Commit graph

167,812 commits

Author SHA1 Message Date
Christian Brauner
024596a4e2
ns: rename to __ns_ref
Make it easier to grep and rename to ns_count.

Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-09-19 16:22:38 +02:00
Christian Brauner
99d33ce100
net: port to ns_ref_*() helpers
Stop accessing ns.count directly.

Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-09-19 16:22:38 +02:00
Christian Brauner
2438b7d63a
uts: port to ns_ref_*() helpers
Stop accessing ns.count directly.

Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-09-19 16:22:38 +02:00
Christian Brauner
96d997ea5a
user: port to ns_ref_*() helpers
Stop accessing ns.count directly.

Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-09-19 16:22:37 +02:00
Christian Brauner
e0c173f1fa
time: port to ns_ref_*() helpers
Stop accessing ns.count directly.

Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-09-19 16:22:37 +02:00
Christian Brauner
07897b38ea
pid: port to ns_ref_*() helpers
Stop accessing ns.count directly.

Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-09-19 16:22:37 +02:00
Christian Brauner
d4825c99d6
ipc: port to ns_ref_*() helpers
Stop accessing ns.count directly.

Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-09-19 16:22:37 +02:00
Christian Brauner
06099e374f
cgroup: port to ns_ref_*() helpers
Stop accessing ns.count directly.

Acked-by: Tejun Heo <tj@kernel.org>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-09-19 16:22:36 +02:00
Christian Brauner
224ef741ce
ns: add reference count helpers
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-09-19 16:22:36 +02:00
Christian Brauner
be5f21d398
ns: add ns_common_free()
And drop ns_free_inum(). Anything common that can be wasted centrally
should be wasted in the new common helper.

Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-09-19 16:22:36 +02:00
Christian Brauner
5612ff3ec5
nscommon: simplify initialization
There's a lot of information that namespace implementers don't need to
know about at all. Encapsulate this all in the initialization helper.

Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-09-19 14:26:19 +02:00
Christian Brauner
cc47f43427
nsfs: add inode number for anon namespace
Add an inode number anonymous namespaces.

Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-09-19 14:26:18 +02:00
Christian Brauner
5fc6bef178
cgroup: split namespace into separate header
We have dedicated headers for all namespace types. Add one for the
cgroup namespace as well. Now it's consistent for all namespace types
and easy to figure out what to include.

Acked-by: Tejun Heo <tj@kernel.org>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-09-19 14:26:18 +02:00
Christian Brauner
f74ca6da11
nscommon: move to separate file
It's really awkward spilling the ns common infrastructure into multiple
headers. Move it to a separate file.

Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-09-19 14:26:18 +02:00
Christian Brauner
b2a0b19208
mnt: expose pointer to init_mnt_ns
There's various scenarios where we need to know whether we are in the
initial set of namespaces or not to e.g., shortcut permission checking.
All namespaces expose that information. Let's do that too.

Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-09-19 14:26:18 +02:00
Christian Brauner
93f67a7dda
uts: split namespace into separate header
We have dedicated headers for all namespace types. Add one for the uts
namespace as well. Now it's consistent for all namespace types.

Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-09-19 14:26:17 +02:00
Christian Brauner
f861225b9e
nsfs: add missing id retrieval support
The mount namespace has supported id retrieval for a while already.
Add support for the other types as well.

Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-09-19 14:26:16 +02:00
Christian Brauner
e83f0b5d10
nsfs: support exhaustive file handles
Pidfd file handles are exhaustive meaning they don't require a handle on
another pidfd to pass to open_by_handle_at() so it can derive the
filesystem to decode in. Instead it can be derived from the file
handle itself. The same is possible for namespace file handles.

Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-09-19 14:26:16 +02:00
Christian Brauner
5222470b2f
nsfs: support file handles
A while ago we added support for file handles to pidfs so pidfds can be
encoded and decoded as file handles. Userspace has adopted this quickly
and it's proven very useful. Implement file handles for namespaces as
well.

A process is not always able to open /proc/self/ns/. That requires
procfs to be mounted and for /proc/self/ or /proc/self/ns/ to not be
overmounted. However, userspace can always derive a namespace fd from
a pidfd. And that always works for a task's own namespace.

There's no need to introduce unnecessary behavioral differences between
/proc/self/ns/ fds, pidfd-derived namespace fds, and file-handle-derived
namespace fds. So namespace file handles are always decodable if the
caller is located in the namespace the file handle refers to.

This also allows a task to e.g., store a set of file handles to its
namespaces in a file on-disk so it can verify when it gets rexeced that
they're still valid and so on. This is akin to the pidfd use-case.

Or just plainly for namespace comparison reasons where a file handle to
the task's own namespace can be easily compared against others.

Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-09-19 14:26:16 +02:00
Christian Brauner
d2afdb73f8
nsfs: add current_in_namespace()
Add a helper to easily check whether a given namespace is the caller's
current namespace. This is currently open-coded in a lot of places.
Simply switch on the type and compare the results.

Reviewed-by: Aleksa Sarai <cyphar@cyphar.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-09-19 14:26:16 +02:00
Christian Brauner
d7afdf8895
ns: add to_<type>_ns() to respective headers
Every namespace type has a container_of(ns, <ns_type>, ns) static inline
function that is currently not exposed in the header. So we have a bunch
of places that open-code it via container_of(). Move it to the headers
so we can use it directly.

Reviewed-by: Aleksa Sarai <cyphar@cyphar.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-09-19 14:26:16 +02:00
Christian Brauner
b36c823b9a
time: support ns lookup
Support the generic ns lookup infrastructure to support file handles for
namespaces.

Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-09-19 14:26:15 +02:00
Christian Brauner
7914f15c5e
Merge branch 'no-rebase-mnt_ns_tree_remove'
Bring in the fix for removing a mount namespace from the mount namespace
rbtree and list.

Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-09-19 14:26:14 +02:00
Christian Brauner
885fc8ac0a
nstree: make iterator generic
Move the namespace iteration infrastructure originally introduced for
mount namespaces into a generic library usable by all namespace types.

Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-09-19 14:26:14 +02:00
Christian Brauner
86c5aba210
ns: remove ns_alloc_inum()
It's now unused.

Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-09-19 14:26:14 +02:00
Christian Brauner
660def10b0
ns: uniformly initialize ns_common
No point in cargo-culting the same code across all the different types.
Use one common initializer.

Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-09-19 14:26:13 +02:00
Christian Brauner
9296f46a96
nsfs: add nsfs.h header
And move the stuff out from proc_ns.h where it really doesn't belong.

Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-09-19 14:26:12 +02:00
Christian Brauner
e3e1812f8e
ns: move to_ns_common() to ns_common.h
Move the helper to ns_common.h where it belongs.

Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-09-19 14:26:12 +02:00
Christian Brauner
3c17001b21
pidfs: validate extensible ioctls
Validate extensible ioctls stricter than we do now.

Reviewed-by: Aleksa Sarai <cyphar@cyphar.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-09-15 13:45:27 +02:00
Linus Torvalds
18ee2b9b7b drm fixes for 6.16-rc4
gpuvm:
 - fix some typos
 
 xe:
 - Fix user-fence race issue
 - Couple xe_vm fixes
 - Don't trigger rebind on initial dma-buf validation
 - Fix a build issue related to basename() posix vs gnu discrepancy
 
 amdgpu:
 - pin buffers while vmapping
 - UserQ fixes
 - Revert CSA fix
 - SR-IOV fix
 
 nouveau:
 - fix linear modifier
 - remove some dead code
 
 msm:
 - Core/GPU:
   - fix comment doc warning in gpuvm
   - fix build with KMS disabled
   - fix pgtable setup/teardown race
   - global fault counter fix
   - various error path fixes
   - GPU devcoredump snapshot fixes
   - handle in-place VM_BIND remaps to solve turnip vm update race
   - skip re-emitting IBs for unusable VMs
   - Don't use %pK through printk
   - moved display snapshot init earlier, fixing a crash
 - DPU:
   - Fixed crash in virtual plane checking code
   - Fixed mode comparison in virtual plane checking code
 - DSI:
   - Adjusted width of resulution-related registers
   - Fixed locking issue on 14nm PLLs
 - UBWC (per Bjorn's ack)
   - Added UBWC configuration for several missing platforms (fixing
     regression)
 
 mediatek:
 - Add error handling for old state CRTC in atomic_disable
 - Fix DSI host and panel bridge pre-enable order
 - Fix device/node reference count leaks in mtk_drm_get_all_drm_priv
 - mtk_hdmi: Fix inverted parameters in some regmap_update_bits calls
 
 tegra:
 - revert dma-buf change
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmixFPQACgkQDHTzWXnE
 hr4d4Q/+Lf/meDiKrjUHiNwW+kZPeZhwrKEEbG2Opc9uZZdQpx44ZhOKM668dUx1
 YWAC2hcQFKWe0tz4Qsg2drPBGmoobhxmVScwXpY7xz1XN4taINssuZRwERp3bLmx
 l63tcQleGJOYvbCcg0SCfDeR4fd7a7iVf+PelFU04mbn/qorJBdYuy/XPTZlCond
 lf1MtaPH8f2M80WHmwb4g5K3mIdIa0HCt6Z9Z73mLRmF0b6KfcWF8159OLz03tiS
 voHDmFR4VsoZihDC4H+fAAitbQG+5vZN6YtX2CC4OtQLxeGkpkOniGwfjD/beKne
 edGHvWpzBchmK0Z6o64+7rzJa7RYEkpgryvAD/jEljG9kk0RzlGAYvXFV3aeLFLn
 +WJX8ZOw/SqkGX5/DDA0CpDb3Ty8QxEmS/MEHn/kAUNmBp0Uw2ad6b/4b3NqkDh9
 ftgWSobFubZJ8oSf8amPwpW7KjSsccogQzASiuDlV/XCCdlKvuxkn/ZX9XjHq0rr
 O0CX+4vLhl20grRstD4oIVsmrLYQXg97uqpOeaoMrzflKfyEzJ7bxDSBd78ZbfVf
 dlHSULx3cgusNe8HNWRnsnC0XeC1MBTXCbpTjrZYkqu1arLZN+r8LXOGRZrKBCPu
 PtlmU21JJKygKUTWeXzX1P2eBdBoTloOKJGkLWthR9KxFDqfppM=
 =QtCr
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2025-08-29' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "Weekly fixes, feels a bit big.

  The major piece is msm fixes, then the usual amdgpu/xe along with some
  mediatek and nouveau fixes and a tegra revert.

  gpuvm:
   - fix some typos

  xe:
   - Fix user-fence race issue
   - Couple xe_vm fixes
   - Don't trigger rebind on initial dma-buf validation
   - Fix a build issue related to basename() posix vs gnu discrepancy

  amdgpu:
   - pin buffers while vmapping
   - UserQ fixes
   - Revert CSA fix
   - SR-IOV fix

  nouveau:
   - fix linear modifier
   - remove some dead code

  msm:
   - Core/GPU:
      - fix comment doc warning in gpuvm
      - fix build with KMS disabled
      - fix pgtable setup/teardown race
      - global fault counter fix
      - various error path fixes
      - GPU devcoredump snapshot fixes
      - handle in-place VM_BIND remaps to solve turnip vm update race
      - skip re-emitting IBs for unusable VMs
      - Don't use %pK through printk
      - moved display snapshot init earlier, fixing a crash
   - DPU:
      - Fixed crash in virtual plane checking code
      - Fixed mode comparison in virtual plane checking code
   - DSI:
      - Adjusted width of resulution-related registers
      - Fixed locking issue on 14nm PLLs
   - UBWC (per Bjorn's ack)
      - Added UBWC configuration for several missing platforms (fixing
        regression)

  mediatek:
   - Add error handling for old state CRTC in atomic_disable
   - Fix DSI host and panel bridge pre-enable order
   - Fix device/node reference count leaks in mtk_drm_get_all_drm_priv
   - mtk_hdmi: Fix inverted parameters in some regmap_update_bits calls

  tegra:
   - revert dma-buf change"

* tag 'drm-fixes-2025-08-29' of https://gitlab.freedesktop.org/drm/kernel: (56 commits)
  drm/mediatek: mtk_hdmi: Fix inverted parameters in some regmap_update_bits calls
  drm/amdgpu/userq: fix error handling of invalid doorbell
  drm/amdgpu: update firmware version checks for user queue support
  drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode
  Revert "drm/amdgpu: fix incorrect vm flags to map bo"
  drm/amdgpu/gfx12: set MQD as appriopriate for queue types
  drm/amdgpu/gfx11: set MQD as appriopriate for queue types
  drm/xe: switch to local xbasename() helper
  drm/xe: Don't trigger rebind on initial dma-buf validation
  drm/xe/vm: Clear the scratch_pt pointer on error
  drm/xe/vm: Don't pin the vm_resv during validation
  drm/xe/xe_sync: avoid race during ufence signaling
  Revert "drm/tegra: Use dma_buf from GEM object instance"
  soc: qcom: use no-UBWC config for MSM8956/76
  soc: qcom: add configuration for MSM8929
  soc: qcom: ubwc: add more missing platforms
  soc: qcom: ubwc: use no-uwbc config for MSM8917
  drm/msm/dpu: Add a null ptr check for dpu_encoder_needs_modeset
  dt-bindings: display/msm: qcom,mdp5: drop lut clock
  drm/gpuvm: fix various typos in .c and .h gpuvm file
  ...
2025-08-28 19:56:32 -07:00
Linus Torvalds
9c736ace06 Including fixes from Bluetooth.
Current release - regressions:
 
   - ipv4: fix regression in local-broadcast routes
 
   - vsock: fix error-handling regression introduced in v6.17-rc1
 
 Previous releases - regressions:
 
   - bluetooth:
     - mark connection as closed during suspend disconnect
     - fix set_local_name race condition
 
   - eth: ice: fix NULL pointer dereference on reset
 
   - eth: mlx5: fix memory leak in hws_pool_buddy_init error path
 
   - eth: bnxt_en: fix stats context reservation logic
 
   - eth: hv: fix loss of receive events from host during channel open
 
 Previous releases - always broken:
 
   - page_pool: fix incorrect mp_ops error handling
 
   - sctp: initialize more fields in sctp_v6_from_sk()
 
   - eth: octeontx2-vf: fix max packet length errors
 
   - eth: idpf: fix Tx flow scheduling to avoid Tx timeouts
 
   - eth: bnxt_en: fix memory corruption during ifdown
 
   - eth: ice: fix incorrect counter for buffer allocation failures
 
   - eth: mlx5: fix lockdep assertion on sync reset unload event
 
   - eth: fbnic: fixup rtnl_lock and devl_lock handling
 
   - eth: xgmac: do not enable RX FIFO overflow interrupts
 
   - phy: mscc: fix when PTP clock is register and unregister
 
 Misc:
 
   - add Telit Cinterion LE910C4-WWX new compositions
 
 Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCAAwFiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmiwM+gSHHBhYmVuaUBy
 ZWRoYXQuY29tAAoJECkkeY3MjxOkyLAP/jMG9RkfV+TA9Q/X5IOEb7E2g7aSxQ6w
 L64meDBrNkX1mPfYZCdYIhrjwV4snmdH1f85EL/Tqid7t6IphHYxy5IuYwsTQEhM
 LjkEPl8wMS5ayKVeSfFTZV9yspi5auB3Mmxd37qKBBj7YsZqoN27v28o7nZLbGqr
 LHO+sorTyqQVN1WMNJtd+MQDn+Ww3vXy0FcYhbpAsWVGweukkRRA9OMrTYNur6Am
 zi8eysRtPyHh72SmqVGAmyaZWstTCAQO6cn50BMPD77atr1ozJfJFeHpftfoEFs6
 xEILvp8/mykb+XrGKQlELly//iIXmBpeECR1KNYHwRXc61CY4WlD4/GHZ+NzHjpC
 hO2jO0x0fRdx0B4CsVTqa74c6fdaVWzkqZ2AuLc8XntqYLlWB8IRYX6UIIx9EkD1
 Q58saCXWPizln6S1F6qBZi3co95unj00Je5z048WQXeZ/icvGynW2voTWALuBVXR
 wHZXxY2W8o1CszTIn8UwST8LcnKnvd5MCAqBX5XaDX7X80sNUSZnsq2NCPFHu1Oy
 D3L0KOrNhqb2KdCxW2+lej6g37B3fTh27mlYJCeX/9zBGR2afnyVcwwrK4O2hDp2
 mnywK0QgfbevoM2V9RcxRcX4AccQF5h9A4V3whOhsf1hlGSRiPJ+VS+Gjc2JWXrx
 4Ewv6VNjeOtd
 =8eIy
 -----END PGP SIGNATURE-----

Merge tag 'net-6.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Paolo Abeni:
 "Including fixes from Bluetooth.

  Current release - regressions:

    - ipv4: fix regression in local-broadcast routes

    - vsock: fix error-handling regression introduced in v6.17-rc1

  Previous releases - regressions:

    - bluetooth:
        - mark connection as closed during suspend disconnect
        - fix set_local_name race condition

    - eth:
        - ice: fix NULL pointer dereference on reset
        - mlx5: fix memory leak in hws_pool_buddy_init error path
        - bnxt_en: fix stats context reservation logic
        - hv: fix loss of receive events from host during channel open

  Previous releases - always broken:

    - page_pool: fix incorrect mp_ops error handling

    - sctp: initialize more fields in sctp_v6_from_sk()

    - eth:
        - octeontx2-vf: fix max packet length errors
        - idpf: fix Tx flow scheduling to avoid Tx timeouts
        - bnxt_en: fix memory corruption during ifdown
        - ice: fix incorrect counter for buffer allocation failures
        - mlx5: fix lockdep assertion on sync reset unload event
        - fbnic: fixup rtnl_lock and devl_lock handling
        - xgmac: do not enable RX FIFO overflow interrupts

    - phy: mscc: fix when PTP clock is register and unregister

  Misc:

    - add Telit Cinterion LE910C4-WWX new compositions"

* tag 'net-6.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (60 commits)
  net: ipv4: fix regression in local-broadcast routes
  net: macb: Disable clocks once
  fbnic: Move phylink resume out of service_task and into open/close
  fbnic: Fixup rtnl_lock and devl_lock handling related to mailbox code
  net: rose: fix a typo in rose_clear_routes()
  l2tp: do not use sock_hold() in pppol2tp_session_get_sock()
  sctp: initialize more fields in sctp_v6_from_sk()
  MAINTAINERS: rmnet: Update email addresses
  net: rose: include node references in rose_neigh refcount
  net: rose: convert 'use' field to refcount_t
  net: rose: split remove and free operations in rose_remove_neigh()
  net: hv_netvsc: fix loss of early receive events from host during channel open.
  net: stmmac: Set CIC bit only for TX queues with COE
  net: stmmac: xgmac: Correct supported speed modes
  net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts
  net/mlx5e: Set local Xoff after FW update
  net/mlx5e: Update and set Xon/Xoff upon port speed set
  net/mlx5e: Update and set Xon/Xoff upon MTU set
  net/mlx5: Prevent flow steering mode changes in switchdev mode
  net/mlx5: Nack sync reset when SFs are present
  ...
2025-08-28 17:35:51 -07:00
Linus Torvalds
4d28e28098 dma-mapping fixes for Linux 6.17
- another small fix relevant to arm64 systems with memory encryption
 (Shanker Donthineni)
 - fix relevant to arm32 systems with non-standard CMA configuration
 (Oreoluwa Babatunde)
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQSrngzkoBtlA8uaaJ+Jp1EFxbsSRAUCaLAK7gAKCRCJp1EFxbsS
 REDxAQC+5hLiyzc/1rR5EQb1D6Xr1f/0VN3IFz3creHp3juFBAEApi1iFMdmahO7
 0YKG4KkzHpcNkGrxaXKP0VNtQsDLwww=
 =fVrB
 -----END PGP SIGNATURE-----

Merge tag 'dma-mapping-6.17-2025-08-28' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux

Pull dma-mapping fixes from Marek Szyprowski:

 - another small fix for arm64 systems with memory encryption (Shanker
   Donthineni)

 - fix for arm32 systems with non-standard CMA configuration (Oreoluwa
   Babatunde)

* tag 'dma-mapping-6.17-2025-08-28' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux:
  dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted
  of: reserved_mem: Restructure call site for dma_contiguous_early_fixup()
2025-08-28 16:04:14 -07:00
Linus Torvalds
5b9f3b013b memblock fixes for v6.17-rc4
* printk cleanups in memblock and numa_memblks
 * update kernel-doc for MEMBLOCK_RSRV_NOINIT to be more accurate and
   detailed
 -----BEGIN PGP SIGNATURE-----
 
 iQFEBAABCgAuFiEEeOVYVaWZL5900a/pOQOGJssO/ZEFAmiv6AwQHHJwcHRAa2Vy
 bmVsLm9yZwAKCRA5A4Ymyw79kR4SB/4u5L2tlpZaM2PzMqHVrdXDWNs7ntmRr97e
 BA0fsIoSVtcqAEUkXiG+2x9cBuzJuiGOkSKOu28u7567zQji8rX3IAHaR1Uw1K+0
 2mmzC3QxMjM6g7g310uA+agMAQlZne6ppiCEqyNnng3Uda8zZudL8NojOjtr3rJi
 +ebiy5/2KR9DDV+758ZCQ4MmBGqnS5YLXu+xXbmnsPw7AqujSADskvrTLugii5qp
 khQwTEX9foUR9kwAsrHPmqW560m2oWNf4eh3uxWtVxuCtbAnqC6uxVnaORW7UKaB
 gLcOCinvBE6Le4sggJQvr6NpAJ1HcrXzA61CfBV9UUXNXb9obxDO
 =xp5F
 -----END PGP SIGNATURE-----

Merge tag 'fixes-2025-08-28' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock

Pull memblock fixes from Mike Rapoport:

 - printk cleanups in memblock and numa_memblks

 - update kernel-doc for MEMBLOCK_RSRV_NOINIT to be more accurate and
   detailed

* tag 'fixes-2025-08-28' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock:
  memblock: fix kernel-doc for MEMBLOCK_RSRV_NOINIT
  mm: numa,memblock: Use SZ_1M macro to denote bytes to MB conversion
  mm/numa_memblks: Use pr_debug instead of printk(KERN_DEBUG)
2025-08-28 15:46:06 -07:00
Dave Airlie
60d98e1a8d Several nouveau fixes to remove unused code, fix an error path and be
less restrictive with the formats it accepts. A fix for amdgpu to pin
 vmapped dma-buf, and a revert for tegra for a regression in the dma-buf
 / GEM code.
 -----BEGIN PGP SIGNATURE-----
 
 iJUEABMJAB0WIQTkHFbLp4ejekA/qfgnX84Zoj2+dgUCaK/35wAKCRAnX84Zoj2+
 duAqAX9IIovrilRa/6169LIVEFbI3NfhWJorjDp5GB6jEilKxu6LBWFNYmyiLLwI
 0+c4WiEBfAk/jHkpO4fdtAbIczic5d1WdSlO3VipH6w8WMDca1A3DcDM4BXO2x5Z
 74f5CctKSA==
 =PWA/
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-fixes-2025-08-28' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes

Several nouveau fixes to remove unused code, fix an error path and be
less restrictive with the formats it accepts. A fix for amdgpu to pin
vmapped dma-buf, and a revert for tegra for a regression in the dma-buf
/ GEM code.

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Maxime Ripard <mripard@redhat.com>
Link: https://lore.kernel.org/r/20250828-hypersonic-colorful-squirrel-64f04b@houat
2025-08-29 08:44:53 +10:00
Linus Torvalds
39f90c1967 virtio,vhost: fixes
More small fixes. Most notably this fixes a messed up ioctl #,
 and a regression in shmem affecting drm users.
 
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQFDBAABCgAtFiEEXQn9CHHI+FuUyooNKB8NuNKNVGkFAmivE+4PHG1zdEByZWRo
 YXQuY29tAAoJECgfDbjSjVRp0zQIALgyJ2XpwY3IlrXWXZdKPqjL5i/pVwDB1bNt
 +9lnLav8UAaNCIfWZKBo6HYOOmjSLWX8zpVGO88n1Vz9aIm3L0NRkwS0nZoLpTCr
 eeZpZ5LwKGTn1iZIOjxX+itc++nffQWS4GKLdCJpasc6D5DHhGU0GLpX62g8NQQc
 /MevRNxuHgECj6KqtNUf8hhqbT5PrCdQmIKGagaX/jzVH2d+9ZTdo0BECStfzB/z
 B9HT6Xm0MsJjRpy7Hqmnp21tBC75O7o79VjnvibENdTOYWMDbgA3g7OL92aUNvGh
 zaAyG040nVYDD5jnC7UiGCZq+49NTw+x9LBUUCuGptU3a2FclHs=
 =fQg1
 -----END PGP SIGNATURE-----

Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost

Pull virtio/vhost fixes from Michael Tsirkin:
 "More small fixes. Most notably this fixes a messed up ioctl number,
  and a regression in shmem affecting drm users"

* tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost:
  virtio_net: adjust the execution order of function `virtnet_close` during freeze
  virtio_input: Improve freeze handling
  vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER
  Revert "virtio: reject shm region if length is zero"
  vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put()
  virtio_pci: Fix misleading comment for queue vector
2025-08-27 10:19:35 -07:00
Linus Torvalds
518b21ba13 [GIT PULL for v6.17-rc4] media fixes
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE+QmuaPwR3wnBdVwACF8+vY7k4RUFAmiuxWgACgkQCF8+vY7k
 4RUQOw//b7sHwBQ3gjCkhD2SKkM9WkY7LJjIhka1FXFNq2Sq/bY75tPTl6bWZyHk
 ptcZVCyibPrRkxzO90BMn7rG/k4bbdW4aQbIu4jO3fX1bXJzLnIIx3Dr6KdcPrTj
 ah3kG5F77Y75tqPfcpttWOu09IkE1TTKk1DQWtlIazqbMAHyk1nj70MoG5Hjfh0j
 GX+wvoAu/J55DrMbbyeMHTwHI1uSIGtDPB4Au/M5mrmQc0JUFf9RByGAcwoj5FKD
 hwKCaL5TOrzRTVQuAUdAdmbv/cDgo4kENZ8vl3/RtGzxZa3d4S6h6rXHZNLr+Tuw
 7BwSqxppf50F+qIc3V1T4RaRkUmhRHV99ov7fny0SCxqdFimGKgWhKlgrjw4eq80
 ePLElShp3MDkbKUFNbsiFogpfpE+mjsmnQFK0vMnPJXdEJE7pm2qwIfxFCA3xw4s
 opzYRLza93/hTGfVdMT1MYHQtn302Ahyyx0Fw3ObU0MIumK0JjTrB42zKhmut3Ex
 i1Y3NrJVhb/UgRUxAJcms2D0IKIDK4zFzTrJxiI1HvePhnC6ZjxNkW9VeqQTgh2g
 m/UFOYG50g3iqJTsbIFaUjHQgohrPz6Uw5SMv3kuYWR9U4VBg8L6PRrSNFOprnAU
 2YJ6MHZkyEOfPQTSpvtk+T2o54KTaKIb8g35lCf8iWcz9TG+/Fo=
 =grLH
 -----END PGP SIGNATURE-----

Merge tag 'media/v6.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

Pull media fixes from Mauro Carvalho Chehab:

 - drop the redundant pm_runtime_mark_last_busy() in rkvdec

 - fix probing error handling in rkvdec

 - fix an issue affecting lt6911uxe/lt6911uxc related to CSI-2 GPIO pins
   in int3472

* tag 'media/v6.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
  media: Remove redundant pm_runtime_mark_last_busy() calls
  platform/x86: int3472: add hpd pin support
  media: rkvdec: Remove redundant pm_runtime_mark_last_busy() calls
  media: rkvdec: Fix an error handling path in rkvdec_probe()
  media: rkvdec: Fix a NULL vs IS_ERR() bug in probe()
2025-08-27 10:10:50 -07:00
Takamitsu Iwai
d860d1faa6 net: rose: convert 'use' field to refcount_t
The 'use' field in struct rose_neigh is used as a reference counter but
lacks atomicity. This can lead to race conditions where a rose_neigh
structure is freed while still being referenced by other code paths.

For example, when rose_neigh->use becomes zero during an ioctl operation
via rose_rt_ioctl(), the structure may be removed while its timer is
still active, potentially causing use-after-free issues.

This patch changes the type of 'use' from unsigned short to refcount_t and
updates all code paths to use rose_neigh_hold() and rose_neigh_put() which
operate reference counts atomically.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Takamitsu Iwai <takamitz@amazon.co.jp>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20250823085857.47674-3-takamitz@amazon.co.jp
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-08-27 07:43:08 -07:00
Takamitsu Iwai
dcb3465902 net: rose: split remove and free operations in rose_remove_neigh()
The current rose_remove_neigh() performs two distinct operations:
1. Removes rose_neigh from rose_neigh_list
2. Frees the rose_neigh structure

Split these operations into separate functions to improve maintainability
and prepare for upcoming refcount_t conversion. The timer cleanup remains
in rose_remove_neigh() because free operations can be called from timer
itself.

This patch introduce rose_neigh_put() to handle the freeing of rose_neigh
structures and modify rose_remove_neigh() to handle removal only.

Signed-off-by: Takamitsu Iwai <takamitz@amazon.co.jp>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20250823085857.47674-2-takamitz@amazon.co.jp
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-08-27 07:43:08 -07:00
Mike Rapoport (Microsoft)
b3dcc9d1d8 memblock: fix kernel-doc for MEMBLOCK_RSRV_NOINIT
The kernel-doc description of MEMBLOCK_RSRV_NOINIT and
memblock_reserved_mark_noinit() do not accurately describe their
functionality.

Expand their kernel doc to make it clear that the user of
MEMBLOCK_RSRV_NOINIT is responsible to properly initialize the struct pages
for such regions and add more details about effects of using this flag.

Reviewed-by: David Hildenbrand <david@redhat.com>
Link: https://lore.kernel.org/r/f8140a17-c4ec-489b-b314-d45abe48bf36@redhat.com
Link: https://lore.kernel.org/r/20250826071947.1949725-1-rppt@kernel.org
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2025-08-26 10:47:03 +03:00
Namhyung Kim
24fc631539 vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER
The VHOST_[GS]ET_FEATURES_ARRAY ioctl already took 0x83 and it would
result in a build error when the vhost uapi header is used for perf tool
build like below.

  In file included from trace/beauty/ioctl.c:93:
  tools/perf/trace/beauty/generated/ioctl/vhost_virtio_ioctl_array.c: In function ‘ioctl__scnprintf_vhost_virtio_cmd’:
  tools/perf/trace/beauty/generated/ioctl/vhost_virtio_ioctl_array.c:36:18: error: initialized field overwritten [-Werror=override-init]
     36 |         [0x83] = "SET_FORK_FROM_OWNER",
        |                  ^~~~~~~~~~~~~~~~~~~~~
  tools/perf/trace/beauty/generated/ioctl/vhost_virtio_ioctl_array.c:36:18: note: (near initialization for ‘vhost_virtio_ioctl_cmds[131]’)

Fixes: 7d9896e9f6 ("vhost: Reintroduce kthread API and add mode selection")
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Message-Id: <20250819063958.833770-1-namhyung@kernel.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Tested-by: Lei Yang <leiyang@redhat.com>
2025-08-26 03:38:19 -04:00
Igor Torrente
ced17ee32a Revert "virtio: reject shm region if length is zero"
The commit 206cc44588 ("virtio: reject shm region if length is zero")
breaks the Virtio-gpu `host_visible` feature.

As you can see in the snippet below, host_visible_region is zero because
of the `kzalloc`.  It's using the `vm_get_shm_region`
(drivers/virtio/virtio_mmio.c:536) to read the `addr` and `len` from
qemu/crosvm.

```
drivers/gpu/drm/virtio/virtgpu_kms.c
132         vgdev = drmm_kzalloc(dev, sizeof(struct virtio_gpu_device), GFP_KERNEL);
[...]
177         if (virtio_get_shm_region(vgdev->vdev, &vgdev->host_visible_region,
178                                   VIRTIO_GPU_SHM_ID_HOST_VISIBLE)) {
```
Now it always fails.

To fix, revert the offending commit.

Fixes: 206cc44588 ("virtio: reject shm region if length is zero")
Signed-off-by: Igor Torrente <igor.torrente@collabora.com>
Message-Id: <20250807124145.81816-1-igor.torrente@collabora.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-08-26 03:38:10 -04:00
Alice Ryhl
e228e7d382 drm/gpuvm: fix various typos in .c and .h gpuvm file
After working with this code for a while, I came across several typos.
This patch fixes them.

Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Link: https://lore.kernel.org/r/20250825-gpuvm-typo-fix-v1-1-14e9e78e28e6@google.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2025-08-25 21:48:50 +02:00
Linus Torvalds
8004d08330 USB fixes for 6.17-rc3
Here are some small USB driver fixes for 6.17-rc3 to resolve a bunch of
 reported issues.  Included in here are:
   - typec driver fixes
   - dwc3 new device id
   - dwc3 driver fixes
   - new usb-storage driver quirks
   - xhci driver fixes
   - other tiny USB driver fixes to resolve bugs
 
 All of these have been in linux-next this week with no reported issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCaKnTpQ8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+yk+7gCfV8UA7wAViZTaXWmqsa3GzeuSMKIAoKdcM0+j
 hV48oay+3njPXzlsTp0d
 =lRRr
 -----END PGP SIGNATURE-----

Merge tag 'usb-6.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB fixes from Greg KH:
 "Here are some small USB driver fixes for 6.17-rc3 to resolve a bunch
  of reported issues. Included in here are:

   - typec driver fixes

   - dwc3 new device id

   - dwc3 driver fixes

   - new usb-storage driver quirks

   - xhci driver fixes

   - other tiny USB driver fixes to resolve bugs

  All of these have been in linux-next this week with no reported issues"

* tag 'usb-6.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  usb: xhci: fix host not responding after suspend and resume
  usb: xhci: Fix slot_id resource race conflict
  usb: typec: fusb302: Revert incorrect threaded irq fix
  USB: core: Update kerneldoc for usb_hcd_giveback_urb()
  usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean
  usb: typec: maxim_contaminant: disable low power mode when reading comparator values
  usb: dwc3: Remove WARN_ON for device endpoint command timeouts
  USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles
  usb: storage: realtek_cr: Use correct byte order for bcs->Residue
  usb: chipidea: imx: improve usbmisc_imx7d_pullup()
  kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq()
  usb: dwc3: pci: add support for the Intel Wildcat Lake
  usb: dwc3: Ignore late xferNotReady event to prevent halt timeout
  USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera
  usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test
  usb: renesas-xhci: Fix External ROM access timeouts
  usb: gadget: tegra-xudc: fix PM use count underflow
  usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive
2025-08-23 11:21:56 -04:00
Kuniyuki Iwashima
ec79003c5f atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().
syzbot reported the splat below. [0]

When atmtcp_v_open() or atmtcp_v_close() is called via connect()
or close(), atmtcp_send_control() is called to send an in-kernel
special message.

The message has ATMTCP_HDR_MAGIC in atmtcp_control.hdr.length.
Also, a pointer of struct atm_vcc is set to atmtcp_control.vcc.

The notable thing is struct atmtcp_control is uAPI but has a
space for an in-kernel pointer.

  struct atmtcp_control {
  	struct atmtcp_hdr hdr;	/* must be first */
  ...
  	atm_kptr_t vcc;		/* both directions */
  ...
  } __ATM_API_ALIGN;

  typedef struct { unsigned char _[8]; } __ATM_API_ALIGN atm_kptr_t;

The special message is processed in atmtcp_recv_control() called
from atmtcp_c_send().

atmtcp_c_send() is vcc->dev->ops->send() and called from 2 paths:

  1. .ndo_start_xmit() (vcc->send() == atm_send_aal0())
  2. vcc_sendmsg()

The problem is sendmsg() does not validate the message length and
userspace can abuse atmtcp_recv_control() to overwrite any kptr
by atmtcp_control.

Let's add a new ->pre_send() hook to validate messages from sendmsg().

[0]:
Oops: general protection fault, probably for non-canonical address 0xdffffc00200000ab: 0000 [#1] SMP KASAN PTI
KASAN: probably user-memory-access in range [0x0000000100000558-0x000000010000055f]
CPU: 0 UID: 0 PID: 5865 Comm: syz-executor331 Not tainted 6.17.0-rc1-syzkaller-00215-gbab3ce404553 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:atmtcp_recv_control drivers/atm/atmtcp.c:93 [inline]
RIP: 0010:atmtcp_c_send+0x1da/0x950 drivers/atm/atmtcp.c:297
Code: 4d 8d 75 1a 4c 89 f0 48 c1 e8 03 42 0f b6 04 20 84 c0 0f 85 15 06 00 00 41 0f b7 1e 4d 8d b7 60 05 00 00 4c 89 f0 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 13 06 00 00 66 41 89 1e 4d 8d 75 1c 4c
RSP: 0018:ffffc90003f5f810 EFLAGS: 00010203
RAX: 00000000200000ab RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88802a510000 RSI: 00000000ffffffff RDI: ffff888030a6068c
RBP: ffff88802699fb40 R08: ffff888030a606eb R09: 1ffff1100614c0dd
R10: dffffc0000000000 R11: ffffffff8718fc40 R12: dffffc0000000000
R13: ffff888030a60680 R14: 000000010000055f R15: 00000000ffffffff
FS:  00007f8d7e9236c0(0000) GS:ffff888125c1c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000045ad50 CR3: 0000000075bde000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 vcc_sendmsg+0xa10/0xc60 net/atm/common.c:645
 sock_sendmsg_nosec net/socket.c:714 [inline]
 __sock_sendmsg+0x219/0x270 net/socket.c:729
 ____sys_sendmsg+0x505/0x830 net/socket.c:2614
 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668
 __sys_sendmsg net/socket.c:2700 [inline]
 __do_sys_sendmsg net/socket.c:2705 [inline]
 __se_sys_sendmsg net/socket.c:2703 [inline]
 __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2703
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8d7e96a4a9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f8d7e923198 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f8d7e9f4308 RCX: 00007f8d7e96a4a9
RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000005
RBP: 00007f8d7e9f4300 R08: 65732f636f72702f R09: 65732f636f72702f
R10: 65732f636f72702f R11: 0000000000000246 R12: 00007f8d7e9c10ac
R13: 00007f8d7e9231a0 R14: 0000200000000200 R15: 0000200000000250
 </TASK>
Modules linked in:

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: syzbot+1741b56d54536f4ec349@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/68a6767c.050a0220.3d78fd.0011.GAE@google.com/
Tested-by: syzbot+1741b56d54536f4ec349@syzkaller.appspotmail.com
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20250821021901.2814721-1-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-08-22 17:23:15 -07:00
Linus Torvalds
6debb69041 drm fixes for 6.17-rc3
rust:
 - drm device memory layout and safety fixes
 
 tests:
 - Endianness fixes
 
 gpuvm:
 - docs warning fix
 
 panic:
 - fix division on 32-bit arm
 
 i915:
 - TypeC DP display Fixes
 - Silence rpm wakeref asserts on GEN11_GU_MISC_IIR access
 - Relocate compression repacking WA for JSL/EHL
 
 xe:
 - xe_vm_create fixes
 - fix vm bind ioctl double free
 
 amdgpu:
 - Replay fixes
 - SMU14 fix
 - Null check DC fixes
 - DCE6 DC fixes
 - Misc DC fixes
 
 bridge:
 - analogix_dp: devm_drm_bridge_alloc() error handling fix
 
 habanalabs:
 - Memory deallocation fix
 
 hibmc:
 - modesetting black screen fixes
 - fix UAF on irq
 - fix leak on i2c failure path
 
 nouveau:
 - memory leak fixes
 - typos
 
 rockchip:
 - Kconfig fix
 - register caching fix
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmio5O4ACgkQDHTzWXnE
 hr7CTQ//b+Qz9Qt/hxqoKVO7dX9RDQmXrR+BxCiQTkVGdzlrMKCLS4s5FPElq5II
 wSQ/Ya3r6rdy9MP8Jf+LTxY1UDHaAqhjE5cO/ETfzgE/2I3/rOb92/ITnCrA8ATc
 w2w1oM1pZ6SI9+Aigmbb6ivTKDjI2m/+VAR2YFfXVdZ6D1YggLXj2O4+IXVZHiGD
 LesusmoiyTiP+t5NroPSlXwKMJJVnTfQ8a3qUOzgplOIvPuQpB4EBesdPLAjuqos
 VYM0tXDEOrMy7taSpStgcn0PmT6rTHSC8RU+tXEtyB4EUqkfTrbyRQjH8DrQPUq1
 gFDj265AzfCnRGTMSF52taDViJzHV3JkgibrFD71eejgqOw9NfICBfnYczt4W5jv
 dCnPXdVtMk4VVogqma9DiC9+ZWaPqRlD85NVQnwfy3rn8hEmpOlvs4vGa+zUxC3J
 iMYZnZPFHeGtmqweH0TSB1RNvYQgYAj+j7cKJWFEfhUrQYqRYppqzKtybUamR6JJ
 kEKXLGEoIvo84LvX71evxL8ogPo68kYdd4EWKpM2PdqQEsmfvEWWbO1SpGzRqmnm
 UOkDB2pQVEzfbO4Rsz7olcZBNqEcEf8Nq24z/laA4B7B9E7wAFCBjqpx/2Ih7dBG
 bknJI0ghm1Uxd4ZMa0c2ejxIcgxQ4DHC9MA+HFtDZU0SXrsyskY=
 =GfgI
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2025-08-23-1' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "Weekly drm fixes. Looks like things did indeed get busier after rc2,
  nothing seems too major, but stuff scattered all over the place,
  amdgpu, xe, i915, hibmc, rust support code, and other small fixes.

  rust:
   - drm device memory layout and safety fixes

  tests:
   - Endianness fixes

  gpuvm:
   - docs warning fix

  panic:
   - fix division on 32-bit arm

  i915:
   - TypeC DP display Fixes
   - Silence rpm wakeref asserts on GEN11_GU_MISC_IIR access
   - Relocate compression repacking WA for JSL/EHL

  xe:
   - xe_vm_create fixes
   - fix vm bind ioctl double free

  amdgpu:
   - Replay fixes
   - SMU14 fix
   - Null check DC fixes
   - DCE6 DC fixes
   - Misc DC fixes

  bridge:
   - analogix_dp: devm_drm_bridge_alloc() error handling fix

  habanalabs:
   - Memory deallocation fix

  hibmc:
   - modesetting black screen fixes
   - fix UAF on irq
   - fix leak on i2c failure path

  nouveau:
   - memory leak fixes
   - typos

  rockchip:
   - Kconfig fix
   - register caching fix"

* tag 'drm-fixes-2025-08-23-1' of https://gitlab.freedesktop.org/drm/kernel: (49 commits)
  drm/xe: Fix vm_bind_ioctl double free bug
  drm/xe: Move ASID allocation and user PT BO tracking into xe_vm_create
  drm/xe: Assign ioctl xe file handler to vm in xe_vm_create
  drm/i915/gt: Relocate compression repacking WA for JSL/EHL
  drm/i915: silence rpm wakeref asserts on GEN11_GU_MISC_IIR access
  drm/amd/display: Fix DP audio DTO1 clock source on DCE 6.
  drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3
  drm/amd/display: Don't print errors for nonexistent connectors
  drm/amd/display: Don't warn when missing DCE encoder caps
  drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs
  drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs
  drm/amd/display: Adjust DCE 8-10 clock, don't overclock by 15%
  drm/amd/display: Don't overclock DCE 6 by 15%
  drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session()
  drm/amd/display: Fix Xorg desktop unresponsive on Replay panel
  drm/amd/display: Avoid a NULL pointer dereference
  drm/amdgpu/swm14: Update power limit logic
  drm/amd/display: Revert Add HPO encoder support to Replay
  drm/i915/icl+/tc: Convert AUX powered WARN to a debug message
  drm/i915/lnl+/tc: Use the cached max lane count value
  ...
2025-08-22 18:16:54 -04:00
Pavel Shpakovskiy
6bbd0d3f0c Bluetooth: hci_sync: fix set_local_name race condition
Function set_name_sync() uses hdev->dev_name field to send
HCI_OP_WRITE_LOCAL_NAME command, but copying from data to hdev->dev_name
is called after mgmt cmd was queued, so it is possible that function
set_name_sync() will read old name value.

This change adds name as a parameter for function hci_update_name_sync()
to avoid race condition.

Fixes: 6f6ff38a1e ("Bluetooth: hci_sync: Convert MGMT_OP_SET_LOCAL_NAME")
Signed-off-by: Pavel Shpakovskiy <pashpakovskii@salutedevices.com>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2025-08-22 13:57:31 -04:00
Linus Torvalds
b3d80535e2 xen: branch for v6.17-rc3
-----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRTLbB6QfY48x44uB6AXGG7T9hjvgUCaKf/jgAKCRCAXGG7T9hj
 vsTcAP0eRBCWDlCTzyuRN+2MpyryoNspFcovhJGwMG16a/7SbgEA/Vi7WqK7Y0XT
 /7ovC2AzehL9iJaZvl8hWULVnw9C8Aw=
 =gDSN
 -----END PGP SIGNATURE-----

Merge tag 'for-linus-6.17-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip

Pull xen fixes from Juergen Gross:
 "Two small cleanups which are both relevant only when running as a Xen
  guest"

* tag 'for-linus-6.17-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
  drivers/xen/xenbus: remove quirk for Xen 3.x
  compiler: remove __ADDRESSABLE_ASM{_STR,}() again
2025-08-22 09:50:17 -04:00
Linus Torvalds
a2e94e8079 block-6.17-20250822
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmiobRkQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpnvDEAC6ybsqvNAOSV1Tdk1EQZ/mIrmIb7tVrp/P
 zRReWTK9jF7kzOLn2Mqgu0c4RFLCMABXmPb5F2aLx72uSxMSFq2sI9QZCgGzZQeZ
 yjOIxFBAPsdgr+gyIOdS3zH04+IKfJw20ojJb83irCgd5M1hpmVwzZ3iGMq8Gs9q
 VJQYvKny7tjjpuLpk3DWl7t1J0YV+0sGQhk3iZdWEHrui7mqmfh6DkeB5forTu6z
 Gn5e4DNbZvmcvkJQ+Rnkua1UmTZ4hr/+3YV9mqzsWYv+1hOTx/uomGbY7DjSdSyK
 vWWNwN97sgAjwhaFgWvB2iRk1pdAb4A3zP+NV1MXheOhHnAT3C6i43DaS1fivone
 YKLEqy4v3IzB5WcdlwclJW2qizoLtopu7A4pRURv9v+Q0wb4Q2YM0gRum59QgxZN
 +YUhglR5ucazYPmIAxOZMaU/WMIN6m4h3hRa1RkFRNXkBvPGxV2fQxi8exX0QWqf
 oxSSfImO0QVjYPlAL7oi0eWwHtqXtebXXdrUNozQdnrEQnimTrxPAuSnfRIv63un
 swlaCzfqXXhtl25t9p6Sx7xM7aKF2k7tYnZdSM7JjiOS7KXHFaZcYt3YcoFfdLc7
 X/vtT9OQWwnEtqzFKnK8EvcjSN+4KbXwI4neVLmsWK81dwqI2huScB+Xe5eBPidU
 6d6dZzUikA==
 =mbqK
 -----END PGP SIGNATURE-----

Merge tag 'block-6.17-20250822' of git://git.kernel.dk/linux

Pull block fixes from Jens Axboe:
 "A set of fixes for block that should go into this tree. A bit larger
  than what I usually have at this point in time, a lot of that is the
  continued fixing of the lockdep annotation for queue freezing that we
  recently added, which has highlighted a number of little issues here
  and there. This contains:

   - MD pull request via Yu:

       - Add a legacy_async_del_gendisk mode, to prevent a user tools
         regression. New user tools releases will not use such a mode,
         the old release with a new kernel now will have warning about
         deprecated behavior, and we prepare to remove this legacy mode
         after about a year later

       - The rename in kernel causing user tools build failure, revert
         the rename in mdp_superblock_s

       - Fix a regression that interrupted resync can be shown as
         recover from mdstat or sysfs

   - Improve file size detection for loop, particularly for networked
     file systems, by using getattr to get the size rather than the
     cached inode size.

   - Hotplug CPU lock vs queue freeze fix

   - Lockdep fix while updating the number of hardware queues

   - Fix stacking for PI devices

   - Silence bio_check_eod() for the known case of device removal where
     the size is truncated to 0 sectors"

* tag 'block-6.17-20250822' of git://git.kernel.dk/linux:
  block: avoid cpu_hotplug_lock depedency on freeze_lock
  block: decrement block_rq_qos static key in rq_qos_del()
  block: skip q->rq_qos check in rq_qos_done_bio()
  blk-mq: fix lockdep warning in __blk_mq_update_nr_hw_queues
  block: tone down bio_check_eod
  loop: use vfs_getattr_nosec for accurate file size
  loop: Consolidate size calculation logic into lo_calculate_size()
  block: remove newlines from the warnings in blk_validate_integrity_limits
  block: handle pi_tuple_size in queue_limits_stack_integrity
  selftests: ublk: Use ARRAY_SIZE() macro to improve code
  md: fix sync_action incorrect display during resync
  md: add helper rdev_needs_recovery()
  md: keep recovery_cp in mdp_superblock_s
  md: add legacy_async_del_gendisk mode
2025-08-22 09:29:51 -04:00
Linus Torvalds
f28ad47b66 sound fixes for 6.17-rc3
Only small fixes.
 
 - ASoC Cirrus codec fixes
 - A regression fix for the recent TAS2781 codec refactoring
 - A fix for user-timer error handling
 - Fixes for USB-audio descriptor validators
 - Usual HD-audio and ASoC device-specific quirks
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAminN10OHHRpd2FpQHN1
 c2UuZGUACgkQLtJE4w1nLE/RFw//XtS8u0fRY+WRbFdV7zE+nUBszbqAfOBs7kzd
 jB3iWJogKyeUq/whgT1xDa3R7PPHK74XDrSEAEJTTmyiUtAPMNh895CGIEqD07nz
 sg1rHlDLNgB4Hdc4cfiBXfSMZnPH4CAnWUSnUF7QsSXmaPHyhJsc3zQDwrVEl0/j
 DLuaF5BjzOGVL8my61UWCUrAEI+lVBerlJ5A2RT2LnZxH6f/PgtGmXyFElcfnxy0
 TFZ/na7llmNn4O+yUPq/w/lvaEXE5ER/G4vfDbtQTlOeBXI4IHJ2xWtPGGA1Nkbm
 YagdLxoBAMq+mL4HOHhldF0nuPbia0LFdpc5NEmFT8D4SOuy6WS+0qlqAxpytbSC
 T9UhLDe1lDiMhVYhnvqPORNIC7lCXsUHIT/fccaK240qpQidwzmNDA8JsFNC6ZZj
 D/wJddMk8XgCs3kmIa8P7nfnF4QO+xIATaiWjpBgE+ahIpWZFMq1f7ZKY3pwjqu3
 kJg4GsMeopqyOphD2mX3EQMJ6x4aDpemRLxVj9esPqvpT+j5dViLQsZI/h2n8ZUU
 V253FW9qj7uFPTQ/hYDcDXneMGG/kS741ggTFmHNJSNOAk31qBfOGjS52LkkHvw1
 DT/UouG6GRh4Qgq23doRIC2zRU6ySh4KbktGvysVAvljMvRJLroQywJNyaTVH3HP
 9Z+1zxI=
 =myx0
 -----END PGP SIGNATURE-----

Merge tag 'sound-6.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "Only small fixes.

   - ASoC Cirrus codec fixes

   - A regression fix for the recent TAS2781 codec refactoring

   - A fix for user-timer error handling

   - Fixes for USB-audio descriptor validators

   - Usual HD-audio and ASoC device-specific quirks"

* tag 'sound-6.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation
  ALSA: timer: fix ida_free call while not allocated
  ASoC: cs35l56: Remove SoundWire Clock Divider workaround for CS35L63
  ASoC: cs35l56: Handle new algorithms IDs for CS35L63
  ASoC: cs35l56: Update Firmware Addresses for CS35L63 for production silicon
  ALSA: hda: tas2781: Fix wrong reference of tasdevice_priv
  ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again
  ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14
  ASoC: codecs: ES9389: Modify the standby configuration
  ALSA: usb-audio: Fix size validation in convert_chmap_v3()
  ALSA: hda/tas2781: Add name prefix tas2781 for tas2781's dvc_tlv and amp_vol_tlv
  ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6
2025-08-22 09:05:37 -04:00
Linus Torvalds
e86ba12cf8 NFS client bugfix for Linux 6.17
Stable fixes:
 - NFS: Fix a data corrupting race when updating an existing write
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEESQctxSBg8JpV8KqEZwvnipYKAPIFAminvwMACgkQZwvnipYK
 APIFkxAAmmlm+6rVRmkb5W37hgcsntWS90CjIw6axH7WlFToypiDam83pCIYzAMc
 wzO5e03ZnKwp49zabTYSqoLD30/irZ3QwR6H1XIe6NToomYr43CZPjqctZLhVaeq
 HpLfBiJdxI2jJQMpHubQk66MyBhk0tXln+Pzzi59ZESOevbGWcT8bz6v849nIh0F
 emngSbMEKMXLrY+r/NsX31wF3Te4WYNyV/tumck3hOEZNouCKD/a2JKGEXdkWKw6
 1IFiTxo4IT8vsVrUTKsG3QUtkv/v8iZ0FSl1f9FD1C6eubX5Jo4JcEQmDc6NoJTF
 4viy0c19+8TUs//Kax4VlBE6opeb9jXba4iN0FOXeYsbqVXyv8fEuinLu174I+s4
 bQNpScZ8/o/dMio/Qa6RgTvxIvk9kICJEmfF1IKeIb7Kn+nczpsD8CqwT/EKiCV2
 ZotYZP5BP2BKYrtV5eUhWcl9mKpagz8ivHCevKvaG4JX+M2/XVNNspgkdr8hwu3j
 SX5lwOdLP//gHqt3x8PUCrD2G9Pn81qkshR5mfJAyWhPodwrP6vsDSvAnB93zeZB
 LVln0c1BHmvPpjAEnIzCh3mZXdzMHSVHxKldktYDfhfh/8tFJAkS7o3bXpgZ8dMF
 eHsYZHBJnByZBfi61B3RkWB9QU8KWi+winDQJpoU+MbZGxRdFmA=
 =Yh2D
 -----END PGP SIGNATURE-----

Merge tag 'nfs-for-6.17-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs

Pull NFS client fix from Trond Myklebust:

 - NFS: Fix a data corrupting race when updating an existing write

* tag 'nfs-for-6.17-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
  NFS: Fix a race when updating an existing write
2025-08-22 08:58:58 -04:00