suite follows behind.

 - "mm: remove page_swap_entry()" (Tal Zussman):

   Remove page_swap_entry() and convert its remaining users to the folio
   and swap-entry helpers. Lose an old page-level interface and make the
   swap paths a little more consistent.

 - "mm: refactor zonelist constructors and iterators" (Gregory Price):

   Refactor the zonelist construction and walk helpers to reduce
   duplicated logic. Keep the allocation ordering rules intact while
   making it clearer how zones are selected.

 - "mm: kmemleak: batch the struct page scan" (Breno Leitao):

   Scan adjacent struct pages in batches instead of taking kmemleak_lock
   once for every single page. This preserves scan coverage and the
   lock-hold bound, while cutting overhead substantially on debug
   kernels.

 - "mm/damon: misc improvements in tests and documents" (Zenghui Yu):

   Fix some DAMON selftests which leave kdamond running or fail under
   Python safe-path mode, and improve the KUnit coverage and
   documentation. Nothing especially glamorous, but these are worth
   doing.

 - "mm/damon: introduce probe_hits_wsum DAMOS core filter" (SJ Park):

   Add a DAMOS core filter using weighted probe-hit counts. This gives
   schemes another way to select regions based on what the monitoring
   probes observed.

 - "mm/mglru: fix ineffective memory protection for non-kswapd reclaim"
   (Ridong Chen):

   Fix MGLRU's memory protection handling for reclaim outside kswapd.
   The protection settings weren't having the intended effect in these
   paths, leaving protected memory more exposed than requested.

 - "mm/damon: improve readability, clarity and test coverage" (SJ Park):

   Simplify a handful of DAMON core helpers, clarify their behavior and
   expand test coverage. There are no intended userspace-visible changes
   in this batch.

 - "mm: replace PF_KCOMPACTD/PF_KSWAPD with kthread_func()" (Kefeng
   Wang):

   Stop identifying reclaim and compaction workers through the PF_KSWAPD
   and PF_KCOMPACTD task flags. Use their kthread functions instead and
   remove the redundant flag plumbing.

 - "mm/hugetlb: fix surplus accounting and availability checks during
   demotion" (Longlong Xia):

   Fix HugeTLB surplus accounting and availability checks when demoting
   huge pages. Keep the counters and reservation decisions consistent as
   one huge page turns into several smaller ones.

 - "mm/damon: add kunit tests for probe_hits handling and probe params
   validation" (Jason Angelov):

   Add KUnit tests for DAMON probe-hit handling and invalid probe
   parameters. These cover edge cases that were too easy to miss in
   ordinary monitoring tests.

 - "mm/damon: fix misc bugs in kunit, quota goals and sysfs refresh_ms"
   (SJ Park):

   Fix a few DAMON bugs in KUnit tests, quota-goal handling and the
   sysfs refresh interval. Small fixes, but the incorrect results and
   control behavior were real.

 - "mm: zswap: optimize zswap invalidate and store" (Kefeng Wang):

   Simplify zswap's invalidate and store paths to avoid avoidable
   lookups and work. Keep the entry lifetime rules intact while making
   those frequent operations cheaper.

 - "mm: replace custom ratelimiting logic" (Pedro Falcato):

   Replace hand-rolled MM rate limiting with the common kernel helpers.
   There is no need to maintain another local version of the same
   mechanism.

 - "mm/vmalloc: minor cleanups" (Ye Liu):

   Tidy some vmalloc initialization and reporting code, and pull
   duplicated vmap-area insertion work into a helper. No functional
   changes are intended.

 - "mm/mglru: clean up isolate_folios for readability and clarity"
   (Ridong Chen):

   Clean up MGLRU's isolate_folios() so the decisions are easier to read
   and verify. Keep reclaim behavior unchanged while removing
   unnecessary twists in the control flow.

 - "Catch automatic storage in IDA and Maple Tree definitions" (Yury
   Norov):

   Catch IDA and maple-tree definitions placed in automatic storage
   where the lifetime rules are wrong or easy to get wrong. Add checks
   so such mistakes are harder to slip through unnoticed.

 - "mm, swap: some random fixes and cleanups" (Kemeng Shi):

   Fix and simplify a few unrelated swap paths, removing redundant work
   and tidying up error handling. A small collection of things which
   were better fixed than left lying around.

 - "mm/page_io: folio conversion cleanups" (Tal Zussman):

   Finish some page-to-folio conversions in swap I/O, removing obsolete
   wrappers and using folio operations consistently. The I/O behavior is
   intended to remain the same.

 - "mm/swap: skip empty clusters in the swapoff scan" (Youngjun Park):

   Skip empty swap clusters during swapoff instead of walking slots
   which have nothing to release. This avoids pointless work on sparsely
   used swap devices.

 - "mm: trace: decode architecture-specific VMA flags" (Meijing Zhao):

   Teach the VMA trace output to decode architecture-specific flags,
   rather than leaving them as unexplained bits. That should make
   tracing a good deal more useful when debugging unusual mappings.

 - "mm, swap: don't spin on a bad swap entry" (Breno Leitao):

   Stop repeatedly retrying a swap entry which is already known to be
   bad. Make the error path terminate cleanly instead of wasting CPU
   chasing an entry that cannot be used.

 - "mm/page_isolation: fix UBSAN shift-out-of-bounds in
   isolate_single_pageblock" (Qi Xi):

   Fix an out-of-range shift in isolate_single_pageblock() and tighten
   its associated boundary handling. UBSAN found the issue; the result
   should be more robust pageblock isolation.

 - "mm: khugepaged: fix tracepoint UAF" (Vernon Yang):

   Fix a use-after-free in khugepaged tracepoint handling. Make sure the
   information recorded by tracing stays valid for as long as the trace
   event needs it.

 - "mm/damon: fix DAMOS bugs in core, paddr and vaddr" (SJ Park):

   Fix several DAMOS problems across the core and physical- and
   virtual-address backends. The changes close error cases and bring the
   implementations back into agreement.

 - "mm/hugetlb_cgroup: move the per-node usage along with the folio"
   (Hongfu Li):

   Move HugeTLB per-node usage accounting when folios migrate between
   nodes or are reparented to another cgroup. Otherwise numa_stat can
   retain stale charges and even underflow when the folio is freed.

 - "docs/core-api: memory-allocation: add k[mz]alloc_obj() and clarify
   kmalloc" (Mike Rapoport):

   Document the typed k[mz]alloc_obj() allocation helpers and clear up
   some kmalloc guidance. Make it easier for callers to choose the right
   interface.

 - "selftests/mm: Validate selections and scope memfd_secret setup"
   (Tianyi Chen):

   Check selftest selections before running and confine memfd_secret
   setup to the cases that actually need it. Avoid confusing failures
   caused by the test harness itself.

 - "mm/damon: move zero damos quota target_value handling to the core
   layer" (SJ Park):

   Handle a zero DAMOS quota goal target in the core rather than making
   each user of the interface invent its own rule. Keep quota decisions
   consistent across callers.

 - "mm/damon: Introduce a huge page collapsing mechanism using auto
   tuning" (Asier Gutierrez):

   Add an auto-tuned DAMON mechanism for collapsing huge pages. Use
   monitoring feedback to decide when collapse is worthwhile rather than
   forcing one fixed policy onto every workload.

 - "kmemleak: fix stale documentation and raise the verbose default"
   (Breno Leitao):

   Bring the kmemleak documentation up to date and require a third
   confirming scan before verbose kernels print a suspected leak. The
   extra scan helps suppress transient false positives in noisy debug
   builds.

 - "mm/memory: improve insert_pages() error handling" (Avi Weiss):

   Tighten insert_pages() error handling so partial failures are
   reported and cleaned up consistently. The caller should not have to
   guess how far the operation got.

 - "mm/damon: allow NULL or unstarted damon_ctx parameter for
   damon_call()" (SJ Park):

   Make damon_call() handle NULL and not-yet-started contexts safely.
   Simplify the rules for callers and avoid an indefinite wait on an
   invalid state.

 - "mm/damon: introduce pgidle_set probe filter type" (SJ Park):

   Add a pgidle_set DAMON probe filter, giving monitoring users another
   way to select pages by their idle-tracking state. Wire it through the
   filter interfaces and tests.

 - "mm/damon/core: remove unused helper functions" (Cheng-Han Wu):

   Remove DAMON core helpers which no longer have callers. Keep the API
   surface smaller rather than retaining dead code just in case.

 - "mm: stop calling pmd_folio() on special PMDs" (Gregory Price):

   Avoid calling pmd_folio() on special PMD mappings that have no struct
   page. The old assumption could fault in procfs walkers; use the
   normal-folio checks and handle those mappings properly.

 - "mm: remove three unused helpers from mm.h" (Tal Zussman):

   Remove three unused helpers from mm.h. Fewer obsolete interfaces for
   the next person to stumble over.

 - "mm/damon: improvements in efficiency, error handling, documents"
   (Liew Rui Yan):

   Skip needless DAMOS quota work once the quota is full, propagate a
   missing sysfs error and tidy a couple of comments. The ignored error
   could make a monitoring-start request appear successful when it
   wasn't.

 - "docs/mm/damon/design: add explanation of nr_snapshots" (Liew Rui
   Yan):

   Explain DAMON's nr_snapshots accounting in the design documentation
   and straighten out the associated terminology. Make it clearer what
   users should expect from that counter.

 - "selftests/cgroup: fixes for test_zswap on single core VM" (Wilson
   Felipe Pereira):

   Fix two test_zswap failures on single-CPU VMs. Wait for the exiting
   child's cgroup to become unpopulated before reconfiguring it, and
   avoid another test assumption which breaks under constrained
   scheduling.

 - "docs/ksm: fix advisor documentation and comment" (Jinjiang Tu):

   Correct the KSM advisor documentation and a misleading code comment.
   Keep the description aligned with how the advisor actually works.

 - "Fix bugs in HugeTLB allocation when mem_cgroup_charge_hugetlb()
   fails" (Ackerley Tng):

   Fix HugeTLB allocation cleanup when the memcg charge fails. Make sure
   failure exits undo what was allocated rather than leaving stale
   accounting or resources behind.

 - "mm, memcg: fix memory.peak reset clobbering other fds' watermark"
   (Ridong Chen):

   Fix memory.peak reset handling so resetting one file descriptor
   doesn't overwrite the watermark kept for another. Keep those per-open
   measurements independent as intended.

 - "mm: reject zone device folios in more folio walkers" (Gregory
   Price):

   Reject zone-device folios in page walkers that cannot safely handle
   them. Extend the existing checks rather than assuming every folio has
   ordinary system-memory backing.

 - "percpu: remove code with no effect" (Sang-Heon Jeon):

   Remove a few pieces of percpu code which no longer do anything. There
   is no reason to keep maintaining dead paths.

* tag 'mm-stable-2026-10-19-21-33' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (539 commits)
  mm: shmem: assign a lock class to the unused huge shrinklist
  mm: vmscan: put rotation-missed folios at the LRU tail
  mm: kmemleak: scan the struct page array in MAX_SCAN_SIZE batches
  mm: kmemleak: move the struct page scan into a helper
  mm/damon: document that a zero sample_interval is accepted
  mm/damon: fix typos in comments
  mm/damon/sysfs: propagate damon_call() error in turn_damon_on
  mm/damon/core: skip quota score setup when the quota is full
  mm/damon/tests/core-kunit: test the size charged for a filter-trimmed region
  mm/damon/core: charge only the part of a region the filter left
  mm: disallow raw PFN mappings of huge/shared zeropage
  selftests/mm: zap whole PTE tables in the khugepaged race harness
  selftests/mm: add memory-pressure threads to the khugepaged race harness
  selftests/mm: race the collapse of windows with holes
  selftests/mm: add khugepaged race harness
  selftests/mm: check that one khugepaged pass collapses one window
  selftests/mm: run every supported collapse order by default
  selftests/mm: cover a shared-source collapse write race
  selftests/mm: parameterize the mixed-source collapse case by source order
  selftests/mm: add order-parameterized khugepaged collapse cases
  ...
</pre>
</div>
</content>
</entry>
<entry>
<title>block: always adjust bi_offset on bio_advance_iter</title>
<updated>2026-10-14T13:36:02+00:00</updated>
<author>
<name>Pavel Begunkov</name>
<email>asml.silence@gmail.com</email>
</author>
<published>2026-10-14T11:02:01+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=801503b9a66f7c2423b5e495d8e77e0f4447e5d4'/>
<id>801503b9a66f7c2423b5e495d8e77e0f4447e5d4</id>
<content type='text'>
Extend bio_no_advance_iter() iteration to also increment the offset.
It's not currently needed because the currently listed request types
don't have a buffer, but will be useful once we add bios backed by
dma-buf, which don't have a bvec but work with a single range.

Suggested-by: Christoph Hellwig &lt;hch@lst.de&gt;
Reviewed-by: Christoph Hellwig &lt;hch@lst.de&gt;
Signed-off-by: Pavel Begunkov &lt;asml.silence@gmail.com&gt;
Link: https://patch.msgid.link/8e5a67c2f84b6df99ff57a7b3bf7b289999e0468.1791975048.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe &lt;axboe@kernel.dk&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Extend bio_no_advance_iter() iteration to also increment the offset.
It's not currently needed because the currently listed request types
don't have a buffer, but will be useful once we add bios backed by
dma-buf, which don't have a bvec but work with a single range.

Suggested-by: Christoph Hellwig &lt;hch@lst.de&gt;
Reviewed-by: Christoph Hellwig &lt;hch@lst.de&gt;
Signed-off-by: Pavel Begunkov &lt;asml.silence@gmail.com&gt;
Link: https://patch.msgid.link/8e5a67c2f84b6df99ff57a7b3bf7b289999e0468.1791975048.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe &lt;axboe@kernel.dk&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>dm-verity: clear LSM integrity state on suspend</title>
<updated>2026-10-13T15:31:14+00:00</updated>
<author>
<name>Fan Wu</name>
<email>wufan@kernel.org</email>
</author>
<published>2026-09-21T22:05:16+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=334714e4bdf8868c17a7650a7502ba1c90a8721f'/>
<id>334714e4bdf8868c17a7650a7502ba1c90a8721f</id>
<content type='text'>
dm-verity publishes its root hash and signature state to LSMs in
verity_preresume(). LSMs such as IPE store this information in the block
device's security blob and use it to authorize access to files.

The original LSM integration relied on DM_TARGET_IMMUTABLE to prevent
verity from being replaced by a different target type. However, DM allows
tables containing a DM_TARGET_WILDCARD target to replace immutable
targets. The block device can then retain the old integrity state even
though its data is no longer verified by dm-verity.

Clear the published root hash and signature state in verity_postsuspend()
so that the block device does not retain stale dm-verity attributes after
the verity target is replaced.

Assisted-by: gpt-6-astra
Signed-off-by: Fan Wu &lt;wufan@kernel.org&gt;
Signed-off-by: Mikulas Patocka &lt;mpatocka@redhat.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
dm-verity publishes its root hash and signature state to LSMs in
verity_preresume(). LSMs such as IPE store this information in the block
device's security blob and use it to authorize access to files.

The original LSM integration relied on DM_TARGET_IMMUTABLE to prevent
verity from being replaced by a different target type. However, DM allows
tables containing a DM_TARGET_WILDCARD target to replace immutable
targets. The block device can then retain the old integrity state even
though its data is no longer verified by dm-verity.

Clear the published root hash and signature state in verity_postsuspend()
so that the block device does not retain stale dm-verity attributes after
the verity target is replaced.

Assisted-by: gpt-6-astra
Signed-off-by: Fan Wu &lt;wufan@kernel.org&gt;
Signed-off-by: Mikulas Patocka &lt;mpatocka@redhat.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>dm-bufio: clean-up cache size reading</title>
<updated>2026-10-13T13:35:52+00:00</updated>
<author>
<name>Mikulas Patocka</name>
<email>mpatocka@redhat.com</email>
</author>
<published>2026-10-12T15:56:06+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=17f7f7ef5dc2f4607ba8cdf486cb25cc564cd6f7'/>
<id>17f7f7ef5dc2f4607ba8cdf486cb25cc564cd6f7</id>
<content type='text'>
In the original dm-bufio, setting dm_bufio_cache_size to 0 meant to set
the default value. However, when the code was refactored in the commit
450e8dee51aa, the meaning of 0 is inconsistent, at some places, we just
read the variable dm_bufio_cache_size without testing it to zero.

This commit cleans up the zero handling, all reads of dm_bufio_cache_size
go through the function dm_budio_get_cache_size() and this function tests
the variable for zero and sets the default cache size in this case.

Signed-off-by: Mikulas Patocka &lt;mpatocka@redhat.com&gt;
Assisted-by: Claude:claude-opus-5
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
In the original dm-bufio, setting dm_bufio_cache_size to 0 meant to set
the default value. However, when the code was refactored in the commit
450e8dee51aa, the meaning of 0 is inconsistent, at some places, we just
read the variable dm_bufio_cache_size without testing it to zero.

This commit cleans up the zero handling, all reads of dm_bufio_cache_size
go through the function dm_budio_get_cache_size() and this function tests
the variable for zero and sets the default cache size in this case.

Signed-off-by: Mikulas Patocka &lt;mpatocka@redhat.com&gt;
Assisted-by: Claude:claude-opus-5
</pre>
</div>
</content>
</entry>
<entry>
<title>dm-bufio: fix a race leading to an unsigned integer underflow</title>
<updated>2026-10-13T13:35:43+00:00</updated>
<author>
<name>Mikulas Patocka</name>
<email>mpatocka@redhat.com</email>
</author>
<published>2026-10-12T14:09:52+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=005d2ec5723cd4ac740de678274623f1fadd6a6e'/>
<id>005d2ec5723cd4ac740de678274623f1fadd6a6e</id>
<content type='text'>
The function __scan tests "count - freed &lt;= retain_target" and then sets
"atomic_long_set(&amp;c-&gt;need_shrink, 0);" It exits with the condition "if
(!atomic_long_read(&amp;c-&gt;need_shrink)) break;" It may be possible that
between these two statements, another thread sets &amp;c-&gt;need_shrink to a
non-zero value. In this case, the function __scan continues and it may
possibly the "freed" variable is larger than the "count" variable. The
expression "count - freed" underflows and the function __scan will
continue to free all the buffers, even those that are below
retain_target.

Fix this bug by immediatelly exiting if we set
"atomic_long_set(&amp;c-&gt;need_shrink, 0)"; and don't attempt to re-read
c-&gt;need_shrink afterwards.

Fixes: 450e8dee51aa ("dm bufio: improve concurrent IO performance")
Cc: stable@vger.kernel.org
Signed-off-by: Mikulas Patocka &lt;mpatocka@redhat.com&gt;
Assisted-by: Claude:claude-opus-5
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The function __scan tests "count - freed &lt;= retain_target" and then sets
"atomic_long_set(&amp;c-&gt;need_shrink, 0);" It exits with the condition "if
(!atomic_long_read(&amp;c-&gt;need_shrink)) break;" It may be possible that
between these two statements, another thread sets &amp;c-&gt;need_shrink to a
non-zero value. In this case, the function __scan continues and it may
possibly the "freed" variable is larger than the "count" variable. The
expression "count - freed" underflows and the function __scan will
continue to free all the buffers, even those that are below
retain_target.

Fix this bug by immediatelly exiting if we set
"atomic_long_set(&amp;c-&gt;need_shrink, 0)"; and don't attempt to re-read
c-&gt;need_shrink afterwards.

Fixes: 450e8dee51aa ("dm bufio: improve concurrent IO performance")
Cc: stable@vger.kernel.org
Signed-off-by: Mikulas Patocka &lt;mpatocka@redhat.com&gt;
Assisted-by: Claude:claude-opus-5
</pre>
</div>
</content>
</entry>
</feed>
