The compat version of settimeofday() uses '>' instead of '>=' when
validating tv_usec against USEC_PER_SEC, allowing the value 1000000 to pass
the check. After the subsequent conversion to nanoseconds (tv_nsec *=
NSEC_PER_USEC), this results in tv_nsec == NSEC_PER_SEC, which violates the
timespec invariant that tv_nsec must be strictly less than NSEC_PER_SEC.

The native settimeofday() was already fixed in commit ce4abda5e126 ("time:
Fix off-by-one in settimeofday() usec validation"), but the compat
counterpart was missed.

Fix it by using '>=' to reject tv_usec values outside the valid range [0,
USEC_PER_SEC - 1].

Fixes: 5e0fb1b57bea ("y2038: time: avoid timespec usage in settimeofday()")
Signed-off-by: Wang Yan <wangyan01@kylinos.cn>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260622103348.120255-1-wangyan01@kylinos.cn

A comment in kernel/time/hrtimer.c incorrectly refers to
CONFIG_NOHZ_COMMON instead of CONFIG_NO_HZ_COMMON. Correct it.

Discovered while searching for CONFIG_* symbols referenced in code but
not defined in any Kconfig file.

Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260609034314.25029-1-enelsonmoore@gmail.com

update_rlimit_cpu() converts the RLIMIT_CPU value to nanoseconds with

        u64 nsecs = rlim_new * NSEC_PER_SEC;

On 32-bit kernels both rlim_new (unsigned long) and NSEC_PER_SEC
(1000000000L) are 32-bit, so the multiplication is performed in unsigned
long and truncated for rlim_new > 4 seconds before being widened to u64.

The same file already casts to u64 for the matching computation in
check_process_timers():

        u64 softns = (u64)soft * NSEC_PER_SEC;

As a result, the truncated value is installed into the CPUCLOCK_PROF
expiry cache (nextevt), causing the process CPU timer to be programmed
to fire prematurely for any RLIMIT_CPU soft limit >= 5 seconds. The
actual SIGXCPU/SIGKILL decision in check_process_timers() already casts
to u64 and is therefore correct, so limit enforcement is not broken;
only the expiry-cache programming is wrong. Apply the same cast here so
both paths convert rlim_cur identically.

64-bit kernels are unaffected.

Fixes: 858cf3a8c599 ("timers/itimer: Convert internal cputime_t units to nsec")
Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260616112017.1681372-1-zhanxusheng@xiaomi.com

Commit f24df84cbe05 ("time/jiffies: Register jiffies clocksource before
usage") moved the jiffies clocksource registration into
clocksource_default_clock(), so that it is registered lazily on the first
call. __clocksource_register() acquires clocksource_mutex, but the first
caller is timekeeping_init(), which invokes clocksource_default_clock()
while holding tk_core.lock, a raw spinlock.

Acquiring a sleeping mutex while holding a raw spinlock is invalid.

The default clocksource only has to be registered before
tk_setup_internals() consumes its mult/shift/maxadj. Neither
clocksource_default_clock(), the ->enable() callback, nor the registration
itself need tk_core.lock, so fetch and enable the clock before acquiring
the lock. This preserves the "register before usage" ordering while
keeping clocksource_mutex out of the raw spinlock section.

clocksource_default_clock() has a second caller,
clocksource_done_booting(), which invokes it with clocksource_mutex already
held. That path avoids a recursive lock because timekeeping_init() has
already run and set cs_jiffies_registered, so the registration is skipped
there. This change does not alter that; it only fixes the invalid wait
context in timekeeping_init().

Fixes: f24df84cbe05 ("time/jiffies: Register jiffies clocksource before usage")
Signed-off-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reported-by: Breno Leitao <leitao@debian.org>
Reported-by: Oleg Nesterov <oleg@redhat.com>
Reviewed-by: Breno Leitao <leitao@debian.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260616070914.65818-1-mikhail.v.gavrilov@gmail.com

Pull vdso updates from Thomas Gleixner:

 - Remove the redundant CONFIG_GENERIC_TIME_VSYSCALL after converting
   the remaining users over.

 - Rework and sanitize the MIPS VDSO handling, so it does not handle the
   time related VDSO if there is no VDSO capable clocksource available.
   Also stop mapping VDSO data pages unconditionally even if there is no
   usage possible.

* tag 'timers-vdso-2026-06-13' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip:
  MIPS: VDSO: Fold MIPS_CLOCK_VSYSCALL into MIPS_GENERIC_GETTIMEOFDAY
  MIPS: VDSO: Gate microMIPS restriction on GCC version
  MIPS: VDSO: Fold MIPS_DISABLE_VDSO into MIPS_GENERIC_GETTIMEOFDAY
  clocksource/drivers/mips-gic-timer: Only use VDSO_CLOCKMODE_GIC when it is a available
  MIPS: csrc-r4k: Only use VDSO_CLOCKMODE_R4K when it is a available
  MIPS: VDSO: Only map the data pages when the vDSO is used
  MIPS: Introduce Kconfig MIPS_GENERIC_GETTIMEOFDAY
  vdso/datastore: Always provide symbol declarations
  MAINTAINERS: Add include/linux/vdso_datastore.h to vDSO block
  vdso/gettimeofday: Rename __arch_get_vdso_u_timens_data()
  vdso/treewide: Drop GENERIC_TIME_VSYSCALL
  vdso/vsyscall: Gate update_vsyscall() behind CONFIG_GENERIC_GETTIMEOFDAY
  riscv: vdso: Drop CONFIG_GENERIC_TIME_VSYSCALL guard around syscall fallbacks

Pull timekeeping updates from Thomas Gleixner:
 "Updates for NTP/timekeeping and PTP:

   - Expand timekeeping snapshot mechanisms

     The various snapshot functions are mostly used for PTP to collect
     "atomic" snapshots of various involved clocks.

     They lack support for the recently introduced AUX clocks and do not
     provide the underlying counter value (e.g. TSC) to user space.
     Exposing the counter value snapshot allows for better control and
     steering.

     Convert the hard wired ktime_get_snapshot() to take a clock ID,
     which allows the caller to select the clock ID to be captured along
     with CLOCK_MONONOTONIC_RAW. Additionally capture the underlying
     hardware counter value and the clock source ID of the counter.

     Expand the hardware based snapshot capture where devices provide a
     mechanism to snapshot the hardware PTP clock and the system counter
     (usually via PCI/PTM) to support AUX clocks and also provide the
     captured counter value back to the caller and not only the clock
     timestamps derived from it.

   - Add a new optional read_snapshot() callback to clocksources

     That is required to capture atomic snapshots from clocksources
     which are derived from TSC with a scaling mechanism (e.g. Hyper-V,
     KVMclock).

     The value pair is handed back in the snapshot structure to the
     callers, so they can do the necessary correlations in a more
     precise way.

  This touches usage sites of the affected functions and data structure
  all over the tree, but stays fully backwards compatible for the
  existing user space exposed interfaces. New PTP IOCTLs will provide
  access to the extended functionality in later kernel versions"

* tag 'timers-ptp-2026-06-13' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip: (28 commits)
  ptp: vmclock: Use hw_cycles from snapshot for precise TSC pairing
  x86/kvmclock: Implement read_snapshot() for kvmclock clocksource
  clocksource/hyperv: Implement read_snapshot() for TSC page clocksource
  timekeeping: Add clocksource read_snapshot() method and hw_cycles to snapshot
  ptp: Switch to ktime_get_snapshot_id() for pre/post timestamps
  timekeeping: Add support for AUX clock cross timestamping
  timekeeping: Remove system_device_crosststamp::sys_realtime
  ALSA: hda/common: Use system_device_crosststamp::sys_systime
  wifi: iwlwifi: Use system_device_crosststamp::sys_systime
  ptp: Use system_device_crosststamp::sys_systime
  timekeeping: Prepare for cross timestamps on arbitrary clock IDs
  timekeeping: Remove ktime_get_snapshot()
  virtio_rtc: Use provided clock ID for history snapshot
  net/mlx5: Use provided clock ID for history snapshot
  igc: Use provided clock ID for history snapshot
  ice/ptp: Use provided clock ID for history snapshot
  wifi: iwlwifi: Adopt PTP cross timestamps to core changes
  timekeeping: Add CLOCK ID to system_device_crosststamp
  timekeeping: Add system_counterval_t to struct system_device_crosststamp
  timekeeping: Add CLOCK_AUX support for ktime_get_snapshot_id()
  ...

Pull NOHZ updates from Thomas Gleixner:

 - Fix a long standing TOCTOU in get_cpu_sleep_time_us()

 - Make the CPU offline NOHZ handling more robust by disabling NOHZ on
   the outgoing CPU early instead of creating unneeded state which needs
   to be undone.

 - Unify idle CPU time accounting instead of having two different
   accounting mechanisms. These two different mechanisms are not really
   independent, but the different properties can in the worst case cause
   that gloabl idle time can be observed going backwards.

 - Consolidate the idle/iowait time retrieval interfaces instead of
   converting back and forth between them.

 - Make idle interrupt time accounting more robust. The original code
   assumes that interrupt time accouting is enabled and therefore stops
   elapsing idle time while an interrupt is handled in NOHZ dyntick
   state. That assumption is not correct as interrupt time accounting
   can be disabled at compile and runtime.

 - Fix an accounting error between dyntick idle time and dyntick idle
   steal time. The stolen time is not accounted and therefore idle time
   becomes inaccurate. The stolen time is now accounted after the fact
   as there is no way to predict the steal time upfront.

* tag 'timers-nohz-2026-06-13' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip:
  sched/cputime: Handle dyntick-idle steal time correctly
  sched/cputime: Handle idle irqtime gracefully
  sched/cputime: Provide get_cpu_[idle|iowait]_time_us() off-case
  tick/sched: Consolidate idle time fetching APIs
  tick/sched: Account tickless idle cputime only when tick is stopped
  tick/sched: Remove unused fields
  tick/sched: Move dyntick-idle cputime accounting to cputime code
  tick/sched: Remove nohz disabled special case in cputime fetch
  tick/sched: Unify idle cputime accounting
  s390/time: Prepare to stop elapsing in dynticks-idle
  powerpc/time: Prepare to stop elapsing in dynticks-idle
  sched/cputime: Correctly support generic vtime idle time
  sched/cputime: Remove superfluous and error prone kcpustat_field() parameter
  sched/idle: Handle offlining first in idle loop
  tick/sched: Fix TOCTOU in nohz idle time fetch

Pull timer core updates from Thomas Gleixner:
 "Updates for the time/timer core subsystem:

   - Harden the user space controllable hrtimer interfaces further to
     protect against unpriviledged DoS attempts by arming timers in the
     past.

   - Add per-capacity hierarchies to the timer migration code to prevent
     timer migration accross different capacity domains. This code has
     been disabled last minute as there is a pathological problem with
     SoCs which advertise a larger number of capacity domains. The
     problem is under investigation and the code won't be active before
     v7.3, but that turned out to be less intrusive than a full revert
     as it preserves the preparatory steps and allows people to work on
     the final resolution

   - Export time namespace functionality as a recent user can be built
     as a module.

   - Initialize the jiffies clocksource before using it. The recent
     hardening against time moving backward requires that the related
     members of struct clocksource have been initialized, otherwise it
     clamps the readout to 0, which makes time stand sill and causes
     boot delays.

   - Fix a more than twenty year old PID reference count leak in an
     error path of the POSIX CPU timer code.

   - The usual small fixes, improvements and cleanups all over the
     place"

* tag 'timers-core-2026-06-13' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip: (31 commits)
  posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path
  time/jiffies: Register jiffies clocksource before usage
  timers/migration: Temporarily disable per capacity hierarchies
  timers/migration: Turn tmigr_hierarchy level_list into a flexible array
  timers/migration: Deactivate per-capacity hierarchies under nohz_full
  timers/migration: Fix hotplug migrator selection target on asymetric capacity machines
  ntsync: Honour caller's time namespace for absolute MONOTONIC timeouts
  time/namespace: Export init_time_ns and do_timens_ktime_to_host()
  timers/migration: Update stale @online doc to @available
  timers: Fix flseep() typo in kernel-doc comment
  hrtimer: Fix the bogus return type of __hrtimer_start_range_ns()
  hrtimer: Return ktime_t from hrtimer_get_next_event()/hrtimer_next_event_without()
  clocksource: Clean up clocksource_update_freq() functions
  alarmtimer: Remove stale return description from alarm_handle_timer()
  selftests/posix_timers: Use CLOCK_THREAD_CPUTIME_ID for ITIMER_PROF measurements
  scripts/timers: Add timer_migration_tree.py
  timers/migration: Handle capacity in connect tracepoints
  timers/migration: Split per-capacity hierarchies
  timers/migration: Track CPUs in a hierarchy
  timers/migration: Abstract out hierarchy to prepare for CPU capacity awareness
  ...

Pull clocksource updates from Thomas Gleixner:
 "Updates for clocksource/clockevent drivers:

   - Add devm helpers for clocksources, which allows to simplify driver
     teardown and probe failure handling.

   - More module conversion work

   - Update the support for the ARM EL2 virtual timer including the
     required ACPI changes.

   - Add clockevent and clocksource support for the TI Dual Mode Timer

   - Fix the support for multiple watchdog instances in the TEGRA186
     driver

   - Add D1 timer support to the SUN5I driver

   - The usual devicetree updates, cleanups and small fixes all over the
     place"

* tag 'timers-clocksource-2026-06-13' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip: (24 commits)
  clocksource: move NXP timer selection to drivers/clocksource
  clocksource/drivers/timer-tegra186: Reserve and service a kernel watchdog
  clocksource/drivers/timer-tegra186: Register all accessible watchdog timers
  clocksource/drivers/timer-tegra186: Correct num_wdts for Tegra186 and Tegra234
  clocksource/drivers/timer-tegra186: Fix support for multiple watchdog instances
  clocksource/drivers/timer-ti-dm: Add clockevent support
  clocksource/drivers/timer-ti-dm: Add clocksource support
  clocksource/drivers/timer-ti-dm: Fix property name in comment
  dt-bindings: timer: arm,arch_timer: Fix requirements for interrupt description
  clocksource/drivers/arm_arch_timer: Default to EL2 virtual timer when running VHE
  ACPI: GTDT: Parse information related to the EL2 virtual timer
  ACPI: GTDT: Account for GTDTv3 size when walking the platform timer descriptors
  clocksource: Add devm_clocksource_register_*() helpers
  clocksource/drivers/sun5i: Add D1 hstimer support
  dt-bindings: timer: allwinner,sun5i-a13-hstimer: add H616 and D1
  dt-bindings: timer: Add StarFive JHB100 clint
  dt-bindings: timer: renesas,rz-mtu3: document RZ/{T2H,N2H}
  dt-bindings: timer: renesas,rz-mtu3: Remove TCIU8 interrupt
  dt-bindings: timer: Remove sifive,fine-ctr-bits property
  clocksource/drivers/timer-of: Make the code compatible with modules
  ...

In do_cpu_nanosleep(), posix_cpu_timer_create() takes a pid reference
via get_pid() and stores it in timer.it.cpu.pid. If the subsequent
posix_cpu_timer_set() call fails, the function returns immediately
without calling posix_cpu_timer_del() to release the pid reference,
causing a leak.

Fix it by calling posix_cpu_timer_del() before the unlock-and-return
on the error path, consistent with the other exit paths in the same
function.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: WenTao Liang <vulab@iscas.ac.cn>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260611161738.97043-1-vulab@iscas.ac.cn