Commit graph

1,427,869 commits

Author SHA1 Message Date
Tuo Li
7ad6ef91d8 md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt()
The variable mddev->private is first assigned to conf and then checked:

  conf = mddev->private;
  if (!conf) ...

If conf is NULL, then mddev->private is also NULL. In this case,
null-pointer dereferences can occur when calling raid5_quiesce():

  raid5_quiesce(mddev, true);
  raid5_quiesce(mddev, false);

since mddev->private is assigned to conf again in raid5_quiesce(), and conf
is dereferenced in several places, for example:

  conf->quiesce = 0;
  wake_up(&conf->wait_for_quiescent);

To fix this issue, the function should unlock mddev and return before
invoking raid5_quiesce() when conf is NULL, following the existing pattern
in raid5_change_consistency_policy().

Fixes: fa1944bbe6 ("md/raid5: Wait sync io to finish before changing group cnt")
Signed-off-by: Tuo Li <islituo@gmail.com>
Reviewed-by: Xiao Ni <xni@redhat.com>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Link: https://lore.kernel.org/linux-raid/20251225130326.67780-1-islituo@gmail.com
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
2025-12-27 09:51:35 +08:00
Linus Torvalds
04688d6128 smb3 client fix
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmlO6cQACgkQiiy9cAdy
 T1HsqAv+Ltayxx9JUSsl9yWKfL5GYaJm0JLFBusl0VYOPnGk2+lQpRea72QpAQVn
 c3dkdHLTgIQoT0jvGrjRO/khYRf6DAm4rxHpGfMkbbpDIbPEFldsDs5Ic5/wNJv9
 X2+msiffb0+m+T4rPxybFycYUexjPgbBlVrAZPc4jxxHZcf/YzvlDN7P9avSgaPU
 Np2eGtqg6pc0187g5BadkDKm2xWAlPgxPklcm41Kjjzxv96tHrK2IstGj1afoZvK
 K+mltI7ge3K/VmigoAOTmPe1zLgF6hwVc9HmU9dRw4itUPKMaI/YuGwRc5oyu8FM
 iBFH2NIWyD6EuouHb37Zu6MsWvulXZmydi5pKcDkhbrglxlhlA82nAoA6Glz1aG+
 CLxHf27vbw4xmse9u5y2Vs0m2Y9obC+8Pb077ZjlYzrYLcfVPi5ayeXeuJ3h5ijA
 n5qO21/eosX23ml4E7AgtIAb1eAce5oy64KU2OIU5J/kWc8HB+uN3802u+Uh45U5
 jnHNN6X8
 =LEh0
 -----END PGP SIGNATURE-----

Merge tag 'v6.19-rc2-smb3-client-fix' of git://git.samba.org/sfrench/cifs-2.6

Pull smb client fix from Steve French:

 - Fix potential memory leak

* tag 'v6.19-rc2-smb3-client-fix' of git://git.samba.org/sfrench/cifs-2.6:
  cifs: Fix memory and information leak in smb3_reconfigure()
2025-12-26 16:19:45 -08:00
Linus Torvalds
1e5e062ad8 Driver core fixes for 6.19-rc3
- Introduce DMA Rust helpers to avoid build errors when !CONFIG_HAS_DMA.
 
 - Remove unnecessary (and hence incorrect) endian conversion in the Rust
   PCI driver sample code.
 
 - Fix memory leak in the unwind path of debugfs_change_name().
 
 - Support non-const struct software_node pointers in
   SOFTWARE_NODE_REFERENCE(), after introducing _Generic().
 
 - Avoid NULL pointer dereference in the unwind path of
   simple_xattrs_free().
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQS2q/xV6QjXAdC7k+1FlHeO1qrKLgUCaU7O/wAKCRBFlHeO1qrK
 LirZAPoCljVnVVZoA1oesoyIQ8KWDdoC55dfUZyCp4yz87MvjgD/e1Gw1o+y3YyS
 dut7ODDimiUPh0I54nMX4l561NMVggU=
 =v3Qg
 -----END PGP SIGNATURE-----

Merge tag 'driver-core-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core

Pull driver core fixes from Danilo Krummrich:

 - Introduce DMA Rust helpers to avoid build errors when !CONFIG_HAS_DMA

 - Remove unnecessary (and hence incorrect) endian conversion in the
   Rust PCI driver sample code

 - Fix memory leak in the unwind path of debugfs_change_name()

 - Support non-const struct software_node pointers in
   SOFTWARE_NODE_REFERENCE(), after introducing _Generic()

 - Avoid NULL pointer dereference in the unwind path of
   simple_xattrs_free()

* tag 'driver-core-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core:
  fs/kernfs: null-ptr deref in simple_xattrs_free()
  software node: Also support referencing non-constant software nodes
  debugfs: Fix memleak in debugfs_change_name().
  samples: rust: fix endianness issue in rust_driver_pci
  rust: dma: add helpers for architectures without CONFIG_HAS_DMA
2025-12-26 13:41:02 -08:00
Linus Torvalds
b63f4a4e95 EFI fixes for v6.19 #1
A couple of fixes for EFI regressions introduced this cycle:
 
 - Make EDID handling in the EFI stub mixed mode safe
 
 - Ensure that efi_mm.user_ns has a sane value - this is needed now that
   EFI runtime calls are preemptible on arm64
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQQm/3uucuRGn1Dmh0wbglWLn0tXAUCaU694AAKCRAwbglWLn0t
 XJHoAPsHkA4g+rRXXhqgysWvqQvGWTrWLiVHPeDOs3dAWTxHpQD+KTNVaW4H+BCz
 x+5S3unu5q9PxWOwqeoCi2JvkKKjJwE=
 =fb7r
 -----END PGP SIGNATURE-----

Merge tag 'efi-fixes-for-v6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi

Pull EFI fixes from Ard Biesheuvel:
 "A couple of fixes for EFI regressions introduced this cycle:

   - Make EDID handling in the EFI stub mixed mode safe

   - Ensure that efi_mm.user_ns has a sane value - this is needed now
     that EFI runtime calls are preemptible on arm64"

* tag 'efi-fixes-for-v6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi:
  kthread: Warn if mm_struct lacks user_ns in kthread_use_mm()
  arm64: efi: Fix NULL pointer dereference by initializing user_ns
  efi/libstub: gop: Fix EDID support in mixed-mode
2025-12-26 13:37:11 -08:00
Jon Kohler
3b34d6324d vhost: use "checked" versions of get_user() and put_user()
vhost_get_user and vhost_put_user leverage __get_user and __put_user,
respectively, which were both added in 2016 by commit 6b1e6cc785
("vhost: new device IOTLB API"). In a heavy UDP transmit workload on a
vhost-net backed tap device, these functions showed up as ~11.6% of
samples in a flamegraph of the underlying vhost worker thread.

Quoting Linus from [1]:
    Anyway, every single __get_user() call I looked at looked like
    historical garbage. [...] End result: I get the feeling that we
    should just do a global search-and-replace of the __get_user/
    __put_user users, replace them with plain get_user/put_user instead,
    and then fix up any fallout (eg the coco code).

Switch to plain get_user/put_user in vhost, which results in a slight
throughput speedup. get_user now about ~8.4% of samples in flamegraph.

Basic iperf3 test on a Intel 5416S CPU with Ubuntu 25.10 guest:
TX: taskset -c 2 iperf3 -c <rx_ip> -t 60 -p 5200 -b 0 -u -i 5
RX: taskset -c 2 iperf3 -s -p 5200 -D
Before: 6.08 Gbits/sec
After:  6.32 Gbits/sec

As to what drives the speedup, Sean's patch [2] explains:
	Use the normal, checked versions for get_user() and put_user() instead of
	the double-underscore versions that omit range checks, as the checked
	versions are actually measurably faster on modern CPUs (12%+ on Intel,
	25%+ on AMD).

	The performance hit on the unchecked versions is almost entirely due to
	the added LFENCE on CPUs where LFENCE is serializing (which is effectively
	all modern CPUs), which was added by commit 304ec1b050 ("x86/uaccess:
	Use __uaccess_begin_nospec() and uaccess_try_nospec").  The small
	optimizations done by commit b19b74bc99 ("x86/mm: Rework address range
	check in get_user() and put_user()") likely shave a few cycles off, but
	the bulk of the extra latency comes from the LFENCE.

[1] https://lore.kernel.org/all/CAHk-=wiJiDSPZJTV7z3Q-u4DfLgQTNWqUqqrwSBHp0+Dh016FA@mail.gmail.com/
[2] https://lore.kernel.org/all/20251106210206.221558-1-seanjc@google.com/

Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Sean Christopherson <seanjc@google.com>
Signed-off-by: Jon Kohler <jon@nutanix.com>
Message-Id: <20251113005529.2494066-1-jon@nutanix.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
2025-12-26 15:00:01 -05:00
zhangdongchuan@eswincomputing.com
4b7bf8d550 virtio_ring: code cleanup in detach_buf_split
Since the return value of vring_unmap_one_split() is exactly
vq->split.desc_extra[i].next, 'i = vq->split.desc_extra[i].next' is
redundant. Assign vring_unmap_one_split() to i instead.

Since vq->split.desc_extra is assigned to extra, use extra[i].next
instead of vq->split.desc_extra[i].next to improve readability.

No change in functionality.

Signed-off-by: zhangdongchuan <zhangdongchuan@eswincomputing.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <202511261140162936986@eswincomputing.com>
2025-12-26 15:00:00 -05:00
Thomas Weißschuh
3c4629b68d virtio: uapi: avoid usage of libc types
Using libc types and headers from the UAPI headers is problematic as it
introduces a dependency on a full C toolchain.

On Linux 'unsigned long' works as a replacement for 'uintptr_t' and does
not depend on libc.

Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251222-uapi-virtio-v1-1-29390f87bcad@linutronix.de>
2025-12-26 15:00:00 -05:00
Linus Torvalds
3f0e9c8cef block-6.19-20251226
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmlOrqkQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpmIoEAC25bhRVlbwHPGTXiT2tFpxb3AQofmcxNZK
 2Ooj525wcHvgPoh6shBiPDoH8tDoUJaqg+ZUtMjA3gYWmbhL719G5n3TuJSE/I6m
 AUwP0pAU+dtJbDRxTfYD7JjSGidKd74WlLHAoF5SiDW1U1DMfyYPfQO+p+MhuGJV
 Olo+oFVdWst4+aV8elxY/SgRISI+3VIRwe+zIlPofRTrvkhh1qYcDKzUZmrxDCRl
 TP4csqKanuTrTZaWTG6tTrIEfyuvsfxDSst/slZziUlEx3k+WnB6WHUbWufWMFp6
 zRuK+NGKrwrLb/K0J1kSGeGsc2Ptkx6Sn+dOp3zNsrH1chihZvr7k+q8z5kBpv7i
 mwu1CbreGRI3pgQYMIdO3UD7PZKEj/5XJ36cHPYWQwG056vrtD2X7dMfGFfJ4SdE
 KBSm3tXDiBLqbP6g2lZ6BixeUB/nHoDqhZtfsP/guw8coVyGkN4w0ND0/mIbbD0p
 VQ47HSQB4zfE6NHlr4tcnDDxEg4V+9d3H1yva0KRwVXjrEsTUcMVSoRwA99JUQoi
 VLmQ2sGn8qEGWxVHPGXvF6gEHnU8eoQfZD2oG2gZPyw145HKeuml4VtbB6wy0J0n
 GHWY8cLcq5y2quWfHDYEbd/g9yedE+Y8eVkHgPbHmGjwCLZOt3pltKmfpjw5otkt
 xdNoodcOTw==
 =DwyX
 -----END PGP SIGNATURE-----

Merge tag 'block-6.19-20251226' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull block fixes from Jens Axboe:

 - Fix for a signedness issue introduced in this kernel release for rnbd

 - Fix up user copy references for ublk when the server exits

* tag 'block-6.19-20251226' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  block: rnbd-clt: Fix signedness bug in init_dev()
  ublk: clean up user copy references on ublk server exit
2025-12-26 11:44:35 -08:00
Mickaël Salaün
6548fb5218
landlock: Fix spelling
Cc: Günther Noack <gnoack3000@gmail.com>
Link: https://lore.kernel.org/r/20251219193855.825889-4-mic@digikod.net
Reviewed-by: Günther Noack <gnoack3000@gmail.com>
Signed-off-by: Mickaël Salaün <mic@digikod.net>
2025-12-26 20:39:01 +01:00
Mickaël Salaün
aa9877d74c
landlock: Clean up hook_ptrace_access_check()
Make variable's scope minimal in hook_ptrace_access_check().

Cc: Günther Noack <gnoack3000@gmail.com>
Link: https://lore.kernel.org/r/20251219193855.825889-3-mic@digikod.net
Reviewed-by: Günther Noack <gnoack3000@gmail.com>
Signed-off-by: Mickaël Salaün <mic@digikod.net>
2025-12-26 20:39:01 +01:00
Mickaël Salaün
03a0ff99ef
landlock: Improve erratum documentation
Improve description about scoped signal handling.

Reported-by: Günther Noack <gnoack3000@gmail.com>
Link: https://lore.kernel.org/r/20251219193855.825889-2-mic@digikod.net
Reviewed-by: Günther Noack <gnoack3000@gmail.com>
Signed-off-by: Mickaël Salaün <mic@digikod.net>
2025-12-26 20:39:00 +01:00
Mickaël Salaün
60207df2eb
landlock: Remove useless include
Remove useless audit.h include.

Cc: Günther Noack <gnoack@google.com>
Fixes: 33e65b0d3a ("landlock: Add AUDIT_LANDLOCK_ACCESS and log ptrace denials")
Link: https://lore.kernel.org/r/20251219193855.825889-1-mic@digikod.net
Reviewed-by: Günther Noack <gnoack3000@gmail.com>
Signed-off-by: Mickaël Salaün <mic@digikod.net>
2025-12-26 20:39:00 +01:00
Tingmao Wang
29fbfa46e4
landlock: Fix wrong type usage
I think, based on my best understanding, that this type is likely a typo
(even though in the end both are u16)

Signed-off-by: Tingmao Wang <m@maowtm.org>
Fixes: 2fc80c69df ("landlock: Log file-related denials")
Reviewed-by: Günther Noack <gnoack@google.com>
Link: https://lore.kernel.org/r/7339ad7b47f998affd84ca629a334a71f913616d.1765040503.git.m@maowtm.org
Signed-off-by: Mickaël Salaün <mic@digikod.net>
2025-12-26 20:38:59 +01:00
Matthieu Buffet
e4aa4461d4
selftests/landlock: NULL-terminate unix pathname addresses
The size of Unix pathname addresses is computed in selftests using
offsetof(struct sockaddr_un, sun_path) + strlen(xxx). It should have
been that +1, which makes addresses passed to the libc and kernel
non-NULL-terminated. unix_mkname_bsd() fixes that in Linux so there is
no harm, but just using sizeof(the address struct) should improve
readability.

Signed-off-by: Matthieu Buffet <matthieu@buffet.re>
Reviewed-by: Günther Noack <gnoack@google.com>
Link: https://lore.kernel.org/r/20251202215141.689986-1-matthieu@buffet.re
Signed-off-by: Mickaël Salaün <mic@digikod.net>
2025-12-26 20:38:58 +01:00
Matthieu Buffet
e1a57c3359
selftests/landlock: Remove invalid unix socket bind()
Remove bind() call on a client socket that doesn't make sense.
Since strlen(cli_un.sun_path) returns a random value depending on stack
garbage, that many uninitialized bytes are read from the stack as an
unix socket address. This creates random test failures due to the bind
address being invalid or already in use if the same stack value comes up
twice.

Fixes: f83d51a5bd ("selftests/landlock: Check IOCTL restrictions for named UNIX domain sockets")
Signed-off-by: Matthieu Buffet <matthieu@buffet.re>
Reviewed-by: Günther Noack <gnoack@google.com>
Link: https://lore.kernel.org/r/20251201003631.190817-1-matthieu@buffet.re
Signed-off-by: Mickaël Salaün <mic@digikod.net>
2025-12-26 20:38:58 +01:00
Matthieu Buffet
6685201ebf
selftests/landlock: Add missing connect(minimal AF_UNSPEC) test
connect_variant(unspec_any0) is called twice. Both calls end
up in connect_variant_addrlen() with an address length of
get_addrlen(minimal=false).
However, the connect() syscall and its variants (e.g.
iouring/compat) accept much shorter addresses of 4 bytes
and that behaviour was not tested.

Replace one of these calls with one using a minimal address
length (just a bare sa_family=AF_UNSPEC field with no actual
address). Also add a call using a truncated address for good
measure.

Signed-off-by: Matthieu Buffet <matthieu@buffet.re>
Link: https://lore.kernel.org/r/20251027190726.626244-3-matthieu@buffet.re
Signed-off-by: Mickaël Salaün <mic@digikod.net>
2025-12-26 20:38:57 +01:00
Matthieu Buffet
bd09d9a05c
selftests/landlock: Fix TCP bind(AF_UNSPEC) test case
The nominal error code for bind(AF_UNSPEC) on an IPv6 socket
is -EAFNOSUPPORT, not -EINVAL. -EINVAL is only returned when
the supplied address struct is too short, which happens to be
the case in current selftests because they treat AF_UNSPEC
like IPv4 sockets do: as an alias for AF_INET (which is a
16-byte struct instead of the 24 bytes required by IPv6
sockets).

Make the union large enough for any address (by adding struct
sockaddr_storage to the union), and make AF_UNSPEC addresses
large enough for any family.

Test for -EAFNOSUPPORT instead, and add a dedicated test case
for truncated inputs with -EINVAL.

Fixes: a549d055a2 ("selftests/landlock: Add network tests")
Signed-off-by: Matthieu Buffet <matthieu@buffet.re>
Link: https://lore.kernel.org/r/20251027190726.626244-2-matthieu@buffet.re
Signed-off-by: Mickaël Salaün <mic@digikod.net>
2025-12-26 20:38:57 +01:00
Matthieu Buffet
e4d82cbce2
landlock: Fix TCP handling of short AF_UNSPEC addresses
current_check_access_socket() treats AF_UNSPEC addresses as
AF_INET ones, and only later adds special case handling to
allow connect(AF_UNSPEC), and on IPv4 sockets
bind(AF_UNSPEC+INADDR_ANY).
This would be fine except AF_UNSPEC addresses can be as
short as a bare AF_UNSPEC sa_family_t field, and nothing
more. The AF_INET code path incorrectly enforces a length of
sizeof(struct sockaddr_in) instead.

Move AF_UNSPEC edge case handling up inside the switch-case,
before the address is (potentially incorrectly) treated as
AF_INET.

Fixes: fff69fb03d ("landlock: Support network rules with TCP bind and connect")
Signed-off-by: Matthieu Buffet <matthieu@buffet.re>
Link: https://lore.kernel.org/r/20251027190726.626244-4-matthieu@buffet.re
Signed-off-by: Mickaël Salaün <mic@digikod.net>
2025-12-26 20:38:56 +01:00
Mickaël Salaün
552dbf47a8
landlock: Fix formatting
Format with clang-format -i security/landlock/*.[ch]

Cc: Christian Brauner <brauner@kernel.org>
Cc: Günther Noack <gnoack3000@gmail.com>
Cc: Mateusz Guzik <mjguzik@gmail.com>
Fixes: b4dbfd8653 ("Coccinelle-based conversion to use ->i_state accessors")
Link: https://lore.kernel.org/r/20251219193855.825889-5-mic@digikod.net
Reviewed-by: Günther Noack <gnoack3000@gmail.com>
Signed-off-by: Mickaël Salaün <mic@digikod.net>
2025-12-26 20:38:53 +01:00
Linus Torvalds
4079a38693 io_uring-6.19-20251226
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmlOro8QHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgprhhEADWKzgb1tqALkgjSNfzA9mEBpxt6Xp6++7x
 4lwUnnX/m4C1ILphAD4ii7YY2hm7xjRBaUeqH2OifznxXnAw1Rbhjr9GJdKqq43y
 1HWIzz48wP9wn0LI0tXkHA2AZR3Rs0IbtHZ+87gHA0HVoSNxqBIM9DKuFbbKDFNq
 P2ef4WoPZekThIRKXM05bkeVZuiMekMWpC5YUKPpm+XzPOE0rOtsPDypbmGVN/hT
 vpTjtAFEEDh3zTmmjd/Egk9fMJJMBMhr7E5us8VrUHFtNyZ6DmGCHOKAcJj3iJyT
 /BEOHQ1Yu/COXHlqj1kDefmoD/glsCnZFeGAXQu45CaU/ZU8jcm6Yy04hRbd9FLu
 QT6ycA84N0HOqoe1+UYnTy8/vqseCo5E6e9thPak6CWLsZA6Xc/8LcXZbNhe6fEW
 m9ldoQRnLnPkmiX3+gtEyjb+fa8DjYxzq/7ab37khIjdaJxesqFWkZ2Z+M2GKzVq
 9Qvth2ribWq0xtm9vZ0jb07JSss/Q+lQMKGlZ3vlvG2CODB5ll7Gq18LAxS7xoO3
 ciA+tcrMgTZcw9R7Ha5gbqkjpKZbwqA1malsNUo4YNRI/S4d6UU74nEVuyyAcsTv
 czFeU+d2nffwp1HV94ipNrCR2adKIQ1ESRxLTDNKt9hcFDlL9tHB//Kr28BO123V
 SrDcDR3Slw==
 =vmEn
 -----END PGP SIGNATURE-----

Merge tag 'io_uring-6.19-20251226' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull io_uring fix from Jens Axboe:
 "Just a single fix for a bug that can cause a leak of the filename with
  IORING_OP_OPENAT, if direct descriptors are asked for and O_CLOEXEC
  has been set in the request flags"

* tag 'io_uring-6.19-20251226' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring: fix filename leak in __io_openat_prep()
2025-12-26 11:34:38 -08:00
Linus Torvalds
8f0cbedc86 virtio,vhost: fixes
Just a bunch of fixes, mostly trivial ones in tools/virtio
 
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQFDBAABCgAtFiEEXQn9CHHI+FuUyooNKB8NuNKNVGkFAmlOnSYPHG1zdEByZWRo
 YXQuY29tAAoJECgfDbjSjVRpLvsH/RiAvtYIimnu5XEuk013EB9T4WXn8dE4pDRt
 EwZyJie+Ox99ZpNTLEgqpN4jyOQzJ7udVIgbHANR0SWqHtXzYV39I5tI7ZCJ951F
 /CXax7INc/oS0s0bHpMKhji8U0FTvtrBY0d9FgvmVTXJpEhnwyKPKx0Z8eJEvaaU
 1OCpMNOhbx5EIS9CWvxyJtcc8y2jY6CO855BCph3IdCdUlOTJLrJ6nPdAyP2RRuL
 +pjsWRH/ZKhYpL5zmLbTDduRTDaKdns00sMMN6xqjNgu4bgvBo2DM5ljZrRKoFTB
 zZAQsitIjR5nxcrtv1QxEeL32XENkb4iXOb9T96+3veEwk9SlRM=
 =Ofvg
 -----END PGP SIGNATURE-----

Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost

Pull virtio fixes from Michael Tsirkin:
 "Just a bunch of fixes, mostly trivial ones in tools/virtio"

* tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost:
  vhost/vsock: improve RCU read sections around vhost_vsock_get()
  tools/virtio: add device, device_driver stubs
  tools/virtio: fix up oot build
  virtio_features: make it self-contained
  tools/virtio: switch to kernel's virtio_config.h
  tools/virtio: stub might_sleep and synchronize_rcu
  tools/virtio: add struct cpumask to cpumask.h
  tools/virtio: pass KCFLAGS to module build
  tools/virtio: add ucopysize.h stub
  tools/virtio: add dev_WARN_ONCE and is_vmalloc_addr stubs
  tools/virtio: stub DMA mapping functions
  tools/virtio: add struct module forward declaration
  tools/virtio: use kernel's virtio.h
  virtio: make it self-contained
  tools/virtio: fix up compiler.h stub
2025-12-26 11:11:30 -08:00
Liang Jie
255b721c96 pinctrl: mediatek: make devm allocations safer and clearer in mtk_eint_do_init()
mtk_eint_do_init() allocates several pointer arrays which are then
populated in a per-instance loop and freed on error. The arrays are
currently allocated with devm_kmalloc(), so their entries are left
uninitialised until the per-instance allocations succeed.

On a failure in the middle of the loop, the error path iterates over
the full nbase range and calls devm_kfree() on each element. For
indices which were never initialised, the corresponding array entries
contain stack garbage. If any of those happen to be non-zero,
devm_kfree() will pass them to devres_destroy(), which will WARN
because there is no matching devm_kmalloc() resource for such bogus
pointers.

Improve the robustness and readability by:

  - Using devm_kcalloc() for the pointer arrays so that all entries
    start as NULL, ensuring that only genuinely initialised elements
    may be freed and preventing spurious WARN_ON()s in the error path.
  - Switching the allocations to sizeof(*ptr) / sizeof(**ptr) forms,
    avoiding hard-coded element types and making the code more resilient
    to future type changes.
  - Dropping the redundant NULL checks before devm_kfree(), as
    devm_kfree() safely handles NULL pointers.

The functional behaviour in the successful initialisation path remains
unchanged, while the error handling becomes simpler and less
error-prone.

Reviewed-by: fanggeng <fanggeng@lixiang.com>
Signed-off-by: Liang Jie <liangjie@lixiang.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
2025-12-26 19:13:01 +01:00
Linus Torvalds
e2cc644089 four smb3 server fixes
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmlMjJYACgkQiiy9cAdy
 T1EK1wv9H3OR/MYWie0dD2QDEUbYje9wAxR5mbxZ8AQpDJFdiqaCg6FKJOBpo2YL
 iXB8r2948DWELuqj/cgzvs0iOZazx797soMhfOkN/3VZ08rchag3xAFDJmLgECPI
 lU/v3j0JKfo3icw117jBmVNi7zn1sUWaNJVgW0Ed2QgzT7caBiV1IjsL3QPmtnXN
 1sdoE3aYABJjsM/H0Yobgji/7oDRJQJMuhfw6OMw8amHlXh2Qg1hrjUB6R8BkVfJ
 r46jbwPSKmdjkxw/waZ152qljpnkf5SnWspNruoye885o5XlQud+c8Br2xMYwX3J
 4sJCMXOkeoju3OEHL3B02/Q2tjzeVjoKgGM4aTuIeiNuFB+3zu1ibvNppEwsUPhG
 xjUsqsZsLqP7E0/l4gy8CyszHXdd4jiex6D0maLS4QaxeB27DFCdG8MiVfbe2nKO
 +i8rZqvwSU3WvkA2vyQw+i29rKitNUpRljwa69MyGUWgDlvLULa/ArjdhEFMehkP
 OkvROSOx
 =Qr9r
 -----END PGP SIGNATURE-----

Merge tag 'v6.19-rc2-smb3-server-fixes' of git://git.samba.org/ksmbd

Pull smb server fixes from Steve French:

 - Fix parsing of SMB1 negotiate request by adjusting offsets affected
   by the removal of the RFC1002 length field from the SMB header

 - Update minimum PDU size macros for both SMB1 and SMB2

 - Rename smb2_get_msg function to smb_get_msg to better reflect its
   role in handling both SMB1 and SMB2 requests

* tag 'v6.19-rc2-smb3-server-fixes' of git://git.samba.org/ksmbd:
  smb/server: fix minimum SMB2 PDU size
  smb/server: fix minimum SMB1 PDU size
  ksmbd: rename smb2_get_msg to smb_get_msg
  ksmbd: Fix to handle removal of rfc1002 header from smb_hdr
2025-12-26 10:03:25 -08:00
Louis-Alexis Eyraud
fa917d3d57 pinctrl: mediatek: mt8189: restore previous register base name array order
In mt8189-pinctrl driver, a previous commit changed the register base
name array (mt8189_pinctrl_register_base_names) entry name and order to
align it with the same name and order as the "mediatek,mt8189-pinctrl"
devicetree bindings. The new order (by ascending register address) now
causes an issue with MT8189 pinctrl configuration.

MT8189 SoC has multiple base addresses for the pin configuration
registers. Several constant data structures, declaring each pin
configuration, are using PIN_FIELD_BASE() macro which i_base parameter
indicates for a given pin the lookup index in the base register address
array of the driver internal data for the configuration register
read/write accesses. But in practice, this parameter is given a
hardcoded numerical value that corresponds to the expected base
register entry index in mt8189_pinctrl_register_base_names array.
Since this array reordering, the i_base index matching is no more
correct.

So, in order to avoid modifying over a thousand of PIN_FIELD_BASE()
calls, restore previous mt8189_pinctrl_register_base_names entry order.

Fixes: 518919276c ("pinctrl: mediatek: mt8189: align register base names to dt-bindings ones")
Signed-off-by: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
2025-12-26 18:45:11 +01:00
Ian Rogers
0297dce758 PCI: cadence: Avoid signed 64-bit truncation and invalid sort
The cdns_pcie_host_dma_ranges_cmp() element comparison function used by
list_sort() is of type list_cmp_func_t, so it returns a 32-bit int.

cdns_pcie_host_dma_ranges_cmp() computes a resource_size_t difference that
may be a 64-bit value, and truncating that difference to a 32-bit return
value may change the sign and result in an invalid sort order.

Avoid the truncation and invalid sort order by returning -1, 0, or 1.

Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
[bhelgaas: commit log]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20251209223756.2321578-1-irogers@google.com
2025-12-26 11:14:23 -06:00
Aaron Kling
aac5ba6acc PCI: tegra: Allow building as a module
Change the module macro back to builtin, which does not define an exit
function. This will prevent the module from being unloaded. There are
concerns with modules not cleaning up IRQs on unload, thus unload must be
specifically disallowed. Drop the remove callback as it is unused.

Signed-off-by: Aaron Kling <webgeek1234@gmail.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20250731-pci-tegra-module-v7-3-cad4b088b8fb@gmail.com
2025-12-26 10:57:17 -06:00
Aaron Kling
eefff3d9f6 cpuidle: tegra: Export tegra_cpuidle_pcie_irqs_in_use()
Export tegra_cpuidle_pcie_irqs_in_use() to allow pci-tegra to be built as a
module.

Signed-off-by: Aaron Kling <webgeek1234@gmail.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20250731-pci-tegra-module-v7-2-cad4b088b8fb@gmail.com
2025-12-26 10:57:17 -06:00
Aaron Kling
92d661c36f irqdomain: Export irq_domain_free_irqs()
Export irq_domain_free_irqs() to allow PCI/MSI drivers like pci-tegra to be
built as a module.

Signed-off-by: Aaron Kling <webgeek1234@gmail.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://patch.msgid.link/20250731-pci-tegra-module-v7-1-cad4b088b8fb@gmail.com
2025-12-26 10:57:17 -06:00
Rafael J. Wysocki
0a869409a9 ACPI: battery: Convert the driver to a platform one
While binding drivers directly to struct acpi_device objects allows
basic functionality to be provided, at least in the majority of cases,
there are some problems with it, related to general consistency, sysfs
layout, power management operation ordering, and code cleanliness.

Overall, it is better to bind drivers to platform devices than to their
ACPI companions, so convert the ACPI battery driver to a platform one.

While this is not expected to alter functionality, it changes sysfs
layout and so it will be visible to user space.

Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/3187448.CbtlEUcBR6@rafael.j.wysocki
2025-12-26 15:11:38 +01:00
Rafael J. Wysocki
0d17aafa79 ACPI: battery: Reduce code duplication related to cleanup
Notice that sysfs_battery_cleanup() calls sysfs_remove_battery() under
battery->update_lock which is also done in acpi_battery_remove(), so
adjust the latter to use it.

No intentional functional impact.

Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/1866517.TLkxdtWsSY@rafael.j.wysocki
2025-12-26 15:11:38 +01:00
Rafael J. Wysocki
08b54fd577 ACPI: battery: Adjust event notification routine
Adjust acpi_battery_notify() to cast its "data" argument to a struct
acpi_battery pointer istead of a struct acpi_device one, which allows
the use of acpi_driver_data() to be limited and will facilitate
subsequent changes.

No intentional functional impact.

Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/4344406.1IzOArtZ34@rafael.j.wysocki
2025-12-26 15:11:38 +01:00
Rafael J. Wysocki
6cba60361b ACPI: thermal: Rework system suspend and resume handling
In the process of handling system resume, acpi_thermal_resume() attempts
to power up active cooling devices to guarantee that they will be
operational when the ACPI thermal check queued by it runs.  However,
the only kind of cooling devices that can be bound to ACPI thermal zones
is fans and they are already powered up by the ACPI fan driver resume,
which additionally takes "ACPI 4" fans that don't need to be powered
up into account.

For this reason, remove the part of acpi_thermal_resume() related to
fans and in order to ensure that it will run after powering up all fans,
rename it to acpi_thermal_complete() and point the .complete() driver
callback to it.  Analogously, rename acpi_thermal_suspend() to
acpi_thermal_prepare() and point the .prepare() driver callback to it.

Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Acked-by: lihuisong@huawei.com
Link: https://patch.msgid.link/3024049.e9J7NaK4W3@rafael.j.wysocki
2025-12-26 15:09:35 +01:00
Rafael J. Wysocki
d1db160da0 ACPI: thermal: Convert the driver to a platform one
While binding drivers directly to struct acpi_device objects allows
basic functionality to be provided, at least in the majority of cases,
there are some problems with it, related to general consistency, sysfs
layout, power management operation ordering, and code cleanliness.

Overall, it is better to bind drivers to platform devices than to their
ACPI companions, so convert the ACPI thermal zone driver to a platform
one.

While this is not expected to alter functionality, it changes sysfs
layout and so it will be visible to user space.

Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Tested-by: lihuisong@huawei.com
Link: https://patch.msgid.link/2249483.irdbgypaU6@rafael.j.wysocki
2025-12-26 15:09:35 +01:00
Rafael J. Wysocki
a497538599 ACPI: thermal: Adjust event notification routine
Adjust acpi_thermal_notify() to cast its "data" argument to a struct
acpi_thermal pointer istead of a struct acpi_device one, which allows
the use of acpi_driver_data() to be limited and will facilitate
subsequent changes.

No intentional functional impact.

Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Acked-by: lihuisong@huawei.com
Link: https://patch.msgid.link/5035876.GXAFRqVoOG@rafael.j.wysocki
2025-12-26 15:09:35 +01:00
Rafael J. Wysocki
d27ccaebab ACPI: scan: Register platform devices for thermal zones
Currently, platform devices are not registered for ACPI thermal zones
because they are not represented as device objects in the ACPI namespace.
Instead, they are represented as thermal zone objects, so in particular
the platform_id flag is not set for them during enumeration because it
is only set for objects of type ACPI_BUS_TYPE_DEVICE, but otherwise they
are handled similarly at the ACPI core level.

To facilitate converting the ACPI thermal zone driver into a platform
one, modify acpi_set_pnp_ids() to set the platform_id flag for thermal
zones in analogy with device objects to cause platform devices to be
registered for them.

No intentional functional impact.

Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Acked-by: lihuisong@huawei.com
Link: https://patch.msgid.link/4701463.LvFx2qVVIh@rafael.j.wysocki
2025-12-26 15:09:35 +01:00
Rafael J. Wysocki
91ba8de81b ACPI: scan: Do not mark button ACPI devices as wakeup-capable
It is generally questionable to mark struct acpi_device "devices" as
wakeup-capable because they represent firmware entities that by
themselves have no wakeup capabilities.

It was done for struct acpi_device "devices" corresponding to buttons
because the ACPI button driver was binding to them directly, but now
that corresponding platform devices are created for the buttons and
they are marked as wakeup-capable by the ACPI button driver, there is
no reason to continue doing it.

Update acpi_wakeup_gpe_init() accordingly.

Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/2891119.BEx9A2HvPv@rafael.j.wysocki
2025-12-26 15:08:57 +01:00
Rafael J. Wysocki
2cf321ef4e ACPI: scan: Do not bind ACPI drivers to fixed event buttons
Both ACPI button drivers have been converted to platform ones, so there
is no reason to attempt to bind an ACPI driver to a struct acpi_device
representing a fixed event device button.

Update the relevant code accordingly.

No intentional functional impact.

Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/2213073.OBFZWjSADL@rafael.j.wysocki
2025-12-26 15:08:57 +01:00
Rafael J. Wysocki
f4203ec64e ACPI: tiny-power-button: Convert the driver to a platform one
While binding drivers directly to struct acpi_device objects allows
basic functionality to be provided, at least in the majority of cases,
there are some problems with it, related to general consistency, sysfs
layout, power management operation ordering, and code cleanliness.

Overall, it is better to bind drivers to platform devices than to their
ACPI companions, so convert the ACPI tiny-power-button driver to a
platform one.

While this is not expected to alter functionality, it changes sysfs
layout and so it will be visible to user space.

Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
[ rjw: White space fixup ]
Link: https://patch.msgid.link/5629403.Sb9uPGUboI@rafael.j.wysocki
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2025-12-26 15:08:57 +01:00
Rafael J. Wysocki
52d8640196 ACPI: button: Convert the driver to a platform one
While binding drivers directly to struct acpi_device objects allows
basic functionality to be provided, at least in the majority of cases,
there are some problems with it, related to general consistency, sysfs
layout, power management operation ordering, and code cleanliness.

Overall, it is better to bind drivers to platform devices than to their
ACPI companions, so convert the ACPI button driver to a platform one.

While this is not expected to alter functionality, it changes sysfs
layout and so it will be visible to user space.

Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/2461734.NG923GbCHz@rafael.j.wysocki
2025-12-26 15:08:57 +01:00
Rafael J. Wysocki
93dc5db6d4 ACPI: button: Adjust event notification routines
Adjust the event notification routines in the ACPI button driver to
take a struct acpi_button pointer as an argument istead of a struct
acpi_device one where applicable, which allows the use of
acpi_driver_data() to be limited and will facilitate subsequent
changes.

No intentional functional impact.

Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/2260995.Icojqenx9y@rafael.j.wysocki
2025-12-26 15:08:57 +01:00
Rafael J. Wysocki
ddfebb7537 ACPI: scan: Reduce code duplication related to fixed event devices
Move duplicate fixed event device registration code
from acpi_bus_scan_fixed() into a new function called
acpi_bus_add_fixed_device_object() and make acpi_bus_scan_fixed()
invoke that function as needed.

No intentional functional impact.

Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/1916860.atdPhlSkOF@rafael.j.wysocki
2025-12-26 15:08:57 +01:00
Rafael J. Wysocki
ab06eb9204 ACPI: scan: Register platform devices for fixed event buttons
On platforms using ACPI, power and sleep buttons may be so called "fixed
event devices" in which case they are hooked up directly to the Fixed
Events register in the platform via dedicated lines and there are no
corresponding device objects in the ACPI namespace.  Nevertheless, in
Linux they get corresponding struct acpi_device objects with special
device IDs, either LNXPWRBN or LNXSLPBN, which are then used for driver
binding in a ususal way.

However, the function creating those struct acpi_device objects for
"fixed event device" buttons, acpi_bus_scan_fixed(), does not register
platform devices for them, unlike the generic code handling device
enumeration based on the ACPI namespace.  Consequently, if an ACPI power
or sleep button is represented by a device object in the ACPI namespace,
it will get a corresponding platform device, but if it is a "fixed event
device", it will not get one, which is inconsistent and prevents the
ACPI power button driver from being converted into a platform driver.

For the sake of consistency and to allow the ACPI power button driver to
become a platform one going forward, modify acpi_bus_scan_fixed() to
register platform devices for "fixed event device" buttons and update
ACPI platform device registration code to work with non-device ACPI
object types, so it can handle the buttons in question.

No intentional functional impact.

Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/3731144.R56niFO833@rafael.j.wysocki
2025-12-26 15:08:56 +01:00
Rafael J. Wysocki
03667e146f ACPI: NFIT: core: Convert the driver to a platform one
While binding drivers directly to struct acpi_device objects allows
basic functionality to be provided, at least in the majority of cases,
there are some problems with it, related to general consistency, sysfs
layout, power management operation ordering, and code cleanliness.

Overall, it is better to bind drivers to platform devices than to their
ACPI companions, so convert the ACPI NFIT core driver to a platform one.

While this is not expected to alter functionality, it changes sysfs
layout and so it will be visible to user space.

This change was mostly developed by Michal Wilczynski [1].

Linu: https://lore.kernel.org/linux-acpi/20231011083334.3987477-6-michal.wilczynski@intel.com/ [1]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://patch.msgid.link/6221453.lOV4Wx5bFT@rafael.j.wysocki
Acked-by: Ira Weiny <ira.weiny@intel.com>
Tested-by: Ira Weiny <ira.weiny@intel.com>
2025-12-26 15:07:24 +01:00
Thomas Fourier
c48c0fd0e1 firewire: nosy: Fix dma_free_coherent() size
It looks like the buffer allocated and mapped in add_card() is done
with size RCV_BUFFER_SIZE which is 16 KB and 4KB.

Fixes: 286468210d ("firewire: new driver: nosy - IEEE 1394 traffic sniffer")
Co-developed-by: Thomas Fourier <fourier.thomas@gmail.com>
Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
Co-developed-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/20251216165420.38355-2-fourier.thomas@gmail.com
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
2025-12-26 22:04:03 +09:00
Danilo Krummrich
97872fa28b MAINTAINERS: exclude the tyr driver from DRM MISC
The ARM MALI TYR DRM DRIVER is already maintained through the drm-rust
tree, hence exclude it from drm-misc.

Fixes: cf4fd52e32 ("rust: drm: Introduce the Tyr driver for Arm Mali GPUs")
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Link: https://patch.msgid.link/20251223120436.33233-1-dakr@kernel.org
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
2025-12-26 12:14:40 +00:00
Danilo Krummrich
de0bdcaf36 MAINTAINERS: fix typo in TYR DRM driver entry
Fix a missing ':' in the ARM MALI TYR DRM DRIVER entry, which does
prevent script/get_maintainer.pl to properly work and pick up the
corresponding maintainers.

Fixes: cf4fd52e32 ("rust: drm: Introduce the Tyr driver for Arm Mali GPUs")
Reported-by: Tamir Duberstein <tamird@kernel.org>
Closes: https://lore.kernel.org/lkml/CAJ-ks9mrZtnPUjp5tD03hW+TyS0M9i-KRF_ramNY-oh-0X+ayA@mail.gmail.com/
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Reviewed-by: Tamir Duberstein <tamird@kernel.org>
Link: https://patch.msgid.link/20251223115949.32531-1-dakr@kernel.org
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
2025-12-26 12:13:21 +00:00
Dave Airlie
7bc0f871f9 drm-misc-next for 6.20:
Core Changes:
 
   - dma-buf: Add tracepoints
   - sched: Introduce new helpers
 
 Driver Changes:
 
   - amdxdna: Enable hardware context priority, Remove (obsolete and
     never public) NPU2 Support, Race condition fix
   - rockchip: Add RK3368 HDMI Support
   - rz-du: Add RZ/V2H(P) MIPI-DSI Support
 
   - panels:
     - st7571: Introduce SPI support
     - New panels: Sitronix ST7920, Samsung LTL106HL02, LG LH546WF1-ED01, HannStar HSD156JUW2
 -----BEGIN PGP SIGNATURE-----
 
 iJUEABMJAB0WIQTkHFbLp4ejekA/qfgnX84Zoj2+dgUCaUUQPQAKCRAnX84Zoj2+
 djCkAYC0wujWi4gdMY50vISgrz8sNnYlsMpWKlEgU9oBlPTC226FQz9VNzjruW2D
 ftxAsRcBfjTEY3eadqq51+B/JzKwDnWpQskjOq6/MZbrlXvMhnokVBkWzYKEF/s/
 H+znO5LbfQ==
 =7lY/
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-next-2025-12-19' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

drm-misc-next for 6.20:

Core Changes:

  - dma-buf: Add tracepoints
  - sched: Introduce new helpers

Driver Changes:

  - amdxdna: Enable hardware context priority, Remove (obsolete and
    never public) NPU2 Support, Race condition fix
  - rockchip: Add RK3368 HDMI Support
  - rz-du: Add RZ/V2H(P) MIPI-DSI Support

  - panels:
    - st7571: Introduce SPI support
    - New panels: Sitronix ST7920, Samsung LTL106HL02, LG LH546WF1-ED01, HannStar HSD156JUW2

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Maxime Ripard <mripard@redhat.com>
Link: https://patch.msgid.link/20251219-arcane-quaint-skunk-e383b0@houat
2025-12-26 19:00:41 +10:00
Dave Airlie
6c8e404891 drm-misc-next for 6.19:
UAPI Changes:
 
   - panfrost: Add PANFROST_BO_SYNC ioctl
   - panthor: Add PANTHOR_BO_SYNC ioctl
 
 Core Changes:
 
   - atomic: Add drm_device pointer to drm_private_obj
   - bridge: Introduce drm_bridge_unplug, drm_bridge_enter, and
     drm_bridge_exit
   - dma-buf: Improve sg_table debugging
   - dma-fence: Add new helpers, and use them when needed
   - dp_mst: Avoid out-of-bounds access with VCPI==0
   - gem: Reduce page table overhead with transparent huge pages
   - panic: Report invalid panic modes
   - sched: Add TODO entries
   - ttm: Various cleanups
   - vblank: Various refactoring and cleanups
 
   - Kconfig cleanups
   - Removed support for kdb
 
 Driver Changes:
 
   - amdxdna: Fix race conditions at suspend, Improve handling of zero
     tail pointers, Fix cu_idx being overwritten during command setup
   - ast: Support imported cursor buffers
   -
   - panthor: Enable timestamp propagation, Multiple improvements and
     fixes to improve the overall robustness, notably of the scheduler.
 
   - panels:
     - panel-edp: Support for CSW MNE007QB3-1, AUO B140HAN06.4, AUO B140QAX01.H
 -----BEGIN PGP SIGNATURE-----
 
 iJUEABMJAB0WIQTkHFbLp4ejekA/qfgnX84Zoj2+dgUCaTvY/gAKCRAnX84Zoj2+
 dvwQAX9/8TuCixEI9o5A9HRsKM3yD+PuwHKNmqIGB8NqTMsvuV1WyMvbtrFiiDCy
 ga92dJEBf2QNx07e9UnTn5ktvZMGWvUlmi5O7iimxnMj+zNoPItBJ+xvS0WgW0gI
 MmXXjg8ICg==
 =cT/H
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-next-2025-12-12' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

drm-misc-next for 6.19:

UAPI Changes:

  - panfrost: Add PANFROST_BO_SYNC ioctl
  - panthor: Add PANTHOR_BO_SYNC ioctl

Core Changes:

  - atomic: Add drm_device pointer to drm_private_obj
  - bridge: Introduce drm_bridge_unplug, drm_bridge_enter, and
    drm_bridge_exit
  - dma-buf: Improve sg_table debugging
  - dma-fence: Add new helpers, and use them when needed
  - dp_mst: Avoid out-of-bounds access with VCPI==0
  - gem: Reduce page table overhead with transparent huge pages
  - panic: Report invalid panic modes
  - sched: Add TODO entries
  - ttm: Various cleanups
  - vblank: Various refactoring and cleanups

  - Kconfig cleanups
  - Removed support for kdb

Driver Changes:

  - amdxdna: Fix race conditions at suspend, Improve handling of zero
    tail pointers, Fix cu_idx being overwritten during command setup
  - ast: Support imported cursor buffers
  -
  - panthor: Enable timestamp propagation, Multiple improvements and
    fixes to improve the overall robustness, notably of the scheduler.

  - panels:
    - panel-edp: Support for CSW MNE007QB3-1, AUO B140HAN06.4, AUO B140QAX01.H

Signed-off-by: Dave Airlie <airlied@redhat.com>

[airlied: fix mm conflict]
From: Maxime Ripard <mripard@redhat.com>
Link: https://patch.msgid.link/20251212-spectacular-agama-of-abracadabra-aaef32@penduick
2025-12-26 18:15:33 +10:00
Bitterblue Smith
fcac0f23d4 wifi: rtw88: Fix inadvertent sharing of struct ieee80211_supported_band data
Internally wiphy writes to individual channels in this structure,
so we must not share one static definition of channel list between
multiple device instances, because that causes hard to debug
breakage.

For example, with two rtw88 driven devices in the system, channel
information may get incoherent, preventing channel use.

Copied from commit 0ae36391c8 ("wifi: rtw89: Fix inadverent sharing
of struct ieee80211_supported_band data").

Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/e94ad653-2b6d-4284-a33c-8c694f88955b@gmail.com
2025-12-26 13:32:58 +08:00
Bitterblue Smith
2ba12401cc wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band()
Simplify the code by using device managed memory allocations.

This also fixes a memory leak in rtw_register_hw(). The supported bands
were not freed in the error path.

Copied from commit 145df52a86 ("wifi: rtw89: Convert
rtw89_core_set_supported_band to use devm_*").

Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/1aa7fdef-2d5b-4a31-a4e9-fac8257ed30d@gmail.com
2025-12-26 13:32:48 +08:00