mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-10 20:48:12 +00:00
1,463,287 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Linus Torvalds
|
08de7d9d24 |
watchdog fixes for v7.2-rc5
Notable fixes: - airoha: Prevent division by zero when clock frequency is zero - core: pretimeout: Fix UAF in watchdog_unregister_governor() - ni903x_wdt: Check ACPI_COMPANION() against NULL - s32g_wdt: remove incorrect options in watchdog_info struct -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEiHPvMQj9QTOCiqgVyx8mb86fmYEFAmpg9jQACgkQyx8mb86f mYECGw//fpjigslXk+hj7G/qZ+ng2Cct34tbXPCf5z9mxnmWwu678vGFs1/V3vJp 0Ix0CbsXIAmlzgaenFFqHU0WFWbd8VrQTw0tAOwoEpMpyZ+Z2pYiZ7TY1Y3lHPhR bMj5Wsts2Vtni1o2/iOi3dUiqMPwQ6gpYgmCoQSPweA7CUpjvcYEjBcLSiz59eCz z1HiyMdOUt+elo1UUazJuLJZR5E6BfeGYmiAJ04N+yjuKcytV1I8dTLHtnQUt8Tu CG+DRJEGBfM0TeLQfUGtQqvCXNwhuEKgEwj+gL030fuIjyIV70nmO/jjRmitAQsu rpgcl9HWH0Y8ZMpYzG/ZXC1pg861aJSumPR2mqT1hHKqXqxhv4qk8hoSKH3TSBbF Glbzdjtd0A2LR43Z2+tCdZmCf2Q7iFgr6CyZnq/1mmGLT90HbytSYTMiZpumKuN1 FwWUyEgMDk81L9bxzdmaGhg0XyuwzXhL8bk3tzBPKOqnmtNfIFHQVN8NKAuPzPgR W38R3cq7H+GsEVjVBZWkqP6Ij6HKfj186bjeeOMEWnPkicwBNi201mZTS+7arAE5 oxlfNOLAjtsd9ml7130ddVz2zZ2Ez2zhNvf23Bu/uIHaVjSr5FId0Gnbeywf/JLh whflQmaMPXs4a5kzppk23PAZVwYJ8PN7QYhPoDgfJzLJSJwEqJY= =12+G -----END PGP SIGNATURE----- Merge tag 'watchdog-for-v7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull watchdog fixes from Guenter Roeck: - airoha: Prevent division by zero when clock frequency is zero - core: pretimeout: Fix UAF in watchdog_unregister_governor() - ni903x_wdt: Check ACPI_COMPANION() against NULL - s32g_wdt: remove incorrect options in watchdog_info struct * tag 'watchdog-for-v7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: watchdog: airoha: Prevent division by zero when clock frequency is zero watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() docs: watchdog: Fix brackets watchdog: ni903x_wdt: Check ACPI_COMPANION() against NULL watchdog: s32g_wdt: remove incorrect options in watchdog_info struct |
||
|
Linus Torvalds
|
d0ec222d41 |
platform-drivers-x86 for v7.2-3
Fixes
- asus-wmi: Revert retaining battery charge threshold on boot due to
userspace regression. Userspace assumed (errorneously) a
non-zero return code from sysfs read implies feature is not
supported but the correct way would be to check file
visibility instead. This results in the kernel change
breaking the functionality completely. Thus, we are taking
timeout on the kernel side to allow userspace to sort their
problem first.
- intel/vsec: Free ACPI discovery data allocation on error paths
The following is an automated shortlog grouped by driver:
asus-wmi:
- temporarily revert to setting a charge limit
intel/vsec:
- free ACPI discovery data on early errors
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQSCSUwRdwTNL2MhaBlZrE9hU+XOMQUCamC2OgAKCRBZrE9hU+XO
MayPAQD6WZEq/0gBk0qmXQs/LsgGbhmmt0lWjN2i4KeQ/CqUlQEA/TAII2u3amM0
m0xOxdu139D4b7VJp8QjCanIYhFusg0=
=ePnn
-----END PGP SIGNATURE-----
Merge tag 'platform-drivers-x86-v7.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86
Pull x86 platform driver fixes from Ilpo Järvinen:
- asus-wmi: Revert retaining battery charge threshold on boot due to
userspace regression.
Userspace assumed (errorneously) a non-zero return code from sysfs
read implies feature is not supported but the correct way would be to
check file visibility instead. This results in the kernel change
breaking the functionality completely. Thus, we are taking timeout on
the kernel side to allow userspace to sort their problem first.
- intel/vsec: Free ACPI discovery data allocation on error paths
* tag 'platform-drivers-x86-v7.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86:
platform/x86: asus-wmi: temporarily revert to setting a charge limit
platform/x86/intel/vsec: free ACPI discovery data on early errors
|
||
|
Linus Torvalds
|
57a92aaba9 |
sound fixes for 7.2-rc5
A collection of fixes that have been accumulated recently.
The amount is still "new normal", but all small fixes.
Mostly hardware-specific quirks, but including a few core fixes, too.
ALSA Core:
- Fix potential UAF and race fixes in ALSA timer core
- Fix sequencer queue timer cleanup to prevent leaks and double-free
HD-audio:
- Fix silent streams with Intel HDMI keep-alive silent mode
- Quirks for HP laptops (Pavilion x360, EliteBook 830 G8, ZBook 8
G2a), Samsung 750XBE/730XBE, and Dell Pro QC1255, Alienware x16 R2,
Lunnen Ground 14
- Properly validate ACPI mute object in CS35L41 HDA companion driver
- Reset calibration data size on failure in TAS2781 HDA driver.
USB-audio:
- Support FIXED_RATE quirk for JBL Quantum650 Wireless USB headset
ASoC:
- Intel SOF SoundWire board driver quirks for new Dell laptops
- DMI overrides and quirks for AMD ACP/YC platforms, including new
ASUS TUF platforms and MSI Vector A16 HX laptops
- Skip sysclk reset for active DAIs in shutdown for FSL imx-card
- Fix spurious BCLK on resume by clearing BYP in FSL SAI driver
- Add playback-only quirk for H616 codec in Allwinner driver
- Fix Cirrus Logic CS35L56 potential probe deadlock
- Fix cache write-through on resume in FS210X codec
- Bound firmware description string parsing in TAS2781 codec driver
- Fix duplicate DAPM widget names for wideband DAI in BT-SCO codec
-----BEGIN PGP SIGNATURE-----
iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmpfdfoOHHRpd2FpQHN1
c2UuZGUACgkQLtJE4w1nLE8GsA/8DOTRLmfsOkdCRd23LcQtmU0vLypZD1Mb4mpW
0syspvylS7RnUN+2pGOqP/k4BbOFPtoVHel0RTHqmolesA0OFTMk86nHZF/sOpno
VspMoiI9ptFjOFQdrCVt9wM+Yj9A5n/cRXuwgNJ3RxLuBPPgStzIPQqrfB2ofMIo
ox+iYu57kvm4eH+WU8gul5snxTh1g9y2CdWCvtKSCVtTpK9IoMTdPV7DWizti2eA
u3Na0wt6FuDnO74bg81Oku7u4rsfjBUEc8p6EOk+p8zWpQ12WFmH7QS+1Q2lLHqz
m8IdgLH4PwRZjqdX/k9SggNyNoGc3LIE3bhyuioFQBr+9brZluuj9rVYWARAg+wF
WZGJoY1o9Pr+lQk24Uk1kEdrOYYHUqPJj4JuPdLI9gnA5j0GyF28dke4QV2Z0849
NXnX/R0u8nV1QQQLFmyTsTm4FghfWGZTLnQnTvuG0zoEyktrGVSWpR77nN+zQGFx
gsv0hJAf8PKPEK6uyxfVzcG+vy0N/m2BDQ6CekcLQYjqKpYj9wV8Z9ftbCAKlD6w
s1Z9pR5SQgbzDLxCE4XHUgz3rox+5Tni9ulgnkhHlkTLVHmRB84rEJ1+J3VJTLYt
fxogK3LpD7pu70w+DR7byUtx8jHLD5wQCw/fY7VSf2cxbqTQpLPzJ6HyLxxR9TPY
fFEiG8A=
=Shbe
-----END PGP SIGNATURE-----
Merge tag 'sound-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"A collection of fixes that have been accumulated recently.
The amount is still "new normal", but all small fixes. Mostly
hardware-specific quirks, but including a few core fixes, too.
ALSA Core:
- Fix potential UAF and race fixes in ALSA timer core
- Fix sequencer queue timer cleanup to prevent leaks and double-free
HD-audio:
- Fix silent streams with Intel HDMI keep-alive silent mode
- Quirks for HP laptops (Pavilion x360, EliteBook 830 G8, ZBook 8
G2a), Samsung 750XBE/730XBE, and Dell Pro QC1255, Alienware x16 R2,
Lunnen Ground 14
- Properly validate ACPI mute object in CS35L41 HDA companion driver
- Reset calibration data size on failure in TAS2781 HDA driver.
USB-audio:
- Support FIXED_RATE quirk for JBL Quantum650 Wireless USB headset
ASoC:
- Intel SOF SoundWire board driver quirks for new Dell laptops
- DMI overrides and quirks for AMD ACP/YC platforms, including new
ASUS TUF platforms and MSI Vector A16 HX laptops
- Skip sysclk reset for active DAIs in shutdown for FSL imx-card
- Fix spurious BCLK on resume by clearing BYP in FSL SAI driver
- Add playback-only quirk for H616 codec in Allwinner driver
- Fix Cirrus Logic CS35L56 potential probe deadlock
- Fix cache write-through on resume in FS210X codec
- Bound firmware description string parsing in TAS2781 codec driver
- Fix duplicate DAPM widget names for wideband DAI in BT-SCO codec"
* tag 'sound-7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (25 commits)
ALSA: hda/realtek - Add quirk for Dell Pro QC1255
ALSA: hda/tas2781: clear cali_data.total_sz when calibration read fails
ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Samsung 750XBE/730XBE
ALSA: hda/realtek: Fix speakers on Lunnen Ground 14
ALSA: timer: drain a slave's callback before its master detaches it
ALSA: timer: don't re-enter an instance callback that is still running
ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless
ALSA: hda/realtek: Add quirk for HP Pavilion x360
ASoC: Intel: sof_sdw: Add quirks for new Dell laptops
ASoC: cs35l56: Use complete_all() to signal init_completion
ASoC: cs35l56: Fix potential probe() deadlock
ASoC: fs210x: Make cache write through again during resume
ALSA: hda/realtek: Add inverted LED quirk for HP ZBook 8 G2a
ALSA: hda: codecs: hdmi: disable keep-alive before audio format change
ASoC: bt-sco: fix duplicate DAPM widget names for wideband DAI
ALSA: hda: cs35l41: validate and free ACPI mute object
ALSA: hda/realtek: Fix speakers on Alienware x16 R2
ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs
ASoC: amd: yc: Add DMI quirk for MSI Vector A16 HX A8WIG
ASoC: fsl: imx-card: Skip sysclk reset for active DAIs in shutdown
...
|
||
|
Linus Torvalds
|
5a52217525 |
nfsd-7.2 fixes:
Issues reported with v7.2-rc: - Fix issue with NLMv3 GRANTED_MSG introduced in v7.2 -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEKLLlsBKG3yQ88j7+M2qzM29mf5cFAmpftS0ACgkQM2qzM29m f5epbA/+OdiOdpnmxMClc7tKcvNlbPzDQxM8yi1LCKWD5IYbDzdtZatnfHsjGkIw pYtoDTrvlJC9nC8LyNu2eaj8BQXM8IYNNDlQ/m2zLWQ+5E59JUwBPzZyLCMBRHb+ l7h7SCsCb/6S6+sn0/iAi7DFvlreDPNOMCSlArmulmRZRq99JbIOfbHg02qXK3bx huPNMeU/3y9GZccqHRz6l8joxCGYn2iXlFIs8wex+MecifmhfKhyAhjA5QP6ZbjL vCkluLrlPy+nM/ZjESx7UgKZQYkwnq9zitYNakIr7I53wrPci7z/6ZzCucEEtwSN q+Zl+8fmLfr1MyicNn30hVFuZ7Q04+K3GjaV4beuSj5YGe5lI1rlNultQBGSK3WZ 1GmdOo7XiKQ2x4k37HXf38DxKFYYCJp//HYXKRHnjOhKIaXDaMqj1Qq8H0fyElPG txIFm3ZNLgUyoULihpA8sx/j/mCcub3GIu/yplXFCBOwMKf0fKFPdY9jTWU93cDN krIhucg6RGWMoHQ8WnWDY1/+B5NrAska4/RHzqLhSESiLAUOtgLCQHPsJSufqf3h +Qbf6XTM4G/ABEXkOB4P515fcNYxHx6v0/qkyUdESHGLFrAuP2leSAWG1oKmeBDn HUYKaJvjZcx+Tvd5xhXm9jPBBkwfzDFhURm4IZ0rLKpDu489BIE= =dW6d -----END PGP SIGNATURE----- Merge tag 'nfsd-7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fix from Chuck Lever: - Fix issue with NLMv3 GRANTED_MSG introduced in v7.2 * tag 'nfsd-7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: lockd: fix NLMv3 GRANTED_MSG handling |
||
|
Linus Torvalds
|
248951ddc1 |
hwmon fixes for v7.2-rc5
- asus-ec-sensors: Add missed handle for ENOMEM, fix EC read intervals, and fix looping over banks while reading from EC - occ: Vvalidate poll response sensor blocks - pmbus/max34440: Block unsupported VIN and IIN limit registers - nzxt-kraken3, nzxt-smart2: gigabyte_waterforce, corsair-cpro, corsair-psu: Stop device IO before calling hid_hw_stop -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEiHPvMQj9QTOCiqgVyx8mb86fmYEFAmpfhwAACgkQyx8mb86f mYFLVA//bLgBEfOKLQga/VlcxohtRQCuxbtq2iObk6hZPLn2Y2ugiHONI9f9mudt Yd45aMVH6utmYGaIZmXEN2xetGhiWa991rXQTlKe2iBLnRY1NGw+RIc7XEJo7iMU I/xAK+0CNXgUVRkzbzjEku532KXU3AHlfOyX6DFlBuYxhBr3PMAAyMZaI3QGPNpH cay49WgsXl0VHY0Hmih/JgBljcbqfAxqUs39lYeIcRiehJmvaBccfA6XW/edWBBB bU1MEvT59s+6ATFdsdNtTbBmpmLZ5AnvKjtQvw5xkHVAfnPFSwAUwX3hangJBmnn TT21fAkhahFTZJ5pHGt40E+AkCCLYofq3KNRIxwBPvFh1qNe0Tt7XZZi4RguQQ9m g1kUXHXiE3edn1yzZ4lqj6rIZ7WO9Qg7OrwZs0g23Qf4XbAfDK6JsxflWL0CuUSS VrDrymBE1abAgwOw4yenaKW7FFHUSNHHaoYis0Ct6MBWT/DJ2dOeZtqFM89heLAn yoWor7KmDKuazSJ8ShmuAU8JOT0y8hGadp7WHd2ByzIAVgvMO6BTcaqa8aFoh6u+ IlMZAgN2JiqeeWoGc71ciF+/pBvfYNEA7huUKKB/UgY+KReYOLvqQxQnW4/gi4lQ b1tCnJw5jlrah7Q77qSjj/recbKaDcPjmHKkMfYYGkU4DCHxqEg= =Bo65 -----END PGP SIGNATURE----- Merge tag 'hwmon-for-v7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - asus-ec-sensors: Add missed handle for ENOMEM, fix EC read intervals, and fix looping over banks while reading from EC - occ: validate poll response sensor blocks - pmbus/max34440: Block unsupported VIN and IIN limit registers - nzxt-kraken3, nzxt-smart2: gigabyte_waterforce, corsair-cpro, corsair-psu: Stop device IO before calling hid_hw_stop * tag 'hwmon-for-v7.2-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: occ: validate poll response sensor blocks hwmon: (asus-ec-sensors) add missed handle for ENOMEM hwmon: (asus-ec-sensors) fix EC read intervals hwmon: (asus-ec-sensors) fix looping over banks while reading from EC hwmon: (pmbus/max34440) block unsupported VIN and IIN limit registers hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop |
||
|
Linus Torvalds
|
b4b760b59f |
RISC-V:
- Avoid redundant allocations when allocating IMSIC page tables
- Apply SBI FWFT LOCK flag only on successful set
- Bound SBI PMU counter mask scan to BITS_PER_LONG, since on RV32
the PMU SBI start/stop helper can only access 32 PMU counters.
- Skip TLB flush when G-stage PTE becomes valid if the Svvptc
extension is available.
- Always show Zicbo[m|z|p] block sizes in ONE_REG
- Inject instruction access fault on unmapped guest fetch
- Use raw spinlock for irqs_pending and irqs_pending_mask
- Fix Spectre-v1 in vector register access via ONE_REG
x86:
- Fixes to SEV selftests.
- Once free_nested() did a VMCLEAR of shadow VMCS, there's no need to VMCLEAR it
again if the kernel is preempted and thread migration happens
- Preserve nested TDP shadow page tables if they are used as roots, instead of
clearing them unnecessarily
- Fix use of stale data if out-of-memory happens after vendor module reload
- Check for invalid/obsolete root *after* making MMU pages available, because
the latter can make a page invalid
- Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN
-----BEGIN PGP SIGNATURE-----
iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmpfSUwUHHBib256aW5p
QHJlZGhhdC5jb20ACgkQv/vSX3jHroOrWQf/S8Za6t7bZbQbJHDV0NXCKufpyKyz
l6WMsLGdn4LFLNqCtKhvQf5lEZ5PKRHFTGoWrO1wQSbREHRUCnfMD5lsSKQA4Grf
0QpQ6YBjXFv6zg0M456/Q/S1oyusyqkXXBS8BxlBQyfqR+ByKx8f4PXTGazfUua3
4SPHr5TUxr6CXy8715OQUGa1Xdf0/5d3OseiAgBwqM31yZPhK0tsar77Cd9P93bs
DC+FzfphHg0gb3s/xSfuVR0BPnqHvQMDF9rS/YKgJgJdZkzHXCo7muWRQmHWK+FR
Q2zOTWSlJATQucC0+2j1yj2Wdhg1itgZTfj/8RaIDRKbmjk0S1bLc3bamg==
=Svds
-----END PGP SIGNATURE-----
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
Pull kvm fixes from Paolo Bonzini:
"RISC-V:
- Avoid redundant allocations when allocating IMSIC page tables
- Apply SBI FWFT LOCK flag only on successful set
- Bound SBI PMU counter mask scan to BITS_PER_LONG, since on RV32 the
PMU SBI start/stop helper can only access 32 PMU counters.
- Skip TLB flush when G-stage PTE becomes valid if the Svvptc
extension is available.
- Always show Zicbo[m|z|p] block sizes in ONE_REG
- Inject instruction access fault on unmapped guest fetch
- Use raw spinlock for irqs_pending and irqs_pending_mask
- Fix Spectre-v1 in vector register access via ONE_REG
x86:
- Fixes to SEV selftests
- Once free_nested() did a VMCLEAR of shadow VMCS, there's no need to
VMCLEAR it again if the kernel is preempted and thread migration
happens
- Preserve nested TDP shadow page tables if they are used as roots,
instead of clearing them unnecessarily
- Fix use of stale data if out-of-memory happens after vendor module
reload
- Check for invalid/obsolete root *after* making MMU pages available,
because the latter can make a page invalid
- Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN"
* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN
KVM: selftests: sev_init2_tests: Derive SEV availability from KVM
KVM: selftests: sev_smoke_test: Only run VM types the host offers
KVM: x86/mmu: Fix use-after-free on vendor module reload
KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots
KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
KVM: nVMX: Hide shadow VMCS right after VMCLEAR
KVM: riscv: Fix Spectre-v1 in vector register access
RISC-V: KVM: Serialize virtual interrupt pending state updates
RISC-V: KVM: Inject instruction access fault on unmapped guest fetch
RISC-V: KVM: Zicbo[m|z|p] block sizes should be always present in ONE_REG
riscv: kvm: Skip TLB flush when G-stage PTE becomes valid with Svvptc
KVM: riscv: PMU: Bound counter mask scan to BITS_PER_LONG
KVM: riscv: SBI FWFT: Apply LOCK flag only on successful set
RISC-V: KVM: Avoid redundant page-table allocations in ioremap topup
|
||
|
Linus Torvalds
|
cdb65777c4 |
Probes fixes for v7.2-rc4:
- tracing/probes: Avoid temporary buffer truncation in match_command_args() Compare argument name, delimiter, and comm expression directly instead of formatting into a stack buffer to prevent false matching failures. - tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() Return early when trace_probe_log.argc is zero to prevent out-of-bounds access when constructing the formatted error command string. - tracing/probes: Fix potential underflow in LEN_OR_ZERO macro Ensure buffer length is greater than current position before subtraction to prevent unsigned size underflow when formatting print strings. - tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() Check system name null-termination to avoid partial prefix matching when comparing event probe target system names. -----BEGIN PGP SIGNATURE----- iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmpfMPgbHG1hc2FtaS5o aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8bDm8IAJ3GuBwQOTcVyn1+7Poh fOtXOD9yMIV2YYoe6MDD/ZF1JCCnJgzgjPOqRbZjM4uGE8QbEuGnrwwu3zRiNON3 JU1R5aOxadflNhOnY7HxPjDHTwxJ5z+Ju10wPM+YE3M9gLKia8uzCabdEgYEly01 Rx6kpGKdsNgtJ/uAbrZlx++YtJCmBI1j+SdnRgNSejbcJUBtTmt+VYA+oh7ISF0f Fuhw6MuznpnA9JkLrPJaUI6KLiNLEoLQVS2gqhCD0PvrlDGF/h+b7Qbv9ML0C8YW W0p38Sq0Pc9lNlukYJlkh1A4H7lbAGpdGgZVoCvMQZt1ccy+H1QYfXzrFRlYyRWk n6g= =pC9O -----END PGP SIGNATURE----- Merge tag 'probes-fixes-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull probes fixes from Masami Hiramatsu: - Avoid temporary buffer truncation in match_command_args() Compare argument name, delimiter, and comm expression directly instead of formatting into a stack buffer to prevent false matching failures - Prevent out-of-bounds write in __trace_probe_log_err() Return early when trace_probe_log.argc is zero to prevent out-of-bounds access when constructing the formatted error command string - Fix potential underflow in LEN_OR_ZERO macro Ensure buffer length is greater than current position before subtraction to prevent unsigned size underflow when formatting print strings - Fix exact system name matching in eprobe_dyn_event_match() Check system name null-termination to avoid partial prefix matching when comparing event probe target system names * tag 'probes-fixes-v7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() tracing/probes: Fix potential underflow in LEN_OR_ZERO macro tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err() tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args() |
||
|
Linus Torvalds
|
51f247c4b2 |
for-7.2-rc4-tag
-----BEGIN PGP SIGNATURE-----
iQJPBAABCgA5FiEE8rQSAMVO+zA4DBdWxWXV+ddtWDsFAmpdukAbFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMiwyAAoJEMVl1fnXbVg70hwQAJ78AUVnvTSwMi2w6TEx
KFYZSMPdBi9TwGC3lDCcTA/U5PqGTkKACWBLf5z+9YXAcb3By7OiSAQeko7sib0X
k0jz5SmJjMHrHe1qGQvaztLin9/Ow9K8/QUQW0qhunwF6FbmgkfWdXw4au5+zV5R
rwdyDt74nlhf3pCOpJb1JL2BFy23PXbfQIty9I+2qKUMPSgqhC6l7CBYsWZoG5ub
QC2+Go5Ygz61iKDpAZ3TKjULI58+7K3FBq+76Jr9UajPVD75637Wze3zsrgcb2LV
THxITsWTxx5CwiQF1Sf0JGo/rU+V0wU5oJqwmn4FrGeZXhnGXXcnXmG70VzvAJYX
4so+p0aejefqQnwcFbQE0+dFjrEuD+Dl8PVzlDSMygz/y1xpSlxVz+83kQFH+MV6
1bxrOJNS6sLwvqtwRa8INjqvMfk443Ub5sFUS+bav0ZUlOg3BmitkEP0H0NlQ+5p
CAMCXFSfb/1UDXMrMHAcZn3LZtDLNaVVkneCz97A72D5C6Ae4rL3/FeHvmDk1KUh
StO3ReF4JXeN3FYTzWpMIw07jGxR9ZuFVn78DAW9Gwjk658wsXBqcGPgg/GAsy6R
bvrFRkWiJGSSdUeipNwxjfTeM8NwkA7fv+DnLbp6HzpOLDKIC8pID1Eoh1nwTlas
R073SeoNHO0sC6Lz+2NcvVMb
=1jNx
-----END PGP SIGNATURE-----
Merge tag 'for-7.2-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux
Pull btrfs fixes from David Sterba:
"I'm catching up with the fix backlog in the development branch, so
here's a number of them and will probably send one more for this or
the next rc:
- relocation fixes:
- skip attempting compression on reloc inodes
- exclude inline extents from file extent offset checks
- fix minor memory leak after error when adding reloc root
- fix root cleanup after inserting and merging
- fix clearing folio tags after writeback
- clear logging flag of extent map before splitting
- fix unsigned 32/64 type conversions when accounting dirty metadata,
leading to continually exceeding threshold
- fix regression in 32bit compat ioctl for subvolume info
- fix type of SEARCH_TREE ioctl buffer in UAPI header
- fix expression in ASSERT expression which can be unconditionally
evaluated on some compilers
- only account delalloc bytes for regular inodes"
* tag 'for-7.2-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
btrfs: fix GET_SUBVOL_INFO after compat refactor
btrfs: free mapping node on duplicate reloc root insert
btrfs: fix a regression where PAGECACHE_TAG_DIRTY is never cleared
btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps
btrfs: fix u32 to s64 type conversion in dirty_metadata_bytes accounting
btrfs: fix NULL pointer deref during assertion in btrfs_backref_free_node()
btrfs: only account delalloc bytes for regular file inodes in btrfs_getattr()
btrfs: reject inline file extents item in get_new_location()
btrfs: do not try compression for data reloc inodes
btrfs: declare btrfs_ioctl_search_args_v2::buf as __u8
btrfs: fix reloc root cleanup in merge_reloc_roots()
btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol()
|
||
Paolo Bonzini
|
e61e6fd4f1 |
KVM/riscv fixes for 7.2, take #1
- Avoid redundant page-table allocations in ioremap pcache topup - Apply SBI FWFT LOCK flag only on successful set - Bound SBI PMU counter mask scan to BITS_PER_LONG - Skip TLB flush when G-stage PTE becomes valid with Svvptc - Zicbo[m|z|p] block sizes should be always present in ONE_REG - Inject instruction access fault on unmapped guest fetch - Serialize virtual interrupt pending state updates using raw spinlock - Fix Spectre-v1 in vector register access via ONE_REG -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEZdn75s5e6LHDQ+f/rUjsVaLHLAcFAmpbMVwACgkQrUjsVaLH LAdENhAAi5eWE2WACOp50yy+e9/K/n7WFyGsnAg1u157HR0ywBIfOKA9Q3fGnHs/ WUeqXjtjnVLJFB/LfG3aF9O4PLyU+iZ2g7On5O4ZXQMY2wpueHBZ2fyvUFmrWKl6 JwwgluMxeX1IIhJdhSe0hUU8sxcurYtmuxMKO/2lkYcqxfn6UGpBHONkNGVBncsJ RcaU2lQBnv+8hJ0wlCb0hep9R34YkjF1rmti71tru7XqnF3rq2Z5PBITjfBHXmeB 6iYvVnpSvPiEvxF8454dvQ9bbXmh3OS+ncI/qjS1u2fkrQrM00eZs2bKzUpW7LlG 7ZA5Rm+EQPbHoPV1EKHXXip7uSZ7U8nm9CxMCADI7zZi1K3qvKnnRtA4MahLxO2o WSxWEW7ONHskZWz1YZUyqpPCutJQOtKaIu7ITzS0aHep9UB/3Lrs1sA9hRTEINUl 9O1Nusro+wdlG1SsycWXPNoyHvEnN1h2FjWLRpr54X9mEQtCCg0/qNvwo6CPZNwH E9lWgx7rcFnmy24ln01fHOtTD5IKRNis2MUswqNVyc3X7gOft+w8/1QE/MHYC9cl LF7b12xCOFp1PMkicgVYwWRQ+6qrvidFvWOWqVtcRmfMw6TjXIrB5Fr/MYg8gBL/ N6uzyk3+UmSiFehbElXww3YEiqd81KzKgeEsU74/T2yyAEflVYA= =jcT0 -----END PGP SIGNATURE----- Merge tag 'kvm-riscv-fixes-7.2-1' of https://github.com/kvm-riscv/linux into HEAD KVM/riscv fixes for 7.2, take #1 - Avoid redundant page-table allocations in ioremap pcache topup - Apply SBI FWFT LOCK flag only on successful set - Bound SBI PMU counter mask scan to BITS_PER_LONG - Skip TLB flush when G-stage PTE becomes valid with Svvptc - Zicbo[m|z|p] block sizes should be always present in ONE_REG - Inject instruction access fault on unmapped guest fetch - Serialize virtual interrupt pending state updates using raw spinlock - Fix Spectre-v1 in vector register access via ONE_REG |
||
Venkatesh Srinivas
|
e800decd9c |
KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN
On Intel platforms with a VMX preemption timer and APICv, if a VMM
calls KVM_GET_LAPIC before KVM_GET_MSRS to save the vCPU state, it is
possible to lose a pending timer interrupt.
If the thread running these ioctls is migrated to another core after
calling KVM_GET_LAPIC but before KVM_GET_MSRS and the guest is using
their LAPIC timer in TSC-deadline mode, not only does the save LAPIC
state not carry the pending interrupt, the TSCDEADLINE MSR will be
zeroed.
After migration across CPUs, KVM_GET_MSRS calls vcpu_load, posting the
interrupt and clearing the MSR:
vcpu_load() ->
kvm_arch_vcpu_load() ->
kvm_lapic_restart_hv_timer() ->
start_hv_timer() ->
apic_timer_expired() ->
kvm_apic_inject_pending_timer_irqs()
. post interrupt into the LAPIC state
. clear IA32_TSCDEADLINE
The saved LAPIC state will be missing the pending interrupt and the saved
MSR will be zero. Oops.
Fix by only posting an interrupt when we're attempting to enter the guest
(vcpu->wants_to_run == true), not for vcpu_load from other paths.
Assisted-by: gemini:gemini-3.1-pro-preview
Debugged-by: David Matlack <dmatlack@google.com>
Debugged-by: Sean Christopherson <seanjc@google.com>
Debugged-by: Jim Mattson <jmattson@google.com>
Debugged-by: James Houghton <jthoughton@google.com>
Signed-off-by: Venkatesh Srinivas <venkateshs@chromium.org>
Message-ID: <20260715234234.15382-2-venkateshs@chromium.org>
Reviewed-by: James Houghton <jthoughton@google.com>
Reviewed-by: Chao Gao <chao.gao@intel.com>
Cc: stable@vger.kernel.org
Fixes:
|
||
David Woodhouse
|
f148dd411d |
KVM: selftests: sev_init2_tests: Derive SEV availability from KVM
The test asserted that the X86_FEATURE_SEV CPUID bit exactly matches whether KVM offers KVM_X86_SEV_VM. That is not an invariant: when all SEV ASIDs are assigned to SEV-SNP, KVM does not offer the SEV VM type even though CPUID reports SEV, so the test aborts on an SNP-only host. Derive SEV availability from KVM_CAP_VM_TYPES (as already done for SEV-ES and SNP), assert only the one-way implication that a type offered by KVM is also reported in CPUID, and TEST_REQUIRE() the SEV VM type so the test skips cleanly when it is unavailable. Reviewed-by: Tycho Andersen (AMD) <tycho@kernel.org> Signed-off-by: David Woodhouse <dwmw@amazon.co.uk> Message-ID: <5d3c345113748f39b7982e365d241abaf3e11086.1784545391.git.dwmw@amazon.co.uk> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> |
||
|
David Woodhouse
|
cd76ec58be |
KVM: selftests: sev_smoke_test: Only run VM types the host offers
sev_smoke_test ran the plain SEV subtest unconditionally, gated only on the X86_FEATURE_SEV CPUID bit, while gating SEV-ES and SNP on the KVM_CAP_VM_TYPES bits. CPUID reporting SEV does not mean KVM offers the SEV VM type: when all SEV ASIDs are assigned to SEV-SNP, KVM_X86_SEV_VM is unavailable even though X86_FEATURE_SEV is set. On such a host the test aborts in KVM_CREATE_VM instead of exercising the available modes. Gate the SEV subtest on KVM_CAP_VM_TYPES like the others, so the test runs the VM types the host actually offers. Reviewed-by: Tycho Andersen (AMD) <tycho@kernel.org> Signed-off-by: David Woodhouse <dwmw@amazon.co.uk> Message-ID: <2b5e7a83d277134294199a455469bb436196b902.1784545391.git.dwmw@amazon.co.uk> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> |
||
Phil Rosenthal
|
52f2f7c301 |
KVM: x86/mmu: Fix use-after-free on vendor module reload
mmu_destroy_caches() destroys pte_list_desc_cache and
mmu_page_header_cache, but leaves both pointers unchanged. The pointers
live in kvm.ko, and therefore survive when a vendor module is unloaded
while kvm.ko remains loaded.
If creation of pte_list_desc_cache fails during a subsequent vendor
module load, its assignment sets pte_list_desc_cache to NULL and the
error path calls mmu_destroy_caches(). mmu_page_header_cache still
points to the cache destroyed during the preceding vendor module
unload. Passing that stale pointer to kmem_cache_destroy() causes a
slab use-after-free.
Reproduce the issue on a v7.1.3 kernel with CONFIG_KASAN=y,
CONFIG_KASAN_GENERIC=y, CONFIG_KVM=m, and CONFIG_KVM_INTEL=m. A
one-shot test hook forces pte_list_desc_cache to NULL on the second
invocation of kvm_mmu_vendor_module_init():
1. Load kvm.ko and kvm-intel.ko, creating both caches.
2. Unload only kvm_intel, leaving kvm.ko loaded.
3. Reload kvm_intel and force initialization through the -ENOMEM path.
KASAN reports:
BUG: KASAN: slab-use-after-free in
kvm_mmu_vendor_module_init+0x5b/0x170 [kvm]
...
kmem_cache_destroy+0x21/0x1d0
kvm_mmu_vendor_module_init+0x5b/0x170 [kvm]
...
Allocated by task 16817:
__kmem_cache_create_args+0x12c/0x3b0
__kmem_cache_create.constprop.0+0xb6/0xf0 [kvm]
kvm_mmu_vendor_module_init+0x13b/0x170 [kvm]
...
Freed by task 16820:
kmem_cache_destroy+0x117/0x1d0
kvm_mmu_vendor_module_exit+0x21/0x30 [kvm]
Clear both pointers immediately after destroying their caches so that
the stored state reflects the caches' lifetime and repeated cleanup is
safe.
With the fix applied, the same injected vendor module reload fails with
-ENOMEM as expected and produces no KASAN report.
Fixes:
|
||
Hyunwoo Kim
|
7a2c70e777 |
KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots
kvm_mmu_zap_oldest_mmu_pages() excludes a shadow page whose root_count
is non-zero from top-level reclaim, because such a page cannot be
freed. The path in mmu_page_zap_pte() that recursively zaps a parentless
nested TDP child has no such check. As a result, a shadow page can
be zapped even if the page itself can't be freed; as the comment in
kvm_mmu_zap_oldest_mmu_pages() notes, zapping it will just force vCPUs
to rebuild the page.
As in top-level reclaim, do not recursively prepare zapping of a
nested TDP child whose root_count is non-zero.
Fixes:
|
||
Sean Christopherson
|
2abd5287f0 |
KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
Check for a "stale" page fault, i.e. for an invalid and/or obsolete root, after making MMU pages available for the shadow MMU. If reclaiming shadow pages zaps an in-use root, i.e. marks it invalid, then KVM will attempt to map memory into an invalid root. On its own, populating an invalid root is "fine", but because child shadow pages inherit their parent's role, any children created during the map/fetch will be created as invalid pages, thus violating KVM's invariant that invalid pages are never on the list of active MMU pages. Note, the underlying flaw has existed since KVM first started tracking invalid roots in 2008 (commit |
||
|
Hyunwoo Kim
|
622ebfac01 |
KVM: nVMX: Hide shadow VMCS right after VMCLEAR
free_nested() frees the shadow VMCS while vmcs01 still points to it. But
because it is asynchronous with respect to loaded_vmcs_clear(), the vCPU
might migrate before the pointer is cleared and __loaded_vmcs_clear()
may then execute VMCLEAR.
The VMCS needs to stay attached until its explicit VMCLEAR completes, but
then it can be hidden and the page safely freed.
Fixes:
|
||
Kailang Yang
|
9573818cc1 |
ALSA: hda/realtek - Add quirk for Dell Pro QC1255
Vendor want to add more machine on this workaround.
Fixes:
|
||
Masami Hiramatsu (Google)
|
f418d68d71 |
tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match()
eprobe_dyn_event_match() checks if the target event system in argv[0]
matches ep->event_system using strncmp(ep->event_system, argv[0], len).
However, if ep->event_system is longer than len (e.g. "eprobes" vs
"ep/event"), strncmp() still returns 0 because the first len characters
match.
Check that ep->event_system[len] is '\0' to ensure exact system name
matching.
Link: https://lore.kernel.org/all/178454235856.290363.14872590900774231133.stgit@devnote2/
Fixes:
|
||
|
Masami Hiramatsu (Google)
|
8ce20bfba4 |
tracing/probes: Fix potential underflow in LEN_OR_ZERO macro
In __set_print_fmt(), LEN_OR_ZERO is defined as (len ? len - pos : 0).
If len is non-zero but smaller than pos, len - pos evaluates to a negative
integer. When passed as a size argument to snprintf(), this negative value
is cast to a large unsigned size_t, bypassing buffer size limits.
Ensure len > pos before subtracting to avoid integer underflow.
Link: https://lore.kernel.org/all/178454234934.290363.15247317871499514139.stgit@devnote2/
Fixes:
|
||
|
Masami Hiramatsu (Google)
|
a9d6fb2840 |
tracing/probes: Prevent out-of-bounds write in __trace_probe_log_err()
If trace_probe_log.argc is 0 in __trace_probe_log_err(), the loop
constructing the command string will not execute and p will remain equal to
command. Writing to *(p - 1) will cause an out-of-bounds access before
command. This should not happen, but better to be treated.
Reject if trace_probe_log.argc is 0.
Link: https://lore.kernel.org/all/178454233992.290363.18323091580600697731.stgit@devnote2/
Fixes:
|
||
|
Masami Hiramatsu (Google)
|
15f197856d |
tracing/probes: Avoid temporary buffer truncation in trace_probe_match_command_args()
In trace_probe_match_command_args(), a stack buffer buf[MAX_ARGSTR_LEN + 1]
(256 bytes) is used to format "<name>=<comm>". However, since name can
be up to 32 bytes (MAX_ARG_NAME_LEN) and comm up to 255 bytes
(MAX_ARGSTR_LEN), the formatted string can exceed 256 bytes and get
truncated by snprintf(), causing spurious argument matching failures.
Instead of formatting into a temporary buffer on stack, compare the
argument name, the '=' delimiter, and the comm expression directly.
Link: https://lore.kernel.org/all/178454233010.290363.10428767141343428804.stgit@devnote2/
Fixes:
|
||
|
Linus Torvalds
|
b95f03f04d |
12 hotfixes. 8 are cc:stable and the remainder address post-7.1 issues or
aren't considered appropriate for backporting. 10 are for MM. All are singletons - please see the relevant changelogs for details. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCal5rBQAKCRDdBJ7gKXxA jtgtAQCuWNUTCR7u+MzAuO3Nh46DxHXeb27OTHZL8JcazQTEQgD+NZfwqVYnNNX/ 4CVqqZvrXJQDg0aiWtIP4VdLirNh/Ac= =Gslp -----END PGP SIGNATURE----- Merge tag 'mm-hotfixes-stable-2026-07-20-11-37' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "12 hotfixes. 8 are cc:stable and the remainder address post-7.1 issues or aren't considered appropriate for backporting. 10 are for MM. All are singletons - please see the relevant changelogs for details" * tag 'mm-hotfixes-stable-2026-07-20-11-37' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm/memory-failure: trace: change memory_failure_event to ras subsystem mm: page_reporting: allow driver to set batch capacity mm/kmemleak: fix checksum computation for per-cpu objects mm/damon/core: disallow overlapping input ranges for damon_set_regions() MAINTAINERS: add Usama as a THP reviewer fat: avoid stack overflow warning mm/damon/core: validate ranges in damon_set_regions() m68k: avoid -Wunused-but-set-parameter in clear_user_page() mm/huge_memory: set PG_has_hwpoisoned only after new folio head is established mm/page_vma_mapped: fix device-private PMD handling MAINTAINERS: s/SeongJae/SJ/ userfaultfd: prevent registration of special VMAs |
||
|
Linus Torvalds
|
abc69ae5d2 |
This push contains the following changes:
- Fix potential crash in rhashtable walk. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEn51F/lCuNhUwmDeSxycdCkmxi6cFAmpdcJUACgkQxycdCkmx i6er4RAApk4CnipPZbwH43IpbOaXpt0eypastuIf8gzZ6HRfcSEClHx+YA7+hjEb tsYXaZJbudZIYIOQHN9ad1MdsoRH7mkj0eLaIXmz4sWD8ilV/R9sFx1tFVNOWPN1 siTLTdsCtkhUqdRnupf9XhFXNijaJtT1OMHeWKWHIPgu1GZbD9Uhb6t+/Navw3TY 3fcdUiIpqsba9FDdo53DBnL7U84c6/ptFuBHKEXWfu0MKJ0hLD6dJwijn9xb9NS8 nNBgZMZ7Y4QI/SRHOTD1bpnI4DE6m2juEqUxgVy9WxwKPWyxFUZFXfsoNQg8aJya yYqopxnzZF7kSNMMKcU6VFAgMCWFVPaMi7Zmh7Z9sSQy+Vt/6Gv3DbMEbUwr1LHY dTwyFTgo0Ef3acJdcx73JjvV28ubfALopvPRxs3QC6+unMBRxzcCmBwbgtjYd6RZ rDEDZwQ/3xhO3gVBIy4p8VcHx4wiPuGslcgSJufWeYTrBejcqFkhd5zqOUMd7nbB zbCo09kDRtxJB8SC1YZ7naUHaCJP/hwSvnZhjxphlI+qPqBe1hmBTp47+qTMpX3u nZLtMQMcB0NMWgRMY++V2/QQUYRkYVhYhPdaYJhAu7I2TUaHXtRgVKGTCfV+2iZD +OjbU8dVRpPg+kUtBJz/C6EipvwImRTcQ5kmeLfbwq5pwEe2OpE= =Q1uC -----END PGP SIGNATURE----- Merge tag 'v7.2-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fix from Herbert Xu: - Fix potential crash in rhashtable walk * tag 'v7.2-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: rhashtable: clear stale iter->p on table restart |
||
Philipp Oster
|
b6016332b8 |
ALSA: hda/tas2781: clear cali_data.total_sz when calibration read fails
tas2563_save_calibration() assigns cali_data.total_sz before it reads the per-device calibration data from EFI, but its error paths return without clearing it again. cali_data.cali_reg_array is left all zero, because the function returns before the register addresses are assigned. On the first playback tasdev_load_calibrated_data() does if (!data || !cali_data->total_sz) return; which passes, since total_sz is still non-zero. It then issues five 4-byte bulk writes to p->r0_reg, p->r0_low_reg, p->invr0_reg, p->pow_reg and p->tlimit_reg, all of which are 0. Register 0 decodes to book 0 / page 0 / register 0x00, so the auto-incrementing block write zeroes registers 0x00 to 0x03. Register 0x03 is PB_CFG1, which holds AMP_LEVEL, so the amplifier gain is set to its minimum and the speaker stays silent. This is reproducible on a Lenovo Yoga 7 14ARB7 (two TAS2563 on I2C, ACPI INT8866) whose factory calibration was never written to UEFI, so the EFI read fails with EFI_NOT_FOUND. The two woofers driven by the amplifiers are silent while the tweeters driven directly by the ALC287 play. Reading the amplifier registers over i2c shows PWR_CTL = 0x00 (active) and the TDM slots correctly programmed by the RCA profile, but PB_CFG1 = 0x00. With this change PB_CFG1 keeps its power-on default of 0x20 and both woofers play. tas2781_save_calibration() in tas2781_hda.c already clears total_sz on failure; do the same for the TAS2563 variant. Signed-off-by: Philipp Oster <philippdev5396@outlook.de> Link: https://patch.msgid.link/20260720-tas2781-calfix-v1-1-3a5fa6ad90bc@outlook.de Signed-off-by: Takashi Iwai <tiwai@suse.de> |
||
Zhang Heng
|
740b3c6780 |
ALSA: hda/realtek: Add HDA_CODEC_QUIRK for Samsung 750XBE/730XBE
Add a codec SSID quirk for Samsung ELECTRONICS 750XBE/730XBE using HDA_CODEC_QUIRK() instead of SND_PCI_QUIRK(), because the alsa-info report from this device does not expose a PCI subsystem ID, only the HDA codec subsystem ID (0x144d:0xc824) is available. This applies ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET to fix sound being very low and distorted on the headphone jack of this system. Reported-by: Caio Ramos <caioramos97@gmail.com> Link: https://bugzilla.kernel.org/show_bug.cgi?id=208663 Signed-off-by: Zhang Heng <zhangheng@kylinos.cn> Link: https://patch.msgid.link/20260720123702.799474-1-zhangheng@kylinos.cn Signed-off-by: Takashi Iwai <tiwai@suse.de> |
||
Nikita Maksimov
|
5c3f8dac53 |
ALSA: hda/realtek: Fix speakers on Lunnen Ground 14
The firmware on the Lunnen Ground 14 marks pin 0x1b as unused even though the internal speakers are connected to it. As a result, the speakers are not detected. Add a pin configuration quirk for PCI subsystem ID 2782:a212 to configure pin 0x1b as an internal speaker. The pin configuration was tested on a Lunnen Ground 14 (DMI product LL4FA) with an ALC269VC codec. The internal speakers and microphone work as expected. Cc: stable@vger.kernel.org Signed-off-by: Nikita Maksimov <nickstogramm@yandex.ru> Link: https://patch.msgid.link/20260720180214.73770-1-nickstogramm@yandex.ru Signed-off-by: Takashi Iwai <tiwai@suse.de> |
||
Pengpeng Hou
|
70e76e700f |
hwmon: occ: validate poll response sensor blocks
The OCC poll response parser walks a counted list of sensor data blocks.
It used the static backing-array capacity as the parse boundary, but a
transport response makes only data_length bytes current and valid. A
truncated response can therefore make the parser consume a block header or
block extent outside the current response.
Use data_length as the parent boundary, prove the fixed poll header and
each current block header before reading them, and prove the complete block
before advancing. Keep parsed sensor metadata local until the complete
response has passed validation, then publish it. Propagate
malformed-response errors before publishing the OCC as active.
Fixes:
|
||
Norbert Szetei
|
bdefe1346a |
ALSA: timer: drain a slave's callback before its master detaches it
snd_timer_close_locked() drains the closing instance's own in-flight
callback (IFLG_CALLBACK) before freeing it, but not its slaves'. When a
master instance is closed, remove_slave_links() clears each slave's
->timer; the slave's own close then reads timer == NULL and takes the
branch that skips the drain entirely (snd_timer_stop_slave() also no-ops
on a NULL timer). So a slave whose callback is still running when the
master is closed is freed underneath the live callback, leading to
use-after-free.
Drain the slaves too before remove_slave_links() severs them.
snd_timer_stop() has already taken this instance off the active list, so
no new slave callback can be queued. Take the slaves off the ack list so
a pending one can't fire either, then wait for any that is already in
flight.
Fixes:
|
||
|
Norbert Szetei
|
70d28bfcd6 |
ALSA: timer: don't re-enter an instance callback that is still running
The userspace-driven timer (utimer) TRIGGER ioctl calls
snd_timer_interrupt() directly with no serialization, so two threads
triggering the same utimer can run snd_timer_interrupt() on one
snd_timer concurrently.
snd_timer_process_callbacks() drops timer->lock around each instance
callback and marks the in-flight callback with the single
SNDRV_TIMER_IFLG_CALLBACK bit; snd_timer_close_locked() waits on that
bit to drain an in-flight callback before freeing the instance. The bit
cannot represent two concurrent callbacks: when a second interrupt
re-queues an instance whose callback is still running, both run at once,
the first to finish clears the bit, and the close-path drain then frees
the instance (and its callback_data) while the other callback is still
live - a use-after-free reachable by any user able to open
/dev/snd/timer, both via a user timer instance and via a sequencer queue
timer bound to the utimer.
snd_timer_interrupt() sets IFLG_CALLBACK before dropping timer->lock, so
a concurrent interrupt already observes it under the lock. Skip
re-queuing an instance (and its slaves) to the ack/sack list while its
callback is in flight; the accumulated pticks are delivered on the next
tick, so no event is lost.
Fixes:
|
||
|
Linus Torvalds
|
1590cf0329 | Linux 7.2-rc4 v7.2-rc4 | ||
|
Linus Torvalds
|
82a47586c0 |
RISC-V updates for v7.2-rc4
- Call flush_cache_vmap() after populating new vmemmap pages, on all architectures. This avoids spurious faults on RISC-V microarchitectures that cache PTEs marked as non-present - Disable LTO for the vDSO to prevent the compiler from eliding functions that are used, but which don't appear to be - Fix an issue with libgcc's unwinder and signal handlers by dropping an unnecessary CFI landing pad instruction in __vdso_rt_sigreturn (similar to what was done on ARM64) - Avoid reading uninitialized memory under certain conditions in hwprobe_get_cpus() - Save some memory and I$ when CONFIG_DYNAMIC_FTRACE=n by avoiding our four-byte function alignment requirement in that case - Avoid clang warnings about null-pointer arithmetic in the I/O-port accessor macros (inb, outb, etc.) by ifdeffing them out when !CONFIG_HAS_IOPORT - Make the build of the lazy TLB flushing code in the vmalloc path depend on CONFIG_64BIT and CONFIG_MMU (since those platforms are the only ones that use it) -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEElRDoIDdEz9/svf2Kx4+xDQu9KksFAmpc+vAACgkQx4+xDQu9 KksZqw//fbTxRO0sOhv5h+UvJNfsKg43AZWpYVr6bGvtur3d5DUBBiIY+KOroT1Y G3l9UvzFV6NIdvHNt3OOy9lIC25Oy0EC5MoCjToRSTOTH+EjsMgdZPMFOZh8VBkT qnn1ehvtJSIYRmX+Xk6gPk8BQLxVbFkRedXUd24vMCSYwlt9MxqWeJjLlktm1slj IjBWZRi5AOLGn4pVEztgMaGauxF5OObq2Cq5WjE2U1Pz/nvbAUMSBBNkJU739WOp KK+Hr2HqcoOHbgDcElYsQEY+WMKUgn7cdv/tCLBLAIzGrthFkm/4FkIP327qkKyu HDc3ef5VpPLY1MoS7hMFS5+HWJ4POEKaGEDf85HRIycr4mTsUUac4NtEoSvONhrP x4jCRlu/PTWoX3n0RWR5ed5iWtk2tWCcQcaUCUYdJWPLHyJLq25TmQpvCbtfmHtI 1NySg0i4zL8tHJzCklJfwn8CyGfL1Gt627aQUHsJtMA6xeY73+zpxuOKrJElK/z7 4vHykuTlkBjnpVX+a4QImUOYQ6cJ+Km6jkwhvJAaKYXzCs4JFqolCSEg1q/eBGBk ay9igMkpw+hy2o0OM9TdkEMPaDOsVO6XATjmoVfoyGqvMsZ4sFFHV1fiHqdE5FUE uoQrbuJ6R729nEWEOoRdw9lGjOI+Hmv+bVKDLwpynSIfbw7TNIY= =gKi/ -----END PGP SIGNATURE----- Merge tag 'riscv-for-linus-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: - Call flush_cache_vmap() after populating new vmemmap pages, on all architectures. This avoids spurious faults on RISC-V microarchitectures that cache PTEs marked as non-present - Disable LTO for the vDSO to prevent the compiler from eliding functions that are used, but which don't appear to be - Fix an issue with libgcc's unwinder and signal handlers by dropping an unnecessary CFI landing pad instruction in __vdso_rt_sigreturn (similar to what was done on ARM64) - Avoid reading uninitialized memory under certain conditions in hwprobe_get_cpus() - Save some memory and I$ when CONFIG_DYNAMIC_FTRACE=n by avoiding our four-byte function alignment requirement in that case - Avoid clang warnings about null-pointer arithmetic in the I/O-port accessor macros (inb, outb, etc.) by ifdeffing them out when !CONFIG_HAS_IOPORT - Make the build of the lazy TLB flushing code in the vmalloc path depend on CONFIG_64BIT and CONFIG_MMU (since those platforms are the only ones that use it) * tag 'riscv-for-linus-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: hwprobe: Avoid uninitialized read in hwprobe_get_cpus() arch/riscv: vdso: remove CFI landing pad from rt_sigreturn riscv: vdso: Do not use LTO for the vDSO riscv: io: avoid null-pointer arithmetic in PIO helpers riscv: Gate FUNCTION_ALIGNMENT_4B on DYNAMIC_FTRACE mm/sparse-vmemmap: flush_cache_vmap() after hotplugging vmemmap riscv: mm: Make mark_new_valid_map() stuff depend on 64BIT && MMU |
||
Daniel C. Ribeiro
|
f6d6a4147a |
ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless
JBL Quantum650 Wireless (0ecb:2125) requires the same workaround that was used for JBL Quantum610 and Quantum810 for limiting the sample rate. Without it, the capture (microphone) stream fails to work. Setting the QUIRK_FLAG_FIXED_RATE flag, as done for the sibling models, makes both playback and capture work correctly. Signed-off-by: Daniel C. Ribeiro <dcoutinho.96@gmail.com> Link: https://patch.msgid.link/20260719090037.40149-1-dcoutinho.96@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de> |
||
|
Linus Torvalds
|
980ab36ae5 |
block-7.2-20260717
-----BEGIN PGP SIGNATURE----- iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmpbBc8QHGF4Ym9lQGtl cm5lbC5kawAKCRD301j7KXHgpibUD/9SCYq0YZSH4fgwv6PwouAdw2/0TogbCf2E OZ+oq76WYeG8Q95iFXLdjv72EkNi+m1cHesn89lhvZkHWu9TAKAeCoXcnfsLIpmp 60e6Dnz7GCTRsv2L9nBEEmsyQdYGVbbMes8hSpBXbcO1jczbr8x9nzBzkfR4XL3z /Vqy1CK9lA0z1+0sVkUrjKt9li7BGodpUPiNdhMReu8nuwuy1mHJ585+Y6pkwHav 1TmaSiQ+NQxSLmyOwG1rzmzWCDdeszAa56exJ6L/T16RJ6rNTPcz2TCjsBcmuupo UytqdUhKaqxlikfrdus0Cnjsn8ivTiXFfYnvNTAWThRuIq+ePC4nzWzuncJTeVdE MIzfND6sTmfOG6Vchrx0CN92nv5gsOprxbLjbM28VSb5Xpad5PYMMGpdkBranI/9 zUkJi0fiJOp0i/uvpltdPqcgvPKBHBhLyi5GPVb+fjLJW2Gm1s1xcBfpKIj+2+S5 A3F2ac626DhcGrKQcZPl71RwAeEWRzP3Zr93Eg1oEQd9uqRz1jH2K8DCGh0fd9mP FppUw/p4GbBnc8QVraIfAIssg12eFU2ZIHvWuTiB/1UnzMuS3gJ8pwEy0s/9ObUJ +8vCI1fZDmbXN7T31rTl/X4npL0AfXtTbG61KcWqvbAhyVmmKNoNPHFj4SA3G0wF p5Y7qj2Jmg== =qHz/ -----END PGP SIGNATURE----- Merge tag 'block-7.2-20260717' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - Fixes for the dio bounce buffer helpers: correct the alignment of bounced dio read bios to avoid a double unpin, handle huge zero folios in bio_free_folios(), and don't warn on the larger-order folio attempts in the greedy allocation path. - Try a slab allocation in bio_alloc_bioset() before falling back to the mempool, restoring the previous behavior for non-sleeping allocations from a cache-enabled bioset. - Serialize elevator changes for the same queue using the writer lock. - Fix a race in blk_time_get_ns() where a task preempted between setting PF_BLOCK_TS and the cached-timestamp reload could return 0. - blk-cgroup fix for leaks and the online flag on a radix_tree_insert() failure in blkg_create(). - Free the copied pages when blk_rq_map_kern() fails after blk_rq_append_bio() rejects the bio. - Remove manually added partitions on loop device detach, fixing dead partition devices left behind and a subsequent LOOP_CONFIGURE -EBUSY - Bound the AIX partition lvd scan to the sector that was actually read. - Show the block operation in error injection rules (Jackie) * tag 'block-7.2-20260717' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: block: fix aligning of bounced dio read bios block: handle huge zero folios in bio_free_folios block: try slab allocation in bio_alloc_bioset() before mempool block: show operation in error injection rules block: serialize elevator changes for the same queue using a writer lock block: free copied pages when blk_rq_map_kern() fails block: do not warn when doing greedy allocation in folio_alloc_greedy() partitions: aix: bound the lvd scan to one sector blk-cgroup: fix leaks and online flag on radix_tree_insert failure loop: remove manually added partitions on detach block: fix race in blk_time_get_ns() returning 0 |
||
|
Linus Torvalds
|
a2b81de43c |
io_uring-7.2-20260717
-----BEGIN PGP SIGNATURE----- iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmpbBbsQHGF4Ym9lQGtl cm5lbC5kawAKCRD301j7KXHgpgpFD/9NnN5A9eMm+4ZeC41yeynykN1QOl5wCqoT zi7CIizuwtsCQAjgpFUahMosvkLg3P77S/MJxqzlGVPhaSvp/QISxr7oH9WqyoYf jEfi3Dx8XfdxK+5GG0dC7s4iiWuxZha7iGt4W2DZmjXWWu0ofCKB0FTVK7J/AkC0 7DA4hMmts643cE9pwmD1Bbuj7SYmqjneDhgwe/JaSuCiuuclN5L359E1rnxzc+dS 9McCmwPjwF0f+Vs9IWyHb1KNMBBmC2T0n2zvzKoJKL72mQ0v3IaOlGkUEDgp7EpT TIK5rEKPl/Wpw970BOlzdYgD01vDiWeLuQQQlGfAaLheUUImLoFPo1rf/q8nCgFN CVEWDSZZWRnwH6FjFCa5JwOS0B9YcamYzhkTck1O+g7KcNB6ZCU1zMX8+pCMEVgr Ju5J2uoazT2txEZEgCSSUYLuRRSpz5P5s/VmFEXNxeRAhndlGhyNq16kVnRqyLfA OzVS5uYeqSOlOYbY8pL4QkGaxBUr0CSBOnhCT7q9d8KYXnh9CHReFQcy9wPclSfd D+F5v4CPqWN0tg2rrYBgo3Zpt4Mwb1JEiyOAaIapAKQT2T9tNtp1fubq4PA9c1ub VkSRutPGeUWNC1fEjs67I9V3V0bzbR8j+AMC9AAFFqaqpn2B5NGHqvlcYdaNuuje Dr7yXvROWw== =Ue52 -----END PGP SIGNATURE----- Merge tag 'io_uring-7.2-20260717' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Fix a use-after-free in the bpf-ops struct_ops path, where the same io_uring_bpf_ops map could be registered more than once. - Fix the deferred iovec free for the provided-buffer grow path, which could leave the caller with a dangling iovec and result in repeated frees. Follow-up to the earlier fix in this series. - Zero-check the unused addr3/pad2 SQE fields for unlinkat * tag 'io_uring-7.2-20260717' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/bpf-ops: reject re-registration of an already-bound ops io_uring/fs: check unused sqe fields for unlinkat io_uring/kbuf: free the replaced iovec after a successful grow |
||
|
Linus Torvalds
|
8b752c8501 |
spi: Fixes for v7.2
A couple of fairly routine driver fixes, nothing too remarkable. -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmpcxP4ACgkQJNaLcl1U h9Cnigf9FRw9pWxDNEhhABYvy7A9kcSTYWDoYEoljdsvYzGCWpbkS9VCmiSOcxlA WYrVkrknUrjnd2twMyqWSs3MGePcncEchlOKOqTF8bA12dKSiRgFlldZ5MoRgYrf GAbFzlu0Z3wZgGK2n8NwHwQ4ut0LcM4PYYKqQ+nABbURmfCA+oCnbE2QhCdRxHUB MtHiA1fzoBnnCHsDkRnI5MTbkKWA2r2nqzQY7pzojtwrR4xghm1MUO16gD5V8VM9 w5ndpdLIer3FtHpwy1OqtuvXnZJEu8xWqQ/uAv+HfdHsRvckPB6hKt6GkSKVdut/ R4e8ZbIuSfEwcwy8VC4fRQjVw5BNVQ== =b2Lc -----END PGP SIGNATURE----- Merge tag 'spi-fix-v7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A couple of fairly routine driver fixes, nothing too remarkable" * tag 'spi-fix-v7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: cadence-quadspi: Fix indirect write timeout when DMA read mode is enabled spi: dw-dma: Wait for controller idle before completing Tx |
||
|
Linus Torvalds
|
6eb9466f75 |
regulator: Fix for v7.3
One straightforward driver fix for some incorrectly described bitfields in the ltc3676 driver. -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmpcxWoACgkQJNaLcl1U h9Bj2Af+J+ibj5u+dpsT9GdFRkV3dkZtR7wAShFlbVYRI0dtEvrvAOFQ+/dh8whX vRs8qvn8JtpXepUs2DsZlvB70CEdK5yYIuAQBJAj1QpolWLd069q0TK3fHAdqD6R 61KCpuhbQ8JTCYzL/BCmKhYTqr9A9vhC0hn6cFflqT3Ngunxvayal/pIiutC0S0W AT57CKul41+DUPJ7XhKlCuuo2ZUL6wiYKkecRp8+hsMWllUaN9Jg+gsPKZQXwL18 ykKOsfYqQR+qinUNRqZTvzJUlMZNJCOpeTZnrVx1gIRv03UpCFnLSCQlDDRWqHkZ CfDemVw6oZdyHY+0qNroKYENpbqWoA== =SYeH -----END PGP SIGNATURE----- Merge tag 'regulator-fix-v7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "One straightforward driver fix for some incorrectly described bitfields in the ltc3676 driver" * tag 'regulator-fix-v7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: ltc3676: Fix incorrect IRQSTAT bit offsets |
||
|
Linus Torvalds
|
502c9e9c59 |
Misc x86 fixes:
- Reject too long acpi_rsdp= boot parameter values
(Thorsten Blum)
- Validate console=uart8250 baud rate to fix early boot hang
(Thorsten Blum)
- Remove dead Makefile rule (Ethan Nelson-Moore)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmpcjhMRHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1gVUw//UmbQ3jby1pvjDfAeJeqI8x2iCY2F9N5l
AqPD3371RPNzyx5uqyz4dLY94M31JW4jqzxntbIhGJrm9aXPLRTVzfMjF6sd9Lmj
lkMyHW+a4DVtA7oVSk2INebGUX2t+cpGLcF+9/yH3QavpLIXL9BNz5vDYqS0POMc
EitNNNqmO4+/f6oLf7Xxfl8Z2z2cVhcPCj1EG8b/rOWKeFmw1teuVu+dSagnV7Cn
/Hi4S8Q5HYUvvFBIFxgtuPW5S8HlTINhaE8hiat+Z0BENlAnbNThGEpz7hdogXAq
VDFwGPsjg3AF2agTWnF3e7Vs2CdDLHgcdTxUGII2lhZ9wCXzQ72+qXajf9PPynzH
YV9xtPw0a4sTDcR4QtdgBneCLf320WmbV6aH+tm9aZ1LIcPUgBO0qxYI/Ff1Frm8
NI1LxZJMiVfNNpFBk4JW/V1QKo3Padjhzfc23Rb4/8Xpu+S+Cu31pligIH3Rtnhm
pNt6Bv8eV61QJMZvjy4+5MouFfK2rL3YyEiE/WMP5cRhOCaK10hgDDEqCbuL5IRV
AgYMqGQPLTbZbdZZ1oSub+OPIRidMDfITlLoR9ggcJgNrV5J4tGysgAJWU2fCDoR
5dvRlzeQ0cjmCVMC+FVjQAahjBX5KqAQolDuDGB/vAAvxiir711ZO7g9UTCCRWQg
Bq1slSZ0WEc=
=upW0
-----END PGP SIGNATURE-----
Merge tag 'x86-urgent-2026-07-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fixes from Ingo Molnar:
- Reject too long acpi_rsdp= boot parameter values (Thorsten Blum)
- Validate console=uart8250 baud rate to fix early boot hang (Thorsten
Blum)
- Remove dead Makefile rule (Ethan Nelson-Moore)
* tag 'x86-urgent-2026-07-19' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/boot: Validate console=uart8250 baud rate to fix early boot hang
x86/boot: Reject too long acpi_rsdp= values
x86/cpu: Remove Makefile rule for removed UMC CPU support
|
||
Eugene Shalygin
|
9813c1f49e |
hwmon: (asus-ec-sensors) add missed handle for ENOMEM
Add missing return value check in the setup function.
Fixes:
|
||
|
Eugene Shalygin
|
60710b2af1 |
hwmon: (asus-ec-sensors) fix EC read intervals
Take INITIAL_JIFFIES into account when setting up next update time.
Fixes:
|
||
|
Eugene Shalygin
|
e741d13cc2 |
hwmon: (asus-ec-sensors) fix looping over banks while reading from EC
Do not assume there are only bank 0 and bank 1 available, just use '!='
for bank comparison.
Fixes:
|
||
Alexis Czezar Torreno
|
af01dab0c3 |
hwmon: (pmbus/max34440) block unsupported VIN and IIN limit registers
MAX34451 and ADPM chips do not support standard PMBus VIN/IIN limit registers, manufacturer specific min/max registers, or undercurrent or undertemperature fault limits. STATUS_BYTE and STATUS_OTHER are also not available. Accessing these non-existent registers during driver initialization triggers a CML error and asserts ALERT. Handled by blocking these functions during read/write. Fixes: |
||
|
Linus Torvalds
|
c6859eed75 |
s390 updates for 7.2-rc4
- Fix checksum lib on machines without the vector facility where the non-vector fallback made csum_partial() calculate the checksum from address 0 instead of the provided buffer - Fix cpum_cf perf event initialization missing speculation barrier for user controlled event numbers used as generic event array indexes -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEE3QHqV+H2a8xAv27vjYWKoQLXFBgFAmpcDpgACgkQjYWKoQLX FBizogf/fOTDdmXPx2xp5PFadlaoVnRmycslrPDog+lVp2tl+RXlAU6mKT27gcXT 2G/PCF9SjYQSQdGztMNPCh6Az1cAo+XvhADtElumRAjlybTYlk++aallv5+buHRS Z2jEnurYVWQaQP/PpFDIUhh7Yf6ggrctXuRdYgyJv/5Siy4OQYQEpWQazQXyfOZI 506gQ2M4mD8dIJRgZygM7tQztR7K8IFDIUPzxMCiBKj9XQQBpZ0Q9SOm07nL6dtS MHcXbyd80XbvVoYNCZHquktJ4ZOvru+sA65Hd94TSHOQRDxuuiDueo6VYPPqBX5o /ENY4mFt0aD7m0lbTqMyxrUI2bDzLg== =WPyD -----END PGP SIGNATURE----- Merge tag 's390-7.2-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Vasily Gorbik: - Fix checksum lib on machines without the vector facility where the non-vector fallback made csum_partial() calculate the checksum from address 0 instead of the provided buffer - Fix cpum_cf perf event initialization missing speculation barrier for user controlled event numbers used as generic event array indexes * tag 's390-7.2-5' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() s390/checksum: Fix csum_partial() without vector facility |
||
|
Linus Torvalds
|
80c1c309d8 |
ARC fixes for 7.2
- Miscc fixes and config updates -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEOXpuCuR6hedrdLCJadfx3eKKwl4FAmpb+HcACgkQadfx3eKK wl5S0g/+NG3rQUMcGAzWLqsLq0HjdNAYrqj0uL0ha+HWkicBU1AzU7CrlPZygFuf S+Z5uTlcuUGhwpsFpyd/bixR+0wX9FoAUxdZdBXEuf8d0/GIr2kJsMLn5yMo+1GI IBo+P/B8l50CqzXrLQ8X7zzOp95/B3Y+3wYz/IjuGna5X4yksN8TjSnz6t25I20Q 90oiUx/XX+cPmV153KaEbbDreKH1d/vwdc5QNdxCbPqSlbtSaCMuMg8xtO73uCq6 2sazoX/iOf0l1wU3EbCk1H6mls3vh7ZrYfzUg6DcbvGVYANKvcl3H2FEOWVubQvh jIYyZGfyM+dIgz0ug/Y9IfhyinQi4Oi7qVf+SS6zIb74NV2fS6OvE1tiD2iGa1KQ 4OjybdJC8uZI7RRLJpd8JWsH9l3P/s1BVbybOgpDPurMKxfv3OBBAVq0wKYGpB4O 9Iah8C0wMHAG/aUzNi97KIUumMEn/0jT1ICRUmzGcM5Pl5rrzAsAdC5I9U3Vbdd2 BU8SyOqeqYyBukQDfVWiAypKJ3sWCXPoT0XA2ATbIWQBDkS7G1AU5Atbqic9TkDg mR+bOFErBT1aGrsfEInO+Ec5MFvyGO7S4o22gATLZC0XL3cm/ziL7RUxgNZRWUuk RdiAPe88qFwe0nPUGVY4TGNhEwK5xDBqo20uO0rxtJHGsryyRI0= =pOUa -----END PGP SIGNATURE----- Merge tag 'arc-7.2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc Pull ARC fixes from Vineet Gupta: - Misc fixes and config updates * tag 'arc-7.2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc: ARC: configs: Drop redundant I2C_DESIGNWARE_PLATFORM arc: validate DT CPU map strings before parsing them |
||
|
Linus Torvalds
|
f2ec6312bf |
SCSI fixes on 20260718
The biggest core change is the reliable wake fix for scsi_schedule_eh which is used by both libata and libsas which could otherwise cause error handler hangs due to rare races. All other fixes are in drivers (well except the export symbol removal) the next biggest being the target PR-OUT transportid parsing fix. Signed-off-by: James E.J. Bottomley <James.Bottomley@HansenPartnership.com> -----BEGIN PGP SIGNATURE----- iLgEABMIAGAWIQTnYEDbdso9F2cI+arnQslM7pishQUCalvAVRsUgAAAAAAEAA5t YW51MiwyLjUrMS4xMiwyLDImHGphbWVzLmJvdHRvbWxleUBoYW5zZW5wYXJ0bmVy c2hpcC5jb20ACgkQ50LJTO6YrIUI/QD+Kr/rBo60RkNJfsdC6vmHj0+pkkSpQNkM XGTZXjPz+poBAL7ybOwWvQWYoJ2LLDg10F9dSb68DxE2FJAS3lzM0IGf =dhtX -----END PGP SIGNATURE----- Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "The biggest core change is the reliable wake fix for scsi_schedule_eh which is used by both libata and libsas which could otherwise cause error handler hangs due to rare races. All other fixes are in drivers (well except the export symbol removal) the next biggest being the target PR-OUT transportid parsing fix" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: hpsa: Fix DMA mapping leak on IOACCEL2 reset path scsi: elx: efct: Fix refcount leak in efct_hw_io_abort() scsi: elx: efct: Fix I/O leak on unsupported additional CDB scsi: core: wake eh reliably when using scsi_schedule_eh scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE scsi: target: Bound PR-OUT TransportID parsing to the received buffer scsi: lpfc: Fix memory leak in lpfc_sli4_driver_resource_setup() scsi: sg: Report request-table problems when any status is set scsi: ufs: core: tracing: Do not dereference pointers in TP_printk() scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block() scsi: xen: scsiback: Free the command tag on the TMR submit-failure path scsi: xen: scsiback: Free unsubmitted command instead of double-putting it scsi: core: Remove export for scsi_device_from_queue() |
||
|
Linus Torvalds
|
ba6bd0df9a |
i2c-fixes for v7.2-rc4
imx: fix empty SMBus block reads in atomic and IRQ paths spacemit: return IRQ_NONE for empty interrupt status mlxbf: fix a use-after-free issue mediatek: restore WRRD support without automatic restart CREDITS: add Wolfram Sang -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQScDfrjQa34uOld1VLaeAVmJtMtbgUCaltX3AAKCRDaeAVmJtMt bqqgAPsFCe+3Y/71UNBWzOEI99zUlyFu7OH7Rt/015HVXsmelgEAjkQ0X5RX2Njg AswoeT+OGvxxVxlNeNMMrxAM4s6caQU= =yKh8 -----END PGP SIGNATURE----- Merge tag 'i2c-fixes-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux Pull i2c fixes from Andi Shyti: "A handful of small fixes for host controller drivers. One patch also adds Wolfram Sang to CREDITS after more than a decade of work on I2C" * tag 'i2c-fixes-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux: i2c: mediatek: fix WRRD for SoCs without auto_restart option i2c: mlxbf: Fix use-after-free in mlxbf_i2c_init_resource() i2c: spacemit: fix spurious IRQ handling returning IRQ_HANDLED i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) CREDITS: Add Wolfram Sang |
||
Takashi Iwai
|
02bbbf05d1 |
ALSA: hda/realtek: Add quirk for HP Pavilion x360
HP Pavilion x360 sets a bogus PCI SSID (103c:0000), hence the driver picks up a wrong quirk entry, resulting in an almost silent output. And yet, the existing quirk for x390 doesn't seem sufficing, and we need the extra setup for the amp. This patch adds the quirk entry for the codec SSID (103c:8486) to initialize the amp via COEF verbs and chains to the existing quirk for another x360 model to address the silent output. Closes: https://lore.kernel.org/CAF2ktaUW2oaWwGazGtJQ3o1JyE2R4O2xPd-Dchr=qqi7_QRruQ@mail.gmail.com Reviewed-by: Cezary Rojewski <cezary.rojewski@intel.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260716064916.540616-1-tiwai@suse.de |
||
|
Linus Torvalds
|
1229e2e57a |
eight ksmbd server fixes
-----BEGIN PGP SIGNATURE-----
iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmpa3JoACgkQiiy9cAdy
T1EP7wv9FiM0oUOekxfydVFTMdpzkMpvBHcLoVSpnFjvgJZVh4gOmvyY0fRuXKRB
o40SAoBvZP5KRe6qjBxo2o+z4T6NpRY+K1ftv0xxFvgDZ3+wvyV6jEf80cLnoDAl
xqOji4PeeZfrKVwPYAFTVWhImQZ9IZuP3cBpZKqf5EWYovk43Ex/VQCqnVdAMY33
fvdUEY1u8HVVILOzHRWvo7QAlyw6SEBjdmTLqCB2mNDwBcfg1C/zuvbf8KYS4LXu
+C8F137JlSz6tplrTBGIq3FVwLxhGunZwanO3IVM8B0+FhSsedWT/qS5CbgijZxn
GpT9CBKWN/KU3YPHEFDKxcSkJAc0MA20cb9LRUdIy7uv+OnYVV2oY209dukj8RpI
05F8RC1frrdhY9vZZhjIw/x5jbrHb4cGEohGyB6pH8C1gJc1AOuFBEZ7X7dHgGqA
jjJ3bBD4f8mL7Pim37gubyCYvO/MtjEkKYWvoWxtjWewHxpJdvH+JefnOz8Cyp94
BXR4hd1r
=K5Ks
-----END PGP SIGNATURE-----
Merge tag 'v7.2-rc3-smb3-server-fixes' of git://git.samba.org/ksmbd
Pull smb server fixes from Steve French:
"ksmbd server fixes, mostly addressing malformed SMB request
handling and connection/session lifetime issues, including
two information-disclosure or memory-safety bugs in the SMB2
request/response paths.
- validate FILE_ALLOCATION_INFORMATION before block rounding to
prevent a client-controlled overflow from truncating a file.
- pin connections while asynchronous oplock and lease-break
notifications are pending.
- initialize compound SMB2 READ alignment padding, preventing
disclosure of uninitialized heap bytes.
- release the allocated alternate-stream xattr name after rename.
- size multichannel binding session-key buffers for the largest
permitted key, avoiding a stack buffer overflow.
- remove a disconnecting connection's channels from every session,
including channels whose binding state has since changed.
- serialize binding preauthentication-session lookup and update
against its teardown.
- check that every compound request element contains StructureSize2
before reading it"
* tag 'v7.2-rc3-smb3-server-fixes' of git://git.samba.org/ksmbd:
ksmbd: validate compound request size before reading StructureSize2
ksmbd: lock the binding preauth session in smb3_preauth_hash_rsp
ksmbd: remove stale channels from all sessions on teardown
ksmbd: fix stack buffer overflow in multichannel session-key copy
ksmbd: fix memory leak of xattr_stream_name in smb2_rename()
ksmbd: zero the smb2_read alignment tail to avoid an infoleak
ksmbd: pin conn during async oplock break notification
ksmbd: fix integer overflow in set_file_allocation_info()
|
||
|
Linus Torvalds
|
94dc07d6d9 |
ata fixes for 7.2-rc4
- Interrupt initialization and handling Fixes for the Designware
ahci_dwc driver (Rosen)
- Avoid possible infinite loop when scanning completion in the
Designware ahci_dwc driver (Rosen)
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQSRPv8tYSvhwAzJdzjdoc3SxdoYdgUCalrPMQAKCRDdoc3SxdoY
dnQ3AP9NaxQu5xoACQtFtNPb8CyY35CRclAKZsKk+/clCNAVwwEAuUo2rgw/eAfP
w98ZEvN1HMRqW4dbatv2d3zNw2L8Iw8=
=9+gW
-----END PGP SIGNATURE-----
Merge tag 'ata-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux
Pull ata fixes from Damien Le Moal:
- Interrupt initialization and handling fixes for the Designware
ahci_dwc driver (Rosen)
- Avoid possible infinite loop when scanning completion in the
Designware ahci_dwc driver (Rosen)
* tag 'ata-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:
ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning
ata: sata_dwc_460ex: fix clear_interrupt_bit() clearing all pending interrupts
ata: sata_dwc_460ex: use platform_get_irq()
ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered
|
||
|
Linus Torvalds
|
7d6ca51a44 |
drm fixes for 7.2-rc4
ttm: - Handle NULL pages and backup handles in ttm_pool_backup() correctly. gpusvm: - Improve unmap and error handling on gpusvm. udmabuf: - Always synchronize for CPU in begin_cpu_udmabuf. xe: - Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOCK - Hold a dma-buf reference for imported BOs - Fix writable override for CRI - Fix VF CCS attach/detach race with in-flight BO moves - Fix WOPCM size for LNL+ - Reset current_op in xe_pt_update_ops_init - Keep scheduler timeline name alive - Hold device ref until queue teardown completes - Disable display in admin only PF mode i915: - NV12 display fix for bigjoiner - clear watermark on plane disable - GT selftest fixes host1x: - Fix UAF amdxdna - Fix UAF - Reject more invalid amdxdna command submissions. ivpu: - Fix wrong read - Handle invalid firmware log in ivpu. panthor: - Fix error handling virtio: - Fix virtio deadlock - Fix invalid gem detach. amdgpu: - DCN 4.2 fixes - NUTMEG fixes - 8K panel fix - Backlight fixes - UserQ fix - Fix bo->pin leaking in amdgpu_bo_create_reserved() - VFCT fixes - devcoredump fixes - Display fixes - SMU7 DPM fix - AC/DC fixes for SMU7 and SI - Queue reset fix - PCIe DPM fix - XHCI/GPU resume ordering fix - Pageflip timeout fix amdkfd: - Fix potential overflow in CWSR size calculation - DQM error clean up fixes -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmpauCwACgkQDHTzWXnE hr4xMw/+LIYBn7zptNvi0VK8YmgJpyEhpHSVbdCA2syFuhcFYoqs7YEQMQN5I5NR Dk6HofKEAQkzZWucLDmCeRSe7f1dfq6zCZE6l/Mgmwxt3EpTMT2MrbzLUCJkKi6W 63q6F9T238Q8x0ceXnJJOxFS3BkDgyHy0UkxUcicMo5tLw4p7rsn+h18bMmBIj+x 0ekxJ444ZHBChhjEGYA575KOaOAuFT4V+GCRdw2BriEgWcoKCQkuWH+nbSkrB/p2 C+Yf2ruK0onLQu5nhmkumc0hPjS+qctOFSPYNUVa/73RtWzEKZxLmMamEf+zZOGU UuLE2aoGQ4HDqnxZdXiv+J+1HS42XoM3tCpKnUHXgY2y7aoB91M5A7thPk3oem/C lrQlPyoS5sZbl7OdJO6DzD2G6Nr/9eHzzS8HoYrJc4TE6p9rnSMThIeXXaryTSCz CYo3lasMJaZ+HM3wUz6vxUykdmoic09siqGV9T4j7IOcb9r6fg7tJIARjx8tVyRy 4C55z3J9fKV5OJpPDondCY8/pRLqhyoZXOBMk8vzG1gjnVSbSplVjcb4iAjn6/vQ blV4EMhkMVa3f2cVE5+jaCxe8jEVEQsBkLeKUxl/x6XJ0YLTFPZUqom33S3dkwCI pFt2XRNs/fgBuVuf4ZSgaSX4Smrv5OY2gxC6jGqdyteI9fAbNZk= =SJsq -----END PGP SIGNATURE----- Merge tag 'drm-fixes-2026-07-18-1' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Daie Airlie: "Weekly drm fixes, there is amdgpu, xe and i915 and then a lot of scattered fixes. Looks about the right level for the new right. ttm: - Handle NULL pages and backup handles in ttm_pool_backup() correctly gpusvm: - Improve unmap and error handling on gpusvm udmabuf: - Always synchronize for CPU in begin_cpu_udmabuf xe: - Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOCK - Hold a dma-buf reference for imported BOs - Fix writable override for CRI - Fix VF CCS attach/detach race with in-flight BO moves - Fix WOPCM size for LNL+ - Reset current_op in xe_pt_update_ops_init - Keep scheduler timeline name alive - Hold device ref until queue teardown completes - Disable display in admin only PF mode i915: - NV12 display fix for bigjoiner - clear watermark on plane disable - GT selftest fixes host1x: - Fix UAF amdxdna - Fix UAF - Reject more invalid amdxdna command submissions ivpu: - Fix wrong read - Handle invalid firmware log in ivpu panthor: - Fix error handling virtio: - Fix virtio deadlock - Fix invalid gem detach amdgpu: - DCN 4.2 fixes - NUTMEG fixes - 8K panel fix - Backlight fixes - UserQ fix - Fix bo->pin leaking in amdgpu_bo_create_reserved() - VFCT fixes - devcoredump fixes - Display fixes - SMU7 DPM fix - AC/DC fixes for SMU7 and SI - Queue reset fix - PCIe DPM fix - XHCI/GPU resume ordering fix - Pageflip timeout fix amdkfd: - Fix potential overflow in CWSR size calculation - DQM error clean up fixes * tag 'drm-fixes-2026-07-18-1' of https://gitlab.freedesktop.org/drm/kernel: (61 commits) Revert "drm/amd/display: Restore 5s vbl offdelay for NV3x+ DGPUs" drm/amd/display: check GRPH_FLIP status before sending event drm/amd/display: consolidate DCN vblank/flip handling onto vupdate_no_lock drm/amd: Create a device link between APU display and XHCI devices drm/amd/display: wire DCN42B mcache programming callback drm/amd/display: set new_stream to NULL after release drm/amd/display: Force PWM backlight on Lenovo Legion 5 15ARH05 drm/amdkfd: free MQD managers on DQM init failures drm/amdgpu/ttm: Consider concurrent VM flushes for buffer entities drm/amd/pm/smu7: Fix AC/DC switch notification drm/amdgpu: Disable PCIe dynamic speed switching on Ryzen Pinnacle Ridge drm/amdgpu: always emit the job vm fence drm/amd/pm/si: Fix AC/DC switch notification drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized drm/amd/display: dce100: skip non-DP stream encoders for DP MST drm/amd/display: Set native cursor mode for disabled CRTCs drm/amd/pm/ci: Don't disable MCLK DPM on Bonaire 0x6658 (R7 260X) drm/amd/display: fix __udivdi3 link error drm/amdgpu: Reserve space for IB contents in devcoredumps drm/amdgpu: Print vmid, pasid and more task info in devcoredump ... |
||
Dave Airlie
|
973fd9493e |
amd-drm-fixes-7.2-2026-07-17:
amdgpu: - DCN 4.2 fixes - NUTMEG fixes - 8K panel fix - Backlight fixes - UserQ fix - Fix bo->pin leaking in amdgpu_bo_create_reserved() - VFCT fixes - devcoredump fixes - Display fixes - SMU7 DPM fix - AC/DC fixes for SMU7 and SI - Queue reset fix - PCIe DPM fix - XHCI/GPU resume ordering fix - Pageflip timeout fix amdkfd: - Fix potential overflow in CWSR size calculation - DQM error clean up fixes -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQQgO5Idg2tXNTSZAr293/aFa7yZ2AUCalqifQAKCRC93/aFa7yZ 2JreAQC8qdjr8xl1zMJkKuGPLS8GP1LxDQIyBY+s+7kTc0UU6QD+Pxo9ZbX/3Rxf uf6GJ4eq1kCs5b0VwI1EK61UaYHhLgA= =Kenl -----END PGP SIGNATURE----- Merge tag 'amd-drm-fixes-7.2-2026-07-17' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-7.2-2026-07-17: amdgpu: - DCN 4.2 fixes - NUTMEG fixes - 8K panel fix - Backlight fixes - UserQ fix - Fix bo->pin leaking in amdgpu_bo_create_reserved() - VFCT fixes - devcoredump fixes - Display fixes - SMU7 DPM fix - AC/DC fixes for SMU7 and SI - Queue reset fix - PCIe DPM fix - XHCI/GPU resume ordering fix - Pageflip timeout fix amdkfd: - Fix potential overflow in CWSR size calculation - DQM error clean up fixes Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20260717215008.998399-1-alexander.deucher@amd.com |