Merge drm/drm-fixes into drm-misc-fixes

Let's start the 7.3 drm-misc-fixes cycle.

Signed-off-by: Maxime Ripard <mripard@kernel.org>

Merge drm/drm-fixes into drm-misc-fixes

Updating drm-misc-fixes to the state of v7.2.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>

Merge remote-tracking branch 'drm/drm-next' into msm-next-backmerge

Backmerge of drm-next, mainly to pick up dt bindings docs updates to
avoid conflicts.

Signed-off-by: Rob Clark <robin.clark@oss.q

Merge remote-tracking branch 'drm/drm-next' into msm-next-backmerge

Backmerge of drm-next, mainly to pick up dt bindings docs updates to
avoid conflicts.

Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>

show more ...

Merge tag 'mm-stable-2026-08-26-15-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull more MM updates from Andrew Morton:

- "mm/rmap: index MAP_PRIVATE file-backed folios by anonymo

Merge tag 'mm-stable-2026-08-26-15-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull more MM updates from Andrew Morton:

- "mm/rmap: index MAP_PRIVATE file-backed folios by anonymous pgoff"
(Lorenzo Stoakes)

Index MAP_PRIVATE file-backed folios by their anonymous page offset
to resolve confusion around reverse mapping for zeroed and CoW'd
file-backed memory.

Use this new VMA anonymous page offset tracking to eliminate index
conflicts and lay the foundation for scalable CoW performance
improvements.

- "promote mapped executable folios after first usage for MGLRU"
(Baolin Wang)

Make MGLRU's protection of mapped executable file folios more
reliable. Follow the classical LRU's logic, promoting mapped
executable file folios after their first usage to give executable
code a better chance to stay in memory and improve workload
performance.

- "mm: vmscan: fix node reclaim ignoring swappiness parameter" (Ridong
Chen)

Fix per-node proactive reclaim interface's ignoring the swappiness
parameter when CONFIG_MEMCG is disabled by consolidating
sc_swappiness() into a single function that checks
proactive_swappiness regardless of kernel configuration.

- "mm/vmscan: reduce lru_lock contention via vmstat-derived
scan-balance cost" (Usama Arif)

Reduce lru_lock contention in the reclaim path by deriving
scan-balance costs from vmstat counters rather than lock-acquired
producer updates.

Read and decay these cost signals on the reclaim side under a
dedicated per-lruvec lock, reducing total LRU lock wait time by over
60% without impacting scan throughput.

- "zram: fix zram issues reported by sashiko" (Sergey Senozhatsky)

Fix two low-risk zram bugs which Sashiko spotted in drive-by review.

- "Honor XA_FLAGS_ACCOUNT in xas_split_alloc() and charge to folio's
memcg" (Zi Yan)

Fix xas_split_alloc() by enabling target folio memcg charging during
splits and adding the missing __GFP_ACCOUNT flag for proper XArray
node memory accounting.

- "selftests/mm: use pattern matching in .gitignore" (Pratyush Mallick)

Replace hardcoded binary names in selftests/mm/.gitignore with a
generic pattern-matching rule to automatically ignore generated test
files and avoid manual updates when adding new tests.

- "mm/page_ext: remove pgdat_page_ext_init()" (Sang-Heon Jeon)

Make the incompatibility between FLATMEM and NUMA explicit in
mm/Kconfig and remove the unused pgdat_page_ext_init() function.

- "zram: fix zstd error paths and add parameter validation" (Haoqin
Huang)

Clean up zram compression backends by removing redundant error
cleanup, adding parameter and dictionary validation, auto-prefixing
algorithm error logs, and resetting parameters prior to
reinitialization.

- "zram: fix stale scan bounds after reinitialization" (Longlong Xia)

Prevent out-of-bounds slot accesses during concurrent zram resets by
moving table scan bound calculations under dev_lock in
writeback_store() and read_block_state().

- "add anon mTHP collapse test cases" (Baolin Wang)

Extend selftests helper functions to support arbitrary page orders
and add new test cases and options for mTHP collapse in khugepaged.

- "selftests/mm: Handle unsupported and transient test conditions"
(Muhammad Usama Anjum)

Update MM selftests to report a SKIP status instead of a failure when
required kernel or filesystem features are unsupported, while adding
retry logic for transient page migration errors.

- "mm/zswap: Fixes and improves the zswap shrink" (Hao Jia)

Fix the missing zswap global shrinker when CONFIG_MEMCG is disabled
and extend shrink_memcg() to support batch writeback for improved
writeback efficiency.

- "alloc_tag: introduce IOCTL-based filtering for MAP" (Suren
Baghdasaryan)

Introduce an IOCTL-based binary interface for memory allocation
profiling that enables kernel-side filtering before per-CPU counter
aggregation.

This eliminates the text-parsing overhead of /proc/allocinfo and
provides up to a 20x speedup by transferring only filtered allocation
data to userspace.

- "better block swap batching and a different take on swap_ops v5"
(Christoph Hellwig)

Refactor block swap I/O to use swap_iocb for batching instead of
single-bio requests and rebase the swap_ops interface, achieving
faster swap throughput during kernel builds.

- "mm: kmemleak: reduce transient false positives by confirming leaks"
(Catalin Marinas)

Reduce false-positive kmemleak reports by combining two kmemleak
enhancements that add a second confirmation scan and a configurable
minimum unreferenced scan count module parameter.

- "mm: kmemleak: default min_unref_scans to 2 for verbose kernels"
(Breno Leitao)

Auto-scanning kernels can generate false-positive memory leak reports
on single scans, so this patch defaults min_unref_scans to 2 when
CONFIG_DEBUG_KMEMLEAK_VERBOSE is enabled to require a second
confirming scan.

- "swap_ops updates" (Christoph Hellwig)

Batching I/O for synchronous swap devices causes performance
regressions and filesystem-based swap suffers from double-indirection
overhead. This series resolves both issues by reintroducing per-folio
writes for synchronous swap and allowing filesystems to directly
export their own swap_ops.

- "mm/khugepaged: several cleanups" (Nico Pache)

khugepaged accumulated redundant state-checking patterns and outdated
comments following mTHP integration. Introduce dedicated helpers for
PTE validation and event counting while refreshing the internal
documentation.

- "maple_tree: lock checking and clean ups" (Liam Howlett)

Syzbot reports incorrectly blame memory management exit paths for
locking bugs, maple tree erase operations risk allocation failures
without gfp flags and internal documentation lacks clarity.

Improve lock error detection, update docs, fix race and allocation
edge cases and optimize erase allocations using a fallback to
GFP_KERNEL | GFP_NOFAIL.

* tag 'mm-stable-2026-08-26-15-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (172 commits)
selftests/proc: make proc-maps-race work with READ_IMPLIES_EXEC
memcg: move LRU size accounting on reparenting instead of copying it
mm/vmscan: fix comment logic in balance_pgdat
maple_tree: add helper mas_make_walkable()
maple_tree: avoid extra gap calculation
maple_tree: fix argument name in header
maple_tree: change two GFP flags in tests
maple_tree: document erase and allocations better
maple_tree: avoid mas_erase() and mtree_erase() failures
maple_tree: document that erase may use GFP_KERNEL for allocations
maple_tree: catch race in mas_alloc_cyclic()
maple_tree: add bulk parent set helper
maple_tree: micro optimisation of mas_wr_store_type()
maple_tree: optimise mas_wr_node_store() when not in rcu mode
maple_tree: use prefetched value in mas_wr_store_type()
maple_tree: clarify comments on mas_nomem()
maple_tree: drop MAPLE_ALLOC_SLOTS
maple_tree: drop dead code from mas_extend_spanning_null()
maple_tree: documentation fix
maple_tree: add write lock checking with lockdep sequence numbers
...

show more ...

kselftest: alloc_tag: add kselftest for ioctl interface

Introduce a kselftest to verify the new IOCTL-based interface for
/proc/allocinfo. The test covers:

1. Validation of the filename filter.
2.

kselftest: alloc_tag: add kselftest for ioctl interface

Introduce a kselftest to verify the new IOCTL-based interface for
/proc/allocinfo. The test covers:

1. Validation of the filename filter.
2. Validation of the function filter.

The first test validates the functionality of the filename filter. Using
"mm/memory.c" as the candidate filename filter, it retrieves filtered
entries from both procfs and ioctl and matches the first VEC_MAX_ENTRIES
entries.

The second test validates the functionality of the function filter. It
uses "dup_mm" as the candidate function as we do not expect this function
name to change frequently and hence won't be needing to modify this test
often.

Note that both the tests match line no, function name and file name
fields. Bytes allocated and calls are not matched as those values may
change in the time when the data is being read from procfs and ioctl and
hence can lead to false negatives.

[abhishekbapat@google.com: fix a typo in the selftest]
Link: https://lore.kernel.org/e4e49ec4a5960292aeeb9e196526c18dc95228a2.1785867739.git.abhishekbapat@google.com
Closes: https://sashiko.dev/#/patchset/cover.1783532853.git.abhishekbapat@google.com
Link: https://lore.kernel.org/e2a3795677a14aeab249758ba570cd5e98402032.1783532853.git.abhishekbapat@google.com
Signed-off-by: Abhishek Bapat <abhishekbapat@google.com>
Tested-by: Hao Ge <hao.ge@linux.dev>
Acked-by: Hao Ge <hao.ge@linux.dev>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Kent Overstreet <kent.overstreet@linux.dev>
Cc: Sourav Panda <souravpanda@google.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

show more ...

Merge tag 'kvm-riscv-7.3-1' of https://github.com/kvm-riscv/linux into HEAD

KVM/riscv changes for 7.3

- Svadu/Zicfiss/Zicfilp FWFT support for Guest
- Use try_cmpxchg for IMSIC MRIF RMW
- More arch

Merge tag 'kvm-riscv-7.3-1' of https://github.com/kvm-riscv/linux into HEAD

KVM/riscv changes for 7.3

- Svadu/Zicfiss/Zicfilp FWFT support for Guest
- Use try_cmpxchg for IMSIC MRIF RMW
- More arch-specific tracepoints in KVM RISC-V
- Eager Page Splitting for KVM RISC-V
- Optimize hfence request handling for SMP Guests
- Improve dirty log clearing by skipping zero bits in mask
- Guard HFENCE range loops against overflow
- CPU PM notifiers in KVM RISC-V for non-retentive idle states
- Fix kernel-mode vector context save/restore for Guest

show more ...

Merge tag 'mm-stable-2026-08-18-18-39' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull MM updates from Andrew Morton:

- "mm: drop "sub" prefix from various places" (Dev Jain)

pag

Merge tag 'mm-stable-2026-08-18-18-39' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull MM updates from Andrew Morton:

- "mm: drop "sub" prefix from various places" (Dev Jain)

page->folio conversion and a naming cleanup

- "mm/kasan: remove redundant initialization for kasan_flag_write_only"
(Igor Putko)

KASAN cleanup work

- "mm/filemap: reduce unnecessary xarray lookups" (Chi Zhiling)

Small speedup in the pagecaache read code

- "mm/percpu: Fix possible NOFS/NOIO reclaim recursion" (Kaitao Cheng)

Improve the vmalloc code - mainly the avoidance of GFP_KERNEL
allocations when the caller asked for GFP_NOFS or GFP_NOIO

- "mm/kmemleak: avoid soft lockup when scanning task stacks" (Breno
Leitao)

Avoid a soft lockup watchdog trigger from the kmemleak scanning code
in extreme situations

- "mm/page_owner: misc cleanups" (Ye Liu)

Cleanups to the page_owner code. For some reason lots of people have
been working on the page_owner code this cycle.

- "mm: convert to walk_page_range_vma() to eliminate find_vma()"
(Kefeng Wang)

Simplify and accelerate the page walking library function

- "mm/migrate: preparatory cleanups for batch copy and offload"
(Shivank Garg)

Cleanups in the migration code

- "mm/page_owner: add per-fd filter infrastructure for print_mode and
NUMA filtering" (Zhen Ni)

Per-fd filtering to page_owner in order to reduce the sometimes vast
amount of output it can produce

- "mm: Refactor bootmem gigantic hugepage allocation" (Muchun Song)

Fixes and preparatory cleanups around bootmem HugeTLB handling,
sparse initialization ordering, and related vmemmap setup

- "mm/zsmalloc: reduce lock contention in zs_free()" (Wenchao Hao)

Reduce lock contention in zs_free(), which dominates the unmap path
under memory pressure on Android (LMK kills) and on x86 servers
running zswap-heavy workloads.

Up to 1.83x improvement in microbenchmarking.

- "move alloc_tag.c file under mm/" (Suren Baghdasaryan)

- "samples/damon: handle damon_{start,stop}() failures" (SJ Park)

Fix improper handling of damon_start(), damon_stop(), and
damon_call() failures across DAMON sample modules to prevent
potential memory leaks, operation disruptions and use-after-free
bugs

- "mm/damon/sysfs: kobject_del() directories that users can
create/remove" (SJ Park)

Fix delayed sysfs directory removal under DEBUG_KOBJECT_RELEASE
causeing creation failures due to duplicate directory names by adding
missing kobject_del() calls before creating new directories

- "mm: cleanup clear_not_present_full_ptes()" (David Hildenbrand)

Clean up the core pte handling code

- "selftests/damon: misc fixes for test bugs" (Kunwu Chan)

Fix several bugs in the DAMON selftests

- "selftests/damon: fix memcg_path staging handling" (Cheng Nie)

Fix a bug in _damon_sysfs.py for damos_filter memcg_path setup, and
add a test case for it in sysfs.py.

- "selftests/damon: test kdamond refresh_ms" (Ruslan Valiyev)

Selftest coverage for DAMON's refresh_ms sysfs feature by updating
the test control module and verifying that scheme stats update
automatically without manual intervention

- "mm/damon: five misc fixups" (Akinobu Mita)

Miscellaneous DAMON fixups.

- "mm/damon/core: detect internal variation above max_nr_regions/2"
(Jiayuan Chen)

Fix DAMON's region splitting behavior when region counts exceed half
the maximum budget by dynamically scaling down the split fraction as
the limit approaches, preventing large regions from staying un-split,
and add corresponding KUnit test coverage

- "mm: preparatory patches for PMD level swap entries" (Usama Arif)

Refactor and clean up PMD softleaf helpers, call sites, and
architecture flags to lay the groundwork for a follow-up series that
introduces PMD page table swap entries

- "mm/damon: update, optimize, and clean up doc, tests, and code" (SJ
Park)

Update DAMON design and ABI documentation, expands unit and selftest
coverage, optimize damon_commit_target_regions(), and clean up
recently added sysfs interface code for better readability

- "mm/vmpressure: reduce CPU, memory and code overhead on cgroup v2"
(Usama Arif)

Optimize vmpressure() by skipping unnecessary work on cgroup v2 for
userspace event notifications and refactor v1-only eventfd handling
into mm/memcontrol-v1.c to reduce memory overhead and code complexity

- "selftests/mm: refactor pkey helpers and fix mmap error handling"
(Hongfu Li)

Refactor pkeys shared tracing and assertion helpers into a common
file, unify protection key selftests to use consistent diagnostic
logging and assertions, and enforce standardized MAP_FAILED return
checks for mmap() calls across the tests

- "mm/damon: optimize out nr_accesses_bp" (SJ Park)

Replace the error-prone, continuously updated nr_accesses_bp field in
damon_region with an on-demand moving sum function, reducing
structure memory overhead and avoiding state corruption bugs

- "Open HugeTLB allocation routine for more generic use" (Ackerley Tng)

Decouple HugeTLB folio allocation from VMA dependencies by
introducing hugetlb_alloc_folio(), enabling subsystems like
guest_memfd to allocate HugeTLB folios without standard VMA
reservations or pseudo-VMAs

- "mm/damon: provide pseudo moving sum probe_hits" (SJ Park)

Integrate DAMON's probe_hits attribute counter into the pseudo moving
sum infrastructure, enabling real-time, online monitoring without
waiting for full aggregation intervals

- "mm: Some cleanups for page allocator APIs" (Brendan Jackman)

Simplify and refactor the page allocator entry points and flags by
unifying allocation paths, adding internal alloc_flags arguments, and
eliminating redundant __ prefixed alloc_pages variants.

- "Fix incorrect access of hugetlb pte entries" (Dev Jain)

Enforce the consistent use of huge_ptep_get() instead of ptep_get()
for HugeTLB entries and fixes an unaligned address issue in arm64's
huge_ptep_get() implementation

- "mm/damon: validate all parameters in the core" (SJ Park)

Consolidate parameter validation into the DAMON core specifically
within damon_start() and damon_commit_ctx() to centralize error
checking, eliminate caller-side redundant checks and to improve
maintenance efficiency

- "tools/mm/page_owner_sort: fix filtering and cleanup issues" (Yichong
Chen)

Rename is_need() to filter_record() for clearer return semantics, fix
per-record allocation memory leaks and bound output copies in
search_pattern() to address an existing buffer issue

- "memcg: bail out reclaim when memcg is dying" (Jiayuan Chen)

Mitigate a system-wide stall which occurs when a cgroup is removed
while one of its memory control files is doing synchronous reclaim

- "mm/memory-failure: add panic option for unrecoverable pages" (Breno
Leitao)

Introduce an opt-in vm.panic_on_unrecoverable_memory_failure sysctl
that immediately panics the kernel on unrecoverable memory errors in
kernel-owned pages to preserve error context and prevent delayed,
silent data corruption

- "mm/damon: refactor damon_{start,stop,commit}() for simple error
handling" (SJ Park)

Refactor the DAMON core API functions to guarantee that all contexts
are fully stopped when damon_start(), damon_stop(), or damon_commit()
fail, eliminating the need for complex and error-prone caller-side
cleanup code

- "Keep tail page private zero at free and folio split" (Zi Yan)

Add checks to ensure tail_page->private is zero when freeing compound
or high-order pages and when promoting tail pages during large folio
splits. By validating these fields at free and split time, it allows
the removal of redundant private field clearing inside
prep_compound_tail()

- "mm: drop redundant lru_add_drain in anon folio reuse paths" (Barry
Song)

Eliminate redundant lru_add_drain() calls in
wp_can_reuse_anon_folio() and do_swap_page() to reduce LRU lock
contention and system overhead

By validating folio refcounts against the LRU cache before draining
and removing unnecessary drains in the swap path, it achieves up to a
30.5% reduction in drain calls during heavy swap workloads

- "mm: clean up folio LRU and swap declarations" (Jianyue Wu)

Reorganize folio LRU and swap code by relocating page-cluster state
to mm/swap_state.c, renaming mm/swap.c to mm/folio.c, and moving
MM-internal reclaim declarations into mm/internal.h.

- "userfaultfd: working set tracking for VM guest memory" (Kiryl
Shutsemau)

Add userfaultfd support for tracking the working set of VM guest
memory, so a VMM can identify hot pages and reclaim cold ones to
tiered or remote storage

- "mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE (Part 2)" (David
Hildenbrand)

Remove the remaining pieces of CONFIG_HAVE_BOOTMEM_INFO_NODE,
performing some smaller cleanups around freeing of reserved vmemmap
pages on the way.

- "mm/damon: update probe hits for runtime parameter commits" (SJ Park)

Ensure that DAMON's probe_hits attribute counter is properly updated
when monitoring intervals are changed at runtime, matching the
behavior of nr_accesses. To achieve this, it refactors and renames
existing helper functions for shared use, applies the updates to
probe_hits, and handles edge cases in damon_probe_hits_mvsum() to
maintain measurement accuracy.

- "KSM: performance optimizations for rmap_walk_ksm" (xu xin)

Resolve a severe KSM reverse-mapping performance bottleneck where
thousands of split VMAs sharing a single anon_vma cause extended lock
contention.

By adding an interval-filtering check during the rmap walk, it
reduces worst-case anon_vma lock hold times from over 500ms down to
under 2ms, preventing application freezes and latency spikes under
memory pressure.

- "mm: split a couple of headers from internal.h" (Mike Rapoport)

Split declarations related to mm_init, memblock, vmalloc and sparse
into new headers

- "KSM: use linear_page_index in collect_procs_ksm()" (xu xin)

Apply the interval tree optimization from rmap_walk_ksm() to
collect_procs_ksm() to avoid iterating over non-matching VMAs during
KSM memory error handling.

It hoists loop-invariant address initialization and restricts the
anon_vma_interval_tree_foreach walk to a targeted page offset range,
reducing redundant checks and improving lookup efficiency.

- "selftests/mm: avoid false failures in hugetlb and KSM tests" (Sayali
Patil)

Fix issues in the hugetlb and KSM MM selftest categories that can
report failures when the prerequisites for the tests are not
satisfied

- "mm/damon: introduce data attributes only monitoring" (SJ Park)

Introduce attribute-weighted region management in DAMON, allowing
users to prioritize specific data attributes (such as page sizes or
cgroups) over or instead of access monitoring.

By assigning weights to attribute probes, DAMON can completely
disable access tracking and adjust monitoring regions based on
weighted probe-hit counters to optimize monitoring quality for
attribute-focused workloads.

- "mm/hmm: Add mmap lock-drop support for userfaultfd-backed mappings"
(Stanislav Kinsburskii)

Extend hmm_range_fault() to support userfaultfd-backed regions by
allowing the mmap lock to be dropped during fault handling via a new
hmm_range_fault_locked() helper.

By accepting a locked pointer and signaling retry status when lock
release occurs, it enables page fault resolution in userfaultfd
regions while preserving backward compatibility for existing callers.

- "mm: make VMA page offset handling more consistent" (Lorenzo Stoakes)

Clean up and standardize how vma->vm_pgoff is accessed and
manipulated across file-backed and anonymous mappings in the kernel

It introduces dedicated helper functions such as vma_start_pgoff(),
vma_end_pgoff(), vma_set_pgoff() and linear_page_delta() while
renaming rmap interval tree helpers to better reflect their
functionality.

These changes establish a cleaner foundation for future work that
will unify virtual page offset indexing for all anonymous and CoW'd
folios.

- "mm: handle device-private PMDs in walk callbacks" (Usama Arif)

Address kernel panics and state corruption caused by MM walk
callbacks reaching non-present device-private PMD swap entries
created during HMM migrations

It ensures that functions which acquire pmd_trans_huge_lock()
properly recognize device-private PMDs instead of assuming a present
THP or a standard migration entry.

- "mm/rmap: Refactor try_to_unmap_one" (Dev Jain)

Refactor try_to_unmap_one by modularizing Hugetlb,
anonymous-lazyfree, and anonymous-swapbacked logic into dedicated
functions, laying the structural groundwork for batched anonymous
large folio unmapping.

- "Docs/ABI/damon: sysfs ABI document fixes and additions" (Song Hu)

Fix typos and fills in missing entries in the DAMON sysfs ABI
document

- "dax/kmem: atomic whole-device hotplug via sysfs" (Gregory Price)

Introduce an atomic sysfs state attribute and supporting DAX/MM
infrastructure to prevent userland races when offlining and removing
entire memory regions

By adding an unplugged state alongside standard online modes, it
enables whole-device atomic hotplug control while preserving backward
compatibility.

- "mm: convert more vm_flags_t users to vma_flags_t" (Lorenzo Stoakes)

Continue transitioning the kernel from the deprecated vm_flags_t type
to vma_flags_t across core memory management infrastructure.

It replaces legacy type usage in core functions such as do_mmap(),
unmapped area allocation, mm->def_vma_flags, and VMA operations like
mlock, mprotect, and mremap.

- "Two small patches to clean up mm/mm_slot.h" (xu xin)

Refactor mm_slot.h by introducing mm_slot_remove() to unify duplicate
slot deletion sequences in khugepaged and KSM. It also adds code
documentation explaining why mm_slot_lookup and mm_slot_insert must
remain as preprocessor macros rather than static inline functions.

- "mm/damon/core: hide core-private struct fields" (SJ Park)

Clean up DAMON core structures by consistently marking internal-only
fields with private: comment tags to prevent improper direct access
from outer layers.

It enforces encapsulation across core structures including
damon_region, damon_target, and damon_ctx and updates DAMON_SYSFS to
interact through approved access APIs instead of exposing raw struct
members.

- "mm/damon: unurgent fixes for infinite loop, NULL de-ref and races"
(SJ Park)

Address potential infinite loops, NULL dereferences, and race
conditions identified in DAMON

It fixes an infinite loop triggered by extreme user configurations, a
NULL pointer dereference within unit tests and minor monitoring
accuracy degradation caused by subtle runtime races.

- "mm/page_alloc: fixes for free_pages_nolock() on RT/UP" (Brendan
Jackman)

Fix an NMI safety flaw in __free_frozen_pages() where freeing pages
on non-SMP or PREEMPT_RT kernels can bypass can_spin_trylock() checks
via non-PCP or isolated migration paths.

It also resolves potential kernel crashes and privilege escalation
risks triggered when BPF tracing runs in NMI context alongside memory
hotplug or large allocation frees.

- "mm/page_alloc: couple of followups for recent cleanups" (Brendan
Jackman)

Clean up and update page allocator nomenclature, documentation, and
debug assertions.

It aligns internal FPI_ flags with the public "nolock" naming
convention, removes outdated internal implementation details from
high-level page allocator comments, and eliminates obsolete
VM_BUG_ON() assertions in allocation paths.

- "mm/mseal: further cleanups" (Lorenzo Stoakes)

Refactor and simplify the mseal implementation by clarifying API
boundaries and removing unnecessary code complexity.

It replaces generic do_mseal() usage outside the syscall with a
dedicated mseal_mmap_page_zero() helper for MMAP_PAGE_ZERO,
eliminates mm_struct parameters to enforce that sealing applies only
to current->mm, and streamlines overall logic and comments with no
functional changes intended.

- "mm/vmscan: fix swappiness=max and clean up per-node proactive
reclaim" (Ridong Chen)

Resolve reclaim behavior bugs and clean up function parameters across
memory reclaim paths

It fixes swappiness=max in both standard reclaim and MGLRU so
unswappable anonymous memory no longer falls back to evicting page
cache, ensures reclaim_store() returns accurate error codes instead
of collapsing all failures into -EAGAIN, and removes the obsolete
gfp_mask parameter from __node_reclaim().

- "mm: mincore: misc cleanups" (Kefeng Wang)

Clean up and simplifies the mincore code. Most importantly, it
removes the historical special behavior that always reports VM_PFNMAP
pages as non-resident.

- "mm/huge_memory: drop dead split helper variants" (Kiryl Shutsemau)

Two trivial cleanups in the folio split API

- "mm/damon: fix uninitialized DAMOS field and kunit exec expectation
bugs" (SJ Park)

Resolve minor operational and testing bugs in DAMON identified by
Sashiko. It initializes the damos->last_applied field to prevent
occasional efficiency degradation and fixes invalid memory accesses
in DAMON KUnit tests during test failure handling.

- "cleanup for stable_page_flags()" (Jinjiang Tu)

Clean up and refactor stable_page_flags() used by /proc/kpageflags
without altering functionality.

It uses BIT_ULL() to prevent shift-overflow warnings on 64-bit flag
bits, converts folio-specific flag checks to standard folio_test_*()
helpers, and removes redundant CONFIG_PAGE_IDLE_FLAG handling.

- "Batch unmap of uffd-wp file folios" (Dev Jain)

Extend batched folio unmapping support to file folios within
userfaultfd write-protect (uffd-wp) VMAs by adding batching
capabilities to pte_install_uffd_wp_if_needed().

This removes special-case restrictions on uffd-wp VMAs in
try_to_unmap_one(), significantly simplifying the function's control
flow and complexity.

- "mm/early_ioremap: clarify and clean up early_ioremap_reset()"
(Sang-Heon Jeon)

Clarify and clean up the architecture-specific usage of
__late_set_fixmap() and __late_clear_fixmap() after
early_ioremap_reset()

It adds explicit documentation regarding when early_ioremap_reset()
must be called and removes redundant macro definitions and reset
calls in the RISC-V and ARM64 architectures.

- "mm: fix reclaim storms in defrag_mode" (Johannes Weiner)

Address severe performance regressions, swap storms, and spurious
OOMs caused by vm.defrag_mode=1 under high memory pressure in Meta
production

It updates the page allocator slowpath so non-movable allocation
requests actively trigger direct reclaim and direct compaction at
pageblock_order scale, allowing them to claim whole pageblocks rather
than spinning unproductively.

- "zram: lockmap tweaks" (Sebastian Siewior)

Optimize and fix lockdep tracking for zram devices by consolidating
per-entry lockmaps and isolate lock classes across multiple instances

This reduces memory overhead by replacing per-entry lockdep_map
instances with a single map per struct zram, and assigns a dynamic
lock_class_key to each instance to prevent false deadlock reports
when different zram devices are backed by distinct filesystems.

* tag 'mm-stable-2026-08-18-18-39' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (501 commits)
selftests/mm: thuge-gen: fix test_shmget() for PAGE_SIZE check
selftests/mm: unpoison pages in memory-failure teardown
mm/shmem: downgrade final i_blocks check in shmem_evict_inode() to pr_warn()
mm/khugepaged: replace mutex_lock/mutex_unlock usage with guard macro
mm/zsmalloc: fix release order of locks in zs_page_migrate()
Documentation: zram: remove sections numbering
ksm: stop iterating VMAs when ksm_test_exit returns true
mm: fold userfaultfd_rwp() to false without CONFIG_ARCH_HAS_PTE_PROTNONE
mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()
zram: use a custom key for each zram object
zram: move lockmap to be per-zram instead per table
selftests/mm: fix gup_longterm EINVAL error message
mm: page_alloc: fix non-movable reclaim storm in defrag_mode
mm: page_alloc: move capture_control to the page allocator
mm: compaction: support non-movable compaction for pageblock requests
mm: page_alloc: __GFP_FS lockdep annotation for direct compaction
hugetlb: evaluate subpool free state while locked
mm/damon: remove trailing semicolons after function definitions
mm/damon/ops-common: prevent migration fallback to non-target nodes
mm/damon: update outdated comment about DAMOS filter handling
...

show more ...

BackMerge tag 'v7.2' into drm-next

Linux 7.2

There was a lot of conflicts this round between fixes and next,
and I'd like to get the merge resolutions that we have in drm-tip.

Signed-off-by: Dave

BackMerge tag 'v7.2' into drm-next

Linux 7.2

There was a lot of conflicts this round between fixes and next,
and I'd like to get the merge resolutions that we have in drm-tip.

Signed-off-by: Dave Airlie <airlied@redhat.com>

show more ...

selftests/dax: add dax/kmem hotplug sysfs regression test

Add a kselftest for the dax/kmem whole-device "state" sysfs attribute
(/sys/bus/dax/devices/daxX.Y/state), which transitions a kmem-backed
d

selftests/dax: add dax/kmem hotplug sysfs regression test

Add a kselftest for the dax/kmem whole-device "state" sysfs attribute
(/sys/bus/dax/devices/daxX.Y/state), which transitions a kmem-backed
dax device between "unplugged", "online" and "online_movable".

The kselftest also includes a test to demonstrate the force-unbind
does not deadlock - but this is destructive (the dax device can never
be rebound), so it only runs when DAX_KMEM_TEST_UNBIND=1 is set.

Provisioning a devdax device and binding it to kmem needs daxctl/ndctl
out of scope for an in-tree selftest. As the test mutates a device's
memory, the operator opts in by naming it in DAX_KMEM_TEST_DEV (or
"auto" to pick the first kmem-bound device); it SKIPs when unset, when
no device is present, or when the memory cannot be freed to a baseline.

When a device is available it validates the interface contract:
- online / online_movable actually add memory (MemTotal grows),
- online is idempotent,
- switching between online types without unplug is rejected,
- unplug removes memory and the reported state is "unplugged"
- invalid input is rejected,
- unplug and unbind tolerate blocks toggled out-of-band through the
per-block memoryX/state interface.

One specific regression test:
online -> unplug -> online_movable -> unplug

Re-online must re-reserve per-range resources so subsequent unplug
actually offlines and removes instead of silently reporting success
while the memory stays online.

Link: https://lore.kernel.org/20260712154505.3564379-11-gourry@gourry.net
Signed-off-by: Gregory Price <gourry@gourry.net>
Cc: Alison Schofield <alison.schofield@intel.com>
Cc: Danilo Krummrich <dakr@kernel.org>
Cc: Dave Jiang <dave.jiang@intel.com>
Cc: David Hildenbrand (Arm) <david@kernel.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Hannes Reinecke <hare@suse.de>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Pankaj Gupta <pankaj.gupta@amd.com>
Cc: "Rafael J. Wysocki" <rafael@kernel.org>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vishal Verma <vishal.l.verma@intel.com>
Cc: Vlastimil Babka <vbabka@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

show more ...

Merge drm/drm-next into drm-xe-next

Sync some i915/display changes

Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>

Merge drm/drm-next into drm-intel-next

Sync with v7.2-rc1.

Signed-off-by: Jani Nikula <jani.nikula@intel.com>

Merge drm/drm-next into drm-misc-next

Backmerging to get drm-misc-next to v7.2-rc1.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>

Merge tag 'v7.2-rc1' into drm-rust-next

Merge v7.2-rc1 into drm-rust-next to start the next cycle.

Devres now requires T: 'static, which conflicts with shmem::Object using
Devres<SGTableMap<T, C>>

Merge tag 'v7.2-rc1' into drm-rust-next

Merge v7.2-rc1 into drm-rust-next to start the next cycle.

Devres now requires T: 'static, which conflicts with shmem::Object using
Devres<SGTableMap<T, C>> without that bound. Resolve by adding 'static
as a supertrait to DriverObject and DeviceContext, which does not
restrict any current use cases since DriverObject is always implemented
on owned, refcounted types and DeviceContext is a sealed marker trait
with only unit-type implementors.

If DriverObject (or DeviceContext) ever becomes lifetime-parameterized
(e.g. via a GAT for TTM backed objects), the 'static supertrait can be
relaxed at that point.

Signed-off-by: Danilo Krummrich <dakr@kernel.org>

show more ...

Merge tag 'v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux into gpio/for-next

Linux 7.2

Merge tag 'timers-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/daniel.lezcano/linux into timers/clocksource

- Use designated initializers for sh_mtu2, sh_cmt, and sh_tmu, and
dro

Merge tag 'timers-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/daniel.lezcano/linux into timers/clocksource

- Use designated initializers for sh_mtu2, sh_cmt, and sh_tmu, and
drop the unused initializer in the platform_device_id table for
sh_mtu2 (Uwe Kleine-König)

- Remove redundant dev_err()/dev_err_probe() messages when
devm_request_*_irq() fails, as the helper already logs an error
message (Pan Chuang)

- Fix a boot hang on Allwinner D1 when a forced minimum delta is used
with the sun4i timer (Felix Yan)

- Fix an IRQ leak in the cpuhp_setup_state() error path by freeing the
IRQ on failure in the NXP PIT driver (WenTao Liang)

- Fix incorrect unmapping of shared MMIO between the clocksource and
clockevent drivers. If one of them fails to initialize, the error
path unmaps the shared MMIO region, leaving the other driver with an
invalid mapping on clps711x (Guangshuo Li)

- Make the samsung_pwm driver compatible with PREEMPT_RT by replacing
regular spinlocks with raw_spinlock_t in atomic contexts (Marek
Szyprowski)

- Use __raw_readl() and __raw_writel() instead of ioread32() and
iowrite32() to support SWAP_IO_SPACE in the rtl-otto driver (Rustam
Adilov)

- Fix a missing clk_disable_unprepare() call in the timer
initialization error path of the Armada driver (Yuho Choi)

Link: https://lore.kernel.org/lkml/75feea31-683d-45a1-87f4-ab045e0152ae@oss.qualcomm.com

show more ...

Merge branch 'next' into for-linus

Prepare input updates for 7.3 merge window.

Merge tag 'v7.2-rc3' into next

Sync up with mainline to pull in stable fixes to avoid merge conflicts.

Merge tag 'vfs-7.3-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull misc vfs updates from Christian Brauner:
"Bigger cleanups:

- The lockref dead-count handling is tidied

Merge tag 'vfs-7.3-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull misc vfs updates from Christian Brauner:
"Bigger cleanups:

- The lockref dead-count handling is tidied up.

The open-coded check for a count below zero as the dead marker
relies on information the caller should not have.

- make put_mnt_ns() leave mounts connected. Destroying a mount
namespace disconnected its mounts from their mount points. So a
file descriptor still open on the parent of a mount point could be
used to peek under it.

Locked mounts were already kept connected to prevent exactly that.
But a mount is only locked when its tree is copied across a user
namespace boundary. So a mount namespace set up by a privileged
component had no locked mounts and its mounts were disconnected.
Passing UMOUNT_CONNECTED keeps every mount connected and prevents
that bug.

- vfs_prepare_mode() passes S_IFDIR for directories. I meant to fix
that ago but didn't get to it. So now someone finally did it.

This kills the exception where the mode could be 0 when a directory
was created whereas every other creation operation passed it
explicitly already.

- move long delayed work for ufs, jffs2, hfsplus, hfs and affs from
the per-cpu system_long_wq to the new unbound system_dfl_long_wq.

None of that work relies on per-cpu state and the work item is
enqueued with queue_delayed_work() whose timer is global anyway. So
it may as well benefit from scheduler task placement.

Smaller fixes and cleanups:

- unlock_buffer() and journal_end_buffer_io_sync() use
clear_and_wake_up_bit()

- the pipe page pools are unified into a single per-pipe pool and the
extra wake_up(rd_wait) is limited to EPOLLET consumers

- eventpoll now computes its timer slack lazily in ep_poll()

- shrink_dcache_for_umount() keeps making progress on busy roots

- excess xarray nodes are freed in clear_inode()

- romfs detects hard link cycles

- the user path of nested backing files is fixed

- pidfd holds exec_update_lock around the namespace ioctl

- non-memcg-aware nr_cached_objects is skipped during memcg slab
shrink

- iomap_write_iter() always returns status

- mangle_path() is renamed to seq_mangle_path()

- inode timestamp accessors are annotated

- new regression test for pipe->poll_usage.

- a few documentation, kernel-doc and selftest fixes"

* tag 'vfs-7.3-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (67 commits)
selftests/namespaces: Fix racy pipe handshake in timens and pidns_separate
selftests/epoll: add a regression test for pipe->poll_usage
pipe: only enable the extra wake_up(rd_wait) for EPOLLET consumers
pidfd: hold exec_update_lock around namespace ioctl
fs: fix user path of nested backing files
fs: remove stale inode_insert5() kernel-doc parameter
fs: fix switch/case indentation in sysfs() syscall
fs: document semantics of kstat::{uid,gid} fields
dcache: keep shrink_dcache_for_umount() making progress on busy roots
seq_file: rename mangle_path to seq_mangle_path
nstree: add/fix struct ns_id_req kernel-doc member fields
dcache: use lockref routines for dead count checks
lockref: tidy up dead count handling
initramfs: fix typo in reserve_initrd_mem comment
fs/pipe: unify the page pools into a single per-pipe pool
fs: annotate inode timestamp accessors
eventpoll: compute timer slack lazily in ep_poll()
selftests/filesystems: add mntns cleanup test
put_mnt_ns(): leave mounts connected
affs: Move long delayed work on system_dfl_long_wq
...

show more ...

Merge tag 'vfs-7.3-rc1.failfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull failfs filesystem from Christian Brauner:
"Add failfs and expose a FD_FAILFS_ROOT sentinel.

This allo

Merge tag 'vfs-7.3-rc1.failfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull failfs filesystem from Christian Brauner:
"Add failfs and expose a FD_FAILFS_ROOT sentinel.

This allows userspace to shed their filesystem state completely. A
process with its root or working directory in failfs must anchor every
path lookup at an explicit file descriptor. Absolute paths, absolute
symlinks and AT_FDCWD-relative lookups simply fail.

Failfs is the counterpart to nullfs. nullfs says adds a permanently
empty, immutable directory whose lookups fail with ENOENT but which
can be opened, read, stat'd and mounted upon. Failfs on the other hand
fails every operation. The root cannot be opened at all. A single
instance is mounted during early boot via kern_mount(), which makes it
logically distinct from every mount namespace.

This is accompanied by a new fchroot() system call which makes
chrooting via a file descriptor a first class concept. It's possible
to chroot into failfs as an unprivileged user provided the task has no
new privileges set"

* tag 'vfs-7.3-rc1.failfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
Documentation: add failfs documentation
selftests/filesystems: add failfs selftests
arch: hookup fchroot() system call
fs: support FD_FAILFS_ROOT in fchroot()
fs: add fchroot()
fs: support FD_FAILFS_ROOT in fchdir()
fs: add failfs

show more ...

Merge tag 'vfs-7.2-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull vfs fixes from Christian Brauner:

- Don't warn when a mount is completed from another user namespace.

Merge tag 'vfs-7.2-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull vfs fixes from Christian Brauner:

- Don't warn when a mount is completed from another user namespace.

fsopen() records the caller's user namespace in fc->user_ns and
hands back an ordinary file descriptor. The task that calls
fsconfig(FSCONFIG_CMD_CREATE) doesn't have to be the one that
created the context, and mount_capable() lets it through as long
as the caller has CAP_SYS_ADMIN over fc->user_ns, which anyone in
an ancestor namespace does. So fc->user_ns != current_user_ns()
is something an unprivileged user can arrange.

Both overlayfs and binfmt_misc WARN_ON() that. Overlayfs already
has the same check as a plain error return in ovl_parse_param().

Drop the WARN_ON() and just refuse. Add selftests for both cases.

- Reject pid allocations through dead ancestor pid namespaces.

Require PIDNS_ADDING in every namespace that will receive the pid
before publishing any of them. That preserves the invariant that
free_pid() never decrements pid_allocated in a namespace whose
child_reaper is no longer live. The existing ENOMEM behavior is
unchanged.

* tag 'vfs-7.2-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
pid: reject allocations through dead ancestor pid namespaces
selftests/filesystems: test completing a context from another user namespace
binfmt_misc: don't warn when the mount is completed from another user namespace
ovl: don't warn when the mount is completed from another user namespace

show more ...

Merge patch series "fs: don't warn when a mount is completed from another user namespace"

Christian Brauner <brauner@kernel.org> says:

fsopen() records the caller's user namespace in fc->user_ns an

Merge patch series "fs: don't warn when a mount is completed from another user namespace"

Christian Brauner <brauner@kernel.org> says:

fsopen() records the caller's user namespace in fc->user_ns and hands back
an ordinary file descriptor. The task that calls fsconfig(CMD_CREATE)
doesn't have to be the one that created the context, and mount_capable()
lets it through as long as the caller has CAP_SYS_ADMIN over fc->user_ns,
which anyone in an ancestor namespace does. So fc->user_ns !=
current_user_ns() is something an unprivileged user can arrange.

Both overlayfs and binfmt_misc WARN_ON() that. They're plain WARN_ON()s, so
it can be done in a loop to taint the kernel and flood the log, and it
panics a machine booted with panic_on_warn. Keep refusing the mount, just
stop warning about it. Overlayfs already spells the same check as a plain
error return in ovl_parse_param() for Opt_override_creds.

And add a selftest for both cases.

* patches from https://patch.msgid.link/20260802-work-fill_super-warn-v1-0-4e987911a39a@kernel.org:
selftests/filesystems: test completing a context from another user namespace
binfmt_misc: don't warn when the mount is completed from another user namespace
ovl: don't warn when the mount is completed from another user namespace

Link: https://patch.msgid.link/20260802-work-fill_super-warn-v1-0-4e987911a39a@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

show more ...

selftests/filesystems: test completing a context from another user namespace

fsopen() records the caller's user namespace in fc->user_ns and hands
back an ordinary file descriptor, so the task that

selftests/filesystems: test completing a context from another user namespace

fsopen() records the caller's user namespace in fc->user_ns and hands
back an ordinary file descriptor, so the task that issues
FSCONFIG_CMD_CREATE need not be the one that created the context.
mount_capable() authorizes that for a caller holding CAP_SYS_ADMIN in an
ancestor of fc->user_ns, which any unprivileged user has over a user
namespace it just created.

binfmt_misc and overlayfs used to WARN_ON() the mismatch. Add a test for
both. Also cover the handover within one user namespace. That is a
supported thing to do and has to keep working.

Link: https://patch.msgid.link/20260802-work-fill_super-warn-v1-3-4e987911a39a@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

show more ...

Merge patch series "put_mnt_ns(): leave mounts connected"

Noah Orlando <Noah.Orlando@deshaw.com> says:

When a mount namespace is destroyed, put_mnt_ns() disconnects its mounts
from their mount poin

Merge patch series "put_mnt_ns(): leave mounts connected"

Noah Orlando <Noah.Orlando@deshaw.com> says:

When a mount namespace is destroyed, put_mnt_ns() disconnects its mounts
from their mount points. A file descriptor still open on the parent of a
mount point can then be used to look under the mount point.

Locked mounts are kept connected to prevent this. However, a mount is
only locked when its tree is copied across a user namespace boundary. A
mount namespace set up by a privileged component has no locked mounts,
so its mounts are disconnected.

Pass UMOUNT_CONNECTED so every mount is kept connected, as locked mounts
already are.

* patches from https://patch.msgid.link/20260706182559.2496448-2-Noah.Orlando@deshaw.com:
selftests/filesystems: add mntns cleanup test
put_mnt_ns(): leave mounts connected

Link: https://patch.msgid.link/20260706182559.2496448-2-Noah.Orlando@deshaw.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

show more ...

selftests/filesystems: add mntns cleanup test

Verify that destroying a mount namespace keeps its mounts connected.

Signed-off-by: Noah Orlando <Noah.Orlando@deshaw.com>
Link: https://patch.msgid.li

selftests/filesystems: add mntns cleanup test

Verify that destroying a mount namespace keeps its mounts connected.

Signed-off-by: Noah Orlando <Noah.Orlando@deshaw.com>
Link: https://patch.msgid.link/20260706182559.2496448-4-Noah.Orlando@deshaw.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

show more ...

Merge patch series "fs: add failfs"

Christian Brauner <brauner@kernel.org> says:

nullfs provides a permanently empty and immutable directory. Lookups
fail with ENOENT. The directory can be opened,

Merge patch series "fs: add failfs"

Christian Brauner <brauner@kernel.org> says:

nullfs provides a permanently empty and immutable directory. Lookups
fail with ENOENT. The directory can be opened, read, stat, mounted upon.
It behaves like nothing is there.

Add its counterpart failfs where the semantics are not "there is
nothing here" but "nothing is supported here". Every operation that
reaches the filesystem fails with EOPNOTSUPP. Even statfs()/fstatfs()
fail so the filesystem cannot be discovered through an fd to it.

EOPNOTSUPP rather than a permission errno keeps that coherent. There
is no permission model in which anything could ever be allowed and
EACCES or EPERM would merely suggest that different credentials might
succeed while EIO would suggest corruption. It also makes hitting the
failfs boundary mostly quite dinstinguishable. A task anchoring its
lookups at real directory file descriptors may be able to tell a failfs
refusal from an ordinary permission failure. I wouldn't go so far as
guaranteeing that but it should mostly work.

The root cannot be opened at all not even with O_PATH. It is never
reached by a lookup in a parent directory. The only way to a path-walk
terminal at the root is a jump through a /proc/<pid>/{root,cwd} magic
link or by mountpoint traversal. The root also refuses
->d_weak_revalidate() which the VFS calls for jumped terminals. That
closes every remaining way to reference it. An O_PATH
open is refused and name_to_handle_at() cannot encode it into a file
handle, and following a magic link into it fails. A plain readlink() of
such a link still works and shows "failfs:/".

There is a single instance of failfs mounted during early boot via
kern_mount() making it logically distinct from every mount namespace.

Since the mount is a member of no mount namespace mounting onto it
fails. So nothing can ever be mounted on top of it. It cannot be cloned
via OPEN_TREE_CLONE and it does not show up in statmount()/listmount()
or /proc/<pid>/mountinfo. The filesystem is not registered so it is
not visible in /proc/filesystems and cannot be mounted from userspace.

This lets tasks shed their filesystem state completely. A process with
its root directory or working directory in failfs must anchor every path
lookup at an explicit file descriptor or is doomed to fail any lookup.
Absolute paths, absolute symlinks, and AT_FDCWD-relative lookups
simply fail. Followup patches will expose it via a new FD_FAILFS_ROOT
file descriptor sentinel understood by fchdir() and the new fchroot()
system call.

Fun fact, because of how dynamic binary execution work with PT_INTERP
this also currently prevents execution of dynamic binaries because
loaders have absolute paths (see selftests).

* patches from https://patch.msgid.link/20260724-work-failfs-v2-0-485dabbae185@kernel.org:
Documentation: add failfs documentation
selftests/filesystems: add failfs selftests
arch: hookup fchroot() system call
fs: support FD_FAILFS_ROOT in fchroot()
fs: add fchroot()
fs: support FD_FAILFS_ROOT in fchdir()
fs: add failfs

Link: https://patch.msgid.link/20260724-work-failfs-v2-0-485dabbae185@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

show more ...