Commit graph

1,462,193 commits

Author SHA1 Message Date
Brett A C Sheffield
fbb7ad31ab docs: kselftest: remove link to obsolete wiki
Remove the reference to the obsolete kselftest wiki.

The kselftest wiki is marked obsolete and is no longer updated. The last
edit was in 2019, and the information is outdated, referring readers for
support to IRC networks that have not been used for years, and to kernel
versions that are no longer supported.

If there is any relevant information left in the wiki it needs to be
cleaned up and moved into the canonical kselftest documentation here.

Link: https://lore.kernel.org/r/20260115172817.7120-1-bacs@librecast.net
Signed-off-by: Brett A C Sheffield <bacs@librecast.net>
Acked-by: Bagas Sanjaya <bagasdotme@gmail.com>
Acked-by: SeongJae Park <sj@kernel.org>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2026-06-18 17:04:49 -06:00
Linus Torvalds
53c7db5c19 Pin control changes for the v7.2 kernel cycle:
Core changes:
 
 - Add new generic callbacks to populate per-pin pin controllers creating
   groups and functions from the device tree building out
   pinctrl_generic_to_map() and move the Spacemit driver over to use this.
 
 - Generic board-level pin control driver using the mux framework.
 
 New drivers:
 
 - Amlogic (meson) A9 SoC pin controller.
 
 - Aspeed AST2700 SoC0 and SoC1 pin controllers.
 
 - nVidia Tegra264 pin controller.
 
 - nVidia Tegra238 pin controller.
 
 - Qualcomm Nord TLMM pin controller.
 
 - Qualcomm Shikra TLMM pin controller.
 
 - Qualcomm SM6350 LPASS LPI pin controller.
 
 - Qualcomm IPQ9650 TLMM pin controller.
 
 - Renesas RZ/G3L SoC pin controller.
 
 - UltraRISC DP1000 pin controller.
 
 Improvements:
 
 - Handle pull up/pull down properly in the Renesas RZG2L driver.
 
 - Fix up nVidia Tegra 234 DT bindings.
 
 - Fix up pin definitions in the Qualcomm Eliza driver.
 
 - Qualcomm PM8010 GPIO support in the PM8010 pin controller.
 
 - Qualcomm SM6115 EGPIO support in the SM6115 pin controller.
 
 - Switch Qualcomm LPASS LPI drivers to use runtime PM for power management.
 
 - Clean up the Qualcomm Kconfig business a bit to include the necessary
   drivers for each subarch.
 
 - Fix output glitch in the Amlogic (meson) A4 pin controller.
 
 - Move the Airoha driver from the Mediatek directory to its own directory.
   It is too different from other Mediatek hardware.
 
 - A slew of fixes to the Airoha AN7581 and AN7583 drivers.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEElDRnuGcz/wPCXQWMQRCzN7AZXXMFAmoz6V8ACgkQQRCzN7AZ
 XXNvUg/9ExEBVgJFo0yFKqQfwyr0sVHHjFwbAuWZnoBz7qPS0tRTfQ1GeJclqa9a
 7hWkYM0wFWxZ0UpMI+DZI7rvhvg0mLDuU6Fjd8GOgPUISVgvejenqxCGsYTGLNHF
 DsAzGMD42aj+Jt4eL3wBumrKrBS7J36sBfn5wUMcQgFtTjp+2SwDJxntPIfKRH8Q
 l3arrJ+C3cStOwMKGa//S5c/qy2mijaTPKU+NzFrrmD/wZEYzzSLHcS1v4kBSVab
 vVa32q6A5UZtKyPupFxVSICZEtz0/Lze381ppFef+h/txDaHlLwAKZvMLNcoJXt6
 8AJu+q0DNP71mNNpr/51c8ZsAcV8kyc//CCjpV6vGwg2Pk2HnjBRWdOhzeY4H1z1
 eESKEw9GJGdEeO3Ua6CV6FgXVxLGRnLigU9RC4zP0M8qwZuh/z3F3WxKKTWKZIpK
 w0UF+Sl+KrW8qjQRyISsDXphT1fyglQGMrNntL4ihHq/T5JJGF9qjlJMKooZSkiH
 oswB14JGVkNU4XGpG76I6IgbJJcaVe8CDGSdfRoVmTQ1sI3gHrO42eQdlWxbJ9x/
 DgzL7bnO4os+vq5YJo6YdMsQYI0wpIqTWU7WRGfmCQYkyAVYPRVq+AE7KGlRZjbN
 qoqQ9ychYaqKcO94F4vc5ZvhRJkcqIsxNRJel3dky0h8Brq2PZ8=
 =5CSf
 -----END PGP SIGNATURE-----

Merge tag 'pinctrl-v7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl

Pull pin control updates from Linus Walleij:
 "Core changes:

   - Add new generic callbacks to populate per-pin pin controllers
     creating groups and functions from the device tree building out
     pinctrl_generic_to_map() and move the Spacemit driver over to use
     this

   - Generic board-level pin control driver using the mux framework

  New pin controller drivers:

   - Amlogic (meson) A9 SoC

   - Aspeed AST2700 SoC0 and SoC1

   - nVidia Tegra264 and Tegra238

   - Qualcomm Nord TLMM, Shikra TLMM, SM6350 LPASS LPI, and IPQ9650 TLMM

   - Renesas RZ/G3L SoC

   - UltraRISC DP1000

  Improvements:

   - Handle pull up/pull down properly in the Renesas RZG2L driver

   - Fix up nVidia Tegra 234 DT bindings

   - Fix up pin definitions in the Qualcomm Eliza driver

   - Qualcomm PM8010 GPIO support in the PM8010

   - Qualcomm SM6115 EGPIO support in the SM6115

   - Switch Qualcomm LPASS LPI drivers to use runtime PM for power
     management

   - Clean up the Qualcomm Kconfig business a bit to include the
     necessary drivers for each subarch

   - Fix output glitch in the Amlogic (meson) A4 pin controller

   - Move the Airoha driver from the Mediatek directory to its own
     directory. It is too different from other Mediatek hardware

   - A slew of fixes to the Airoha AN7581 and AN7583 drivers"

* tag 'pinctrl-v7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (151 commits)
  pinctrl: Export pinctrl_get_group_selector()
  pinctrl: Match DT helper types
  pinctrl: qcom: Register functions before enabling pinctrl
  pinctrl: meson: amlogic-a4: use nolock get range
  pinctrl: ultrarisc: Add UltraRISC DP1000 pinctrl driver
  dt-bindings: pinctrl: Add UltraRISC DP1000 pinctrl controller
  pinctrl: qcom: Remove unused macro definitions
  pinctrl: tegra: PINCTRL_TEGRA264 should depend on ARCH_TEGRA
  pinctrl: tegra: PINCTRL_TEGRA238 should depend on ARCH_TEGRA
  pinctrl: tegra238: add missing AON pin groups
  dt-bindings: pinctrl: tegra238: add missing AON pin groups
  pinctrl: airoha: an7583: remove undefined groups from pcm_spi pin function
  pinctrl: airoha: an7583: fix phy1_led1 pin function
  pinctrl: airoha: an7583: add missed gpio22 pin group
  pinctrl: airoha: an7583: fix gpio21 pin group
  pinctrl: airoha: fix pwm pin function for an7581 and an7583
  pinctrl: airoha: an7583: fix incorrect led mapping in phy4_led1 pin function
  pinctrl: airoha: an7581: fix incorrect led mapping in phy4_led1 pin function
  pinctrl: airoha: an7583: fix misprint in gpio19 pinconf
  pinctrl: airoha: an7581: fix misprint in gpio19 pinconf
  ...
2026-06-18 15:03:21 -07:00
Linus Torvalds
7c6742507c Backlight for v7.2
- New Support & Features
   - Maxim MAX25014: Add support for the Maxim MAX25014 4-channel automotive grade
     backlight driver IC
 
 - Improvements & Fixes
   - Maintainers: Add the Congatec Board Controller backlight driver to its corresponding
     entry
   - Congatec Board Controller: Remove redundant X86 dependency from the backlight driver
   - Kinetic KTD2801: Enable BL_CORE_SUSPENDRESUME to ensure the chip is powered off
     during suspend
 
 - Cleanups & Refactoring
   - Core: Use named initializers for i2c_device_id arrays to improve readability and
     robustness
 
 - Device Tree Binding Updates
   - Maxim MAX25014: Add device tree bindings for the Maxim MAX25014 backlight controller
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEdrbJNaO+IJqU8IdIUa+KL4f8d2EFAmoylZoACgkQUa+KL4f8
 d2GrtQ//dLUsFbhagbO2OqCef3jkugwIe+aQqiZQ+KjrYVVg+YzQsxbltH7dylXf
 Tx8oLO6EZ5yD35Tf/STF17omMOqCAXGXefzm5jf0/z8yPDieBpML+StBnApm5JIg
 C1SOHy8UtSBxnlC6bNLuj3GdvNza7XjB6mpopn/zFwV4F/1EdmWSVzj1lZmzc7qr
 qjOrrW+hcF7F0toDGTRpL6kb4leVxAQHWn8C3qbebcpQ4PHue+eO2/6Nzn2gNgVE
 hiQhz51W7bGEC9LJyRBkXYkSqQVJpBo3FEMY+//ONwvfduLZ9KzHE1jfJzkQHhxt
 OshNBEggZVfP0Q2hx00w19I9Mn56MRpcJWC/QHW71MDu/PWVL8BKsglA9/FtLROg
 qChu9igqipsLR26grj0rjaImh8P9jM2HKfTcTIfu9BUGkpsLAjxZMOhCJI+zWzq1
 YhyCnYqP/vJxE72iXLXqyKCoTPHuhXp5mYNQdmglQtrdnRjuQGn3My/cY58uZHd5
 8uV0bVL2SKp589f0DmfSIZQChqOPtuJTDpklijV9GRZ8GNhpEuHhpHSmoMGIkVJS
 37m8ddZBlA8HgLBpSMI7CMRcEv7s8Jviwv84F0V4cGZ0AKpQ49/7xFHR2y4JkT26
 SpYVPrMbZfbRB4twUfBu6+8qKxHVS5TU3C7ybLMeuz/aEpapRo8=
 =6Es2
 -----END PGP SIGNATURE-----

Merge tag 'backlight-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight

Pull backlight updates from Lee Jones:
 "New Support & Features:
   - Maxim MAX25014: Add support for the Maxim MAX25014 4-channel
     automotive grade backlight driver IC

  Improvements & Fixes:
   - Maintainers: Add the Congatec Board Controller backlight driver to
     its corresponding entry
   - Congatec Board Controller: Remove redundant X86 dependency from the
     backlight driver
   - Kinetic KTD2801: Enable BL_CORE_SUSPENDRESUME to ensure the chip is
     powered off during suspend

  Cleanups & Refactoring:
   - Core: Use named initializers for i2c_device_id arrays to improve
     readability and robustness

  Device Tree Binding Updates:
   - Maxim MAX25014: Add device tree bindings for the Maxim MAX25014
     backlight controller"

* tag 'backlight-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight:
  backlight: Use named initializers for arrays of i2c_device_data
  MAINTAINERS: Add cgbc backlight driver
  backlight: cgbc: Remove redundant X86 dependency
  backlight: Add max25014atg backlight
  dt-bindings: backlight: Add max25014 support
  backlight: ktd2801: Enable BL_CORE_SUSPENDRESUME
2026-06-18 14:55:20 -07:00
Linus Torvalds
6e717507bf LEDs for v7.2
- New Support & Features
   - Samsung S2MU005: Add support for the Samsung S2MU005 PMIC which includes flash and
     RGB LED controllers
   - Texas Instruments LP5812: Add support for the TI LP5812 LED driver
   - Texas Instruments LP5860: Add support for the Texas Instruments LP5860 LED matrix
     driver via SPI
 
 - Improvements & Fixes
   - Core: Adjust the brightness sysfs node documentation to clarify that only decimal
     values are accepted
   - Core: Fix a race condition in the software blink logic when stopping blinking and
     setting brightness simultaneously
   - Core: Introduce the `multi_max_intensity` sysfs attribute for multicolor LEDs to
     support hardware-based global brightness control
   - Core: Replace OF-based device lookup with firmware node equivalents to support ACPI
     and software nodes
   - Core: Return `ENODATA` when reading brightness from hardware-controlled LEDs
   - Core: Set the coherent DMA mask to zero for the Samsung PMIC device to suppress
     unnecessary "DMA mask not set" messages
   - ams OSRAM AS3668: Fix a Kconfig symbol name mismatch in the Makefile that prevented
     the driver from being built
   - BlinkM: Fix spelling and comment style issues in the driver
   - DAC124S085: Declare the SPI command word as `__le16` to ensure correct endianness
     and pass sparse checks
   - GPIO Trigger: Use `GPIOD_FLAGS_BIT_NONEXCLUSIVE` to allow sharing GPIOs between the
     LED trigger and other drivers
   - NXP PCA9532: Fix an issue where the LED would stop blinking when changing brightness
     to a non-zero value
   - Qualcomm: Unify the user-visible company name to "Qualcomm" across flash LED config
     options
   - Qualcomm LPG: Optimize memory allocation by combining main structure and channels
     into a single allocation using flexible array members
   - Texas Instruments LP5860: Add missing `CONFIG_OF` dependency to prevent build
     warnings
   - TI TPS6131x: Increase the overvoltage protection threshold to 6V to avoid false
     triggers with 5V input supplies
   - Userspace LEDs (uLEDs): Fix a potential buffer overread by using `strnchr()` for
     name string validation
   - Userspace LEDs (uLEDs): Return `-EFAULT` on `copy_to_user()` failure to properly
     handle read errors
 
 - Cleanups & Refactoring
   - Core: Convert various `i2c_device_id` arrays to use named initializers for improved
     robustness and readability
   - Multi-color Core: Fix incorrect `KernelVersion` and `Date` tags for the
     `multi_max_intensity` ABI
   - Broadcom BCM63138 / ChromeOS EC: Move `MODULE_DEVICE_TABLE` declarations next to the
     ID tables for consistency
   - LP5812: Fix a sysfs ABI reference in the documentation
   - ST1202: Remove an unused legacy GPIO header include
 
 - Device Tree Binding Updates
   - Class: Document the keyboard backlight LED class naming conventions, including a new
     scheme for zoned backlights
   - Core: Dual-license the common LED bindings header under GPLv2 and BSD-2-Clause
   - IR SPI LED: Add a new 30% duty-cycle value for the IR transmitter used in Xiaomi
     Redmi Note 8
   - Samsung S2M series: Document the flash LED device bindings for Samsung S2M series
     PMICs
   - Samsung S2M series: Document the pattern behavior for Samsung S2M series PMIC RGB
     LEDs
   - Samsung S2MU005: Add device tree bindings for the S2MU005 PMIC, including its flash
     and RGB LED sub-devices
   - TI LM3560: Document the TI LM3559 and LM3560 synchronous boost flash drivers
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEdrbJNaO+IJqU8IdIUa+KL4f8d2EFAmoylZ0ACgkQUa+KL4f8
 d2GgaQ//QrL6Ap+Sp4JrG4m0FDvMB72QkqtTBtfMtUUpvliFrggGr5tAbPVOnITn
 N5vFNJy++ffGA25xvi7XvMUDAi5dXY71razR7Rw+QAp7KytNnNNu5GxcYw4rGXGR
 yndd9YQBhowlLF+jGjk866txj59vBKf/MpHXt+VrdJGK/se3nzeg4rOsCx/ZP1p5
 nhBcyunGKereeVUHj041N22PVxicR8TsleDf9ho69UdiKTh3ZGiRmzdvn0sgA+wi
 b8wZCQXNmnpnmWm2xtwoH7dCdTFMshbs1rmFl1GxctkRqwx5yRU5sREqJKxeW6g9
 Q/24gwMI6UD350Yx5ir748aKgIeQxmGXAzKvqostqVNxt4uqKIcBat4Q3BHjzSgX
 HzmpF1OZHZOcyPrN1mNgc5fpiv+5FyzQirddg+Au9P2FKe+leOH08u70b0eaZHX0
 RgzSHayGq8DR2evAsUl1pIaJfSuh7W+YopSFaB2VnU83ShTEqLqE3DvdjwwQsjZ8
 Fb1XkPfFqFShQr1gZ8SG3F60yDAbs77ZBzxH6vEC5kjMM7ewsg5rg06o4siR81S1
 6rWyWTQyDXsywapra/vFyBUxum3aE/tj50YieSoovb7pKnwsoeiGU9Tzn2PRdlTX
 u6LxZnnebsIvlKE2UWRWs82raKzDjTRa9u3HwQ42E8xiI0WYVDs=
 =zlOu
 -----END PGP SIGNATURE-----

Merge tag 'leds-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds

Pull LED updates from Lee Jones:
 "New Support & Features:
   - Samsung S2MU005: Add support for the Samsung S2MU005 PMIC which
     includes flash and RGB LED controllers
   - Texas Instruments:
       - LP5812: Add support for the TI LP5812 LED driver
       - LP5860: Add support for the Texas Instruments LP5860 LED matrix
         driver via SPI

  Improvements & Fixes:
   - Core:
       - Adjust the brightness sysfs node documentation to clarify that
         only decimal values are accepted
       - Fix a race condition in the software blink logic when stopping
         blinking and setting brightness simultaneously
       - Introduce the `multi_max_intensity` sysfs attribute for
         multicolor LEDs to support hardware-based global brightness
         control
       - Replace OF-based device lookup with firmware node equivalents
         to support ACPI and software nodes
       - Return `ENODATA` when reading brightness from
         hardware-controlled LEDs
       - Set the coherent DMA mask to zero for the Samsung PMIC device
         to suppress unnecessary "DMA mask not set" messages
   - ams OSRAM AS3668: Fix a Kconfig symbol name mismatch in the
     Makefile that prevented the driver from being built
   - BlinkM: Fix spelling and comment style issues in the driver
   - DAC124S085: Declare the SPI command word as `__le16` to ensure
     correct endianness and pass sparse checks
   - GPIO Trigger: Use `GPIOD_FLAGS_BIT_NONEXCLUSIVE` to allow sharing
     GPIOs between the LED trigger and other drivers
   - NXP PCA9532: Fix an issue where the LED would stop blinking when
     changing brightness to a non-zero value
   - Qualcomm: Unify the user-visible company name to "Qualcomm" across
     flash LED config options
   - Qualcomm LPG: Optimize memory allocation by combining main
     structure and channels into a single allocation using flexible
     array members
   - Texas Instruments
       - LP5860: Add missing `CONFIG_OF` dependency to prevent build
         warnings
       - TPS6131x: Increase the overvoltage protection threshold to 6V
         to avoid false triggers with 5V input supplies
   - Userspace LEDs (uLEDs):
       - Fix a potential buffer overread by using `strnchr()` for name
         string validation
       - Return `-EFAULT` on `copy_to_user()` failure to properly handle
         read errors

  Cleanups & Refactoring:
   - Core:
       - Convert various `i2c_device_id` arrays to use named
         initializers for improved robustness and readability
       - Multi-color: Fix incorrect `KernelVersion` and `Date` tags for
         the `multi_max_intensity` ABI
   - Broadcom BCM63138 / ChromeOS EC: Move `MODULE_DEVICE_TABLE`
     declarations next to the ID tables for consistency
   - LP5812: Fix a sysfs ABI reference in the documentation
   - ST1202: Remove an unused legacy GPIO header include

  Device Tree Binding Updates:
   - Class: Document the keyboard backlight LED class naming
     conventions, including a new scheme for zoned backlights
   - Core: Dual-license the common LED bindings header under GPLv2
     and BSD-2-Clause
   - IR SPI LED: Add a new 30% duty-cycle value for the IR transmitter
     used in Xiaomi Redmi Note 8
   - Samsung S2M series:
       - Document the flash LED device bindings for Samsung S2M series
         PMICs
       - Document the pattern behavior for Samsung S2M series PMIC RGB
       - S2MU005: Add device tree bindings for the S2MU005 PMIC,
         including its flash and RGB LED sub-devices
   - TI LM3560: Document the TI LM3559 and LM3560 synchronous boost
     flash drivers"

* tag 'leds-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds: (30 commits)
  leds: tps6131x: Increase overvoltage protection threshold to 6V
  leds: Fix sysfs ABI date
  leds: Fix CONFIG_OF dependency for LEDS_LP5860_CORE
  leds: uleds: Fix potential buffer overread
  leds: Use named initializers for arrays of i2c_device_data
  leds: uleds: Return -EFAULT on copy_to_user() failure
  leds: core: Report ENODATA for brightness of hardware controlled LED
  leds: class: Use firmware nodes for device lookup
  Documentation: leds: Document pattern behavior of Samsung S2M series PMIC RGB LEDs
  leds: rgb: Add support for Samsung S2M series PMIC RGB LED device
  leds: flash: Add support for Samsung S2M series PMIC flash LED device
  dt-bindings: leds: Document Samsung S2M series PMIC flash LED device
  leds: core: Fix race condition for software blink
  leds: Adjust documentation of brightness sysfs node
  leds: dac124s085: Declare SPI command word as __le16
  leds: Introduce the multi_max_intensity sysfs attribute
  dt-bindings: leds: Document TI LM3560 Synchronous Boost Flash Driver
  leds: bcm63138/cros_ec: Move MODULE_DEVICE_TABLE next to the table itself
  leds: Add support for TI LP5860 LED driver chip
  Documentation: leds: leds-class: Document keyboard backlight LED class naming
  ...
2026-06-18 14:45:08 -07:00
Linus Torvalds
6beaec3aee MFD for v7.2
- New Support & Features
   - Renesas RSMU: Add support for the IDT 8a34002 Clock Matrix
   - Samsung S2MU005: Add support for the Samsung S2MU005 PMIC which includes charger,
     MUIC, flash and RGB LED controllers
   - SpacemiT P1: Add a reboot cell for the SpacemiT P1 chip
   - Texas Instruments BQ25792: Add support for the TI BQ25792 charger manager
 
 - Improvements & Fixes
   - Core: Unify the user-visible company name to "Qualcomm" across various config
     options
   - ChromeOS EC: Delay `dev_set_drvdata()` until the probe process has successfully
     completed to avoid use-after-free issues
   - ChromeOS EC: Prevent adding `cros_ec_ucsi` as an MFD sub-device if it is already
     defined in Device Tree or ACPI
   - Cirrus Logic CS42L43: Add a sanity check for firmware size to prevent out-of-bounds
     memory access during firmware loading
   - Cirrus Logic CS5535: Associate the GPIO cell with a dedicated software node to
     support board files requesting GPIOs
   - Maxim MAX77620: Modernize poweroff handling by converting to the sys-off API
   - Qualcomm RPM: Add the missing QDSS clock resource for the MSM8960 SoC
   - Renesas RSMU: Fix page register setup for the 8A3400x family by correctly
     calculating the page address
   - Renesas RZ/MTU3: Make the reset line optional to support newer SoC variants (RZ/T2H,
     RZ/N2H)
   - Renesas RZ/MTU3: Modernize the driver by using device-managed APIs for reset control
     and device addition
   - Samsung Core: Set the coherent DMA mask to zero for the Samsung PMIC device to
     suppress unnecessary "DMA mask not set" messages
   - Silicon Motion SM501: Fix a reference leak on failed device registration by properly
     dropping the platform device reference
   - Texas Instruments TPS65219: Make poweroff handler registration conditional on the
     "system-power-controller" Device Tree property
   - Texas Instruments TPS6586x: Fix Device Tree node reference counting by manually
     bumping the refcount for sub-devices
   - Texas Instruments TPS65910: Add return value checking for the dummy I2C transfer
     used to work around silicon erratum SWCZ010
   - Texas Instruments TWL4030: Update board-specific checks to use Device Tree
     compatibles instead of legacy machine IDs
 
 - Cleanups & Refactoring
   - Core: Consistently define `pci_device_id` arrays using named initializers across
     various Intel and Silicon Motion drivers
   - Maintainers: Shift maintenance of Samsung PMIC drivers to André Draszik
   - Maxim MAX77759: Improve code style by reformatting the IRQ table and refining macro
     comments
   - MEN MENF21BMC / Texas Instruments TWL: Correctly treat `i2c_check_functionality()`
     as returning a boolean status
   - Rohm BD72720: Drop the non-existent BUCK11 ID to improve code clarity
   - Silicon Labs Si476x: Fix various spelling mistakes in driver comments
   - Spreadtrum SC27xx: Transition to `devm_mfd_add_devices()` and separate MFD cell
     tables for each PMIC model
   - Timberdale: Move GPIO pin definitions into the driver and transition to using a
     software node for the GPIO cell
   - Wolfson WM8994: Remove dead legacy-GPIO code and its associated `irq_gpio` member
 
 - Device Tree Binding Updates
   - Aspeed AST2x00: Document the AST2700 SCU0 and add support for its SoC0/SoC1 pin
     controllers
   - Hisilicon Hi655x: Convert the Hi655x PMIC binding from text format to YAML DT schema
   - Khadas MCU: Add a new compatible and fan-supply property for the Khadas VIM4 MCU
   - MediaTek MT6397: Add support for the MT6365 PMIC and document regulator supplies for
     the MT6359 variant
   - Qualcomm TCSR: Add compatibles for Nord and IPQ5210 TCSR blocks
   - Renesas RZ/G3L: Revert the addition of the `renesas,r9a08g046-lvds-cmn` compatible
     string due to documentation errors
   - Samsung S2MU005: Document the S2MU005 PMIC and its sub-devices (charger, MUIC,
     flash and RGB LEDs)
   - Spreadtrum SC2731: Include regulator bindings for the SC2730 variant
   - STMPE: Fix the schema by marking 'compatible' and '#pwm-cells' as required for the
     PWM subnode
   - Texas Instruments BQ257xx: Expand the BQ25703A binding to include the BQ25792
     variant
 
 - Removals
   - Motorola EZX PCAP: Remove the unused and non-functional driver for Motorola EZX
     phones
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEdrbJNaO+IJqU8IdIUa+KL4f8d2EFAmoylaAACgkQUa+KL4f8
 d2HKlw/+LNN6+pdOuvpFd/I+SnMyYnpFH/DMCHBDu7KnOWtn1AVsCAhKy7jz2cmz
 8NCtKvPaYcJWvsV+zYw+VPWilgUJ0lU3mRDJ4b8KIRjMv37JYA9xhFrz3pr/MS/Z
 z//gGHbWzzKsH9E8BEpbxHOx4kwqI1RiTBS2yV8OuooHpqfp8kg9E5lKW+roP4YQ
 VcWkHduywOOkT+PKUjKySFx8qJ7ySskx6RFEVH8Nywu6AmSuNiKOeGtDkKKIGGFe
 YL2L19m/In0p0z4aqwqJWpj5sZQ3CSOAMT82k25/ApR7+Aot8lsbWuANbySfr5l/
 Yv695XrN01qaXrEmCkk7cpKpzW18QFxVEnfdpCJrZcG1OkfwvfHCcGbZC8ihD/xN
 fGkaOP7f9Jx3uoQQX+j1dgU3GJyMPAABxPdrzU2o59mE6UFGUZobepFGWBqYSPCJ
 b7P530qhnt8qp0iXKDwpnzt1LhxiAIo0PnZJ2DFDRiZXzl/IOOK0ywgBENu1cebn
 gkL3xpA4TMASeHcE8dPCNdYeI6PqRjV0LO80HWG2vGk9nmolW8BnuvtGp4kHroxh
 Y37yg9BR67JbTrUfTwFU/U9utqkiY3cTZ8skElff/rsKdysKGBcGXdeCh4dTEQXo
 3XNGKb1RRUgiCixjPqQkf+iLWZalr+QY8Z40OmqcDncXQe8t3+o=
 =9Igx
 -----END PGP SIGNATURE-----

Merge tag 'mfd-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd

Pull MFD updates from Lee Jones:
 "New Support & Features:
   - Renesas RSMU: Add support for the IDT 8a34002 Clock Matrix
   - Samsung S2MU005: Add support for the Samsung S2MU005 PMIC which
     includes charger, MUIC, flash and RGB LED controllers
   - SpacemiT P1: Add a reboot cell for the SpacemiT P1 chip
   - Texas Instruments BQ25792: Add support for the TI BQ25792 charger
     manager

  Improvements & Fixes:
   - Core: Unify the user-visible company name to "Qualcomm" across
     various config options
   - ChromeOS EC:
       - Delay `dev_set_drvdata()` until the probe process has
         successfully completed to avoid use-after-free issues
       - Prevent adding `cros_ec_ucsi` as an MFD sub-device if it is
         already defined in Device Tree or ACPI
   - Cirrus Logic CS42L43: Add a sanity check for firmware size to
     prevent out-of-bounds memory access during firmware loading
   - Cirrus Logic CS5535: Associate the GPIO cell with a dedicated
     software node to support board files requesting GPIOs
   - Maxim MAX77620: Modernize poweroff handling by converting to the
     sys-off API
   - Qualcomm RPM: Add the missing QDSS clock resource for the MSM8960
     SoC
   - Renesas RSMU: Fix page register setup for the 8A3400x family by
     correctly calculating the page address
   - Renesas RZ/MTU3:
       - Make the reset line optional to support newer SoC variants
         (RZ/T2H, RZ/N2H)
       - Modernize the driver by using device-managed APIs for reset
         control and device addition
   - Samsung Core: Set the coherent DMA mask to zero for the Samsung
     PMIC device to suppress unnecessary "DMA mask not set" messages
   - Silicon Motion SM501: Fix a reference leak on failed device
     registration by properly dropping the platform device reference
   - Texas Instruments:
       - TPS65219: Make poweroff handler registration conditional on the
         "system-power-controller" Device Tree property
       - TPS6586x: Fix Device Tree node reference counting by manually
         bumping the refcount for sub-devices
       - TPS65910: Add return value checking for the dummy I2C transfer
         used to work around silicon erratum SWCZ010
       - TWL4030: Update board-specific checks to use Device Tree
         compatibles instead of legacy machine IDs

  Cleanups & Refactoring:
   - Core: Consistently define `pci_device_id` arrays using named
     initializers across various Intel and Silicon Motion drivers
   - Maintainers: Shift maintenance of Samsung PMIC drivers to André
     Draszik
   - Maxim MAX77759: Improve code style by reformatting the IRQ table
     and refining macro comments
   - MEN MENF21BMC / Texas Instruments TWL: Correctly treat
     `i2c_check_functionality()` as returning a boolean status
   - Rohm BD72720: Drop the non-existent BUCK11 ID to improve code
     clarity
   - Silicon Labs Si476x: Fix various spelling mistakes in driver
     comments
   - Spreadtrum SC27xx: Transition to `devm_mfd_add_devices()` and
     separate MFD cell tables for each PMIC model
   - Timberdale: Move GPIO pin definitions into the driver and
     transition to using a software node for the GPIO cell
   - Wolfson WM8994: Remove dead legacy-GPIO code and its associated
     `irq_gpio` member

  Device Tree Binding Updates:
   - Aspeed AST2x00: Document the AST2700 SCU0 and add support for its
     SoC0/SoC1 pin controllers
   - Hisilicon Hi655x: Convert the Hi655x PMIC binding from text format
     to YAML DT schema
   - Khadas MCU: Add a new compatible and fan-supply property for the
     Khadas VIM4 MCU
   - MediaTek MT6397: Add support for the MT6365 PMIC and document
     regulator supplies for the MT6359 variant
   - Qualcomm TCSR: Add compatibles for Nord and IPQ5210 TCSR blocks
   - Renesas RZ/G3L: Revert the addition of the
     `renesas,r9a08g046-lvds-cmn` compatible string due to documentation
     errors
   - Samsung S2MU005: Document the S2MU005 PMIC and its sub-devices
     (charger, MUIC, flash and RGB LEDs)
   - Spreadtrum SC2731: Include regulator bindings for the SC2730
     variant
   - STMPE: Fix the schema by marking 'compatible' and '#pwm-cells' as
     required for the PWM subnode
   - Texas Instruments BQ257xx: Expand the BQ25703A binding to include
     the BQ25792 variant

  Removals:
   - Motorola EZX PCAP: Remove the unused and non-functional driver for
     Motorola EZX phones"

* tag 'mfd-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (47 commits)
  dt-bindings: mfd: syscon: Revert renesas,r9a08g046-lvds-cmn
  dt-bindings: mfd: st,stmpe: Add missing properties for PWM subnode
  mfd: rz-mtu3: Make reset optional
  mfd: rz-mtu3: Store &pdev->dev in local variable
  mfd: rz-mtu3: Use local variable for reset
  mfd: rz-mtu3: Use device-managed APIs
  dt-bindings: mfd: aspeed,ast2x00-scu: Support AST2700 SoC1 pinctrl
  mfd: tps6586x: Fix OF node refcount
  dt-bindings: mfd: sprd,sc2731: Include SC2730 regulator bindings
  mfd: twl4030-power: Update checks for specific boards to use the DT
  dt-bindings: mfd: qcom,tcsr: Document the IPQ5210 TCSR block
  mfd: qcom_rpm: Add msm8960 QDSS clock resource
  mfd: si476x-i2c: Fix spelling mistakes in comments
  mfd: max77620: Convert poweroff support to sys-off API
  mfd: dt-bindings: mt6397: Add regulator supplies
  dt-bindings: mfd: mediatek: mt6397: Add MT6365 PMIC support
  dt-bindings: mfd: mediatek: mt6397: Add rtc for MT6359
  mfd: cs42l43: Sanity check firmware size
  mfd: qcom: Unify user-visible "Qualcomm" name
  mfd: cros_ec: Delay dev_set_drvdata() until probe success
  ...
2026-06-18 14:26:29 -07:00
Linus Torvalds
b7556c8e71 hid-for-linus-2026061601
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEL65usyKPHcrRDEicpmLzj2vtYEkFAmoxq94ACgkQpmLzj2vt
 YElr1A//RPXn3om4Sm5QeIcbIFHrdVx6Un8QcXVaNSqL8XUB7yMCbsH+zD7NmWSP
 U4wX9bDZ0F8/1gkQh80HuGDEEErSmzAQk8+iE3mhUTXmLmyPn7bgHClMXVmKD1UO
 74f6+57RV7Y0Uo/cgna9hLr3kuSCR5+y81f9esWoXSz8j6BNzml6KyCNcNbbnYlk
 RmS6c5MJ15KxnY593HKr04jWqC1zs++pdcAOmZF3gnwTf7X+Pl3hgP53jCQeAJqH
 AGbXc8N09Nc+JBEJ9zUIgwpU0DwnJRe+/LptIWNGebpSW2/jqfXWabrHjpaXekuX
 6hf+/bnkeoIKDQGIAXSFuqEBsP0WofEbAvCix0+QVEz3MBDtsR6/3h3q+/hbNEgJ
 KrAO7rEHTEEOKPvYiIwQ6cMPAlNRF178k4Havy2EZaaT8w0v9/eovYRIR1J2H/34
 0D7pRb+pyxV0vzuHosa7EKRTTga+8LOwWxLB5lJnG5UhSBUYghihGM6T8pCjBCw5
 BuhcVPpGRT6kreOAIR82sUxfOZHcq6g8rj64iHofPNiPlAr/qkehhHGJ2sBLzeMm
 CPSmYrI0hwULldRunR9/JBMBC44fzfhoRhcQZE1QaJbRu7KYPMWhRPRR8nNR6oEc
 xDnbllexgSya9yAjKZ8mJKb4ywIFUrqpC0xacQmJbZmaXkTX8mI=
 =O/MI
 -----END PGP SIGNATURE-----

Merge tag 'hid-for-linus-2026061601' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid

Pull HID updates from Jiri Kosina:
 "Core:
   - semantic cleanup fixes for 'hid_device_id::driver_data' (Pawel
     Zalewski)

  Multitouch:
   - UX improvement fixes for Yoga Book 9 (Dave Carey)

  Logitech:
   - fix for high resolution scrolling for Logitech HID++ 2.0 devices
     (Lauri Saurus)

  CP2112:
   - fix for cp2112 firmware-based speed configuration, if available
     (Danny Kaehn)

  Wacom:
   - memory corruption and scheduling while atomic and error fixes and
     error handling fixes (Jinmo Yang, Myeonghun Pak)

  New device support:
   - OneXPlayer (Derek J. Clark)
   - HORI Wireless Switch Pad (Hector Zelaya)
   - Rakk Dasig X (Karl Cayme)

  And other assorted small fixes and device ID additions"

* tag 'hid-for-linus-2026061601' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (39 commits)
  HID: hidpp: fix potential UAF in hidpp_connect_event()
  HID: logitech-hidpp: sync wheel multiplier on wheel mode changes
  HID: intel-thc-hid: intel-quickspi: reset touch IC on system resume
  HID: uhid: convert to hid_safe_input_report()
  HID: hid-goodix-spi: validate report size to prevent stack buffer overflow
  HID: nintendo: add support for HORI Wireless Switch Pad
  HID: multitouch: Honor ContactCount for Yoga Book 9 to suppress ghost contacts
  HID: pidff: Use correct effect type in effect update
  HID: wacom: stop hardware after post-start probe failures
  HID: core: demote warning to debug level
  HID: lenovo: Use KEY_PERFORMANCE capability for ThinkPad X12 Tab Gen 2
  HID: lenovo: Add support for ThinkPad X13 Folio keyboard
  HID: cp2112: Configure I2C bus speed from firmware
  HID: cp2112: Add fwnode support
  HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove()
  HID: Input: Add battery list cleanup with devm action
  HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter
  HID: wacom: use cleanup.h for wacom_wac_queue_flush() buffer management
  HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()
  HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert
  ...
2026-06-18 14:20:39 -07:00
Pengpeng Hou
645323a7f4
kconfig: add optional warnings for changed input values
When reading .config input, Kconfig stores user-provided values first
and then resolves the final value after applying dependencies, ranges,
and other constraints.

If the final value differs from the user input, Kconfig already tracks
that state internally, but it does not provide a focused diagnostic to
show which explicit inputs were adjusted. This is particularly confusing
for requested values that get forced down by unmet dependencies or
clamped by ranges.

Add an opt-in diagnostic controlled by KCONFIG_WARN_CHANGED_INPUT. Emit
the warnings from conf_write() and conf_write_defconfig() after value
resolution. Print the diagnostic to stderr directly, not through the
normal message callback, so it remains visible when conf is run with -s,
such as from make -s.

Keep the diagnostic out of the conf_message() formatting buffer so long
warning lists are not truncated, and mark processed symbols as written
before the SYMBOL_WRITE check so duplicate menu nodes cannot emit
duplicate warnings.

Document the new environment variable and add tests for olddefconfig,
savedefconfig, and the silent-conf path.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Tested-by: Julian Braha <julianbraha@gmail.com>
Link: https://patch.msgid.link/20260611060000.23858-1-pengpeng@iscas.ac.cn
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
2026-06-18 11:46:32 -07:00
Rong Xu
9a289cc425
modpost: Ignore Clang LTO suffixes in symbol matching
When building the kernel with Clang ThinLTO enabled, the compiler
can mangle static variable names by appending suffixes such as
".llvm.<hash>" to prevent naming collisions across translation units.

This name mangling breaks the section mismatch whitelisting in modpost.
modpost relies on glob patterns (e.g., "*_ops" or "*_probe") to identify
safe references between permanent data and initialization code. Because
the LTO suffix modifies the end of the symbol name, legitimately
whitelisted structures fail the match, resulting in false positive
warnings.

For example, a static pernet_operations struct triggers the following:

  WARNING: modpost: vmlinux: section mismatch in reference: \
  ping_v4_net_ops.llvm.5641696707737373282 (section: .data) -> \
  ping_v4_proc_init_net (section: .init.text)

Fix this by ignoring "*_ops.llvm.*" in "from" symbol names (the same
as "*_ops").

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202606111233.kM8oo8Df-lkp@intel.com/
Signed-off-by: Rong Xu <xur@google.com>
Link: https://patch.msgid.link/20260617224623.1346309-1-xur@google.com
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
2026-06-18 11:35:22 -07:00
Quang Nguyen
7b25dbafa2
spi: rpc-if: Use correct device for hardware reinitialization on resume
rpcif_spi_resume() currently passes the SPI controller device to
rpcif_hw_init(), but the function should be called with the RPC
interface device.

Retrieve the rpcif private data from the SPI controller and pass
rpc->dev instead. Also propagate the return value of rpcif_hw_init() so
that a failure during resume is properly reported rather than silently
ignored.

Fixes: ad4728740b ("spi: rpc-if: Add resume support for RZ/G3E")
Signed-off-by: Quang Nguyen <quang.nguyen.wx@renesas.com>
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20260618081932.172168-1-biju.das.jz@bp.renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-18 19:20:56 +01:00
Ratheesh Kannoth
fda8749ba7 PCI: host-common: Request bus reassignment when not probe-only
pci_host_common_init() is used by several generic ECAM host drivers.
After PCI core changes around pci_flags and preserve_config, these hosts
no longer opted into full bus number reassignment the way they did
before, which broke enumeration of devices on a Marvell CN106XX board.

When PCI_PROBE_ONLY is not set, add PCI_REASSIGN_ALL_BUS so
pci_scan_bridge_extend() takes the reassignment path: bus numbers can be
assigned from firmware EA data (e.g. pci_ea_fixed_busnrs()). Skip the
flag in probe-only mode so existing assignments are not overridden.

Fixes: 7246a4520b ("PCI: Use preserve_config in place of pci_flags")
Closes: https://lore.kernel.org/all/abkqm_LCd9zAM8cW@rkannoth-OptiPlex-7090/
Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com>
[mani: added stable tag]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
[bhelgaas: add problem report link]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Cc: Vidya Sagar <vidyas@nvidia.com>
Link: https://patch.msgid.link/20260414081730.3864372-1-rkannoth@marvell.com
2026-06-18 12:13:14 -05:00
Hans Zhang
0bd9611587 PCI: rockchip: Protect root bus removal with rescan lock
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus
to avoid racing with concurrent rescan or hotplug operations triggered via
sysfs.  Such races may lead to use-after-free issues or system crashes.

Signed-off-by: Hans Zhang <18255117159@163.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
[bhelgaas: commit log]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260521161822.132996-8-18255117159@163.com
2026-06-18 11:50:55 -05:00
Hans Zhang
4e4f9745f0 PCI: plda: Protect root bus removal with rescan lock
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus
to avoid racing with concurrent rescan or hotplug operations triggered via
sysfs.  Such races may lead to use-after-free issues or system crashes.

Signed-off-by: Hans Zhang <18255117159@163.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
[bhelgaas: commit log]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260521161822.132996-10-18255117159@163.com
2026-06-18 11:50:55 -05:00
Hans Zhang
a29812a55d PCI: mediatek: Protect root bus removal with rescan lock
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus
to avoid racing with concurrent rescan or hotplug operations triggered via
sysfs.  Such races may lead to use-after-free issues or system crashes.

Signed-off-by: Hans Zhang <18255117159@163.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
[bhelgaas: commit log]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260521161822.132996-7-18255117159@163.com
2026-06-18 11:50:55 -05:00
Hans Zhang
a6a64e150f PCI: iproc: Protect root bus removal with rescan lock
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus
to avoid racing with concurrent rescan or hotplug operations triggered via
sysfs.  Such races may lead to use-after-free issues or system crashes.

Signed-off-by: Hans Zhang <18255117159@163.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
[bhelgaas: commit log]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260521161822.132996-6-18255117159@163.com
2026-06-18 11:50:55 -05:00
Hans Zhang
2633569649 PCI: dwc: Protect root bus removal with rescan lock
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus
to avoid racing with concurrent rescan or hotplug operations triggered via
sysfs.  Such races may lead to use-after-free issues or system crashes.

Signed-off-by: Hans Zhang <18255117159@163.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
[bhelgaas: commit log]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260521161822.132996-3-18255117159@163.com
2026-06-18 11:50:55 -05:00
Hans Zhang
713331969c PCI: cadence: Protect root bus removal with rescan lock
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus
to avoid racing with concurrent rescan or hotplug operations triggered via
sysfs.  Such races may lead to use-after-free issues or system crashes.

Signed-off-by: Hans Zhang <18255117159@163.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
[bhelgaas: commit log]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260521161822.132996-2-18255117159@163.com
2026-06-18 11:50:55 -05:00
Hans Zhang
20b7aba83c PCI: brcmstb: Protect root bus removal with rescan lock
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus
to avoid racing with concurrent rescan or hotplug operations triggered via
sysfs.  Such races may lead to use-after-free issues or system crashes.

Signed-off-by: Hans Zhang <18255117159@163.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
[bhelgaas: commit log]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260521161822.132996-5-18255117159@163.com
2026-06-18 11:50:55 -05:00
Hans Zhang
a8759c8ac4 PCI: altera: Protect root bus removal with rescan lock
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus
to avoid racing with concurrent rescan or hotplug operations triggered via
sysfs.  Such races may lead to use-after-free issues or system crashes.

Signed-off-by: Hans Zhang <18255117159@163.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
[bhelgaas: commit log]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260521161822.132996-4-18255117159@163.com
2026-06-18 11:50:55 -05:00
Linus Torvalds
83f1454877 Various ext4 updates for 7.2-rc1:
* A major rework of the fast commit mechanism to avoid lock
   contention and deadlocks.  We also export snapshot statistics
   in /proc/fs/ext4/*/fc_info.
 * Performance optimization for directory hash computation by
   processing input in 4-byte chunks and removing function pointers,
   along with new KUnit tests for directory hash.
 * Cleanups in JBD2 to remove special slabs and use kmalloc() instead.
 * Various bug fixes, including:
    - Early validation of donor superblock in EXT4_IOC_MOVE_EXT to avoid
      cross-fs deadlock
    - Fix for a kernel BUG in ext4_write_inline_data_end under
      data=journal
    - Fix for a NULL dereference in jbd2_journal_dirty_metadata when
      handle is aborted
    - Fix for an underflow in JBD2 fast commit block initialization check
    - Fix for LOGFLUSH shutdown ordering to ensure ordered data writeback
    - Miscellaneous fixes for error path return values and KUnit assertions.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCAAdFiEEK2m5VNv+CHkogTfJ8vlZVpUNgaMFAmoz6iIACgkQ8vlZVpUN
 gaMSQwf+ICmzStB4tjmfWTbLo7/LXZVsuWYCcutQm1ToioZep+5javE4R5J+lW7H
 h8g7dnkIfg5RSx6VtdAwff0RqB1kprvyoUD2Qkx3DOqzGqGPHyhgczggq/HOLGDv
 Rylnv/jpK0UCyK5ilmsBDYeLvFHqXlR5bWfeJmXlVQZyFJiMkYao0uCGRJwZ7A/b
 ErMPi/v6jK8Ofv+sQlHmA3wwsnoSSlmZOzfj6Rh5TvComaGg4Mtb0rj6Sh7U1k5L
 7YY/OgQBlY6pocxagqY8HLs2NJbKeTFoAH557UdUIEHoWm4RWTLqahou7yyNmyIb
 By8582Bjy7hs8sbavEh/3qx87qTMCw==
 =AP6z
 -----END PGP SIGNATURE-----

Merge tag 'ext4_for_linus-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4

Pull ext4 updates from Ted Ts'o:

 - A major rework of the fast commit mechanism to avoid lock contention
   and deadlocks. We also export snapshot statistics in
   /proc/fs/ext4/*/fc_info

 - Performance optimization for directory hash computation by processing
   input in 4-byte chunks and removing function pointers, along with new
   KUnit tests for directory hash

 - Cleanups in JBD2 to remove special slabs and use kmalloc() instead

 - Various bug fixes, including:
     - Early validation of donor superblock in EXT4_IOC_MOVE_EXT to
       avoid cross-fs deadlock
     - Fix for a kernel BUG in ext4_write_inline_data_end under
       data=journal
     - Fix for a NULL dereference in jbd2_journal_dirty_metadata when
       handle is aborted
     - Fix for an underflow in JBD2 fast commit block initialization
       check
     - Fix for LOGFLUSH shutdown ordering to ensure ordered data
       writeback
     - Miscellaneous fixes for error path return values and KUnit
       assertions

* tag 'ext4_for_linus-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
  ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT
  ext4: fix kernel BUG in ext4_write_inline_data_end
  ext4: fix ERR_PTR(0) in ext4_mkdir()
  jbd2: remove special jbd2 slabs
  ext4: remove mention of PageWriteback
  ext4: improve str2hashbuf by processing 4-byte chunks and removing function pointers
  ext4: add Kunit coverage for directory hash computation
  ext4: fast commit: export snapshot stats in fc_info
  ext4: fast commit: add lock_updates tracepoint
  ext4: fast commit: avoid i_data_sem by dropping ext4_map_blocks() in snapshots
  ext4: fast commit: avoid self-deadlock in inode snapshotting
  ext4: fast commit: avoid waiting for FC_COMMITTING
  ext4: lockdep: handle i_data_sem subclassing for special inodes
  ext4: fast commit: snapshot inode state before writing log
  jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()
  ext4: fix fast commit wait/wake bit mapping on 64-bit
  jbd2: check for aborted handle in jbd2_journal_dirty_metadata()
  ext4: Use %pe to print PTR_ERR()
  ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback
  ext4: replace KUnit tests for memcmp() with KUNIT_ASSERT_MEMEQ()
2026-06-18 09:42:02 -07:00
Linus Torvalds
dac3b26eae 31 ksmbd fixes
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmox4zkACgkQiiy9cAdy
 T1GiPAwAkMFnKHWoZ1+th9QyMb3ac3ClmhwHLvsEJJo+Q6281u+y9/fiFll9oq+G
 hxpxkFRlt0F0WS4X4bo72RjOj9msB1gXADcNAIPTE+ukm3Psi8gKlXqUSlRs5Dd3
 Hc7O87UQOstyAtVZyBRlFvCIsOIkijQYdV6dONljKvuWPGGO+ICM/V9Qsqnrd3nM
 g11O3dZSfwZUANGYMumq1DuZ25FyV1ffbuFKmzIVvZI5/Qip4X/vND0zixOjiE2o
 W1fbNxZsNXdNDD5vSI26200b36lv0sqpecy7w/W4N5/vOkf5TUkkNVdHxcLKkP8/
 Z0wBaF+Gcsb/c/WWEpF4eOB087W2lmmiunTOOwS94/kgABmhMedoKK52wZnvNYFG
 JjOoXv+KPKbLdlVAj1PlioxBeu7i/aV37FwJ+7m/ynSpDk2bk6GEz2wHAqyPyid4
 y4KHc4dN+/nWLLB071tGqbPheecPxL7SwrtppW2rWEemZNqi4Y3vXIfx3pBrhE7W
 peFaxuDu
 =cmJl
 -----END PGP SIGNATURE-----

Merge tag 'v7.2-rc-part1-ksmbd-fixes' of git://git.samba.org/ksmbd

Pull smb server updates from Steve French:

 - Use after free fixes

 - Out of bounds read fix

 - Add SMB compression support both at rest and over the wire: support
   decompression of compressed SMB2 requests, initially allow compressed
   SMB2 READ responses, and implement get/set compression operations for
   per-file compression state.

 - Credentials fixes: for various FSCTLs, setinfo, delete on close and
   for alternate data streams

 - Fix access checks and permission checks in DUPLICAT_EXTENTS and
   SET_ZERO_DATA fsctls, find_file_posix_info, FILE_LINK_INFORMATION and
   smb2_set_info_sec

 - Reject non valid session in compound request

 - Serialize QUERY_DIRECTORY

 - Prevent path traversal bypass by restricting caseless retry

 - Path lookup fix

 - Two minor cleanup fixes

* tag 'v7.2-rc-part1-ksmbd-fixes' of git://git.samba.org/ksmbd: (31 commits)
  ksmbd: fix path resolution in ksmbd_vfs_kern_path_create
  ksmbd: use opener credentials for FSCTL mutations
  ksmbd: use opener credentials for ADS I/O
  ksmbd: require source read access for duplicate extents
  ksmbd: run set info with opener credentials
  ksmbd: use opener credentials for delete-on-close
  ksmbd: serialize QUERY_DIRECTORY requests per file
  ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE
  ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION
  ksmbd: reject non-VALID session in compound request branch
  ksmbd: compress SMB2 READ responses
  ksmbd: negotiate and decode SMB2 compression
  cifs: negotiate chained SMB2 compression capabilities
  smb: add common SMB2 compression transform helpers
  smb: move LZ77 compression into common code
  ksmbd: add per-handle permission check to FILE_LINK_INFORMATION
  ksmbd: add a permission check for FSCTL_SET_ZERO_DATA
  ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY
  ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL
  smb: server: remove code guarded by nonexistent config option
  ...
2026-06-18 09:21:50 -07:00
Linus Torvalds
e753a63f2a 14 smb3 client fixes
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmozDFkACgkQiiy9cAdy
 T1GXbAv+L1Uy4GflN9jfdC92lOugZ0IHUxSXoaEOIFNda47IBxPmtegpJ3/oUrQi
 E4ymHHXQXiEDQTA1MTXh23OPhiF4GXedMYoxqRI8f0edYe6KEXp2xTMMpojGSq3S
 P6Bnle07Afi33njUjH3X0Nv9Sdpuz3f36828B3hxojhwb46axveSGAQtO/iy6VWg
 CLEcCZeBF1s/mAplwawgY8lGPtPmChqoM7Diy0dtVKFZcHR8mjX258t05d6sYvys
 LBXLFbkmZL/n8PJhkU+/ZZST+1CZwaA1Ar77oMAFx7g5jtNJwdMC0Wm8I/57HDS+
 h3Neb/TH5SLlMQkPlBcYz+o9TDkFS6m7Ch1w7stANP27Z8IiX1eVZJ67WQ0rMMtr
 sizGSqxRVJ2QrfV+8xHOF8mD8gGZpHAcjIJcMOW8oCxayis5PBdlDFaL6CGJjZNJ
 nzrsVdtVNLvkGDtkEIUzn0APUWpjN4HSMEnIqEi5DwF7j1QWimCR6q73C63d2DMq
 5Yovh4Qd
 =QP62
 -----END PGP SIGNATURE-----

Merge tag 'v7.2-rc-part1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6

Pull smb client updates from Steve French:
 - Three cleanup patches
 - Fix error return value in smb2_aead_req_alloc
 - Three compression fixes
 - Update i_blocks after write (fixes various xfstests)
 - Fix races in cifsd thread creation
 - Fix potential out of bounds read parsing security descriptors
 - Witness protocol fix
 - Fix umount bug
 - Mount fix
 - Fix cached directory entries on unlink/rmdir/rename

* tag 'v7.2-rc-part1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
  smb: client: Use more common code in SMB2_tcon()
  smb: client: Use more common error handling code in smb3_reconfigure()
  smb/client: Fix error code in smb2_aead_req_alloc()
  smb/client: clean up a type issue in cifs_xattr_get()
  smb/client: allow FS_IOC_SETFLAGS to clear compression
  smb/client: use writable handle for FS_IOC_SETFLAGS compression
  smb/client: always return a value for FS_IOC_GETFLAGS
  smb/client: update i_blocks after contiguous writes
  smb: client: fix races in cifsd thread creation
  cifs: validate full SID length in security descriptors
  smb: client: resolve SWN tcon from live registrations
  cifs: remove all cifs files before kill super
  smb: client: fix conflicting option validation for new mount API
  cifs: invalidate cfid on unlink/rename/rmdir
2026-06-18 09:18:00 -07:00
Linus Torvalds
3dc7c00116 NFSD 7.2 Release Notes
Jeff Layton wired up netlink upcalls for the auth.unix.ip and
 auth.unix.gid caches in SunRPC and the svc_export and nfsd.fh
 caches in NFSD. The new kernel-user API is more extensible and
 lays the groundwork for retiring the old pipe interface.
 
 The default NFS r/w block size rises to 4MB on hosts with at least
 16GB of RAM, reducing per-RPC overhead on fast networks. Smaller
 machines keep their previously computed default, and the value
 remains tunable through /proc/fs/nfsd/max_block_size.
 
 Chuck Lever converted the server's RPCSEC GSS Kerberos code to the
 kernel's shared crypto/krb5 library. The conversion retires and
 removes SunRPC's bespoke implementation of Kerberos v5, but keeps
 RPCSEC GSS-API.
 
 Continuing the xdrgen migration that converted the NLMv4 server XDR
 layer in v7.1, Chuck Lever converted the NLM version 3 server-side
 XDR layer from hand-written C to xdrgen-generated code. As with the
 NLMv4 conversion in v7.1, the goals are improved memory safety,
 lower maintenance burden, and groundwork for generation of Rust code
 for this layer instead of C.
 
 Chuck Lever fixed an issue where lingering NFSv4 state pins a
 mounted file system after it is unexported. A new netlink-based
 mechanism can now release NLM locks and NFSv4 state by client
 address, by filesystem, and by export. Now an administrator can
 quiesce an export cleanly before unmounting it.
 
 The remaining patches are bug fixes, clean-ups, and minor
 optimizations, including a batch of memory-leak and use-after-free
 fixes in the ACL, lockd, and TLS handshake paths, many of them
 reported by Chris Mason. Sincere thanks to all contributors,
 reviewers, testers, and bug reporters who participated in the v7.2
 NFSD development cycle.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEKLLlsBKG3yQ88j7+M2qzM29mf5cFAmox5BcACgkQM2qzM29m
 f5eFJQ//QlyZCt0BlzeBrGHJB41yrMZkZGSJsPaZPfvNnjIQPwd6WH3d6i1vygvC
 HgC+KTF/8LLuFx14m17M6FBCujixNoknMLyp74vRPZOSCoXilP/jzlDoVWwgwv73
 E0AkKXyij1QFToIh7NP/ClX+Zpc9yoCR3/RWri7ud400z1mlvFBk8NA7E6pb+AzT
 89lKFgkubSQVnHFRdIAgb3G/AkZzt35O6hzPA6thtwkb8MS2knE27L9HNc2InQ/K
 71QjQj09052tcXOJRHlg7Xj6AeCyPteCqxsA03qMo2mmqRiSBVV+5y6czawxdHk8
 yt9cDloUu+ZynhH4qktv3i8lX7dPcYNfIcMora71LAswDE5Ud3c/EG6zleA5DnzX
 cgUaS8VkbfLyHAlvPRl9DroizsBgrr/qjuwUqewoY/wJCpyEBtCGRxLKI0MS2Ivo
 BvgdXE74uCyOGZ2EYOqaocGejMtXt1GGpf2Wj5/jyDDUABEhwTptoTIlbBcWQbf6
 7ZRlxjwx7kaMMtmag0ZEhkh42ujoHF3NzNDDD4hY1M6twgF+0uofJPLb5eK4JZak
 FDKV38iiwqq2/bWOKGnaFQBV1Hn/0569rxFku2Z0O+wWNBXhiZ5wezw84GoYaCt/
 AYSDFYnI4FOrHurdmgZUyr04W2toXWN6mV3IqbDIIx5eXyWEKvU=
 =xAeq
 -----END PGP SIGNATURE-----

Merge tag 'nfsd-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux

Pull nfsd updates from Chuck Lever:
 "Jeff Layton wired up netlink upcalls for the auth.unix.ip and
  auth.unix.gid caches in SunRPC and the svc_export and nfsd.fh caches
  in NFSD. The new kernel-user API is more extensible and lays the
  groundwork for retiring the old pipe interface.

  The default NFS r/w block size rises to 4MB on hosts with at least
  16GB of RAM, reducing per-RPC overhead on fast networks. Smaller
  machines keep their previously computed default, and the value remains
  tunable through /proc/fs/nfsd/max_block_size.

  Chuck Lever converted the server's RPCSEC GSS Kerberos code to the
  kernel's shared crypto/krb5 library. The conversion retires and
  removes SunRPC's bespoke implementation of Kerberos v5, but keeps
  RPCSEC GSS-API.

  Continuing the xdrgen migration that converted the NLMv4 server XDR
  layer in v7.1, Chuck Lever converted the NLM version 3 server-side XDR
  layer from hand-written C to xdrgen-generated code. As with the NLMv4
  conversion in v7.1, the goals are improved memory safety, lower
  maintenance burden, and groundwork for generation of Rust code for
  this layer instead of C.

  Chuck Lever fixed an issue where lingering NFSv4 state pins a mounted
  file system after it is unexported. A new netlink-based mechanism can
  now release NLM locks and NFSv4 state by client address, by
  filesystem, and by export. Now an administrator can quiesce an export
  cleanly before unmounting it.

  The remaining patches are bug fixes, clean-ups, and minor
  optimizations, including a batch of memory-leak and use-after-free
  fixes in the ACL, lockd, and TLS handshake paths, many of them
  reported by Chris Mason. Sincere thanks to all contributors,
  reviewers, testers, and bug reporters who participated in the v7.2
  NFSD development cycle"

* tag 'nfsd-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: (106 commits)
  svcrdma: wake sq waiters when the transport closes
  nfsd: reset write verifier on deferred writeback errors
  nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race
  sunrpc: wait for in-flight TLS handshake callback when cancel loses race
  sunrpc: pin svc_xprt across the asynchronous TLS handshake callback
  nfsd: fix posix_acl leak on SETACL decode failure
  nfsd: fix posix_acl leak and ignored error in nfsd4_create_file
  nfsd: check get_user() return when reading princhashlen
  nfsd: fix inverted cp_ttl check in async copy reaper
  nfsd: fix dead ACL conflict guard in nfsd4_create
  NFSD: Fix SECINFO_NO_NAME decode error cleanup
  sunrpc: harden rq_procinfo lifecycle to prevent double-free
  SUNRPC: Return an error from xdr_buf_to_bvec() on overflow
  SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing
  nfsd: release layout stid on setlease failure
  lockd: Avoid hashing uninitialized bytes in nlm4svc_lookup_file()
  lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure
  lockd: Plug nlm_file leak when nlm_do_fopen() fails
  Revert "NFSD: Defer sub-object cleanup in export put callbacks"
  Revert "svcrdma: Use contiguous pages for RDMA Read sink buffers"
  ...
2026-06-18 09:14:15 -07:00
Linus Torvalds
6edc20078a fuse update for 7.2
-----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQSQHSd0lITzzeNWNm3h3BK/laaZPAUCajE+HAAKCRDh3BK/laaZ
 POtqAQDLFg02uYFjQ2KTsgLi6fYvQw2w32d+MvNO4f//pO/dPQD9FfH66MSkOW25
 TV/WLbQ9vzsfdPFfe8uXvm4EF01w9wU=
 =qUPT
 -----END PGP SIGNATURE-----

Merge tag 'fuse-update-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse

Pull fuse updates from Miklos Szeredi:

 - Fix lots of bugs, most from the late 6.x era, but some going back
   to 2.6.x

 - Add subsystems (io-uring, passthrough) and respective maintainers
   (Bernd, Joanne and Amir)

 - Separate transport and fs layers (Miklos)

 - Don't block on cat /dev/fuse (Joanne)

 - Perform some refactoring in fuse-uring (Joanne)

 - Don't use bounce-buffer for READDIR reply in virtio-fs (Matthew Ochs)

 - Clean up documentation (Randy)

 - Improve tracing (Amir)

 - Extend page cache invalidation after DIO (Cheng Ding)

 - Invalidate readdir cache on epoch change (Jun Wu)

 - Misc cleanups

* tag 'fuse-update-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: (81 commits)
  fuse-uring: clear ent->fuse_req in commit_fetch error path
  fuse-uring: use named constants for io-uring iovec indices
  fuse-uring: refactor setting up copy state for payload copying
  fuse-uring: use enum types for header copying
  fuse-uring: refactor io-uring header copying from ring
  fuse-uring: refactor io-uring header copying to ring
  fuse-uring: separate next request fetching from sending logic
  fuse: invalidate readdir cache on epoch bump
  virtio-fs: avoid double-free on failed queue setup
  fuse: invalidate page cache after DIO and async DIO writes
  fuse: set ff->flock only on success
  fuse: clean up interrupt reading
  fuse: remove stray newline in fuse_dev_do_read()
  fuse: use READ_ONCE in fuse_chan_num_background()
  fuse: dax: Move long delayed work on system_dfl_long_wq
  fuse: add fuse_request_sent tracepoint
  fuse: Add SPDX ID lines to some files
  fuse: use QSTR() instead of QSTR_INIT() in fuse_get_dentry
  fuse: convert page array allocation to kcalloc()
  fuse: use current creds for backing files
  ...
2026-06-18 08:50:52 -07:00
Markus Elfring
b59aff6276 ALSA: emu10k1: Use common error handling code in snd_emu10k1_playback_open()
Use an additional label so that a bit of exception handling can be better
reused at the end of this function implementation.

This issue was detected by using the Coccinelle software.

Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Link: https://patch.msgid.link/d709474d-62b0-4f7e-9011-a0f716b35383@web.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-06-18 17:50:30 +02:00
Jean-Louis Colaco
348f69320e ALSA: usb-audio: Add quirk for YAMAHA CDS3000
This quirk is identical to the one for the Yamaha Steinberg UR22, here
applied to a CD player that also uses the Steinberg USB interface.
This quirk is necessary to avoid sporadic "clic" noise when using the DAC
of the player.

Signed-off-by: Jean-Louis Colaco <jean-louis.colaco@orange.fr>
Link: https://patch.msgid.link/20260618113202.8363-1-jean-louis.colaco@orange.fr
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-06-18 17:48:56 +02:00
Mark Tomlinson
3c2e6cc6af PCI: iproc: Restore .map_irq() for the platform bus driver
Commit b64aa11eb2 ("PCI: Set bridge map_irq and swizzle_irq to default
functions") moved the assignment of default .map_irq() callback to
devm_of_pci_bridge_init() and removed the initialization of
'iproc_pcie::map_irq' in platform bus driver.  This led to the callback
getting assigned the NULL pointer for platform bus driver, thereby breaking
the INTx functionality, since 'iproc_pcie::map_irq' overrides the
'pci_host_bridge::map_irq' callback in iproc_pcie_setup().

This issue only affected the iproc platform bus driver as this driver
relies on the default callback for non-PAXC controllers. iproc-brcm driver
was already providing the custom mapping function, so it was unaffected.

Restore the original (and intended) behaviour to use the default map_irq
function by removing the local 'iproc_pcie::map_irq' pointer and directly
assigning the 'pci_host_bridge::map_irq' callback in iproc-bcma driver.
This ensures that the default 'map_irq' callback is used for platform bus
driver and only iproc-brcm driver overrides it with a custom one.

Fixes: b64aa11eb2 ("PCI: Set bridge map_irq and swizzle_irq to default functions")
Signed-off-by: Mark Tomlinson <mark.tomlinson@alliedtelesis.co.nz>
[mani: commit log]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Ray Jui <ray.jui@broadcom.com>
Link: https://patch.msgid.link/20260430021628.1343154-1-mark.tomlinson@alliedtelesis.co.nz
2026-06-18 10:16:57 -05:00
Linus Torvalds
9e7e663345 RDMA v7.2 merge window
Many AI driven bug fixes, and several big driver API cleanups
 
 - Driver bug fixes and minor cleanups in mlx5, hns, rxe, efa, siw, rtrs,
   mana, irdma, mlx4. Commonly error path flows, integer arithmetic
   overflows on unsafe data, out of bounds access, and use after free
   issues under races.
 
 - Second half of the new udata API for drivers focusing on uAPI response
 
 - bnxt_re supports more options for QP creation that will allow a dv
   path in rdma-core
 
 - Untangle the module dependencies so drivers don't link to ib_uverbs.ko
   as was originall intended
 
 - Provide a new way to handle umems with a consistent simplified uAPI and
   update several drivers to use it. This brings dmabuf support to more
   places and more drivers
 
 - Support for mlx5 rate limit and packet pacing for UD and UC
 
 - A batch of fixes for the new shared FRMR pools infrastructure
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRRRCHOFoQz/8F5bUaFwuHvBreFYQUCajLevAAKCRCFwuHvBreF
 YVFuAP0X6gxaON+6cRGoaHp+KjxNj3zbuRj9VccTOy1OjerUdwD+LsbK/Pa9xrcO
 ByA3LVvbw4BoQw9qcQpTu2klFuYV5g8=
 =qnpN
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma

Pull rdma updates from Jason Gunthorpe:
 "Many AI driven bug fixes, and several big driver API cleanups

   - Driver bug fixes and minor cleanups in mlx5, hns, rxe, efa, siw,
     rtrs, mana, irdma, mlx4. Commonly error path flows, integer
     arithmetic overflows on unsafe data, out of bounds access, and use
     after free issues under races.

   - Second half of the new udata API for drivers focusing on uAPI
     response

   - bnxt_re supports more options for QP creation that will allow a dv
     path in rdma-core

   - Untangle the module dependencies so drivers don't link to
     ib_uverbs.ko as was originall intended

   - Provide a new way to handle umems with a consistent simplified uAPI
     and update several drivers to use it. This brings dmabuf support to
     more places and more drivers

   - Support for mlx5 rate limit and packet pacing for UD and UC

   - A batch of fixes for the new shared FRMR pools infrastructure"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (148 commits)
  RDMA/irdma: Replace waitqueue and flag with completion
  RDMA/hns: Fix memory leak of bonding resources
  RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
  docs: infiniband: correct name of option to enable the ib_uverbs module
  RDMA/bnxt_re: Reject GET_TOGGLE_MEM when toggle page was not allocated
  RDMA/bnxt_re: Fail DBR related page allocation UAPIs if the feature is disabled
  RDMA/bnxt_re: Avoid repeated requests to allocate WC pages
  RDMA/bnxt_re: Proper rollback if the ioremap fails
  RDMA/bnxt_re: Add a max slot check for SQ
  RDMA/bnxt_re: Avoid displaying the kernel pointer
  RDMA/bnxt_re: Free CQ toggle page after firmware teardown
  RDMA/bnxt_re: Free SRQ toggle page after firmware teardown
  RDMA/bnxt_re: Initialize dpi variable to zero
  ABI: sysfs-class-infiniband: minor cleanup
  RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one
  RDMA/mlx5: Fix undefined shift of user RQ WQE size
  RDMA/mlx5: Remove raw RSS QP restrack tracking
  RDMA/mlx5: Remove DCT restrack tracking
  RDMA/mlx5: Drop FRMR pool handle on UMR revoke failure
  RDMA/core: Add ib_frmr_pool_drop for unrecoverable handles
  ...
2026-06-18 08:16:21 -07:00
Rosen Penev
7cb0335070 PCI: mvebu: Use fixed-width interrupt masks to avoid truncation in 64-bit builds
Use u32-typed BIT and GENMASK helpers for PCIe interrupt register
masks.  This keeps inverted masks in the same width as the registers
and avoids truncation warnings on 64-bit compile-test builds.

Fixes below and similar warnings:

  drivers/pci/controller/pci-mvebu.c:316:21: error: implicit conversion from 'unsigned long' to 'u32' (aka 'unsigned int') changes value from 18446744069414584320 to 0 [-Werror,-Wconstant-conversion]
           mvebu_writel(port, ~PCIE_INT_ALL_MASK, PCIE_INT_UNMASK_OFF);

Assisted-by: Codex:GPT-5.5
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260526044016.1025613-1-rosenp@gmail.com
2026-06-18 10:15:16 -05:00
Linus Torvalds
00d07402df ata changes for 7.2-rc1
- Bump required Clang version to 23 (Marco)
    NOTE: This commit was merged from an immutable branch from the tip
    tree, and is carried both in the tip tree and the libata tree (with
    the approval of tip maintainers) to avoid dependency problems.
 
  - Add Clang context analysis annotations (Bart)
 
  - Use the ahci_nr_ports() helper in libahci (me)
 
  - Fail to probe the ahci driver if the BAR size is smaller than the
    required size to support CAP.NP (Number of Ports) (liyouhong)
 
  - Move EXPORT_SYMBOL_GPL(ahci_do_softreset) to be just below the
    function definition (Bart)
 
  - Make ata_scsi_scan_host() schedule hotplug work on the
    system_dfl_long_wq workqueue so that it can benefit from scheduler
    task placement (Marco)
 
  - Make ata_scsi_port_error_handler() schedule hotplug work on the
    system_dfl_long_wq workqueue, such that the work always uses the same
    workqueue (me)
 
  - Use devm_platform_get_and_ioremap_resource() in pata_arasan_cf driver
    (Rosen)
 
  - Fix ata_exec_internal() to only release and acquire the EH mutex if
    the calling function is the one holding the EH mutex (Bart)
 
  - Use hweight_long() to count the port_map bits (TanZheng)
 
  - Add COMPILE_TEST support for pata_ep93xx driver (Rosen)
 
  - Drop unused assignments from pata_isapnp driver (Uwe)
 
  - Extend existing JMicron PMP quirk to include JMicron JMS562 (Xu)
 
  - Drop unused assignments of pci_device_id driver data (Uwe)
 
  - Use named initializers for pci_device_id arrays (Uwe)
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRN+ES/c4tHlMch3DzJZDGjmcZNcgUCajFdDAAKCRDJZDGjmcZN
 cg83AP9gjkyIFg4o4ImG1jL46nQ9dHbk+/QQ3ahbn66Wf/UvwgD8CEee7lI3BiXg
 pLzk9Hg982BMA5JAM4SZBJcQXCImmQ4=
 =arvv
 -----END PGP SIGNATURE-----

Merge tag 'ata-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux

Pull ata updates from Niklas Cassel:

 - Bump required Clang version to 23 (Marco), and add Clang context
   analysis annotations (Bart)

 - Use the ahci_nr_ports() helper in libahci (me)

 - Fail to probe the ahci driver if the BAR size is smaller than the
   required size to support CAP.NP (Number of Ports) (liyouhong)

 - Move EXPORT_SYMBOL_GPL(ahci_do_softreset) to be just below the
   function definition (Bart)

 - Make ata_scsi_scan_host() schedule hotplug work on the
   system_dfl_long_wq workqueue so that it can benefit from scheduler
   task placement (Marco)

 - Make ata_scsi_port_error_handler() schedule hotplug work on the
   system_dfl_long_wq workqueue, such that the work always uses the same
   workqueue (me)

 - Use devm_platform_get_and_ioremap_resource() in pata_arasan_cf driver
   (Rosen)

 - Fix ata_exec_internal() to only release and acquire the EH mutex if
   the calling function is the one holding the EH mutex (Bart)

 - Use hweight_long() to count the port_map bits (TanZheng)

 - Add COMPILE_TEST support for pata_ep93xx driver (Rosen)

 - Drop unused assignments from pata_isapnp driver (Uwe)

 - Extend existing JMicron PMP quirk to include JMicron JMS562 (Xu)

 - Drop unused assignments of pci_device_id driver data (Uwe)

 - Use named initializers for pci_device_id arrays (Uwe)

* tag 'ata-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:
  ata: Use named initializers for pci_device_id arrays
  ata: Drop unused assignments of pci_device_id driver data
  ata: libata-pmp: add JMicron JMS562 quirk
  ata: pata_isapnp: Drop unused assignments from pnp_device_id array
  ata: pata_ep93xx: add COMPILE_TEST support
  ata: pata_ep93xx: use unsigned long for data
  ata: pata_ep93xx: avoid asm on non ARM
  ata: Annotate functions in the issuing path with __must_hold()
  ata: libata: Pass ap parameter directly to functions in the issuing path
  ata: libata: Document when host->eh_mutex should be held
  ata: libata: Add an argument to ata_eh_reset()
  ata: ahci: use hweight_long() to count port_map bits
  ata: libata: Fix ata_exec_internal()
  ata: pata_arasan_cf: simplify ioremap
  ata: libata-eh: queue hotplug work on the system_dfl_long_wq workqueue
  ata: libata-scsi: Move long delayed work on system_dfl_long_wq
  ata: ahci: Move EXPORT_SYMBOL_GPL(ahci_do_softreset)
  ata: ahci: fail probe if BAR too small for claimed ports
  ata: libahci: use ahci_nr_ports() helper
2026-06-18 08:12:50 -07:00
Linus Torvalds
2f9f5887b4 for-7.2/io_uring-epoll-20260616
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmoxQDoQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgphm7EADQ7UmRhQGFQCbykRQ2joI0T4FGBgiRQaEa
 Rkpcob8xeqzkX16G00TzXeiM4K76QVaIHG6bDpXNwpHeL/2flsMLSpD0XuQONzAC
 g3OZQsaPyZqXwUZ+3mLKEgd830LgTeIC0iiVm6hnxNhTo29O1v1ueU/K0LgaE0AG
 40q2NSpzxMbnFM/c3UVpepLsZ9XwGwE10xzZJTgnX5VhVxXwlNlT0scmEaHbfeJ3
 hh9fn6KqW0LqnrK7Pq3UBKNxxoiVM5sruFDWPevXgw+LyEBykPiNR3+zzRoXFurx
 cIwavXR9tVnTFFdfSpZ/YWA11TuOlIyELxb50R3cN4ks8y7nVTNbv6vF7fVCJDIO
 iHylAsAHEvkLaCt8X4qZsZQwO/10ZeaUA4gNPnT15gs8jxvk5SWEQOX74tZHps4S
 eBPB9zyxfRXs6KZWRfONEHpYQnkfQH5/jIYGjycenWlyZ2jHqwZYcOWQcn9lqHzF
 UWWblfp8JfRegmp5i5vwJNUSRq3FUVDiifVSYkSrYpeVztIbSz8E36pes8GKVSZe
 gKKw1qgEcqio72dmprZFVAuG3YhAD6ebXAI5KWQ3XZcwJCKnaw16H4ObjBXrqOgH
 69jzB4xlwvHlbyFnBQpYFdtfge0ziD0DbMVYT701TCUwsA7CItBEiOe5ZQ6N8u2/
 QME4m1sg8A==
 =yyaO
 -----END PGP SIGNATURE-----

Merge tag 'for-7.2/io_uring-epoll-20260616' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull io_uring epoll update from Jens Axboe:
 "As discussed a few months ago, this pull request gets rid of allowing
  nested epoll notification contexts via io_uring.

  Nested contexts have been a source of issues on the epoll side, and
  there should not be a need to support them from io_uring. The epoll
  io_uring side exists mainly to facilitate a gradual migration from a
  notification based epoll setup to an io_uring ditto"

* tag 'for-7.2/io_uring-epoll-20260616' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring/epoll: disallow adding an epoll file to an epoll context
  io_uring/epoll: switch to using do_epoll_ctl_file() interface
2026-06-18 08:09:57 -07:00
Alvin Šipraga
e6fa716c9d
ASoC: audio-graph-card2: Drop warning for manually selected DAI formats
Sometimes the DAI format must be specified in the audio-graph-card2
device tree, so emitting a warning can be misleading. Revert back to
emitting no warning.

A few examples where automatic format selection might not be applicable:

- For DPCM, where the other side of the DAI link is not apparent, no
  proper selection can actually be made. This can lead to disagreeing
  formats.

- Due to hardware peculiarities, some ostensibly supported formats might
  not work in practice.

In either case, the only correct solution is for the sound card to set
the format

Link: https://lore.kernel.org/all/87ik7s36k2.wl-kuninori.morimoto.gx@renesas.com/
Signed-off-by: Alvin Šipraga <alvin.sipraga@analog.com>
Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Link: https://patch.msgid.link/20260617145508.327213-1-alvin@pqrs.dk
Signed-off-by: Mark Brown <broonie@kernel.org>
2026-06-18 13:51:18 +01:00
Heiko Carstens
6938846872 s390/idle: Add missing EXPORT_SYMBOL_GPL()
Uwe Kleine-König reported this build breakage caused by a recent commit
which provides arch specific kcpustat_field_idle()/kcpustat_field_iowait()
functions:

ERROR: modpost: "arch_kcpustat_field_idle" [drivers/leds/trigger/ledtrig-activity.ko] undefined!
ERROR: modpost: "arch_kcpustat_field_iowait" [drivers/leds/trigger/ledtrig-activity.ko] undefined!

Fix this by adding the missing EXPORT_SYMBOL_GPL().

Fixes: 670e057744 ("s390/idle: Provide arch specific kcpustat_field_idle()/kcpustat_field_iowait()")
Reported-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
Closes: https://lore.kernel.org/r/ajKsG0JP6qTssQBX@monoceros
Acked-by: Alexander Gordeev <agordeev@linux.ibm.com>
Tested-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
2026-06-18 14:44:44 +02:00
Michael Bommarito
3c7af07943 ALSA: usb-audio: qcom: clear opened when stream enable fails
On enable, subs->opened is set before the service_interval is validated;
an invalid interval jumps to the response label without clearing it, so
the substream is wedged at -EBUSY until a disable or disconnect.

Clear subs->opened on the enable error path.

Fixes: 326bbc3482 ("ALSA: usb-audio: qcom: Introduce QC USB SND offloading support")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Link: https://patch.msgid.link/20260618025126.1862954-3-michael.bommarito@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-06-18 12:44:59 +02:00
Michael Bommarito
bdb640be82 ALSA: usb-audio: qcom: reject stream disable with no active interface
handle_uaudio_stream_req() resolves an interface index with
info_idx_from_ifnum(), which returns -EINVAL when no interface matches.
The enable branch and the response: cleanup label both guard against a
negative index, but the disable branch does not: it forms
info = &uadev[pcm_card_num].info[info_idx] and dereferences it.

uadev[].info is a pointer allocated only when a stream is first enabled,
so a negative info_idx on the disable path is unsafe in two ways:

 - If the card was never enabled, .info is NULL and &info[-EINVAL] is a
   wild pointer; reading info->data_ep_pipe faults (kernel oops).

 - If the card was enabled at least once (.info allocated) and the
   disable names an interface that does not match, &info[-EINVAL] points
   before the allocation; info->data_ep_pipe / info->sync_ep_pipe are an
   out-of-bounds slab read and, when non-zero, an out-of-bounds 4-byte
   write (both pipe fields are cleared to 0). That is memory corruption,
   not just a NULL dereference.

The request is reachable from unprivileged local userspace over
AF_QIPCRTR. Reject a disable request with no resolved interface, matching
the guard the enable path already has.

Fixes: 326bbc3482 ("ALSA: usb-audio: qcom: Introduce QC USB SND offloading support")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Link: https://patch.msgid.link/20260618025126.1862954-2-michael.bommarito@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-06-18 12:43:02 +02:00
Haowen Tu
4520fbbaed ALSA: hda/realtek: Add headset mic quirk for Acer S40-54
Acer S40-54 with ALC256 does not restore headset mic detection properly
after S4 resume. After resume, headset plug events may no longer update
the headset mic state, leaving the headset microphone unavailable.

The system uses subsystem ID 1025:161f. Applying the existing
ALC256_FIXUP_ACER_MIC_NO_PRESENCE fixup restores headset mic detection
on this machine.

Add a machine-specific quirk for this system.

Signed-off-by: Haowen Tu <tuhaowen@uniontech.com>
Link: https://patch.msgid.link/20260618075431.1116988-1-tuhaowen@uniontech.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-06-18 12:40:22 +02:00
Maoyi Xie
58fc1275b3 ALSA: caiaq: bound the length in the EP1 input parsers
snd_caiaq_input_read_erp() and snd_caiaq_input_read_io() can be reached
from snd_usb_caiaq_input_dispatch(). They read fixed byte offsets from
the reply buffer without checking the reported length. On a short reply
they decode stale bytes left from a previous, longer report and feed them
to the input layer.

This is not an out-of-bounds access. Every offset is a compile-time
driver constant. The largest is buf[21] in the Maschine ERP case. The
EP1 transfer buffer ep1_in_buf is EP1_BUFSIZE (64) bytes, and the USB
core caps actual_length at 64, so a short reply only reads in-bounds
stale data. Acting on data the device did not send is still wrong, so
bail out per usb_id case when the reply is shorter than the bytes that
case consumes.

  read_erp: AK1 needs 2 bytes, Kore needs 16, Maschine needs 22.
  read_io:  the Kore case needs 5 bytes (buf[4]) and the Traktor Kontrol
            X1 case needs 7 (buf[5]/buf[6]). The preceding key bit loop
            is already bounded by "i < len * 8" and is left untouched.

snd_caiaq_input_read_analog() and snd_usb_caiaq_maschine_dispatch() are
not changed. Their callers already floor the reply length.

Suggested-by: Takashi Iwai <tiwai@suse.com>
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Link: https://patch.msgid.link/178176259547.3343534.6659489917322808916@maoyixie.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-06-18 12:37:50 +02:00
Maoyi Xie
f7f3f9fd81 ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser
snd_usb_caiaq_tks4_dispatch() decodes the Traktor Kontrol S4 input
stream in fixed 16-byte (TKS4_MSGBLOCK_SIZE) message blocks. On every
iteration it advances buf and subtracts the block size while looping on
"while (len)".

len is urb->actual_length. That value is supplied by the device and is
not guaranteed to be a multiple of 16. When a final short block leaves
len between 1 and 15, the loop runs once more, reads up to buf[15], and
then does "len -= TKS4_MSGBLOCK_SIZE". As len is unsigned this underflows
to a huge value. The loop then keeps iterating and walking buf far past
the end of the 512-byte ep4_in_buf, reading out of bounds until a bogus
block id happens to be hit.

Iterate only while a full message block is available. This stops the
unsigned underflow and silently drops any trailing partial block, which
carries no complete control value anyway.

The sibling endpoint-4 parsers are not affected. The Traktor Kontrol X1
and Maschine arms in snd_usb_caiaq_ep4_reply_dispatch() floor
urb->actual_length before dispatching.

Fixes: 15c5ab6070 ("ALSA: snd-usb-caiaq: Add support for Traktor Kontrol S4")
Cc: stable@vger.kernel.org
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Link: https://patch.msgid.link/178176259547.3343534.2724779296835237429@maoyixie.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-06-18 12:37:40 +02:00
Ben Dooks
53d1ae7c20 ALSA: pcm: fix __le32 cast warning in snd_pcm_set_sync_per_card
In snd_pcm_set_sync_per_card() the le32 value is written to an u32
instead of an __le32 pointer. Fix the following warning by fixing
the type:

sound/soc/soc-pcm.c:2166:9: warning: incorrect type in argument 7 (different base types)
sound/soc/soc-pcm.c:2166:9:    expected int
sound/soc/soc-pcm.c:2166:9:    got restricted snd_pcm_format_t

Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk>
Link: https://patch.msgid.link/20260617102943.893950-1-ben.dooks@codethink.co.uk
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-06-18 12:33:59 +02:00
Uwe Kleine-König (The Capable Hub)
ac930b80c1
i2c: pxa: Use named initializers for the platform_device_id array
Named initializers are better readable and more robust to changes of the
struct definition. This robustness is relevant for a planned change to
struct platform_device_id replacing .driver_data by an anonymous union.

Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/827657abb02edb39bc90f7336194f614d383770e.1781688767.git.u.kleine-koenig@baylibre.com
2026-06-18 12:08:49 +02:00
Yichong Chen
892a786473 tools/mm/slabinfo: fix total_objects attribute name
SLUB exports the total_objects sysfs attribute, but slabinfo tries to read
objects_total. As a result, the lookup fails and the field remains zero.

Use the correct attribute name and rename the corresponding structure
member to match.

Fixes: 205ab99dd1 ("slub: Update statistics handling for variable order slabs")
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Cc: <stable@vger.kernel.org>
Reviewed-by: SeongJae Park <sj@kernel.org>
Link: https://patch.msgid.link/96556748872BB47E+20260612071359.649946-1-chenyichong@uniontech.com
Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
2026-06-18 11:19:43 +02:00
Randy Dunlap
7b5f5865fb slab: recognize @GFP parameter as optional in kernel-doc
Since the @GFP parameter in kmalloc_obj() etc. is now optional, change
the kernel-doc to indicate that it is optional. This avoids kernel-doc
warnings:

WARNING: include/linux/slab.h:1101 Excess function parameter 'GFP' description in 'kmalloc_obj'
WARNING: include/linux/slab.h:1113 Excess function parameter 'GFP' description in 'kmalloc_objs'
WARNING: include/linux/slab.h:1128 Excess function parameter 'GFP' description in 'kmalloc_flex'

Fixes: e19e1b480a ("add default_gfp() helper macro and use it in the new *alloc_obj() helpers")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Acked-by: Harry Yoo (Oracle) <harry@kernel.org>
Link: https://patch.msgid.link/20260617163125.2716279-1-rdunlap@infradead.org
Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
2026-06-18 10:40:53 +02:00
Pedro Falcato
6808645b71 mm/slab: add a node-track-caller variant for kmem buckets allocation
This is required by users that want to use kmem buckets, but still
desire specifying the NUMA node.

Reviewed-by: Kees Cook <kees@kernel.org>
Acked-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
Acked-by: Harry Yoo (Oracle) <harry@kernel.org>
Signed-off-by: Pedro Falcato <pfalcato@suse.de>
Link: https://patch.msgid.link/20260611124642.345400-2-pfalcato@suse.de
Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
2026-06-18 10:40:53 +02:00
Vlastimil Babka (SUSE)
71553a6067 mm/slab: replace __GFP_NO_OBJ_EXT with SLAB_ALLOC_NO_RECURSE for sheaves
Finish the switch away from __GFP_NO_OBJ_EXT by replacing it with
SLAB_ALLOC_NO_RECURSE when allocating empty sheaves. Pass alloc_flags to
[__]alloc_empty_sheaf(). Callers that can't be part of a recursive
kmalloc() chain simply pass SLAB_ALLOC_DEFAULT. Use kmalloc_flags()
instead of kzalloc() for allocating the sheaf.

With that we can finalize the removal the __GFP_NO_OBJ_EXT handling from
obj_ext allocations as well, leaving only SLAB_ALLOC_NO_RECURSE in
place.

This leaves __GFP_NO_OBJ_EXT with no users in slab, so stop allowing the
flag in kmalloc_nolock().

Link: https://patch.msgid.link/20260610-slab_alloc_flags-v2-16-7190909db118@kernel.org
Reviewed-by: Hao Li <hao.li@linux.dev>
Reviewed-by: Harry Yoo (Oracle) <harry@kernel.org>
Reviewed-by: Suren Baghdasaryan <surenb@google.com>
Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
2026-06-18 10:40:53 +02:00
Vlastimil Babka (SUSE)
3022263960 mm/slab: remove __GFP_NO_OBJ_EXT usage from alloc_slab_obj_exts()
__GFP_NO_OBJ_EXT has limited scope within the slab allocator itself and
gfp flags are a scarce resource, unlike slab's alloc_flags.

Introduce SLAB_ALLOC_NO_RECURSE alloc flag that has the same intent as
__GFP_NO_OBJ_EXT but a more generic name, meaning that a kmalloc()
family function should not recurse into another kmalloc*() for the
purposes of allocating auxiliary structures (obj_ext arrays or sheaves).

First, replace the __GFP_NO_OBJ_EXT for allocating obj_ext arrays in
alloc_slab_obj_exts(). Make use of the newly added kmalloc_flags()
function, where we can pass alloc_flags with SLAB_ALLOC_NO_RECURSE
added. This will also pass through SLAB_ALLOC_NOLOCK so we don't need
to special case kmalloc_nolock() anymore.

Note that until now the kmalloc_nolock() ignored the incoming gfp flags
and hardcoded __GFP_ZERO | __GFP_NO_OBJ_EXT. But it's correct to pass on
the incoming gfp flags (only augmented with __GFP_ZERO), because if
alloc_flags contain SLAB_ALLOC_NOLOCK, the incoming gfp flags have to
be also compatible with it. However, we might have added __GFP_THISNODE
for opportunistic slab allocation, as pointed out by Hao Li, and
__GFP_COMP by allocate_slab() as pointed out by Shengming Hu. Solve this
by adding both flags to OBJCGS_CLEAR_MASK as it makes sense to strip
them anyway for non-kmalloc_nolock() allocations of sheaves or obj_ext
arrays as well.

To avoid recursion of sheaf -> obj_ext -> sheaf -> ... allocations at
this patch, until the next patch converts sheaves to
SLAB_ALLOC_NO_RECURSE, use both gfp and alloc_flags for obj_ext. The
next patch will remove the gfp part.

Link: https://patch.msgid.link/20260610-slab_alloc_flags-v2-15-7190909db118@kernel.org
Reviewed-by: Harry Yoo (Oracle) <harry@kernel.org>
Reviewed-by: Suren Baghdasaryan <surenb@google.com>
Reviewed-by: Hao Li <hao.li@linux.dev>
Signed-off-by: Vlastimil Babka (SUSE) <vbabka@kernel.org>
2026-06-18 10:40:32 +02:00
Zhan Xusheng
28c5d23098 erofs: add folio order to trace_erofs_read_folio
erofs supports large folios for reads, but the actual folio order
instantiated in the page cache may be lower due to allocation
constraints such as memory fragmentation.

trace_erofs_read_folio already receives the folio being read but
currently records only its index. Add folio_order() to the tracepoint
so that users can observe the realized folio order and verify the
effectiveness of large folio reads.

Also drop the uptodate field: read_folio() is only called for a
non-uptodate folio, so it is always 0.

Suggested-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
2026-06-18 16:19:33 +08:00
Runyu Xiao
90f0109019 gpio: eic-sprd: use raw_spinlock_t in the irq startup path
sprd_eic_irq_unmask() enables the GPIO IRQ and then updates controller
state through sprd_eic_update(), which takes sprd_eic->lock with
spin_lock_irqsave().  The callback can be reached from irq_startup()
while setting up a requested IRQ.  That path is not sleepable, but on
PREEMPT_RT a regular spinlock_t becomes a sleeping lock.

This issue was found by our static analysis tool and then manually
reviewed against the current tree.

The grounded PoC kept the request_threaded_irq() -> __setup_irq() ->
irq_startup() -> sprd_eic_irq_unmask() -> sprd_eic_update() carrier and
used the original spin_lock_irqsave(&sprd_eic->lock) edge.  Lockdep
reported:

  BUG: sleeping function called from invalid context
  hardirqs last disabled at ... __setup_irq.constprop.0 ... [vuln_msv]
  sprd_rt_spin_lock_irqsave+0x1c/0x30 [vuln_msv]
  sprd_eic_update.constprop.0+0x48/0x90 [vuln_msv]
  sprd_eic_irq_unmask.constprop.0+0x35/0x50 [vuln_msv]
  __setup_irq.constprop.0+0xd/0x30 [vuln_msv]

Convert the Spreadtrum EIC controller lock to raw_spinlock_t.  The
locked section only serializes MMIO register updates and does not contain
sleepable operations, so keeping it non-sleeping is appropriate for the
irqchip callbacks.

Fixes: 25518e024e ("gpio: Add Spreadtrum EIC driver support")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://patch.msgid.link/20260617154035.1199948-3-runyu.xiao@seu.edu.cn
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-18 10:02:13 +02:00
Runyu Xiao
286533cb14 gpio: sch: use raw_spinlock_t in the irq startup path
sch_irq_unmask() enables the GPIO IRQ and then updates the controller
state through sch_irq_mask_unmask(), which takes sch->lock with
spin_lock_irqsave().  The callback can be reached from irq_startup()
while setting up a requested IRQ.  That path is not sleepable, but on
PREEMPT_RT a regular spinlock_t becomes a sleeping lock.

This issue was found by our static analysis tool and then manually
reviewed against the current tree.

The grounded PoC kept the request_threaded_irq() -> __setup_irq() ->
irq_startup() -> sch_irq_unmask() -> sch_irq_mask_unmask() carrier and
used the original spin_lock_irqsave(&sch->lock) edge.  Lockdep reported:

  BUG: sleeping function called from invalid context
  hardirqs last disabled at ... __setup_irq.constprop.0 ... [vuln_msv]
  sch_rt_spin_lock_irqsave+0x1c/0x30 [vuln_msv]
  sch_irq_mask_unmask.constprop.0+0x31/0x70 [vuln_msv]
  __setup_irq.constprop.0+0xd/0x30 [vuln_msv]

Convert the SCH controller lock to raw_spinlock_t.  The same lock is
also used by the GPIO direction and value callbacks, but those critical
sections only update MMIO-backed GPIO registers and do not contain
sleepable operations.  Keeping this register lock non-sleeping is
therefore appropriate for the irqchip callbacks and does not change the
GPIO-side locking contract.

Fixes: 7a81638485 ("gpio: sch: Add edge event support")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Link: https://patch.msgid.link/20260617154035.1199948-2-runyu.xiao@seu.edu.cn
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-06-18 10:02:13 +02:00
Xin Long
7d8297e26b sctp: hold socket lock when dumping endpoints in sctp_diag
SCTP_DIAG endpoint dumping was traversing endpoint address lists without
holding lock_sock(), while those lists could change concurrently via
socket operations (e.g., bindx changes). This creates a race where
nla_reserve() counts addresses under RCU protection, but the subsequent
copy may see fewer entries, potentially leaking uninitialized memory to
userspace.

Fix this by:

- Taking a reference on each endpoint during hash traversal
- Moving socket operations (lock_sock()) outside read_lock_bh()
- Serializing address list access during dump
- Reworking sctp_for_each_endpoint() to support restart-based traversal
  with (net, pos) tracking

Also:

- Add WARN_ON_ONCE() for inconsistent address counts
- Fix idiag_states filtering for LISTEN vs association cases
- Skip dumping endpoints being freed (ep->base.dead)
- Move dump position tracking into iterator, removing cb->args[4] and
  its comment for sctp_ep_dump().,
- Update the comment for cb->args[4] and remove the comment for unused
  cb->args[5] for sctp_sock_dump().

Note: traversal is restart-based and may re-scan buckets multiple times,
but this is acceptable due to small bucket sizes and required to support
sleeping-safe callbacks.

This issue was reported by Nico Yip (@_cyeaa_) working with TrendAI Zero
Day Initiative.

Reported-by: Zero Day Initiative <zdi-disclosures@trendmicro.com>
Fixes: 8f840e47f1 ("sctp: add the sctp_diag.c file")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/4c1b49ab87e0f7d552ebd8172b364b1994e913c9.1781552190.git.lucien.xin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-17 16:41:34 -07:00
Jakub Kicinski
aedd02af1f net: psample: fix info leak in PSAMPLE_ATTR_DATA
psample open codes nla_put() presumably to avoid wiping
the data with 0s just to override it with packet data.
This open coding is missing clearing the pad, however,
each netlink attr is padded to 4B and data_len may
not be divisible by 4B.

Fixes: 6ae0a62861 ("net: Introduce psample, a new genetlink channel for packet sampling")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Link: https://patch.msgid.link/20260616003046.1099490-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-17 16:35:50 -07:00
Li RongQing
b50fa1e07c net/mlx5: Remove broken and unused mlx5_query_mtppse()
mlx5_query_mtppse() reads the Event Trigger Pin (MTPPSE) register but
reads the returned arm and mode values from the input buffer 'in'
instead of the output buffer 'out', so it always returns the values
that were written rather than the actual hardware state, making the
query useless.

The function has no in-tree callers. Remove it rather than fix it.

Signed-off-by: Li RongQing <lirongqing@baidu.com>
Reviewed-by: Gal Pressman <gal@nvidia.com>
Link: https://patch.msgid.link/20260615140406.1828-1-lirongqing@baidu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-17 16:35:33 -07:00