7.2.11-rc1 review

PATCH In review Greg Kroah-Hartman 9 participants 291 messages Oct 13 – Oct 14 Page 3 of 3

Subsystems (2)

Stable branch RISC-V

lore

Share & tools

lore

Greg Kroah-Hartman

author maintainer

2026-10-13 11:58 UTC #275 lore raw

PATCH 274/281 drm/vc4: Fix binner slot allocation failing on an idle GPU

In reply to Greg Kroah-Hartman

7.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Maíra Canal <[email protected]>

[ Upstream commit cca01232d94adcb10f7c8c5bb8ce072b045fcb58 ]

A job's binner slots are returned to bin_alloc_used by vc4_complete_exec(), which runs from the job_done workqueue, but the seqno vc4_v3d_get_bin_slot() waits on is incremented earlier, in the function vc4_irq_finish_render_job(). Therefore, a waiter can wake, retry, and still find the pool full because the worker has not run. By then, the job might have left the render_job_list, so no seqno remains to wait on and the allocation fails returning -ENOMEM.

This scenario can be reproduced on a Raspberry Pi 3 by using a burst of small jobs (e.g. Piglit's quick_gl suite), with userspace seeing a rejected submit for a pool about to become free.

Note that the slots are held from validation until the render completes, so the pool can also be exhausted by jobs still queued on bin_job_list, leaving render_job_list empty and nothing to wait on.

Release the slots from the FRDONE handler and wait on the pool instead of on one job's seqno. This bounds the wait to the actual resource. Also, by claiming the slot inside the wait condition, another submit is unable to take the slot between the wakeup and the retry. vc4_complete_exec() keeps clearing the slots for jobs that never completed, and now wakes the waiters too.

Note that the wait takes a deadline, since the two callers need different ones. The submit path is a user task and can be interrupted, so it waits without one. On the other hand, vc4_overflow_mem_work() runs on a worker and never sees a signal, so it needs a deadline. During a reset, vc4_irq_disable() masks V3D_DRIVER_IRQS before draining the worker, and with those masked nothing can release a slot. This deadlocks: the worker would wait for slots that only the reset can free, while the reset waits in cancel_work_sync() for the worker.

Fixes 553c942f8b2c ("drm/vc4: Allow using more than 256MB of CMA memory.")

Reviewed-by Iago Toral Quiroga <[email protected]>

Link https://patch.msgid.link/[email protected] open here

Signed-off-by Maíra Canal <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/gpu/drm/vc4/vc4_drv.h      |  2 +-
 drivers/gpu/drm/vc4/vc4_gem.c      |  8 +++++-
 drivers/gpu/drm/vc4/vc4_irq.c      |  6 +++-
 drivers/gpu/drm/vc4/vc4_v3d.c      | 44 ++++++++++++++----------------
 drivers/gpu/drm/vc4/vc4_validate.c |  2 +-
 5 files changed, 34 insertions(+), 28 deletions(-)

drivers/gpu/drm/vc4/vc4_drv.h +1 -1

index 0f5958c1e6b60..b0e82c2dc1bae 100644
@@ -1051,7 +1051,7 @@ void vc4_plane_async_set_fb(struct drm_plane *plane,
 /* vc4_v3d.c */
 extern struct platform_driver vc4_v3d_driver;
 extern const struct of_device_id vc4_v3d_dt_match[];
-int vc4_v3d_get_bin_slot(struct vc4_dev *vc4);
+int vc4_v3d_get_bin_slot(struct vc4_dev *vc4, long timeout);
 int vc4_v3d_bin_bo_get(struct vc4_dev *vc4, bool *used);
 void vc4_v3d_bin_bo_put(struct vc4_dev *vc4);
 int vc4_v3d_pm_get(struct vc4_dev *vc4);

drivers/gpu/drm/vc4/vc4_gem.c +7 -1

index e231c906709c1..6ee4bd77d4331 100644
@@ -877,11 +877,17 @@ vc4_complete_exec(struct drm_device *dev, struct vc4_exec_info *exec)
 		drm_gem_object_put(&bo->base.base);
 	}
 
-	/* Free up the allocation of any bin slots we used. */
+	/* Free up the allocation of any bin slots we used. Jobs that ran to
+	 * completion had their slots released in vc4_irq_finish_render_job().
+	 * Only jobs that never completed still have slots to be released here.
+	 */
 	spin_lock_irqsave(&vc4->job_lock, irqflags);
 	vc4->bin_alloc_used &= ~exec->bin_slots;
 	spin_unlock_irqrestore(&vc4->job_lock, irqflags);
 
+	/* Let anyone waiting on the binner pool retry. */
+	wake_up_all(&vc4->job_wait_queue);
+
 	/* Release the reference on the binner BO if needed. */
 	if (exec->bin_bo_used)
 		vc4_v3d_bin_bo_put(vc4);

drivers/gpu/drm/vc4/vc4_irq.c +5 -1

index 98a8db7200917..dc10d3a4d90f2 100644
@@ -74,7 +74,7 @@ vc4_overflow_mem_work(struct work_struct *work)
 
 	bo = vc4->bin_bo;
 
-	bin_bo_slot = vc4_v3d_get_bin_slot(vc4);
+	bin_bo_slot = vc4_v3d_get_bin_slot(vc4, msecs_to_jiffies(500));
 	if (bin_bo_slot < 0) {
 		drm_err(&vc4->base, "Couldn't allocate binner overflow mem\n");
 		goto complete;

@@ -165,6 +165,10 @@ vc4_irq_finish_render_job(struct drm_device *dev)
 	trace_vc4_rcl_end_irq(dev, exec->seqno);
 
 	vc4->finished_seqno++;
+
+	vc4->bin_alloc_used &= ~exec->bin_slots;
+	exec->bin_slots = 0;
+
 	list_move_tail(&exec->head, &vc4->job_done_list);
 
 	nextbin = vc4_first_bin_job(vc4);

drivers/gpu/drm/vc4/vc4_v3d.c +20 ~~-24~~

66 lines not on this page · raw message

drivers/gpu/drm/vc4/vc4_validate.c +1 -1

index d2a65c968b1f9..565227657b43b 100644
@@ -402,7 +402,7 @@ validate_tile_binning_config(VALIDATE_ARGS)
 		return -EINVAL;
 	}
 
-	bin_slot = vc4_v3d_get_bin_slot(vc4);
+	bin_slot = vc4_v3d_get_bin_slot(vc4, MAX_SCHEDULE_TIMEOUT);
 	if (bin_slot < 0) {
 		if (bin_slot != -EINTR && bin_slot != -ERESTARTSYS) {
 			drm_err(dev, "Failed to allocate binner memory: %d\n",

Signature · 1 line

2.53.0

Greg Kroah-Hartman

author maintainer

2026-10-13 11:59 UTC #276 lore raw

PATCH 275/281 sched_ext: Generate qseq from a per-task counter

In reply to Greg Kroah-Hartman

7.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Kuba Piecuch <[email protected]>

commit e6ac89b8b1c12e9104df45a14a26e2dfa96ded06 upstream.

finish_dispatch() uses the qseq embedded in p->scx.ops_state to tell whether the QUEUED instance of a task it's about to claim is the one scx_bpf_dsq_insert() saw. qseq is generated from rq->scx.ops_qseq, but the counters of different rqs are independent, so if a task is dequeued and re-enqueued on a different rq between scx_bpf_dsq_insert() and finish_dispatch(), the new QUEUED instance can end up with the same qseq as the old one:

CPU X CPU Z
----- -----
enqueue p on rq A, qseq = N
ops.dispatch()
scx_bpf_dsq_insert(p)
records qseq N
sched_setaffinity(p)
dequeue p from rq A enqueue p on rq B, qseq = N
finish_dispatch(p, N)
qseq matches, p is claimed

The claim itself is still atomic so the core stays consistent, but an insert issued for a previous QUEUED instance gets applied to a new one which the BPF scheduler has just received through ops.enqueue(). This breaks the guarantee that dispatches targeting a stale instance are ignored.

Generate qseq from a per-task counter, p->scx.ops_qseq, instead so that consecutive QUEUED instances of a task never share a qseq regardless of which rq they're on. The counter is only updated in scx_do_enqueue_task() with the task's rq locked, so no additional synchronization is needed, and it fits in an existing hole in struct sched_ext_entity on 64bit. Remove the now unused rq->scx.ops_qseq.

Never generate qseq 0. NONE and DISPATCHING don't carry a qseq, so scx_bpf_dsq_insert() on a task in either state records 0. With a per-task counter, every task's first QUEUED instance would otherwise get qseq 0 and could be claimed by such an insert. Wrap the counter where the QSEQ field wraps so that it can't reach a value that shifts to 0 on 32bit either.

Fixes f0e1a0643a59 ("sched_ext: Implement BPF extensible scheduler class")

Cc [email protected] # v6.12+

Assisted-by Claude:claude-opus-5.5

Signed-off-by Kuba Piecuch <[email protected]>

Signed-off-by Tejun Heo <[email protected]>

[ jpiecuch: 7.2.y lacks runnable_cpu in sched_ext_entity, so ops_qseq goes
after selected_cpu; adjust context in scx_rq and the dump_line() CPU line ]

Signed-off-by Kuba Piecuch <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 include/linux/sched/ext.h   |    1 +
 kernel/sched/ext/ext.c      |   15 ++++++++++-----
 kernel/sched/ext/internal.h |    5 +++++
 kernel/sched/sched.h        |    1 -
 4 files changed, 16 insertions(+), 6 deletions(-)

include/linux/sched/ext.h +1 -0

@@ -198,6 +198,7 @@ struct sched_ext_entity {
 	s32			sticky_cpu;
 	s32			holding_cpu;
 	s32			selected_cpu;
+	u32			ops_qseq;	/* protected by rq lock */
 	struct task_struct	*kf_tasks[2];	/* see SCX_CALL_OP_TASK() */
 
 	struct list_head	runnable_node;	/* rq->scx.runnable_list */

kernel/sched/ext/ext.c +10 -5

@@ -1953,8 +1953,14 @@ static void do_enqueue_task(struct rq *r
 	if (unlikely(!SCX_HAS_OP(sch, enqueue)))
 		goto global;
 
-	/* DSQ bypass didn't trigger, enqueue on the BPF scheduler */
-	qseq = rq->scx.ops_qseq++ << SCX_OPSS_QSEQ_SHIFT;
+	/*
+	 * DSQ bypass didn't trigger, enqueue on the BPF scheduler. Wrap the
+	 * per-task qseq counter where the QSEQ field wraps and skip 0, which is
+	 * what scx_bpf_dsq_insert() records for a task in NONE or DISPATCHING.
+	 */
+	p->scx.ops_qseq = ((p->scx.ops_qseq + 1) &
+			   (SCX_OPSS_QSEQ_MASK >> SCX_OPSS_QSEQ_SHIFT)) ?: 1;
+	qseq = (unsigned long)p->scx.ops_qseq << SCX_OPSS_QSEQ_SHIFT;
 
 	WARN_ON_ONCE(atomic_long_read(&p->scx.ops_state) != SCX_OPSS_NONE);
 	atomic_long_set(&p->scx.ops_state, SCX_OPSS_QUEUEING | qseq);

@@ -6690,10 +6696,9 @@ static void scx_dump_cpu(struct scx_sche
 	seq_buf_init(&ns, buf, avail);
 
 	dump_newline(&ns);
-	dump_line(&ns, "CPU %-4d: nr_run=%u flags=0x%x cpu_rel=%d ops_qseq=%lu ksync=%lu",
+	dump_line(&ns, "CPU %-4d: nr_run=%u flags=0x%x cpu_rel=%d ksync=%lu",
 		  cpu, rq->scx.nr_running, rq->scx.flags,
-		  rq->scx.cpu_released, rq->scx.ops_qseq,
-		  rq->scx.kick_sync);
+		  rq->scx.cpu_released, rq->scx.kick_sync);
 	dump_line(&ns, "          curr=%s[%d] class=%ps",
 		  rq->curr->comm, rq->curr->pid,
 		  rq->curr->sched_class);

kernel/sched/ext/internal.h +5 -0

@@ -1508,6 +1508,11 @@ enum scx_ops_state {
 	 * dequeue/requeue, the dispatcher can tell whether it still has a claim
 	 * on the task being dispatched.
 	 *
+	 * QSEQ is generated from the per-task p->scx.ops_qseq counter so that
+	 * it doesn't repeat across QUEUED instances of the same task even if
+	 * the task moves between rqs. 0 is never used as a valid QSEQ since
+	 * NONE and DISPATCHING map to this value.
+	 *
 	 * As some 32bit archs can't do 64bit store_release/load_acquire,
 	 * p->scx.ops_state is atomic_long_t which leaves 30 bits for QSEQ on
 	 * 32bit machines. The dispatch race window QSEQ protects is very narrow

kernel/sched/sched.h +0 -1

@@ -795,7 +795,6 @@ struct scx_rq {
 	struct scx_dispatch_q	local_dsq;
 	struct list_head	runnable_list;		/* runnable tasks on this rq */
 	struct list_head	ddsp_deferred_locals;	/* deferred ddsps from enq */
-	unsigned long		ops_qseq;
 	u64			extra_enq_flags;	/* see move_task_to_local_dsq() */
 	u32			nr_running;
 	u32			cpuperf_target;		/* [0, SCHED_CAPACITY_SCALE] */

Greg Kroah-Hartman

author maintainer

2026-10-13 11:59 UTC #277 lore raw

PATCH 276/281 sched_ext: Call ops.dequeue() when a task arrives on a remote local DSQ

In reply to Greg Kroah-Hartman

7.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Kuba Piecuch <[email protected]>

commit af701b8d3238b9eb7cd450b0491300452c700bf5 upstream.

When a task in the BPF scheduler's custody is moved to another CPU's local DSQ, ops.dequeue() is only called once the task is picked for execution, from set_next_task_scx() with SCX_DEQ_CORE_SCHED_EXEC, even though no core-sched pick took place. It should instead be called without flags when the task is inserted into the destination DSQ, as it is for same-rq dispatches.

move_remote_task_to_local_dsq() sets p->scx.sticky_cpu across the migration so that deactivate_task() on the source rq doesn't end custody. Since commit b75aaea24c9f ("sched_ext: Properly mark SCX-internal migrations via sticky_cpu"), enqueue_task_scx() only clears it after inserting the task, so task_leave_custody() still sees the migration in progress and skips the custody exit.

Clear p->scx.sticky_cpu as soon as enqueue_task_scx() has read it, as was done before that commit. The source side is unaffected.

Fixes ebf1ccff79c4 ("sched_ext: Fix ops.dequeue() semantics")

Cc [email protected] # 7.1.x: 18d62044cda7: sched_ext: Preserve rq tracking across local DSQ dispatch

Cc [email protected] # 7.1.x

Reviewed-by Andrea Righi <[email protected]>

Assisted-by Claude:claude-opus-5.5

Signed-off-by Kuba Piecuch <[email protected]>

Signed-off-by Tejun Heo <[email protected]>

(cherry picked from commit af701b8d3238b9eb7cd450b0491300452c700bf5)

[ jpiecuch: resolved context conflict, 7.2.y still names the function
do_enqueue_task() rather than scx_do_enqueue_task() ]

Signed-off-by Kuba Piecuch <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 kernel/sched/ext/ext.c |   10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

kernel/sched/ext/ext.c +7 -3

@@ -2051,6 +2051,13 @@ static void enqueue_task_scx(struct rq *
 	u64 enq_flags = core_enq_flags | rq->scx.extra_enq_flags;
 
 	/*
+	 * An SCX-internal migration ends on arrival. Clear sticky_cpu so @p can
+	 * leave custody when inserted into the destination DSQ.
+	 */
+	if (sticky_cpu >= 0)
+		p->scx.sticky_cpu = -1;
+
+	/*
 	 * SCX_RQ_IN_WAKEUP promises a task_woken_scx() call once this enqueue
 	 * returns. Only the core's wakeup path delivers one. The flags stashed
 	 * for a remote activation may carry the wakeup bit without it.

@@ -2088,9 +2095,6 @@ static void enqueue_task_scx(struct rq *
 		dl_server_start(&rq->ext_server);
 
 	do_enqueue_task(rq, p, enq_flags, sticky_cpu);
-
-	if (sticky_cpu >= 0)
-		p->scx.sticky_cpu = -1;
 out:
 	rq->scx.flags &= ~SCX_RQ_IN_WAKEUP;

Greg Kroah-Hartman

author maintainer

2026-10-13 11:59 UTC #278 lore raw

PATCH 277/281 drm/amd/display: Dont replace a sink mode that shares the native totals

In reply to Greg Kroah-Hartman

7.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Adrian Betschart <[email protected]>

commit 54c998c55fc9cbc391b350d67b86e0c2a0748f1a upstream.

decide_crtc_timing_for_drm_display_mode() copies the native mode's CRTC timing into the requested mode when clock, htotal and vtotal match. That is meant for the modes amdgpu inserts itself:
amdgpu_dm_create_common_mode() duplicates the native mode and changes only hdisplay and vdisplay, so those are sent with the native timing and scaled.

A sink can also offer a real mode with the same clock and totals as its native mode. CTA-861 VIC 102 (4096x2160@60) and VIC 97 (3840x2160@60) both use 594 MHz and 4400x2250. With 3840x2160@60 as the preferred mode, a 4096x2160@60 request goes out with the 3840x2160 timing and the framebuffer scaled into it (dst 3840x2025 at y=67), while the AVI InfoFrame still carries VIC 102. A JVC projector then reports 3840x2160 and shows a corrupted right edge. 4096x2160@24, whose totals differ, is sent and displayed correctly.

Inserted modes keep the native sync positions; a real mode with its own active width does not. Compare those too, so only inserted modes are patched.

Fixes 4562236b3bc0 ("drm/amd/dc: Add dc display driver (v2)")

Signed-off-by Adrian Betschart <[email protected]>

Assisted-by Claude-Code:claude-opus-5-5

Tested-by Dan Wheeler <[email protected]>

Reviewed-by Roman Li <[email protected]>

Signed-off-by Alex Deucher <[email protected]>

(cherry picked from commit 22f9a2da101c37f821cd00954f81dc598754f4d5)

Cc [email protected]

[ Adrian: this tree keeps the function in amdgpu_dm.c; dropped the KUnit
test, its file does not exist here. ]

Signed-off-by Adrian Betschart <[email protected]>

Assisted-by Claude-Code:claude-opus-5-5

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +6 -1

@@ -7260,10 +7260,15 @@ decide_crtc_timing_for_drm_display_mode(
 					const struct drm_display_mode *native_mode,
 					bool scale_enabled)
 {
+	/* Inserted modes copy the native sync; a sink mode with equal totals may not */
 	if (scale_enabled || (
 	    native_mode->clock == drm_mode->clock &&
 	    native_mode->htotal == drm_mode->htotal &&
-	    native_mode->vtotal == drm_mode->vtotal)) {
+	    native_mode->vtotal == drm_mode->vtotal &&
+	    native_mode->hsync_start == drm_mode->hsync_start &&
+	    native_mode->hsync_end == drm_mode->hsync_end &&
+	    native_mode->vsync_start == drm_mode->vsync_start &&
+	    native_mode->vsync_end == drm_mode->vsync_end)) {
 		if (native_mode->crtc_clock)
 			copy_crtc_timing_for_drm_display_mode(native_mode, drm_mode);
 	} else {

Greg Kroah-Hartman

author maintainer

2026-10-13 11:59 UTC #279 lore raw

PATCH 278/281 io_uring/memmap: account the pages a compound region really uses

In reply to Greg Kroah-Hartman

7.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Ali Ahmet Memis <[email protected]>

[ Upstream commit f12f0234cc14886bcfd53ffb7c8df4216dad51f1 ]

io_mem_alloc_compound() allocates get_order(size) pages, which rounds a region size that is not a power of two up to the next order. The pages past the region are part of the same allocation and cannot be used for anything else, but io_create_region() accounts reg->size >> PAGE_SHIFT, so they are never charged against RLIMIT_MEMLOCK. For a ring with 4096 SQ entries and the default CQ size the region is 37 pages while the allocation is 64.

Account the tail pages together with the region, and fall back to the exact sized bulk allocation when they do not fit the limit, so a user close to their limit still gets the region rather than an error. io_free_region() gives the same amount back, the compound case being the one that set IO_REGION_F_SINGLE_REF.

Counting how many 4096 entry rings an unprivileged user can create under a given RLIMIT_MEMLOCK, before and after:

	limit (pages)	before	after
	256		2	2
	300		2	2
	350		3	2
	400		3	3
	512		5	4

Five rings under a 512 page limit really pin 640 pages.

Fixes dfbbfbf19187 ("io_uring: introduce concept of memory regions")

Link https://lore.kernel.org/all/[email protected]/ open here

Signed-off-by Ali Ahmet Memis <[email protected]>

Link https://patch.msgid.link/[email protected] open here

Signed-off-by Jens Axboe <[email protected]>

Stable-dep-of: b59cabf9b4ac ("io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK")

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 io_uring/memmap.c |   37 ++++++++++++++++++++++++++++++-------
 1 file changed, 30 insertions(+), 7 deletions(-)

io_uring/memmap.c +30 -7

@@ -16,8 +16,10 @@
 #include "zcrx.h"
 
 static bool io_mem_alloc_compound(struct page **pages, int nr_pages,
-				  size_t size, gfp_t gfp)
+				  size_t size, gfp_t gfp,
+				  struct user_struct *user)
 {
+	unsigned long nr_compound, extra;
 	struct page *page;
 	int i, order;

@@ -27,9 +29,22 @@ static bool io_mem_alloc_compound(struct
 	else if (order)
 		gfp |= __GFP_COMP;
 
+	/*
+	 * get_order() rounds a non power of two size up, so the allocation
+	 * can hold more pages than the region exposes. Account those too,
+	 * and leave the compound allocation alone if they do not fit.
+	 */
+	nr_compound = 1UL << order;
+	extra = nr_compound - nr_pages;
+	if (extra && user && __io_account_mem(user, extra))
+		return false;
+
 	page = alloc_pages(gfp, order);
-	if (!page)
+	if (!page) {
+		if (extra && user)
+			__io_unaccount_mem(user, extra);
 		return false;
+	}
 
 	for (i = 0; i < nr_pages; i++)
 		pages[i] = page + i;

@@ -105,8 +120,15 @@ void io_free_region(struct user_struct *
 	}
 	if ((mr->flags & IO_REGION_F_VMAP) && mr->ptr)
 		vunmap(mr->ptr);
-	if (mr->nr_pages && user)
-		__io_unaccount_mem(user, mr->nr_pages);
+	if (mr->nr_pages && user) {
+		unsigned long nr_accounted = mr->nr_pages;
+
+		/* a compound region was accounted for the whole allocation */
+		if (mr->flags & IO_REGION_F_SINGLE_REF)
+			nr_accounted = 1UL << get_order(io_region_size(mr));
+
+		__io_unaccount_mem(user, nr_accounted);
+	}
 
 	memset(mr, 0, sizeof(*mr));
 }

@@ -151,7 +173,8 @@ static int io_region_pin_pages(struct io
 
 static int io_region_allocate_pages(struct io_mapped_region *mr,
 				    struct io_uring_region_desc *reg,
-				    unsigned long mmap_offset)
+				    unsigned long mmap_offset,
+				    struct user_struct *user)
 {
 	gfp_t gfp = GFP_KERNEL_ACCOUNT | __GFP_ZERO | __GFP_NOWARN;
 	size_t size = io_region_size(mr);

@@ -162,7 +185,7 @@ static int io_region_allocate_pages(stru
 	if (!pages)
 		return -ENOMEM;
 
-	if (io_mem_alloc_compound(pages, mr->nr_pages, size, gfp)) {
+	if (io_mem_alloc_compound(pages, mr->nr_pages, size, gfp, user)) {
 		mr->flags |= IO_REGION_F_SINGLE_REF;
 		goto done;
 	}

@@ -217,7 +240,7 @@ int io_create_region(struct io_ring_ctx
 	if (reg->flags & IORING_MEM_REGION_TYPE_USER)
 		ret = io_region_pin_pages(mr, reg);
 	else
-		ret = io_region_allocate_pages(mr, reg, mmap_offset);
+		ret = io_region_allocate_pages(mr, reg, mmap_offset, ctx->user);
 	if (ret)
 		goto out_free;

Greg Kroah-Hartman

author maintainer

2026-10-13 11:59 UTC #280 lore raw

PATCH 279/281 io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK

In reply to Greg Kroah-Hartman

7.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Hengyu Liang <[email protected]>

[ Upstream commit b59cabf9b4acb65f3f9968087ca0e18010d85076 ]

Commit 8078486e1d53 ("io_uring: use region api for SQ") and commit 81a4058e0cd0 ("io_uring: use region api for CQ") made io_uring_setup() allocate the rings with io_create_region().

However, io_create_region() charges the memory to RLIMIT_MEMLOCK, and the rings had been exempt from that limit since commit 26bfa89e25f4 ("io_uring: place ring SQ/CQ arrays under memcg memory limits"). As of now, a user without CAP_IPC_LOCK gets ENOMEM from io_uring_setup() when their rings exceed the limit, which is 8 MiB by default. PostgreSQL developers have already hit this in their io_uring tests [1].

The issue can be reproduced with a simple liburing program, run as an unprivileged user:

    #include <liburing.h>
    #include <stdio.h>

    int main(void)
    {
            static struct io_uring ring[64];
            int i;

            for (i = 0; i < 64; i++)
                    if (io_uring_queue_init(4096, &ring[i], 0) < 0)
                            break;
            printf("%d rings\n", i);
            return 0;
    }

Before those commits (v6.13), it prints "64 rings". After those commits (v6.14), it prints "21 rings".

This patch makes io_create_region() take the user to charge, and passes no user for the SQ/CQ rings.

Link https://www.postgresql.org/message-id/flat/[email protected] [1]

Fixes 8078486e1d53 ("io_uring: use region api for SQ")

Fixes 81a4058e0cd0 ("io_uring: use region api for CQ")

Cc [email protected]

Signed-off-by Hengyu Liang <[email protected]>

Link https://lore.kernel.org/io-uring/[email protected]/ open here

Signed-off-by Jens Axboe <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 io_uring/io_uring.c |   10 ++++++----
 io_uring/kbuf.c     |    2 +-
 io_uring/memmap.c   |   10 +++++-----
 io_uring/memmap.h   |    2 +-
 io_uring/register.c |   12 +++++++-----
 io_uring/zcrx.c     |    2 +-
 6 files changed, 21 insertions(+), 17 deletions(-)

io_uring/io_uring.c +6 -4

@@ -2077,8 +2077,9 @@ int io_submit_sqes(struct io_ring_ctx *c
 
 static void io_rings_free(struct io_ring_ctx *ctx)
 {
-	io_free_region(ctx->user, &ctx->sq_region);
-	io_free_region(ctx->user, &ctx->ring_region);
+	/* ring memory is not charged to RLIMIT_MEMLOCK, hence no user */
+	io_free_region(NULL, &ctx->sq_region);
+	io_free_region(NULL, &ctx->ring_region);
 	ctx->rings = NULL;
 	RCU_INIT_POINTER(ctx->rings_rcu, NULL);
 	ctx->sq_sqes = NULL;

@@ -2742,7 +2743,8 @@ static __cold int io_allocate_scq_urings
 		rd.user_addr = p->cq_off.user_addr;
 		rd.flags |= IORING_MEM_REGION_TYPE_USER;
 	}
-	ret = io_create_region(ctx, &ctx->ring_region, &rd, IORING_OFF_CQ_RING);
+	/* ring memory is not charged to RLIMIT_MEMLOCK, hence no user */
+	ret = io_create_region(NULL, &ctx->ring_region, &rd, IORING_OFF_CQ_RING);
 	if (ret)
 		return ret;
 	ctx->rings = rings = io_region_get_ptr(&ctx->ring_region);

@@ -2756,7 +2758,7 @@ static __cold int io_allocate_scq_urings
 		rd.user_addr = p->sq_off.user_addr;
 		rd.flags |= IORING_MEM_REGION_TYPE_USER;
 	}
-	ret = io_create_region(ctx, &ctx->sq_region, &rd, IORING_OFF_SQES);
+	ret = io_create_region(NULL, &ctx->sq_region, &rd, IORING_OFF_SQES);
 	if (ret) {
 		io_rings_free(ctx);
 		return ret;

io_uring/kbuf.c +1 -1

@@ -675,7 +675,7 @@ int io_register_pbuf_ring(struct io_ring
 		rd.user_addr = reg.ring_addr;
 		rd.flags |= IORING_MEM_REGION_TYPE_USER;
 	}
-	ret = io_create_region(ctx, &bl->region, &rd, mmap_offset);
+	ret = io_create_region(ctx->user, &bl->region, &rd, mmap_offset);
 	if (ret)
 		goto fail;
 	br = io_region_get_ptr(&bl->region);

io_uring/memmap.c +5 -5

@@ -204,7 +204,7 @@ done:
 	return 0;
 }
 
-int io_create_region(struct io_ring_ctx *ctx, struct io_mapped_region *mr,
+int io_create_region(struct user_struct *user, struct io_mapped_region *mr,
 		     struct io_uring_region_desc *reg,
 		     unsigned long mmap_offset)
 {

@@ -230,8 +230,8 @@ int io_create_region(struct io_ring_ctx
 		return -EOVERFLOW;
 
 	nr_pages = reg->size >> PAGE_SHIFT;
-	if (ctx->user) {
-		ret = __io_account_mem(ctx->user, nr_pages);
+	if (user) {
+		ret = __io_account_mem(user, nr_pages);
 		if (ret)
 			return ret;
 	}

@@ -240,7 +240,7 @@ int io_create_region(struct io_ring_ctx
 	if (reg->flags & IORING_MEM_REGION_TYPE_USER)
 		ret = io_region_pin_pages(mr, reg);
 	else
-		ret = io_region_allocate_pages(mr, reg, mmap_offset, ctx->user);
+		ret = io_region_allocate_pages(mr, reg, mmap_offset, user);
 	if (ret)
 		goto out_free;

@@ -249,7 +249,7 @@ int io_create_region(struct io_ring_ctx
 		goto out_free;
 	return 0;
 out_free:
-	io_free_region(ctx->user, mr);
+	io_free_region(user, mr);
 	return ret;
 }

io_uring/memmap.h +1 -1

@@ -18,7 +18,7 @@ unsigned long io_uring_get_unmapped_area
 int io_uring_mmap(struct file *file, struct vm_area_struct *vma);
 
 void io_free_region(struct user_struct *user, struct io_mapped_region *mr);
-int io_create_region(struct io_ring_ctx *ctx, struct io_mapped_region *mr,
+int io_create_region(struct user_struct *user, struct io_mapped_region *mr,
 		     struct io_uring_region_desc *reg,
 		     unsigned long mmap_offset);

io_uring/register.c +7 -5

@@ -480,8 +480,9 @@ struct io_ring_ctx_rings {
 static void io_register_free_rings(struct io_ring_ctx *ctx,
 				   struct io_ring_ctx_rings *r)
 {
-	io_free_region(ctx->user, &r->sq_region);
-	io_free_region(ctx->user, &r->ring_region);
+	/* ring memory is not charged to RLIMIT_MEMLOCK, hence no user */
+	io_free_region(NULL, &r->sq_region);
+	io_free_region(NULL, &r->ring_region);
 }
 
 #define swap_old(ctx, o, n, field)		\

@@ -529,7 +530,7 @@ static int io_register_resize_rings(stru
 		rd.user_addr = p->cq_off.user_addr;
 		rd.flags |= IORING_MEM_REGION_TYPE_USER;
 	}
-	ret = io_create_region(ctx, &n.ring_region, &rd, IORING_OFF_CQ_RING);
+	ret = io_create_region(NULL, &n.ring_region, &rd, IORING_OFF_CQ_RING);
 	if (ret)
 		return ret;

@@ -559,7 +560,7 @@ static int io_register_resize_rings(stru
 		rd.user_addr = p->sq_off.user_addr;
 		rd.flags |= IORING_MEM_REGION_TYPE_USER;
 	}
-	ret = io_create_region(ctx, &n.sq_region, &rd, IORING_OFF_SQES);
+	ret = io_create_region(NULL, &n.sq_region, &rd, IORING_OFF_SQES);
 	if (ret) {
 		io_register_free_rings(ctx, &n);
 		return ret;

@@ -730,7 +731,8 @@ static int io_register_mem_region(struct
 	    !(ctx->flags & IORING_SETUP_R_DISABLED))
 		return -EINVAL;
 
-	ret = io_create_region(ctx, &region, &rd, IORING_MAP_OFF_PARAM_REGION);
+	ret = io_create_region(ctx->user, &region, &rd,
+			       IORING_MAP_OFF_PARAM_REGION);
 	if (ret)
 		return ret;
 	if (copy_to_user(rd_uptr, &rd, sizeof(rd))) {

io_uring/zcrx.c +1 -1

@@ -398,7 +398,7 @@ static int io_allocate_rbuf_ring(struct
 	mmap_offset = IORING_MAP_OFF_ZCRX_REGION;
 	mmap_offset += (u64)id << IORING_OFF_ZCRX_SHIFT;
 
-	ret = io_create_region(ctx, &ifq->rq_region, rd, mmap_offset);
+	ret = io_create_region(ctx->user, &ifq->rq_region, rd, mmap_offset);
 	if (ret < 0)
 		return ret;

Greg Kroah-Hartman

author maintainer

2026-10-13 11:59 UTC #281 lore raw

PATCH 280/281 io_uring/kbuf: dont charge provided buffer rings to RLIMIT_MEMLOCK

In reply to Greg Kroah-Hartman

7.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: Jens Axboe <[email protected]>

[ Upstream commit cde56daf4b93f474dc256dbcc5205035223ae6f5 ]

Just like with the SQ and CQ rings, the provided buffer rings were also not charged against the memlock limit prior to the below mentioned commit. Restore that behavior.

Fixes ef62de3c4ad5 ("io_uring/kbuf: use region api for pbuf rings")

Reported-by Hengyu Liang <[email protected]>

Cc [email protected]

Tested-by Hengyu Liang <[email protected]>

Signed-off-by Jens Axboe <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
Depends on <[email protected]>

 io_uring/kbuf.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

io_uring/kbuf.c +3 -3

@@ -458,7 +458,7 @@ static int io_remove_buffers_legacy(stru
 static void io_put_bl(struct io_ring_ctx *ctx, struct io_buffer_list *bl)
 {
 	if (bl->flags & IOBL_BUF_RING)
-		io_free_region(ctx->user, &bl->region);
+		io_free_region(NULL, &bl->region);
 	else
 		io_remove_buffers_legacy(ctx, bl, -1U);

@@ -675,7 +675,7 @@ int io_register_pbuf_ring(struct io_ring
 		rd.user_addr = reg.ring_addr;
 		rd.flags |= IORING_MEM_REGION_TYPE_USER;
 	}
-	ret = io_create_region(ctx->user, &bl->region, &rd, mmap_offset);
+	ret = io_create_region(NULL, &bl->region, &rd, mmap_offset);
 	if (ret)
 		goto fail;
 	br = io_region_get_ptr(&bl->region);

@@ -708,7 +708,7 @@ int io_register_pbuf_ring(struct io_ring
 	if (!ret)
 		return 0;
 fail:
-	io_free_region(ctx->user, &bl->region);
+	io_free_region(NULL, &bl->region);
 	kfree(bl);
 	return ret;
 }

Greg Kroah-Hartman

author maintainer

2026-10-13 11:59 UTC #282 lore raw

PATCH 281/281 mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge

In reply to Greg Kroah-Hartman

7.2-stable review patch. If anyone has any objections, please let me know.

------------------

From: "Lorenzo Stoakes (ARM)" <[email protected]>

[ Upstream commit 838bb60dc21553e32df90f2f3bac5b905376e7aa ]

Patch series "mm/mremap: fix two issues with MREMAP_DONTUNMAP", v2.

The MREMAP_DONTUNMAP feature is highly unusual in that it permits mremap() operations that keep the original VMA in place.

Historically this has led to a lot of bugs where non-obvious interactions occur between existing mremap() operations and the original VMA.

Commit 397432cab17b ("mm/mremap: account mm->locked_vm correctly for MREMAP_DONTUNMAP") fixed an accidentally introduced bug around mm->locked_vm accounting, but this wasn't the only issue.

And thus history repeats itself, as it turns out that mm->locked_vm accounting is broken by MREMAP_DONTUNMAP yet again by two further cases, and has been broken ever since the feature was introduced.

Both relate to the fact that VMA_LOCKED_BIT is cleared on the source VMA (it has to be as all page tables are moved):

1. If an unfaulted VMA_LOCKONFAULT_BIT anonymous VMA self-merges it clears the VMA_LOCKED_BIT flag and permanently leaks mm->locked_vm pages.

2. If a partial mremap() is performed on a locked VMA there is a leak equal to the number of pages not copied.

(Both for MREMAP_DONTUNMAP operations only)

Both issues can be fixed by treating the source range as distinct from the destination range, which is the definition of what MREMAP_DONTUNMAP does so is appropriate.

In case 1, simply disallow the self-merge, keeping adjacent source and destination VMAs distinct.

In case 2, split the source range ahead of time if the VMA is mlock()'d, so accounting is always correct.

Both changes were tested locally and confirmed to fix the issues.

For the purposes of a backport, the fixes are kept distinct, a follow-up series can add self-tests.

This patch (of 2):

The MREMAP_DONTUNMAP feature is highly unusual in that it permits mremap() operations that keep the original VMA in place.

Historically this has led to a lot of bugs where non-obvious interactions occur between existing mremap() operations and the original VMA.

Fix another of these - self-merge.

Self-merge occurs when a VMA is moved in front of or behind itself and the attributes of the VMA permit such a merge.

Practically this can only happen for unfaulted anonymous VMAs due to the page offset equality requirement for merge:

                           |------------|
                           |            |
                           |            v
        |...........||-----------||...........|
        |           || unfaulted ||           |
        |...........||-----------||...........|
              ^            |
              |            |
              |------------|

This becomes problematic if the VMA is configured by the user to mlock-on-fault, i.e. the VMA_LOCKED_BIT, VMA_LOCKONFAULT_BIT VMA flags are set.

MREMAP_DONTUNMAP clears mlock flags for the source VMA and maintains them for the destination VMA.

Self-merge makes this impossible (there is only one VMA) and incorrectly clears the destination VMA's mlock flags.

This causes a leak in mm->locked_vm as clearing this flag does not decrement the counter and the VMA no longer has VMA_LOCKED_BIT set so it is not decremented on unmap.

Resolve this by simply disallowing a self-merge in this case - the source and destination VMAs are kept distinct and then are able to have distinct mlock() flags.

Update dontunmap_complete() to make the now-redundant self-merge check a VM_WARN_ON_ONCE() instead to guard against future regressions.

Also update the VMA userland tests to reflect the change.

Link https://lore.kernel.org/20260930-fix-dontunmap-partial-self-merge-v2-0-f388985a0f0a@kernel.org open here

Link https://lore.kernel.org/20260930-fix-dontunmap-partial-self-merge-v2-1-f388985a0f0a@kernel.org open here

Fixes e346b3813067 ("mm/mremap: add MREMAP_DONTUNMAP to mremap()")

Signed-off-by Lorenzo Stoakes (ARM) <[email protected]>

Signed-off-by Andrew Morton <[email protected]>

Reviewed-by Pedro Falcato <[email protected]>

Acked-by Kiryl Shutsemau (Meta) <[email protected]>

Reviewed-by Jose A. Perez de Azpillaga <[email protected]>

Tested-by Anirudh Srinivasan <[email protected]>

Cc Liam R. Howlett <[email protected]>

Cc Vlastimil Babka <[email protected]>

Cc Jann Horn <[email protected]>

Cc Brian Geffon <[email protected]>

Cc Minchan Kim <[email protected]>

Cc <[email protected]>

[ sashal: Adapted can_self_merge logic to the inverse faulted_in_anon_vma flag. ]

Signed-off-by Sasha Levin <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 mm/mremap.c                   |    8 ++++++--
 mm/vma.c                      |   17 ++++++++++++++++-
 mm/vma.h                      |    2 +-
 tools/testing/vma/tests/vma.c |    4 ++--
 4 files changed, 25 insertions(+), 6 deletions(-)

mm/mremap.c +6 -2

@@ -1295,7 +1295,8 @@ static int copy_vma_and_data(struct vma_
 	PAGETABLE_MOVE(pmc, NULL, NULL, vrm->addr, vrm->new_addr, vrm->old_len);
 
 	new_vma = copy_vma(&vma, vrm->new_addr, vrm->new_len, new_pgoff,
-			   &pmc.need_rmap_locks);
+			   &pmc.need_rmap_locks,
+			   vrm->flags & MREMAP_DONTUNMAP);
 	if (!new_vma) {
 		vrm_uncharge(vrm);
 		*new_vma_ptr = NULL;

@@ -1355,6 +1356,9 @@ static void dontunmap_complete(struct vm
 	unsigned long old_start = vma->vm_start;
 	unsigned long old_end = vma->vm_end;
 
+	/* Self-merge is disallowed. */
+	VM_WARN_ON_ONCE(new_vma == vma);
+
 	/* We always clear VM_LOCKED[ONFAULT] on the old VMA. */
 	vm_flags_clear(vma, VM_LOCKED_MASK);

@@ -1362,7 +1366,7 @@ static void dontunmap_complete(struct vm
 	 * anon_vma links of the old vma is no longer needed after its page
 	 * table has been moved.
 	 */
-	if (new_vma != vma && start == old_start && end == old_end) {
+	if (start == old_start && end == old_end) {
 		const pgoff_t pgoff_unfaulted = vma->vm_start >> PAGE_SHIFT;
 
 		unlink_anon_vmas(vma);

mm/vma.c +16 -1

@@ -1863,7 +1863,7 @@ static int vma_link(struct mm_struct *mm
  */
 struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
 	unsigned long addr, unsigned long len, pgoff_t pgoff,
-	bool *need_rmap_locks)
+	bool *need_rmap_locks, bool keep_source)
 {
 	struct vm_area_struct *vma = *vmap;
 	unsigned long vma_start = vma->vm_start;

@@ -1896,6 +1896,21 @@ struct vm_area_struct *copy_vma(struct v
 
 	vmg.pgoff = pgoff;
 	vmg.next = vma_iter_next_rewind(&vmi, NULL);
+
+	/*
+	 * If the original VMA is kept (MREMAP_DONTUNMAP), the source and
+	 * destination VMA must be treated distinctly.
+	 *
+	 * A merge violates this, so in this case disallow a self-merge.
+	 */
+	if (!faulted_in_anon_vma && keep_source) {
+		if (vmg.prev == vma)
+			vmg.prev = NULL;
+		if (vmg.next == vma)
+			vmg.next = NULL;
+		faulted_in_anon_vma = true;
+	}
+
 	new_vma = vma_merge_copied_range(&vmg);
 
 	if (new_vma) {

mm/vma.h +1 -1

@@ -449,7 +449,7 @@ void unlink_file_vma_batch_add(struct un
 
 struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
 	unsigned long addr, unsigned long len, pgoff_t pgoff,
-	bool *need_rmap_locks);
+	bool *need_rmap_locks, bool keep_source);
 
 struct anon_vma *find_mergeable_anon_vma(struct vm_area_struct *vma);

tools/testing/vma/tests/vma.c +2 -2

@@ -38,7 +38,7 @@ static bool test_copy_vma(void)
 	/* Move backwards and do not merge. */
 
 	vma = alloc_and_link_vma(&mm, 0x3000, 0x5000, 3, vma_flags);
-	vma_new = copy_vma(&vma, 0, 0x2000, 0, &need_locks);
+	vma_new = copy_vma(&vma, 0, 0x2000, 0, &need_locks, false);
 	ASSERT_NE(vma_new, vma);
 	ASSERT_EQ(vma_new->vm_start, 0);
 	ASSERT_EQ(vma_new->vm_end, 0x2000);

@@ -51,7 +51,7 @@ static bool test_copy_vma(void)
 
 	vma = alloc_and_link_vma(&mm, 0, 0x2000, 0, vma_flags);
 	vma_next = alloc_and_link_vma(&mm, 0x6000, 0x8000, 6, vma_flags);
-	vma_new = copy_vma(&vma, 0x4000, 0x2000, 4, &need_locks);
+	vma_new = copy_vma(&vma, 0x4000, 0x2000, 4, &need_locks, false);
 	vma_assert_attached(vma_new);
 
 	ASSERT_EQ(vma_new, vma_next);

Pavel Machek

2026-10-13 13:23 UTC #283 lore raw

In reply to Greg Kroah-Hartman

Hi!

Quoted 7 lines

There's build failure on risc-v:

https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/jobs/17139155257
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/2942353460

Best regards,
Pavel

arch/riscv/kernel/cpufeature.c: In function 'riscv_clear_hypervisor_csr':
400
13:14:38
arch/riscv/kernel/cpufeature.c:1189:43: error: 'RISCV_ISA_EXT_H' undeclared (first use in this function); did you mean 'RISCV_ISA_EXT_h'? 401
13:14:38
1189 | if (!riscv_has_extension_unlikely(RISCV_ISA_EXT_H))
402
13:14:38

      |                                           ^~~~~~~~~~~~~~~

403
13:14:38
| RISCV_ISA_EXT_h
404
13:14:38
arch/riscv/kernel/cpufeature.c:1189:43: note: each undeclared identifier is reported only once for each function it appears in 405
13:14:38
CC io_uring/kbuf.o
406
13:14:38
make[4]: *** [scripts/Makefile.build:289: arch/riscv/kernel/cpufeature.o] Error 1
407
13:14:38
make[3]: *** [scripts/Makefile.build:550: arch/riscv/kernel] Error 2
408
13:14:38
CC ipc/sem.o
409
13:14:38
make[3]: *** Waiting for unfinished jobs....
410
13:14:38
CC kernel/printk/printk.o
411
13:14:39

Quoted 1,156 lines

Ronald Warsow

Tested-by on the v1 series

2026-10-13 16:30 UTC #284 lore raw

In reply to Greg Kroah-Hartman

kernel build / boot test on x86_64 (Intel).

No regressions here.

Thanks

Tested-by Ronald Warsow <[email protected]>

Miguel Ojeda

Tested-by on the v1 series

2026-10-13 17:03 UTC #285 lore raw

In reply to Greg Kroah-Hartman

Quoted 8 lines · On Tue, 13 Oct 2026 13:35:16 +0200 Greg Kroah-Hartman…

Boot-tested under QEMU for Rust x86_64, arm64; built-tested for loongarch64 and arm32:

Tested-by Miguel Ojeda <[email protected]>

riscv64 fails (as mentioned in the patch).

Thanks!

Cheers,
Miguel

Florian Fainelli

Tested-by on the v1 series

2026-10-13 19:47 UTC #286 lore raw

In reply to Greg Kroah-Hartman

Quoted 9 lines · Greg Kroah-Hartman

Quoted 8 lines

On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:

Tested-by Florian Fainelli <[email protected]>

Signature · 1 line

Florian

Peter Schneider

Tested-by on the v1 series

2026-10-13 21:23 UTC #287 lore raw

In reply to Greg Kroah-Hartman

Am 13.10.2026 um 13:35 schrieb Greg Kroah-Hartman:

Quoted 4 lines

Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697v2 server. No dmesg oddities or regressions found.

Tested-by Peter Schneider <[email protected]>

Beste Grüße,
Peter Schneider

Signature · 8 lines

Climb the mountain not to plant your flag, but to embrace the challenge,
enjoy the air and behold the view. Climb it so you can see the world,
not so the world can see you.                    -- David McCullough Jr.

OpenPGP:  0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244
Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc
https://keys.mailvelope.com/pks/lookup?op=get&[email protected]
https://keys.mailvelope.com/pks/lookup?op=get&[email protected]

Shuah Khan

Tested-by on the v1 series

2026-10-13 22:22 UTC #288 lore raw

In reply to Greg Kroah-Hartman

Quoted 9 lines · Greg Kroah-Hartman

Quoted 9 lines

Compiled and booted on my test system. No dmesg regressions.

Tested-by Shuah Khan <[email protected]>

thanks,
-- Shuah

Justin Forbes

Tested-by on the v1 series

2026-10-13 22:27 UTC #289 lore raw

In reply to Greg Kroah-Hartman

Quoted 9 lines · Greg Kroah-Hartman

Quoted 8 lines

Tested rc1 against the Fedora build system (aarch64, ppc64le, s390x, x86_64), and boot tested x86_64. No regressions noted.

Tested-by Justin M. Forbes <[email protected]>

Brett A C Sheffield

Tested-by on the v1 series

2026-10-14 11:42 UTC #290 lore raw

In reply to Greg Kroah-Hartman

# Librecast Test Results

044/044 [ OK ] liblcrq
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast

CPU/kernel: Linux auntie 7.2.11-rc1-gc24fcd821ad0 #2 SMP PREEMPT_DYNAMIC Wed Oct 14 11:40:20 -00 2026 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux

Tested-by Brett A C Sheffield <[email protected]>