Commit graph

1,385,869 commits

Author SHA1 Message Date
Willy Tarreau
3a68841d1d Documentation: smooth the text flow in the security bug reporting process
The text was presenting the team, the the e-mail address, then some of
the expectations, then what form of e-mail is expected. By switching
the e-mail paragraph two paragraphs later and dropping the "Contact"
sub-section, we can have a more natural flow that presents the team,
then its expectation, then how to best contribute, then where to send.

And more importantly, it increases the chances that reporters have read
the prerequisites before finding the e-mail address.

Signed-off-by: Willy Tarreau <w@1wt.eu>
Reviewed-by: Kees Cook <kees@kernel.org>
Link: https://lore.kernel.org/r/20250814192730.19252-2-w@1wt.eu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-08-17 12:23:30 +02:00
Willy Tarreau
d49172bbd7 Documentation: clarify the expected collaboration with security bugs reporters
Some bug reports sent to the security team sometimes lack any explanation,
are only AI-generated without verification, or sometimes it can simply be
difficult to have a conversation with an invisible reporter belonging to
an opaque team. This fortunately remains rare but the trend has been
steadily increasing over the last years and it seems important to clarify
what developers expect from reporters to avoid frustration on any side and
keep the process efficient.

Signed-off-by: Willy Tarreau <w@1wt.eu>
Reviewed-by: Kees Cook <kees@kernel.org>
Link: https://lore.kernel.org/r/20250814192730.19252-1-w@1wt.eu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-08-17 12:23:28 +02:00
Charalampos Mitrodimas
ba6cc29351 debugfs: fix mount options not being applied
Mount options (uid, gid, mode) are silently ignored when debugfs is
mounted. This is a regression introduced during the conversion to the
new mount API.

When the mount API conversion was done, the parsed options were never
applied to the superblock when it was reused. As a result, the mount
options were ignored when debugfs was mounted.

Fix this by following the same pattern as the tracefs fix in commit
e4d32142d1 ("tracing: Fix tracefs mount options"). Call
debugfs_reconfigure() in debugfs_get_tree() to apply the mount options
to the superblock after it has been created or reused.

As an example, with the bug the "mode" mount option is ignored:

  $ mount -o mode=0666 -t debugfs debugfs /tmp/debugfs_test
  $ mount | grep debugfs_test
  debugfs on /tmp/debugfs_test type debugfs (rw,relatime)
  $ ls -ld /tmp/debugfs_test
  drwx------ 25 root root 0 Aug  4 14:16 /tmp/debugfs_test

With the fix applied, it works as expected:

  $ mount -o mode=0666 -t debugfs debugfs /tmp/debugfs_test
  $ mount | grep debugfs_test
  debugfs on /tmp/debugfs_test type debugfs (rw,relatime,mode=666)
  $ ls -ld /tmp/debugfs_test
  drw-rw-rw- 37 root root 0 Aug  2 17:28 /tmp/debugfs_test

Fixes: a20971c187 ("vfs: Convert debugfs to use the new mount API")
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220406
Cc: stable <stable@kernel.org>
Reviewed-by: Eric Sandeen <sandeen@redhat.com>
Signed-off-by: Charalampos Mitrodimas <charmitro@posteo.net>
Link: https://lore.kernel.org/r/20250816-debugfs-mount-opts-v3-1-d271dad57b5b@posteo.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-08-17 12:22:25 +02:00
Amit Sunil Dhamne
a381c6d6f6 usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean
Presently in `max_contaminant_is_contaminant()` if there's no
contaminant detected previously, CC is open & stopped toggling and no
contaminant is currently present, TCPC.RC would be programmed to do DRP
toggling. However, it didn't actively look for a connection. This would
lead to Type-C not detect *any* new connections. Hence, in the above
situation, re-enable toggling & program TCPC to look for a new
connection.

Also, return early if TCPC was looking for connection as this indicates
TCPC has neither detected a potential connection nor a change in
contaminant state.

In addition, once dry detection is complete (port is dry), restart
toggling.

Fixes: 02b332a063 ("usb: typec: maxim_contaminant: Implement check_contaminant callback")
Cc: stable <stable@kernel.org>
Signed-off-by: Amit Sunil Dhamne <amitsd@google.com>
Reviewed-by: Badhri Jagan Sridharan <badhri@google.com>
Link: https://lore.kernel.org/r/20250815-fix-upstream-contaminant-v2-2-6c8d6c3adafb@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-08-17 12:14:55 +02:00
Amit Sunil Dhamne
cabb6c5f4d usb: typec: maxim_contaminant: disable low power mode when reading comparator values
Low power mode is enabled when reading CC resistance as part of
`max_contaminant_read_resistance_kohm()` and left in that state.
However, it's supposed to work with 1uA current source. To read CC
comparator values current source is changed to 80uA. This causes a storm
of CC interrupts as it (falsely) detects a potential contaminant. To
prevent this, disable low power mode current sourcing before reading
comparator values.

Fixes: 02b332a063 ("usb: typec: maxim_contaminant: Implement check_contaminant callback")
Cc: stable <stable@kernel.org>
Signed-off-by: Amit Sunil Dhamne <amitsd@google.com>
Reviewed-by: Badhri Jagan Sridharan <badhri@google.com>
Rule: add
Link: https://lore.kernel.org/stable/20250814-fix-upstream-contaminant-v1-1-801ce8089031%40google.com
Link: https://lore.kernel.org/r/20250815-fix-upstream-contaminant-v2-1-6c8d6c3adafb@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-08-17 12:14:50 +02:00
Selvarasu Ganesan
45eae113dc usb: dwc3: Remove WARN_ON for device endpoint command timeouts
This commit addresses a rarely observed endpoint command timeout
which causes kernel panic due to warn when 'panic_on_warn' is enabled
and unnecessary call trace prints when 'panic_on_warn' is disabled.
It is seen during fast software-controlled connect/disconnect testcases.
The following is one such endpoint command timeout that we observed:

1. Connect
   =======
->dwc3_thread_interrupt
 ->dwc3_ep0_interrupt
  ->configfs_composite_setup
   ->composite_setup
    ->usb_ep_queue
     ->dwc3_gadget_ep0_queue
      ->__dwc3_gadget_ep0_queue
       ->__dwc3_ep0_do_control_data
        ->dwc3_send_gadget_ep_cmd

2. Disconnect
   ==========
->dwc3_thread_interrupt
 ->dwc3_gadget_disconnect_interrupt
  ->dwc3_ep0_reset_state
   ->dwc3_ep0_end_control_data
    ->dwc3_send_gadget_ep_cmd

In the issue scenario, in Exynos platforms, we observed that control
transfers for the previous connect have not yet been completed and end
transfer command sent as a part of the disconnect sequence and
processing of USB_ENDPOINT_HALT feature request from the host timeout.
This maybe an expected scenario since the controller is processing EP
commands sent as a part of the previous connect. It maybe better to
remove WARN_ON in all places where device endpoint commands are sent to
avoid unnecessary kernel panic due to warn.

Cc: stable <stable@kernel.org>
Co-developed-by: Akash M <akash.m5@samsung.com>
Signed-off-by: Akash M <akash.m5@samsung.com>
Signed-off-by: Selvarasu Ganesan <selvarasu.g@samsung.com>
Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://lore.kernel.org/r/20250808125315.1607-1-selvarasu.g@samsung.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-08-17 12:14:11 +02:00
Zenm Chen
a3dc32c635 USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles
Many Realtek USB Wi-Fi dongles released in recent years have two modes:
one is driver CD mode which has Windows driver onboard, another one is
Wi-Fi mode. Add the US_FL_IGNORE_DEVICE quirk for these multi-mode devices.
Otherwise, usb_modeswitch may fail to switch them to Wi-Fi mode.

Currently there are only two USB IDs known to be used by these multi-mode
Wi-Fi dongles: 0bda:1a2b and 0bda:a192.

Information about Mercury MW310UH in /sys/kernel/debug/usb/devices.
T:  Bus=02 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 12 Spd=480  MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=0bda ProdID=a192 Rev= 2.00
S:  Manufacturer=Realtek
S:  Product=DISK
C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none)
E:  Ad=8a(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=0b(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms

Information about D-Link AX9U rev. A1 in /sys/kernel/debug/usb/devices.
T:  Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 55 Spd=480  MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=0bda ProdID=1a2b Rev= 0.00
S:  Manufacturer=Realtek
S:  Product=DISK
C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none)
E:  Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms

Cc: stable <stable@kernel.org>
Signed-off-by: Zenm Chen <zenmchen@gmail.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/20250813162415.2630-1-zenmchen@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-08-17 12:13:36 +02:00
Miguel Ojeda
0f580d5d3d rust: alloc: fix rusttest by providing Cmalloc::aligned_layout too
Commit fde578c862 ("rust: alloc: replace aligned_size() with
Kmalloc::aligned_layout()") provides a public `aligned_layout` function
in `Kamlloc`, but not in `Cmalloc`, and thus uses of it will trigger an
error in `rusttest`.

Such a user appeared in the following commit 22ab0641b9 ("rust: drm:
ensure kmalloc() compatible Layout"):

    error[E0599]: no function or associated item named `aligned_layout` found for struct `alloc::allocator_test::Cmalloc` in the current scope
       --> rust/kernel/drm/device.rs💯31
        |
    100 |         let layout = Kmalloc::aligned_layout(Layout:🆕:<Self>());
        |                               ^^^^^^^^^^^^^^ function or associated item not found in `Cmalloc`
        |
       ::: rust/kernel/alloc/allocator_test.rs:19:1
        |
    19  | pub struct Cmalloc;
        | ------------------ function or associated item `aligned_layout` not found for this struct

Thus add an equivalent one for `Cmalloc`.

Fixes: fde578c862 ("rust: alloc: replace aligned_size() with Kmalloc::aligned_layout()")
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Link: https://lore.kernel.org/r/20250816204215.2719559-1-ojeda@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2025-08-17 01:29:21 +02:00
Linus Torvalds
99bade344c Rust fixes for v6.17
Toolchain and infrastructure:
 
   - Workaround 'rustdoc' target modifiers bug in Rust >= 1.88.0. It will
     be fixed in Rust 1.90.0 (expected 2025-09-18).
 
   - Clean 'rustdoc' output before running it to avoid confusing the tool
     when files from previous versions remain.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEPjU5OPd5QIZ9jqqOGXyLc2htIW0FAmig+UEACgkQGXyLc2ht
 IW1s4RAAzT1MCd+CMXfPFyVQnsyXblCa5I3UWhE0+T2nPlicdQqD8NmmkvsxyGLB
 SpoZnYk1yDl9L0wxx7Bw/elGeaoIf/EDqsF2Jl7jg9czhWuQhUTsnHemhw93gaOW
 uCpCUduiTRlZH3Zp2jCQ7rglXdbAzWTPhyCOTJ5oxn3XTj9GL5iFE8iCea2/vjgV
 sYf9GMkwy6I1+HmLsf7rhKVtrt+vozI8PVTXiPX1OlYpRBH0VjmRwjHIDJiGL1qU
 FO0AZzNJqZ8yctheCvTJLxezf2SWXxgMaRuEPY7dEXNvyf7LcmXcxvnAnuQbbh0v
 7wWTRd427bcKLG4NQ6Mqs1bB53YrgC/qfnSgczAtmULXTYoKHq26Ei6bUG2RnBr6
 Br534xF1o1k71Fi5vebtbaGRoLAQFVSB1eTU+iaSZy01YZAevqP4+Ot2Y4NntJtP
 CYnU9cUMZiWIOa42RnBI0YHOtdW7QeNSKKIAH2eT1GTB2bbqUtWuioN67jbHG3uq
 kt3q7Mu8BwLoH6x6/vkPVW9KKahK5LMlB/uOspZhoaEHeGLO7JluoRwc0+EWV8Zm
 QOaCB+lQC1gsEJTmNt0SaexYc7T2ml7zh8uXf+7jXOPzJ1UGUtCXq74un5kkYSOG
 CKMmDKAhZa76BwSiFhlrYKlKBxhnYatyzQKXxe6u7caKoJAixfc=
 =uT2O
 -----END PGP SIGNATURE-----

Merge tag 'rust-fixes-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux

Pull rust fixes from Miguel Ojeda:

 - Workaround 'rustdoc' target modifiers bug in Rust >= 1.88.0. It will
   be fixed in Rust 1.90.0 (expected 2025-09-18).

 - Clean 'rustdoc' output before running it to avoid confusing the tool
   when files from previous versions remain.

* tag 'rust-fixes-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:
  rust: kbuild: clean output before running `rustdoc`
  rust: workaround `rustdoc` target modifiers bug
2025-08-16 15:49:24 -07:00
Thorsten Blum
5eb4b9a4cd
params: Replace deprecated strcpy() with strscpy() and memcpy()
strcpy() is deprecated; use strscpy() and memcpy() instead.

In param_set_copystring(), we can safely use memcpy() because we already
know the length of the source string 'val' and that it is guaranteed to
be NUL-terminated within the first 'kps->maxlen' bytes.

Link: https://github.com/KSPP/linux/issues/88
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Reviewed-by: Daniel Gomez <da.gomez@samsung.com>
Reviewed-by: Petr Pavlu <petr.pavlu@suse.com>
Link: https://lore.kernel.org/r/20250813132200.184064-2-thorsten.blum@linux.dev
Signed-off-by: Daniel Gomez <da.gomez@samsung.com>
2025-08-16 21:47:25 +02:00
Linus Torvalds
90d970cade ata fixes for 6.17-rc2
- Fix a regression affecting old IDE/PATA device scan and introduced by
    the recent link power management cleanups & fixes. The regression
    prevented devices from being properly detected (me).
 
  - Fix command duration limits (CDL) feature control: attempting to
    enable the feature while NCQ commands are being executed resulted in
    a silent failure to enable CDL when needed (Igor).
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQSRPv8tYSvhwAzJdzjdoc3SxdoYdgUCaKB5NgAKCRDdoc3SxdoY
 dmb0AQDGsKNEgAB4tY6e0dkqmp6j0TbcfqT38sizQrOHQKXbQwD8Cq/SdMxsWvjq
 4gWan4AiQmCBR5plwuFmeZ5XXuLSdgU=
 =2Hgt
 -----END PGP SIGNATURE-----

Merge tag 'ata-ata-6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux

Pull ata fixes from Damien Le Moal:

 - Fix a regression affecting old IDE/PATA device scan and introduced by
   the recent link power management cleanups & fixes. The regression
   prevented devices from being properly detected (me)

 - Fix command duration limits (CDL) feature control: attempting to
   enable the feature while NCQ commands are being executed resulted in
   a silent failure to enable CDL when needed (Igor)

* tag 'ata-ata-6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:
  ata: libata-scsi: Fix CDL control
  ata: libata-eh: Fix link state check for IDE/PATA ports
2025-08-16 06:59:13 -07:00
Jonathan Cameron
433b99e922 iio: light: as73211: Ensure buffer holes are zeroed
Given that the buffer is copied to a kfifo that ultimately user space
can read, ensure we zero it.

Fixes: 403e5586b5 ("iio: light: as73211: New driver")
Reviewed-by: Matti Vaittinen <mazziesaccount@gmail.com>
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Link: https://patch.msgid.link/20250802164436.515988-2-jic23@kernel.org
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2025-08-16 14:58:35 +01:00
Claudiu Beznea
c69e13965f iio: adc: rzg2l_adc: Set driver data before enabling runtime PM
When stress-testing the system by repeatedly unbinding and binding the ADC
device in a loop, and the ADC is a supplier for another device (e.g., a
thermal hardware block that reads temperature through the ADC), it may
happen that the ADC device is runtime-resumed immediately after runtime PM
is enabled, triggered by its consumer. At this point, since drvdata is not
yet set and the driver's runtime PM callbacks rely on it, a crash can
occur. To avoid this, set drvdata just after it was allocated.

Fixes: 89ee8174e8 ("iio: adc: rzg2l_adc: Simplify the runtime PM code")
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Link: https://patch.msgid.link/20250810123328.800104-3-claudiu.beznea.uj@bp.renesas.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2025-08-16 14:52:43 +01:00
Claudiu Beznea
a3c6eabe3b iio: adc: rzg2l: Cleanup suspend/resume path
There is no need to manually track the runtime PM status in the driver.
The pm_runtime_force_suspend() and pm_runtime_force_resume() functions
already call pm_runtime_status_suspended() to check the runtime PM state.

Additionally, avoid calling pm_runtime_put_autosuspend() during the
suspend/resume path, as this would decrease the usage counter of a
potential user that had the ADC open before the suspend/resume cycle.

Fixes: 563cf94f93 ("iio: adc: rzg2l_adc: Add suspend/resume support")
Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
Reviewed-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Link: https://patch.msgid.link/20250810123328.800104-2-claudiu.beznea.uj@bp.renesas.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2025-08-16 14:52:20 +01:00
Wentao Liang
4a81f78caa pcmcia: Add error handling for add_interval() in do_validate_mem()
In the do_validate_mem(), the call to add_interval() does not
handle errors. If kmalloc() fails in add_interval(), it could
result in a null pointer being inserted into the linked list,
leading to illegal memory access when sub_interval() is called
next.

This patch adds an error handling for the add_interval(). If
add_interval() returns an error, the function will return early
with the error code.

Fixes: 7b4884ca88 ("pcmcia: validate late-added resources")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
2025-08-16 15:49:58 +02:00
Dr. David Alan Gilbert
750da5029f pcmcia: cs: Remove unused pcmcia_get_socket_by_nr
The last use of pcmcia_get_socket_by_nr() was removed in 2010 by
commit 5716d415f8 ("pcmcia: remove obsolete ioctl")

Remove it.

Signed-off-by: Dr. David Alan Gilbert <linux@treblig.org>
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
2025-08-16 15:44:33 +02:00
Chen Ni
ecef14f70e pcmcia: omap: Add missing check for platform_get_resource
Add missing check for platform_get_resource() and return error if it fails
to catch the error.

Fixes: d87d44f7ab ("ARM: omap1: move CF chipselect setup to board file")
Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
2025-08-16 15:43:33 +02:00
Thorsten Blum
9e1ee33363 pcmcia: Use str_off_on() and str_yes_no() helpers
Remove hard-coded strings by using the str_off_on() and str_yes_no()
helper functions.

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
2025-08-16 15:40:31 +02:00
Lukas Bulwahn
4bf1541e41 pcmcia: remove PCCARD_IODYN
The config PCCARD_IODYN was last used in the config option PCMCIA_M8XX with
its m8xx_pcmcia driver. This driver was removed with commit 39eb56da2b
("pcmcia: Remove m8xx_pcmcia driver"), included in v3.17, back in 2014.
Since then, the config PCCARD_IODYN is unused. Remove the config option,
the corresponding file included with this config and the corresponding
definition in the pcmcia header file.

Signed-off-by: Lukas Bulwahn <lukas.bulwahn@redhat.com>
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
2025-08-16 15:37:47 +02:00
Bagas Sanjaya
ce0e8efb84 pcmcia: ds: Emphasize "really" epizeuxis
pcmcia_dev_present() comment writes about small timeframe where
the function returns NULL (racy condition), in epizeuxis device. In the
past, it tripped contributors who misunderstood it for "really"
duplicate ([1], [2]).

Add comma between "really" words to emphasize the epizeuxis.

Link: https://lore.kernel.org/all/YxT1As38WRZcyH0%2F@shine.dominikbrodowski.net/ [1]
Link: https://lore.kernel.org/all/20220831083623.GA25639@isilmar-4.linta.de/ [2]
Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
2025-08-16 15:36:08 +02:00
David Lechner
b04e455189 iio: adc: ad7380: fix missing max_conversion_rate_hz on adaq4381-4
Add max_conversion_rate_hz to the chip info for "adaq4381-4". Without
this, the driver fails to probe because it tries to set the initial
sample rate to 0 Hz, which is not valid.

Fixes: bbeaec81a0 ("iio: ad7380: add support for SPI offload")
Signed-off-by: David Lechner <dlechner@baylibre.com>
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Link: https://patch.msgid.link/20250811-iio-adc-ad7380-fix-missing-max_conversion_rate_hs-on-ad4381-4-v1-1-ffb728d7a71c@baylibre.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2025-08-16 14:32:35 +01:00
Ma Ke
44822df89e pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region()
In __iodyn_find_io_region(), pcmcia_make_resource() is assigned to
res and used in pci_bus_alloc_resource(). There is a dereference of res
in pci_bus_alloc_resource(), which could lead to a NULL pointer
dereference on failure of pcmcia_make_resource().

Fix this bug by adding a check of res.

Cc: stable@vger.kernel.org
Fixes: 49b1153adf ("pcmcia: move all pcmcia_resource_ops providers into one module")
Signed-off-by: Ma Ke <make24@iscas.ac.cn>
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
2025-08-16 15:31:00 +02:00
Geert Uytterhoeven
d1dfcdd301 pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch
As described in the added code comment, a reference to .exit.text is ok
for drivers registered via platform_driver_probe().  Make this explicit
to prevent the following section mismatch warning

    WARNING: modpost: drivers/pcmcia/omap_cf: section mismatch in reference: omap_cf_driver+0x4 (section: .data) -> omap_cf_remove (section: .exit.text)

that triggers on an omap1_defconfig + CONFIG_OMAP_CF=m build.

Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Acked-by: Aaro Koskinen <aaro.koskinen@iki.fi>
Reviewed-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
2025-08-16 15:23:24 +02:00
Linus Torvalds
c5f3e78d35 SCSI fixes on 20250816
One core change removing the 'w' access flag of attributes that don't
 have a set routine (and therefore can't be written to) which should
 have no practical impact.  The big scsi_debug update is caused by
 reformatting lots of arrays and the rest of the bug fixes in drivers
 are trivial.
 
 Signed-off-by: James E.J. Bottomley <James.Bottomley@HansenPartnership.com>
 -----BEGIN PGP SIGNATURE-----
 
 iJwEABMIAEQWIQTnYEDbdso9F2cI+arnQslM7pishQUCaKBK+yYcamFtZXMuYm90
 dG9tbGV5QGhhbnNlbnBhcnRuZXJzaGlwLmNvbQAKCRDnQslM7pishW1NAP4wTjnJ
 MWB2YCP2jjQRyqUTdNI+XmL3pb15fnY1DZ/18QD/Vrhoa0SX1QFzr4h4ItPU+cIM
 zAqMdfi2rVKbewZ5R+A=
 =8XVL
 -----END PGP SIGNATURE-----

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
 "One core change removing the 'w' access flag of attributes that don't
  have a set routine (and therefore can't be written to) which should
  have no practical impact. The big scsi_debug update is caused by
  reformatting lots of arrays and the rest of the bug fixes in drivers
  are trivial"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: ufs: core: Remove error print for devm_add_action_or_reset()
  scsi: ufs: mediatek: Fix out-of-bounds access in MCQ IRQ mapping
  scsi: lpfc: Remove redundant assignment to avoid memory leak
  scsi: lpfc: Fix wrong function reference in a comment
  scsi: ufs: core: Fix interrupt handling for MCQ Mode
  scsi: scsi_debug: Make read-only arrays static const
  scsi: core: sysfs: Correct sysfs attributes access rights
2025-08-16 06:20:49 -07:00
Matti Vaittinen
8a6ededaad iio: adc: bd79124: Add GPIOLIB dependency
The bd79124 has ADC inputs which can be muxed to be GPIOs. The driver
supports this by registering a GPIO-chip for channels which aren't used
as ADC.

The Kconfig entry does not handle the dependency to GPIOLIB, which
causes errors:

ERROR: modpost: "devm_gpiochip_add_data_with_key" [drivers/iio/adc/rohm-bd79124.ko] undefined!
ERROR: modpost: "gpiochip_get_data" [drivers/iio/adc/rohm-bd79124.ko] undefined!

at linking phase if GPIOLIB is not configured to be used.

Fix this by adding dependency to the GPIOLIB.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202508131533.5sSkq80B-lkp@intel.com/
Fixes: 3f57a3b9ab ("iio: adc: Support ROHM BD79124 ADC")
Signed-off-by: Matti Vaittinen <mazziesaccount@gmail.com>
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Link: https://patch.msgid.link/6837249bddf358924e67566293944506206d2d62.1755076369.git.mazziesaccount@gmail.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
2025-08-16 13:25:35 +01:00
Thorsten Blum
a44458dfd5
accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc()
Use kvfree() to fix the following Coccinelle/coccicheck warning reported
by kfree_mismatch.cocci:

  WARNING kvmalloc is used to allocate this memory at line 10398

Fixes: f728c17fc9 ("accel/habanalabs/gaudi2: move HMMU page tables to device memory")
Reported-by: Qianfeng Rong <rongqianfeng@vivo.com>
Closes: https://patch.msgid.link/20250808085530.233737-1-rongqianfeng@vivo.com
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
[lukas: acknowledge Qianfeng, adjust Thorsten's domain, add Fixes tag]
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Reviewed-by: Tomer Tayar <ttayar@habana.ai>
Cc: stable@vger.kernel.org  # v6.9+
Link: https://patch.msgid.link/20240820231028.136126-1-thorsten.blum@toblux.com
2025-08-16 12:45:08 +02:00
Avizrat, Yaron
39ca24675b
MAINTAINERS: Change habanalabs maintainers
I will be leaving Intel soon, Koby Elbaz & Konstantin Sinyuk will take
the role of habanalabs driver maintainers.

Signed-off-by: Yaron Avizrat <yaron.avizrat@intel.com>
Reviewed-by: Koby Elbaz <koby.elbaz@intel.com>
Reviewed-by: Konstantin Sinyuk <konstantin.sinyuk@intel.com>
Link: https://patch.msgid.link/DM4PR11MB55491ACAA33DF29CEF3C67DAE935A@DM4PR11MB5549.namprd11.prod.outlook.com
[lukas: wrap to 72 chars]
Signed-off-by: Lukas Wunner <lukas@wunner.de>
2025-08-16 09:58:41 +02:00
Jakub Kicinski
715c7a36d5 selftests: tls: make the new data_steal test less flaky
The CI has hit a couple of cases of:

  RUN           global.data_steal ...
 tls.c:2762:data_steal:Expected recv(cfd, buf2, sizeof(buf2), MSG_DONTWAIT) (20000) == -1 (-1)
 data_steal: Test terminated by timeout
          FAIL  global.data_steal

Looks like the 2msec sleep is not long enough. Make the sleep longer,
and then instead of second sleep wait for the thieving process to exit.
That way we can be sure it called recv() before us.

While at it also avoid trying to steal more than a record, this seems
to be causing issues in manual testing as well.

Fixes: d7e82594a4 ("selftests: tls: test TCP stealing data from under the TLS socket")
Link: https://patch.msgid.link/20250814194323.2014650-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-08-15 18:07:27 -07:00
Zheng Qixing
b7ee30f0ef md: fix sync_action incorrect display during resync
During raid resync, if a disk becomes faulty, the operation is
briefly interrupted. The MD_RECOVERY_RECOVER flag triggered by
the disk failure causes sync_action to incorrectly show "recover"
instead of "resync". The same issue affects reshape operations.

Reproduction steps:
  mdadm -Cv /dev/md1 -l1 -n4 -e1.2 /dev/sd{a..d} // -> resync happened
  mdadm -f /dev/md1 /dev/sda                     // -> resync interrupted
  cat sync_action
  -> recover

Add progress checks in md_sync_action() for resync/recover/reshape
to ensure the interface correctly reports the actual operation type.

Fixes: 4b10a3bc67 ("md: ensure resync is prioritized over recovery")
Signed-off-by: Zheng Qixing <zhengqixing@huawei.com>
Link: https://lore.kernel.org/linux-raid/20250816002534.1754356-3-zhengqixing@huaweicloud.com
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
2025-08-16 08:52:33 +08:00
Zheng Qixing
cb0780ad43 md: add helper rdev_needs_recovery()
Add a helper for checking if an rdev needs recovery.

Signed-off-by: Zheng Qixing <zhengqixing@huawei.com>
Link: https://lore.kernel.org/linux-raid/20250816002534.1754356-2-zhengqixing@huaweicloud.com
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
2025-08-16 08:51:59 +08:00
Xiao Ni
c27973211f md: keep recovery_cp in mdp_superblock_s
commit 907a99c314 ("md: rename recovery_cp to resync_offset") replaces
recovery_cp with resync_offset in mdp_superblock_s which is in md_p.h.
md_p.h is used in userspace too. So mdadm building fails because of this.
This patch revert this change.

Fixes: 907a99c314 ("md: rename recovery_cp to resync_offset")
Signed-off-by: Xiao Ni <xni@redhat.com>
Link: https://lore.kernel.org/linux-raid/20250815040028.18085-1-xni@redhat.com
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
2025-08-16 08:47:38 +08:00
Ma Ke
1f403699c4 drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv
Using device_find_child() and of_find_device_by_node() to locate
devices could cause an imbalance in the device's reference count.
device_find_child() and of_find_device_by_node() both call
get_device() to increment the reference count of the found device
before returning the pointer. In mtk_drm_get_all_drm_priv(), these
references are never released through put_device(), resulting in
permanent reference count increments. Additionally, the
for_each_child_of_node() iterator fails to release node references in
all code paths. This leaks device node references when loop
termination occurs before reaching MAX_CRTC. These reference count
leaks may prevent device/node resources from being properly released
during driver unbind operations.

As comment of device_find_child() says, 'NOTE: you will need to drop
the reference with put_device() after use'.

Cc: stable@vger.kernel.org
Fixes: 1ef7ed4835 ("drm/mediatek: Modify mediatek-drm for mt8195 multi mmsys support")
Signed-off-by: Ma Ke <make24@iscas.ac.cn>
Reviewed-by: CK Hu <ck.hu@mediatek.com>
Link: https://patchwork.kernel.org/project/dri-devel/patch/20250812071932.471730-1-make24@iscas.ac.cn/
Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
2025-08-15 23:35:35 +00:00
Linus Torvalds
dfd4b508c8 drm fixes for 6.17-rc2
bridge:
 - fix OF-node leak
 - fix documentation
 
 fbdev-emulation:
 - pass correct format info to drm_helper_mode_fill_fb_struct()
 
 panfrost:
 - print correct RSS size
 
 amdgpu:
 - PSP fix
 - VRAM reservation fix
 - CSA fix
 - Process kill fix
 
 i915:
 - Fix the implementation of wa_18038517565 [fbc]
 - Do not trigger Frame Change events from frontbuffer flush [psr]
 
 xe:
 - Some more xe_migrate_access_memory fixes (Auld)
 - Defer buffer object shrinker write-backs and GPU waits (Thomas)
 - HWMON fix for clamping limits (Karthik)
 - SRIOV-PF: Set VF LMEM BAR size (Michal)
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmifpQsACgkQDHTzWXnE
 hr63FA//SvXpA51XfZuF1gm6x3oeYuF1xGMLS34ol6EI4YwOQg7wke7IFMe12dMJ
 X/1kZ48Ju1l9NLyuRQfC7zW1EAqN4HjrB62MdGxFv7+Ap/i5SiOow9zJRSg0a5Mq
 qRNmyGSw4ch1sVnU4LN1+9rVqpMN/jo5ngEvSlLlUmDtG2Plg9PzqSGIGHGPgStL
 DEQI9DHUzn1F6lVtvdj/rA1+EzxaPKQ1g/VHMbA8bR46xal4jJ1BOWUI2plG6dcf
 OxfhNvdqETz7q1YFgbyMUSXaR2VcK9qM/ATSBV/CSYOz51cd11CE12FI+Fywfc0i
 /Jgt3H1Ociis/x7BfuTaRL3FkVYgzq7UK4KHZVeASJch2AjSl5tyaLx+ghmr4+5i
 bPgK5rcWof9XvxRHylzKUcJwg+1Tn3r280mwWS/RQuGDEAWkT/8IB7WO+Ol8tJ+v
 UbSsODl2BkXnumZE7r/dOcYNaJNgRdE5Uvc7+jCnt67Rk1WHBS8BB82Cst285A9h
 lJdNp+mvN10erfWfLYhEWaFs/E6Us0YyFxKui65ZJftS5ErsQBDKE7Va7MVz5AxM
 Laa8/K+5Y6c/2WW1Z8Ayiua/KV2Y7b4oWlhUPu6V/rjZrHHYt2sE1KV/bBeBKlPo
 Q1zjf8ECQW90lK7vLSxPfGID5LMQUhJbmpaEpfyjyU+Q9nYjl9Y=
 =d48j
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2025-08-16' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "Relatively quiet week, usual amdgpu/i915/xe fixes along with a set of
  fixes for fbdev format info, which fix some regressions seen in with
  rc1.

  bridge:
   - fix OF-node leak
   - fix documentation

  fbdev-emulation:
   - pass correct format info to drm_helper_mode_fill_fb_struct()

  panfrost:
   - print correct RSS size

  amdgpu:
   - PSP fix
   - VRAM reservation fix
   - CSA fix
   - Process kill fix

  i915:
   - Fix the implementation of wa_18038517565 [fbc]
   - Do not trigger Frame Change events from frontbuffer flush [psr]

  xe:
   - Some more xe_migrate_access_memory fixes (Auld)
   - Defer buffer object shrinker write-backs and GPU waits (Thomas)
   - HWMON fix for clamping limits (Karthik)
   - SRIOV-PF: Set VF LMEM BAR size (Michal)"

* tag 'drm-fixes-2025-08-16' of https://gitlab.freedesktop.org/drm/kernel:
  drm/xe/pf: Set VF LMEM BAR size
  drm/amdgpu: fix task hang from failed job submission during process kill
  drm/amdgpu: fix incorrect vm flags to map bo
  drm/amdgpu: fix vram reservation issue
  drm/amdgpu: Add PSP fw version check for fw reserve GFX command
  drm/xe/hwmon: Add SW clamp for power limits writes
  drm/xe: Defer buffer object shrinker write-backs and GPU waits
  drm/xe/migrate: prevent potential UAF
  drm/xe/migrate: don't overflow max copy size
  drm/xe/migrate: prevent infinite recursion
  drm/i915/psr: Do not trigger Frame Change events from frontbuffer flush
  drm/i915/fbc: fix the implementation of wa_18038517565
  drm/panfrost: Print RSS for tiler heap BO's in debugfs GEMS file
  drm/radeon: Pass along the format info from .fb_create() to drm_helper_mode_fill_fb_struct()
  drm/nouveau: Pass along the format info from .fb_create() to drm_helper_mode_fill_fb_struct()
  drm/omap: Pass along the format info from .fb_create() to drm_helper_mode_fill_fb_struct()
  drm/bridge: document HDMI CEC callbacks
  drm/bridge: Describe the newly introduced drm_connector parameter for drm_bridge_detect
  drm/bridge: fix OF node leak
2025-08-15 14:52:36 -07:00
Miguel Ojeda
db2e7bcee1 drm: nova-drm: fix 32-bit arm build
In 32-bit arm, the build fails with:

    error[E0308]: mismatched types
      --> drivers/gpu/drm/nova/file.rs:42:28
       |
    42 |         getparam.set_value(value);
       |                  --------- ^^^^^ expected `u64`, found `u32`
       |                  |
       |                  arguments to this method are incorrect
       |
    note: method defined here
      --> drivers/gpu/drm/nova/uapi.rs:29:12
       |
    29 |     pub fn set_value(&self, v: u64) {
       |            ^^^^^^^^^        ------
    help: you can convert a `u32` to a `u64`
       |
    42 |         getparam.set_value(value.into());
       |                                 +++++++

The reason is that `Getparam::set_value` takes a `u64` (from the UAPI),
but `pci::Device::resource_len()` returns a `resource_size_t`, which is a
`phys_addr_t`, which may be 32- or 64-bit.

Thus add an `into()` call to support the 32-bit case, while allowing the
Clippy lint that complains in the 64-bit case where the type is the same.

Fixes: cdeaeb9dd7 ("drm: nova-drm: add initial driver skeleton")
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Reviewed-by: Christian Schrefl <chrisi.schrefl@gmail.com>
Link: https://lore.kernel.org/r/20250724165441.2105632-1-ojeda@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2025-08-15 23:04:08 +02:00
Linus Torvalds
d0efc9e427 xfs: Fixes for 6.17-rc2
Signed-off-by: Carlos Maiolino <cem@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iJUEABMJAB0WIQSmtYVZ/MfVMGUq1GNcsMJ8RxYuYwUCaJ8nJQAKCRBcsMJ8RxYu
 Y91GAX4q+aKhXBJzzEYGaCGEajMNHlClPI9Ac5AlhSkzW/XdZdS8FhIgJMNegTst
 yOKZ32kBgPoBtiVDbRs7h0USqmcd94f9IwmoLa+0miUKyHHJaZIR97of9F/P1o3q
 Lx2dLf5hwQ==
 =e0dN
 -----END PGP SIGNATURE-----

Merge tag 'xfs-fixes-6.17-rc2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux

Pull xfs fixes from Carlos Maiolino:

 - Fix an assert trigger introduced during the merge window

 - Prevent atomic writes to be used with DAX

 - Prevent users from using the max_atomic_write mount option without
   reflink, as atomic writes > 1block are not supported without reflink

 - Fix a null-pointer-deref in a tracepoint

* tag 'xfs-fixes-6.17-rc2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
  xfs: split xfs_zone_record_blocks
  xfs: fix scrub trace with null pointer in quotacheck
  xfs: reject max_atomic_write mount option for no reflink
  xfs: disallow atomic writes on DAX
  fs/dax: Reject IOCB_ATOMIC in dax_iomap_rw()
  xfs: remove XFS_IBULK_SAME_AG
  xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags
  xfs: fix frozen file system assert in xfs_trans_alloc
2025-08-15 12:50:12 -07:00
Chandra Mohan Sundar
12da2b92ad net: libwx: Fix the size in RSS hash key population
While trying to fill a random RSS key, the size of the pointer
is being used rather than the actual size of the RSS key.

Fix by passing an appropriate value of the RSS key.
This issue was reported by static coverity analyser.

Fixes: eb4898fde1 ("net: libwx: add wangxun vf common api")
Signed-off-by: Chandra Mohan Sundar <chandramohan.explore@gmail.com>
Link: https://patch.msgid.link/20250814163014.613004-1-chandramohan.explore@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-08-15 12:38:53 -07:00
Marc Zyngier
d19c541d26 KVM: arm64: Correctly populate FAR_EL2 on nested SEA injection
vcpu_write_sys_reg()'s signature is not totally obvious, and it
is rather easy to write something that looks correct, except that...
Oh wait...

Swap addr and FAR_EL2 to restore some sanity in the nested SEA
department.

Fixes: 9aba641b9e ("KVM: arm64: nv: Respect exception routing rules for SEAs")
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20250813163747.2591317-1-maz@kernel.org
Signed-off-by: Oliver Upton <oliver.upton@linux.dev>
2025-08-15 11:51:18 -07:00
Javier Garcia
6cc44e9618 drm: Add directive to format code in comment
Add formatting directive line in function `drm_gpuvm_sm_map_exec_lock()`
comment to clear warning messages shown bellow that appears generating
documentation `make htmldocs`.

  Warning: ./drivers/gpu/drm/drm_gpuvm.c:2444: Unexpected indentation.
  Warning: ./drivers/gpu/drm/drm_gpuvm.c:2446: Block quote ends without a blank line; unexpected unindent.
  Warning: ./drivers/gpu/drm/drm_gpuvm.c:2450: Definition list ends without a blank line; unexpected unindent.
  Warning: ./drivers/gpu/drm/drm_gpuvm.c:2451: Definition list ends without a blank line; unexpected unindent.
  Warning: ./drivers/gpu/drm/drm_gpuvm.c:2455: Unexpected indentation.
  Warning: ./drivers/gpu/drm/drm_gpuvm.c:2456: Definition list ends without a blank line; unexpected unindent.
  Warning: ./drivers/gpu/drm/drm_gpuvm.c:2457: Definition list ends without a blank line; unexpected unindent.
  Warning: ./drivers/gpu/drm/drm_gpuvm.c:2458: Definition list ends without a blank line; unexpected unindent.

Fixes: 471920ce25 ("drm/gpuvm: Add locking helpers")
Signed-off-by: Javier Garcia <rampxxxx@gmail.com>
Reviewed-by: Bagas Sanjaya <bagasdotme@gmail.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250810150706.305040-1-rampxxxx@gmail.com
[ Fix typo in commit message. - Danilo ]
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2025-08-15 20:47:13 +02:00
Qianfeng Rong
989fe67712 drm/nouveau/gsp: fix mismatched alloc/free for kvmalloc()
Replace kfree() with kvfree() for memory allocated by kvmalloc().

Compile-tested only.

Cc: stable@vger.kernel.org
Fixes: 8a8b1ec526 ("drm/nouveau/gsp: split rpc handling out on its own")
Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
Reviewed-by: Timur Tabi <ttabi@nvidia.com>
Acked-by: Zhi Wang <zhiw@nvidia.com>
Link: https://lore.kernel.org/r/20250813125412.96178-1-rongqianfeng@vivo.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2025-08-15 20:39:48 +02:00
Thijs Raymakers
c87bd4dd43 KVM: x86: use array_index_nospec with indices that come from guest
min and dest_id are guest-controlled indices. Using array_index_nospec()
after the bounds checks clamps these values to mitigate speculative execution
side-channels.

Signed-off-by: Thijs Raymakers <thijs@raymakers.nl>
Cc: stable@vger.kernel.org
Cc: Sean Christopherson <seanjc@google.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Fixes: 715062970f ("KVM: X86: Implement PV sched yield hypercall")
Fixes: bdf7ffc899 ("KVM: LAPIC: Fix pv ipis out-of-bounds access")
Fixes: 4180bf1b65 ("KVM: X86: Implement "send IPI" hypercall")
Link: https://lore.kernel.org/r/20250804064405.4802-1-thijs@raymakers.nl
Signed-off-by: Sean Christopherson <seanjc@google.com>
2025-08-15 11:33:21 -07:00
Jakub Kicinski
79116acb75 bluetooth pull request for net:
- hci_conn: Fix running bis_cleanup for hci_conn->type PA_LINK
  - hci_conn: Fix not cleaning up Broadcaster/Broadcast Source
  - hci_core: Fix using {cis,bis}_capable for current settings
  - hci_core: Fix using ll_privacy_capable for current settings
  - hci_core: Fix not accounting for BIS/CIS/PA links separately
  - hci_conn: do return error from hci_enhanced_setup_sync()
  - hci_event: fix MTU for BN == 0 in CIS Established
  - hci_sync: Fix scan state after PA Sync has been established
  - hci_sync: Avoid adding default advertising on startup
  - hci_sync: Prevent unintended PA sync when SID is 0xFF
  - ISO: Fix getname not returning broadcast fields
  - btmtk: Fix wait_on_bit_timeout interruption during shutdown
  - btnxpuart: Uses threaded IRQ for host wakeup handling
 -----BEGIN PGP SIGNATURE-----
 
 iQJNBAABCgA3FiEE7E6oRXp8w05ovYr/9JCA4xAyCykFAmifQh4ZHGx1aXoudm9u
 LmRlbnR6QGludGVsLmNvbQAKCRD0kIDjEDILKSpyD/4+a98UD/FMiu2MuowbCJvK
 EWneAUc9l0j/bhVSaTnRzpXM6gov/SNdSFr9dLrTeYY75X+ky1YDFca/deP2fZzl
 v+2H306yIw73k4DAEqkzOQk+YRpi/N7+rruytlZd7TC29zwer1IEg2Rv6hMqmZQt
 bkFiEcR2HpIFaXGDAmsKmXEQ3xsNnbHpeuqQIYPC0uzTYDdW8O+vV/etgHeycfzc
 dGDJOX+3oEAYCi3NtJY/DZLlIhKneLHRn7qGpDAXUWTRvzHESdzmOzSQ9wD0fVqD
 pMMJv0dmaubH32JHafnIGixGb6LwhHWbse2yaei2uWfwukQJAzflfMwkManVsEBa
 SM5mNXS586xeLfahLy1FmlbOaL5e7enL8Bhd4jZJGtIb1WRMZBsXCNKX0cZUKn8B
 mNrM1zqQUvBrmS9G5KC2lAfgco0mqxoSKipgctJLamzNR2z6Yz4No0MLTzh89MnV
 0waBToTn8sXidN/ENzOrxq6GGFZmaV0x3UXickwcbxLKC30+r3nXR4j0xK56N2ly
 2sM+wU9CkXitQIW8PUWcYAWZ1k3/7ixv5/pIGVHnozQEcHiBX0OOmReauF3LWZjC
 pWZU0/T7vduS4/3ThSBQNOjjWp3uhyKYCbbumMQsTVSsJ5MOgvf7IqLcVWAVi3Eg
 1lbQkLQNC3uaosoV/JJfRg==
 =ZtN+
 -----END PGP SIGNATURE-----

Merge tag 'for-net-2025-08-15' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth

Luiz Augusto von Dentz says:

====================
bluetooth pull request for net:

 - hci_conn: Fix running bis_cleanup for hci_conn->type PA_LINK
 - hci_conn: Fix not cleaning up Broadcaster/Broadcast Source
 - hci_core: Fix using {cis,bis}_capable for current settings
 - hci_core: Fix using ll_privacy_capable for current settings
 - hci_core: Fix not accounting for BIS/CIS/PA links separately
 - hci_conn: do return error from hci_enhanced_setup_sync()
 - hci_event: fix MTU for BN == 0 in CIS Established
 - hci_sync: Fix scan state after PA Sync has been established
 - hci_sync: Avoid adding default advertising on startup
 - hci_sync: Prevent unintended PA sync when SID is 0xFF
 - ISO: Fix getname not returning broadcast fields
 - btmtk: Fix wait_on_bit_timeout interruption during shutdown
 - btnxpuart: Uses threaded IRQ for host wakeup handling

* tag 'for-net-2025-08-15' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:
  Bluetooth: hci_core: Fix not accounting for BIS/CIS/PA links separately
  Bluetooth: btnxpuart: Uses threaded IRQ for host wakeup handling
  Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync()
  Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established
  Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF
  Bluetooth: hci_core: Fix using ll_privacy_capable for current settings
  Bluetooth: hci_core: Fix using {cis,bis}_capable for current settings
  Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown
  Bluetooth: hci_conn: Fix not cleaning up Broadcaster/Broadcast Source
  Bluetooth: hci_conn: Fix running bis_cleanup for hci_conn->type PA_LINK
  Bluetooth: ISO: Fix getname not returning broadcast fields
  Bluetooth: hci_sync: Fix scan state after PA Sync has been established
  Bluetooth: hci_sync: Avoid adding default advertising on startup
====================

Link: https://patch.msgid.link/20250815142229.253052-1-luiz.dentz@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-08-15 10:56:11 -07:00
Jakub Kicinski
0894731887 Merge branch 'mlxsw-spectrum-forward-packets-with-an-ipv4-link-local-source-ip'
Petr Machata says:

====================
mlxsw: spectrum: Forward packets with an IPv4 link-local source IP

By default, Spectrum devices do not forward IPv4 packets with a link-local
source IP (i.e., 169.254.0.0/16). This behavior does not align with the
kernel which does forward them. Fix the issue and add a selftest.
====================

Link: https://patch.msgid.link/cover.1755174341.git.petrm@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-08-15 10:44:50 -07:00
Ido Schimmel
5e0b2177bd selftest: forwarding: router: Add a test case for IPv4 link-local source IP
Add a test case which checks that packets with an IPv4 link-local source
IP are forwarded and not dropped.

Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: Petr Machata <petrm@nvidia.com>
Link: https://patch.msgid.link/3c2e0b17d99530f57bef5ddff9af284fa0c9b667.1755174341.git.petrm@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-08-15 10:44:48 -07:00
Ido Schimmel
f604d3aaf6 mlxsw: spectrum: Forward packets with an IPv4 link-local source IP
By default, the device does not forward IPv4 packets with a link-local
source IP (i.e., 169.254.0.0/16). This behavior does not align with the
kernel which does forward them.

Fix by instructing the device to forward such packets instead of
dropping them.

Fixes: ca360db4b8 ("mlxsw: spectrum: Disable DIP_LINK_LOCAL check in hardware pipeline")
Reported-by: Zoey Mertes <zoey@cloudflare.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: Petr Machata <petrm@nvidia.com>
Link: https://patch.msgid.link/6721e6b2c96feb80269e72ce8d0b426e2f32d99c.1755174341.git.petrm@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-08-15 10:44:48 -07:00
Shinji Nomoto
357d1fc38a cpupower: Allow control of boost feature on non-x86 based systems with boost support.
The cpufreq subsystem has a generic sysfs interface for controlling boost
(/sys/devices/system/cpu/cpufreq/boost).
The sysfs interface can be used to enable boost control from the cpupower
command on non-x86 platforms as well. So, allow boost controlling
on non-x86 system if boost sysfs file exists.

The set subcommand enables/disables the boost feature using the following
syntax:
    cpupower set --boost 1
    cpupower set --boost 0

The --boost option is an alias for --turbo-boost. We provided the neutral
option name because the name "turbo boost" is specific to Intel technology.

The frequency-info subcommand displays the enabled/disabled state of
the boost feature as follows:
    boost state support:
        Active: yes (or no)

Link: https://lore.kernel.org/r/20250522061122.2149188-3-fj5851bi@fujitsu.com
Signed-off-by: Shinji Nomoto <fj5851bi@fujitsu.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2025-08-15 10:49:14 -06:00
Shinji Nomoto
b3eaf14f4c cpupower: Fix a bug where the -t option of the set subcommand was not working.
The set subcommand's -t option is documented as being available for boost
configuration, but it was not actually functioning due to a bug
in the option handling.

Link: https://lore.kernel.org/r/20250522061122.2149188-2-fj5851bi@fujitsu.com
Signed-off-by: Shinji Nomoto <fj5851bi@fujitsu.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
2025-08-15 10:49:13 -06:00
Evgeniy Harchenko
eafae0fdd1 ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6
The HP EliteBook x360 830 G6 and HP EliteBook 830 G6 have
Realtek HDA codec ALC215. It needs the ALC285_FIXUP_HP_GPIO_LED
quirk to enable the mute LED.

Cc: <stable@vger.kernel.org>
Signed-off-by: Evgeniy Harchenko <evgeniyharchenko.dev@gmail.com>
Link: https://patch.msgid.link/20250815095814.75845-1-evgeniyharchenko.dev@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2025-08-15 17:55:57 +02:00
Linus Torvalds
ee94b00c1a block-6.17-20250815
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmifSywQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpo6lD/0T1HlfvcG2kVfk35pcn1EaVxX5li1nuRTa
 afUmnVHeOe8C5Fcl9uwc7oBcdJUGldWcE3ARBHorMhmougy9hVj5T9qUKzP6w87U
 ZVMU63gDJ13Uz0hv3nl6UDSv2P0Sgk+zb9qEpJx/XiOVtaw9rERGNpLNjjASU65v
 c+BdRO4dwIrWUEz/dWU8AMADacjyFd1fBLvLxUQAWJ2Jo9voup4KnywDw5AuoTSw
 wmXPYYoyaPtciNontQz+s6lFX4qCJJijnmiS4W7jF//xxbMS5MxSQzKVhdH5Ax0w
 hpMO2Zb7UsF3zPiNiwfrtukhK68GJOJPmmOFkVPjaLU15kme84mDKE7Ad6hmiJXy
 nDaMbt7+NLvV3Gn4TEZxyiqwA4MPOoqdmwg7rFPD4k6oCQ9Z+lOnKSd+gGNX2Mn5
 fSjTAGFRXygfJ7mshGjRSqPEzqa+uPGMg+32gEUcE7Dx3U0bvFs4jZSqgEAjEAqR
 e62zJtlYKgwaj+1lHG5+GMq1guU//H8IndSFGPMRKUBky1AIaLZZ8LiQbqEdnAWW
 nTuPPUth5l2AzdmVjiBRzlOoiH8vhf8Mh5n+QPHP/olG9AKUmpYWquMzDMHKnZtt
 6SOvnD8RDUgcojgdDPHXHpWEclNEw31b+jjZaFC+qcwnGDqAhEFy4qZJNFqqsiDl
 W2nSJrsLtw==
 =JNGm
 -----END PGP SIGNATURE-----

Merge tag 'block-6.17-20250815' of git://git.kernel.dk/linux

Pull block fixes from Jens Axboe:

 - Fix for unprivileged daemons in ublk

 - Speedup ublk release by removing unnecessary quiesce

 - Fix for blk-wbt, where a regression caused it to not be possible to
   enable at runtime

 - blk-wbt cleanups

 - Kill the page pool from drbd

 - Remove redundant __GFP_NOWARN uses in a few spots

 - Fix for a kobject double initialization issues

* tag 'block-6.17-20250815' of git://git.kernel.dk/linux:
  block: restore default wbt enablement
  Docs: admin-guide: Correct spelling mistake
  blk-wbt: doc: Update the doc of the wbt_lat_usec interface
  blk-wbt: Eliminate ambiguity in the comments of struct rq_wb
  blk-wbt: Optimize wbt_done() for non-throttled writes
  block: fix kobject double initialization in add_disk
  blk-cgroup: remove redundant __GFP_NOWARN
  block, bfq: remove redundant __GFP_NOWARN
  ublk: check for unprivileged daemon on each I/O fetch
  ublk: don't quiesce in ublk_ch_release
  drbd: Remove the open-coded page pool
2025-08-15 08:20:36 -07:00
Ahmed S. Darwish
ed6c4b657b x86/cpuid: Remove transitional <asm/cpuid.h> header
All CPUID call sites were updated at commit:

    968e300068 ("x86/cpuid: Set <asm/cpuid/api.h> as the main CPUID header")

to include <asm/cpuid/api.h> instead of <asm/cpuid.h>.

The <asm/cpuid.h> header was still retained as a wrapper, just in case
some new code in -next started using it.  Now that everything is merged
to Linus' tree, remove the header.

Signed-off-by: Ahmed S. Darwish <darwi@linutronix.de>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/20250815070227.19981-2-darwi@linutronix.de
2025-08-15 17:06:23 +02:00
Tom Lendacky
3ee9cebd0a x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero
In order to support future versions of the SVSM_CORE_PVALIDATE call, all
reserved fields within a PVALIDATE entry must be set to zero as an SVSM should
be ensuring all reserved fields are zero in order to support future usage of
reserved areas based on the protocol version.

Fixes: fcd042e864 ("x86/sev: Perform PVALIDATE using the SVSM when not at VMPL0")
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Joerg Roedel <joerg.roedel@amd.com>
Cc: <stable@kernel.org>
Link: https://lore.kernel.org/7cde412f8b057ea13a646fb166b1ca023f6a5031.1755098819.git.thomas.lendacky@amd.com
2025-08-15 17:06:17 +02:00