linux-toradex.git/drivers/usb/gadget, branch master Linux kernel for Apalis and Colibri modules Merge tag 'mm-stable-2026-10-25-19-27' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm 2026-10-27T22:23:17+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-10-27T22:23:17+00:00 8a36f53fd5ec3eff01f1b637d42cbdc3821d0493 Pull more MM updates from Andrew Morton: - "mm: make VMA flag semantics explicit, eliminate VM_SPECIAL" (Lorenzo Stoakes): Replace VM_SPECIAL with helpers describing mapping ownership and behavior. Enforce the mmap flag rules and convert affected drivers, removing ambiguous tests shared by driver mappings and ordinary memory. - "support kselftest on nommu platform" (Hajime Tazaki): Add opt-in mmap and mremap tests for NOMMU systems. Teach the runner to avoid its fork-dependent timeout command and document the build and runtime requirements. - "mm/collapse: separate a collapse from its callers" (Kiryl Shutsemau): Separate huge-page collapse from caller policy. Replace khugepaged identity checks with explicit permissions, and separate scanning from collapse with the mmap_lock drop in one place. - "mm: implement and use vma_has_anon_rmap(), silence KCSAN" (Lorenzo Stoakes): Provide a common helper for testing whether a VMA has anonymous reverse mappings. Document the locking rules, annotate intentional concurrent reads for KCSAN, and convert the core MM callers. - "mm/sparse: remove SECTION_MARKED_PRESENT and further cleanups" (David Hildenbrand): Remove SECTION_MARKED_PRESENT in favor of the early-section flag. Simplify sparse memory initialization, section metadata handling and related PFN validity checks. - "sh: remove NUMA and SPARSEMEM support" (Mike Rapoport): Remove SuperH NUMA and SPARSEMEM support. The extra memory banks have been unusable since the NO_BOOTMEM conversion, leaving only the code and data overhead. - "mm: Unify device DAX and HugeTLB vmemmap population paths" (Muchun Song): Unify the generic device DAX and HugeTLB vmemmap population paths and shared tail-page handling. Remove the duplicate DAX machinery while retaining the powerpc radix implementation. - "kselftest: mm: fix some failure of split_huge_page_test" (Yeoreum Yun): Fix huge-page split tests racing with khugepaged recollapse. Use pagemap and page flags instead of VMA-boundary assumptions which fail when glibc has already enabled THP. - "memcg: move memcgid refcount to objcg to unpin dying memcgs" (Bingfang Guo): Let dying memcgs be freed while swapped-out shmem still holds their IDs. Move ID references to reparentable objcgs, with the necessary swap accounting and RCU lifetime changes. - "mm/truncate: fix data loss when truncating straddling large folios" (Zhang Yi): Preserve out-of-range data when truncating straddling large folios. Fix a lookup race and split-failure handling, and handle minimum folio orders for the forthcoming ext4 iomap buffered I/O path. - "mm/damon: introduce damos quota goal target metric complement flag" (SJ Park): Let DAMOS quota goals use a metric's complement, so utilization can also express free-memory goals without adding separate metrics. Add the sysfs interface, documentation and tests. - "arm64/mm: Standardize printing for pgtable entries" (Anshuman Khandual): Use the generic formatter for arm64 page-table entries, ready for future wider entries. Move the safe-PTE-update check out of the header to avoid an include cycle. - "mm: kmsan: fix iounmap metadata teardown" (Dima Koziuk): Fix KMSAN metadata leaks on iounmap and failed ioremap allocations. Free backing pages before removing their mappings, and share the teardown with partial-allocation cleanup. - "mm/damon/core: preserve quota state when constructing schemes" (Karl Mehltretter): Preserve running DAMOS quota state while validating parameter updates. Even rejected updates could reset accounting and exceed the quota window; add tests for both accepted and rejected updates. - "mm/vmalloc: fix vmalloc_dump_obj VA lookup" (Ye Liu): Fix vmalloc_dump_obj() lookups for last-page addresses and allocations spanning vmap zones. These allocations were being missed in diagnostic output. - "mm: various (urgent?) fixes" (David Hildenbrand): Fix mmap charge leaks and hugetlb use-after-free, wrong-address unmapping, stuck locks and endless faults. Also preserve reservations on failed mremap and handle stale userfaultfd bits. - "maple_tree: fix maple_range_64 crashes in RCU mode" (Dimitris Charisis): Fix pointer and metadata confusion during RCU destruction of maple_range_64 nodes, avoiding double frees and invalid accesses. Add a regression test; no in-tree user currently uses this combination. - "mm: fix hugetlb NR_HUGETLB accounting on folio migration" (Hongfu Li): Fix hugetlb migration and preallocation accounting so /proc/vmstat retains the correct count and memory.numa_stat follows the folio to its new node. - "mm/damon: fix a minor bug, clean code, and add a test" (SJ Park): Fix 32-bit DAMON age overflow which made old regions look young. Share hugetlb folio acquisition code and add a regression test for the previously fixed last-region skipping bug. - "mm/damon/core: cleanup code, reduce stack usage, and add kunit" (SJ Park): Reduce kdamond stack usage and remove unused enums. Add deterministic PSI quota-goal tests which do not depend on the machine's current memory pressure. - "mm/damon: fix the temporal goal tuner's size quota conversion" (Donggeun Yoo): Bound the temporal tuner's quota conversion to prevent overflow and zero effective quotas, which could stop schemes making progress. Add boundary tests. - "Don't use GFP_DMA when calling dma_alloc_coherent" (Baoquan He): Remove redundant GFP_DMA flags from coherent DMA allocation calls. The DMA API already selects the zone from device limits and ignores the caller's flag. - "kselftest: mm: fix intermittent failure khugepaged test" (Yeoreum Yun): Propagate child-process failures in the khugepaged tests and prevent background collapse from racing their checks. This removes false passes and intermittent failures. - "MAINTAINERS: cover all hugetlb headers under HUGETLB SUBSYSTEM" (Enze Li): Cover all hugetlb headers in MAINTAINERS so get_maintainer.pl finds the right maintainers. Also label the closing hugetlb_cgroup.h include guard. Summary of the 65 singletons in this merge: The singletons include a few worthwhile performance fixes. Avoiding unnecessary reverse-map tree updates gave a reported 15.9% improvement in UnixBench's execl test on a 192-core x86 system. A reclaim retry fix stops defrag_mode from spinning under memory.low protection; a reported file-creation stress test ran 5.7 times faster, with far less memory pressure. Narrower hugetlb invalidations also spare KVM guests needless refaults: the reported Redis-in-VM P99 QPS penalty while punching holes fell from 7.09% to 1.45%. Several fixes prevent lost data or corrupted memory. Lazyfree huge-page races with mremap()/munmap() could lose data or access freed memory, and MADV_COLD could lose a concurrent write's dirty bit. Another fix prevents stale migration entries from outliving large folios. On filesystems with blocks smaller than a page, extending a file by 4 GiB or more could expose bytes written past the old EOF through mmap instead of zeroes. That is fixed, along with use-after-free races in PAGEMAP_SCAN during process exit and in memory-cgroup accounting on PREEMPT_RT kernels. Other fixes stop UFFDIO_MOVE spinning forever on pinned large folios, which could wedge other memory operations, and stop mremap() leaking commit charges until allocations fail under strict overcommit. A further fix keeps userfaultfd tracking intact on neighboring mappings. NUMA binding no longer prevents long-term pins when the chosen node has only movable memory, fixing QEMU/VFIO startup and io_uring buffer registration failures. MGLRU also gets a fix for early-boot crashes with memory cgroups disabled at boot, notably in small crash kernels. * tag 'mm-stable-2026-10-25-19-27' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (213 commits) mm: multi-gen LRU: fix NULL lruvec->pgdat deref with memcg disabled on cmdline mm/page_counter: use WRITE_ONCE() for emin/elow when parent is the root mm/memcontrol: publish null pointer before dropping css reference test_maple_tree: test maple_range_64 node in RCU mode maple_tree: fix maple_range_64 crashes in RCU mode mm/vma: avoid broken uffd merge on mremap tools/testing/shared: catch a failed posix_memalign() mm/damon/core: remove unreachable damos charge_{target,addr}_from mm/shrinker: allocate shrinker_info_unit from a dedicated kmem_cache riscv: mm: exclude invalid THP PMDs from page table check mm/damon/core: filter out damos address filter-split failed region fs/proc/task_mmu: pin mm_users in do_pagemap_scan() mm/mempolicy: apply bind policies against the scoped allocation zone mm/vmscan: reclaim every zone in per-node proactive reclaim mm/mremap: correctly uncharge accountable VMAs in error path mm/mremap: populate calculated fields in vrm state correctly MAINTAINERS: add an entry for MEMORY MANAGEMENT - MEMORY MAP mm: bdi: reset min_ratio after the sysfs attributes are gone mm/page_vma_mapped: continue past nonmatching huge PMDs selftests/mm: skip hugetlb cgroup v2 tests without the needed controllers ... 
Pull more MM updates from Andrew Morton:

 - "mm: make VMA flag semantics explicit, eliminate VM_SPECIAL" (Lorenzo
   Stoakes):

   Replace VM_SPECIAL with helpers describing mapping ownership and
   behavior. Enforce the mmap flag rules and convert affected drivers,
   removing ambiguous tests shared by driver mappings and ordinary
   memory.

 - "support kselftest on nommu platform" (Hajime Tazaki):

   Add opt-in mmap and mremap tests for NOMMU systems. Teach the runner
   to avoid its fork-dependent timeout command and document the build
   and runtime requirements.

 - "mm/collapse: separate a collapse from its callers" (Kiryl
   Shutsemau):

   Separate huge-page collapse from caller policy. Replace khugepaged
   identity checks with explicit permissions, and separate scanning from
   collapse with the mmap_lock drop in one place.

 - "mm: implement and use vma_has_anon_rmap(), silence KCSAN" (Lorenzo
   Stoakes):

   Provide a common helper for testing whether a VMA has anonymous
   reverse mappings. Document the locking rules, annotate intentional
   concurrent reads for KCSAN, and convert the core MM callers.

 - "mm/sparse: remove SECTION_MARKED_PRESENT and further cleanups"
   (David Hildenbrand):

   Remove SECTION_MARKED_PRESENT in favor of the early-section flag.
   Simplify sparse memory initialization, section metadata handling and
   related PFN validity checks.

 - "sh: remove NUMA and SPARSEMEM support" (Mike Rapoport):

   Remove SuperH NUMA and SPARSEMEM support. The extra memory banks have
   been unusable since the NO_BOOTMEM conversion, leaving only the code
   and data overhead.

 - "mm: Unify device DAX and HugeTLB vmemmap population paths" (Muchun
   Song):

   Unify the generic device DAX and HugeTLB vmemmap population paths and
   shared tail-page handling. Remove the duplicate DAX machinery while
   retaining the powerpc radix implementation.

 - "kselftest: mm: fix some failure of split_huge_page_test" (Yeoreum
   Yun):

   Fix huge-page split tests racing with khugepaged recollapse. Use
   pagemap and page flags instead of VMA-boundary assumptions which fail
   when glibc has already enabled THP.

 - "memcg: move memcgid refcount to objcg to unpin dying memcgs"
   (Bingfang Guo):

   Let dying memcgs be freed while swapped-out shmem still holds their
   IDs. Move ID references to reparentable objcgs, with the necessary
   swap accounting and RCU lifetime changes.

 - "mm/truncate: fix data loss when truncating straddling large folios"
   (Zhang Yi):

   Preserve out-of-range data when truncating straddling large folios.
   Fix a lookup race and split-failure handling, and handle minimum
   folio orders for the forthcoming ext4 iomap buffered I/O path.

 - "mm/damon: introduce damos quota goal target metric complement flag"
   (SJ Park):

   Let DAMOS quota goals use a metric's complement, so utilization can
   also express free-memory goals without adding separate metrics. Add
   the sysfs interface, documentation and tests.

 - "arm64/mm: Standardize printing for pgtable entries" (Anshuman
   Khandual):

   Use the generic formatter for arm64 page-table entries, ready for
   future wider entries. Move the safe-PTE-update check out of the
   header to avoid an include cycle.

 - "mm: kmsan: fix iounmap metadata teardown" (Dima Koziuk):

   Fix KMSAN metadata leaks on iounmap and failed ioremap allocations.
   Free backing pages before removing their mappings, and share the
   teardown with partial-allocation cleanup.

 - "mm/damon/core: preserve quota state when constructing schemes" (Karl
   Mehltretter):

   Preserve running DAMOS quota state while validating parameter
   updates. Even rejected updates could reset accounting and exceed the
   quota window; add tests for both accepted and rejected updates.

 - "mm/vmalloc: fix vmalloc_dump_obj VA lookup" (Ye Liu):

   Fix vmalloc_dump_obj() lookups for last-page addresses and
   allocations spanning vmap zones. These allocations were being missed
   in diagnostic output.

 - "mm: various (urgent?) fixes" (David Hildenbrand):

   Fix mmap charge leaks and hugetlb use-after-free, wrong-address
   unmapping, stuck locks and endless faults. Also preserve reservations
   on failed mremap and handle stale userfaultfd bits.

 - "maple_tree: fix maple_range_64 crashes in RCU mode" (Dimitris
   Charisis):

   Fix pointer and metadata confusion during RCU destruction of
   maple_range_64 nodes, avoiding double frees and invalid accesses. Add
   a regression test; no in-tree user currently uses this combination.

 - "mm: fix hugetlb NR_HUGETLB accounting on folio migration" (Hongfu
   Li):

   Fix hugetlb migration and preallocation accounting so /proc/vmstat
   retains the correct count and memory.numa_stat follows the folio to
   its new node.

 - "mm/damon: fix a minor bug, clean code, and add a test" (SJ Park):

   Fix 32-bit DAMON age overflow which made old regions look young.
   Share hugetlb folio acquisition code and add a regression test for
   the previously fixed last-region skipping bug.

 - "mm/damon/core: cleanup code, reduce stack usage, and add kunit" (SJ
   Park):

   Reduce kdamond stack usage and remove unused enums. Add deterministic
   PSI quota-goal tests which do not depend on the machine's current
   memory pressure.

 - "mm/damon: fix the temporal goal tuner's size quota conversion"
   (Donggeun Yoo):

   Bound the temporal tuner's quota conversion to prevent overflow and
   zero effective quotas, which could stop schemes making progress. Add
   boundary tests.

 - "Don't use GFP_DMA when calling dma_alloc_coherent" (Baoquan He):

   Remove redundant GFP_DMA flags from coherent DMA allocation calls.
   The DMA API already selects the zone from device limits and ignores
   the caller's flag.

 - "kselftest: mm: fix intermittent failure khugepaged test" (Yeoreum
   Yun):

   Propagate child-process failures in the khugepaged tests and prevent
   background collapse from racing their checks. This removes false
   passes and intermittent failures.

 - "MAINTAINERS: cover all hugetlb headers under HUGETLB SUBSYSTEM"
   (Enze Li):

   Cover all hugetlb headers in MAINTAINERS so get_maintainer.pl finds
   the right maintainers. Also label the closing hugetlb_cgroup.h
   include guard.

Summary of the 65 singletons in this merge:

  The singletons include a few worthwhile performance fixes. Avoiding
  unnecessary reverse-map tree updates gave a reported 15.9% improvement
  in UnixBench's execl test on a 192-core x86 system. A reclaim retry
  fix stops defrag_mode from spinning under memory.low protection; a
  reported file-creation stress test ran 5.7 times faster, with far less
  memory pressure. Narrower hugetlb invalidations also spare KVM guests
  needless refaults: the reported Redis-in-VM P99 QPS penalty while
  punching holes fell from 7.09% to 1.45%.

  Several fixes prevent lost data or corrupted memory. Lazyfree
  huge-page races with mremap()/munmap() could lose data or access freed
  memory, and MADV_COLD could lose a concurrent write's dirty bit.
  Another fix prevents stale migration entries from outliving large
  folios. On filesystems with blocks smaller than a page, extending a
  file by 4 GiB or more could expose bytes written past the old EOF
  through mmap instead of zeroes. That is fixed, along with
  use-after-free races in PAGEMAP_SCAN during process exit and in
  memory-cgroup accounting on PREEMPT_RT kernels.

  Other fixes stop UFFDIO_MOVE spinning forever on pinned large folios,
  which could wedge other memory operations, and stop mremap() leaking
  commit charges until allocations fail under strict overcommit. A
  further fix keeps userfaultfd tracking intact on neighboring mappings.
  NUMA binding no longer prevents long-term pins when the chosen node
  has only movable memory, fixing QEMU/VFIO startup and io_uring buffer
  registration failures. MGLRU also gets a fix for early-boot crashes
  with memory cgroups disabled at boot, notably in small crash kernels.

* tag 'mm-stable-2026-10-25-19-27' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (213 commits)
  mm: multi-gen LRU: fix NULL lruvec->pgdat deref with memcg disabled on cmdline
  mm/page_counter: use WRITE_ONCE() for emin/elow when parent is the root
  mm/memcontrol: publish null pointer before dropping css reference
  test_maple_tree: test maple_range_64 node in RCU mode
  maple_tree: fix maple_range_64 crashes in RCU mode
  mm/vma: avoid broken uffd merge on mremap
  tools/testing/shared: catch a failed posix_memalign()
  mm/damon/core: remove unreachable damos charge_{target,addr}_from
  mm/shrinker: allocate shrinker_info_unit from a dedicated kmem_cache
  riscv: mm: exclude invalid THP PMDs from page table check
  mm/damon/core: filter out damos address filter-split failed region
  fs/proc/task_mmu: pin mm_users in do_pagemap_scan()
  mm/mempolicy: apply bind policies against the scoped allocation zone
  mm/vmscan: reclaim every zone in per-node proactive reclaim
  mm/mremap: correctly uncharge accountable VMAs in error path
  mm/mremap: populate calculated fields in vrm state correctly
  MAINTAINERS: add an entry for MEMORY MANAGEMENT - MEMORY MAP
  mm: bdi: reset min_ratio after the sysfs attributes are gone
  mm/page_vma_mapped: continue past nonmatching huge PMDs
  selftests/mm: skip hugetlb cgroup v2 tests without the needed controllers
  ...
Merge tag 'mm-nonmm-stable-2026-10-25-14-57' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm 2026-10-27T22:08:22+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-10-27T22:08:22+00:00 7d1f84f1b94e79cb95d974ab3ec54cb3a4d64f5b Pull non-MM updates from Andrew Morton: - "ocfs2: exit recovery thread on mount error path" (Joseph Qi): Stop OCFS2 recovery before freeing failed-mount state and replay slots, closing use-after-free and double-free races. Defer suballocator reclaim to break a transaction-lock deadlock with dismount. - "ocfs2: validate suballoc slot and bit of metadata blocks" (Joseph Qi): Validate OCFS2 metadata suballocator slots, bits and directory index block locations. Reject corrupt metadata with filesystem errors instead of BUGs or out-of-bounds accesses. - "ocfs2: deal with legacy signed name hash values" (Joseph Qi): Restore OCFS2 lookups for non-ASCII names stored with legacy signed hashes. Use stored xattr hashes during bucket splits to avoid duplicate entries and spurious ENOSPC failures. - "ocfs2: stabilize dentry names in file and setattr traces" (Cen Zhang): Snapshot OCFS2 names during file and setattr tracing to prevent rename races using freed storage or mismatched names and lengths. Preserve trace formats and the locked release open-count sample. - "panic: fix panic_force_cpu= redirect races and NMI bypass" (Bradley Morgan): Fix panic_force_cpu races and NMI redirection so crash-kernel CPU selection is honored. Preserve variable arguments on failed redirects and use a static message buffer. - "fat: allocate multiple clusters in fallocate" (Matheus Alves de Almeida): Allocate FAT clusters in batches for FALLOC_FL_KEEP_SIZE and batch FAT updates. This removes repeated single-cluster allocation overhead, particularly on synchronous mounts. - "scripts/gdb: fix radix tree lookup and stack depot diagnostic" (Ting-Han Hou): Fix GDB radix-tree lookup and its handling of XArray sibling, retry and zero entries. Also repair the stack-depot diagnostic for an out-of-range pool index. - "hung_task: Improve warning budget handling and task reporting" (Aaron Tomlin): Reset the hung-task warning budget after recovery so later hangs remain visible. Keep the configured limit intact and emit one summary per scan when detailed reports exhaust the budget. - "bootconfig: Reject unexpected data after null character and cleanups" (Masami Hiramatsu): Reject bootconfig data after an embedded null while accepting trailing padding. Validate the full input in the userspace tool, and retain internal tree sanity checks there rather than in the kernel. - "kbuild: GCOV cleanups following the prefer-atomic fix" (Konstantin Khorenko): Use the actual GCOV build flags in the prefer-atomic compiler probe. Move flag setup into scripts/Makefile.gcov and skip the probe when GCOV is disabled. - "ocfs2: xattr bucket validation fixes" (Joseph Qi): Accept valid OCFS2 xattr buckets spanning 512-byte blocks, avoiding false read-only remounts. Reject misaligned buckets and return errors instead of panicking on corrupt defrag metadata. - "ocfs2: fix metadata reservation for xattr value trees" (Joseph Qi): Reserve enough OCFS2 metadata for new and relocated xattr value trees. Fix shortfalls which could cause ENOSPC, dropped entries and leaked clusters on fragmented filesystems; remove duplicate reservations. - "Introduce arch_do_panic" (Mete Durlu): Add arch_do_panic() and move s390 and sparc handling out of generic panic code. The architecture-specific actions now follow the end-of-panic marker. - "checkpatch: userspace improvements" (Petr Vorel): Improve checkpatch's userspace detection and suppress kernel-only checks. Recognize standard inttypes macros and add explicit --userspace and --no-userspace overrides. - "ocfs2: validate dr_fs_generation of dir index root blocks" (Joseph Qi): Check OCFS2 directory index generations and leaf block numbers. Reject stale or misplaced blocks instead of using metadata left by a previously formatted filesystem. - "selftests/membarrier: Skip an unregistered memory barrier test on Musl" (Chris Gellermann): Skip the unregistered membarrier test when libc has already registered the command. Musl does this during thread creation, causing false failures in the multithreaded test. - "init: fix array boundary bugs in boot parameter parsing" (Wilson Felipe Pereira): Fix boot argument boundary cases which leave stale arguments in init's command line or panic when replacing the final environment variable. Clear the last slot and check duplicates before the limit. Summary of the 87 singletons in this merge: The OCFS2 singletons fix deadlocks between xattr updates and inline truncation, and during inode reclaim. Corrupt quota and extent metadata could also crash the kernel or corrupt memory; these paths now check the layout before using it. Other fixes close use-after-free and publication races around cluster reconfiguration, node failure, quota remount errors and shared refcount trees. New files now retain security labels from all stacked LSMs instead of silently dropping all but one. Valid xattr insertions also stop tripping FORTIFY on builds with counted arrays. Elsewhere, a lost wakeup could leave hardware-monitoring reads stuck in unkillable sleep and block further I2C traffic. That is fixed, as are kernel memory leaks in POSIX message-queue notifications and tmpfs casefold setup which could grow until memory is exhausted. A driver removal race which could crash the kernel is fixed too. The hibernation command through reboot() also stops taking the same mutex twice, avoiding a deadlock before suspension. On the boot side, bzip2 decoding now accepts valid full blocks emitted by lbzip2, fixing failures to boot those compressed kernels. Malformed bzip2 streams can no longer overflow the decode buffer, and LZ4 initrds are checked before the decoder can read past their end. FAT rejects geometry which overflows the data-area calculation on 32-bit systems, and rolls back entries when inode setup fails, preventing failed creations from reappearing after remount. The x86 XOR and RAID6 AVX paths also avoid imposing a slowdown on subsequent SSE code. * tag 'mm-nonmm-stable-2026-10-25-14-57' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (134 commits) scripts/gdb: fix stack depot out-of-bounds diagnostic scripts/gdb: fix radix tree lookup pointer handling ocfs2/cluster: remove zero-address nodes from IP tree on teardown ocfs2: snapshot the dentry name while tracing file release ocfs2: snapshot dentry names in file and setattr traces ocfs2/dlm: drain join handlers before releasing module text MAINTAINERS: update Markus's e-mail address mailmap: add entries for Andrew Jones stackdepot: stop preallocating after the final pool ocfs2: drain quorum work before removing the cluster watchdog: force console verbose when reporting lockups profiling: fix sampling step on 64-bit big-endian systems kernel/reboot: avoid potential deadlocks during suspension compat: avoid double rounding in times() ocfs2: pin owning modules for open debugfs files ocfs2/cluster: initialize heartbeat regions before publishing them selftests/proc: proc-pid-vm: fix unused variable warning on non-x86 ocfs2: pin refcount trees before dropping the lookup lock ocfs2: validate the xattr tree root of an indexed xattr block ocfs2/dlm: hold the lookup reference across convert AST enqueue ... 
Pull non-MM updates from Andrew Morton:

 - "ocfs2: exit recovery thread on mount error path" (Joseph Qi):

   Stop OCFS2 recovery before freeing failed-mount state and replay
   slots, closing use-after-free and double-free races. Defer
   suballocator reclaim to break a transaction-lock deadlock with
   dismount.

 - "ocfs2: validate suballoc slot and bit of metadata blocks" (Joseph
   Qi):

   Validate OCFS2 metadata suballocator slots, bits and directory index
   block locations. Reject corrupt metadata with filesystem errors
   instead of BUGs or out-of-bounds accesses.

 - "ocfs2: deal with legacy signed name hash values" (Joseph Qi):

   Restore OCFS2 lookups for non-ASCII names stored with legacy signed
   hashes. Use stored xattr hashes during bucket splits to avoid
   duplicate entries and spurious ENOSPC failures.

 - "ocfs2: stabilize dentry names in file and setattr traces" (Cen
   Zhang):

   Snapshot OCFS2 names during file and setattr tracing to prevent
   rename races using freed storage or mismatched names and lengths.
   Preserve trace formats and the locked release open-count sample.

 - "panic: fix panic_force_cpu= redirect races and NMI bypass" (Bradley
   Morgan):

   Fix panic_force_cpu races and NMI redirection so crash-kernel CPU
   selection is honored. Preserve variable arguments on failed redirects
   and use a static message buffer.

 - "fat: allocate multiple clusters in fallocate" (Matheus Alves de
   Almeida):

   Allocate FAT clusters in batches for FALLOC_FL_KEEP_SIZE and batch
   FAT updates. This removes repeated single-cluster allocation
   overhead, particularly on synchronous mounts.

 - "scripts/gdb: fix radix tree lookup and stack depot diagnostic"
   (Ting-Han Hou):

   Fix GDB radix-tree lookup and its handling of XArray sibling, retry
   and zero entries. Also repair the stack-depot diagnostic for an
   out-of-range pool index.

 - "hung_task: Improve warning budget handling and task reporting"
   (Aaron Tomlin):

   Reset the hung-task warning budget after recovery so later hangs
   remain visible. Keep the configured limit intact and emit one summary
   per scan when detailed reports exhaust the budget.

 - "bootconfig: Reject unexpected data after null character and
   cleanups" (Masami Hiramatsu):

   Reject bootconfig data after an embedded null while accepting
   trailing padding. Validate the full input in the userspace tool, and
   retain internal tree sanity checks there rather than in the kernel.

 - "kbuild: GCOV cleanups following the prefer-atomic fix" (Konstantin
   Khorenko):

   Use the actual GCOV build flags in the prefer-atomic compiler probe.
   Move flag setup into scripts/Makefile.gcov and skip the probe when
   GCOV is disabled.

 - "ocfs2: xattr bucket validation fixes" (Joseph Qi):

   Accept valid OCFS2 xattr buckets spanning 512-byte blocks, avoiding
   false read-only remounts. Reject misaligned buckets and return errors
   instead of panicking on corrupt defrag metadata.

 - "ocfs2: fix metadata reservation for xattr value trees" (Joseph Qi):

   Reserve enough OCFS2 metadata for new and relocated xattr value
   trees. Fix shortfalls which could cause ENOSPC, dropped entries and
   leaked clusters on fragmented filesystems; remove duplicate
   reservations.

 - "Introduce arch_do_panic" (Mete Durlu):

   Add arch_do_panic() and move s390 and sparc handling out of generic
   panic code. The architecture-specific actions now follow the
   end-of-panic marker.

 - "checkpatch: userspace improvements" (Petr Vorel):

   Improve checkpatch's userspace detection and suppress kernel-only
   checks. Recognize standard inttypes macros and add explicit
   --userspace and --no-userspace overrides.

 - "ocfs2: validate dr_fs_generation of dir index root blocks" (Joseph
   Qi):

   Check OCFS2 directory index generations and leaf block numbers.
   Reject stale or misplaced blocks instead of using metadata left by a
   previously formatted filesystem.

 - "selftests/membarrier: Skip an unregistered memory barrier test on
   Musl" (Chris Gellermann):

   Skip the unregistered membarrier test when libc has already
   registered the command. Musl does this during thread creation,
   causing false failures in the multithreaded test.

 - "init: fix array boundary bugs in boot parameter parsing"
   (Wilson Felipe Pereira):

   Fix boot argument boundary cases which leave stale arguments in
   init's command line or panic when replacing the final environment
   variable. Clear the last slot and check duplicates before the limit.

Summary of the 87 singletons in this merge:

  The OCFS2 singletons fix deadlocks between xattr updates and inline
  truncation, and during inode reclaim. Corrupt quota and extent
  metadata could also crash the kernel or corrupt memory; these paths
  now check the layout before using it. Other fixes close use-after-free
  and publication races around cluster reconfiguration, node failure,
  quota remount errors and shared refcount trees. New files now retain
  security labels from all stacked LSMs instead of silently dropping all
  but one. Valid xattr insertions also stop tripping FORTIFY on builds
  with counted arrays.

  Elsewhere, a lost wakeup could leave hardware-monitoring reads stuck
  in unkillable sleep and block further I2C traffic. That is fixed, as
  are kernel memory leaks in POSIX message-queue notifications and tmpfs
  casefold setup which could grow until memory is exhausted. A driver
  removal race which could crash the kernel is fixed too. The
  hibernation command through reboot() also stops taking the same mutex
  twice, avoiding a deadlock before suspension.

  On the boot side, bzip2 decoding now accepts valid full blocks emitted
  by lbzip2, fixing failures to boot those compressed kernels. Malformed
  bzip2 streams can no longer overflow the decode buffer, and LZ4
  initrds are checked before the decoder can read past their end. FAT
  rejects geometry which overflows the data-area calculation on 32-bit
  systems, and rolls back entries when inode setup fails, preventing
  failed creations from reappearing after remount. The x86 XOR and RAID6
  AVX paths also avoid imposing a slowdown on subsequent SSE code.

* tag 'mm-nonmm-stable-2026-10-25-14-57' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (134 commits)
  scripts/gdb: fix stack depot out-of-bounds diagnostic
  scripts/gdb: fix radix tree lookup pointer handling
  ocfs2/cluster: remove zero-address nodes from IP tree on teardown
  ocfs2: snapshot the dentry name while tracing file release
  ocfs2: snapshot dentry names in file and setattr traces
  ocfs2/dlm: drain join handlers before releasing module text
  MAINTAINERS: update Markus's e-mail address
  mailmap: add entries for Andrew Jones
  stackdepot: stop preallocating after the final pool
  ocfs2: drain quorum work before removing the cluster
  watchdog: force console verbose when reporting lockups
  profiling: fix sampling step on 64-bit big-endian systems
  kernel/reboot: avoid potential deadlocks during suspension
  compat: avoid double rounding in times()
  ocfs2: pin owning modules for open debugfs files
  ocfs2/cluster: initialize heartbeat regions before publishing them
  selftests/proc: proc-pid-vm: fix unused variable warning on non-x86
  ocfs2: pin refcount trees before dropping the lookup lock
  ocfs2: validate the xattr tree root of an indexed xattr block
  ocfs2/dlm: hold the lookup reference across convert AST enqueue
  ...
Merge tag 'usb-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb 2026-10-25T01:31:19+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-10-25T01:31:19+00:00 168151cdb0f93d26557f9f3c7aae659b8d6b1863 Pull USB / Thunderbolt update from Greg KH: "Here is the big set of USB and Thunderbolt changes for 7.4-rc1. Included in here are: - thunderbolt driver updates and fixes - lots of dt schema conversions - usb gadget driver fixes (and a new maintainer!) - usb core fixups with some interactions with the driver core - usb serial updates and fixes for scan-found "issues" - xhci driver updates - typec driver updates - dwc3 driver updates - lots of usb gadget driver fixes for syzbot found "problems" - lots of other small USB driver fixes for randomly reported problems. All of these have been in linux-next with no reported issues" * tag 'usb-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (158 commits) usb: gadget: dummy_hcd: prevent unbind via sysfs usb: gadget: dummy_hcd: add tick_us module parameter for timer-rate tuning usb: gadget: dummy_hcd: set no_sg_constraint only on the SuperSpeed bus usb: gadget: dummy_hcd: fix SuperSpeed ep0 maxpacket usb: gadget: fix refcount underflow in gadgetfs_bind() error path USB: core: document purpose of interface parent reference MAINTAINERS: add Neill Kapron as USB Gadget maintainer USB: Documentation: Update description of completion callback context USB: serial: mxuport: support RS485 mode configuration USB: serial: mxuport: handle SEND_NEXT transmit flow control USB: serial: add generic write control callbacks USB: serial: mxuport: add MUX50U-based device support USB: serial: mxuport: clean up firmware version handling USB: serial: mxuport: clean up product ID definitions and device table USB: serial: sierra: fix urb leak on write completion usb: typec: ucsi_ccg: Add retry mechanism in ccg_read usb: host: xhci-tegra: Add Tegra264 XHCI support usb: host: xhci-tegra: Skip MBOX MSG_ENABLED on Tegra264 dt-bindings: usb: Add Tegra264 XUSB host support usb: xhci-pci: Add TUSB73x0 definitions ... 
Pull USB / Thunderbolt update from Greg KH:
 "Here is the big set of USB and Thunderbolt changes for 7.4-rc1.
  Included in here are:

   - thunderbolt driver updates and fixes

   - lots of dt schema conversions

   - usb gadget driver fixes (and a new maintainer!)

   - usb core fixups with some interactions with the driver core

   - usb serial updates and fixes for scan-found "issues"

   - xhci driver updates

   - typec driver updates

   - dwc3 driver updates

   - lots of usb gadget driver fixes for syzbot found "problems"

   - lots of other small USB driver fixes for randomly reported problems.

  All of these have been in linux-next with no reported issues"

* tag 'usb-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (158 commits)
  usb: gadget: dummy_hcd: prevent unbind via sysfs
  usb: gadget: dummy_hcd: add tick_us module parameter for timer-rate tuning
  usb: gadget: dummy_hcd: set no_sg_constraint only on the SuperSpeed bus
  usb: gadget: dummy_hcd: fix SuperSpeed ep0 maxpacket
  usb: gadget: fix refcount underflow in gadgetfs_bind() error path
  USB: core: document purpose of interface parent reference
  MAINTAINERS: add Neill Kapron as USB Gadget maintainer
  USB: Documentation: Update description of completion callback context
  USB: serial: mxuport: support RS485 mode configuration
  USB: serial: mxuport: handle SEND_NEXT transmit flow control
  USB: serial: add generic write control callbacks
  USB: serial: mxuport: add MUX50U-based device support
  USB: serial: mxuport: clean up firmware version handling
  USB: serial: mxuport: clean up product ID definitions and device table
  USB: serial: sierra: fix urb leak on write completion
  usb: typec: ucsi_ccg: Add retry mechanism in ccg_read
  usb: host: xhci-tegra: Add Tegra264 XHCI support
  usb: host: xhci-tegra: Skip MBOX MSG_ENABLED on Tegra264
  dt-bindings: usb: Add Tegra264 XUSB host support
  usb: xhci-pci: Add TUSB73x0 definitions
  ...
Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi 2026-10-25T00:30:22+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-10-25T00:30:22+00:00 6fba331225f5040e93d0947d1027e9712238291f Pull SCSI updates from James Bottomley: "Small number of driver updates (mpi3mr, ufs, scsi_debug). By far the biggest core change (at 4000+ lines) is the sense code rework to make our sense handling follow the 16 bit defines in the SCSI standard rather than our split ASC and ASCQ handling which ends up being confusing and difficult to grep. The changes should all be functionally equivalent and so far the bots and AI seem to agree; the code has been incubating in -next since 16 September with one reported issue fixed. The remaining updates are minor" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (114 commits) scsi: ufs: rpmb: Fix power-on UNIT ATTENTION retry scsi: bfa: Use snprintf() in bfa_fcs_fabric_psymb_init() scsi: bfa: Use snprintf() in bfa_fcs_fabric_nsymb_init() scsi: MAINTAINERS: Remove Avri Altman as UFS reviewer scsi: st: Relock the door after a reset scsi: st: Restore the drive buffering mode after reset scsi: st: Record the tape position after a successful MTLOAD scsi: st: Restore changed drive settings after reset also for MTLOAD and MTRETEN scsi: scsi_debug: Validate the access parameters of WRITE ATOMIC (16) scsi: scsi_debug: Map the region written by WRITE ATOMIC (16) scsi: scsi_debug: Refuse a short WRITE ATOMIC (16) before writing it scsi: scsi_debug: Advance the write pointer over the data written scsi: scsi_debug: Do not write a partial physical block to a zoned device scsi: scsi_debug: Enforce physical block alignment of zoned writes scsi: scsi_debug: Report the residual of a write scsi: scsi_debug: Avoid 32-bit overflow in WRITE SCATTERED offsets scsi: scsi_debug: Evaluate scsi_debug_lbp() only once scsi: scsi_debug: Take the zone metadata lock before the data lock scsi: scsi_debug: Refuse a negative physblk_exp scsi: scsi_debug: Make atomic writes and ZBC emulation mutually exclusive ... 
Pull SCSI updates from James Bottomley:
 "Small number of driver updates (mpi3mr, ufs, scsi_debug).

  By far the biggest core change (at 4000+ lines) is the sense code
  rework to make our sense handling follow the 16 bit defines in the
  SCSI standard rather than our split ASC and ASCQ handling which ends
  up being confusing and difficult to grep.

  The changes should all be functionally equivalent and so far the bots
  and AI seem to agree; the code has been incubating in -next since 16
  September with one reported issue fixed.

  The remaining updates are minor"

* tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (114 commits)
  scsi: ufs: rpmb: Fix power-on UNIT ATTENTION retry
  scsi: bfa: Use snprintf() in bfa_fcs_fabric_psymb_init()
  scsi: bfa: Use snprintf() in bfa_fcs_fabric_nsymb_init()
  scsi: MAINTAINERS: Remove Avri Altman as UFS reviewer
  scsi: st: Relock the door after a reset
  scsi: st: Restore the drive buffering mode after reset
  scsi: st: Record the tape position after a successful MTLOAD
  scsi: st: Restore changed drive settings after reset also for MTLOAD and MTRETEN
  scsi: scsi_debug: Validate the access parameters of WRITE ATOMIC (16)
  scsi: scsi_debug: Map the region written by WRITE ATOMIC (16)
  scsi: scsi_debug: Refuse a short WRITE ATOMIC (16) before writing it
  scsi: scsi_debug: Advance the write pointer over the data written
  scsi: scsi_debug: Do not write a partial physical block to a zoned device
  scsi: scsi_debug: Enforce physical block alignment of zoned writes
  scsi: scsi_debug: Report the residual of a write
  scsi: scsi_debug: Avoid 32-bit overflow in WRITE SCATTERED offsets
  scsi: scsi_debug: Evaluate scsi_debug_lbp() only once
  scsi: scsi_debug: Take the zone metadata lock before the data lock
  scsi: scsi_debug: Refuse a negative physblk_exp
  scsi: scsi_debug: Make atomic writes and ZBC emulation mutually exclusive
  ...
usb: cdns2: don't use GFP_DMA when calling dma_alloc_coherent() 2026-10-24T08:56:01+00:00 Baoquan He hebaoquan@kylinos.cn 2026-09-03T11:18:36+00:00 1528ed9f962f328280b918b066188a0fe3a5ce0e dma_alloc_coherent() allocates the DMA buffer with the device's addressing limitation in mind; the DMA core picks the zone from the device's coherent DMA mask and ignores GFP_DMA passed by the caller. Use GFP_KERNEL instead so the allocation may reclaim as usual for probe-time allocations. Link: https://lore.kernel.org/20260903111836.1777265-14-hebaoquan@kylinos.cn Signed-off-by: Baoquan He <hebaoquan@kylinos.cn> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Cc: Christoph Hellwig <hch@lst.de> Cc: Harry Yoo <harry@kernel.org> 
dma_alloc_coherent() allocates the DMA buffer with the device's
addressing limitation in mind; the DMA core picks the zone from the
device's coherent DMA mask and ignores GFP_DMA passed by the caller.
Use GFP_KERNEL instead so the allocation may reclaim as usual for
probe-time allocations.

Link: https://lore.kernel.org/20260903111836.1777265-14-hebaoquan@kylinos.cn
Signed-off-by: Baoquan He <hebaoquan@kylinos.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Harry Yoo <harry@kernel.org>
usb: gadget: lpc32xx_udc: don't use GFP_DMA when calling dma_alloc_coherent() 2026-10-24T08:55:59+00:00 Baoquan He hebaoquan@kylinos.cn 2026-09-03T11:18:29+00:00 fd3d2126e737c9c95d78d30904916ff84ebd2940 dma_alloc_coherent() allocates the DMA buffer with the device's addressing limitation in mind; the DMA core picks the zone from the device's coherent DMA mask and ignores GFP_DMA passed by the caller. Remove the redundant GFP_DMA flag. Link: https://lore.kernel.org/20260903111836.1777265-7-hebaoquan@kylinos.cn Signed-off-by: Baoquan He <hebaoquan@kylinos.cn> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Cc: Christoph Hellwig <hch@lst.de> Cc: Harry Yoo <harry@kernel.org> 
dma_alloc_coherent() allocates the DMA buffer with the device's addressing
limitation in mind; the DMA core picks the zone from the device's coherent
DMA mask and ignores GFP_DMA passed by the caller.  Remove the redundant
GFP_DMA flag.

Link: https://lore.kernel.org/20260903111836.1777265-7-hebaoquan@kylinos.cn
Signed-off-by: Baoquan He <hebaoquan@kylinos.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Harry Yoo <harry@kernel.org>
usb: gadget: dummy_hcd: prevent unbind via sysfs 2026-10-18T08:19:23+00:00 Aleksandr Nogikh nogikh@google.com 2026-07-29T12:25:27+00:00 bdf12cde30830d46a8ef1ba93986356f1164b4f1 The dummy_hcd (Host Controller) and dummy_udc (Device Controller) are implemented as two separate platform drivers that share the same underlying state (struct dummy). They are designed to be created and destroyed together during the module's init and exit phases. If userspace forces the dummy_hcd driver to unbind from the device via sysfs, dummy_hcd_remove() cleans up the host controllers and sets the pointers to NULL (dum->hs_hcd = NULL). However, the dummy_udc driver is still bound to its device, meaning the USB gadget is still registered with the udc-core subsystem. If a new gadget driver is subsequently registered, it binds to the still-registered dummy_udc gadget, invoking the dummy_udc_start() callback. This callback attempts to retrieve the HCD state using gadget_to_dummy_hcd(), which returns NULL because of the unbind. This results in a null-pointer dereference: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] ... RIP: 0010:dummy_udc_start+0xd0/0x1f0 drivers/usb/gadget/udc/dummy_hcd.c:1022 ... Call Trace: <TASK> usb_gadget_udc_start_locked drivers/usb/gadget/udc/core.c:1237 [inline] gadget_bind_driver+0x3a8/0x9e0 drivers/usb/gadget/udc/core.c:1667 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __driver_attach+0x339/0x600 drivers/base/dd.c:1292 bus_for_each_dev+0x23b/0x2c0 drivers/base/bus.c:383 bus_add_driver+0x345/0x670 drivers/base/bus.c:763 driver_register+0x23a/0x320 drivers/base/driver.c:174 usb_gadget_register_driver_owner+0xf9/0x270 drivers/usb/gadget/udc/core.c:1752 raw_ioctl_run drivers/usb/gadget/legacy/raw_gadget.c:596 [inline] raw_ioctl+0x1541/0x41c0 drivers/usb/gadget/legacy/raw_gadget.c:1307 Adding NULL checks to the UDC callbacks is not a robust solution because there is no synchronization between dummy_hcd_remove() and the UDC callbacks, which would result in a use-after-free race condition if the HCD were unbound concurrently. Fix this by setting .suppress_bind_attrs = true in both driver definitions. This prevents userspace from unbinding these drivers dynamically, ensuring their lifecycles remain strictly synchronized with the module's load/unload process. Fixes: d9b762510c18 ("[PATCH] USB dummy_hcd: Use separate pdevs for HC and UDC") Assisted-by: Gemini:gemini-3.5-flash Gemini:gemini-3.1-pro-preview syzbot Reported-by: syzbot+d270af829aca04e783fc@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d270af829aca04e783fc Link: https://syzkaller.appspot.com/ai_job?id=7a763ada-c07c-458f-9fea-f7e913dc1f2f Signed-off-by: Aleksandr Nogikh <nogikh@google.com> Acked-by: Alan Stern <stern@rowland.harvard.edu> Link: https://patch.msgid.link/18ec3122-7566-49e5-9964-1028857405b1@mail.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
The dummy_hcd (Host Controller) and dummy_udc (Device Controller) are
implemented as two separate platform drivers that share the same underlying
state (struct dummy). They are designed to be created and destroyed
together during the module's init and exit phases.

If userspace forces the dummy_hcd driver to unbind from the device via
sysfs, dummy_hcd_remove() cleans up the host controllers and sets the
pointers to NULL (dum->hs_hcd = NULL). However, the dummy_udc driver is
still bound to its device, meaning the USB gadget is still registered with
the udc-core subsystem.

If a new gadget driver is subsequently registered, it binds to the
still-registered dummy_udc gadget, invoking the dummy_udc_start() callback.
This callback attempts to retrieve the HCD state using
gadget_to_dummy_hcd(), which returns NULL because of the unbind. This
results in a null-pointer dereference:

Oops: general protection fault, probably for non-canonical address
0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
...
RIP: 0010:dummy_udc_start+0xd0/0x1f0
drivers/usb/gadget/udc/dummy_hcd.c:1022
...
Call Trace:
 <TASK>
 usb_gadget_udc_start_locked drivers/usb/gadget/udc/core.c:1237 [inline]
 gadget_bind_driver+0x3a8/0x9e0 drivers/usb/gadget/udc/core.c:1667
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x254/0xae0 drivers/base/dd.c:706
 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
 __driver_attach+0x339/0x600 drivers/base/dd.c:1292
 bus_for_each_dev+0x23b/0x2c0 drivers/base/bus.c:383
 bus_add_driver+0x345/0x670 drivers/base/bus.c:763
 driver_register+0x23a/0x320 drivers/base/driver.c:174
 usb_gadget_register_driver_owner+0xf9/0x270
 drivers/usb/gadget/udc/core.c:1752
 raw_ioctl_run drivers/usb/gadget/legacy/raw_gadget.c:596 [inline]
 raw_ioctl+0x1541/0x41c0 drivers/usb/gadget/legacy/raw_gadget.c:1307

Adding NULL checks to the UDC callbacks is not a robust solution because
there is no synchronization between dummy_hcd_remove() and the UDC
callbacks, which would result in a use-after-free race condition if the HCD
were unbound concurrently.

Fix this by setting .suppress_bind_attrs = true in both driver definitions.
This prevents userspace from unbinding these drivers dynamically, ensuring
their lifecycles remain strictly synchronized with the module's load/unload
process.

Fixes: d9b762510c18 ("[PATCH] USB dummy_hcd: Use separate pdevs for HC and UDC")
Assisted-by: Gemini:gemini-3.5-flash Gemini:gemini-3.1-pro-preview syzbot
Reported-by: syzbot+d270af829aca04e783fc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d270af829aca04e783fc
Link: https://syzkaller.appspot.com/ai_job?id=7a763ada-c07c-458f-9fea-f7e913dc1f2f
Signed-off-by: Aleksandr Nogikh <nogikh@google.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>

Link: https://patch.msgid.link/18ec3122-7566-49e5-9964-1028857405b1@mail.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: gadget: dummy_hcd: add tick_us module parameter for timer-rate tuning 2026-10-18T08:13:48+00:00 Mikhail Zubenko misha.zubenko.01@yandex.ru 2026-08-24T15:54:28+00:00 ab248e0b900ea2e30bec5c71fd56d8f0fa87a67a dummy_hcd services URB completions from an hrtimer callback that rearms itself with a fixed 125 us delay (one high-speed microframe) for as long as any URBs are queued. Against a permanently polled HID interrupt endpoint the queue never drains, so the timer runs at ~8 kHz regardless of actual traffic. On timer-rate-sensitive platforms (observed on one consumer AM4 board with a current BIOS and a stock kernel) this timer rate co-existing with a live Bluetooth session on the machine's real xHCI controller resulted in a hard, below-software platform hang: printk, SysRq, NMI and both watchdogs died in the same instant, with no panic, no MCE, and empty pstore. 13 occurrences over 5 days, reliably reproducible with that configuration (hangs within 20 min to 2.5 h of uptime). The same workload with the emulated microframe lengthened to 1000 us (this parameter) ran ~8 hours with zero hangs, and USB-cable sessions (identical gadget traffic, no Bluetooth co-existence) never hung. Note that lengthening the emulated microframe makes the emulation run slower than a physical device would; users of the parameter trade that emulation fidelity for interrupt-rate headroom. The per-frame bandwidth budget in dummy_timer() does not scale with the emulated microframe length; making that accounting microframe- correct is planned as a follow-up patch. Otherwise nothing in the driver's behaviour depends on the emulated microframe length. Default keeps the current 125 us behaviour bit-for-bit (and defaults to 1000 us for full-speed emulation, where the natural unit is the 1-ms frame). Values below 125 are rejected. Signed-off-by: Mikhail Zubenko <misha.zubenko.01@yandex.ru> Reviewed-by: Alan Stern <stern@rowland.harvard.edu> Link: https://patch.msgid.link/178758686883.288478.6637939361965647417@yandex.ru Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
dummy_hcd services URB completions from an hrtimer callback that
rearms itself with a fixed 125 us delay (one high-speed microframe)
for as long as any URBs are queued.  Against a permanently polled HID
interrupt endpoint the queue never drains, so the timer runs at ~8 kHz
regardless of actual traffic.

On timer-rate-sensitive platforms (observed on one consumer AM4 board
with a current BIOS and a stock kernel) this timer rate co-existing
with a live Bluetooth session on the machine's real xHCI controller
resulted in a hard, below-software platform hang: printk, SysRq, NMI
and both watchdogs died in the same instant, with no panic, no MCE,
and empty pstore.  13 occurrences over 5 days, reliably reproducible
with that configuration (hangs within 20 min to 2.5 h of uptime).
The same workload with the emulated microframe lengthened to 1000 us
(this parameter) ran ~8 hours with zero hangs, and USB-cable sessions
(identical gadget traffic, no Bluetooth co-existence) never hung.

Note that lengthening the emulated microframe makes the emulation run
slower than a physical device would; users of the parameter trade
that emulation fidelity for interrupt-rate headroom.

The per-frame bandwidth budget in dummy_timer() does not scale with
the emulated microframe length; making that accounting microframe-
correct is planned as a follow-up patch.  Otherwise nothing in the
driver's behaviour depends on the emulated microframe length.

Default keeps the current 125 us behaviour bit-for-bit (and defaults
to 1000 us for full-speed emulation, where the natural unit is the
1-ms frame).  Values below 125 are rejected.

Signed-off-by: Mikhail Zubenko <misha.zubenko.01@yandex.ru>
Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://patch.msgid.link/178758686883.288478.6637939361965647417@yandex.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: gadget: dummy_hcd: set no_sg_constraint only on the SuperSpeed bus 2026-10-18T08:13:34+00:00 Igor Skalkin igor.skalkin@oss.qualcomm.com 2026-08-12T08:19:10+00:00 8d22d6da17d9612963a08965c3784a191dc66cec dummy_hcd registers two separate root hubs/buses: a HighSpeed one emulating an EHCI-class controller, and a SuperSpeed one emulating an xHCI-class controller. usb_submit_urb() rejects SG URBs whose non-final segments are not a multiple of the endpoint maxpacket size, unless the bus has no_sg_constraint set. For SuperSpeed bulk endpoints maxpacket is 1024 bytes; usbtest generates SG lists with varying segment sizes (e.g. 512 bytes) that are valid transfers but not maxpacket-aligned, causing usb_submit_urb to return -EINVAL before the URB reaches the host controller. xHCI-class controllers have no such DMA alignment requirement, so set no_sg_constraint on the SS bus to match. Leave the HS bus unchanged: EHCI-class controllers do have this requirement in hardware, and dummy_hcd's HS roothub is meant to emulate that behaviour, so the constraint should stay enforced there. Suggested-by: Alan Stern <stern@rowland.harvard.edu> Assisted-by: OpenCode:claude-sonnet-5 Signed-off-by: Igor Skalkin <igor.skalkin@oss.qualcomm.com> Acked-by: Alan Stern <stern@rowland.harvard.edu> Link: https://patch.msgid.link/20260812081910.6821-3-igor.skalkin@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
dummy_hcd registers two separate root hubs/buses: a HighSpeed one
emulating an EHCI-class controller, and a SuperSpeed one emulating an
xHCI-class controller.  usb_submit_urb() rejects SG URBs whose
non-final segments are not a multiple of the endpoint maxpacket size,
unless the bus has no_sg_constraint set.

For SuperSpeed bulk endpoints maxpacket is 1024 bytes; usbtest
generates SG lists with varying segment sizes (e.g. 512 bytes) that
are valid transfers but not maxpacket-aligned, causing usb_submit_urb
to return -EINVAL before the URB reaches the host controller.

xHCI-class controllers have no such DMA alignment requirement, so set
no_sg_constraint on the SS bus to match.  Leave the HS bus unchanged:
EHCI-class controllers do have this requirement in hardware, and
dummy_hcd's HS roothub is meant to emulate that behaviour, so the
constraint should stay enforced there.

Suggested-by: Alan Stern <stern@rowland.harvard.edu>
Assisted-by: OpenCode:claude-sonnet-5
Signed-off-by: Igor Skalkin <igor.skalkin@oss.qualcomm.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://patch.msgid.link/20260812081910.6821-3-igor.skalkin@oss.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
usb: gadget: dummy_hcd: fix SuperSpeed ep0 maxpacket 2026-10-18T08:13:27+00:00 Igor Skalkin igor.skalkin@oss.qualcomm.com 2026-08-12T08:19:09+00:00 e68f245bcb1f863aeb8eab617bd06878c078029a For USB_SPEED_SUPER, dummy_hcd sets ep0 maxpacket to 9. That is incorrect for SuperSpeed ep0 and breaks short packet handling in control transfer tests. Set ep0 maxpacket to 512 for SuperSpeed. Fixes: 1cd8fd2887e1 ("usb: gadget: dummy_hcd: add SuperSpeed support") Acked-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Igor Skalkin <igor.skalkin@oss.qualcomm.com> Link: https://patch.msgid.link/20260812081910.6821-2-igor.skalkin@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
For USB_SPEED_SUPER, dummy_hcd sets ep0 maxpacket to 9.
That is incorrect for SuperSpeed ep0 and breaks short packet handling
in control transfer tests.

Set ep0 maxpacket to 512 for SuperSpeed.

Fixes: 1cd8fd2887e1 ("usb: gadget: dummy_hcd: add SuperSpeed support")
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Igor Skalkin <igor.skalkin@oss.qualcomm.com>
Link: https://patch.msgid.link/20260812081910.6821-2-igor.skalkin@oss.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>