linux-toradex.git/kernel/time, branch master Linux kernel for Apalis and Colibri modules Merge tag 'timers-urgent-2026-09-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2026-09-20T16:41:00+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-09-20T16:41:00+00:00 0a15ba6b0c3adec5842d4252c3e5d2ca935e9948 Pull timer race fixes from Ingo Molnar: - Fix timer signal <-> exec() race, to prevent UAF (Thomas Gleixner) - Clean up POSIX CPU timers right after de_thread(), to prevent UAF (Hyunwoo Kim) - Fix POSIX CPU timers race between expiry and timer_settime(), to prevent UAF (Thomas Gleixner) * tag 'timers-urgent-2026-09-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list exec: Cleanup POSIX timers right after de_thread() signal: Prevent exec() race 
Pull timer race fixes from Ingo Molnar:

 - Fix timer signal <-> exec() race, to prevent UAF (Thomas Gleixner)

 - Clean up POSIX CPU timers right after de_thread(), to prevent UAF
   (Hyunwoo Kim)

 - Fix POSIX CPU timers race between expiry and timer_settime(),
   to prevent UAF (Thomas Gleixner)

* tag 'timers-urgent-2026-09-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list
  exec: Cleanup POSIX timers right after de_thread()
  signal: Prevent exec() race
posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list 2026-09-19T20:56:22+00:00 Thomas Gleixner tglx@kernel.org 2026-09-16T18:48:30+00:00 c21eaa72f02fc6e85621cbe09d303d8fb8bd39cd Kijo analyzed another race in the POSIX CPU timer code: Commit bf635681c906 converted cpu_timer::firing from a tristate value to a boolean. This lost the distinction between "not owned by the firing list" and "still owned, but delivery was canceled". The resulting race is: expiry handler timer_settime() timer_delete() -------------- --------------- -------------- collect timer onto private firing list firing = true observes firing = true firing = false return TIMER_RETRY wait for handler observes firing = false finish deletion unhash and free timer resume list traversal read freed elist.next -> UAF The firing bit is clearly the wrong indicator since that commit. Check whether the timer is queued on the expiry list or not instead. If it is queued clear the firing bit to prevent signal delivery as before and return TIMER_RETRY so the caller unlocks the timer which allows the expiry code to make progress and remove it from the list. Fixes: bf635681c906 ("posix-cpu-timers: Cleanup the firing logic") Reported-by: Kijo Park <red993688@gmail.com> Debugged-by: Kijo Park <red993688@gmail.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Tested-by: Kijo Park <red993688@gmail.com> Reviewed-by: Frederic Weisbecker <frederic@kernel.org> Cc: stable@vger.kernel.org 
Kijo analyzed another race in the POSIX CPU timer code:

Commit bf635681c906 converted cpu_timer::firing from a tristate value to a
boolean. This lost the distinction between "not owned by the firing list"
and "still owned, but delivery was canceled". The resulting race is:

    expiry handler              timer_settime()        timer_delete()
    --------------              ---------------        --------------
    collect timer onto
    private firing list
    firing = true
                                observes firing = true
                                firing = false
                                return TIMER_RETRY
                                wait for handler
                                                       observes firing = false
                                                       finish deletion
                                                       unhash and free timer
    resume list traversal
    read freed elist.next
    -> UAF

The firing bit is clearly the wrong indicator since that commit.

Check whether the timer is queued on the expiry list or not instead. If it
is queued clear the firing bit to prevent signal delivery as before and
return TIMER_RETRY so the caller unlocks the timer which allows the expiry
code to make progress and remove it from the list.

Fixes: bf635681c906 ("posix-cpu-timers: Cleanup the firing logic")
Reported-by: Kijo Park <red993688@gmail.com>
Debugged-by: Kijo Park <red993688@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Tested-by: Kijo Park <red993688@gmail.com>
Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
Cc: stable@vger.kernel.org
sysctl: Fix type truncation in sysctl_msec_to_jiffies 2026-09-15T07:20:58+00:00 Joel Granados joel.granados@kernel.org 2026-09-10T10:22:16+00:00 afdf35cfae0d039a4a6c907fa5d8391f1ef0a0aa Return MAX_JIFFY_OFFSET for all the values truncated when val (u64) is passed to msecs_to_jiffies (u32). This aligns with how very large millisecond values get translated into MAX_JIFFY_OFFSET. Fixes: b96b5c6708ea ("sysctl: Replace do_proc_do{int,ulong,uint}vec with do_proc_vec") Suggested-by: Kuniyuki Iwashima <kuniyu@google.com> Signed-off-by: Joel Granados <joel.granados@kernel.org> 
Return MAX_JIFFY_OFFSET for all the values truncated when val (u64) is
passed to msecs_to_jiffies (u32). This aligns with how very large
millisecond values get translated into MAX_JIFFY_OFFSET.

Fixes: b96b5c6708ea ("sysctl: Replace do_proc_do{int,ulong,uint}vec with do_proc_vec")
Suggested-by: Kuniyuki Iwashima <kuniyu@google.com>
Signed-off-by: Joel Granados <joel.granados@kernel.org>
sysctl: Check range in do_proc_ulong_conv_ms_jiffies 2026-09-15T07:20:58+00:00 Kuniyuki Iwashima kuniyu@google.com 2026-09-05T23:36:31+00:00 318012c56576e09806747f64f89f8f3cde1f999f Add the range check back to do_proc_ulong_conv_ms_jiffies that commit b96b5c6708ea ("sysctl: Replace do_proc_do{int,ulong,uint}vec with do_proc_vec") incorrectly removed. Append "_minmax" to the end of do_proc_ulong_conv_ms_jiffies so it is clear that there should be a range check. Fixes: b96b5c6708ea ("sysctl: Replace do_proc_do{int,ulong,uint}vec with do_proc_vec") Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Signed-off-by: Joel Granados <joel.granados@kernel.org> 
Add the range check back to do_proc_ulong_conv_ms_jiffies that commit
b96b5c6708ea ("sysctl: Replace do_proc_do{int,ulong,uint}vec with
do_proc_vec") incorrectly removed. Append "_minmax" to the end of
do_proc_ulong_conv_ms_jiffies so it is clear that there should be a
range check.

Fixes: b96b5c6708ea ("sysctl: Replace do_proc_do{int,ulong,uint}vec with do_proc_vec")
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Signed-off-by: Joel Granados <joel.granados@kernel.org>
sysctl: Check range in proc_dointvec_ms_jiffies_minmax 2026-09-15T07:20:58+00:00 Kuniyuki Iwashima kuniyu@google.com 2026-09-05T23:36:30+00:00 82431877d837a6c2593efd8e66ba28b35a220ca4 Add the range check to do_proc_int_conv_ms_jiffies_minmax that commit d174174c6776 ("sysctl: replace SYSCTL_INT_CONV_CUSTOM macro with functions") incorrectly removed. Fixes: d174174c6776 ("sysctl: replace SYSCTL_INT_CONV_CUSTOM macro with functions") Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Signed-off-by: Joel Granados <joel.granados@kernel.org> 
Add the range check to do_proc_int_conv_ms_jiffies_minmax that commit
d174174c6776 ("sysctl: replace SYSCTL_INT_CONV_CUSTOM macro with
functions") incorrectly removed.

Fixes: d174174c6776 ("sysctl: replace SYSCTL_INT_CONV_CUSTOM macro with functions")
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Signed-off-by: Joel Granados <joel.granados@kernel.org>
hrtimer: Use hard expiry when updating timers on the same base 2026-09-11T08:15:42+00:00 Andrea Parri parri.andrea@gmail.com 2026-09-10T14:34:42+00:00 c5dcb3aadc18d7b82ba64790721b005d18193d35 Rearming a queued timer with nonzero slack can leave the timerqueue out of order. remove_and_enqueue_same_base() checks the new soft expiry against its neighbours' hard expiries, then stores the new hard expiry in the node without requeueing it. For example, with A at 10 and B at 20, rearming A at 11 with slack 30 passes the neighbour check but leaves A's hard expiry of 41 before B's 20. The same function also caches the soft expiry in base->expires_next when updating or inserting the first timer, giving next-event selection an earlier deadline than the queue head's hard expiry. Set the timer expiry before handling the queue. Use its stored hard expiry for the in-place ordering check and both updates to base->expires_next. The early update is safe because remove_and_enqueue_same_base() runs with base->cpu_base->lock held. The lock keeps the queue stable while hrtimer_can_update_in_place() checks the new expiry against both neighbours. If the check fails, timerqueue_linked_del() removes the node without comparing expiry values before it is reinserted. Fixes: eddffab8282e3 ("hrtimer: Keep track of first expiring timer per clock base") Fixes: 343f2f4dc5425 ("hrtimer: Try to modify timers in place") Signed-off-by: Andrea Parri <parri.andrea@gmail.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Assisted-by: LLM Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260910143442.2018-1-parri.andrea@gmail.com 
Rearming a queued timer with nonzero slack can leave the timerqueue out
of order. remove_and_enqueue_same_base() checks the new soft expiry
against its neighbours' hard expiries, then stores the new hard expiry
in the node without requeueing it.

For example, with A at 10 and B at 20, rearming A at 11 with slack 30
passes the neighbour check but leaves A's hard expiry of 41 before B's
20. The same function also caches the soft expiry in base->expires_next
when updating or inserting the first timer, giving next-event selection
an earlier deadline than the queue head's hard expiry.

Set the timer expiry before handling the queue. Use its stored hard
expiry for the in-place ordering check and both updates to
base->expires_next.

The early update is safe because remove_and_enqueue_same_base() runs
with base->cpu_base->lock held. The lock keeps the queue stable while
hrtimer_can_update_in_place() checks the new expiry against both
neighbours. If the check fails, timerqueue_linked_del() removes the node
without comparing expiry values before it is reinserted.

Fixes: eddffab8282e3 ("hrtimer: Keep track of first expiring timer per clock base")
Fixes: 343f2f4dc5425 ("hrtimer: Try to modify timers in place")
Signed-off-by: Andrea Parri <parri.andrea@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Assisted-by: LLM
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260910143442.2018-1-parri.andrea@gmail.com
tick/broadcast: Plug clockevents replacement race 2026-09-07T09:10:20+00:00 Thomas Gleixner tglx@linutronix.de 2024-08-12T14:19:48+00:00 113a9796effe3376d2ec5aabcca1fef4fef4cd62 朱恺乾 reported and decoded the following race condition when a broadcast device is replaced: CPUA CPUB __tick_broadcast_oneshot_control() bc = tick_broadcast_device.evtdev; tick_install_broadcast_device(dev) clockevents_exchange_device(cur, dev) shutdown(cur); detach(cur); cur->handler = noop; tick_broadcast_device.evtdev = dev; tick_broadcast_set_event(bc, next_event); <- FAIL: arms a detached device. If the original broadcast device has a restricted interrupt affinity mask and the last CPU in that mask goes offline then the BUG() in tick_cleanup_dead_cpu() triggers because the clockevent device is not in detached state. The reason for this is that tick_install_broadcast_device() is not serialized vs. tick broadcast operations. The obvious cure is to serialize tick_install_broadcast_device() with tick_broadcast_lock against a concurrent tick broadcast operation. That requires to split clockevents_exchange_device() into two parts, one which does the exchange, shutdown and detach operation and the other which drops the module reference count. This is required because the module reference cannot be dropped while holding tick_broadcast_lock. Let clockevents_exchange_device() do both operations as before, but let the broadcast device code take the two step approach and do the device exchange under tick_broadcast_lock and drop the module reference count after releasing it. Fixes: f8381cba04ba ("[PATCH] tick-management: broadcast functionality") Reported-by: 朱恺乾 <zhukaiqian@xiaomi.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Bradley Morgan <brads@mainlining.org> Tested-by: 刘术高 <liushugao@xiaomi.com> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/87cymdsu0r.ffs@tglx 
朱恺乾 reported and decoded the following race condition when a broadcast
device is replaced:

CPUA					CPUB
 __tick_broadcast_oneshot_control()
   bc = tick_broadcast_device.evtdev;
					tick_install_broadcast_device(dev)
        				clockevents_exchange_device(cur, dev)
					   shutdown(cur);
					   detach(cur);
					   cur->handler = noop;
					   tick_broadcast_device.evtdev = dev;

  tick_broadcast_set_event(bc, next_event); <- FAIL: arms a detached device.

If the original broadcast device has a restricted interrupt affinity mask
and the last CPU in that mask goes offline then the BUG() in
tick_cleanup_dead_cpu() triggers because the clockevent device is not in
detached state.

The reason for this is that tick_install_broadcast_device() is not
serialized vs. tick broadcast operations.

The obvious cure is to serialize tick_install_broadcast_device() with
tick_broadcast_lock against a concurrent tick broadcast operation.

That requires to split clockevents_exchange_device() into two parts, one
which does the exchange, shutdown and detach operation and the other which
drops the module reference count. This is required because the module
reference cannot be dropped while holding tick_broadcast_lock.

Let clockevents_exchange_device() do both operations as before, but let the
broadcast device code take the two step approach and do the device
exchange under tick_broadcast_lock and drop the module reference count
after releasing it.

Fixes: f8381cba04ba ("[PATCH] tick-management: broadcast functionality")
Reported-by: 朱恺乾 <zhukaiqian@xiaomi.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Bradley Morgan <brads@mainlining.org>
Tested-by: 刘术高 <liushugao@xiaomi.com>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/87cymdsu0r.ffs@tglx
Merge tag 's390-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux 2026-08-23T17:26:44+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-08-23T17:26:44+00:00 66ec24c5d7a047f5b06ee1deb1d0a2869b1791bd Pull s390 updates from Vasily Gorbik: - Add a cpuidle driver with polling and enabled wait states using the existing CPU idle infrastructure and idle governor to improve latency for frequent sleep/wakeup cycles. Remove the obsolete tick delay heuristic and generic arch_needs_cpu() hook. Add the corresponding driver entry to MAINTAINERS - Add kCFI support using the generic support provided by Clang - Enable Clang CONTEXT_ANALYSIS for various architecture code and for char, PCI, CIO and virtio drivers. Add required lock annotations, exclude unsupported mm helpers and remove conditional PCI locking - Fix secure storage access exception handling and reintroduce DCACHE_WORD_ACCESS previously removed as a workaround - Fix cpum_cf perf crashes when CPUs are brought online while per-task events are active. Allocate and remove per-CPU counter data from CPU hotplug callbacks - Fix a deadlock when an s390dbf debug area is unregistered while one of its debugfs files is being written to - Fix MVIY_PERCPU() with binutils older than 2.39, where an assembler macro silently omitted an instruction needed to repair interrupted operations after CPU migration - Remove/replace cond_resched() calls which are no-ops with the supported s390 preemption models - Fix AP queue depth and maximum message length decoding according to the architecture. Current hardware is not affected, but future hardware could report values which were handled incorrectly - Reflect the configured CPU state in cpu_enabled_mask so deconfigured CPUs are not presented as available for onlining - Restore the vDSO GNU_EH_FRAME program header which was lost when the build switched to direct linker invocation, and mark it read-only - Add SCLP action qualifiers used by Spyre for card initialization, recoverable error and telemetry reporting - Move KMSAN interrupt flag helpers out of line to fix -Wstatic-in-inline build warnings - Use level-specific page table entry accessors for hugetlb entries and ptep_get() when accessing crashed kernel memory in kdump - Make forced AP bus rescans killable so that a user process blocked behind an ongoing scan can still be terminated with SIGKILL - Rework pkey ioctl error paths to remove duplicated cleanup code and avoid freeing error pointers - Allow the protected guest SWIOTLB buffer to be allocated outside the first 2GB. Also enable dynamic SWIOTLB growth and the coherent atomic pool fallback to improve I/O behavior when the initial pool is exhausted - Add program check statistics and spinlock contention tracepoints. Increase the lockdep chain capacity to keep lockdep enabled for complex code paths such as btrfs - Simplify IPL, trap and syscall code and remove the obsolete unistd_32.h generation entry * tag 's390-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (59 commits) s390/percpu: Fix MVIY_PERCPU() with older binutils s390/debug: Fix deadlock during unregister s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks s390: Enable CONTEXT_ANALYSIS for various directories s390/mm: Add __context_unsafe() attribute to gmap helper functions s390/mm: Add __context_unsafe() attribute to do_secure_storage_access() s390/sysinfo: Add context analysis attributes s390/irqflags: Add out-of-line definitions of arch_local_irq_*() for KMSAN s390/virtio: Enable CONTEXT_ANALYSIS s390/cio: Enable CONTEXT_ANALYSIS s390/vfio_ccw: Add __must_hold() attribute to vfio_ccw_sch_quiesce() s390/pci: Enable CONTEXT_ANALYSIS s390/pci: Rework __zpci_event_availability() to remove conditional locking s390/pci: Rework __zpci_event_error() to remove conditional locking s390/char: Enable CONTEXT_ANALYSIS s390/con3215: Add __must_hold() attribute to raw3215_make_room() s390/ap: Fix MAPML computation s390/cio: Remove cond_resched() calls s390: Remove cond_resched() calls KVM: s390: Remove cond_resched() calls ... 
Pull s390 updates from Vasily Gorbik:

 - Add a cpuidle driver with polling and enabled wait states using the
   existing CPU idle infrastructure and idle governor to improve latency
   for frequent sleep/wakeup cycles. Remove the obsolete tick delay
   heuristic and generic arch_needs_cpu() hook. Add the corresponding
   driver entry to MAINTAINERS

 - Add kCFI support using the generic support provided by Clang

 - Enable Clang CONTEXT_ANALYSIS for various architecture code and for
   char, PCI, CIO and virtio drivers. Add required lock annotations,
   exclude unsupported mm helpers and remove conditional PCI locking

 - Fix secure storage access exception handling and reintroduce
   DCACHE_WORD_ACCESS previously removed as a workaround

 - Fix cpum_cf perf crashes when CPUs are brought online while per-task
   events are active. Allocate and remove per-CPU counter data from CPU
   hotplug callbacks

 - Fix a deadlock when an s390dbf debug area is unregistered while one
   of its debugfs files is being written to

 - Fix MVIY_PERCPU() with binutils older than 2.39, where an assembler
   macro silently omitted an instruction needed to repair interrupted
   operations after CPU migration

 - Remove/replace cond_resched() calls which are no-ops with the
   supported s390 preemption models

 - Fix AP queue depth and maximum message length decoding according to
   the architecture. Current hardware is not affected, but future
   hardware could report values which were handled incorrectly

 - Reflect the configured CPU state in cpu_enabled_mask so deconfigured
   CPUs are not presented as available for onlining

 - Restore the vDSO GNU_EH_FRAME program header which was lost when the
   build switched to direct linker invocation, and mark it read-only

 - Add SCLP action qualifiers used by Spyre for card initialization,
   recoverable error and telemetry reporting

 - Move KMSAN interrupt flag helpers out of line to fix
   -Wstatic-in-inline build warnings

 - Use level-specific page table entry accessors for hugetlb entries and
   ptep_get() when accessing crashed kernel memory in kdump

 - Make forced AP bus rescans killable so that a user process blocked
   behind an ongoing scan can still be terminated with SIGKILL

 - Rework pkey ioctl error paths to remove duplicated cleanup code and
   avoid freeing error pointers

 - Allow the protected guest SWIOTLB buffer to be allocated outside the
   first 2GB. Also enable dynamic SWIOTLB growth and the coherent atomic
   pool fallback to improve I/O behavior when the initial pool is
   exhausted

 - Add program check statistics and spinlock contention tracepoints.
   Increase the lockdep chain capacity to keep lockdep enabled for
   complex code paths such as btrfs

 - Simplify IPL, trap and syscall code and remove the obsolete
   unistd_32.h generation entry

* tag 's390-7.3-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (59 commits)
  s390/percpu: Fix MVIY_PERCPU() with older binutils
  s390/debug: Fix deadlock during unregister
  s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks
  s390: Enable CONTEXT_ANALYSIS for various directories
  s390/mm: Add __context_unsafe() attribute to gmap helper functions
  s390/mm: Add __context_unsafe() attribute to do_secure_storage_access()
  s390/sysinfo: Add context analysis attributes
  s390/irqflags: Add out-of-line definitions of arch_local_irq_*() for KMSAN
  s390/virtio: Enable CONTEXT_ANALYSIS
  s390/cio: Enable CONTEXT_ANALYSIS
  s390/vfio_ccw: Add __must_hold() attribute to vfio_ccw_sch_quiesce()
  s390/pci: Enable CONTEXT_ANALYSIS
  s390/pci: Rework __zpci_event_availability() to remove conditional locking
  s390/pci: Rework __zpci_event_error() to remove conditional locking
  s390/char: Enable CONTEXT_ANALYSIS
  s390/con3215: Add __must_hold() attribute to raw3215_make_room()
  s390/ap: Fix MAPML computation
  s390/cio: Remove cond_resched() calls
  s390: Remove cond_resched() calls
  KVM: s390: Remove cond_resched() calls
  ...
Merge tags 'core-urgent-2026-08-22' and 'timers-urgent-2026-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2026-08-22T23:11:56+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-08-22T23:11:56+00:00 81ed8bd71e093fa2bed806c3b19bbcbaa3a85080 Pull timer fixes from Ingo Molnar: - Fix timer debugobjects state corruption on CPU offlining (Thomas Gleixner) - Fix ARM get_cycles() regression causing boot hangs on certain ARM configs (Nathan Chancellor) * tag 'core-urgent-2026-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: timer: Keep debugobjects state consistent in migrate_timer_list() * tag 'timers-urgent-2026-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: ARM: Fix get_cycles() after delay_read_timer() conversion 
Pull timer fixes from Ingo Molnar:

 - Fix timer debugobjects state corruption on CPU offlining (Thomas
   Gleixner)

 - Fix ARM get_cycles() regression causing boot hangs on certain ARM
   configs (Nathan Chancellor)

* tag 'core-urgent-2026-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  timer: Keep debugobjects state consistent in migrate_timer_list()

* tag 'timers-urgent-2026-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  ARM: Fix get_cycles() after delay_read_timer() conversion
Merge tag 'sysctl-7.03-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl 2026-08-20T15:46:41+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-08-20T15:46:41+00:00 9d2ed026f031f764e9450ac9aada2f46bc977397 Pull sysctl updates from Joel Granados: - Fix kernel-doc warnings by adjusting in file documentation - Consolidate do_proc_* function into do_proc_vec Consolidate three slightly different implementations of applying a converter on all elements of a vector. Fixes to this function now propagate to the three types. - Replace CONFIG_PROC_SYSCTL with CONFIG_SYSCTL (they were the same) and restrict cad_pid modifications to global root (GLOBAL_ROOT_UID) * tag 'sysctl-7.03-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl: sysctl: remove CONFIG_PROC_SYSCTL, it just mirrors CONFIG_SYSCTL sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[] sysctl: repair some kernel-doc comments sysctl: add Returns: kernel-doc for all functions sysctl: Update API function documentation sysctl: Rename proc_doulongvec_minmax_conv to proc_doulongvec_conv sysctl: Group proc_handler declarations and document sysctl: Replace do_proc_do{int,ulong,uint}vec with do_proc_vec sysctl: Add negp parameter to douintvec converter functions sysctl: Move default converter assignment out of do_proc_dointvec 
Pull sysctl updates from Joel Granados:

 - Fix kernel-doc warnings by adjusting in file documentation

 - Consolidate do_proc_* function into do_proc_vec

   Consolidate three slightly different implementations of applying a
   converter on all elements of a vector. Fixes to this function now
   propagate to the three types.

 - Replace CONFIG_PROC_SYSCTL with CONFIG_SYSCTL (they were the same)
   and restrict cad_pid modifications to global root (GLOBAL_ROOT_UID)

* tag 'sysctl-7.03-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl:
  sysctl: remove CONFIG_PROC_SYSCTL, it just mirrors CONFIG_SYSCTL
  sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[]
  sysctl: repair some kernel-doc comments
  sysctl: add Returns: kernel-doc for all functions
  sysctl: Update API function documentation
  sysctl: Rename proc_doulongvec_minmax_conv to proc_doulongvec_conv
  sysctl: Group proc_handler declarations and document
  sysctl: Replace do_proc_do{int,ulong,uint}vec with do_proc_vec
  sysctl: Add negp parameter to douintvec converter functions
  sysctl: Move default converter assignment out of do_proc_dointvec