kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-13 07:31:07 +00:00
Code Issues Releases Packages Activity
1,482,218 commits 117 branches 5,827 tags 6.3 GiB
Commit graph

1,482,218 commits

This branch
This branch
All branches
Author SHA1 Message Date
Linus Torvalds
6271f6ea7f xfs: new code for Linux 7.2 
Signed-off-by: Carlos Maiolino <cem@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iJUEABMJAB0WIQSmtYVZ/MfVMGUq1GNcsMJ8RxYuYwUCai/ATAAKCRBcsMJ8RxYu
 YwizAX9pr/FDF4FJEob18Juys/r+VvptqdJxx/e2igubyOzhz0MrDHSbzfF8Z1d2
 lY4oa9EBgKrLjV/v+erpxxg9+i3Dqya/QvsHAzm/7k/fbA3udeiop71PlqRKF1SD
 clzkim/DSg==
 =qpVD
 -----END PGP SIGNATURE-----

Merge tag 'xfs-merge-7.2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux

Pull xfs updates from Carlos Maiolino:
 "The main highlight is the removal of experimental tag of the zone
  allocator feature.

  Besides that, this contains a collection of bug fixes and code
  refactoring but no new features have been added"

* tag 'xfs-merge-7.2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (29 commits)
  xfs: shut down the filesystem on a failed mount
  xfs: skip inode inactivation on a shut down mount
  xfs: move XFS_LSN_CMP to xfs_log_format.h
  xfs: shut down zoned file systems on writeback errors
  xfs: cleanup xfs_growfs_compute_deltas
  xfs: pass back updated nb from xfs_growfs_compute_deltas
  xfs: fix pointer arithmetic error on 32-bit systems
  xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap
  xfs: only log freed extents for the current RTG in zoned growfs
  xfs: add newly added RTGs to the free pool in growfs
  xfs: factor out a xfs_zone_mark_free helper
  xfs: mark struct xfs_imap as __packed
  xfs: store an agbno in struct xfs_imap
  xfs: massage xfs_imap_to_bp into xfs_read_icluster
  xfs: remove im_len field in struct xfs_imap
  xfs: cleanup xfs_imap
  xfs: remove the call to xfs_buf_reverify in xfs_trans_read_buf_map
  xfs: remove the i_ino field in struct xfs_inode
  xfs: remove xfs_setup_existing_inode
  xfs: convert xchk_inode_xref_set_corrupt to xchk_ip_xref_set_corrupt
  ...
 2026-06-16 11:50:40 +05:30
Bryam Vargas
66725039f7 Input: mms114 - reject an oversized device packet size 
mms114_interrupt() reads a packet of touch data from the device into a
fixed-size on-stack buffer

	struct mms114_touch touch[MMS114_MAX_TOUCH];

which holds MMS114_MAX_TOUCH (10) events of MMS114_EVENT_SIZE (8) bytes,
i.e. 80 bytes. The length of the I2C read into it is taken verbatim from
the device:

	packet_size = mms114_read_reg(data, MMS114_PACKET_SIZE);
	if (packet_size <= 0)
		goto out;
	...
	error = __mms114_read_reg(data, MMS114_INFORMATION, packet_size,
			(u8 *)touch);

packet_size is a single device register byte (0x0F) and the only check
is the lower bound packet_size <= 0; it is never bounded against the
size of touch[]. A malfunctioning, malicious or counterfeit controller
(or an attacker tampering with the I2C bus) can report a packet_size of
up to 255, so __mms114_read_reg() writes up to 175 bytes past the end of
touch[] on the IRQ-thread stack: a stack out-of-bounds write that can
overwrite the stack canary, saved registers and the return address.

A well-formed device never reports more than the buffer holds, so reject
an oversized packet and drop the report, consistent with the handler's
other error paths, rather than reading past the buffer.

Fixes: 07b8481d4a ("Input: add MELFAS mms114 touchscreen driver")
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260612-b4-disp-dc4b8dc4-v1-1-d7cb0a828d92@proton.me
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
 2026-06-15 22:05:34 -07:00
Linus Torvalds
481329ec5b hardening updates for v7.2-rc1 
- lkdtm: Add case to provoke a crash in EFI runtime services (Ard Biesheuvel)
 
 - lkdtm: add PPC_RADIX_TLBIEL test and missed isync (Sayali Patil)
 
 - stddef: Document designated initializer semantics for __TRAILING_OVERLAP()
   (Gustavo A. R. Silva)
 
 - strarray: drop redundant allocation, add __counted_by_ptr (Thorsten Blum)
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRSPkdeREjth1dHnSE2KwveOeQkuwUCajBj8AAKCRA2KwveOeQk
 u/fjAPwJVWvocviOCGGA6Rq/BAPNJpkrahqtcNAjwvuh+SWDfQD/bHcdXLXi6tl2
 fHWCdJ2ScNBqAWVkJNl9F3k+XdSsmws=
 =GZAD
 -----END PGP SIGNATURE-----

Merge tag 'hardening-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

Pull hardening updates from Kees Cook:

 - lkdtm:
     - Add case to provoke a crash in EFI runtime services (Ard Biesheuvel)
     - add PPC_RADIX_TLBIEL test and missed isync (Sayali Patil)

 - stddef: Document designated initializer semantics for
   __TRAILING_OVERLAP() (Gustavo A. R. Silva)

 - strarray: drop redundant allocation, add __counted_by_ptr (Thorsten
   Blum)

* tag 'hardening-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  lkdtm/powerpc: add PPC_RADIX_TLBIEL test for radix MCE validation
  lkdtm/powerpc: add isync after slbmte to enforce SLB update ordering
  lkdtm: Add case to provoke a crash in EFI runtime services
  lib/string_helpers: annotate struct strarray with __counted_by_ptr
  lib/string_helpers: drop redundant allocation in kasprintf_strarray
  MAINTAINERS: add kernel hardening keyword __counted_by_ptr
  stddef: Document designated initializer semantics for __TRAILING_OVERLAP()
 2026-06-16 09:21:01 +05:30
Linus Torvalds
673f72944d Crypto library updates for 7.2 
- Drop the last architecture-specific implementation of MD5
 
 - Mark clmul32() as noinline_for_stack to improve codegen in some cases
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYIADIWIQSacvsUNc7UX4ntmEPzXCl4vpKOKwUCajA7lxQcZWJpZ2dlcnNA
 a2VybmVsLm9yZwAKCRDzXCl4vpKOK7dtAQDZsISd/th6twEfSfdqLpuDIqIHtwjk
 uTE6GQJKdkYT0AD/VuU0FCSn0On+8Anho3Fk1AP0civzuJyixI8m8QSgYQs=
 =nTJj
 -----END PGP SIGNATURE-----

Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux

Pull crypto library updates from Eric Biggers:

 - Drop the last architecture-specific implementation of MD5

 - Mark clmul32() as noinline_for_stack to improve codegen in some cases

* tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux:
  lib/crypto: gf128hash: mark clmul32() as noinline_for_stack
  lib/crypto: powerpc/md5: Drop powerpc optimized MD5 code
 2026-06-16 09:18:53 +05:30
Linus Torvalds
ef3b7426a6 CRC updates for 7.2 
Accelerate CRC64-NVME for 32-bit ARM by refactoring the arm64 NEON
 intrinsics implementation to be shared by 32-bit and 64-bit.
 
 Also apply a similar cleanup to the 32-bit ARM NEON implementation of
 xor_gen(), where it now reuses code from the 64-bit implementation.
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYIADIWIQSacvsUNc7UX4ntmEPzXCl4vpKOKwUCajA5WBQcZWJpZ2dlcnNA
 a2VybmVsLm9yZwAKCRDzXCl4vpKOKxAOAP9RLfiQ3S+ZCQhjl4j9niyFvrfXfDpR
 aekeeaGnqA95CQEAs/0MYR1gt/VqeB8T4NjDiy0+8+HxruJ4A3nqWs7dLQ0=
 =hSHr
 -----END PGP SIGNATURE-----

Merge tag 'crc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux

Pull CRC updates from Eric Biggers:
 "Accelerate CRC64-NVME for 32-bit ARM by refactoring the arm64 NEON
  intrinsics implementation to be shared by 32-bit and 64-bit.

  Also apply a similar cleanup to the 32-bit ARM NEON implementation of
  xor_gen(), where it now reuses code from the 64-bit implementation"

* tag 'crc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux:
  crypto: aegis128 - Use neon-intrinsics.h on ARM too
  lib/crc: arm: Enable arm64's NEON intrinsics implementation of crc64
  lib/crc: Turn NEON intrinsics crc64 implementation into common code
  xor/arm64: Use shared NEON intrinsics implementation from 32-bit ARM
  xor/arm: Replace vectorized implementation with arm64's intrinsics
  ARM: Add a neon-intrinsics.h header like on arm64
 2026-06-16 09:16:37 +05:30
Linus Torvalds
0d8c113493 This update includes the following changes: 
API:
 
 - Drop support for off-CPU cryptography in af_alg.
 - Document that af_alg is *always* slower.
 - Document the deprecation of af_alg.
 - Remove zero-copy support from skcipher and aead in af_alg.
 - Cap AEAD AD length to 0x80000000 in af_alg.
 - Free default RNG on module exit.
 
 Algorithms:
 
 - Fix vli multiplication carry overflow in ecc.
 - Drop unused cipher_null crypto_alg.
 - Remove unused variants of drbg.
 - Use lib/crypto in drbg.
 - Use memcpy_from/to_sglist in authencesn.
 - Allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode.
 - Disallow RSA PKCS#1 SHA-1 sig algs in FIPS mode.
 - Filter out async aead implementations at alloc in krb5.
 - Fix non-parallel fallback by rstoring callback in pcrypt.
 - Validate poly1305 template argument in chacha20poly1305.
 
 Drivers:
 
 - Add sysfs PCI reset support to qat.
 - Add KPT support for GEN6 devices to qat.
 - Remove unused character device and ioctls from qat.
 - Add support for hw access via SMCC to mtk.
 - Remove prng support from crypto4xx.
 - Remove prng support from hisi-trng.
 - Remove prng support from sun4i-ss.
 - Remove prng support from xilinx-trng.
 - Remove loongson-rng.
 - Remove exynos-rng.
 
 Others:
 
 - Remove support for AIO on sockets.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEn51F/lCuNhUwmDeSxycdCkmxi6cFAmovcvMACgkQxycdCkmx
 i6emMA/8DfjbQLm7kGXKhlHaAZ9MgSxVUDs+yz+I1XbFL0sbEbLmZlwMiEta2Rg0
 GteR+ZGxkzBbDwL3CHQ+ZJHycCgPxokeRJJ9rWT1j+tGEkJoj/00SRtzMqVXXcY5
 0LGVcw8Ru15oUH7+PlMqnIKYhxrmIPXYGsSwP8FBdRF5CN2q1KNmfW5rtrc8KhPH
 g3SRgH6sE2Bv1cQ7C6GKlgqE89WX41nUil5F5jyQwMlylqZV7SErPjFtc6aqgcoV
 CQP0C2rC0LzZhfTrrnzXLT1h6RUNwulnQAkSICo40F9XZYO+o5EeZvRP0ESNvrda
 fNYCqFOWZaQDjtfnxNT1ZrjT0R00H/Am/Hz5rNFng2sB/XArAqzvHTHtvbuV8t0O
 Kew+KrMEWHSaGnsr+W4lYTw4wZKS1mxjE1P/FcVQN1WLeI5cNywyCVeD3qmhgcws
 GACmM4ghFErBTajBfcHa8dMCshidMQVA6fqHEdOmNn+CxOCZhEdlLmfnJO1KCnEr
 Aw9dnwhtuEdwha1kjNlzN0HC0T/zoumtINqI3Els4/23L7LW8doBAuyGLDd3VmII
 Vr3gu3Oj9pv4Tl0RYJKRObFWM7MwVU6RpVxz2eVkEuM+ZM2je5kZo56tEa8vELrp
 aM/L3yMeuYohssBcP9mfLpR7JCGB2186h47IUGGP6Jz0XjSy7Ns=
 =4BGT
 -----END PGP SIGNATURE-----

Merge tag 'v7.2-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6

Pull crypto updates from Herbert Xu:
 "API:
   - Drop support for off-CPU cryptography in af_alg
   - Document that af_alg is *always* slower
   - Document the deprecation of af_alg
   - Remove zero-copy support from skcipher and aead in af_alg
   - Cap AEAD AD length to 0x80000000 in af_alg
   - Free default RNG on module exit

  Algorithms:
   - Fix vli multiplication carry overflow in ecc
   - Drop unused cipher_null crypto_alg
   - Remove unused variants of drbg
   - Use lib/crypto in drbg
   - Use memcpy_from/to_sglist in authencesn
   - Allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode
   - Disallow RSA PKCS#1 SHA-1 sig algs in FIPS mode
   - Filter out async aead implementations at alloc in krb5
   - Fix non-parallel fallback by rstoring callback in pcrypt
   - Validate poly1305 template argument in chacha20poly1305

  Drivers:
   - Add sysfs PCI reset support to qat
   - Add KPT support for GEN6 devices to qat
   - Remove unused character device and ioctls from qat
   - Add support for hw access via SMCC to mtk
   - Remove prng support from crypto4xx
   - Remove prng support from hisi-trng
   - Remove prng support from sun4i-ss
   - Remove prng support from xilinx-trng
   - Remove loongson-rng
   - Remove exynos-rng

  Others:
   - Remove support for AIO on sockets"

* tag 'v7.2-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (196 commits)
  crypto: tegra - fix refcount leak in tegra_se_host1x_submit()
  crypto: rng - Free default RNG on module exit
  crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode
  hwrng: jh7110 - fix refcount leak in starfive_trng_read()
  crypto: atmel-ecc - drop dead code in atmel_ecdh_max_size
  crypto: cavium/cpt - fix DMA cleanup using wrong loop index
  crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
  MAINTAINERS: make myself the maintainer of the Qualcomm QCE driver
  crypto: amcc - convert irq_of_parse_and_map to platform_get_irq
  crypto: sun4i-ss - Remove insecure and unused rng_alg
  hwrng: xilinx - Move xilinx-rng into drivers/char/hw_random/
  crypto: xilinx-trng - Replace crypto_drbg_ctr_df() with HMAC-SHA512
  crypto: xilinx-trng - Fix return value of xtrng_hwrng_trng_read()
  crypto: xilinx-trng - Remove crypto_rng interface
  crypto: exynos-rng - Remove exynos-rng driver
  hwrng: hisi-trng - Move hisi-trng into drivers/char/hw_random/
  crypto: hisi-trng - Remove crypto_rng interface
  crypto: loongson - Remove broken and unused loongson-rng
  crypto: crypto4xx - Remove insecure and unused rng_alg
  crypto: qat - validate RSA CRT component lengths
  ...
 2026-06-16 09:01:23 +05:30
Linus Torvalds
f8115f0e8a slab changes for 7.2 
-----BEGIN PGP SIGNATURE-----
 
 iQFPBAABCAA5FiEEe7vIQRWZI0iWSE3xu+CwddJFiJoFAmovtcQbFIAAAAAABAAO
 bWFudTIsMi41KzEuMTIsMiwyAAoJELvgsHXSRYia17cH/ROle2R7pTZbk60nupo3
 JHWvvOB6j2xh5s4bxbcoBIb8ZdS5L3YeAE8u/1NUGFHckIJ/7/rB3njxeDtoJyIn
 K1ER5LD2wd0jf0Z6P2WOB4MmoF0LSi+KcT0xRbMlmcd9KM9xQIFy7aLxYoWXlqqM
 T+kDmLuMtUawZGlN+foSFMp2ewO9Iz31kiQACreLa246zTIkCAhqzTBBCFRPkCMX
 cEES6J8Xb3YcfO66PUXqUC63pS0ikovP8P3yt92jWgaXTrntGDQYG/zxm2dkdwQl
 UklmXA0KT1mkaTA8vUDPdBk9LFWVCdhK2rkMWyeirQZqIsHYGfj8vB1HoR839m6a
 vTk=
 =YSns
 -----END PGP SIGNATURE-----

Merge tag 'slab-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab

Pull slab updates from Vlastimil Babka:

 - Support for "allocation tokens" (currently available in Clang 22+)
   for smarter partitioning of kmalloc caches based on the allocated
   object type, which can be enabled instead of the "random"
   per-caller-address-hash partitioning.

   It should be able to deterministically separate types containing a
   pointer from those that do not (Marco Elver)

 - Improvements and simplification of the kmem_cache_alloc_bulk() and
   mempool_alloc_bulk() API. This includes adaptation of callers
   (Christoph Hellwig)

 - Performance improvements and cleanups related mostly to sheaves
   refill (Hao Li, Shengming Hu, Vlastimil Babka)

 - Several fixups for the slabinfo tool (Xuewen Wang)

* tag 'slab-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab:
  mm/slab: do not limit zeroing to orig_size when only red zoning is enabled
  mm/slub: preserve original size in _kmalloc_nolock_noprof retry path
  mm: simplify the mempool_alloc_bulk API
  mm/slab: improve kmem_cache_alloc_bulk
  mm/slub: detach and reattach partial slabs in batch
  mm/slub: introduce helpers for node partial slab state
  mm/slub: use empty sheaf helpers for oversized sheaves
  tools/mm/slabinfo: remove redundant slab->partial assignment
  tools/mm/slabinfo: remove dead assignment in get_obj_and_str()
  tools/mm/slabinfo: Fix trace disable logic inversion
  MAINTAINERS: add slab-related scripts and tools to SLAB ALLOCATOR
  mm/slub: fix typo in sheaves comment
  mm, slab: simplify returning slab in __refill_objects_node()
  mm, slab: add an optimistic __slab_try_return_freelist()
  slab: fix kernel-docs for mm-api
  slab: improve KMALLOC_PARTITION_RANDOM randomness
  slab: support for compiler-assisted type-based slab cache partitioning
  mm/slub: defer freelist construction until after bulk allocation from a new slab
 2026-06-16 08:44:43 +05:30
Linus Torvalds
a87bbc4578 Things have calmed down a bit on the docs front, with no earthshaking 
changes this time around:
 
 - Ongoing work on the Japanese and Portuguese translations.
 
 - Better integration of the MAINTAINERS file into the rendered documents,
   including a search interface.
 
 - A seemingly infinite supply of fixes for typos, minor grammatical issues,
   and related problems that LLMs find with abandon.
 -----BEGIN PGP SIGNATURE-----
 
 iQFDBAABCgAtFiEEIw+MvkEiF49krdp9F0NaE2wMflgFAmowdrAPHGNvcmJldEBs
 d24ubmV0AAoJEBdDWhNsDH5Y2V0H+wYRT2JZkH2CVU1CTkFTYohjs3EEg/CFdRNR
 JF2Nmc6akNYiWURcqC2wuQBDvJOB1NCkfPmX7QOuKlrA+kt41jlkSV6gqbK4M0Fc
 8lJzJ1Qzs+Woe/tWzxE3+7YimZEoG7eWIUfeLiGCMwFviKUj5OxiS6dKwaq1D5Jt
 QVFwb6BERuhDojFqrUH2P8AzJtaPqwGUwEivygwPunMT6yk/eWMj4ZJlkn7RZxP3
 Zt1Sb42UX2noJe6kZ9cP1slTrMQVcSl8WAPQEpSRdcIpimY7RTjD0tZGnVLgyHRI
 bAg/QEVHwqoM9wUC/KaFUVg/tXCVepcXmNRTDhFW4u3yIacE+1U=
 =82gB
 -----END PGP SIGNATURE-----

Merge tag 'docs-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux

Pull documentation updates from Jonathan Corbet:
 "Things have calmed down a bit on the docs front, with no earthshaking
  changes this time around:

   - Ongoing work on the Japanese and Portuguese translations

   - Better integration of the MAINTAINERS file into the rendered
     documents, including a search interface

   - A seemingly infinite supply of fixes for typos, minor grammatical
     issues, and related problems that LLMs find with abandon"

* tag 'docs-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux: (93 commits)
  docs: pt_BR: Translate 3.Early-stage.rst into Portuguese
  docs: pt_BR: update "Purpose of Defconfigs" section in maintainer-soc.rst
  Documentation: bug-hunting.rst: fix grammar
  docs/ja_JP: translate submitting-patches.rst (interleaved-replies)
  docs: Fix minor grammatical error
  docs/{it_it,sp_SP,zh_CN,zh_TW}: update references to removed CONFIG_DEBUG_SLAB
  Documentation: process: fix brackets
  Documentation: arch: fix brackets
  docs/dyndbg: explain flags parse 1st
  docs/dyndbg: update examples \012 to \n
  docs: kernel-parameters: Fix stale sticore file paths
  docs: real-time: Fix duplicated sched(7) text
  docs: kgdb: Fix stale source file paths
  docs: sonypi: Fix stale header file path
  docs: kernel-parameters: Remove sa1100ir IrDA parameter
  iommu: Documentation: rearrange, update kernel-parameters
  docs: md: fix grammar in speed_limit description
  docs: changes.rst: restore pahole 1.26 minimum (regressed by sort)
  Documentation: Fix syntax of kmalloc_objs example in coding style doc
  docs: pt_BR: update maintainer-handbooks
  ...
 2026-06-16 08:35:59 +05:30
Linus Torvalds
bd77e50c9a fbdev fixes & cleanups for 7.2-rc1: 
Removal of drivers:
 - Hercules monochrome ISA graphics adapter driver [Ethan Nelson-Moore]
 - Hercules mdacon console driver [Ethan Nelson-Moore]
 
 Changes affecting many drivers at once:
 - possible memory leak fixes in various drivers [Abdun Nihaal]
 - many conversions to use strscpy() [David Laight]
 - Use named initializers in drivers [Uwe Kleine-König]
 
 Code fixes:
 - fbcon: don't suspend/resume when vc is graphics mode [Lu Yao]
 - modedb: fix a possible UAF in fb_find_mode() [Tuo Li]
 - modedb: Fix entry for 1920x1080-60 mode [Steffen Persvold]
 - arm: Export acorndata_8x8 font symbol for bootloader [Helge Deller]
 - omap2: fix use-after-free in omapfb_mmap [Hongling Zeng]
 
 Cleanups:
 - pxa168fb: use devm_ioremap_resource() [AlbertoArostegui]
 - provice helpers for fb_set_var() and fb_blank() and fbcon updates [Thomas Zimmermann]
 - fbcon: Use correct type for vc_resize() return value [Jiacheng Yu]
 - chipsfb: add missing MODULE_DESCRIPTION() macro [Rahman Mahmutović]
 - sunxvr2500: replace printk with device-aware logging functions [Rahman Mahmutović]
 - sm712: Fix operator precedence in big_swap macro [Li RongQing]
 - imxfb: Use of_device_get_match_data() [Rosen Penev]
 - atmel_lcdfb: Use of_device_get_match_data() [Rosen Penev]
 
 Documentation fixes:
 - grvga: Fix CLUT register address offset in comment [Eduardo Silva]
 - omap/dss: Fix stale modedb.c path [Costa Shulyupin]
 - correct CONFIG_FB_TILEBLITTING macro name in #endif comment [Ethan Nelson-Moore]
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCajAoegAKCRD3ErUQojoP
 X9kQAQC7h8nMZ+VZWjmGY3C8UMooNOXSMXv2oAA7IvMwvs5MtQD7BejDK7UQMjyd
 xod+t1k6XYzX1j8CDwa7k0qeQaLfvgc=
 =Q7dE
 -----END PGP SIGNATURE-----

Merge tag 'fbdev-for-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev

Pull fbdev updates from Helge Deller:
 "Beside the removal of the Hercules monochrome ISA graphics driver and
  the corresponding text console driver, there is just the typical
  maintanance with smaller driver fixes and cleanups:

  Removal of drivers:
   - Hercules monochrome ISA graphics adapter driver (Ethan Nelson-Moore)
   - Hercules mdacon console driver (Ethan Nelson-Moore)

  Changes affecting many drivers at once:
   - possible memory leak fixes in various drivers (Abdun Nihaal)
   - many conversions to use strscpy() (David Laight)
   - Use named initializers in drivers (Uwe Kleine-König)

  Code fixes:
   - fbcon: don't suspend/resume when vc is graphics mode (Lu Yao)
   - modedb: fix a possible UAF in fb_find_mode() (Tuo Li)
   - modedb: Fix entry for 1920x1080-60 mode (Steffen Persvold)
   - arm: Export acorndata_8x8 font symbol for bootloader (Helge Deller)
   - omap2: fix use-after-free in omapfb_mmap (Hongling Zeng)

  Cleanups:
   - pxa168fb: use devm_ioremap_resource() (Alberto Arostegui)
   - provice helpers for fb_set_var() and fb_blank() and fbcon updates
     (Thomas Zimmermann)
   - fbcon: Use correct type for vc_resize() return value (Jiacheng Yu)
   - chipsfb: add missing MODULE_DESCRIPTION() macro (Rahman Mahmutović)
   - sunxvr2500: replace printk with device-aware logging functions
     (Rahman Mahmutović)
   - sm712: Fix operator precedence in big_swap macro (Li RongQing)
   - imxfb: Use of_device_get_match_data() (Rosen Penev)
   - atmel_lcdfb: Use of_device_get_match_data() (Rosen Penev)

  Documentation fixes:
   - grvga: Fix CLUT register address offset in comment (Eduardo Silva)
   - omap/dss: Fix stale modedb.c path (Costa Shulyupin)
   - correct CONFIG_FB_TILEBLITTING macro name in #endif comment (Ethan
     Nelson-Moore)"

* tag 'fbdev-for-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: (43 commits)
  fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode
  fbdev: modedb: fix a possible UAF in fb_find_mode()
  fbdev: s3fb: Use strscpy() to copy strings into arrays
  fbdev: sm501fb: Fix buffer errors in OF binding code
  fbcon: correct CONFIG_FB_TILEBLITTING macro name in #endif comment
  fbdev/arm: Export acorndata_8x8 font symbol for bootloader
  fbdev: mmpfb: Use strscpy() to copy device name
  fbdev: sisfb: Replace strlen() strcpy() pair with strscpy()
  fbdev: rivafb: Use strscpy() to copy device name
  fbdev: cyber2000fb: Use strscpy() to copy device name
  fbdev: atmel_lcdfb: Use strscpy() to copy device name
  fbdev: Do not export fbcon from fbdev
  fbdev: Wrap fbcon updates from vga-switcheroo in helper
  fbdev: Wrap user-invoked calls to fb_blank() in helper
  fbdev: Wrap user-invoked calls to fb_set_var() in helper
  fbdev: omap2: fix use-after-free in omapfb_mmap
  docs: omap/dss: Fix stale modedb.c path
  fbdev: pxa168fb: use devm_ioremap_resource() for MMIO
  fbdev: grvga: Fix CLUT register address offset in comment
  fbdev: sunxvr2500: replace printk with device-aware logging functions
  ...
 2026-06-16 08:28:41 +05:30
Linus Torvalds
464e2f089e MMC core: 
- Validate host's max_segs to fail gracefully
 
 MMC host:
  - davinci: Avoid potential NULL dereference in the IRQ handler
  - davinci: Call mmc_add_host() in the correct order during probe
  - dw_mmc-exynos: Increase DMA threshold for exynos7870
  - renesas_sdhi: Add support for RZ/G2E, RZ/G2N and R-Car M3Le variants
  - sdhci-msm: Add support for Hawi, Eliza and Shikra variants
  - sdhci-of-k1: Add support for SD UHS-I modes
  - sdhci-of-k1: Add support for tuning for eMMC HS200 and SD UHS-I
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmov7/AQHHVsZmhAa2Vy
 bmVsLm9yZwAKCRD+JoQlc1iMKQmZEADIcTrvWmopPAI3YObMB4KdmtLxO2BNn0g/
 qbKagZyQu1dXwj/Bmq1hpDy+1gytuPUyIdcEH+21ScT2j/GwTBYFmDB4nVCYKZxq
 xOENXoG9CDcvMHe1q2pndRy6TtI4htQBLH4c1ItWghgHZewJipKYsBLmLCFBxWKq
 KzLnl+DcKY6dkJ7Ue1N8/QSCiP/Z3xSm/2ErRvcnVIoShKSA4vtt0QLhW7ec4o6w
 oVAzdlAUxgqgUp6xvAVXFQWZWZSNkXRc4RV6mkq6O2tOEd2GkhR3S5CsKSSVz6xg
 nxISvW7aZBoZvtLCwCjScLarmEXXPTo0kIV1qw0i2OCVj4z2K39FENm3pPGXbK0l
 QEggiANkvzyMHh9I6l4oZPkJ9G3N+AXZ6YGYdAzhOOq+/Z8iCtkPr16KIpDzO4kp
 WoFSHWavBotZutpZmZZzNRJNgjt5y2BnQf2IqHZzR8CTt8qWMYakEvJ/SDZ1CSNM
 nAj0TkI2cAq7Y02+DTZfCKim547I5DhcHteatkkNb3ki7aEC9sfHJOw0WziVQT8r
 UdaWtWNR/ddq7+R3LuteI27Fa7kWb1izaPEeb/d+NkO1o0DVdh0sPHOFwGtLtWv1
 KDZb//xAhvuiMSofQx73z1n1LX1A3AaXemz2qZfFVIa8iuegdlCEiAjyt0GkMocI
 itvImL3mtg==
 =ry/K
 -----END PGP SIGNATURE-----

Merge tag 'mmc-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc

Pull MMC updates from Ulf Hansson:
 "MMC core:
   - Validate host's max_segs to fail gracefully

  MMC host:
   - davinci:
       - Avoid potential NULL dereference in the IRQ handler
       - Call mmc_add_host() in the correct order during probe
   - dw_mmc-exynos:
       - Increase DMA threshold for exynos7870
   - renesas_sdhi:
       - Add support for RZ/G2E, RZ/G2N and R-Car M3Le variants
   - sdhci-msm:
       - Add support for Hawi, Eliza and Shikra variants
   - sdhci-of-k1:
       - Add support for SD UHS-I modes
       - Add support for tuning for eMMC HS200 and SD UHS-I"

* tag 'mmc-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (24 commits)
  mmc: dw_mmc: Add desc_num field for clarity
  dt-bindings: mmc: sdhci-msm: Rename the binding to include 'qcom' prefix
  mmc: sdhci-of-dwcmshc: use dev_err_probe() to simplify error paths
  mmc: sdhci-of-dwcmshc: remove redundant IS_ERR() check
  dt-bindings: mmc: sdhci-msm: qcom: Add Hawi compatible
  mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC
  mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC
  dt-bindings: mmc: sdhci-msm: Add Eliza compatible
  mmc: davinci: fix mmc_add_host order in probe
  dt-bindings: mmc: sdhci-msm: Document the Shikra compatible
  mmc: sdhci-of-k1: add comprehensive SDR tuning support
  mmc: sdhci-of-k1: add regulator and pinctrl voltage switching support
  mmc: sdhci-of-k1: enable essential clock infrastructure for SD operation
  dt-bindings: mmc: spacemit,sdhci: add pinctrl support for voltage switching
  mmc: via-sdmmc: Simplify initialisation of pci_device_id array
  mmc: davinci: avoid NULL deref of host->data in IRQ handler
  memstick: Constify the driver id_table
  mmc: host: Move MODULE_DEVICE_TABLE next to the table itself
  mmc: renesas_sdhi: add R-Car M3Le compatibility string
  dt-bindings: mmc: renesas,sdhi: Document R-Car M3Le support
  ...
 2026-06-16 08:16:55 +05:30
Linus Torvalds
fc2ce3ee10 hwmon updates for v7.2 
* New drivers for the following chips
 
 - Analog Devices LTC4283 Swap Controller
 
 - Analog Devices MAX20830
 
 - Analog Devices MAX20860A
 
 - ARCTIC Fan Controller
 
 - Delta E50SN12051
 
 - Luxshare LX1308
 
 - Microchip EMC1812/13/14/15/33
 
 - Monolithic MP2985
 
 - Murata D1U74T PSU
 
 * New chip support added to existing drivers
 
 - asus-ec-sensors: Support for ROG MAXIMUS Z790 EXTREME, ROG STRIX B850-E
   GAMING WIFI, and ROG STRIX B650E-E GAMING WIFI
 
 - dell-smm: Add Dell Latitude 7530 to fan control whitelist
 
 - nct6683: Support for ASRock Z890 Pro-A
 
 - pmbus: Support for Flex BMR316, BMR321, BMR350 and BMR351
 
 - pmbus/max34440: Support for ADPM12250
 
 - pmbus/xdp720: Support for Infineon xdp730, and fix driver issues
   reported by Sashiko
 
 * New functionality
 
 - Add support for update_interval_us chip attribute, and support it
   in ina238 driver
 
 - Add support for guard() and scoped_guard() for subsystem locks,
   and use it in adt7411, ina2xx, and lm90 drivers
 
 - emc2305: Support configurable fan PWM at shutdown
 
 - lm63: Expose PWM frequency and LUT hysteresis as writable
 
 - lm75: Support active-high alert polarity
 
 - nct7802: Add time step attributes for tweaking responsiveness
 
 - pmbus/adm1266: Add rtc debugfs entries for rtc, powerup_counter,
   clear_blackbox, and firmware_revision
 
 - raspberrypi: Fix delayed-work teardown race, add voltage input support
   as well as voltage domain IDs
 
 mcp9982: Add support for reporting external diode faults
 
 * Miscellaneous bug fixes, changes and improvements
 
 - Use named initializers for platform_device_id arrays and
   i2c_device_data, and remove unused driver data
 
 - Various drivers: Move MODULE_DEVICE_TABLE next to the table itself
 
 - ads7871: Convert to hwmon_device_register_with_info(), and use
   DMA-safe buffer for SPI writes
 
 - adt7411: document supported sysfs attributes
 
 - adt7462: Add of_match_table to support devicetree
 
 - adt7475: Add explicit header include
 
 - coretemp; Fix outdated documentation, coding style issues, and
   replace hardcoded core count with dynamic value
 
 - cros_ec: Drop unused assignment of platform_device_id driver data
 
 - emc2305: Fix fan channel index handling
 
 - gpd-fan: Reject EC PWM value 0 as invalid, fix race condition between
   device removal and sysfs access, upgrade log level from warn to err for
   platform device creation failure, initialize EC before registering hwmon
   device, drop global driver data and use per-device allocation
 
 - htu31: document debugfs serial_number
 
 - ina238: Add support for samples and update_interval
 
 - it87: Clamp negative values to zero in set_fan()
 
 - lm75: Add explicit header include, Add explicit default cases in
   lm75_is_visible(), and add section for sysfs interface to documentation
 
 - pmbus/lm25066: Fix PMBus coefficients for LM5064/5066/5066i
 
 - tmp102: Use device_property_read_string API
 
 - tmp401: Read "ti,n-factor" as signed
 
 - Convert zyxel,nsa320-mcu to DT schema
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEiHPvMQj9QTOCiqgVyx8mb86fmYEFAmowFrQACgkQyx8mb86f
 mYHgww/7B620RT1wqLdMizetj/nvYx83LFfBWQTljwCJaOHpX+1Ym1gTQpItNuec
 k0OdgkhoEzlemvo4CCNl6rKwH8WYyGcDrXkS8mPDKcbaDPT9c9SSXkzbsTSeNOFc
 N+PVjy1GA3h3uVxS9eG1+BVXpY4MGnDwN1zfGBZY0XjEzxzw9YIee3qQ6AncHAjn
 6x0n3H3p0B3uZaazyC+6Po1OH3BbvI1mgVAbhYlkf8Z9QAzLggEZWCmM7WtsqQip
 Jd9wsCGq3t6q+tKWOt955DxNEMj97QEHo4LhVQ5Ezr5wQ7GTHv9k8Ygswb+wVYNB
 OUK8pCVZJ2E6IFF6m2O2jJyzscijGGT9cifnJkopvk01Z1kTGggs8W2gQwlhE10T
 ir3gT6fAUoVy/R+t2Tqj633UiBNW3OofzwwhJ9W5m2Kej64W9KFp+2R1VageaPU2
 7J96Kdc8OUipaTf11XoqUR1JtiIvOg/UMEMgGwR3ihMjW6/tEq0hBWIGiNlY50ZK
 NdricCRKN3ujWvNSQRFoQl32UWuGONhE1P0bAvitmrMKyitYsEQMMFXm7ja5xqZO
 OogVAEaakzjqtMFk7MbZpBkYHYndtaDMu2L0HytlFifCvUqiqCqjmHBKzxk6zHPs
 +j6VP62fQ5iVffu6lpn0N505vtbon19JEP8JKB5JSJDgcAHUBJA=
 =mDMd
 -----END PGP SIGNATURE-----

Merge tag 'hwmon-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging

Pull hwmon updates from Guenter Roeck:
 "New drivers for the following chips:
   - Analog Devices LTC4283 Swap Controller
   - Analog Devices MAX20830
   - Analog Devices MAX20860A
   - ARCTIC Fan Controller
   - Delta E50SN12051
   - Luxshare LX1308
   - Microchip EMC1812/13/14/15/33
   - Monolithic MP2985
   - Murata D1U74T PSU

  New chip support added to existing drivers:
   - asus-ec-sensors: Support for ROG MAXIMUS Z790 EXTREME, ROG STRIX
     B850-E GAMING WIFI, and ROG STRIX B650E-E GAMING WIFI
   - dell-smm: Add Dell Latitude 7530 to fan control whitelist
   - nct6683: Support for ASRock Z890 Pro-A
   - pmbus: Support for Flex BMR316, BMR321, BMR350 and BMR351
   - pmbus/max34440: Support for ADPM12250
   - pmbus/xdp720: Support for Infineon xdp730, and fix driver issues
     reported by Sashiko

  New functionality:
   - Add support for update_interval_us chip attribute, and support it
     in ina238 driver
   - Add support for guard() and scoped_guard() for subsystem locks, and
     use it in adt7411, ina2xx, and lm90 drivers
   - emc2305: Support configurable fan PWM at shutdown
   - lm63: Expose PWM frequency and LUT hysteresis as writable
   - lm75: Support active-high alert polarity
   - nct7802: Add time step attributes for tweaking responsiveness
   - pmbus/adm1266: Add rtc debugfs entries for rtc, powerup_counter,
     clear_blackbox, and firmware_revision
   - raspberrypi: Fix delayed-work teardown race, add voltage input
     support as well as voltage domain IDs
   - mcp9982: Add support for reporting external diode faults

  Miscellaneous bug fixes, changes and improvements:
   - Use named initializers for platform_device_id arrays and
     i2c_device_data, and remove unused driver data
   - Various drivers: Move MODULE_DEVICE_TABLE next to the table itself
   - ads7871: Convert to hwmon_device_register_with_info(), and use
     DMA-safe buffer for SPI writes
   - adt7411: document supported sysfs attributes
   - adt7462: Add of_match_table to support devicetree
   - adt7475: Add explicit header include
   - coretemp; Fix outdated documentation, coding style issues, and
     replace hardcoded core count with dynamic value
   - cros_ec: Drop unused assignment of platform_device_id driver data
   - emc2305: Fix fan channel index handling
   - gpd-fan: Reject EC PWM value 0 as invalid, fix race condition
     between device removal and sysfs access, upgrade log level from
     warn to err for platform device creation failure, initialize EC
     before registering hwmon device, drop global driver data and use
     per-device allocation
   - htu31: document debugfs serial_number
   - ina238: Add support for samples and update_interval
   - it87: Clamp negative values to zero in set_fan()
   - lm75: Add explicit header include, Add explicit default cases in
     lm75_is_visible(), and add section for sysfs interface to
     documentation
   - pmbus/lm25066: Fix PMBus coefficients for LM5064/5066/5066i
   - tmp102: Use device_property_read_string API
   - tmp401: Read "ti,n-factor" as signed
   - Convert zyxel,nsa320-mcu to DT schema"

* tag 'hwmon-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (81 commits)
  hwmon: tmp401: Read "ti,n-factor" as signed
  hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i
  hwmon: (gpd-fan) Reject EC PWM value 0 as invalid
  hwmon: (dell-smm) Add Dell Latitude 7530 to fan control whitelist
  hwmon: temperature: add support for EMC1812
  dt-bindings: hwmon: temperature: add support for EMC1812
  hwmon: (gpd-fan): fix race condition between device removal and sysfs access
  hwmon: (gpd-fan): upgrade log level from warn to err for platform device creation failure
  hwmon: (gpd-fan): Initialize EC before registering hwmon device
  hwmon: (gpd-fan): drop global driver data and use per-device allocation
  hwmon: (pmbus/max34440): add support adpm12250
  hwmon: (ina238) Add update_interval_us attribute
  hwmon: Add update_interval_us chip attribute
  hwmon: (ina238) Add support for samples and update_interval
  gpio: gpio-ltc4283: Add support for the LTC4283 Swap Controller
  hwmon: ltc4283: Add support for the LTC4283 Swap Controller
  dt-bindings: hwmon: Document the LTC4283 Swap Controller
  hwmon: (pmbus/xdp720) Fix driver issues xdp720/730
  hwmon: (pmbus/xdp720) Add support for efuse xdp730
  dt-bindings: hwmon/pmbus: Add Infineon xdp730
  ...
 2026-06-16 08:10:21 +05:30
Linus Torvalds
7e54cdd056 watchdog updates and fixes for v7.2 
* subsystem
 
 - Unregister PM notifier on watchdog unregister
 
 - Various documentation fixes and improvements
 
 * Removed drivers
 
 - Remove AMD Elan SC520 processor watchdog driver
 - Drop SMARC-sAM67 support
 - Remove driver for integrated WDT of ZFx86 486-based SoC
 
 * New drivers
 
 - Driver for Andes ATCWDT200
 
 - Driver for Gunyah Watchdog
 
 * Added support to existing drivers
 
 - Add "apple,t8103-wdt" and "apple,t8122-wdt" compatibles to Apple
   watchdog driver
 
 - Add rockchip,rk3528-wdt and rockchip,rv1103b-wdt to snps,dw-wdt.yaml
 
 - Document IPQ9650, IPQ5210, Shikra, Nord, and Hawi in qcom-wdt.yaml
   Also document sram property and add support to get the bootstatus
   to qcom wdt driver
 
 - lenovo_se10_wdt: Fix use-after-rfree and add support for SE10 Gen 2
   platform
 
 - ti,rti-wdt: Add ti,am62l-rti-wdt compatible
 
 - renesas: Document RZ/G3L support and rework example for
   renesas,r9a09g057-wdt
 
 * Other bug fixes and improvements
 
 - Use named initializers (sc1200, ziirave_wdt)
 
 - Allow pic32-dmt and pic32-wdt to be built with COMPILE_TEST
 
 - realtek-otto: enable clock before using I/O, and prevent PHASE2 underflows
 
 - rti_wdt: Add reaction control
 
 - renesas,rzn1-wdt: Drop interrupt support and other cleanup
 
 - gpio_wdt: Add ACPI support
 
 - imx7ulp_wdt: Keep WDOG running until A55 enters WFI on i.MX94
 
 - sprd_wdt: Remove redundant sprd_wdt_disable() on register failure
 
 - bcm2835_wdt: Switch to new sys-off handler API
 
 - sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5
 
 - hpwdt: Refine hpwdt message for UV platform
 
 - Convert TS-4800 bindings to DT schema
 
 - menz069_wdt: drop unneeded MODULE_ALIAS
 
 - sp5100_tco: Use EFCH MMIO for newer Hygon FCH
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEiHPvMQj9QTOCiqgVyx8mb86fmYEFAmowBcsACgkQyx8mb86f
 mYEbpQ/+PAN/6V5DhDecXLEpb3hf7eX0NXykvrx9IqQKm7By1rrW5TjbjqSUweuF
 9AwOjw1bV6oxvBNWo+CcEvlJiX1Agjdv7GQwBawqBf0goWmOro6BuDTFtNFKXxsc
 h1TaOUXMBjN9YZK1lyHTrhMd51Wx+ifAosqMoDBmzKdV5mQm3SM5C04xkr+MxqBN
 PAsHUKnHKqTVmq0+qnbpSES+Pv5n+IsnoeMHylu0fCpTosd7EWCBn03WQjBZpsI6
 6ISOWP7Vthbu2Ae+m+X07TUHbEYZ9mOQi3kFCjEhjehurdTriyiiBeHk8V/3e1Ax
 mH1RezC7gVM1+tmGfQlfWjskYueds0GPUOYdgI3IhB0lYwdGFvxY7u6WaYs2egv1
 qsMrgTOSGEHbK/rBPZ/JDYC3lf35ueTuFmAW5NUhB40jQ0YVR6N8vDVbRm/1mBL4
 FwrBz94Nwvi4lsS1enG7HYwQtQMtJA7iFFs1lDtOl5Lj0EzOTQwUzIMnyQ1pUZOr
 ovL/2HgP1TtKiPPAFSfiDWGHin+rZQcrrMKRZ8vHseKS89LPrpv1WiI1ZEM3Q3T2
 2mfDuQp+6u/dEUtViv0BGqHY0XNE6qjRxsK5j9NuF4KvdXplHUgY3JCz/sWCI5rw
 t/aWt0hgSBs7xFeaCBjYW6ciCKfoY8CGq1z7nCwYhGkX46rc93Q=
 =macd
 -----END PGP SIGNATURE-----

Merge tag 'watchdog-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging

Pull watchdog updates and fixes from Guenter Roeck:
 "Subsystem:
   - Unregister PM notifier on watchdog unregister
   - Various documentation fixes and improvements

  Removed drivers:
   - Remove AMD Elan SC520 processor watchdog driver
   - Drop SMARC-sAM67 support
   - Remove driver for integrated WDT of ZFx86 486-based SoC

  New drivers:
   - Driver for Andes ATCWDT200
   - Driver for Gunyah Watchdog

  Added support to existing drivers:
   - Add "apple,t8103-wdt" and "apple,t8122-wdt" compatibles to Apple
     watchdog driver
   - Add rockchip,rk3528-wdt and rockchip,rv1103b-wdt to snps,dw-wdt.yaml
   - Document IPQ9650, IPQ5210, Shikra, Nord, and Hawi in qcom-wdt.yaml
     Also document sram property and add support to get the bootstatus
     to qcom wdt driver
   - lenovo_se10_wdt: Fix use-after-rfree and add support for SE10 Gen 2
     platform
   - ti,rti-wdt: Add ti,am62l-rti-wdt compatible
   - renesas: Document RZ/G3L support and rework example for
     renesas,r9a09g057-wdt

  Other bug fixes and improvements:
   - Use named initializers (sc1200, ziirave_wdt)
   - Allow pic32-dmt and pic32-wdt to be built with COMPILE_TEST
   - realtek-otto: enable clock before using I/O, and prevent PHASE2 underflows
   - rti_wdt: Add reaction control
   - renesas,rzn1-wdt: Drop interrupt support and other cleanup
   - gpio_wdt: Add ACPI support
   - imx7ulp_wdt: Keep WDOG running until A55 enters WFI on i.MX94
   - sprd_wdt: Remove redundant sprd_wdt_disable() on register failure
   - bcm2835_wdt: Switch to new sys-off handler API
   - sama5d4_wdt: Fix WDDIS detection on SAM9X60 and SAMA7G5
   - hpwdt: Refine hpwdt message for UV platform
   - Convert TS-4800 bindings to DT schema
   - menz069_wdt: drop unneeded MODULE_ALIAS
   - sp5100_tco: Use EFCH MMIO for newer Hygon FCH"

* tag 'watchdog-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (58 commits)
  watchdog: sc1200: Drop unused assignment of pnp_device_id driver data
  watchdog: unregister PM notifier on watchdog unregister
  dt-bindings: watchdog: qcom-wdt: Document IPQ5210 watchdog
  watchdog: dev: convert to kernel-doc comments
  watchdog: core: clean up some comments
  watchdog: uapi: add comments for what bit masks apply to
  watchdog: linux/watchdog.h: repair kernel-doc comments
  watchdog: add devm_watchdog_register_device() to watchdog-kernel-api
  watchdog: ziirave_wdt: Use named initializers for struct i2c_device_id
  watchdog: realtek-otto: enable clock before using I/O
  watchdog: realtek-otto: prevent PHASE2 underflows
  dt-bindings: watchdog: qcom-wdt: Document IPQ9650 watchdog
  dt-bindings: watchdog: renesas,rzn1-wdt: interrupts are not required
  dt-bindings: watchdog: apple,wdt: Add t8122 compatible
  watchdog: apple: Add "apple,t8103-wdt" compatible
  watchdog: rzn1: remove now obsolete interrupt support
  dt-bindings: watchdog: Add watchdog compatible for RK3528
  watchdog: convert the Kconfig dependency on OF_GPIO to OF
  watchdog: Remove AMD Elan SC520 processor watchdog driver
  watchdog: lenovo_se10_wdt: Fix use-after-free and resource leak risk
  ...
 2026-06-16 08:04:24 +05:30
Linus Torvalds
c41cfae42c spi: Updates for v7.2 
This has been quite a busy release, mainly due to the subsystem wide
 work Johan Hovold has done to modernise resource allocation for the
 subsystem on probe, the subsystem did some very clever allocation
 management pre devm which didn't quite mesh comfortably with managed
 allocations and made it far too easy to introduce error handling and
 removal bugs.
 
  - Cleanup and simplification of controller struct allocation, moving
    everything over to devm and making the devm APIs more robust, from
    Johan Hovold
  - Support for spi-mem devices that don't assert chip select and support
    for a secondary read command for memory mapped flashes, some commits
    for this are shared with mtd.
  - Support for SpacemiT K1.
 
 There will be a simple add/add conflict with the i2c-host tree in the
 x86 quirk data in drivers/acpi/acpi_apd.c.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmowLx0ACgkQJNaLcl1U
 h9BiuAf/bSzTrdeSLpQyQh/UxCKnl4joFtpyb9SValB/32oSTx9YecNYLDxA2z1L
 3dkEPBRGBcGjGCINDQldJM/WMMRT0JKG58aWluF3YNPshKN7qK18iNQxbeN9Dh8F
 qykmyWZ7wnLks03UCVm7be9kl2UHs4JJ+oRoHq0+6ktS7o+BrIzgJweprmTBmyB4
 rRigCbPSL2BNBZnNvWqrZSYeqWHnonGYabhogaSJnhmeJTkSfKE6mugE8qmGzi+O
 ZGeWsTdq270WU1omDZRy/PQQ3YLoLU2lUCGuHWTrT/98sGIJjkYV7UfE58GJwzpi
 d1N+y8unL0R5HgSkMM4B+f/4OL3VoA==
 =1zbv
 -----END PGP SIGNATURE-----

Merge tag 'spi-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi

Pull spi updates from Mark Brown:
 "This has been quite a busy release, mainly due to the subsystem wide
  work Johan Hovold has done to modernise resource allocation for the
  subsystem on probe, the subsystem did some very clever allocation
  management pre devm which didn't quite mesh comfortably with managed
  allocations and made it far too easy to introduce error handling and
  removal bugs.

   - Cleanup and simplification of controller struct allocation, moving
     everything over to devm and making the devm APIs more robust, from
     Johan Hovold

   - Support for spi-mem devices that don't assert chip select and
     support for a secondary read command for memory mapped flashes,
     some commits for this are shared with mtd.

   - Support for SpacemiT K1"

* tag 'spi-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (118 commits)
  spi: Fix mismatched DT property access types
  spi: xilinx: use FIFO occupancy register to determine buffer size
  spi: spi-mem: Fix spi_controller_mem_ops kdoc
  spi: xilinx: let transfers timeout in case of no IRQ
  spi: dt-bindings: nuvoton,npcm750-fiu: Convert to DT schema
  spi: meson-spifc: fix runtime PM leak on remove
  spi: Use named initializers for platform_device_id arrays
  spi: rzv2h-rspi: Add suspend/resume support
  spi: dw-pci: remove redundant pci_free_irq_vectors() calls
  spi: ep93xx: fix double-free of zeropage on DMA setup failure
  spi: cadence-xspi: Revert COMPILE_TEST support
  spi: cadence-xspi: Support 32bit and 64bit slave dma interface
  spi: tegra210-quad: Allocate DMA memory for DMA engine
  spi: imx: replace dmaengine_terminate_all() with dmaengine_terminate_sync()
  spi: fsl-lpspi: terminate the RX channel on TX prepare failure path
  spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync()
  spi: atmel: fix DMA channel and bounce buffer leaks
  spi: omap2-mcspi: Use of_device_get_match_data()
  spi: Use named initializers for arrays of i2c_device_data
  spi: aspeed: Replace VLA parameter with flat pointer in calibration helper
  ...
 2026-06-16 07:56:47 +05:30
Linus Torvalds
1e66d46f6d regulator: Updates for v7.2 
The development of the regulator subsystem continues to be quite quiet,
 we've got several new devices, removal of one old device and some kernel
 wide cleanup of platform devices but nothing in the core.
 
  - Cleanups of platform_device_id usage.
  - Filling out and fixing of the description of the MediaTek MT6359
  - Removal of the PCAP regulator driver, the MFD has been removed.
  - New device support for Qualcomm Nord RPMH, PM8109, PM8150 and
    PMAU0102, and SG Micro SGM3804.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmowBwMACgkQJNaLcl1U
 h9C39Qf/bQbsFwOOajnciGePTbn+0NiepkVr8H6+lYYt50oHI9olsvhiIE957x1h
 OR8pYIFcH+ct7fZMJxr0BpET9GmEbx4J0jdZ3dHP4sZUX4td/Ur9XoCsz23nFckD
 lx1VcYo1C3er+/pP5JMueELRB0S5QiJ1RtE2xP7/c3Vv2mqfZJ4bbacohjPYFfsc
 T/z+Is1sB1Bjk+CEs590CkduKw5ElXy+iwt7e7oZYsWZy66CCvmCPlk27Z9mAEYM
 4zLtnNfJyzdeapdadN49Y995mmqp/8Wk9mCYyjcakgAMXDVoYNf8fZLasixy7+zo
 4xbpSs8tFhsoB+4XU1bIlgXkzpRAFA==
 =NKM3
 -----END PGP SIGNATURE-----

Merge tag 'regulator-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator

Pull regulator updates from Mark Brown:
 "The development of the regulator subsystem continues to be quite
  quiet, we've got several new devices, removal of one old device and
  some kernel wide cleanup of platform devices but nothing in the core.

   - Cleanups of platform_device_id usage

   - Filling out and fixing of the description of the MediaTek MT6359

   - Removal of the PCAP regulator driver, the MFD has been removed

   - New device support for Qualcomm Nord RPMH, PM8109, PM8150 and
     PMAU0102, and SG Micro SGM3804"

* tag 'regulator-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (23 commits)
  regulator: dt-bindings: mt6311: Convert to DT schema
  regulator: qcom_smd-regulator: Add PM8019
  regulator: dt-bindings: qcom,smd-rpm-regulator: Add PM8019
  regulator: mt6359: Fix vbbck default internal supply name
  regulator: bq257xx: drop confusing configuration of_node
  regulator: Unify usage of space and comma in platform_device_id arrays
  regulator: Use named initializers for platform_device_id arrays
  regulator: Drop unused assignment of platform_device_id driver data
  regulator: scmi: fix of_node refcount leak in scmi_regulator_probe()
  regulator: remove used pcap regulator driver
  regulator: add SGM3804 Dual Output driver
  regulator: dt-bindings: document the SGM3804 Dual Output regulator
  regulator: mt6359: Add proper ldo_vcn33_[12] regulators
  regulator: mt6359: Add regulator supply names
  regulator: mt6359: const-ify regulator descriptions
  regulator: dt-bindings: mt6359: Deprecate bogus vcn33_[12]_* split regulators
  regulator: dt-bindings: mt6359: Drop regulator-name pattern restrictions
  regulator: palmas: Move MODULE_DEVICE_TABLE next to the table itself
  regulator: qcom_smd: Add PM8150 regulators
  regulator: dt-bindings: qcom,smd-rpm-regulator: Document PM8150 IC
  ...
 2026-06-16 07:50:31 +05:30
Linus Torvalds
aaee7820e2 regmap: Update for v7.2 
This time around we just have a single fix for a sparse warning.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmov92wACgkQJNaLcl1U
 h9Dojwf+LMYo+n8YqxjOvmvQHGiRnGSH0BdEdadN4k/5j0DY+B7AqH5gPpXWoSzz
 hdXscBgwVPz44qlm2dhlbO4ZS2mZzppzBMZ2asvnwNpQ5+UcFYpmkrHPz8FdpaLb
 D496NX3tdxTFDjnWUK88oBnbAbyB5u4BB2wlHa3WoPz9zrpbjMZggLGSsByRt88Q
 g1QLenUGaSIlPIS2CgNdDqqCSzzVnkDVX0gL8xhFVt29lSKk/N81PGf1RRajCYKt
 E9dPPzIsKPcFU7WOtxX73UO4SVhyAxk1hoiTZzuWFCaU3rUUbw2ha1wEEjMH7YCo
 gwzOb+3or4FK+ILyp+9NSuXkhrDjeg==
 =hGZr
 -----END PGP SIGNATURE-----

Merge tag 'regmap-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap

Pull regmap update from Mark Brown:
 "This time around we just have a single fix for a sparse warning"

* tag 'regmap-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
  regmap-i2c: fix sparse warning in regmap_smbus_word_write_reg16
 2026-06-16 07:48:30 +05:30
Linus Torvalds
2779759c09 i2c for v7.2 
Two major cleanup across drivers and core code:
  - use named initializers in device ID tables
  - replace dev_err() with dev_err_probe()
 
 Drivers:
 - at24: use named initializers for arrays of i2c_device_data
 - at91: add MCHP_LAN966X_PCI dependency
 - cadence: add shutdown callback
 - k1: enable by default on SpacemiT
 - mxs: improve documentation
 - qcom-geni: use pm_runtime_force_suspend/resume for system sleep
 - tegra:
    - disable fair arbitration on non-MCTP buses
    - allocate DMA buffers from the correct DMA device
 - designware:
    - handle active target shutdown cleanly
    - add shutdown callbacks for platform and PCI drivers
    - adopt the new PM_RUNTIME_ACQUIRE() helpers
 
 DT bindings:
 - convert davinci bindings to DT schema
 
 Core and muxes:
 - acpi: report missing I2C resources as -ENOENT
 - gpiolib: add gpiod_is_single_ended() helper for I2C GPIO users
 - i2c-mux-reg: add generic firmware node support
 - a set of 10 patches from Johan Hovold fixing adapter
   registration races, cleanup paths and resource management
   issues
 
 New support:
 - DesignWare LECA0003 (ACPI ID)
 - Loongson LS2K0300 I2C controller (new driver)
 - Qualcomm CCI Glymur and Shikra compatibles
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQScDfrjQa34uOld1VLaeAVmJtMtbgUCai/V1gAKCRDaeAVmJtMt
 bse9AQDssuI+jeF6X/UGddy926zIie+YuVITcBzObT+3MSQSzQD9E1HZTRJeuqA/
 dRS6Thf0k4VpES8ecF6NxifZJIS4VgQ=
 =GUmn
 -----END PGP SIGNATURE-----

Merge tag 'i2c-7.2-part1' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux

Pull i2c updates from Andi Shyti:
 "This pull request is mostly made of cleanups and small infrastructure
  improvements across the I2C core, drivers and bindings. It also adds
  support for three drivers and a few new compatibles.

  Two major cleanup across drivers and core code:
   - use named initializers in device ID tables
   - replace dev_err() with dev_err_probe()

  Drivers:
   - at24: use named initializers for arrays of i2c_device_data
   - at91: add MCHP_LAN966X_PCI dependency
   - cadence: add shutdown callback
   - k1: enable by default on SpacemiT
   - mxs: improve documentation
   - qcom-geni: use pm_runtime_force_suspend/resume for system sleep
   - tegra:
       - disable fair arbitration on non-MCTP buses
       - allocate DMA buffers from the correct DMA device
   - designware:
       - handle active target shutdown cleanly
       - add shutdown callbacks for platform and PCI drivers
       - adopt the new PM_RUNTIME_ACQUIRE() helpers

  DT bindings:
   - convert davinci bindings to DT schema

  Core and muxes:
   - acpi: report missing I2C resources as -ENOENT
   - gpiolib: add gpiod_is_single_ended() helper for I2C GPIO users
   - i2c-mux-reg: add generic firmware node support
   - a set of 10 patches from Johan Hovold fixing adapter registration
     races, cleanup paths and resource management issues

  New support:
   - DesignWare LECA0003 (ACPI ID)
   - Loongson LS2K0300 I2C controller (new driver)
   - Qualcomm CCI Glymur and Shikra compatibles"

* tag 'i2c-7.2-part1' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux: (46 commits)
  i2c: mxs: add missing kernel-doc for struct mxs_i2c_dev members
  i2c: qcom-geni: Use pm_runtime_force_{suspend,resume} helpers
  dt-bindings: i2c: qcom-cci: Document Glymur compatible
  dt-bindings: i2c: qcom-cci: Document Shikra compatible
  i2c: mux: reg: use device property accessors
  i2c: acpi: Return -ENOENT when no resources found in i2c_acpi_client_count()
  i2c: at91: Add MCHP_LAN966X_PCI dependency
  i2c: eg20t: Consistently define pci_device_ids using named initializers
  i2c: designware-pcidrv: Consistently define pci_device_ids using named initializers
  i2c: bcm-kona: fix spelling mistake in timeout-check comment
  i2c: cadence: Add shutdown handler
  i2c: tegra: Disable fair arbitration for non-MCTP buses
  i2c: tegra: use dmaengine_get_dma_device() for DMA buffer allocation
  i2c: busses: make K1 driver default for SpacemiT platforms
  i2c: Use named initializers for arrays of i2c_device_data
  i2c: core: clean up adapter registration error label
  i2c: core: clean up bus id allocation
  i2c: core: fix adapter deregistration race
  i2c: core: fix adapter registration race
  i2c: core: disable runtime PM on adapter registration failure
  ...
 2026-06-16 07:43:29 +05:30
Linus Torvalds
31e6aeafcd power sequencing updates for v7.2-rc1 
Power Sequencing core:
 - Add a helper allowing consumers to access the struct device object
   associated with a pwrseq provider
 - Print the power sequencing device's parent in debugfs to add more
   debugging information
 
 Driver updates:
 - Extend/rework the M.2 power sequencing driver in order to allow it to
   support more M.2 cards, not just WCN7850
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEkeUTLeW1Rh17omX8BZ0uy/82hMMFAmovtaoACgkQBZ0uy/82
 hMMd+Q/9GRUyh5GW5PPZfWYxTps7riq7frye71DSg8ldUbWggaQcVGn04zjA8r09
 +w6uwPzq8Bnkzi8x4ZhKSJk7qsj9FHNJzOp6B/+j6aeE7vTV4X7QAHnF57Wa4R2L
 rae0Ub3AyqXzzyquDufuwND8HL8vTsbrxK3yYRCn9s2LjHyI7pZUUdo6K2t8nduu
 Hlw9rCWJjom7s2kJuFakoPf6K+KVieMWm5xp5j6vy1CYrgAiN27R2mLMG53fjLND
 LUhaoIyQM/Vly2Dtwe3GaqIbx74qBb41AWBMWkcTIn16q7YKonHg/3+sz3EVH2qE
 w0/fch4codv5Ldvu/M1IRtOeGzrS5InbwpGr67VBbHZMOvHXacKoEHDrk5vmX3uA
 Yr7G61R2NDtd1DQjkYTLETAzxQgzh14AB9VIwJT5b1yQaDAoEzdHSlYIUpLcQn1z
 MleZVwcYBJplDTWR4wsn9QsQFgIXoL9f58hcTvETQwzJJArgH8zOnH1enyZxIvT6
 fpQJivGAixyt/t8GUtUTnhHpTdr1ZNe7LAncKmVGM6ITw9n8w4JhpkspFyMp+TQW
 HajdZHEeHwP4kvQ5WzuTlpSyprPqnGWrMkuWzoNzAXpXOZP2+QAjMX0nHTegqRv8
 ysEhBiD3QpfPZuV6yPmHj4cbVIXH9lIAjodRvWKylYCFGzEPLYk=
 =Hwkw
 -----END PGP SIGNATURE-----

Merge tag 'pwrseq-updates-for-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux

Pull power sequencing updates from Bartosz Golaszewski:
 "A set of extensions to the M.2 pwrseq driver allowing it to work with
  more cards than just the one from Qualcomm we supported initially.
  There's also a tweak to debugfs output and a new function that will be
  used by a bluetooth driver in the next cycle.

  Power Sequencing core:

   - Add a helper allowing consumers to access the struct device object
     associated with a pwrseq provider

   - Print the power sequencing device's parent in debugfs to add more
     debugging information

  Driver updates:

   - Extend/rework the M.2 power sequencing driver in order to allow it
     to support more M.2 cards, not just WCN7850"

* tag 'pwrseq-updates-for-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
  power: sequencing: pcie-m2: Add PCI ID 0x1103 for WCN6855 Bluetooth
  power: sequencing: Add an API to return the pwrseq device's 'dev' pointer
  power: sequencing: pcie-m2: Create BT node based on the pci_device_id[] table
  power: sequencing: pcie-m2: Create serdev for PCI devices present before probe
  power: sequencing: pcie-m2: Improve PCI device ID check
  power: sequencing: pcie-m2: Allow creating serdev for multiple PCI devices
  power: sequencing: pcie-m2: Fix inconsistent function prefixes
  power: sequencing: print power sequencing device parent in debugfs
 2026-06-16 07:38:04 +05:30
David Yang
72dfa4700f net: dsa: sja1105: fix lastused timestamp in flower stats 
flow_stats_update() takes an absolute timestamp for lastused, not delta.
Fix that.

Signed-off-by: David Yang <mmyangfl@gmail.com>
Link: https://patch.msgid.link/20260614141320.1133321-1-mmyangfl@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2026-06-15 19:01:48 -07:00
Arnd Bergmann
57a6ed0b41 scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block() 
bfa_fcs_fdmi_get_portattr() gets inlined into multiple places and has
two fairly large variables on the stack, to the point of causing a
warning in some randconfig builds:

drivers/scsi/bfa/bfa_fcs_lport.c:2198:1: error: stack frame size (1560) exceeds limit (1280) in 'bfa_fcs_lport_fdmi_build_portattr_block' [-Werror,-Wframe-larger-than]
 2198 | bfa_fcs_lport_fdmi_build_portattr_block(struct bfa_fcs_lport_fdmi_s *fdmi,
      | ^
drivers/scsi/bfa/bfa_fcs_lport.c:1856:1: error: stack frame size (1600) exceeds limit (1280) in 'bfa_fcs_lport_fdmi_build_rhba_pyld' [-Werror,-Wframe-larger-than]
 1856 | bfa_fcs_lport_fdmi_build_rhba_pyld(struct bfa_fcs_lport_fdmi_s *fdmi, u8 *pyld)
      | ^

Mark the inner function as noinline_for_stack to keep it separate from
the other variables and prevent multiple copies of the same variable to
get inlined here.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://patch.msgid.link/20260611125601.3385418-1-arnd@kernel.org
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
 2026-06-15 22:01:26 -04:00
Linus Torvalds
77d084d66b gpio updates for v7.2-rc1 
GPIO core:
 - Add an initial set of kunit test cases for the GPIO subsystem
 - Use the devres owner as the GPIO chip's parent in absence of any other
   parent
 - Fix const-correctness of GPIO chip SRCU guards
 - Provide new GPIO consumer interfaces: gpiod_is_single_ended() and
   fwnode_gpiod_get()
 - Quarantine all legacy GPIO APIs in linux/gpio/legacy.h
 - Use __ro_after_init where applicable
 
 New drivers:
 - Add driver for the GPIO controller on Waveshare DSI TOUCH panels
 
 Removed drivers:
 - Remove the obsolete ts5500 GPIO driver
 
 Driver updates:
 - Modernize gpio-timberdale: remove platform data support and use generic
   device property accessors
 - Extend test build coverage by enabling COMPILE_TEST for more GPIO
   drivers
 - Add some missing dependencies in Kconfig
 - Add support for sparse fixed direction to gpio-regmap
 - Remove dead code from gpio-nomadik
 - use BIT() in gpio-mxc
 - use bitmap_complement() in gpio-xilinx and gpio-pca953x
 - Use more appropriate printing functions where applicable
 - Use named initializers for platform_device_id and i2c_device_id arrays
 - Convert gpio-altera to using the generic GPIO chip helper library
 - Add support for new models to gpio-dwapb, gpio-zynq, gpio-usbio and
   gpio-tegra186
 - Unify the naming convention for Qualcomm in GPIO drivers
 - Fix interrupt bank mapping to GPIO chips in gpio-mt7621
 - Add support for the lines-initial-states property to gpio-74x164
 - Switch to using dynamic GPIO base in gpio-ixp4xx
 - Move the handling of an OF quirk from ASoC to gpiolib-of.c where other
   such quirks live
 - Use handle_bad_irq() in gpio-ep93xx
 - Some other minor tweaks and refactorings
 
 Devicetree bindings:
 - Document the Waveshare GPIO controller for DSI TOUCH panels
 - Document new models: Tegra238 in gpio-tegra186 and EIO GPIO in gpio-zynq
 - Add new properties for gpio-dwapb and fairchild,74hc595
 - Fix whitespace issues
 - Sort compatibles alphabetically in gpio-zynq
 
 Documentation:
 - Fix kerneldoc warnings in gpio-realtek-otto
 
 Misc:
 - Attach software nodes representing GPIO chips to the actual struct
   device objects associated with them in some legacy platforms enabling
   real firmware node lookup instead of string matching
 - Drop unneeded dependencies on OF_GPIO from bus and staging drivers
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEkeUTLeW1Rh17omX8BZ0uy/82hMMFAmovs6IACgkQBZ0uy/82
 hMNGIRAAj5dQALT1UfZ7jYRXR035CvQU1Sdn3O+0Y+r10eBdRaT573iI9IRDmoiu
 KOVoYdOD5mBP+nTYK6De88MTqm3kSDPnN6+fNlNv1dLz6tGyV30mmS1Ub0S4SrC/
 fKQJlj41EL+T/cK304KgQ3u0PpqS7lxSr8/3II5tIii0ED5uXN/t66IuZ4ztCA4p
 6F6WK4DNsxRs5HFGnVaoZjB45KiH6LqDzLqZb+OBVpETGSK4gRzXiHsVVqPUFZAr
 IkPDTrhE9jyGUr54HWFCCVL05K/yMoUlcFGiohxgpZNA2Vmzi0GvoVZBHcqZs1Bg
 EEG114QzqEjLLpvBaJidlBMJafrUB11prlUpkkjjceqJlakWlCDWfBsi3T9rRA27
 R7eBQ0XqDOMoMcFCKHkJVajkPK/rqFMz5LU9+AyXOXkGYO8VI6+6u8ylJY3CjZeB
 ziR5CE9Ly7WDO08CO3UlrVWvNQzh7BUQK/yoP+cRWUbPEP/NV6Jz2yfK5CDMlCDl
 4UYyxYnjaqUFx74TpFB2GtcA61Sqvy2EAATe6UL4uQcGrT16lDqiAJA0kYGChzjc
 4KvQBPen8ESb4n/zjfNdXOtCNxPm7JIFNjXPFuw62+w7qGKtDwDZUcr6FF3cZYVL
 oeUThOj4dwpsl3Pbd56nJYBHsiPyvgrm4Fk5Gv4+f2biIHZCas0=
 =MzJz
 -----END PGP SIGNATURE-----

Merge tag 'gpio-updates-for-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux

Pull gpio updates from Bartosz Golaszewski:
 "There's one new driver, one legacy driver removed, a kunit test-suite
  for the GPIO core, support for new models in existing drivers and a
  slew of various changes in many places though I can't think of
  anything controversial that would stand out - it's been a relatively
  calm cycle.

  GPIO core:
   - Add an initial set of kunit test cases for the GPIO subsystem
   - Use the devres owner as the GPIO chip's parent in absence of any
     other parent
   - Fix const-correctness of GPIO chip SRCU guards
   - Provide new GPIO consumer interfaces: gpiod_is_single_ended() and
     fwnode_gpiod_get()
   - Quarantine all legacy GPIO APIs in linux/gpio/legacy.h
   - Use __ro_after_init where applicable

  New drivers:
   - Add driver for the GPIO controller on Waveshare DSI TOUCH panels

  Removed drivers:
   - Remove the obsolete ts5500 GPIO driver

  Driver updates:
   - Modernize gpio-timberdale: remove platform data support and use
     generic device property accessors
   - Extend test build coverage by enabling COMPILE_TEST for more GPIO
     drivers
   - Add some missing dependencies in Kconfig
   - Add support for sparse fixed direction to gpio-regmap
   - Remove dead code from gpio-nomadik
   - use BIT() in gpio-mxc
   - use bitmap_complement() in gpio-xilinx and gpio-pca953x
   - Use more appropriate printing functions where applicable
   - Use named initializers for platform_device_id and i2c_device_id
     arrays
   - Convert gpio-altera to using the generic GPIO chip helper library
   - Add support for new models to gpio-dwapb, gpio-zynq, gpio-usbio and
     gpio-tegra186
   - Unify the naming convention for Qualcomm in GPIO drivers
   - Fix interrupt bank mapping to GPIO chips in gpio-mt7621
   - Add support for the lines-initial-states property to gpio-74x164
   - Switch to using dynamic GPIO base in gpio-ixp4xx
   - Move the handling of an OF quirk from ASoC to gpiolib-of.c where
     other such quirks live
   - Use handle_bad_irq() in gpio-ep93xx
   - Some other minor tweaks and refactorings

  Devicetree bindings:
   - Document the Waveshare GPIO controller for DSI TOUCH panels
   - Document new models: Tegra238 in gpio-tegra186 and EIO GPIO in
     gpio-zynq
   - Add new properties for gpio-dwapb and fairchild,74hc595
   - Fix whitespace issues
   - Sort compatibles alphabetically in gpio-zynq

  Documentation:
   - Fix kerneldoc warnings in gpio-realtek-otto

  Misc:
   - Attach software nodes representing GPIO chips to the actual struct
     device objects associated with them in some legacy platforms
     enabling real firmware node lookup instead of string matching
   - Drop unneeded dependencies on OF_GPIO from bus and staging drivers"

* tag 'gpio-updates-for-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (62 commits)
  gpio: nomadik: remove dead DB8540 code from <gpio/gpio-nomadik.h>
  gpio: mt7621: fix interrupt banks mapping on gpio chips
  bus: ts-nbus: drop unneeded dependency on OF_GPIO
  staging: media: max96712: drop unneeded dependency on OF_GPIO
  gpiolib: Replace strcpy() with memcpy()
  gpio: remove obsolete UAF FIXMEs from lookup paths
  gpio: core: fix const-correctness of gpio_chip_guard
  gpio: mxc: use BIT() macro
  gpio: realtek-otto: fix kernel-doc warnings
  gpio: max77620: Unify usage of space and comma in platform_device_id array
  gpio: Use named initializers for platform_device_id arrays
  gpio: cros-ec: Drop unused assignment of platform_device_id driver data
  ARM: omap1: enable real software node lookup of GPIOs on Nokia 770
  ARM: omap1: use platform_device_register_full() for GPIO devices on OMAP 16xx
  ARM: omap1: drop unused variable from omap16xx_gpio_init()
  gpio: gpiolib: use seq_puts() for plain strings
  gpio: ts5500: remove obsolete driver
  gpio: add kunit test cases for the GPIO subsystem
  kunit: provide kunit_platform_device_unregister()
  kunit: provide kunit_platform_device_register_full()
  ...
 2026-06-16 07:30:52 +05:30
Jakub Kicinski
2c53418347 Merge branch 'extend-netkit-io_uring-zc-selftests' 
Daniel Borkmann says:

====================
Extend netkit io_uring ZC selftests

Small follow-up to the HW net selftests, in particular to add a
selftest showing that also large rx_buf_len for io_uring ZC is
supported with netkit queue leasing.
====================

Link: https://patch.msgid.link/20260614102607.863838-1-daniel@iogearbox.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2026-06-15 18:58:03 -07:00
Daniel Borkmann
74ac711839 selftests/net: Add hugepage kernel config dependency for zcrx 
test_iou_zcrx_large_buf in drivers/net/hw/nk_qlease.py runs iou-zcrx
with rx_buf_len > page size, backed by a hugepage-mapped area. Thus
add to the Kconfig.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com>
Link: https://patch.msgid.link/20260614102607.863838-5-daniel@iogearbox.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2026-06-15 18:58:01 -07:00
Daniel Borkmann
5024cfc8a3 selftests/net: Add netkit io_uring ZC test for large rx_buf_len 
Add test_iou_zcrx_large_buf, which runs iou-zcrx with rx_buf_len >
page size (-x 2) through a netkit-leased RX queue. The netkit ifindex
is opaque to io_uring, but rx_page_size is honoured by the leased
physical qops via netif_mp_open_rxq()'s lease redirect.

Originally, I also added a BIG TCP variant on top, but dropped it
here as fbnic (and the QEMU fbnic model) has no BIG TCP support
to exercise it as this point.

Tested against the QEMU fbnic emulation. The new test exercises
the > page rx_buf_len path only when the leased NIC advertises
QCFG_RX_PAGE_SIZE; otherwise it skips.

For fbnic, I used Bjorn's patches locally [0]:

  # ./nk_qlease.py
  TAP version 13
  1..5
  ok 1 nk_qlease.test_iou_zcrx
  ok 2 nk_qlease.test_iou_zcrx_large_buf
  ok 3 nk_qlease.test_attrs
  ok 4 nk_qlease.test_attach_xdp_with_mp
  ok 5 nk_qlease.test_destroy
  # Totals: pass:5 fail:0 xfail:0 xpass:0 skip:0 error:0

Without those patches (aka not advertising QCFG_RX_PAGE_SIZE):

  # ./nk_qlease.py
  TAP version 13
  1..5
  ok 1 nk_qlease.test_iou_zcrx
  ok 2 nk_qlease.test_iou_zcrx_large_buf # SKIP Large chunks are not supported -95
  ok 3 nk_qlease.test_attrs
  ok 4 nk_qlease.test_attach_xdp_with_mp
  ok 5 nk_qlease.test_destroy
  # Totals: pass:4 fail:0 xfail:0 xpass:0 skip:1 error:0

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com>
Link: https://lore.kernel.org/netdev/20260522113225.241337-1-bjorn@kernel.org/ [0]
Link: https://patch.msgid.link/20260614102607.863838-4-daniel@iogearbox.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2026-06-15 18:58:01 -07:00
Daniel Borkmann
96fda937b4 selftests/net: Use public NetDrvContEnv API in nk_qlease fixtures 
Expose the netkit host ifname as a public attribute nk_host_ifname
(symmetric with the already-public nk_guest_ifname), rename _attach_bpf
to a public attach_bpf, and add a public detach_bpf helper that
encapsulates the tc-filter teardown bookkeeping. Switch the fixtures
to this public API. No functional change and keeps pylint happy.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com>
Link: https://patch.msgid.link/20260614102607.863838-3-daniel@iogearbox.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2026-06-15 18:58:01 -07:00
Daniel Borkmann
bc5c25c8f6 selftests/net: Move netkit lease hw setup into per-test fixtures 
The HW counterpart of nk_qlease.py was carrying its lease setup in main()
and stashing src_queue / nk_queue / nk_*_ifname on cfg, which had drawbacks
called out during the review at [0].

This is the deferred half of the cleanup that landed in commit e254ffb950
("selftests/net: Split netdevsim tests from HW tests in nk_qlease") which
was the SW counterpart of nk_qlease.py.

While at it, convert the open-coded "ip netns exec" prefixes in the test
bodies over to the ns= argument of cmd() / bkg().

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com>
Link: https://lore.kernel.org/netdev/20260408162238.16709090@kernel.org/ [0]
Link: https://patch.msgid.link/20260614102607.863838-2-daniel@iogearbox.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2026-06-15 18:58:00 -07:00
Linus Torvalds
6b617c8258 pwm: Changes for v7.2-rc1 
The usual mixture of minor fixes, a few cleanups, a new driver and dt
 updates for the pwm subsystem.
 
 Thanks to Chen Ni, Devi Priya, Manish Baing, Maurice Hieronymus, Ronaldo
 Nunez, Rosen Penev, Shiji Yang and Yixun Lan for the actual changes and
 Bjorn Andersson, Conor Dooley, Frank Li, Michal Wilczynski and Rob
 Herring for reviews and acks.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEP4GsaTp6HlmJrf7Tj4D7WH0S/k4FAmovj1UACgkQj4D7WH0S
 /k4ATQf/YNPhLsDzLj0q7VM4wmMdBkX5s8e1yRAu4rRKMevWGP041MQMKxSiYU5k
 7vSEvxGaK2c5nmM6Iop6KJ1+wkL3fQNG+o2e5iOyedgFlayoHTE/vMOsooLPyJ7G
 thKFRQYqXenMtetY9n2fHaOtHayid/JWfZ1lQ9dlf8RDS1eN8dlgR/E4pNL5HUCv
 n3McnhbBxUrxpQaSeTfBRGwVahCORcS01srlLeT/VXlCHVGAwIZu/qtWTlHH7jXZ
 JO3iKxWlcUHvgt8BYxjpio3gYB9LZhunL23FtIHg48+HjYLyRS+JD2SYSWV2FZ+l
 0oRKImnotlW2zeFskp8VIqReUrJMgg==
 =4Uq3
 -----END PGP SIGNATURE-----

Merge tag 'pwm/for-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux

Pull pwm updates from Uwe Kleine-König:
 "The usual mixture of minor fixes, a few cleanups, a new driver and dt
  updates for the pwm subsystem.

  Thanks to Chen Ni, Devi Priya, Manish Baing, Maurice Hieronymus,
  Ronaldo Nunez, Rosen Penev, Shiji Yang and Yixun Lan for the actual
  changes and Bjorn Andersson, Conor Dooley, Frank Li, Michal Wilczynski
  and Rob Herring for reviews and acks"

* tag 'pwm/for-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux:
  pwm: th1520: Remove requirement for mul_u64_u64_div_u64_roundup
  dt-bindings: pwm: stmpe: Drop legacy binding
  pwm: pca9685: Use named initializers for struct i2c_device_id
  pwm: pxa: Add optional bus clock
  dt-bindings: pwm: marvell,pxa-pwm: Add SpacemiT K3 PWM support
  pwm: ipq: Add missing module description
  pwm: stm32: Make use of mul_u64_u64_div_u64_roundup()
  pwm: Consistently define pci_device_ids using named initializers
  pwm: Driver for qualcomm ipq6018 pwm block
  pwm: imx27: Fix variable truncation in .apply()
  pwm: mediatek: correct mt7628 clock source setting
  pwm: mediatek: set mt7628 pwm45_fixup flag to false
  pwm: atmel-tcb: Remove unneeded semicolon
 2026-06-16 07:26:47 +05:30
Michael Bommarito
66aefc277e scsi: xen: scsiback: Free the command tag on the TMR submit-failure path 
scsiback_device_action() obtains a command tag in
scsiback_get_pend_req() and submits a task-management request with
target_submit_tmr(). When target_submit_tmr() fails it returns < 0 and
scsiback jumps to the err: label, which sends a response but frees
nothing, leaking the tag.

Impact: a pvSCSI guest can leak the command tags of a LUN's session,
stopping the LUN, by issuing VSCSIIF_ACT_SCSI_ABORT or RESET requests
whenever target_submit_tmr() fails.

transport_generic_free_cmd() cannot be used here. By the time
target_submit_tmr() returns an error it has already run
__target_init_cmd() (so se_cmd->cmd_kref is one, not zero), and on its
target_get_sess_cmd() error path it has freed se_cmd->se_tmr_req via
core_tmr_release_req() while leaving SCF_SCSI_TMR_CDB set and the
pointer dangling. Letting the command release run target_free_cmd_mem()
would then double-free se_tmr_req.

Use the same helper, which returns just the tag, on this path too.

Fixes: 2dbcdf33db ("xen-scsiback: Convert to percpu_ida tag allocation")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Link: https://patch.msgid.link/20260611123046.2323342-3-michael.bommarito@gmail.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
 2026-06-15 21:52:39 -04:00
Michael Bommarito
ca978f8a93 scsi: xen: scsiback: Free unsubmitted command instead of double-putting it 
scsiback_get_pend_req() obtains a command tag and returns a vscsibk_pend
whose embedded se_cmd has only been memset to 0, so its cmd_kref is 0;
the se_cmd is initialised (kref_init() via target_init_cmd()) only
later, in scsiback_cmd_exec(), on the successful VSCSIIF_ACT_SCSI_CDB
path. The two error paths in scsiback_do_cmd_fn() taken before the
command is submitted -- a failed scsiback_gnttab_data_map() and an
unknown ring_req.act -- call
transport_generic_free_cmd(&pending_req->se_cmd, 0), which kref_put()s a
refcount of 0. That underflows it ("refcount_t: underflow;
use-after-free") and, as the release function is not run, leaks the
command tag.

Impact: a pvSCSI guest can leak every command tag of a LUN's session,
stopping the LUN, by submitting requests with a bad grant reference or
an unknown request type; under panic_on_warn the refcount underflow
panics the host.

Add a helper that just returns the tag with target_free_tag() and sends
the error response. It frees the tag while the v2p reference still pins
the session, and snapshots the response fields beforehand because
freeing the tag can let another ring reuse the pending_req slot.

Fixes: 2dbcdf33db ("xen-scsiback: Convert to percpu_ida tag allocation")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Link: https://patch.msgid.link/20260611123046.2323342-2-michael.bommarito@gmail.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
 2026-06-15 21:52:39 -04:00
Linus Torvalds
fd1878584d chrome-platform-firmware: Updates for v7.2 
* Improvements
 
   - Add bound checks when iterating the coreboot table.
   - Skip failing entries only instead of aborting the whole device
     populate from the coreboot table.
 -----BEGIN PGP SIGNATURE-----
 
 iIkEABYKADEWIQS0yQeDP3cjLyifNRUrxTEGBto89AUCai9pAxMcdHp1bmdiaUBr
 ZXJuZWwub3JnAAoJECvFMQYG2jz0Al8A/2+K6Up3CzuMZQyDJDOwkFb4Qx4CxfFu
 iSecYI5xvUAqAQC28M9Tlg73QBl88ZOzcR9WGE8b7P+sW4UQ/Z8BQ1RTBg==
 =HJUM
 -----END PGP SIGNATURE-----

Merge tag 'chrome-platform-firmware-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux

Pull chrome-platform firmware updates from Tzung-Bi Shih:

 - Add bound checks when iterating the coreboot table

 - Skip failing entries only instead of aborting the whole device
   populate from the coreboot table

* tag 'chrome-platform-firmware-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux:
  firmware: google: Skip failing entries instead of aborting populate
  firmware: google: Add bounds checks in coreboot_table_populate()
 2026-06-16 07:21:48 +05:30
Linus Torvalds
2b5f5609ae chrome-platform: Updates for v7.2 
* Improvements
 
   - Use named initializers for struct i2c_device_id.
 
 * Fixes
 
   - Fix a probe race between cros_ec_sensorhub and cros_ec_sysfs.
   - Check for the presence of ACPI_COMPANION() for drivers converted
     from acpi_driver to platform_driver to avoid issues where
     device_match_driver_override() might forcibly match the driver to
     the device.
   - Fix a possible UAF in cros_ec_chardev.
   - Prevent build for big-endian systems as CHROME_PLATFORMS drivers are
     only running and testing under little-endian systems.
 
 * Cleanups
 
   - Drop some redundant bits in cros_kbd_led_backlight and Kconfig.
 -----BEGIN PGP SIGNATURE-----
 
 iIkEABYKADEWIQS0yQeDP3cjLyifNRUrxTEGBto89AUCai9lxRMcdHp1bmdiaUBr
 ZXJuZWwub3JnAAoJECvFMQYG2jz04cYBALQW7+ddzPPKSShIxACyFsdMV7+DvfUT
 QH8RjhxrYDrjAQC+LGgyy14jGngfuo/mPjEuefuqdPwT2EBDlGXRnLYNDg==
 =lFBr
 -----END PGP SIGNATURE-----

Merge tag 'chrome-platform-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux

Pull chrome-platform updates from Tzung-Bi Shih:
 "Improvements:

   - Use named initializers for struct i2c_device_id

  Fixes:

   - Fix a probe race between cros_ec_sensorhub and cros_ec_sysfs

   - Check for the presence of ACPI_COMPANION() for drivers converted
     from acpi_driver to platform_driver to avoid issues where
     device_match_driver_override() might forcibly match the driver to
     the device

   - Fix a possible UAF in cros_ec_chardev

   - Prevent build for big-endian systems as CHROME_PLATFORMS drivers
     are only running and testing under little-endian systems

  Cleanups:

   - Drop some redundant bits in cros_kbd_led_backlight and Kconfig"

* tag 'chrome-platform-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux:
  platform/chrome: Prevent build for big-endian systems
  platform/chrome: Remove superfluous dependencies from CROS_EC
  platform/chrome: cros_ec_chardev: Introduce rwsem for protecting ec_dev
  platform/chrome: cros_ec_chardev: Add event relayer
  platform/chrome: cros_ec_chardev: Move data to chardev_pdata
  platform/chrome: cros_ec_chardev: Introduce chardev_data
  platform/chrome: Use named initializers for struct i2c_device_id
  platform/chrome: wilco_ec: event: Check ACPI_COMPANION()
  platform/chrome: chromeos_tbmc: Check ACPI_COMPANION()
  platform/chrome: chromeos_privacy_screen: Check ACPI_COMPANION()
  platform/chrome: cros_kbd_led_backlight: Drop CONFIG_MFD_CROS_EC_DEV ifdeffery
  platform/chrome: cros_kbd_led_backlight: Pass keyboard_led as parameter
  platform/chrome: cros_kbd_led_backlight: Drop max_brightness from driver data
  platform/chrome: Resolve kb_wake_angle visibility race
 2026-06-16 07:19:53 +05:30
Catalin Iacob
e81f1079f9 scsi: core: Remove export for scsi_device_from_queue() 
Commit 1cea5180f2 ("block: remove pktcdvd driver") left behind an export
that is now dead code. Remove it and move the declaration of
scsi_device_from_queue() to drivers/scsi/scsi_priv.h.

Signed-off-by: Catalin Iacob <iacobcatalin@gmail.com>
Link: https://patch.msgid.link/20260608-remove-pktcdvd-references-v4-1-72f88b04cc87@gmail.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
 2026-06-15 21:48:31 -04:00
Ethan Nelson-Moore
a7c958e872 xtensa: correct CONFIG_XTENSA_CALIBRATE_CCOUNT macro name in comment 
A comment in arch/xtensa/include/asm/platform.h incorrectly refers to
CONFIG_XTENSA_CALIBRATE instead of CONFIG_XTENSA_CALIBRATE_CCOUNT.
Correct it.

Discovered while searching for CONFIG_* symbols referenced in code but
not defined in any Kconfig file.

Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Message-ID: <20260615224957.21574-1-enelsonmoore@gmail.com>
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
 2026-06-15 18:31:10 -07:00
Arnaldo Carvalho de Melo
d669529868 perf trace: Guard __probe_ip suppression with evsel__is_probe() 
trace__fprintf_tp_fields() compares every field name against
"__probe_ip" for all tracepoint events, but this field is only
implicitly added by the Ftrace subsystem to bare dynamic probes.

Add an evsel__is_probe() check before the strcmp so the string
comparison is skipped entirely for non-probe events.

Reviewed-by: Aaron Tomlin <atomlin@atomlin.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
 2026-06-15 22:17:41 -03:00
Arnaldo Carvalho de Melo
9212e395c6 perf evsel: Add lazy-initialized probe type detection helpers 
Several places in perf need to check whether an evsel is a kprobe or
uprobe, which requires looking up the PMU by name via evsel__find_pmu().
This lookup walks the PMU list each time, which is wasteful when the
same evsel is checked repeatedly.

Add evsel__is_kprobe(), evsel__is_uprobe(), and evsel__is_probe() that
resolve the probe type on first call via evsel__pmu_name() and cache
the result in a 3-bit field (probe_type) in struct evsel.  The field
fits in existing padding after the bool fields, so struct size does not
grow.

The enum uses PROBE__UNKNOWN (0) as the uninitialized sentinel —
explicitly set in evsel__init() — so the lookup happens on first use.
PROBE__NOPE (1) caches "not a probe" to avoid repeated negative lookups.

PMU-based probes (kprobe/uprobe PMU) are detected by PMU name.
Ftrace-based dynamic probes (created via tracefs, reported as PMU
"tracepoint") are detected by the __probe_ip field that the kernel
adds to all dynamic probe formats.  This covers kprobes, uprobes, and
fprobes regardless of their group/system name.

Cc: Aaron Tomlin <atomlin@atomlin.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
 2026-06-16 16:35:43 -03:00
Arnaldo Carvalho de Melo
e22a422854 perf evsel: Add no-libtraceevent stubs for evsel__field() and evsel__common_field() 
When building without libtraceevent (NO_LIBTRACEEVENT=1), evsel__field()
and evsel__common_field() are declared but never defined, causing link
errors in any code path that references them.

Add inline stubs that return NULL when HAVE_LIBTRACEEVENT is not defined,
matching the pattern used by other evsel accessor functions.

Cc: Aaron Tomlin <atomlin@atomlin.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
 2026-06-16 16:37:09 -03:00
Arnaldo Carvalho de Melo
542e88a4c6 perf cs-etm: Reject CPU IDs that would overflow signed comparison 
metadata[j][CS_ETM_CPU] is a u64 from perf.data, but the comparison
with max_cpu casts it to (int).  A crafted value like 0xFFFFFFFF becomes
-1 after the cast, which compares less than max_cpu (0), so the queue
array is never sized to accommodate it.  When the value is later passed
to cs_etm__get_queue(), it indexes queue_array with the original large
value, causing an out-of-bounds access.

Validate that CS_ETM_CPU fits in an int before using it in the signed
comparison.

Fixes: 57880a7966 ("perf: cs-etm: Allocate queues for all CPUs")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: James Clark <james.clark@arm.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
 2026-06-17 08:29:07 -03:00
Arnaldo Carvalho de Melo
4a7500d772 perf c2c: Free format list entries when releasing c2c hist entries 
c2c_hists__init() calls hpp_list__parse() which allocates and registers
format entries on hists->list.  When c2c_he_free() destroys a c2c hist
entry, it deletes the histogram entries and frees the hists container but
never unregisters the format list entries, leaking them.

Call perf_hpp__reset_output_field() before freeing the hists to properly
unregister and free all format entries.

Fixes: f485e33c4543ac31 ("perf c2c report: Add cacheline hists processing")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
 2026-06-17 08:29:03 -03:00
Arnaldo Carvalho de Melo
033e85edfb perf bpf: Bounds-check array offsets in bpil_offs_to_addr() 
bpil_offs_to_addr() converts offsets stored in perf.data's
bpf_prog_info_linear structure into heap pointers by adding the offset
to the data allocation base.  The offsets come from untrusted file input
and are not validated against data_len.

If an offset exceeds data_len, the computed address points outside the
allocated data buffer.  Callers like synthesize_bpf_prog_name() then
dereference prog_tags[sub_id] or func_info pointers, reading arbitrary
heap memory.

Add a bounds check: when an offset exceeds data_len, zero the field
and skip the conversion.  This prevents out-of-bounds pointer
construction from crafted perf.data files.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: 6ac22d036f ("perf bpf: Pull in bpf_program__get_prog_info_linear()")
Cc: Dave Marchevsky <davemarchevsky@fb.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
 2026-06-17 08:29:00 -03:00
Arnaldo Carvalho de Melo
2d6ea08750 perf bpf: Reject oversized BPF metadata events that truncate header.size 
bpf_metadata_alloc() computes event_size from the number of BPF metadata
variables and stores it in header.size, which is __u16.  With 204 or
more .rodata variables prefixed "bpf_metadata_", event_size exceeds
65535 and silently truncates.

The truncated header.size causes synthesize_perf_record_bpf_metadata()
to allocate a buffer sized by the truncated value, then memcpy the full
event data into it — a heap buffer overflow.

Add a check that event_size fits in __u16 before proceeding.  BPF
programs with that many metadata variables are exotic enough that
silently dropping the metadata is acceptable.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: ab38e84ba9 ("perf record: collect BPF metadata from existing BPF programs")
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Blake Jones <blakejones@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
 2026-06-17 08:28:57 -03:00
Arnaldo Carvalho de Melo
10b3c3d63e perf bpf: Validate func_info_rec_size and sub_id in synthesize_bpf_prog_name() 
synthesize_bpf_prog_name() computes a pointer into the func_info array
using sub_id * info->func_info_rec_size without validating either value.
Both come from perf.data and are untrusted:

- A func_info_rec_size smaller than sizeof(struct bpf_func_info) means
  the finfo pointer would reference a truncated entry, reading past it
  into adjacent data.

- A sub_id >= nr_func_info computes an offset past the func_info buffer,
  causing an out-of-bounds read.

Add bounds checks for both values before computing the pointer offset.
When validation fails, fall through to the non-BTF name path instead
of reading garbage.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: 7b612e291a ("perf tools: Synthesize PERF_RECORD_* for loaded BPF programs")
Cc: Song Liu <songliubraving@fb.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
 2026-06-17 08:28:53 -03:00
Arnaldo Carvalho de Melo
500f5dd0a8 perf sched: Replace (void*)1 sentinel with proper runtime allocation 
map__findnew_thread() marks color-pid threads by storing (void*)1 as
the thread private data via thread__set_priv().  This sentinel value
causes two problems:

1. thread__get_runtime() returns (void*)1 as a struct thread_runtime
   pointer.  Any field access (e.g. tr->shortname) dereferences address
   1, which is an unmapped page — immediate segfault.

2. cmd_sched() registers free() as the thread priv destructor, so thread
   cleanup calls free((void*)1) — undefined behavior that corrupts the
   heap on many allocators.

Fix by adding a 'color' flag to struct thread_runtime and allocating a
real runtime struct for color-pid threads.  thread__has_color() now
checks the flag instead of relying on priv being non-NULL.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: 58a606149c ("perf sched: Avoid union type punning undefined behavior")
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Ian Rogers <irogers@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
 2026-06-17 08:28:50 -03:00
Arnaldo Carvalho de Melo
cfafef390c perf hwmon: Fix fd check to accept fd 0 in hwmon_pmu__describe_items() 
hwmon_pmu__describe_items() checks 'if (fd > 0)' after openat(), which
incorrectly rejects fd 0.  While fd 0 is normally stdin, if stdin has
been closed (common in daemon/service contexts), the kernel reuses fd 0
for the next open.  With fd > 0, the sysfs file is not read and the fd
is leaked.

Change to 'if (fd >= 0)' to match the standard openat() error check.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: 53cc0b351e ("perf hwmon_pmu: Add a tool PMU exposing events from hwmon in sysfs")
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Ian Rogers <irogers@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
 2026-06-17 08:28:47 -03:00
Arnaldo Carvalho de Melo
7b0df6f4d4 perf tools: Use snprintf() for root_dir path construction 
get_kernel_version() in machine.c and dso__load_guest_kernel_sym() in
symbol.c use sprintf() to construct paths by prepending root_dir to
"/proc/version" and "/proc/kallsyms" respectively.  Both write into
PATH_MAX stack buffers, but root_dir comes from --guestmount or KVM
configuration and is not length-checked.  A root_dir at or near
PATH_MAX causes a stack buffer overflow.

Switch to snprintf() with sizeof(path) to prevent overflow.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: a1645ce12a ("perf: 'perf kvm' tool for monitoring guest performance from host")
Cc: Zhang Yanmin <yanmin_zhang@linux.intel.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
 2026-06-17 08:28:44 -03:00
Arnaldo Carvalho de Melo
d2c6069d68 perf dso: Set error code when open() fails on uncompressed fallback path 
filename__decompress() has an early return for files that are not
actually compressed, where it calls open() directly.  When open()
fails, the function returns -1 but never sets *err.  The caller chain
(decompress_kmodule → dso__decompress_kmodule_path → dso__get_filename)
then reads *dso__load_errno(dso) to set errno, but that field was never
populated, so errno gets a stale or zero value.

With errno=0, __open_dso() computes fd = -errno = 0, which is non-
negative, so callers treat fd 0 (stdin) as a valid DSO file descriptor.

Set *err = errno when open() fails on the uncompressed path, matching
the error handling on the compressed path at line 354.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: 8b42b7e5e8 ("perf tools: Add is_compressed callback to compressions array")
Cc: Jiri Olsa <jolsa@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
 2026-06-17 08:28:40 -03:00
Arnaldo Carvalho de Melo
f973e52a99 perf dso: Fix heap overflow in dso__get_filename() on decompressed path 
dso__get_filename() allocates name with malloc(PATH_MAX), but the
dso__filename_with_chroot() path replaces name with an asprintf'd
exact-size string (e.g. 8 bytes for "/a/b.ko").  When the DSO needs
decompression, dso__decompress_kmodule_path() writes the temp path
("/tmp/perf-kmod-XXXXXX", 22 bytes) into newpath, and strcpy(name,
newpath) overflows the smaller allocation.

Replace the strcpy with strdup(newpath) + free(name) so the buffer
is always correctly sized for its content.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: 1d6b3c9ba7 ("perf tools: Decompress kernel module when reading DSO data")
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
 2026-06-17 08:28:37 -03:00
Arnaldo Carvalho de Melo
063c647b24 perf symbols: Break infinite loop on zero-filled notes in sysfs__read_build_id() 
sysfs__read_build_id() iterates ELF note headers from sysfs files in a
while(1) loop.  If the file contains a zero-filled note header (both
n_namesz and n_descsz are 0), the code computes n = namesz + descsz = 0
and calls read(fd, bf, 0).  read() with count 0 returns 0, which
matches the expected (ssize_t)n value, so the error check passes and
the loop repeats — reading the same zero bytes and spinning forever.

This can happen with corrupted or zero-padded sysfs pseudo-files.

Add a check for n == 0 before the read, since no valid ELF note has
both name and description of zero length.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: f1617b4059 ("perf symbols: Record the build_ids of kernel modules too")
Reviewed-by: Ian Rogers <irogers@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
 2026-06-17 08:28:31 -03:00
Arnaldo Carvalho de Melo
2a37165443 perf symbols: Validate p_filesz before use in filename__read_build_id() 
filename__read_build_id() stores ELF p_filesz in a ssize_t variable.
A crafted 32-bit ELF with p_filesz = 0xFFFFFFFF produces ssize_t value
-1.  The comparison `p_filesz > buf_size` evaluates false because signed
-1 is less than any non-negative buf_size, so the realloc is skipped and
buf remains NULL.

The subsequent read(fd, NULL, -1) returns -1, which equals p_filesz,
passing the error check.  read_build_id() then dereferences the NULL
buffer.

Add an explicit check for p_filesz <= 0 before using the value,
catching both zero-length and sign-wrapped negative sizes from crafted
ELF files.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: ba0b7081f7 ("perf symbol-minimal: Fix ehdr reading in filename__read_build_id")
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Ian Rogers <irogers@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
 2026-06-17 08:25:14 -03:00
Arnaldo Carvalho de Melo
081b387c73 perf symbols: Fix bswap copy-paste error for 32-bit ELF p_filesz 
filename__read_build_id() byte-swaps 32-bit ELF program headers on
cross-endian files, but line 178 passes p_offset to bswap_32() instead
of p_filesz:

  hdrs.phdr32[i].p_filesz = bswap_32(hdrs.phdr32[i].p_offset);

This clobbers p_filesz with the already-swapped p_offset value.  The
64-bit path on line 182 is correct and swaps p_filesz from p_filesz.

The consequence is that the PT_NOTE segment read uses the wrong size,
which can cause either a short read (missing the build-id) or an
oversized read (reading past the segment into adjacent data).

Fix by swapping the correct field.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: fef8f648bb ("perf symbol: Fix use-after-free in filename__read_build_id")
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Ian Rogers <irogers@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
 2026-06-17 08:25:03 -03:00
Jakub Kicinski
987257c49b Merge branch 'ionic-expose-more-port-stats-to-ethtool' 
Eric Joyner says:

====================
ionic: Expose more port stats to ethtool [part]

The primary aim of this patchset is to support the reporting of new port
statistics (and one old one) that firmware sends to the driver. A scheme
for these extra stats is introduced in order to prevent devices that
don't support these new statistics from unconditionally setting them or
reporting them in ethtool.
====================

Link: https://patch.msgid.link/20260614205303.48088-1-eric.joyner@amd.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2026-06-15 18:15:12 -07:00
Eric Joyner
3277e605ac ionic: Get "link_down_count" ext link stat from firmware 
The number of times that link has gone down at the port level is tracked
by the firmware and sent to the driver via regular DMA writes to an
instance of struct ionic_port_status in the driver's memory.

This statistic was never reported in favor of a driver-derived stat, but
doing it in the driver was never necessary since firmware had been
reporting it the whole time. Since it would be more accurate and true to
the description of the statistic to get this count at the PHY level,
replace the driver-calculated statistic with one derived from the
firmware one and remove the driver-calculated one entirely.

The stat reported by the ethtool .get_link_ext_stats() handler is
normalized to 0 on driver load and any device resets that require the
driver to rebuild state while also handling overflows.

Signed-off-by: Eric Joyner <eric.joyner@amd.com>
Link: https://patch.msgid.link/20260614205303.48088-5-eric.joyner@amd.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2026-06-15 18:15:08 -07:00