Under heavy concurrent attach/detach operations, scx_claim_exit() can
trigger a NULL pointer dereference. This can be reproduced running the
reload_loop kselftests inside a virtme-ng session:
$ vng -v -- ./tools/testing/selftests/sched_ext/runner -t reload_loop
...
BUG: kernel NULL pointer dereference, address: 0000000000000400
RIP: 0010:scx_claim_exit+0x3b/0x120
Call Trace:
<TASK>
bpf_scx_unreg+0x45/0xb0
bpf_struct_ops_map_link_dealloc+0x39/0x50
bpf_link_release+0x18/0x20
__fput+0x10b/0x2e0
__x64_sys_close+0x47/0xa0
The underlying race (diagnosed by Tejun Heo) is a stomp of @ops->priv,
not a missing NULL check:
T2 unreg(K) T1 reg(K)
----------- ---------
sch = ops->priv = sch_b800
scx_disable; flush_disable_work
[scx_root_disable: scx_root=NULL,
mutex_unlock, state=DISABLED]
mutex_lock; state ok
scx_alloc_and_add_sched:
ops->priv = sch_a800
scx_root = sch_a800; init=0
state=ENABLED; mutex_unlock
[flush returns]
RCU_INIT_POINTER(ops->priv, NULL) <-- clobbers sch_a800
kobject_put(sch_b800)
T1 acquires scx_enable_mutex inside scx_root_disable()'s mutex_unlock
window and starts a fresh attach on the same kdata, assigning sch_a800
to @ops->priv. T2 then continues out of scx_disable()/flush_disable_work
and clobbers @ops->priv to NULL, leaking sch_a800; the bpf_link is gone
but state stays SCX_ENABLED, so all future attaches fail with -EBUSY
permanently. The next bpf_scx_unreg() on that kdata then reads NULL
@ops->priv and dereferences it in scx_claim_exit().
Make @ops->priv the lifecycle binding: in scx_root_enable_workfn() and
scx_sub_enable_workfn(), after the existing state check and still under
scx_enable_mutex, refuse with -EBUSY if @ops->priv is non-NULL. This
rejects an attempt to reuse a kdata that is still bound to a previous
scheduler instance, closing the race without changing the unreg side.
Fixes: 105dcd005b ("sched_ext: Introduce scx_prog_sched()")
Suggested-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Andrea Righi <arighi@nvidia.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
The ifdeffery is unnecessary, as the compiler can already optimize away
all of the mfd-specific code based on the IS_ENABLED() in
keyboard_led_is_mfd_device().
Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Link: https://lore.kernel.org/r/20260404-cros_kbd_led-cleanup-v1-3-0dc1100d54e3@weissschuh.net
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
Make the code simpler to read by passing the 'struct keyboard_led' as
a parameter to the 'init' callbacks instead of relying on the platform
device driver data.
Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Link: https://lore.kernel.org/r/20260404-cros_kbd_led-cleanup-v1-2-0dc1100d54e3@weissschuh.net
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
A race condition exists between the probe of cros-ec-sysfs and
cros-ec-sensorhub.
The `kb_wake_angle` attribute should only be visible if the sensor hub
detects two or more accelerometers. If cros_ec_sysfs_probe() runs
before cros_ec_sensorhub_register() completes sensor enumeration, the
sysfs attributes are created while `has_kb_wake_angle` is still false,
hiding `kb_wake_angle` incorrectly.
Store the created attribute group pointer in `ec_dev->group`. When
the sensor hub completes sensor enumeration, it checks for this group
and calls sysfs_update_group() to notify the sysfs core to re-evaluate
attribute visibility. This ensures the `kb_wake_angle` attribute
visibility is correctly updated regardless of the driver probe order.
Co-developed-by: Gwendal Grignou <gwendal@chromium.org>
Signed-off-by: Gwendal Grignou <gwendal@chromium.org>
Link: https://lore.kernel.org/r/20260407102615.1605317-1-tzungbi@kernel.org
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
Building the dequeue selftest with newer compilers (e.g., gcc 16)
triggers the following error:
dequeue.c:28:22: error: variable 'sum' set but not used
The 'volatile' qualifier prevents the writes from being optimized away,
but does not silence the unused variable 'sum' is indeed only written
and never read.
Consume 'sum' via an empty asm() with a register input constraint. This
forces the compiler to keep the accumulated value (preserving the CPU
stress loop) and avoiding the build error.
Fixes: 658ad2259b ("selftests/sched_ext: Add test to validate ops.dequeue() semantics")
Signed-off-by: Andrea Righi <arighi@nvidia.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
cg_read_strcmp() allocated a buffer sized to strlen(expected) + 1,
then passed it to read_text() which calls read(fd, buf, size-1).
When comparing against an empty string (""), strlen("") = 0 gives a
1-byte buffer, and read() is asked to read 0 bytes. The file content
is never actually read, so strcmp("", buf) always returns 0 regardless
of the real content. This caused cg_test_proc_killed() to always
report the cgroup as empty immediately, making OOM tests pass without
verifying that processes were killed.
Signed-off-by: Hongfu Li <lihongfu@kylinos.cn>
Signed-off-by: Tejun Heo <tj@kernel.org>
get_cg_pool_unlocked() handles allocation failures under dmemcg_lock by
dropping the lock, preallocating a pool with GFP_KERNEL, and retrying the
locked lookup and creation path.
If the fallback allocation fails too, pool remains NULL. Since the loop
condition is while (!pool), the function can keep retrying instead of
propagating the allocation failure to the caller.
Set pool to ERR_PTR(-ENOMEM) when the fallback allocation fails so the
loop exits through the existing common return path. The callers already
handle ERR_PTR() from get_cg_pool_unlocked(), so this restores the
expected error path.
Fixes: b168ed458d ("kernel/cgroup: Add "dmem" memory accounting cgroup")
Cc: stable@vger.kernel.org # v6.14+
Signed-off-by: Guopeng Zhang <zhangguopeng@kylinos.cn>
Signed-off-by: Tejun Heo <tj@kernel.org>
Bard Liao <yung-chuan.liao@linux.intel.com> says:
The RT712 and RT721 codec mic are optional and are not used on some
products. Add a quirk to make it optional and skip the codec mic DAI
when it is not present in DisCo table.
Link: https://patch.msgid.link/20260508093224.1246282-1-yung-chuan.liao@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Add a quirk to skip the CODEC_MIC DAI when it is not present.
This ensures PCH_DMIC is used as the fallback; otherwise,
CODEC_MIC remains the default.
Fixes: 846a8d3cf3 ("ASoC: Intel: soc-acpi-intel-ptl-match: Add rt721 support")
Signed-off-by: Mac Chiang <mac.chiang@intel.com>
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://patch.msgid.link/20260508093224.1246282-3-yung-chuan.liao@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Some devices do not use CODEC_MIC but use the host PCH_DMIC
instead. Add a quirk to skip the CODEC_MIC DAI when it is not present
in disco table, ensuring the correct capture device is used.
If CODEC_MIC is present, it continues to be used as default.
Fixes: 9489db97f6 ("ASoC: sdw_utils: add SmartMic DAI for RT712 VB")
Signed-off-by: Mac Chiang <mac.chiang@intel.com>
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://patch.msgid.link/20260508093224.1246282-2-yung-chuan.liao@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Add a SoundWire machine table entry for the LG Gram Pro 2026
(16Z90U-KU7BK), which has an unusual configuration:
sdw:0:1:025d:1320:01 single stereo RT1320 SmartAmp on link 1
sdw:0:3:025d:0713:01 RT713 jack/headset codec on link 3
Existing rt713-rt1320 boards have two RT1320 amps on different links
("link_mask = BIT(1) | BIT(2) | BIT(3)"). The LG Gram uses a single
stereo RT1320 chip, so the new entry uses "link_mask = BIT(1) |
BIT(3)" with the existing rt1320_1_group2_adr structure, leaving the
two-channel routing to the topology.
The RT713 on this board does not expose a SMART_MIC function in
ACPI, so the .machine_check callback used by the existing entries
(snd_soc_acpi_intel_sdca_is_device_rt712_vb) would reject this
board. Drop machine_check for the new entry; speaker output and
the headset jack do not depend on the SMART_MIC presence check.
The corresponding topology source has been submitted to the SOF
project at https://github.com/thesofproject/sof/pull/10760 . The
generated sof-ptl-rt713-l3-rt1320-l1-2ch.tplg and
nhlt-sof-ptl-rt713-l3-rt1320-l1.bin will follow in linux-firmware
once that lands.
Tested on Ubuntu 26.04 with kernel 7.0.0-15: speaker (RT1320
stereo), headphone jack with auto-routing, headset mic, and the
internal NHLT DMIC array all work via the UCM HiFi profile.
Signed-off-by: Jang Pyohwan <vhgksl@daum.net>
Link: https://patch.msgid.link/20260509175317.DnhjxHczQay7kkp5z6t4lg@vhgksl.daum.net
Signed-off-by: Mark Brown <broonie@kernel.org>
Add support for using the rt712 multi-function codec on link 0 and the
rt1320 amplifier on link 3 on ARL platforms.
Signed-off-by: Gary C Wang <gary.c.wang@intel.com>
Co-developed-by: Mac Chiang <mac.chiang@intel.com>
Signed-off-by: Mac Chiang <mac.chiang@intel.com>
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://patch.msgid.link/20260508104239.1247525-3-yung-chuan.liao@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
When the SOF device driver enumerates the machine tables,
it selects the entry with the most numbers of matched links in
ascending order.
Align the ordering with commit 08095e2099
("ASoC: Intel: soc-acpi-intel-ptl-match: Sort ACPI link/machine tables").
Signed-off-by: Mac Chiang <mac.chiang@intel.com>
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://patch.msgid.link/20260508104239.1247525-2-yung-chuan.liao@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Johan Hovold <johan@kernel.org> says:
In preparation for fixing the SPI controller API so that it no longer
drops a reference when deregistering (non-managed) controllers (cf.
[1]), this series converts drivers using non-managed registration to use
managed allocation.
Included is also a related cleanup of a ti-qspi error path.
This second set will be followed by a third set of 12 patches for
drivers using managed registration.
That leaves us with 18 drivers using non-managed allocation, which is
few enough to be able to fix the API in tree-wide change.
Johan
[1] https://lore.kernel.org/lkml/20260325145319.1132072-1-johan@kernel.org/
Link: https://patch.msgid.link/20260505072909.618363-1-johan@kernel.org
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-21-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-20-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Add a proper error path for when registration fails so that the probe
tests for errors consistently.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-19-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-18-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-17-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-16-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-15-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-14-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-13-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-12-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-11-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-10-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-9-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-8-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-7-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-6-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-5-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-4-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-3-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Switch to device managed controller allocation to simplify error
handling and to avoid having to take another reference during
deregistration.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260505072909.618363-2-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
On platforms where the HID2 SPI controller (AMDI0063) is enumerated via
ACPI instead of PCI, amd_spi_probe() unconditionally sets bus_num to 0,
while the PCI probe path assigns bus_num 2 for HID2 controller.
Align the ACPI probe path to use the same bus number so that userspace
and SPI client drivers see a consistent bus assignment regardless of the
enumeration method.
Fixes: b644c27766 ("spi: spi_amd: Add PCI-based driver for AMD HID2 SPI controller")
Cc: stable@vger.kernel.org # v6.16+
Signed-off-by: Krishnamoorthi M <krishnamoorthi.m@amd.com>
Link: https://patch.msgid.link/20260507180051.4158674-1-krishnamoorthi.m@amd.com
Signed-off-by: Mark Brown <broonie@kernel.org>
A phandle-array is really a matrix and needs constraints on the number
of elements for both the inner and outer dimensions. Add the missing
inner constraints.
Fixes: 472d77bdc5 ("ASoC: dt-bindings: mediatek,mt8173-rt5650-rt5514: convert to DT schema")
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://patch.msgid.link/20260508182438.1757394-1-robh@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
As I cannot spend adequate time to fulfill my role as maintainer for the
TI ASoC drivers, it is for the better if I resign and hand over the role
to Sen Wang.
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@gmail.com>
Acked-by: Nishanth Menon <nm@ti.com>
Link: https://patch.msgid.link/20260505164744.16134-1-peter.ujfalusi@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Clippy 1.97 introduces new `useless_borrows_in_formatting` warning which
fires on the examples as we have `&*expr` where the format macro takes
reference already. Remove the extra borrow.
Link: https://patch.msgid.link/20260505115138.2466966-1-gary@kernel.org
Signed-off-by: Gary Guo <gary@garyguo.net>
Tuples implement `FromIterator` since Rust 1.79. Remove the `collect_tuple`
polyfill now the MSRV is above 1.79.
To avoid over-identing the closure, I move the `Field` destructure from the
closure parameter to a let binding. This keeps the diff small.
Link: https://patch.msgid.link/20260501134445.3809731-1-gary@garyguo.net
Signed-off-by: Gary Guo <gary@garyguo.net>
The `PhantomPinned` detection is just a lint, and is emitted as an error
because there is no `compile_warning!()` macro, and
`proc-macro-diagnostics` is not stable.
Use of `#[deprecated = ""]` attribute to approximate custom proc-macro
warnings. A new line is added before message for visual clarity.
An example warning with this trick looks like this:
warning: use of deprecated function `_::warn`:
The field `pin` of type `PhantomPinned` only has an effect if it has the `#[pin]` attribute
--> test.rs:9:5
|
9 | pin: marker::PhantomPinned,
| ^^^^^^^^^^^^^^^^^^^^^^^^^^^
Suggested-by: Benno Lossin <lossin@kernel.org>
Link: https://github.com/Rust-for-Linux/pin-init/issues/51
Link: https://patch.msgid.link/20260428-pin-init-sync-v1-10-07f9bd3859fb@garyguo.net
Signed-off-by: Gary Guo <gary@garyguo.net>
The pin-init crate has been licensed under `Apache-2.0 OR MIT` since the
beginning. I introduced in commit 071cedc84e ("rust: add derive macro for
`Zeroable`") `zeroable.rs` with incompatible GPL-2.0 SPDX identifier. The
file has not been modified by other authors, so relicense it under the
above license.
Signed-off-by: Benno Lossin <lossin@kernel.org>
[ Reworded commit message - Gary ]
Link: https://patch.msgid.link/20260428-pin-init-sync-v1-7-07f9bd3859fb@garyguo.net
Signed-off-by: Gary Guo <gary@garyguo.net>
The `generate_projections` and `generate_the_pin_data` function already
receive filtered field lists, they do not need to filter out `#[pin]`
again.
Reviewed-by: Benno Lossin <lossin@kernel.org>
Link: https://patch.msgid.link/20260428-pin-init-sync-v1-6-07f9bd3859fb@garyguo.net
Signed-off-by: Gary Guo <gary@garyguo.net>
Improve impl_zeroable_option macro to handle generic impls for types
like `&T`, `&mut T`, `NonNull<T>`, and others (for which `Option<T>`
is guaranteed to be zeroable) with similar approach to
`impl_zeroable`.
Also, update old declarations to use generics e.g. `NonZeroU8` to
`NonZero<u8>`.
Signed-off-by: Mohamad Alsadhan <mo@sdhn.cc>
Reviewed-by: Gary Guo <gary@garyguo.net>
Link: https://patch.msgid.link/20260428-pin-init-sync-v1-4-07f9bd3859fb@garyguo.net
Signed-off-by: Gary Guo <gary@garyguo.net>
