Commit graph

171,073 commits

Author SHA1 Message Date
Linus Torvalds
9528d5c091 platform-drivers-x86 for v6.19-2
Fixes and New HW Support
 
 - alienware-wmi-wmax: Area-51, x16, and 16X Aurora laptops support
 
 - asus-armoury:
   - Fix FA507R PPT data
   - Add TDP data for more laptop models
 
 - asus-nb-wmi: Asus Zenbook 14 display toggle key support
 
 - dell-lis3lv02d: Dell Latitude 5400 support
 
 - hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing
 
 - ibm_rtl: Fix EBDA signature search pointer arithmetic
 
 - ideapad-laptop: Reassign KEY_CUT to KEY_SELECTIVE_SCREENSHOT
 
 - intel/pmt:
   - Fix kobject memory leak on init failure
   - Use valid pointers on error handling path
 
 - intel/vsec: Correct kernel doc comments
 
 - mellanox: mlxbf-pmc: Fix event names
 
 - msi-laptop: Add sysfs_remove_group()
 
 - samsumg-galaxybook: Do not cast pointer to a shorter type
 
 - think-lmi: WMI certificate thumbprint support for ThinkCenter
 
 - uniwill: Tuxedo Book BA15 Gen10 support
 
 The following is an automated shortlog grouped by driver:
 
 alienware-wmi-wmax:
  -  Add AWCC support for Alienware x16
  -  Add support for Alienware 16X Aurora
  -  Add support for new Area-51 laptops
 
 asus-armoury:
  -  add support for FA608UM
  -  add support for G615LR
  -  add support for G835LW
  -  add support for GA403WR
  -  add support for GU605CR
  -  fix ppt data for FA507R
 
 asus-nb-wmi:
  -  Add keymap for display toggle
 
 dell-lis3lv02d:
  -  Add Latitude 5400
 
 hp-bioscfg:
  -  Fix out-of-bounds array access in ACPI package parsing
 
 ibm_rtl:
  -  fix EBDA signature search pointer arithmetic
 
 ideapad-laptop:
  -  Reassign KEY_CUT to KEY_SELECTIVE_SCREENSHOT
 
 intel/pmt/discovery:
  -  use valid device pointer in dev_err_probe
 
 intel/pmt:
  -  Fix kobject memory leak on init failure
 
 intel/vsec:
  -  correct kernel-doc comments
 
 mlxbf-pmc:
  -  Remove trailing whitespaces from event names
 
 msi-laptop:
  -  add missing sysfs_remove_group()
 
 samsung-galaxybook:
  -  Fix problematic pointer cast
 
 think-lmi:
  -  Add WMI certificate thumbprint support for ThinkCenter
 
 uniwill:
  -  Add TUXEDO Book BA15 Gen10
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQSCSUwRdwTNL2MhaBlZrE9hU+XOMQUCaVT4igAKCRBZrE9hU+XO
 MTB4AQCIWd1/VEyiHw7nLVraCvVcG25m+E61XkALpP3KHzuWsAD/ejev+eNcng9W
 G+TnUShOsVJ3w++juDHX1PNG7CSNqQ4=
 =tvjU
 -----END PGP SIGNATURE-----

Merge tag 'platform-drivers-x86-v6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86

Pull x86 platform driver fixes from Ilpo Järvinen:

 - alienware-wmi-wmax: Area-51, x16, and 16X Aurora laptops support

 - asus-armoury:
    - Fix FA507R PPT data
    - Add TDP data for more laptop models

 - asus-nb-wmi: Asus Zenbook 14 display toggle key support

 - dell-lis3lv02d: Dell Latitude 5400 support

 - hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing

 - ibm_rtl: Fix EBDA signature search pointer arithmetic

 - ideapad-laptop: Reassign KEY_CUT to KEY_SELECTIVE_SCREENSHOT

 - intel/pmt:
    - Fix kobject memory leak on init failure
    - Use valid pointers on error handling path

 - intel/vsec: Correct kernel doc comments

 - mellanox: mlxbf-pmc: Fix event names

 - msi-laptop: Add sysfs_remove_group()

 - samsumg-galaxybook: Do not cast pointer to a shorter type

 - think-lmi: WMI certificate thumbprint support for ThinkCenter

 - uniwill: Tuxedo Book BA15 Gen10 support

* tag 'platform-drivers-x86-v6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (22 commits)
  platform/x86: asus-armoury: add support for G835LW
  platform/x86: asus-armoury: fix ppt data for FA507R
  platform/x86/intel/pmt/discovery: use valid device pointer in dev_err_probe
  platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing
  platform/x86: asus-armoury: add support for G615LR
  platform/x86: asus-armoury: add support for FA608UM
  platform/x86: asus-armoury: add support for GA403WR
  platform/x86: asus-armoury: add support for GU605CR
  platform/x86: ideapad-laptop: Reassign KEY_CUT to KEY_SELECTIVE_SCREENSHOT
  platform/x86: samsung-galaxybook: Fix problematic pointer cast
  platform/x86/intel/pmt: Fix kobject memory leak on init failure
  platform/x86/intel/vsec: correct kernel-doc comments
  platform/x86: ibm_rtl: fix EBDA signature search pointer arithmetic
  platform/x86: msi-laptop: add missing sysfs_remove_group()
  platform/x86: think-lmi: Add WMI certificate thumbprint support for ThinkCenter
  platform/x86: dell-lis3lv02d: Add Latitude 5400
  platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names
  platform/x86: asus-nb-wmi: Add keymap for display toggle
  platform/x86/uniwill: Add TUXEDO Book BA15 Gen10
  platform/x86: alienware-wmi-wmax: Add support for Alienware 16X Aurora
  ...
2025-12-31 12:25:22 -08:00
Linus Torvalds
349bd28a86 VFIO fixes for v6.19-rc4
- Restrict ROM access to dword to resolve a regression introduced
    with qword access seen on some Intel NICs.  Update VGA region
    access to the same given lack of precedent for 64-bit users.
    (Kevin Tian)
 
  - Fix missing .get_region_info_caps callback in the xe-vfio-pci
    variant driver due to integration through the DRM tree.
    (Michal Wajdeczko)
 
  - Add aligned 64-bit access macros to tools/include/linux/types.h,
    allowing removal of uapi/linux/type.h includes from various
    vfio selftest, resolving redefinition warnings for integration
    with KVM selftests. (David Matlack)
 
  - Fix error path memory leak in pds-vfio-pci variant driver.
    (Zilin Guan)
 
  - Fix error path use-after-free in xe-vfio-pci variant driver.
    (Alper Ak)
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEQvbATlQL0amee4qQI5ubbjuwiyIFAmlUP2oRHGFsZXhAc2hh
 emJvdC5vcmcACgkQI5ubbjuwiyKYsw//fEJ6vfn0TOP/ahfY9tRpw6suZJuEo5wx
 SJj57kMF85/V64iaewRq1G1hbrEAEcOgDtpcR3y57lHAS8METKxyjxL5YZdqvgX4
 kRvDwRJRcFz/kvmO0PZx6rn21ZxLv2d9RXahDwaqaQfw2pR2ZOtr/zaawMr6LPmw
 Z1dl0UhQnHIhw4kG1QKUhdCozhAgSV3/pmGV2bOjgXRS0rVUZ3UQZ0RprLe6uIEl
 hSWLmeWUtyrt30gVzoKPTWWuRvuIw2lnAH2PGhNtha70Djyx1EAUs7iqUA8XBsQh
 7JG/T1yibh9CzE5OzI+JBmix5s8zxd4q0RHNa9T31EMHSdzCJhXQfLiZVeJVv9O6
 EHsFVWHzE4CXgSMEpD+QjfCrEwBcF4n6W6N68BFAuAVN51+0DoFinFF0PaqpTivj
 U/Yh1erkfFhy8IlO33Q2dAOxBfy1aIkszKS2Xkc1pwX3vReMlHiWDmyM5ciB0VKJ
 GwslXQwGljSNuxE81e7EFI6g18FGGLGt5EkkYPhSS/hYAZQy0RpqPdRopcP85OiO
 HtyfZZZ/Ph0y13f7c7rH5awGm9NOc9W+2xNKxuKNkjwvEmjO12lRmrzGkKPu/OTi
 YluIWSFG7gBQfb8eFgcfJoM7vcrRCJ+JeSp5fa7u8QLUsTk+var+/WCxKs9BpX31
 hDb8rHj0Bwo=
 =a1By
 -----END PGP SIGNATURE-----

Merge tag 'vfio-v6.19-rc4' of https://github.com/awilliam/linux-vfio

Pull VFIO fixes from Alex Williamson:

 - Restrict ROM access to dword to resolve a regression introduced with
   qword access seen on some Intel NICs. Update VGA region access to the
   same given lack of precedent for 64-bit users (Kevin Tian)

 - Fix missing .get_region_info_caps callback in the xe-vfio-pci variant
   driver due to integration through the DRM tree (Michal Wajdeczko)

 - Add aligned 64-bit access macros to tools/include/linux/types.h,
   allowing removal of uapi/linux/type.h includes from various vfio
   selftest, resolving redefinition warnings for integration with KVM
   selftests (David Matlack)

 - Fix error path memory leak in pds-vfio-pci variant driver (Zilin Guan)

 - Fix error path use-after-free in xe-vfio-pci variant driver (Alper Ak)

* tag 'vfio-v6.19-rc4' of https://github.com/awilliam/linux-vfio:
  vfio/xe: Fix use-after-free in xe_vfio_pci_alloc_file()
  vfio/pds: Fix memory leak in pds_vfio_dirty_enable()
  vfio: selftests: Drop <uapi/linux/types.h> includes
  tools include: Add definitions for __aligned_{l,b}e64
  vfio/xe: Add default handler for .get_region_info_caps
  vfio/pci: Disable qword access to the VGA region
  vfio/pci: Disable qword access to the PCI ROM bar
2025-12-31 10:38:48 -08:00
Linus Torvalds
dbf8fe85a1 Including fixes from Bluetooth and WiFi. Notably this includes the fix
for the iwlwifi issue you reported.
 
 Current release - regressions:
 
   - core: avoid prefetching NULL pointers
 
   - wifi:
     - iwlwifi: implement settime64 as stub for MVM/MLD PTP
     - mac80211: fix list iteration in ieee80211_add_virtual_monitor()
 
   - handshake: fix null-ptr-deref in handshake_complete()
 
   - eth: mana: fix use-after-free in reset service rescan path
 
 Previous releases - regressions:
 
   - openvswitch: avoid needlessly taking the RTNL on vport destroy
 
   - dsa: properly keep track of conduit reference
 
   - ipv4:
     - fix reference count leak when using error routes with nexthop objects
     - fib: restore ECMP balance from loopback
 
   - mptcp: ensure context reset on disconnect()
 
   - bluetooth: fix potential UaF in btusb
 
   - nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write
 
   - eth: gve: defer interrupt enabling until NAPI registration
 
   - eth: i40e: fix scheduling in set_rx_mode
 
   - eth: macb: relocate mog_init_rings() callback from macb_mac_link_up() to macb_open()
 
   - eth: rtl8150: fix memory leak on usb_submit_urb() failure
 
   - wifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc()
 
 Previous releases - always broken:
 
   - ip6_gre: make ip6gre_header() robust
 
   - ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT
 
   - af_unix: don't post cmsg for SO_INQ unless explicitly asked for
 
   - phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration
 
   - wifi: mac80211: discard beacon frames to non-broadcast address
 
   - eth: iavf: fix off-by-one issues in iavf_config_rss_reg()
 
   - eth: stmmac: fix the crash issue for zero copy XDP_TX action
 
   - eth: team: fix check for port enabled in team_queue_override_port_prio_changed()
 
 Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCgAwFiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmlT43wSHHBhYmVuaUBy
 ZWRoYXQuY29tAAoJECkkeY3MjxOkHhMP/jF3B8c3djMgpYpEwPRgqJlzdpBGQvcO
 UsN/8fYI/XowIcU6T/yC/KM5cABCWyfnj6yZe743wPrlj8DnWK7+Fezrfwx7l8e0
 0LH9kVwOIaQXg/QthtXaDHNB/9OanDtgcpitI209gENRjF81bYWCehImil6jbVnn
 DUnVmfZIQ6k3dFsAPC4W7uJdA2FORtQzEZ1dZ13Ivx9jmbazK81ptUbIMAAnyfIZ
 rUhv+UqaDIlflYwuay58ZPdu8no4nQlJMPiPybXiizfTVStEne9SQKOacP8j7XL0
 GSjEyDO8lJXCPVSVnGEyybBH50M0myGUSH73+56o2QRRLtrHLDfieOL/N8AarNDh
 7U2g9pq0+IFPuJsm9SFR14dIpUAvpKohc57ZvsmworC8NuENzl6H3b6/U4n/1oNE
 JCbcitl91GkyF0Bvyac5a9wfk8SsYEJEGLPrtNX8UwH0UJh8spkfoQq5oHkC3juQ
 77n//eOFSz8oPDlV7ayNv+W3CEzOW09mSYFu8bdjBKC5HeyBJsm3HnJdaAhSqNEH
 6duRvcMlUJQ0JPILJoS1Zoy166uIu8hs2mZtygcAzyacia8yckL+Oq2UCYMi2oKP
 psOIzfd6G/+f203w37jdSY0OVlQSHvmCFSeaY6FHs2LEApDrNWK1cMLYO+lMU8EE
 q0j2SmDNMHhM
 =P1hX
 -----END PGP SIGNATURE-----

Merge tag 'net-6.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Paolo Abeni:
 "Including fixes from Bluetooth and WiFi. Notably this includes the fix
  for the iwlwifi issue you reported.

  Current release - regressions:

   - core: avoid prefetching NULL pointers

   - wifi:
      - iwlwifi: implement settime64 as stub for MVM/MLD PTP
      - mac80211: fix list iteration in ieee80211_add_virtual_monitor()

   - handshake: fix null-ptr-deref in handshake_complete()

   - eth: mana: fix use-after-free in reset service rescan path

  Previous releases - regressions:

   - openvswitch: avoid needlessly taking the RTNL on vport destroy

   - dsa: properly keep track of conduit reference

   - ipv4:
      - fix error route reference count leak with nexthop objects
      - fib: restore ECMP balance from loopback

   - mptcp: ensure context reset on disconnect()

   - bluetooth: fix potential UaF in btusb

   - nfc: fix deadlock between nfc_unregister_device and
     rfkill_fop_write

   - eth:
      - gve: defer interrupt enabling until NAPI registration
      - i40e: fix scheduling in set_rx_mode
      - macb: relocate mog_init_rings() callback from macb_mac_link_up()
        to macb_open()
      - rtl8150: fix memory leak on usb_submit_urb() failure

   - wifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc()

  Previous releases - always broken:

   - ip6_gre: make ip6gre_header() robust

   - ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT

   - af_unix: don't post cmsg for SO_INQ unless explicitly asked for

   - phy: mediatek: fix nvmem cell reference leak in
     mt798x_phy_calibration

   - wifi: mac80211: discard beacon frames to non-broadcast address

   - eth:
      - iavf: fix off-by-one issues in iavf_config_rss_reg()
      - stmmac: fix the crash issue for zero copy XDP_TX action
      - team: fix check for port enabled when priority changes"

* tag 'net-6.19-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (64 commits)
  ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT
  net: rose: fix invalid array index in rose_kill_by_device()
  net: enetc: do not print error log if addr is 0
  net: macb: Relocate mog_init_rings() callback from macb_mac_link_up() to macb_open()
  selftests: fib_test: Add test case for ipv4 multi nexthops
  net: fib: restore ECMP balance from loopback
  selftests: fib_nexthops: Add test cases for error routes deletion
  ipv4: Fix reference count leak when using error routes with nexthop objects
  net: usb: sr9700: fix incorrect command used to write single register
  ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()
  usbnet: avoid a possible crash in dql_completed()
  gve: defer interrupt enabling until NAPI registration
  net: stmmac: fix the crash issue for zero copy XDP_TX action
  octeontx2-pf: fix "UBSAN: shift-out-of-bounds error"
  af_unix: don't post cmsg for SO_INQ unless explicitly asked for
  net: mana: Fix use-after-free in reset service rescan path
  net: avoid prefetching NULL pointers
  net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group struct
  net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write
  net: usb: asix: validate PHY address before use
  ...
2025-12-30 08:45:58 -08:00
Linus Torvalds
0b34fd0fea 27 hotfixes. 12 are cc:stable, 18 are MM.
There's a three patch series from Jiayuan Chen which fixes some issues
 with KASAN and vmalloc.  Apart from that it's the usual shower of
 singletons - please see the respective changelogs for details.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCaVIWxwAKCRDdBJ7gKXxA
 jt6HAP49s/mEIIbuZbqnX8hxDrvYdYffs+RsSLPEZoR+yKG/7gD/VqSZhMoPw53b
 rMZ56djXNjWxsOAfiVbZit3SFuQfnQ4=
 =5rGD
 -----END PGP SIGNATURE-----

Merge tag 'mm-hotfixes-stable-2025-12-28-21-50' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull misc fixes from Andrew Morton:
 "27 hotfixes.  12 are cc:stable, 18 are MM.

  There's a patch series from Jiayuan Chen which fixes some
  issues with KASAN and vmalloc. Apart from that it's the usual
  shower of singletons - please see the respective changelogs
  for details"

* tag 'mm-hotfixes-stable-2025-12-28-21-50' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (27 commits)
  mm/ksm: fix pte_unmap_unlock of wrong address in break_ksm_pmd_entry
  mm/page_owner: fix memory leak in page_owner_stack_fops->release()
  mm/memremap: fix spurious large folio warning for FS-DAX
  MAINTAINERS: notify the "Device Memory" community of memory hotplug changes
  sparse: update MAINTAINERS info
  mm/page_alloc: report 1 as zone_batchsize for !CONFIG_MMU
  mm: consider non-anon swap cache folios in folio_expected_ref_count()
  rust: maple_tree: rcu_read_lock() in destructor to silence lockdep
  mm: memcg: fix unit conversion for K() macro in OOM log
  mm: fixup pfnmap memory failure handling to use pgoff
  tools/mm/page_owner_sort: fix timestamp comparison for stable sorting
  selftests/mm: fix thread state check in uffd-unit-tests
  kernel/kexec: fix IMA when allocation happens in CMA area
  kernel/kexec: change the prototype of kimage_map_segment()
  MAINTAINERS: add ABI headers to KHO and LIVE UPDATE
  .mailmap: remove one of the entries for WangYuli
  mm/damon/vaddr: fix missing pte_unmap_unlock in damos_va_migrate_pmd_entry()
  MAINTAINERS: update one straggling entry for Bartosz Golaszewski
  mm/page_alloc: change all pageblocks migrate type on coalescing
  mm: leafops.h: correct kernel-doc function param. names
  ...
2025-12-29 11:40:38 -08:00
Linus Torvalds
651df41997 regulator: Fixes for v6.19
A couple of fixes from Thomas, making the UAPI headers more robustly
 correct and ensuring they are covered by checkpatch, and one from
 Andreas fixing an update for a change to the DT bindings that I missed
 was requested during bindings review in the newly added fp9931 driver.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmlPvaEACgkQJNaLcl1U
 h9A9Ogf9Fp1tjyQK1onQZlG9EcPGF2gZ3wTKdxEb1PZOx7ioyLUrQHtB1b1wPpEr
 Wniq2BxsG4yqGxaBPSiA7NsLe35CgozvDNy/kJXAcPsix9ZKEMtcjQuZQ9hD8fR9
 SWYLMoey/hZDu/OdF7pnmOEjm9WmXjQ1ielfaAEzwV7rgkZkWSsslj04joYsMcFX
 ESO12jea/pHBj5nI0nfSaRH5UW+spyR3KScU1Z3RP23boG3+ZtT6NK1Kyx3K+x5V
 k0d71rDcqIKn/QYEF651H0RIsrJ8BYd85QAtCW+Of4ATCNttTgeKLN8ZhC91gOns
 VlCogXA+t85KzmVtLH5Fia98lJu+ig==
 =0hFe
 -----END PGP SIGNATURE-----

Merge tag 'regulator-fix-v6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator

Pull regulator fixes from Mark Brown:
 "A couple of fixes from Thomas, making the UAPI headers more robustly
  correct and ensuring they are covered by checkpatch, and one from
  Andreas fixing an update for a change to the DT bindings that I missed
  was requested during bindings review in the newly added fp9931 driver"

* tag 'regulator-fix-v6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
  regulator: fp9931: fix regulator node pointer
  regulator: Add UAPI headers to MAINTAINERS
  regulator: uapi: Use UAPI integer type
2025-12-27 08:04:39 -08:00
Linus Torvalds
1e5e062ad8 Driver core fixes for 6.19-rc3
- Introduce DMA Rust helpers to avoid build errors when !CONFIG_HAS_DMA.
 
 - Remove unnecessary (and hence incorrect) endian conversion in the Rust
   PCI driver sample code.
 
 - Fix memory leak in the unwind path of debugfs_change_name().
 
 - Support non-const struct software_node pointers in
   SOFTWARE_NODE_REFERENCE(), after introducing _Generic().
 
 - Avoid NULL pointer dereference in the unwind path of
   simple_xattrs_free().
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQS2q/xV6QjXAdC7k+1FlHeO1qrKLgUCaU7O/wAKCRBFlHeO1qrK
 LirZAPoCljVnVVZoA1oesoyIQ8KWDdoC55dfUZyCp4yz87MvjgD/e1Gw1o+y3YyS
 dut7ODDimiUPh0I54nMX4l561NMVggU=
 =v3Qg
 -----END PGP SIGNATURE-----

Merge tag 'driver-core-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core

Pull driver core fixes from Danilo Krummrich:

 - Introduce DMA Rust helpers to avoid build errors when !CONFIG_HAS_DMA

 - Remove unnecessary (and hence incorrect) endian conversion in the
   Rust PCI driver sample code

 - Fix memory leak in the unwind path of debugfs_change_name()

 - Support non-const struct software_node pointers in
   SOFTWARE_NODE_REFERENCE(), after introducing _Generic()

 - Avoid NULL pointer dereference in the unwind path of
   simple_xattrs_free()

* tag 'driver-core-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:
  fs/kernfs: null-ptr deref in simple_xattrs_free()
  software node: Also support referencing non-constant software nodes
  debugfs: Fix memleak in debugfs_change_name().
  samples: rust: fix endianness issue in rust_driver_pci
  rust: dma: add helpers for architectures without CONFIG_HAS_DMA
2025-12-26 13:41:02 -08:00
Linus Torvalds
8f0cbedc86 virtio,vhost: fixes
Just a bunch of fixes, mostly trivial ones in tools/virtio
 
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQFDBAABCgAtFiEEXQn9CHHI+FuUyooNKB8NuNKNVGkFAmlOnSYPHG1zdEByZWRo
 YXQuY29tAAoJECgfDbjSjVRpLvsH/RiAvtYIimnu5XEuk013EB9T4WXn8dE4pDRt
 EwZyJie+Ox99ZpNTLEgqpN4jyOQzJ7udVIgbHANR0SWqHtXzYV39I5tI7ZCJ951F
 /CXax7INc/oS0s0bHpMKhji8U0FTvtrBY0d9FgvmVTXJpEhnwyKPKx0Z8eJEvaaU
 1OCpMNOhbx5EIS9CWvxyJtcc8y2jY6CO855BCph3IdCdUlOTJLrJ6nPdAyP2RRuL
 +pjsWRH/ZKhYpL5zmLbTDduRTDaKdns00sMMN6xqjNgu4bgvBo2DM5ljZrRKoFTB
 zZAQsitIjR5nxcrtv1QxEeL32XENkb4iXOb9T96+3veEwk9SlRM=
 =Ofvg
 -----END PGP SIGNATURE-----

Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost

Pull virtio fixes from Michael Tsirkin:
 "Just a bunch of fixes, mostly trivial ones in tools/virtio"

* tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost:
  vhost/vsock: improve RCU read sections around vhost_vsock_get()
  tools/virtio: add device, device_driver stubs
  tools/virtio: fix up oot build
  virtio_features: make it self-contained
  tools/virtio: switch to kernel's virtio_config.h
  tools/virtio: stub might_sleep and synchronize_rcu
  tools/virtio: add struct cpumask to cpumask.h
  tools/virtio: pass KCFLAGS to module build
  tools/virtio: add ucopysize.h stub
  tools/virtio: add dev_WARN_ONCE and is_vmalloc_addr stubs
  tools/virtio: stub DMA mapping functions
  tools/virtio: add struct module forward declaration
  tools/virtio: use kernel's virtio.h
  virtio: make it self-contained
  tools/virtio: fix up compiler.h stub
2025-12-26 11:11:30 -08:00
Michael S. Tsirkin
e88dfb9331 virtio_features: make it self-contained
virtio_features.h uses WARN_ON_ONCE and memset so it must
include linux/bug.h and linux/string.h

Message-ID: <579986aa9b8d023844990d2a0e267382f8ad85d5.1764873799.git.mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-12-24 08:02:56 -05:00
Michael S. Tsirkin
f059588c55 virtio: make it self-contained
virtio.h uses struct module, add a forward declaration to
make the header self-contained.

Message-ID: <9171b5cac60793eb59ab044c96ee038bf1363bee.1764873799.git.mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-12-24 08:02:55 -05:00
Kevin Tian
dc85a46928 vfio/pci: Disable qword access to the PCI ROM bar
Commit 2b938e3db3 ("vfio/pci: Enable iowrite64 and ioread64 for vfio
pci") enables qword access to the PCI bar resources. However certain
devices (e.g. Intel X710) are observed with problem upon qword accesses
to the rom bar, e.g. triggering PCI aer errors.

This is triggered by Qemu which caches the rom content by simply does a
pread() of the remaining size until it gets the full contents. The other
bars would only perform operations at the same access width as their
guest drivers.

Instead of trying to identify all broken devices, universally disable
qword access to the rom bar i.e. going back to the old way which worked
reliably for years.

Reported-by: Farrah Chen <farrah.chen@intel.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220740
Fixes: 2b938e3db3 ("vfio/pci: Enable iowrite64 and ioread64 for vfio pci")
Cc: stable@vger.kernel.org
Signed-off-by: Kevin Tian <kevin.tian@intel.com>
Tested-by: Farrah Chen <farrah.chen@intel.com>
Link: https://lore.kernel.org/r/20251218081650.555015-2-kevin.tian@intel.com
Signed-off-by: Alex Williamson <alex@shazbot.org>
2025-12-23 14:07:08 -07:00
Bijan Tabatabai
f183663901 mm: consider non-anon swap cache folios in folio_expected_ref_count()
Currently, folio_expected_ref_count() only adds references for the swap
cache if the folio is anonymous.  However, according to the comment above
the definition of PG_swapcache in enum pageflags, shmem folios can also
have PG_swapcache set.  This patch makes sure references for the swap
cache are added if folio_test_swapcache(folio) is true.

This issue was found when trying to hot-unplug memory in a QEMU/KVM
virtual machine.  When initiating hot-unplug when most of the guest memory
is allocated, hot-unplug hangs partway through removal due to migration
failures.  The following message would be printed several times, and would
be printed again about every five seconds:

[   49.641309] migrating pfn b12f25 failed ret:7
[   49.641310] page: refcount:2 mapcount:0 mapping:0000000033bd8fe2 index:0x7f404d925 pfn:0xb12f25
[   49.641311] aops:swap_aops
[   49.641313] flags: 0x300000000030508(uptodate|active|owner_priv_1|reclaim|swapbacked|node=0|zone=3)
[   49.641314] raw: 0300000000030508 ffffed312c4bc908 ffffed312c4bc9c8 0000000000000000
[   49.641315] raw: 00000007f404d925 00000000000c823b 00000002ffffffff 0000000000000000
[   49.641315] page dumped because: migration failure

When debugging this, I found that these migration failures were due to
__migrate_folio() returning -EAGAIN for a small set of folios because the
expected reference count it calculates via folio_expected_ref_count() is
one less than the actual reference count of the folios.  Furthermore, all
of the affected folios were not anonymous, but had the PG_swapcache flag
set, inspiring this patch.  After applying this patch, the memory
hot-unplug behaves as expected.

I tested this on a machine running Ubuntu 24.04 with kernel version
6.8.0-90-generic and 64GB of memory.  The guest VM is managed by libvirt
and runs Ubuntu 24.04 with kernel version 6.18 (though the head of the
mm-unstable branch as a Dec 16, 2025 was also tested and behaves the same)
and 48GB of memory.  The libvirt XML definition for the VM can be found at
[1].  CONFIG_MHP_DEFAULT_ONLINE_TYPE_ONLINE_MOVABLE is set in the guest
kernel so the hot-pluggable memory is automatically onlined.

Below are the steps to reproduce this behavior:

1) Define and start and virtual machine
  host$ virsh -c qemu:///system define ./test_vm.xml # test_vm.xml from [1]
  host$ virsh -c qemu:///system start test_vm

2) Setup swap in the guest
  guest$ sudo fallocate -l 32G /swapfile
  guest$ sudo chmod 0600 /swapfile
  guest$ sudo mkswap /swapfile
  guest$ sudo swapon /swapfile

3) Use alloc_data [2] to allocate most of the remaining guest memory
  guest$ ./alloc_data 45

4) In a separate guest terminal, monitor the amount of used memory
  guest$ watch -n1 free -h

5) When alloc_data has finished allocating, initiate the memory
hot-unplug using the provided xml file [3]
  host$ virsh -c qemu:///system detach-device test_vm ./remove.xml --live

After initiating the memory hot-unplug, you should see the amount of
available memory in the guest decrease, and the amount of used swap data
increase.  If everything works as expected, when all of the memory is
unplugged, there should be around 8.5-9GB of data in swap.  If the
unplugging is unsuccessful, the amount of used swap data will settle below
that.  If that happens, you should be able to see log messages in dmesg
similar to the one posted above.

Link: https://lkml.kernel.org/r/20251216200727.2360228-1-bijan311@gmail.com
Link: https://github.com/BijanT/linux_patch_files/blob/main/test_vm.xml [1]
Link: https://github.com/BijanT/linux_patch_files/blob/main/alloc_data.c [2]
Link: https://github.com/BijanT/linux_patch_files/blob/main/remove.xml [3]
Fixes: 86ebd50224 ("mm: add folio_expected_ref_count() for reference count calculation")
Signed-off-by: Bijan Tabatabai <bijan311@gmail.com>
Acked-by: David Hildenbrand (Red Hat) <david@kernel.org>
Acked-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Shivank Garg <shivankg@amd.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Kairui Song <ryncsn@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-12-23 11:23:15 -08:00
Ankit Agrawal
e6dbcb7c0e mm: fixup pfnmap memory failure handling to use pgoff
The memory failure handling implementation for the PFNMAP memory with no
struct pages is faulty.  The VA of the mapping is determined based on the
the PFN.  It should instead be based on the file mapping offset.

At the occurrence of poison, the memory_failure_pfn is triggered on the
poisoned PFN.  Introduce a callback function that allows mm to translate
the PFN to the corresponding file page offset.  The kernel module using
the registration API must implement the callback function and provide the
translation.  The translated value is then used to determine the VA
information and sending the SIGBUS to the usermode process mapped to the
poisoned PFN.

The callback is also useful for the driver to be notified of the poisoned
PFN, which may then track it.

Link: https://lkml.kernel.org/r/20251211070603.338701-2-ankita@nvidia.com
Fixes: 2ec4196718 ("mm: handle poisoning of pfn without struct pages")
Signed-off-by: Ankit Agrawal <ankita@nvidia.com>
Suggested-by: Jason Gunthorpe <jgg@nvidia.com>
Cc: Kevin Tian <kevin.tian@intel.com>
Cc: Matthew R. Ochs <mochs@nvidia.com>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Naoya Horiguchi <nao.horiguchi@gmail.com>
Cc: Neo Jia <cjia@nvidia.com>
Cc: Vikram Sethi <vsethi@nvidia.com>
Cc: Yishai Hadas <yishaih@nvidia.com>
Cc: Zhi Wang <zhiw@nvidia.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-12-23 11:23:15 -08:00
Pingfan Liu
fe55ea8593 kernel/kexec: change the prototype of kimage_map_segment()
The kexec segment index will be required to extract the corresponding
information for that segment in kimage_map_segment().  Additionally,
kexec_segment already holds the kexec relocation destination address and
size.  Therefore, the prototype of kimage_map_segment() can be changed.

Link: https://lkml.kernel.org/r/20251216014852.8737-1-piliu@redhat.com
Fixes: 07d2490297 ("kexec: enable CMA based contiguous allocation")
Signed-off-by: Pingfan Liu <piliu@redhat.com>
Acked-by: Baoquan He <bhe@redhat.com>
Cc: Mimi Zohar <zohar@linux.ibm.com>
Cc: Roberto Sassu <roberto.sassu@huawei.com>
Cc: Alexander Graf <graf@amazon.com>
Cc: Steven Chen <chenste@linux.microsoft.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-12-23 11:23:13 -08:00
Randy Dunlap
6ba776b533 mm: leafops.h: correct kernel-doc function param. names
Modify the kernel-doc function parameter names to prevent kernel-doc
warnings:

Warning: include/linux/leafops.h:135 function parameter 'entry' not
 described in 'leafent_type'
Warning: include/linux/leafops.h:540 function parameter 'pte' not
 described in 'pte_is_uffd_marker'

Link: https://lkml.kernel.org/r/20251214201517.2187051-1-rdunlap@infradead.org
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-12-23 11:23:12 -08:00
Maciej Wieczor-Retman
6f13db031e kasan: refactor pcpu kasan vmalloc unpoison
A KASAN tag mismatch, possibly causing a kernel panic, can be observed
on systems with a tag-based KASAN enabled and with multiple NUMA nodes.
It was reported on arm64 and reproduced on x86. It can be explained in
the following points:

1. There can be more than one virtual memory chunk.
2. Chunk's base address has a tag.
3. The base address points at the first chunk and thus inherits
   the tag of the first chunk.
4. The subsequent chunks will be accessed with the tag from the
   first chunk.
5. Thus, the subsequent chunks need to have their tag set to
   match that of the first chunk.

Refactor code by reusing __kasan_unpoison_vmalloc in a new helper in
preparation for the actual fix.

Link: https://lkml.kernel.org/r/eb61d93b907e262eefcaa130261a08bcb6c5ce51.1764874575.git.m.wieczorretman@pm.me
Fixes: 1d96320f8d ("kasan, vmalloc: add vmalloc tagging for SW_TAGS")
Signed-off-by: Maciej Wieczor-Retman <maciej.wieczor-retman@intel.com>
Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Danilo Krummrich <dakr@kernel.org>
Cc: Dmitriy Vyukov <dvyukov@google.com>
Cc: Jiayuan Chen <jiayuan.chen@linux.dev>
Cc: Kees Cook <kees@kernel.org>
Cc: Marco Elver <elver@google.com>
Cc: "Uladzislau Rezki (Sony)" <urezki@gmail.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: <stable@vger.kernel.org>	[6.1+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-12-23 11:23:11 -08:00
Jiayuan Chen
007f5da43b mm/kasan: fix incorrect unpoisoning in vrealloc for KASAN
Patch series "kasan: vmalloc: Fixes for the percpu allocator and
vrealloc", v3.

Patches fix two issues related to KASAN and vmalloc.

The first one, a KASAN tag mismatch, possibly resulting in a kernel panic,
can be observed on systems with a tag-based KASAN enabled and with
multiple NUMA nodes.  Initially it was only noticed on x86 [1] but later a
similar issue was also reported on arm64 [2].

Specifically the problem is related to how vm_structs interact with
pcpu_chunks - both when they are allocated, assigned and when pcpu_chunk
addresses are derived.

When vm_structs are allocated they are unpoisoned, each with a different
random tag, if vmalloc support is enabled along the KASAN mode.  Later
when first pcpu chunk is allocated it gets its 'base_addr' field set to
the first allocated vm_struct.  With that it inherits that vm_struct's
tag.

When pcpu_chunk addresses are later derived (by pcpu_chunk_addr(), for
example in pcpu_alloc_noprof()) the base_addr field is used and offsets
are added to it.  If the initial conditions are satisfied then some of the
offsets will point into memory allocated with a different vm_struct.  So
while the lower bits will get accurately derived the tag bits in the top
of the pointer won't match the shadow memory contents.

The solution (proposed at v2 of the x86 KASAN series [3]) is to unpoison
the vm_structs with the same tag when allocating them for the per cpu
allocator (in pcpu_get_vm_areas()).

The second one reported by syzkaller [4] is related to vrealloc and
happens because of random tag generation when unpoisoning memory without
allocating new pages.  This breaks shadow memory tracking and needs to
reuse the existing tag instead of generating a new one.  At the same time
an inconsistency in used flags is corrected.


This patch (of 3):

Syzkaller reported a memory out-of-bounds bug [4].  This patch fixes two
issues:

1. In vrealloc the KASAN_VMALLOC_VM_ALLOC flag is missing when
   unpoisoning the extended region. This flag is required to correctly
   associate the allocation with KASAN's vmalloc tracking.

   Note: In contrast, vzalloc (via __vmalloc_node_range_noprof)
   explicitly sets KASAN_VMALLOC_VM_ALLOC and calls
   kasan_unpoison_vmalloc() with it.  vrealloc must behave consistently --
   especially when reusing existing vmalloc regions -- to ensure KASAN can
   track allocations correctly.

2. When vrealloc reuses an existing vmalloc region (without allocating
   new pages) KASAN generates a new tag, which breaks tag-based memory
   access tracking.

Introduce KASAN_VMALLOC_KEEP_TAG, a new KASAN flag that allows reusing the
tag already attached to the pointer, ensuring consistent tag behavior
during reallocation.

Pass KASAN_VMALLOC_KEEP_TAG and KASAN_VMALLOC_VM_ALLOC to the
kasan_unpoison_vmalloc inside vrealloc_node_align_noprof().

Link: https://lkml.kernel.org/r/cover.1765978969.git.m.wieczorretman@pm.me
Link: https://lkml.kernel.org/r/38dece0a4074c43e48150d1e242f8242c73bf1a5.1764874575.git.m.wieczorretman@pm.me
Link: https://lore.kernel.org/all/e7e04692866d02e6d3b32bb43b998e5d17092ba4.1738686764.git.maciej.wieczor-retman@intel.com/ [1]
Link: https://lore.kernel.org/all/aMUrW1Znp1GEj7St@MiWiFi-R3L-srv/ [2]
Link: https://lore.kernel.org/all/CAPAsAGxDRv_uFeMYu9TwhBVWHCCtkSxoWY4xmFB_vowMbi8raw@mail.gmail.com/ [3]
Link: https://syzkaller.appspot.com/bug?extid=997752115a851cb0cf36 [4]
Fixes: a0309faf1c ("mm: vmalloc: support more granular vrealloc() sizing")
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Co-developed-by: Maciej Wieczor-Retman <maciej.wieczor-retman@intel.com>
Signed-off-by: Maciej Wieczor-Retman <maciej.wieczor-retman@intel.com>
Reported-by: syzbot+997752115a851cb0cf36@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/68e243a2.050a0220.1696c6.007d.GAE@google.com/T/
Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Danilo Krummrich <dakr@kernel.org>
Cc: Dmitriy Vyukov <dvyukov@google.com>
Cc: Kees Cook <kees@kernel.org>
Cc: Marco Elver <elver@google.com>
Cc: "Uladzislau Rezki (Sony)" <urezki@gmail.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-12-23 11:23:11 -08:00
Andrew Morton
5393802c94 genalloc.h: fix htmldocs warning
WARNING: include/linux/genalloc.h:52 function parameter 'start_addr' not described in 'genpool_algo_t'

Fixes: 52fbf1134d ("lib/genalloc.c: fix allocation of aligned buffer from non-aligned chunk")
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Closes: https://lkml.kernel.org/r/20251127130624.563597e3@canb.auug.org.au
Acked-by: Randy Dunlap <rdunlap@infradead.org>
Tested-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Alexey Skidanov <alexey.skidanov@intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-12-23 11:23:10 -08:00
Linus Torvalds
ebb8719c1a sound fixes for 6.13-rc3
Likely the last PR in 2025, again a collection of lots of small fixes.
 Most of them are various device-specific small fixes.
 
 * An ASoC core fix for correcting the clamping behavior of *_SX mixer
   elements
 * Various fixes for ASoC fsl, SOF, etc
 * Usual HD- and USB-audio quirks / fix-ups
 * A couple of error-handling fixes for legacy PCMCIA drivers
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmlKYp8OHHRpd2FpQHN1
 c2UuZGUACgkQLtJE4w1nLE/9kQ/8CGqzZrNJ/+ElfVb3NGK83T7mKUZtUCwesXo2
 87wznZ/QecZARGM2bckoW0oX/q9KxqUKQRGIwYjnOXCSnSLIQUOuyDLPC+PIGZZT
 8aY+WUJ6KgUnrnZSQdq1P6uhl6DwUC+8LOYIbJztJGUTob0WAky0S8qsb6rWgxBL
 IDV325TaeDNI9131XUxbBE34pxGCPnud7Q9SiUivBbAjiWbDIxfbqLoqG8bMxb28
 41XVEMXBN6iuwR5c6Ur9HMXHsRa4Q73T1w1HvnI972ACZlfe7Ojmjws1XoNffu/y
 iLrL5M6XOkb4ZDTQkwqk5o1B20EmmxVNIMh8YG6Fix8TgINCzhbT+LX0s0m/mimY
 HJdvUEk/VdxC/BmIXrAIBXs29nz5K3YAhxye2pEHkdFNEh88iR7W5q8L2YjtsiCu
 /BdqHNwET01G3kje39cEZDy3RnSmzNuNYOyLzr39YYqxlayFhToxNbbr/VIgP954
 KLXF7RPJLIUIDYRl4xLjJo3FWc6UslwAGBSEZM6YVYNWV9e++h8qHI1CQ4jryXAc
 hUhquR0ZggkKUkch7D7HtaVrT8RldfnTsxnd0a5DYELZt4aVBLX+fBlTr9vJpyZw
 4sgAVID1x2v/LIhuAwxpsDqweQzCRjUNlPqlQqAT2QK1kdulXcg1G9t6SERfEMu9
 secJMyY=
 =aBfc
 -----END PGP SIGNATURE-----

Merge tag 'sound-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "Likely the last pull request in 2025, again a collection of lots of
  small fixes. Most of them are various device-specific small fixes:

   - An ASoC core fix for correcting the clamping behavior of *_SX mixer
     elements

   - Various fixes for ASoC fsl, SOF, etc

   - Usual HD- and USB-audio quirks / fix-ups

   - A couple of error-handling fixes for legacy PCMCIA drivers"

* tag 'sound-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (35 commits)
  ALSA: hda/realtek: fix PCI SSID for one of the HP 200 G2i laptop
  ASoC: ops: fix snd_soc_get_volsw for sx controls
  ALSA: hda/realtek: Add Asus quirk for TAS amplifiers
  ASoC: Intel: soc-acpi-intel-mtl-match: Add 6 amp CS35L63 with feedback
  ASoC: Intel: soc-acpi-intel-mtl-match: Add 6 amp CS35L56 with feedback
  ASoC: fsl-asoc-card: Use of_property_present() for non-boolean properties
  ASoC: rt1320: update VC blind write settings
  ASoC: fsl_xcvr: provide regmap names
  ASoC: fsl_sai: Add missing registers to cache default
  ASoC: ak4458: remove the reset operation in probe and remove
  ASoC: fsl_asrc_dma: fix duplicate debugfs directory error
  ASoC: fsl_easrc: fix duplicate debugfs directory error
  ALSA: hda/realtek: fix micmute LED reversed on HP Abe and Bantie
  ALSA: hda/realtek: Add support for HP Clipper Laptop
  ALSA: hda/realtek: Add support for HP Trekker Laptop
  ALSA: usb-mixer: us16x08: validate meter packet indices
  ASoC: Intel: soc-acpi-intel-nvl-match: Drop rt722 l3 from the match table
  ASoC: soc-acpi / SOF: Add best_effort flag to get_function_tplg_files op
  ASoC: SOF: Intel: pci-mtl: Change the topology path to intel/sof-ipc4-tplg
  ASoC: SOF: ipc4-topology: set playback channel mask
  ...
2025-12-23 09:13:33 -08:00
Vladimir Oltean
06e219f6a7 net: dsa: properly keep track of conduit reference
Problem description
-------------------

DSA has a mumbo-jumbo of reference handling of the conduit net device
and its kobject which, sadly, is just wrong and doesn't make sense.

There are two distinct problems.

1. The OF path, which uses of_find_net_device_by_node(), never releases
   the elevated refcount on the conduit's kobject. Nominally, the OF and
   non-OF paths should result in objects having identical reference
   counts taken, and it is already suspicious that
   dsa_dev_to_net_device() has a put_device() call which is missing in
   dsa_port_parse_of(), but we can actually even verify that an issue
   exists. With CONFIG_DEBUG_KOBJECT_RELEASE=y, if we run this command
   "before" and "after" applying this patch:

(unbind the conduit driver for net device eno2)
echo 0000:00:00.2 > /sys/bus/pci/drivers/fsl_enetc/unbind

we see these lines in the output diff which appear only with the patch
applied:

kobject: 'eno2' (ffff002009a3a6b8): kobject_release, parent 0000000000000000 (delayed 1000)
kobject: '109' (ffff0020099d59a0): kobject_release, parent 0000000000000000 (delayed 1000)

2. After we find the conduit interface one way (OF) or another (non-OF),
   it can get unregistered at any time, and DSA remains with a long-lived,
   but in this case stale, cpu_dp->conduit pointer. Holding the net
   device's underlying kobject isn't actually of much help, it just
   prevents it from being freed (but we never need that kobject
   directly). What helps us to prevent the net device from being
   unregistered is the parallel netdev reference mechanism (dev_hold()
   and dev_put()).

Actually we actually use that netdev tracker mechanism implicitly on
user ports since commit 2f1e8ea726 ("net: dsa: link interfaces with
the DSA master to get rid of lockdep warnings"), via netdev_upper_dev_link().
But time still passes at DSA switch probe time between the initial
of_find_net_device_by_node() code and the user port creation time, time
during which the conduit could unregister itself and DSA wouldn't know
about it.

So we have to run of_find_net_device_by_node() under rtnl_lock() to
prevent that from happening, and release the lock only with the netdev
tracker having acquired the reference.

Do we need to keep the reference until dsa_unregister_switch() /
dsa_switch_shutdown()?
1: Maybe yes. A switch device will still be registered even if all user
   ports failed to probe, see commit 86f8b1c01a ("net: dsa: Do not
   make user port errors fatal"), and the cpu_dp->conduit pointers
   remain valid.  I haven't audited all call paths to see whether they
   will actually use the conduit in lack of any user port, but if they
   do, it seems safer to not rely on user ports for that reference.
2. Definitely yes. We support changing the conduit which a user port is
   associated to, and we can get into a situation where we've moved all
   user ports away from a conduit, thus no longer hold any reference to
   it via the net device tracker. But we shouldn't let it go nonetheless
   - see the next change in relation to dsa_tree_find_first_conduit()
   and LAG conduits which disappear.
   We have to be prepared to return to the physical conduit, so the CPU
   port must explicitly keep another reference to it. This is also to
   say: the user ports and their CPU ports may not always keep a
   reference to the same conduit net device, and both are needed.

As for the conduit's kobject for the /sys/class/net/ entry, we don't
care about it, we can release it as soon as we hold the net device
object itself.

History and blame attribution
-----------------------------

The code has been refactored so many times, it is very difficult to
follow and properly attribute a blame, but I'll try to make a short
history which I hope to be correct.

We have two distinct probing paths:
- one for OF, introduced in 2016 in commit 83c0afaec7 ("net: dsa: Add
  new binding implementation")
- one for non-OF, introduced in 2017 in commit 71e0bbde0d ("net: dsa:
  Add support for platform data")

These are both complete rewrites of the original probing paths (which
used struct dsa_switch_driver and other weird stuff, instead of regular
devices on their respective buses for register access, like MDIO, SPI,
I2C etc):
- one for OF, introduced in 2013 in commit 5e95329b70 ("dsa: add
  device tree bindings to register DSA switches")
- one for non-OF, introduced in 2008 in commit 91da11f870 ("net:
  Distributed Switch Architecture protocol support")

except for tiny bits and pieces like dsa_dev_to_net_device() which were
seemingly carried over since the original commit, and used to this day.

The point is that the original probing paths received a fix in 2015 in
the form of commit 679fb46c57 ("net: dsa: Add missing master netdev
dev_put() calls"), but the fix never made it into the "new" (dsa2)
probing paths that can still be traced to today, and the fixed probing
path was later deleted in 2019 in commit 93e86b3bc8 ("net: dsa: Remove
legacy probing support").

That is to say, the new probing paths were never quite correct in this
area.

The existence of the legacy probing support which was deleted in 2019
explains why dsa_dev_to_net_device() returns a conduit with elevated
refcount (because it was supposed to be released during
dsa_remove_dst()). After the removal of the legacy code, the only user
of dsa_dev_to_net_device() calls dev_put(conduit) immediately after this
function returns. This pattern makes no sense today, and can only be
interpreted historically to understand why dev_hold() was there in the
first place.

Change details
--------------

Today we have a better netdev tracking infrastructure which we should
use. Logically netdev_hold() belongs in common code
(dsa_port_parse_cpu(), where dp->conduit is assigned), but there is a
tradeoff to be made with the rtnl_lock() section which would become a
bit too long if we did that - dsa_port_parse_cpu() also calls
request_module(). So we duplicate a bit of logic in order for the
callers of dsa_port_parse_cpu() to be the ones responsible of holding
the conduit reference and releasing it on error. This shortens the
rtnl_lock() section significantly.

In the dsa_switch_probe() error path, dsa_switch_release_ports() will be
called in a number of situations, one being where dsa_port_parse_cpu()
maybe didn't get the chance to run at all (a different port failed
earlier, etc). So we have to test for the conduit being NULL prior to
calling netdev_put().

There have still been so many transformations to the code since the
blamed commits (rename master -> conduit, commit 0650bf52b3 ("net:
dsa: be compatible with masters which unregister on shutdown")), that it
only makes sense to fix the code using the best methods available today
and see how it can be backported to stable later. I suspect the fix
cannot even be backported to kernels which lack dsa_switch_shutdown(),
and I suspect this is also maybe why the long-lived conduit reference
didn't make it into the new DSA probing paths at the time (problems
during shutdown).

Because dsa_dev_to_net_device() has a single call site and has to be
changed anyway, the logic was just absorbed into the non-OF
dsa_port_parse().

Tested on the ocelot/felix switch and on dsa_loop, both on the NXP
LS1028A with CONFIG_DEBUG_KOBJECT_RELEASE=y.

Reported-by: Ma Ke <make24@iscas.ac.cn>
Closes: https://lore.kernel.org/netdev/20251214131204.4684-1-make24@iscas.ac.cn/
Fixes: 83c0afaec7 ("net: dsa: Add new binding implementation")
Fixes: 71e0bbde0d ("net: dsa: Add support for platform data")
Reviewed-by: Jonas Gorski <jonas.gorski@gmail.com>
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Link: https://patch.msgid.link/20251215150236.3931670-1-vladimir.oltean@nxp.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-12-23 10:32:08 +01:00
Randy Dunlap
20e20b147c
platform/x86/intel/vsec: correct kernel-doc comments
Fix kernel-doc warnings in intel_vsec.h to eliminate all kernel-doc
warnings:

Warning: include/linux/intel_vsec.h:92 struct member 'read_telem' not
 described in 'pmt_callbacks'
Warning: include/linux/intel_vsec.h:146 expecting prototype for struct
 intel_sec_device.  Prototype was for struct intel_vsec_device instead
Warning: include/linux/intel_vsec.h:146 struct member 'priv_data_size'
 not described in 'intel_vsec_device'

In struct pmt_callbacks, correct the kernel-doc for @read_telem.
kernel-doc doesn't support documenting callback function parameters,
so drop the '@' signs on those and use "* *" to make them somewhat
readable in the produced documentation output.

Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Link: https://patch.msgid.link/20251216063801.2896495-1-rdunlap@infradead.org
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2025-12-22 16:19:53 +02:00
Sakari Ailus
87e7f60190 software node: Also support referencing non-constant software nodes
Fwnode references are be implemented differently if referenced node is a
software node. _Generic() is used to differentiate between the two cases
but only const software nodes were present in the selection. Also add
non-const software nodes.

Reported-by: Kenneth Crudup <kenny@panix.com>
Closes: https://lore.kernel.org/all/af773b82-bef2-4209-baaf-526d4661b7fc@panix.com/
Fixes: d7cdbbc93c ("software node: allow referencing firmware nodes")
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Tested-By: Kenneth R. Crudup <kenny@panix.com>
Tested-by: Mehdi Djait <mehdi.djait@linux.intel.com> # Dell XPS 9315
Reviewed-by: Mehdi Djait <mehdi.djait@linux.intel.com>
Link: https://patch.msgid.link/20251219083638.2454138-1-sakari.ailus@linux.intel.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2025-12-22 13:32:22 +01:00
Thomas Weißschuh
b61104e7a6
regulator: uapi: Use UAPI integer type
Using libc types and headers from the UAPI headers is problematic as it
introduces a dependency on a full C toolchain.

Use the fixed-width integer type provided by the UAPI headers instead.

Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Link: https://patch.msgid.link/20251222-uapi-regulator-v1-1-a71c66eb1a94@linutronix.de
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-12-22 09:00:42 +00:00
Linus Torvalds
10a0e846d8 Input updates for v6.19-rc1
- a quirk for i8042 to better handle another TUXEDO model
 
 - a quirk to atkbd to handle incorcet behavior of HONOR FMB-P internal
   keyboard
 
 - a definition for a new ABS_SND_PROFILE event
 
 - fixes to alps and lkkbd drivers to reliably shut down pending work on
   removal
 
 - a fix to apple_z2 driver tightening input report parsing
 
 - a fix for "off-by-one" error when validating config in ti_am335x_tsc
   driver
 
 - addition of CRKD Guitars device IDs to xpad driver.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCaUeyQQAKCRBAj56VGEWX
 nDlZAQCLkGoaHMX6i6Wi2iQIKexRxlERp386vaa2nA4/La3L2wEA1Ce01Ve72v+k
 JyVplQCihOzAxDZ8+c2dGtLSwqR8fQY=
 =ycHD
 -----END PGP SIGNATURE-----

Merge tag 'input-for-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

Pull input fixes from Dmitry Torokhov:

 - a quirk for i8042 to better handle another TUXEDO model

 - a quirk to atkbd to handle incorcet behavior of HONOR FMB-P internal
   keyboard

 - a definition for a new ABS_SND_PROFILE event

 - fixes to alps and lkkbd drivers to reliably shut down pending work on
   removal

 - a fix to apple_z2 driver tightening input report parsing

 - a fix for "off-by-one" error when validating config in ti_am335x_tsc
   driver

 - addition of CRKD Guitars device IDs to xpad driver.

* tag 'input-for-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: ti_am335x_tsc - fix off-by-one error in wire_order validation
  Input: xpad - add support for CRKD Guitars
  Input: add ABS_SND_PROFILE
  Input: apple_z2 - fix reading incorrect reports after exiting sleep
  Input: alps - fix use-after-free bugs caused by dev3_register_work
  Input: i8042 - add TUXEDO InfinityBook Max Gen10 AMD to i8042 quirk table
  Input: atkbd - skip deactivate for HONOR FMB-P's internal keyboard
  Input: lkkbd - disable pending work before freeing device
2025-12-21 15:21:10 -08:00
Linus Torvalds
44087d3d46 Miscellaneous x86 fixes:
- Fix FPU core dumps on certain CPU models
  - Fix htmldocs build warning
  - Export TLB tracing event name via header
  - Remove unused constant from <linux/mm_types.h>
  - Fix comments
  - Fix whitespace noise in documentation
  - Fix variadic structure's definition to un-confuse UBSAN
  - Fix posted MSI interrupts irq_retrigger() bug
  - Fix asm build failure with older GCC builds
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmlHr/sRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1gpUQ/9FgdoIa3BbdyvP1ZOc7Sasl6OBjhvPKwZ
 2pI7WOcble1Q3wh+BXUmrNnIQxgipENLUm31LaWn22QbHqPplAtzpCYABA06GW+f
 sbAcCMTmXzyBEUm6/Wh6FuoLcKrhr4GJ6UW02ROxE4M/hyWr4vQYZRAHKpmhimfJ
 u4VKrVMRWYoxd17KGEaVEz2WHT/MuctDDtjl1xhc6EbQxw6xmE0xYfFzYBcN8E31
 0743rZ9BBYMXSmS9p83Qqjzj5S3Y+VErGxlCwJ+7QUFGGfwnb0iDLNUA4rk4VBf/
 SL5xZXx6008GoBXEt6npvSUm4zQJI0QPyuCttkR/w0lX1TkoGvyGWKEjCBfnXaK5
 QvptqoHSgpvqqaW6R8ophPJNTtKzPf2ZMQD+kZlRy9MVgKfQhlEPpU2DvouzYg1s
 CtgGHCdCUP5EhozS0l17R6knHUhNg3ZHyB5eRQexsA5gOO7vjxngq+oCMUmoVNPV
 ahGsolGKuU8nrZBTDTc0LpJq6gPpspUSEKdVHY0wX5m4rfKw4tPUsdS5Q7oqzc1K
 1RJrFjzuouADUqW4L21Q7kTeOnRyr6lNej1TwtiOs9sUTmsv1AmywJ5GaZcIsFGP
 /rOaL+Wa8BGtkWFqkmHcq6f80IgQEL63+CoOpmY8uDZF5Ba55nUfG/q0JDZTLtMN
 LAc4pO7ubsA=
 =zJpa
 -----END PGP SIGNATURE-----

Merge tag 'x86-urgent-2025-12-21' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86 fixes from Ingo Molnar:

 - Fix FPU core dumps on certain CPU models

 - Fix htmldocs build warning

 - Export TLB tracing event name via header

 - Remove unused constant from <linux/mm_types.h>

 - Fix comments

 - Fix whitespace noise in documentation

 - Fix variadic structure's definition to un-confuse UBSAN

 - Fix posted MSI interrupts irq_retrigger() bug

 - Fix asm build failure with older GCC builds

* tag 'x86-urgent-2025-12-21' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/bug: Fix old GCC compile fails
  x86/msi: Make irq_retrigger() functional for posted MSI
  x86/platform/uv: Fix UBSAN array-index-out-of-bounds
  mm: Remove tlb_flush_reason::NR_TLB_FLUSH_REASONS from <linux/mm_types.h>
  x86/mm/tlb/trace: Export the TLB_REMOTE_WRONG_CPU enum in <trace/events/tlb.h>
  x86/sgx: Remove unmatched quote in __sgx_encl_extend function comment
  x86/boot/Documentation: Fix whitespace noise in boot.rst
  x86/fpu: Fix FPU state core dump truncation on CPUs with no extended xfeatures
  x86/boot/Documentation: Fix htmldocs build warning due to malformed table in boot.rst
2025-12-21 14:41:29 -08:00
Eric Dumazet
4cc5373f2e clang: work around asm output constraint problems
Work around clang problems with "=rm" asm constraint.

clang seems to always chose the memory output, while it is almost
always the worst choice.

Add ASM_OUTPUT_RM so that we can replace "=rm" constraint
where it matters for clang, while not penalizing gcc.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Suggested-by: Uros Bizjak <ubizjak@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2025-12-20 14:47:05 -08:00
Linus Torvalds
a0bdd554a8 drm fixes for 6.19-rc2
core:
 - fix gem handle leak on DRM_IOCTL_GEM_CHANGE_HANDLE
 
 tests:
 - add EDEADLK handling
 
 amdgpu:
 - Fix no_console_suspend handling
 - DCN 3.5.x seamless boot fixes
 - DP audio fix
 - Fix race in GPU recovery
 - SMU 14 OD fix
 
 amdkfd:
 - Event fix
 
 xe:
 - Limit num_syncs to prevent oversized kernel allocations
 - Disallow 0 OA property values
 - Disallow 0 EU stall property values
 - Fix kobject leak
 - Workaround
 - Loop variable reference fix
 - Fix a CONFIG corner-case incorrect number of argument
 - Skip reason prefix while emitting array
 - VF migration fix
 - Fix context in mei interrupt top half
 - Don't include the CCS metadata in the dma-buf sg-table
 - VF queueing recovery work fix
 - Increase TDF timeout
 - GT reset registers vs scheduler ordering fix
 - Adjust long-running workload timeslices
 - Always set OA_OAGLBCTXCTRL_COUNTER_RESUME
 - Fix a return value
 - Drop preempt-fences when destroying imported dma-bufs
 - Use usleep_range for accurate long-running workload timeslicing
 
 amdxdna:
 - don't load virtualized
 
 panel:
 - fix visionox-rm69299 Kconfig dependency
 - sony-td4353-jdi probing fix
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmlFqlQACgkQDHTzWXnE
 hr5XFw/6A8vKUK79YWbLcGLQpaLdFrReCQTXevyIxBglRMX44pvWpOCU9FBn2Dz6
 inmPeUXYI0jlMdZTPNCx9G7RkvTU0nyJejQqkXt81IPO1/OTtUT/Z337fvzE1rWp
 clBsuJsrUoT4RdZM820MSev9LZCJlUC0X8blD9ReoE6NhWAjXFoPO6sg+Qt4CyKX
 u45jPTtm99RjbBhK4gC/kp/g5RYmpiobZNf6TXFKl7o7sw6r6Uo9XBcp7gB+t3Am
 VJ9khxqqBXe4lEf0ptIWY7agnuMSdByQ5XVaB+thGGNrsRdeATnmgNhw3IhszUnI
 6zmwB12OFj8Xiozcid6MdtD4DqssRLiVuYoa4u8h0wJf0+ci85VOxv6AOE8p20Sg
 mthjqhG6neUK1nmZaB7E//xQwzW3OyoV2JoiH5nXCQp+q6J+1qVRO2btwlvEDU8y
 KcwMqoNvZC5HabEMiv5leT+LSDidWktma8SnZvN50zzYreTj2SYajtxgfn1iAJWX
 bTtCN2DRfhQDiqejWjQGrZfC0mqNGgs6bgz1bhGBi7PP8sDwjjt0OPSoK/SnVzxI
 p9A+tmE4Yi7dpkOb9mjiofdKlT1M/4nSa4LMRr4wGBIrBNLK6nUf89x0dP3KHwc+
 UCzekRPPkRzAj6QwCOgrhtWKa56IERbG2ipkzs8Tl7ChwlJ/198=
 =HT2U
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2025-12-20' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "rc2 fixes for the week, mostly xe, with amdgpu as usual. Then a
  smattering of small fixes across the core/tests/panel and amdxdna.

  I expect things will be quiet for rc3/4 as teams take a break, and I'm
  travelling but will keep an eye on things.

  core:
   - fix gem handle leak on DRM_IOCTL_GEM_CHANGE_HANDLE

  tests:
   - add EDEADLK handling

  amdgpu:
   - Fix no_console_suspend handling
   - DCN 3.5.x seamless boot fixes
   - DP audio fix
   - Fix race in GPU recovery
   - SMU 14 OD fix

  amdkfd:
   - Event fix

  xe:
   - Limit num_syncs to prevent oversized kernel allocations
   - Disallow 0 OA property values
   - Disallow 0 EU stall property values
   - Fix kobject leak
   - Workaround
   - Loop variable reference fix
   - Fix a CONFIG corner-case incorrect number of argument
   - Skip reason prefix while emitting array
   - VF migration fix
   - Fix context in mei interrupt top half
   - Don't include the CCS metadata in the dma-buf sg-table
   - VF queueing recovery work fix
   - Increase TDF timeout
   - GT reset registers vs scheduler ordering fix
   - Adjust long-running workload timeslices
   - Always set OA_OAGLBCTXCTRL_COUNTER_RESUME
   - Fix a return value
   - Drop preempt-fences when destroying imported dma-bufs
   - Use usleep_range for accurate long-running workload timeslicing

  amdxdna:
   - don't load virtualized

  panel:
   - fix visionox-rm69299 Kconfig dependency
   - sony-td4353-jdi probing fix"

* tag 'drm-fixes-2025-12-20' of https://gitlab.freedesktop.org/drm/kernel: (34 commits)
  drm/xe: Use usleep_range for accurate long-running workload timeslicing
  drm/xe: Drop preempt-fences when destroying imported dma-bufs.
  drm/xe/eustall: Disallow 0 EU stall property values
  drm/xe/oa: Disallow 0 OA property values
  drm/xe/xe_sriov_vfio: Fix return value in xe_sriov_vfio_migration_supported()
  drm/xe/oa: Always set OAG_OAGLBCTXCTRL_COUNTER_RESUME
  drm/xe: Adjust long-running workload timeslices to reasonable values
  drm/xe/oa: Limit num_syncs to prevent oversized allocations
  drm/xe: Limit num_syncs to prevent oversized allocations
  drm/amdkfd: Fix improper NULL termination of queue restore SMI event string
  drm/amd/pm: restore SCLK settings after S0ix resume
  drm/amdgpu: fix a job->pasid access race in gpu recovery
  drm/amd/display: Fix DP no audio issue
  drm/amd/display: Fix scratch registers offsets for DCN351
  drm/amd/display: Fix scratch registers offsets for DCN35
  drm/amd: Resume the device in thaw() callback when console suspend is disabled
  drm/panel: visionox-rm69299: Depend on BACKLIGHT_CLASS_DEVICE
  accel/amdxdna: Block running under a hypervisor
  drm/panel: sony-td4353-jdi: Enable prepare_prev_first
  drm/xe: Restore engine registers before restarting schedulers after GT reset
  ...
2025-12-20 12:08:02 -08:00
Linus Torvalds
d8ba32c5a4 block-6.19-20251218
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmlEvbAQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgphTLD/9Gx4wnirRvzo1Vz77Odhqqbipww/gjDV0G
 HASzF4KczfusTei4NABfuSVA4/LS28csZOYq0ZeDmFVg+YPQcmr4DNw/eJzzi1Xh
 TDmYuf8y7jAJjwWmX0fgVF2uDg3/kp3tWKfBxSFqpqHrZUkOLr8IY3y8/uJYKakm
 r8K9HsS7hyPhx4xdfRQixUil5TgQxBtCgwTX+JRv/K9AMnEVHkBkJ+m4GSmjJ3n8
 tr5lL8fQmIQcsSWqTvMH/m2xeLG7gr9LE33wfu2sCLvNJ4CAYFGT9aMf2F0nGbzK
 Uu5XOyq1rJ8vKWJuDVfFsjOca4fyyvaKX4bqycv89Z7MVzQOXsjbs+4sHFycsfYC
 P+OBmxLb2+rowNsawyzObT9wnd37xptl+tF5nXL0LL6W4PWHmUgnDuM6Vg5zpNv+
 n0nO6y7I0iL9o4hgqN8kUOr5e7IjvJccJbratOA/jVXmAw1I/Gg6HDo+W7rEqsVP
 0hrlE+RuJSRypbCO2pcvviahaDaCWo3gQmp9TZCBmgqgoiI0WStPAgYrG424+69Y
 Hoq5HBmtN4GV3EnU0Ybuawzl2OKtQwwr9DrRpvrxdN9qm4E44CD6eTmE5fEnrTnX
 Rcs5VosBAavPTbl8LFDtj2h6qPak+5VHHVZwimLNdOyCLTNf7D/kiAjmOHRBbmdt
 AopIuvCipA==
 =lk7H
 -----END PGP SIGNATURE-----

Merge tag 'block-6.19-20251218' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull block fixes from Jens Axboe:

 - ublk selftests for missing coverage

 - two fixes for the block integrity code

 - fix for the newly added newly added PR read keys ioctl, limiting the
   memory that can be allocated

 - work around for a deadlock that can occur with ublk, where partition
   scanning ends up recursing back into file closure, which needs the
   same mutex grabbed. Not the prettiest thing in the world, but an
   acceptable work-around until we can eliminate the reliance on
   disk->open_mutex for this

 - fix for a race between enabling writeback throttling and new IO
   submissions

 - move a bit of bio flag handling code. No changes, but needed for a
   patchset for a future kernel

 - fix for an init time id leak failure in rnbd

 - loop/zloop state check fix

* tag 'block-6.19-20251218' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  block: validate interval_exp integrity limit
  block: validate pi_offset integrity limit
  block: rnbd-clt: Fix leaked ID in init_dev()
  ublk: fix deadlock when reading partition table
  block: add allocation size check in blkdev_pr_read_keys()
  Documentation: admin-guide: blockdev: replace zone_capacity with zone_capacity_mb when creating devices
  zloop: use READ_ONCE() to read lo->lo_state in queue_rq path
  loop: use READ_ONCE() to read lo->lo_state without locking
  block: fix race between wbt_enable_default and IO submission
  selftests: ublk: add user copy test cases
  selftests: ublk: add support for user copy to kublk
  selftests: ublk: forbid multiple data copy modes
  selftests: ublk: don't share backing files between ublk servers
  selftests: ublk: use auto_zc for PER_IO_DAEMON tests in stress_04
  selftests: ublk: fix fio arguments in run_io_and_recover()
  selftests: ublk: remove unused ios map in seq_io.bt
  selftests: ublk: correct last_rw map type in seq_io.bt
  selftests: ublk: fix overflow in ublk_queue_auto_zc_fallback()
  block: move around bio flagging helpers
2025-12-20 09:48:56 -08:00
Gergo Koteles
733a892422 Input: add ABS_SND_PROFILE
ABS_SND_PROFILE used to describe the state of a multi-value sound profile
switch. This will be used for the alert-slider on OnePlus phones or other
phones.

Profile values added as SND_PROFLE_(SILENT|VIBRATE|RING) identifiers
to input-event-codes.h so they can be used from DTS.

Signed-off-by: Gergo Koteles <soyer@irl.hu>
Reviewed-by: Bjorn Andersson <andersson@kernel.org>
Tested-by: Guido Günther <agx@sigxcpu.org> # oneplus,fajita & oneplus,enchilada
Reviewed-by: Guido Günther <agx@sigxcpu.org>
Signed-off-by: David Heidelberg <david@ixit.cz>
Reviewed-by: Pavel Machek <pavel@ucw.cz>
Link: https://patch.msgid.link/20251113-op6-tri-state-v8-1-54073f3874bc@ixit.cz
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2025-12-18 21:34:42 -08:00
Linus Torvalds
eb23a1198d Power management fixes for 6.19-rc2
- Fix CPU hotplug locking deadlock reported by lockdep after a recent
    update of the Intel RAPL power capping driver (Srinivas Pandruvada)
 
  - Fix sscanf() error return value handling in the power capping core
    and a race condition in register_control_type() (Sumeet Pawnikar)
 
  - Fix a concurrent bit field update issue in the runtime PM core code
    by only updating the bit field in question when runtime PM is
    disabled (Rafael Wysocki)
 -----BEGIN PGP SIGNATURE-----
 
 iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmlEWLsSHHJqd0Byand5
 c29ja2kubmV0AAoJEO5fvZ0v1OO1mloH/3ioUyzreSj90UTRA7B5HP/965pNWYOE
 io3nNcYvVt00cvIsCai2KfhGxC5rcan1jGAl0ZeGOFlKzK1u9DsVl8SBpOsRr39a
 QB7fuOPICwTJNuksPsHcvU7sBOMIPR7oNC9sWl41oa0IdKJDkJfHRSnNu9xO8B6L
 B8fBGPuHYMgKMOVuax1WgzMFMCMxbjARE1p+SU9b+/Ojjdp+lg6oRzGQsUoy0JEy
 9tnVLzMdroin+ae1UcXLLpJU6NsPBxeg1uV+tmMb9Hm8fZl8+WGDzF7/3mZV1a+k
 xDXrWpFtmtUYXYu6hK6rs4sY+49N4UI4sP2P0SKMedtQ1qmnMEil/wk=
 =AGwI
 -----END PGP SIGNATURE-----

Merge tag 'pm-6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull power management fixes from Rafael Wysocki:
 "These fix three issues in the power capping code including one recent
  regression and a runtime PM framework regression introduced during the
  6.17 development cycle:

   - Fix CPU hotplug locking deadlock reported by lockdep after a recent
     update of the Intel RAPL power capping driver (Srinivas Pandruvada)

   - Fix sscanf() error return value handling in the power capping core
     and a race condition in register_control_type() (Sumeet Pawnikar)

   - Fix a concurrent bit field update issue in the runtime PM core code
     by only updating the bit field in question when runtime PM is
     disabled (Rafael Wysocki)"

* tag 'pm-6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  powercap: intel_rapl: Fix possible recursive lock warning
  PM: runtime: Do not clear needs_force_resume with enabled runtime PM
  powercap: fix sscanf() error return value handling
  powercap: fix race condition in register_control_type()
2025-12-19 08:28:02 +12:00
Linus Torvalds
7b8e9264f5 Including fixes from netfilter and CAN.
Current release - regressions:
 
   - netfilter: nf_conncount: fix leaked ct in error paths
 
   - sched: act_mirred: fix loop detection
 
   - sctp: fix potential deadlock in sctp_clone_sock()
 
   - can: fix build dependency
 
   - eth: mlx5e: do not update BQL of old txqs during channel reconfiguration
 
 Previous releases - regressions:
 
   - sched: ets: always remove class from active list before deleting it
 
   - inet: frags: flush pending skbs in fqdir_pre_exit()
 
   - netfilter:  nf_nat: remove bogus direction check
 
   - mptcp:
     - schedule rtx timer only after pushing data
     - avoid deadlock on fallback while reinjecting
 
   - can: gs_usb: fix error handling
 
   - eth: mlx5e:
     - avoid unregistering PSP twice
     - fix double unregister of HCA_PORTS component
 
   - eth: bnxt_en: fix XDP_TX path
 
   - eth: mlxsw: fix use-after-free when updating multicast route stats
 
 Previous releases - always broken:
 
   - ethtool: avoid overflowing userspace buffer on stats query
 
   - openvswitch: fix middle attribute validation in push_nsh() action
 
   - eth: mlx5: fw_tracer, validate format string parameters
 
   - eth: mlxsw: spectrum_router: fix neighbour use-after-free
 
   - eth: ipvlan: ignore PACKET_LOOPBACK in handle_mode_l2()
 
 Misc:
 
   - Jozsef Kadlecsik retires from maintaining netfilter
 
   - tools: ynl: fix build on systems with old kernel headers
 
 Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCgAwFiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmlEPS0SHHBhYmVuaUBy
 ZWRoYXQuY29tAAoJECkkeY3MjxOkHLEP/3TnVI9qLivOGsZ48bn5UUcIaIlX0wiw
 i5gwpUhbtW3zcLSphO0Nh/CmProme6dFhaMOOkk48bKAdIxRpOMbCC20bfYDLyd0
 ZJTUQqheKpuI23vOnhfs2TTOkcqz6cM7txUq681taQ8Nfo8Dbf0fgOO2HT5ljRD+
 JXlxrdvicZDtve68sSdnsAj5M15EPQGKTPMyPkymBmCKnCMQK9SQKaeTEtaW6NIO
 yM0KqDSNoulDc/6LYMhx8DTtyE7yTiTxwe2NixjdyYljXsk0KiRDirCzxnZuSgh8
 oh+cFLdFDq4mwdYEKjgC5c3ifQyLEpZvwzlY5MKoobsVnT5SbigeSK53l5rEkO3V
 sM84lITHfqTJvlid0AF/ixEc6iWwV7nGRBHh2FXNbfoIKt45eF77jPi9YFsq6Z95
 vlCzYIbY0f2L1y3mPvZbzGQbh2Z12b5kyK8QA1j7SK+zNzxgXbf4+ZtYxHg7O3Ne
 gecmIpTKXMWodaZyfsRQPjR/F6UIlMqsgl9Ci9bfUw+XwL8x+7bJxQAQz+yVjLla
 ng14BItiYKBavcPZBjYlhGKqD1fzGhVZqQecrCkF0VTbMusRd9RcwytU1NG4QGDx
 V5aL28ht85KtMednEWOBkrg+PeXnNyZHzLAf2Xtx3UkaGgiDC8G4IxUv3orlOLD1
 sFPfZnSiGCof
 =6pla
 -----END PGP SIGNATURE-----

Merge tag 'net-6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Paolo Abeni:
 "Including fixes from netfilter and CAN.

  Current release - regressions:

   - netfilter: nf_conncount: fix leaked ct in error paths

   - sched: act_mirred: fix loop detection

   - sctp: fix potential deadlock in sctp_clone_sock()

   - can: fix build dependency

   - eth: mlx5e: do not update BQL of old txqs during channel
     reconfiguration

  Previous releases - regressions:

   - sched: ets: always remove class from active list before deleting it

   - inet: frags: flush pending skbs in fqdir_pre_exit()

   - netfilter: nf_nat: remove bogus direction check

   - mptcp:
      - schedule rtx timer only after pushing data
      - avoid deadlock on fallback while reinjecting

   - can: gs_usb: fix error handling

   - eth:
      - mlx5e:
         - avoid unregistering PSP twice
         - fix double unregister of HCA_PORTS component
      - bnxt_en: fix XDP_TX path
      - mlxsw: fix use-after-free when updating multicast route stats

  Previous releases - always broken:

   - ethtool: avoid overflowing userspace buffer on stats query

   - openvswitch: fix middle attribute validation in push_nsh() action

   - eth:
      - mlx5: fw_tracer, validate format string parameters
      - mlxsw: spectrum_router: fix neighbour use-after-free
      - ipvlan: ignore PACKET_LOOPBACK in handle_mode_l2()

  Misc:

   - Jozsef Kadlecsik retires from maintaining netfilter

   - tools: ynl: fix build on systems with old kernel headers"

* tag 'net-6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (83 commits)
  net: hns3: add VLAN id validation before using
  net: hns3: using the num_tqps to check whether tqp_index is out of range when vf get ring info from mbx
  net: hns3: using the num_tqps in the vf driver to apply for resources
  net: enetc: do not transmit redirected XDP frames when the link is down
  selftests/tc-testing: Test case exercising potential mirred redirect deadlock
  net/sched: act_mirred: fix loop detection
  sctp: Clear inet_opt in sctp_v6_copy_ip_options().
  sctp: Fetch inet6_sk() after setting ->pinet6 in sctp_clone_sock().
  net/handshake: duplicate handshake cancellations leak socket
  net/mlx5e: Don't include PSP in the hard MTU calculations
  net/mlx5e: Do not update BQL of old txqs during channel reconfiguration
  net/mlx5e: Trigger neighbor resolution for unresolved destinations
  net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init
  net/mlx5: Serialize firmware reset with devlink
  net/mlx5: fw_tracer, Handle escaped percent properly
  net/mlx5: fw_tracer, Validate format string parameters
  net/mlx5: Drain firmware reset in shutdown callback
  net/mlx5: fw reset, clear reset requested on drain_fw_reset
  net: dsa: mxl-gsw1xx: manually clear RANEG bit
  net: dsa: mxl-gsw1xx: fix .shutdown driver operation
  ...
2025-12-19 07:55:35 +12:00
Shuicheng Lin
8e46130400 drm/xe: Limit num_syncs to prevent oversized allocations
The exec and vm_bind ioctl allow userspace to specify an arbitrary
num_syncs value. Without bounds checking, a very large num_syncs
can force an excessively large allocation, leading to kernel warnings
from the page allocator as below.

Introduce DRM_XE_MAX_SYNCS (set to 1024) and reject any request
exceeding this limit.

"
------------[ cut here ]------------
WARNING: CPU: 0 PID: 1217 at mm/page_alloc.c:5124 __alloc_frozen_pages_noprof+0x2f8/0x2180 mm/page_alloc.c:5124
...
Call Trace:
 <TASK>
 alloc_pages_mpol+0xe4/0x330 mm/mempolicy.c:2416
 ___kmalloc_large_node+0xd8/0x110 mm/slub.c:4317
 __kmalloc_large_node_noprof+0x18/0xe0 mm/slub.c:4348
 __do_kmalloc_node mm/slub.c:4364 [inline]
 __kmalloc_noprof+0x3d4/0x4b0 mm/slub.c:4388
 kmalloc_noprof include/linux/slab.h:909 [inline]
 kmalloc_array_noprof include/linux/slab.h:948 [inline]
 xe_exec_ioctl+0xa47/0x1e70 drivers/gpu/drm/xe/xe_exec.c:158
 drm_ioctl_kernel+0x1f1/0x3e0 drivers/gpu/drm/drm_ioctl.c:797
 drm_ioctl+0x5e7/0xc50 drivers/gpu/drm/drm_ioctl.c:894
 xe_drm_ioctl+0x10b/0x170 drivers/gpu/drm/xe/xe_device.c:224
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:598 [inline]
 __se_sys_ioctl fs/ioctl.c:584 [inline]
 __x64_sys_ioctl+0x18b/0x210 fs/ioctl.c:584
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xbb/0x380 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
...
"

v2: Add "Reported-by" and Cc stable kernels.
v3: Change XE_MAX_SYNCS from 64 to 1024. (Matt & Ashutosh)
v4: s/XE_MAX_SYNCS/DRM_XE_MAX_SYNCS/ (Matt)
v5: Do the check at the top of the exec func. (Matt)

Fixes: dd08ebf6c3 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Reported-by: Koen Koning <koen.koning@intel.com>
Reported-by: Peter Senna Tschudin <peter.senna@linux.intel.com>
Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6450
Cc: <stable@vger.kernel.org> # v6.12+
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Michal Mrozek <michal.mrozek@intel.com>
Cc: Carl Zhang <carl.zhang@intel.com>
Cc: José Roberto de Souza <jose.souza@intel.com>
Cc: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Cc: Ivan Briano <ivan.briano@intel.com>
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Cc: Ashutosh Dixit <ashutosh.dixit@intel.com>
Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Signed-off-by: Matthew Brost <matthew.brost@intel.com>
Link: https://patch.msgid.link/20251205234715.2476561-5-shuicheng.lin@intel.com
(cherry picked from commit b07bac9bd7)
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2025-12-18 18:10:34 +01:00
Srinivas Pandruvada
dcd0b625fe powercap: intel_rapl: Fix possible recursive lock warning
With the RAPL PMU addition, there is a recursive locking when CPU online
callback function calls rapl_package_add_pmu(). Here cpu_hotplug_lock
is already acquired by cpuhp_thread_fun() and rapl_package_add_pmu()
tries to acquire again.

<4>[ 8.197433] ============================================
<4>[ 8.197437] WARNING: possible recursive locking detected
<4>[ 8.197440] 6.19.0-rc1-lgci-xe-xe-4242-05b7c58b3367dca84+ #1 Not tainted
<4>[ 8.197444] --------------------------------------------
<4>[ 8.197447] cpuhp/0/20 is trying to acquire lock:
<4>[ 8.197450] ffffffff83487870 (cpu_hotplug_lock){++++}-{0:0}, at:
rapl_package_add_pmu+0x37/0x370 [intel_rapl_common]
<4>[ 8.197463]
but task is already holding lock:
<4>[ 8.197466] ffffffff83487870 (cpu_hotplug_lock){++++}-{0:0}, at:
cpuhp_thread_fun+0x6d/0x290
<4>[ 8.197477]
other info that might help us debug this:
<4>[ 8.197480] Possible unsafe locking scenario:

<4>[ 8.197483] CPU0
<4>[ 8.197485] ----
<4>[ 8.197487] lock(cpu_hotplug_lock);
<4>[ 8.197490] lock(cpu_hotplug_lock);
<4>[ 8.197493]
*** DEADLOCK ***
..
..
<4>[ 8.197542] __lock_acquire+0x146e/0x2790
<4>[ 8.197548] lock_acquire+0xc4/0x2c0
<4>[ 8.197550] ? rapl_package_add_pmu+0x37/0x370 [intel_rapl_common]
<4>[ 8.197556] cpus_read_lock+0x41/0x110
<4>[ 8.197558] ? rapl_package_add_pmu+0x37/0x370 [intel_rapl_common]
<4>[ 8.197561] rapl_package_add_pmu+0x37/0x370 [intel_rapl_common]
<4>[ 8.197565] rapl_cpu_online+0x85/0x87 [intel_rapl_msr]
<4>[ 8.197568] ? __pfx_rapl_cpu_online+0x10/0x10 [intel_rapl_msr]
<4>[ 8.197570] cpuhp_invoke_callback+0x41f/0x6c0
<4>[ 8.197573] ? cpuhp_thread_fun+0x6d/0x290
<4>[ 8.197575] cpuhp_thread_fun+0x1e2/0x290
<4>[ 8.197578] ? smpboot_thread_fn+0x26/0x290
<4>[ 8.197581] smpboot_thread_fn+0x12f/0x290
<4>[ 8.197584] ? __pfx_smpboot_thread_fn+0x10/0x10
<4>[ 8.197586] kthread+0x11f/0x250
<4>[ 8.197589] ? __pfx_kthread+0x10/0x10
<4>[ 8.197592] ret_from_fork+0x344/0x3a0
<4>[ 8.197595] ? __pfx_kthread+0x10/0x10
<4>[ 8.197597] ret_from_fork_asm+0x1a/0x30
<4>[ 8.197604] </TASK>

Fix this issue in the same way as rapl powercap package domain is added
from the same CPU online callback by introducing another interface which
doesn't call cpus_read_lock(). Add rapl_package_add_pmu_locked() and
rapl_package_remove_pmu_locked() which don't call cpus_read_lock().

Fixes: 748d6ba43a ("powercap: intel_rapl: Enable MSR-based RAPL PMU support")
Reported-by: Borah, Chaitanya Kumar <chaitanya.kumar.borah@intel.com>
Closes: https://lore.kernel.org/linux-pm/5427ede1-57a0-43d1-99f3-8ca4b0643e82@intel.com/T/#u
Tested-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Tested-by: RavitejaX Veesam <ravitejax.veesam@intel.com>
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Link: https://patch.msgid.link/20251217153455.3560176-1-srinivas.pandruvada@linux.intel.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2025-12-17 17:24:28 +01:00
Deepanshu Kartikey
a58383fa45 block: add allocation size check in blkdev_pr_read_keys()
blkdev_pr_read_keys() takes num_keys from userspace and uses it to
calculate the allocation size for keys_info via struct_size(). While
there is a check for SIZE_MAX (integer overflow), there is no upper
bound validation on the allocation size itself.

A malicious or buggy userspace can pass a large num_keys value that
doesn't trigger overflow but still results in an excessive allocation
attempt, causing a warning in the page allocator when the order exceeds
MAX_PAGE_ORDER.

Fix this by introducing PR_KEYS_MAX to limit the number of keys to
a sane value. This makes the SIZE_MAX check redundant, so remove it.
Also switch to kvzalloc/kvfree to handle larger allocations gracefully.

Fixes: 22a1ffea5f ("block: add IOC_PR_READ_KEYS ioctl")
Tested-by: syzbot+660d079d90f8a1baf54d@syzkaller.appspotmail.com
Reported-by: syzbot+660d079d90f8a1baf54d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=660d079d90f8a1baf54d
Link: https://lore.kernel.org/all/20251212013510.3576091-1-kartikey406@gmail.com/T/ [v1]
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-12-17 07:35:22 -07:00
Linus Torvalds
ea1013c153 bpf-fixes
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE+soXsSLHKoYyzcli6rmadz2vbToFAmlCBmwACgkQ6rmadz2v
 bToUZA//ZY0IE1x1nCixEAqGF/nGpDzVX4YQQfjrUoXQOD4ykzt35yTNXl6B1IVA
 dliVSI6kUtdoThUa7xJUxMSkDsVBsEMT/zYXQEXJG1zXvJANCB9wTzsC3OCBWbXt
 BRczcEkq0OHC9/l5CrILR6ocwxKGDIMIysfeOSABgfqckSEhylWy3+EWZQCk08ka
 gNpXlDJUG7dYpcZD/zhuC7e5Rg1uNvN7WiTv+Biig8xZCsEtYOq+qC5C/sOnsypI
 nqfECfbx48cVl49SjatdgquuHn/INESdLRCHisshkurA2Mp5PQuCmrwlXbv4JG59
 v9b7lsFQlkpvEXMdo9VYe6K2gjfkOPRdWsVPu2oXA1qISRmrDqX8cKOpapUIwRhL
 p3ASruMOnz0KFqVaET8+5u2SwtALeW+c+1p1aHMfVGF/qbXuyG05qBkLoGFJR+Xr
 WznXUXY80Z7pjD57SpA6U3DigAkGqKCBXUwdifaOq8HQonwsnQGqkW/3NngNULGP
 IC4u0JXn61VgQsM/kAw+ucc4bdKI0g4oKJR56lT48elrj6Yxrjpde4oOqzZ0IQKu
 VQ0YnzWqqT2tjh4YNMOwkNPbFR4ALd329zI6TUkWib/jByEBNcfjSj9BRANd1KSx
 JgSHAE6agrbl6h3nOx584YCasX3Zq+nfv1Sj4Z/5GaHKKW3q/Vw=
 =wHLt
 -----END PGP SIGNATURE-----

Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Pull bpf fixes from Alexei Starovoitov:

 - Fix BPF builds due to -fms-extensions. selftests (Alexei
   Starovoitov), bpftool (Quentin Monnet).

 - Fix build of net/smc when CONFIG_BPF_SYSCALL=y, but CONFIG_BPF_JIT=n
   (Geert Uytterhoeven)

 - Fix livepatch/BPF interaction and support reliable unwinding through
   BPF stack frames (Josh Poimboeuf)

 - Do not audit capability check in arm64 JIT (Ondrej Mosnacek)

 - Fix truncated dmabuf BPF iterator reads (T.J. Mercier)

 - Fix verifier assumptions of bpf_d_path's output buffer (Shuran Liu)

 - Fix warnings in libbpf when built with -Wdiscarded-qualifiers under
   C23 (Mikhail Gavrilov)

* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
  selftests/bpf: add regression test for bpf_d_path()
  bpf: Fix verifier assumptions of bpf_d_path's output buffer
  selftests/bpf: Add test for truncated dmabuf_iter reads
  bpf: Fix truncated dmabuf iterator reads
  x86/unwind/orc: Support reliable unwinding through BPF stack frames
  bpf: Add bpf_has_frame_pointer()
  bpf, arm64: Do not audit capability check in do_jit()
  libbpf: Fix -Wdiscarded-qualifiers under C23
  bpftool: Fix build warnings due to MS extensions
  net: smc: SMC_HS_CTRL_BPF should depend on BPF_JIT
  selftests/bpf: Add -fms-extensions to bpf build flags
2025-12-17 15:54:58 +12:00
Linus Torvalds
40fbbd64bb a couple of shmem rename fixes - recent regression from tree-in-dcache
series and older breakage from stable directory offsets stuff.
 
 Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQqUNBr3gm4hGXdBJlZ7Krx/gZQ6wUCaUD1egAKCRBZ7Krx/gZQ
 693YAQDWMzqUs8bJx95frxidF4fJ658K/bZWHuG9eLDvhF2CxAEAoIWt5EbJ1dE0
 NEIg/+kdVpKpk1DH7SZTzc+Mgbe4aAE=
 =/LtU
 -----END PGP SIGNATURE-----

Merge tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull shmem rename fixes from Al Viro:
 "A couple of shmem rename fixes - recent regression from tree-in-dcache
  series and older breakage from stable directory offsets stuff"

* tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  shmem: fix recovery on rename failures
  shmem_whiteout(): fix regression from tree-in-dcache series
2025-12-16 19:44:36 +12:00
Al Viro
e1b4c6a583 shmem: fix recovery on rename failures
maple_tree insertions can fail if we are seriously short on memory;
simple_offset_rename() does not recover well if it runs into that.
The same goes for simple_offset_rename_exchange().

Moreover, shmem_whiteout() expects that if it succeeds, the caller will
progress to d_move(), i.e. that shmem_rename2() won't fail past the
successful call of shmem_whiteout().

Not hard to fix, fortunately - mtree_store() can't fail if the index we
are trying to store into is already present in the tree as a singleton.

For simple_offset_rename_exchange() that's enough - we just need to be
careful about the order of operations.

For simple_offset_rename() solution is to preinsert the target into the
tree for new_dir; the rest can be done without any potentially failing
operations.

That preinsertion has to be done in shmem_rename2() rather than in
simple_offset_rename() itself - otherwise we'd need to deal with the
possibility of failure after successful shmem_whiteout().

Fixes: a2e459555c ("shmem: stable directory offsets")
Reviewed-by: Christian Brauner <brauner@kernel.org>
Reviewed-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2025-12-16 00:57:29 -05:00
Peter Ujfalusi
c8f3c9fa75
ASoC: soc-acpi / SOF: Add best_effort flag to get_function_tplg_files op
When there is no fallback possibility available for the function topology
use it is better to try to create  a profile for the card in best effort
manner, leaving out non supported links for example.

As an example: some laptops present SSPx-BT link but we don't have fragment
yet to support this. If we only have support for functional topology
without monolithic fallback then we would fail the card creation.
The reason why the monolithic topology works on the same device is that it
does not have the SSPx-BT link handled, it is ignored.

In case when there is no fallback possibility we should try to create the
card with links that we support as best effort instead of failing and
leaving the user without a card.

Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com>
Reviewed-by: Kai Vehmanen <kai.vehmanen@linux.intel.com>
Reviewed-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://patch.msgid.link/20251215101036.9370-2-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-12-15 23:08:35 +09:00
Florian Westphal
8e1a1bc4f5 netfilter: nf_tables: avoid chain re-validation if possible
Hamza Mahfooz reports cpu soft lock-ups in
nft_chain_validate():

 watchdog: BUG: soft lockup - CPU#1 stuck for 27s! [iptables-nft-re:37547]
[..]
 RIP: 0010:nft_chain_validate+0xcb/0x110 [nf_tables]
[..]
  nft_immediate_validate+0x36/0x50 [nf_tables]
  nft_chain_validate+0xc9/0x110 [nf_tables]
  nft_immediate_validate+0x36/0x50 [nf_tables]
  nft_chain_validate+0xc9/0x110 [nf_tables]
  nft_immediate_validate+0x36/0x50 [nf_tables]
  nft_chain_validate+0xc9/0x110 [nf_tables]
  nft_immediate_validate+0x36/0x50 [nf_tables]
  nft_chain_validate+0xc9/0x110 [nf_tables]
  nft_immediate_validate+0x36/0x50 [nf_tables]
  nft_chain_validate+0xc9/0x110 [nf_tables]
  nft_immediate_validate+0x36/0x50 [nf_tables]
  nft_chain_validate+0xc9/0x110 [nf_tables]
  nft_table_validate+0x6b/0xb0 [nf_tables]
  nf_tables_validate+0x8b/0xa0 [nf_tables]
  nf_tables_commit+0x1df/0x1eb0 [nf_tables]
[..]

Currently nf_tables will traverse the entire table (chain graph), starting
from the entry points (base chains), exploring all possible paths
(chain jumps).  But there are cases where we could avoid revalidation.

Consider:
1  input -> j2 -> j3
2  input -> j2 -> j3
3  input -> j1 -> j2 -> j3

Then the second rule does not need to revalidate j2, and, by extension j3,
because this was already checked during validation of the first rule.
We need to validate it only for rule 3.

This is needed because chain loop detection also ensures we do not exceed
the jump stack: Just because we know that j2 is cycle free, its last jump
might now exceed the allowed stack size.  We also need to update all
reachable chains with the new largest observed call depth.

Care has to be taken to revalidate even if the chain depth won't be an
issue: chain validation also ensures that expressions are not called from
invalid base chains.  For example, the masquerade expression can only be
called from NAT postrouting base chains.

Therefore we also need to keep record of the base chain context (type,
hooknum) and revalidate if the chain becomes reachable from a different
hook location.

Reported-by: Hamza Mahfooz <hamzamahfooz@linux.microsoft.com>
Closes: https://lore.kernel.org/netfilter-devel/20251118221735.GA5477@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net/
Tested-by: Hamza Mahfooz <hamzamahfooz@linux.microsoft.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
2025-12-15 15:02:44 +01:00
Linus Torvalds
0dfb36b2dc We have a patch that adds an initial set of tracepoints to the MDS
client from Max, a fix that hardens osdmap parsing code from myself
 (marked for stable) and a few assorted fixups.
 -----BEGIN PGP SIGNATURE-----
 
 iQFHBAABCAAxFiEEydHwtzie9C7TfviiSn/eOAIR84sFAmk8YxITHGlkcnlvbW92
 QGdtYWlsLmNvbQAKCRBKf944AhHzi702B/9Mfj0HQSAaWCyMz6GJAv8+1ijVTSbG
 nTFeMmipYZhPn188OvWqHsf1cw9rWY0fzenIEW05Tk3YmMvYdeRmCcOkZdeG06xw
 um8XxX4L8315E0b98CCpQpVa02ux7XoNtBPjeHccl8PEErJQgQJrQ3Cc/C8kk5U5
 a0KlfeVRXYWkOPJva3+wosOu0t9QgJ9ABt5stqcvYDfdkKfvatQMBN3N1nNRKkFH
 yhNPv+nRtypSk8jiHhKeeCVmosC0L7MnKuO593vDr761cY5mKrgKFqc2LLlPF6r0
 /p13s5SG6X38RUegWCjcK4XRJAzVcR/tyod8LkVVp8d5DC/ptcyy8H+I
 =h1gC
 -----END PGP SIGNATURE-----

Merge tag 'ceph-for-6.19-rc1' of https://github.com/ceph/ceph-client

Pull ceph updates from Ilya Dryomov:
 "We have a patch that adds an initial set of tracepoints to the MDS
  client from Max, a fix that hardens osdmap parsing code from myself
  (marked for stable) and a few assorted fixups"

* tag 'ceph-for-6.19-rc1' of https://github.com/ceph/ceph-client:
  rbd: stop selecting CRC32, CRYPTO, and CRYPTO_AES
  ceph: stop selecting CRC32, CRYPTO, and CRYPTO_AES
  libceph: make decode_pool() more resilient against corrupted osdmaps
  libceph: Amend checking to fix `make W=1` build breakage
  ceph: Amend checking to fix `make W=1` build breakage
  ceph: add trace points to the MDS client
  libceph: fix log output race condition in OSD client
2025-12-14 15:24:10 +12:00
Linus Torvalds
db0130185e Misc fixes:
- Fix error code in the irqchip/mchp-eic driver
  - Fix setup_percpu_irq() affinity assumptions
  - Remove the unused irq_domain_add_tree() function
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmk74RgRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1gSEw/+IwHsSH9a4fOJGwV+vlwljy3zw6Sbmfwh
 D8C+jtVBQwocYzb/snbTvWnHJuhGwyLh6gVcYDDwJj/8IRGXnKVm7S1UKpV/XpRl
 O/dhqo8uogjqVAlo7osqTlYlwSGVLBY++iYCZrt9cY/Hn1bCm0Oz19/wbSJupHqp
 G/aG05iX4SRDHhTI8oWp7oEnnS1Hyox/2CKYHEBQoR2BapJL10exHqnyDpQ48pgL
 60LCQbPeZp5KArQ+NRkc4RbcHBW6tsBJQUPc+m71H5HJTuetxwQ7uNuc3UsaR6jI
 0A/vBryzeS5d88+FO08WxAYaiSENaGBAZ7aAKVbuiSoddwuRBUhvW6OYvWIGNqJG
 gCk4YB9K5li/2slrQdS4BQhq8thdVGkgzcSDFiFLyYmg7NjECPpr4IWggKwFT2zn
 hTF6tjuanBL9jew4Zxw21WcoJa3Kz6FXwSbU+PfWUUb+xc0/zouai17vkP8qwXR6
 xeMqVJCZjb88VXUvL42xqKjIYD4x6UaoUqOtXjfO7xa40XC+2KVmALRInbSdTDpa
 9MsJg6Mi2C+hYPXM1fPCymbktZoBSWnzi8vGUbA9CegyP9J4Zhpl8vmDIn+mXMmB
 Lu7pGAotSWHnXf9oCqAJ4eioaAj4V6HtIPKkSpmQGozifYMvlEI+boIwfkS2sJWK
 lLGe7LH6QeU=
 =/KYE
 -----END PGP SIGNATURE-----

Merge tag 'irq-urgent-2025-12-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull irq fixes from Ingo Molnar:

 - Fix error code in the irqchip/mchp-eic driver

 - Fix setup_percpu_irq() affinity assumptions

 - Remove the unused irq_domain_add_tree() function

* tag 'irq-urgent-2025-12-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc()
  irqdomain: Delete irq_domain_add_tree()
  genirq: Allow NULL affinity for setup_percpu_irq()
2025-12-14 06:07:09 +12:00
Linus Torvalds
edbe407235 Miscellaneous fixes:
- Improve bug reporting
  - Suppress W=1 format warning
  - Improve rseq scalability on Clang builds
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmk74D8RHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1jfHA/9EIt9FCi8B7HHxAnezyVLCQJI7FdY80YS
 fYB85o+4A5sPq8ypFOSaDD++nZc5X+aG+Jj5LkxgFPaQ81OhqlfMMuefgqXxJi9h
 M7U/BbtD2hfFYKIIGZq6H/XHNUiHbhdLVtruphEp4luYwLUGSjVzek/A11TvTzfX
 W0FZLoYdeZeg4lm4MjjADBjvX6NdUpCeZg38i+/N9x8nk5ICfR2FOGHSThXTg4nc
 /csH+Ymshk3crkXc+DcU/qXTsLYNAX30B47Sa33q0aoFucmcEdkNyYtV09NJWu9P
 hOSq2xFhRJxVtv8BFXVgJdcz5UCDxlDGksbM2dGOQDLs0FpBd8LvJaSXUFJaI1RD
 MPly5KvX5K8WI/V5r+S3YvbDRqA3hXZmmYxmHhcQjPrv+fMvXU0/AEkWjjFsaL4E
 7Jq2RCpRY10yDISQMhw+7niS/8Y5wHrthLqNnKpBqH4/LnhZA+hzIZsOlVl2+rGn
 1tJ1V34RhdU8TUd5qfY6o054xokkCeZpyQ6m7I4+Vg6uyU3a33gJcoeIe5XVyXUg
 mv/0ON990HfELvDbtpR3ns2SyybIoyr9Re2WQU+FT9xCRVfxI6BDn9MXXIIYReRJ
 8fr8jcAxbU/Exhu2ryi6v2jqVHih9C6SJSKSEcBr7V/hlmZ3wdtI6zlTlVmLK/Qe
 r+Cs29OFW1I=
 =Ry1N
 -----END PGP SIGNATURE-----

Merge tag 'core-urgent-2025-12-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull misc core fixes from Ingo Molnar:

 - Improve bug reporting

 - Suppress W=1 format warning

 - Improve rseq scalability on Clang builds

* tag 'core-urgent-2025-12-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  rseq: Always inline rseq_debug_syscall_return()
  bug: Hush suggest-attribute=format for __warn_printf()
  bug: Let report_bug_entry() provide the correct bugaddr
2025-12-14 06:04:16 +12:00
Tal Zussman
0c01ea92f5 mm: Remove tlb_flush_reason::NR_TLB_FLUSH_REASONS from <linux/mm_types.h>
This has been unused since it was added 11 years ago in:

  d17d8f9ded ("x86/mm: Add tracepoints for TLB flushes")

Signed-off-by: Tal Zussman <tz2294@columbia.edu>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Rik van Riel <riel@surriel.com>
Acked-by: David Hildenbrand <david@redhat.com>
Link: https://patch.msgid.link/20251212-tlb-trace-fix-v2-2-d322e0ad9b69@columbia.edu
2025-12-13 11:01:16 +01:00
Tal Zussman
8b62e64e6d x86/mm/tlb/trace: Export the TLB_REMOTE_WRONG_CPU enum in <trace/events/tlb.h>
When the TLB_REMOTE_WRONG_CPU enum was introduced for the tlb_flush
tracepoint, the enum was not exported to user-space. Add it to the
appropriate macro definition to enable parsing by userspace tools, as
per:

  Link: https://lore.kernel.org/all/20150403013802.220157513@goodmis.org

[ mingo: Capitalize IPI, etc. ]

Fixes: 2815a56e4b ("x86/mm/tlb: Add tracepoint for TLB flush IPI to stale CPU")
Signed-off-by: Tal Zussman <tz2294@columbia.edu>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Rik van Riel <riel@surriel.com>
Link: https://patch.msgid.link/20251212-tlb-trace-fix-v2-1-d322e0ad9b69@columbia.edu
2025-12-13 11:01:16 +01:00
Linus Torvalds
9d9c1cfec0 There are no significant series in this small merge. Please see the
individual changelogs for details.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCaTsgBwAKCRDdBJ7gKXxA
 jkSIAP4jD66nEC2QyKTiv9XvXi8rpKz6RGAHNZSam0ucI5WKswEAoflmlqsoD/Kk
 sN3YLwLztzCJIYU7tT3IRaPK0irwDAo=
 =nkux
 -----END PGP SIGNATURE-----

Merge tag 'mm-nonmm-stable-2025-12-11-11-47' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull misc updates from Andrew Morton:
 "There are no significant series in this small merge. Please see the
  individual changelogs for details"

[ Editor's note: it's mainly ocfs2 and a couple of random fixes ]

* tag 'mm-nonmm-stable-2025-12-11-11-47' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
  mm: memfd_luo: add CONFIG_SHMEM dependency
  mm: shmem: avoid build warning for CONFIG_SHMEM=n
  ocfs2: fix memory leak in ocfs2_merge_rec_left()
  ocfs2: invalidate inode if i_mode is zero after block read
  ocfs2: avoid -Wflex-array-member-not-at-end warning
  ocfs2: convert remaining read-only checks to ocfs2_emergency_state
  ocfs2: add ocfs2_emergency_state helper and apply to setattr
  checkpatch: add uninitialized pointer with __free attribute check
  args: fix documentation to reflect the correct numbers
  ocfs2: fix kernel BUG in ocfs2_find_victim_chain
  liveupdate: luo_core: fix redundant bound check in luo_ioctl()
  ocfs2: validate inline xattr size and entry count in ocfs2_xattr_ibody_list
  fs/fat: remove unnecessary wrapper fat_max_cache()
  ocfs2: replace deprecated strcpy with strscpy
  ocfs2: check tl_used after reading it from trancate log inode
  liveupdate: luo_file: don't use invalid list iterator
2025-12-13 20:55:12 +12:00
Linus Torvalds
2516a87153 Patch series in this pull request:
- The 2 patch series "powerpc/pseries/cmm: two smaller fixes" from David
   Hildenbrand fixes a couple of minor things in ppc land.
 
 - The 4 patch series "Improve folio split related functions" from Zi Yan
   provides some cleanups and minorish fixes in the folio splitting code.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCaTseCwAKCRDdBJ7gKXxA
 jkCLAP9ttvtG7zhDf+tqvjCJFnybPEo6Z2B4Qx9g8i7s27gTZgD8DzYbIl+YdxrN
 /tS0tdgUfrJIXR2PzzipkydNrs+lxgg=
 =T65o
 -----END PGP SIGNATURE-----

Merge tag 'mm-stable-2025-12-11-11-39' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull more MM updates from Andrew Morton:

 - "powerpc/pseries/cmm: two smaller fixes" (David Hildenbrand)
   fixes a couple of minor things in ppc land

 - "Improve folio split related functions" (Zi Yan)
   some cleanups and minorish fixes in the folio splitting code

* tag 'mm-stable-2025-12-11-11-39' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
  mm/damon/tests/core-kunit: avoid damos_test_commit stack warning
  mm: vmscan: correct nr_requested tracing in scan_folios
  MAINTAINERS: add idr core-api doc file to XARRAY
  mm/hugetlb: fix incorrect error return from hugetlb_reserve_pages()
  mm: fix CONFIG_STACK_GROWSUP typo in mm.h
  mm/huge_memory: fix folio split stats counting
  mm/huge_memory: make min_order_for_split() always return an order
  mm/huge_memory: replace can_split_folio() with direct refcount calculation
  mm/huge_memory: change folio_split_supported() to folio_check_splittable()
  mm/sparse: fix sparse_vmemmap_init_nid_early definition without CONFIG_SPARSEMEM
  powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages
  powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION
2025-12-13 20:35:41 +12:00
Christian Brauner
d2ea4d254d file: ensure cleanup
Brown paper bag time. This is a silly oversight where I missed to drop
the error condition checking to ensure we clean up on early error
returns. I have an internal unit testset coming up for this which will
catch all such issues going forward.

Reported-by: Chris Mason <clm@fb.com>
Reported-by: Jeff Layton <jlayton@kernel.org>
Fixes: 011703a9ac ("file: add FD_{ADD,PREPARE}()")
Signed-off-by: Christian Brauner <brauner@kernel.org>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2025-12-13 20:04:32 +12:00
Linus Torvalds
d8cc0b917b I3C for 6.19 #2
Subsystem:
  - remove .priv_xfers
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEBqsFVZXh8s/0O5JiY6TcMGxwOjIFAmk8nscACgkQY6TcMGxw
 OjL+1Q//Tg2EpJZPRjJaCjf9ohjcrgyFtse+5qeCypnRYFVD3Oy6r3AkiuacJ8jG
 ufQ8V03JTsOIH+BcyGgQgyDWEplcqFdoJPVpdiuJGYMSj8if3g7pUQFFbrzEGum2
 mMRcrvidhCgGVpUYVmIAUxx7anf9bR4Tuq5q9ZZ1gexxjyMJ+sEiLHpTDfuxRfB+
 JIiaDfHEWAzMdVjwtVX0+BidDlhdj4ioY7BJAh/6Zj5dcw1M3zbSBu/Vfj3+jgvj
 TBwV3MEd69t4uofnbh2OZ6YmH2+HrBDafPBIRmWxlU/qFcdSZBLsJE5mrWIhVfur
 mC0vNXF2C/ShFs5DNStCkBqNs8n2Gtv+8IwT1FnPOlzgya8pyphIl1x9uJcGdPBG
 k6GxIRAQHuWvYZEOS+X/rN4P9itKCVab2Z4Yo3Kwd2au4KXp6lZ7cSsVXgDz5QrU
 fXAXKtizc6Oz2ebU8r88Wh5G/oUeffOf2xls/nZ9gVVXdSNpx7Ehy9N5IbQou7dF
 doFOtWdascK5rmnjCowTwHSug+Jl9K8w0IzaF8w+lLPBo0twru0kFqgWLAc7lj+v
 hVzE6JHtnR4hth+sf5oynUwfjtZYT7nGoQnCSBUlr6f6UAOUQTT+TTqoyXOMxiqh
 5PeeuK78QFcWRdjPeb1JX2mRk3Kj2oMFlmGpk8IQGY4U/zdVr3o=
 =tZor
 -----END PGP SIGNATURE-----

Merge tag 'i3c/for-6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux

Pull further i3c update from Alexandre Belloni:
 "We are removing a legacy API callback and having this sooner rather
  than later will help ensuring no one introduces a new driver using it.

  I've also added patches removing the "__free(...) = NULL" pattern
  because I'm sure we won't avoid people sending those following the
  mailing list discussion..."

* tag 'i3c/for-6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux:
  i3c: adi: Fix confusing cleanup.h syntax
  i3c: master: Fix confusing cleanup.h syntax
  i3c: master: cleanup callback .priv_xfers()
  i3c: master: switch to use new callback .i3c_xfers() from .priv_xfers()
2025-12-13 17:15:16 +12:00
Linus Torvalds
d324e9a915 RTC for 6.19
Subsystem:
  - stop setting max_user_freq from the individual drivers as this has not been
    hardware related for a while
 
 New drivers:
  - Andes ATCRTC100
  - Apple SMC
  - Nvidia VRS
 
 Drivers:
  - renesas-rtca3: add RZ/V2H support
  - tegra: add ACPI support
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEBqsFVZXh8s/0O5JiY6TcMGxwOjIFAmk8lp4ACgkQY6TcMGxw
 OjLp8Q/9HL1Jxy8oXHfvnCCb1/2VPrkRaAEUGJKvbwEJRr7IOM4etyjX2LuCTex4
 L5EQhoTZDhT75bIdVM67hhxswQ+LeBQiPy+kNBsGDPqhIIKx1Wf45Hk3UutJcXta
 Y2FWkPw704WUtLI4oWGxhBgSCMp84lcgakNNITLGUcO2TeRaPqIimcU0p+0PgpZu
 4YYuwu6lPQIK2UL2RcH9dzUiEArM0kkK619jsCvUKEZNI6KQi/8rbyybM6lmiyVp
 FGHAx2Ttr5SIa+Us7TB2M9D+P1Cq06WgmDXClF1SXKUXPKT3Q5woGcjTOzH35Bbf
 vw7nm4ouPe5EKy3ED7nXpXJacpxXvEUo4UKMN6CztAEAoxBsABJ1WjxuHq1bjT9R
 7aSpkNGOMkjzLsD405XRA2oIH1Dp+ML2UAL4fOdu2Hy/cFBXoFqlGnK/mnbXyVMG
 InCbY9HbeO/bOrp7/iKGQMj6Wz0T7TmH2MUT6FHqpk4cXbDW3lwifDJ6NrBafpVq
 VxAsl1wZLeMT1ga8FJQJ2eITLT1QfvYaPNjZM4d9hCRJybst7sxNWxFNHhn/cGD/
 Hdq9iVhU0yVO9HfBYZ7soLXrxg2ePcwsK3oBNvGmp+ZzLy5Jd0/VIE/F2/F+0yke
 rfiEQwUNob7qqsBFT6ko9JiZ8dsAqKldd8f/jgIE+xfDhRbCnOU=
 =oBij
 -----END PGP SIGNATURE-----

Merge tag 'rtc-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux

Pull RTC updates from Alexandre Belloni:
 "Subsystem:
   - stop setting max_user_freq from the individual drivers as this has
     not been hardware related for a while

  New drivers:
   - Andes ATCRTC100
   - Apple SMC
   - Nvidia VRS

  Drivers:
   - renesas-rtca3: add RZ/V2H support
   - tegra: add ACPI support"

* tag 'rtc-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: (34 commits)
  rtc: spacemit: MFD_SPACEMIT_P1 as dependencies
  rtc: atcrtc100: Fix signedness bug in probe()
  rtc: max31335: Fix ignored return value in set_alarm
  rtc: gamecube: Check the return value of ioremap()
  Documentation: ABI: testing: Fix "upto" typo in rtc-cdev
  rtc: Add new rtc-macsmc driver for Apple Silicon Macs
  dt-bindings: rtc: Add Apple SMC RTC
  MAINTAINERS: drop unneeded file entry in NVIDIA VRS RTC DRIVER
  rtc: isl12026: Add id_table
  rtc: renesas-rtca3: Add support for multiple reset lines
  dt-bindings: rtc: renesas,rz-rtca3: Add RZ/V2H support
  rtc: tegra: Replace deprecated SIMPLE_DEV_PM_OPS
  rtc: tegra: Add ACPI support
  rtc: tegra: Use devm_clk_get_enabled() in probe
  rtc: Kconfig: add MC34708 to mc13xxx help text
  rtc: s35390a: use u8 instead of char for register buffer
  rtc: nvvrs: add NVIDIA VRS RTC device driver
  dt-bindings: rtc: Document NVIDIA VRS RTC
  rtc: atcrtc100: Add ATCRTC100 RTC driver
  MAINTAINERS: Add entry for ATCRTC100 RTC driver
  ...
2025-12-13 17:09:06 +12:00
Linus Torvalds
db9c438739 soundwire updates for 6.19
- Support for multiple sections in a BPT stream
  - Aligning DMA frame with BPT frames
  - Qualcomm: support for v3.1.0 controllers
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAmk8DksACgkQfBQHDyUj
 g0eK1g/6Awba2J+ME+ZJ/Narqh7qwQRk0/Q9HcnPCxeXGc8peDtuhIxatmqHM+Eg
 ReoZTIIDA+/ysa1oFrdhi0MBRoZSC1eQpvL9mAQEZ5MxG368flnLncP26rYwyJHT
 rzBy0Ca/feRMddBbeTqR7OehyDsj4CiBeInRy1aY/UvaFypIgnCagyHWO6TZzYDF
 gCEVvsGaa7I3qcc1yhi+hP6jvTPMd5FtH2pKKVgL8aNvNgWSv664WX+zz2KY9KSV
 vcjA5z1rIJ3hohuGx+cqZeQGVS2PBxUyHWjvGlp3wtSVzMRGyb2TDWYsJy8+xKkM
 2Raz1uDMJPz+mDsCYlbU2h5I6SJBBhPa7fYJpuFs5KG4GY4p/ndsdh0LRStf5QtE
 pQmxOiisvbwKgKFlzOLM10zVdRL44VLldwevBt5G7uozpH8FDJ7CTCdSVRAzk2yf
 poB5zRVh1fewWi8I23T29t+GXXMq59s+Yre5lpvIp5+UO6ZDeSqcNhL6YCT6xJaZ
 ze7pkVSRY7V3lcLGP2tM19785XZr9SPZxbNojF+X/FlQbhkAp6QvMQe6v67ouoKK
 K9/9LRMyFYvDq0D19pOdbhCcEUvXWKFgyuUXdfWCpjzkHnpDQZws38FhFhYWeBzm
 LJKkTlAzI1DPEvpFc5YQf2jx4V4OH5W8lPUzunA9MmXN7MWprJ4=
 =tDi0
 -----END PGP SIGNATURE-----

Merge tag 'soundwire-6.19-rc1_updated' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire

Pull soundwire updates from Vinod Koul:

 - Support for multiple sections in a BPT stream

 - Align DMA frame with BPT frames

 - Qualcomm support for v3.1.0 controllers

* tag 'soundwire-6.19-rc1_updated' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire:
  soundwire: intel_ace2x: handle multi BPT sections
  soundwire: pass sdw_bpt_section to cdns BPT helpers
  soundwire: introduce BPT section
  soundwire: intel_ace2x: add fake frame to BRA read command
  soundwire: cadence_master: add fake_size parameter to sdw_cdns_prepare_read_dma_buffer
  ASoC: SOF: Intel: export hda_sdw_bpt_get_buf_size_aligment
  soundwire: cadence: export sdw_cdns_bpt_find_bandwidth
  soundwire: cadence_master: set data_per_frame as frame capability
  soundwire: only compute BPT stream in sdw_compute_dp0_port_params
  soundwire: cadence_master: make frame index trace more readable
  soundwire: qcom: adding support for v3.1.0
  dt-bindings: soundwire: qcom: Document v3.1.0 version of IP block
  soundwire: qcom: prepare for v3.x
  soundwire: qcom: deprecate qcom,din/out-ports
  dt-bindings: soundwire: qcom: deprecate qcom,din/out-ports
  soundwire: qcom: remove unused rd_fifo_depth
  of: base: Add of_property_read_u8_index
2025-12-13 16:26:55 +12:00
Linus Torvalds
7f3c8f9191 sound fixes for 6.19-rc1
The rest for 6.19 merge window.  The only slightly large change is
 the enablement of CIX HD-audio controller, which took a bit time to
 be cooked up, while most of other changes are device-specific small
 trivial fixes.
 
 - Default disablement of the kconfig for decades old pre-release
   alsa-lib PCM API; it's only the default config value change, so
   it can't lead to any regressions for the existing setups
 - Support for CIX HD-audio controller
 - A few ASoC ACP fixes
 - Fixes for ASoC cirrus, bcm, wcd, qcom, ak platforms
 - Trivial hardening for FireWire and USB-audio
 - HD-audio Intel binding fix and quirks
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmk6tSgOHHRpd2FpQHN1
 c2UuZGUACgkQLtJE4w1nLE+RVBAAjPpGl5pG+oS2COkHkaieg+fHcHBOQxKDO+fU
 4p8t/gAb6ELPrYX7YdH0EbSyUhQOYkRin5DSNj1qEa4PQwCayXp2Xv/HT7t6aqbl
 0F3rboXTEnBMRf8haAde+hgNzF0aLwOE3BFZc5hWpDs04pFX8Y0hKu1/JlrVVyvJ
 j54KuoZQxp7nu9N+t9xsdIet3nrrjbdvKGXqPbNbo6IWviuj+6+YSueaLdgNOpD1
 nP8dDx2LcuRf0KRPNoIP4ZuJvOD3C9/rbbHAkSZ5Vf2dliy+aIHo/8SXWjBVW9N3
 V+HFc9P9te3VtUpCOIZjK2Pgf3QTfMIkFIspOR4kSlbdkhoZoPlM2J65VXXugeur
 5lxfnXwL439iW2KfKGFjSdu23EHh7VSBIIXWzRO0y0qtgyEakINCkOEVG//AW+9v
 OL1IUoyatfa3HQA2K15E1xgVr4jTAwENXyMszJ+1zsaLTTD09sKFmFmfLUUCS9Ir
 ekpRC1n0m8dWfDJtGcmcxyda87DL+9lOK0r6KW3Mo31EL92KWlm1wJiQSrsuNWgh
 J4NE8F9+Smh96CKXB/v+B+kXIOsXh8+dVoYWRNzJ9wYfXf2ch8l2LIYPBFJa159/
 7XyzFWC3636ZWrCn6sE/rkzEh/0OHEWI+npeN47OJ1Wh1CSS/b1tFZbGaurkGe5i
 ni1Sa54=
 =3ys0
 -----END PGP SIGNATURE-----

Merge tag 'sound-fix-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "The only slightly large change is the enablement of CIX HD-audio
  controller, which took a bit time to be cooked up, while most of other
  changes are device-specific small trivial fixes:

   - Default disablement of the kconfig for decades old pre-release
     alsa-lib PCM API; it's only the default config value change, so it
     can't lead to any regressions for the existing setups

   - Support for CIX HD-audio controller

   - A few ASoC ACP fixes

   - Fixes for ASoC cirrus, bcm, wcd, qcom, ak platforms

   - Trivial hardening for FireWire and USB-audio

   - HD-audio Intel binding fix and quirks"

* tag 'sound-fix-6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (30 commits)
  ALSA: hda/tas2781: Add new quirk for HP new project
  ALSA: hda: cix-ipbloq: Use modern PM ops
  ALSA: hda: intel-dsp-config: Prefer legacy driver as fallback
  ASoC: amd: acp: update tdm channels for specific DAI
  ASoC: cs35l56: Fix incorrect select SND_SOC_CS35L56_CAL_SYSFS_COMMON
  ALSA: firewire-motu: add bounds check in put_user loop for DSP events
  ASoC: cs35l41: Always return 0 when a subsystem ID is found
  ALSA: uapi: Fix typo in asound.h comment
  ALSA: Do not build obsolete API
  ALSA: hda: add CIX IPBLOQ HDA controller support
  ALSA: hda/core: add addr_offset field for bus address translation
  ALSA: hda: dt-bindings: add CIX IPBLOQ HDA controller support
  ALSA: hda/realtek: Add support for ASUS UM3406GA
  ALSA: hda/realtek: Add support for HP Turbine Laptops
  ALSA: usb-audio: Initialize status1 to fix uninitialized symbol errors
  ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events
  ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi()
  ASoC: cros_ec_codec: Remove unnecessary selection of CRYPTO
  ASoc: qcom: q6afe: fix bad guard conversion
  ASoC: rockchip: Fix Wvoid-pointer-to-enum-cast warning (again)
  ...
2025-12-13 16:09:10 +12:00