Commit graph

1,447,411 commits

Author SHA1 Message Date
Linus Torvalds
f414f9fd68 pci-v6.18-fixes-4
-----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCgAyFiEEgMe7l+5h9hnxdsnuWYigwDrT+vwFAmkFGA4UHGJoZWxnYWFz
 QGdvb2dsZS5jb20ACgkQWYigwDrT+vyfiw//YVAoH88G07XqFNRkkgNzoF5sFwrp
 Is5XsfK+VTey6u9TaPsivphKPoLXVZx6M9iIAbCLlvtxvknCdsyB/oa/QOCOr6Fl
 4ldy44Glo8CRdbSjfGUf1sBLlmRCv0EExJ5RZF6dLuK3glql+YO4pmQIf40Dtxa9
 6ThXIghPXNPdy7l/LuneiNDLOsCTB4NUnETXU1LaRWWYzgx2hRJ5PA1GKbD9c+jL
 QgA2jUH6Ybi6vUdohg4EftaDr5iR1vsl7CBrSTOeHB1M7RIpb6OiwA8R1HAsTpGt
 g0hsz73iB6TTi8TWSJwZYp4bBr4Tk78iFmWEZry51ixQMpm4BrN/wnFlImp3GnBk
 AECgxuIK3t+N1/Tk0Cbed8IW4n64qcUmns8923olgdsweiQpBuf29S6BgtlSZnbG
 YQfwMl6pFZ/HjhYZyUABceM4nAc0hk123+MgR1u9lpX/uC+s8s/QiDcRoDZ7+T4K
 u7haJAHg0XG/0Iy0xb3Ufn0SdyTFpjm7WD5uWNrRekHQ2Z7GfmzaDl6uByL4T5Kq
 vinC2Hno0iPV7Jo1ESUa9EtOcbdUaJwdvxRTCgNcCTZHI7OZ2f//wvH4gVT1hMql
 y5NgX9S6obZaosjVBWMgGT/S2Im3b6w/GW685SBV+308/K0puTLR5GRX6Lrdb7fA
 lBjzEmYlLYRrZTY=
 =fYnS
 -----END PGP SIGNATURE-----

Merge tag 'pci-v6.18-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci

Pull pci fixes from Bjorn Helgaas:

 - Restore custom qcom ASPM enablement code so L1 PM Substates are
   enabled as they were in v6.17 even though the PCI core now enables
   just L0s and L1 by default (Bjorn Helgaas)

 - Size prefetchable bridge windows only when they actually exist, to
   avoid a WARN_ON() regression (Ilpo Järvinen)

* tag 'pci-v6.18-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:
  PCI: Do not size non-existing prefetchable window
  Revert "PCI: qcom: Remove custom ASPM enablement code"
2025-10-31 14:24:32 -07:00
Krishna Chaitanya Chundru
50433f6eea PCI: qcom: Use frequency and level based OPP lookup
PCIe link configurations such as 8GT/s x2 and 16GT/s x1 may operate at the
same frequency, but differ in other characteristics like RPMh votes.  But
the existing OPP selection which is solely based on frequency (the 'opp-hz'
DT property) cannot distinguish between such cases.

Hence, use the newly introduced dev_pm_opp_find_key_exact() API to match
both frequency and level (the 'opp-level' property) when selecting an OPP,
here level indicates PCIe data rate.

To support older device trees where opp-level is not defined, check if
opp-level is present or not using dev_pm_opp_find_level_exact(). If
not present fallback to frequency only match.

Signed-off-by: Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com>
[mani: zero initialize dev_pm_opp_key struct]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
[bhelgaas: add 'opp-hz' and 'opp-level' in commit log]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20251013-opp_pcie-v5-5-eb64db2b4bd3@oss.qualcomm.com
2025-10-31 16:20:46 -05:00
Linus Torvalds
39bcf0f7d4 VFIO update for v6.18-rc4
- Fix overflows in vfio type1 backend for mappings at the end of the
    64-bit address space, resulting in leaked pinned memory.  New
    selftest support included to avoid such issues in the future.
    (Alex Mastro)
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCAAvFiEEQvbATlQL0amee4qQI5ubbjuwiyIFAmkFF0YRHGFsZXhAc2hh
 emJvdC5vcmcACgkQI5ubbjuwiyLZsQ/+OzFOEOOw5UIpVrMsnp7DmLOSYgiorlpS
 q9jtsP99dh4U1JqJaONAGb6uu1SL6yX6VL3QZNEppPY83WXVSxX44lo3qpTZ90iq
 xpeUTNHv/YOhAYJ+eXbGfjoJsxQqRLECkWyJwQAQl227yRsqWzAR5twRhBrLi9Gf
 hd6d+ZQuTbEQo3oa7bNA2Q+EUevn7gEiNEBAz6L+zz0DWiVrd+XEk4N+37MR7UKr
 6og/p3lI6AyjFG3dqUGBB2uUVfCGzdCXi6F01reZm3q7aPUdO+PuP7MnYjpJ5j4n
 Ph3qN5iZ+bF24wXtZEGs+NDvaNXsfk5RoPxjc62DeYRG7WfH83KZCyrQju6vuCsd
 CFirCf/97MK/LdDaj46nOi37vNQGap4EibmJTI9hMRh2x2RRlxTVdOv+j/lkQAEr
 GgNwPMZO1yp2tJKQ5DJEgaXgQyOfEpWAtG2qbVCXHUc6lzsN2HQTpIDSbXsZdpfK
 IuCLtmaR20tfUoRQJYCryb2hww2+6Z5j6W+CDdZpCfkqmQnsC0duoebru1g32vc0
 20PrVE/xMMtw+I1CBTDLWFDLs/M8sg0AbBicoHFXh1Ea8n9EC3b/aczPk0ff0b9g
 x2BcDBaoCyslE7pSpeCwemCrACtreXu7Ttzb5CgAIQAuBcZCvKAFGC80KGOt8Tbh
 M0bQYDkeouM=
 =sfMw
 -----END PGP SIGNATURE-----

Merge tag 'vfio-v6.18-rc4' of https://github.com/awilliam/linux-vfio

Pull VFIO fixes from Alex Williamson:

 - Fix overflows in vfio type1 backend for mappings at the end of the
   64-bit address space, resulting in leaked pinned memory.

   New selftest support included to avoid such issues in the future
   (Alex Mastro)

* tag 'vfio-v6.18-rc4' of https://github.com/awilliam/linux-vfio:
  vfio: selftests: add end of address space DMA map/unmap tests
  vfio: selftests: update DMA map/unmap helpers to support more test kinds
  vfio/type1: handle DMA map/unmap up to the addressable limit
  vfio/type1: move iova increment to unmap_unpin_*() caller
  vfio/type1: sanitize for overflow using check_*_overflow()
2025-10-31 14:20:09 -07:00
Simona Vetter
f67d54e96b amd-drm-next-6.19-2025-10-29:
amdgpu:
 - VPE idle handler fix
 - Re-enable DM idle optimizations
 - DCN3.0 fix
 - SMU fix
 - Powerplay fixes for fiji/iceland
 - License copy-pasta fixes
 - HDP eDP panel fix
 - Vblank fix
 - RAS fixes
 - SR-IOV updates
 - SMU 13 VCN reset fix
 - DMUB fixes
 - DC frame limit fix
 - Additional DC underflow logging
 - DCN 3.1.5 fixes
 - DC Analog encoders support
 - Enable DC on bonaire by default
 - UserQ fixes
 - Remove redundant pm_runtime_mark_last_busy() calls
 
 amdkfd:
 - Process cleanup fix
 - Misc fixes
 
 radeon:
 - devm migration fixes
 - Remove redundant pm_runtime_mark_last_busy() calls
 
 UAPI
 - Add ABM KMS property
   Proposed kwin changes: https://invent.kde.org/plasma/kwin/-/merge_requests/6028
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQgO5Idg2tXNTSZAr293/aFa7yZ2AUCaQJ+0gAKCRC93/aFa7yZ
 2Nk+AQCHTFT+1Tnte1dV3BhmHKtChER0EmSmcct/fPYthfUmwwD/SjWpFlyaUCeq
 OQzJtocc6Af4DAXS+xDPpkiFO6tjRwU=
 =8VBA
 -----END PGP SIGNATURE-----

Merge tag 'amd-drm-next-6.19-2025-10-29' of https://gitlab.freedesktop.org/agd5f/linux into drm-next

amd-drm-next-6.19-2025-10-29:

amdgpu:
- VPE idle handler fix
- Re-enable DM idle optimizations
- DCN3.0 fix
- SMU fix
- Powerplay fixes for fiji/iceland
- License copy-pasta fixes
- HDP eDP panel fix
- Vblank fix
- RAS fixes
- SR-IOV updates
- SMU 13 VCN reset fix
- DMUB fixes
- DC frame limit fix
- Additional DC underflow logging
- DCN 3.1.5 fixes
- DC Analog encoders support
- Enable DC on bonaire by default
- UserQ fixes
- Remove redundant pm_runtime_mark_last_busy() calls

amdkfd:
- Process cleanup fix
- Misc fixes

radeon:
- devm migration fixes
- Remove redundant pm_runtime_mark_last_busy() calls

UAPI
- Add ABM KMS property
  Proposed kwin changes: https://invent.kde.org/plasma/kwin/-/merge_requests/6028

Signed-off-by: Simona Vetter <simona.vetter@ffwll.ch>
From: Alex Deucher <alexander.deucher@amd.com>
Link: https://patch.msgid.link/20251029205713.9480-1-alexander.deucher@amd.com
2025-10-31 22:08:24 +01:00
Sukrut Heroorkar
de90521604 gfs2: document ip in __gfs2_holder_init kernel-doc comment
Building with W=1 reports:
Warning: fs/gfs2/glock.c:1248 function parameter 'ip' not described
in '__gfs2_holder_init'

The ip parameter was added when __gfs2_holder_init started saving the
gfs2_glock_nq_init caller's return address to gh_ip. This makes it
easier to backtrack which holder took the lock. Document @ip to silence
this warning.

Fixes: b016d9a84a ("gfs2: Save ip from gfs2_glock_nq_init")
Signed-off-by: Sukrut Heroorkar <hsukrut3@gmail.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2025-10-31 21:04:17 +00:00
Bagas Sanjaya
620fc27ef6 Documentation: gfs2: Consolidate GFS2 docs into its own subdirectory
Documentation for GFS2 is scattered in three docs that are in
Documentation/filesystems/ directory. As these docs are standing out as
a group, move them into separate gfs2/ subdirectory.

Reviewed-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2025-10-31 21:00:43 +00:00
Utkarsh Singh
02c03021e2 gfs2/sysfs: Replace sprintf/snprintf with sysfs_emit
Documentation/filesystems/sysfs.rst mentions that show() should only
use sysfs_emit() or sysfs_emit_at() when formatting values returned
to user space. This patch updates the GFS2 sysfs interface accordingly.

It replaces uses of sprintf() and snprintf() in all *_show() functions
with sysfs_emit() to align with current kernel sysfs API best practices.
It also updates the TUNE_ATTR_2 macro to use sysfs_emit() instead of
snprintf().

Signed-off-by: Utkarsh Singh <utkarsh.singh.em@gmail.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2025-10-31 21:00:42 +00:00
Ilpo Järvinen
437aa64c8e PCI: Do not size non-existing prefetchable window
pbus_size_mem() should only be called for bridge windows that exist but
__pci_bus_size_bridges() may point 'pref' to a resource that does not exist
(has zero flags) in case of non-root buses.

When prefetchable bridge window does not exist, the same non-prefetchable
bridge window is sized more than once which may result in duplicating
entries into the realloc_head list. Duplicated entries are shown in this
log and trigger a WARN_ON() because realloc_head had residual entries after
the resource assignment algorithm:

  pci 0000:00:03.0: [11ab:6820] type 01 class 0x060400 PCIe Root Port
  pci 0000:00:03.0: PCI bridge to [bus 00]
  pci 0000:00:03.0:   bridge window [io  0x0000-0x0fff]
  pci 0000:00:03.0:   bridge window [mem 0x00000000-0x000fffff]
  pci 0000:00:03.0: bridge window [mem 0x00200000-0x003fffff] to [bus 02] add_size 200000 add_align 200000
  pci 0000:00:03.0: bridge window [mem 0x00200000-0x003fffff] to [bus 02] add_size 200000 add_align 200000
  pci 0000:00:03.0: bridge window [mem 0xe0000000-0xe03fffff]: assigned
  pci 0000:00:03.0: PCI bridge to [bus 02]
  pci 0000:00:03.0:   bridge window [mem 0xe0000000-0xe03fffff]
  ------------[ cut here ]------------
  WARNING: CPU: 0 PID: 1 at drivers/pci/setup-bus.c:2373 pci_assign_unassigned_root_bus_resources+0x1bc/0x234

Check resource flags of 'pref' and only size the prefetchable window if the
resource has the IORESOURCE_PREFETCH flag.

Fixes: ae88d0b9c5 ("PCI: Use pbus_select_window_for_type() during mem window sizing")
Reported-by: Klaus Kudielka <klaus.kudielka@gmail.com>
Closes: https://lore.kernel.org/r/51e8cf1c62b8318882257d6b5a9de7fdaaecc343.camel@gmail.com/
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Klaus Kudielka <klaus.kudielka@gmail.com>
Link: https://patch.msgid.link/20251027132423.8841-1-ilpo.jarvinen@linux.intel.com
2025-10-31 15:07:21 -05:00
Bjorn Helgaas
057f1652fe Revert "PCI: qcom: Remove custom ASPM enablement code"
This reverts commit a729c16646.

Prior to a729c16646 ("PCI: qcom: Remove custom ASPM enablement code"),
the qcom controller driver enabled ASPM, including L0s, L1, and L1 PM
Substates, for all devices powered on at the time the controller driver
enumerates them.

ASPM was *not* enabled for devices powered on later by pwrctrl (unless the
kernel was built with PCIEASPM_POWERSAVE or PCIEASPM_POWER_SUPERSAVE, or
the user enabled ASPM via module parameter or sysfs).

After f3ac2ff148 ("PCI/ASPM: Enable all ClockPM and ASPM states for
devicetree platforms"), the PCI core enabled all ASPM states for all
devices whether powered on initially or by pwrctrl, so a729c16646 was
unnecessary and reverted.

But f3ac2ff148 was too aggressive and broke platforms that didn't support
CLKREQ# or required device-specific configuration for L1 Substates, so
df5192d9bb ("PCI/ASPM: Enable only L0s and L1 for devicetree platforms")
enabled only L0s and L1.

On Qualcomm platforms, this left L1 Substates disabled, which was a
regression.  Revert a729c16646 so L1 Substates will be enabled on devices
that are initially powered on.  Devices powered on by pwrctrl will be
addressed later.

Fixes: df5192d9bb ("PCI/ASPM: Enable only L0s and L1 for devicetree platforms")
Reported-by: Johan Hovold <johan@kernel.org>
Closes: https://lore.kernel.org/lkml/aPuXZlaawFmmsLmX@hovoldconsulting.com/
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/20251024210514.1365996-1-helgaas@kernel.org
2025-10-31 15:04:19 -05:00
Linus Torvalds
a5beb58e53 block-6.18-20251031
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmkE0BoQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpvHID/0bh5wEXK/IFMIDdiyqdbr2GsoMfHxiM2k0
 OSeQdwMgEGPY2frB8SirTBZWPIskOFdgSbRQyuYiu5XpdbsRJY+JdtkaGYp1L+Fc
 4I4C1ZpK4Kdlw+nbBrcUxdedYKx4ZN/00otZWV2K2ZpJFn1ZCLhyInZZ8ZbosKEn
 HeAW54YLu+q3pO9BSbJBO97FP38AZAOqkT9suUDkQYUUnNivejFKV0qbKlRm5v4H
 fQLU2sfT1J78DHdhJ1Gdk+uNKzVuYxR7lJRC+1c0yi2fZN3VGNRYlTk1f4VX3mOn
 RcRaUr4r9LMZc9K2IYEpQgAyuznttokWI0SkklFVTFDZwa1KmsIZjEccNXvESDXN
 vSxUXuZtgePo2qijK0F8VoPqgQRLBoP5MeAfp+VlkUWAu49zljwrIZXuZl0xuHpT
 JIEzbzvk+KfPS/gKtQdWxuN3eqZvv596SxnWnzGMg17zmhsj2kEZ9BF4Q+9BNVMZ
 NdK0jmdsBA3iTI8xVy2ajEY6U2W3KDdkSKPWR2SDg+vBd/qu3VBmrC9ptr1AoYpO
 54UOyBtIAumMyaOAUDSGiKC4KSbgMWUhN2uBFC8uWvuh733Z333xb9BnY1T7D624
 cfacmSzkoXKUACmcLaod2+MDJlSXhxmOtVN65euxst8ZGQsSah1TpY4Tr/2UHKnO
 ru+vbsqJyQ==
 =rC6y
 -----END PGP SIGNATURE-----

Merge tag 'block-6.18-20251031' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull block fixes from Jens Axboe:

 - Fix blk-crypto reporting EIO when EINVAL is the correct error code

 - Two bug fixes for the block zone support

 - NVME pull request via Keith:
      - Target side authentication fixup
      - Peer-to-peer metadata fixup

 - null_blk DMA alignment fix

* tag 'block-6.18-20251031' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  null_blk: set dma alignment to logical block size
  blk-crypto: use BLK_STS_INVAL for alignment errors
  block: make REQ_OP_ZONE_OPEN a write operation
  block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL
  nvme-pci: use blk_map_iter for p2p metadata
  nvmet-auth: update sc_c in host response
2025-10-31 12:57:19 -07:00
Linus Torvalds
b4f7f01ea1 s390 fixes for 6.18-rc4
- Use correct locking in zPCI event code to avoid deadlock
 
 - Get rid of irqs_registered flag in zpci_dev structure and restore IRQ
   unconditionally for zPCI devices. This fixes sit uations where the flag
   was not correctly updated
 
 - Fix potential memory leak kernel page table dumper code
 
 - Disable (revert) ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP for s390 again. The
   optimized hugetlb vmemmap code modifies kernel page tables in a way which
   does not work on s390 and leads to reproducible kernel crashes due to
   stale TLB entries. This needs to be addressed with some larger changes.
   For now simply disable the feature
 
 - Update defconfigs
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEECMNfWEw3SLnmiLkZIg7DeRspbsIFAmkE6BMACgkQIg7DeRsp
 bsJ0JQ//WKvaB3P3ftEwO5q7TdUSpMxHMOkwIp1eCkc90ex4H71tiJMcbmq6dJyO
 SZBZZZ56+uCddKX9dGTWOxsQZGUSpCK8ln5g9MU/hL4tb1UYrpwN5iJa5WF5lpnO
 EjmLemMVa9ONV2wRf44vkd5ZEoIQv405QHIDOV1NT2xeLePldYo7QibH4SBK2NMp
 VkQ69EMNNWLxGyu/GbnWtSgpZN7g35ZkFWoj3RWuMvDbEPp8M/QlhCqA7ONeCLHB
 +G7at4+xO0XdyeI6EKaECFYCGEA/DiYnF+1ASYNnonLuuOZTLVkQBQ2QC/H05hvK
 0bWKuLSJo1fJqASKDSGpVhNalvmXmbD91R1BJa4DzTKQy0OLsJmbQGr/n84GZ7aE
 znz0WDGxLXG4YaIZkPh68pZhMIz6+D7McDt+zcit3nRQjD8P+05e6UC+GqvDmniw
 xSvglMZzWo7et9mhOwlLsU+BzSg9leYb2fAF8htpdPqw1nmRDZYwZBw4Nw2M/Bog
 YVBDHTCnh03F/nsbb/MwavEZb0disTYNFY7/i0Say3Le676za1hQ2VwEwIprL4/l
 W0Ir3Zh+duS0dcewd0z4wASKht6Sxn/S4VGKna91V3LD2lzAJk+MRKITJiWf3cLV
 amHcaw1+hMdeAoyI1NUFmk63Eme80BkUB0iqDugd9GP3z20njiA=
 =nKcN
 -----END PGP SIGNATURE-----

Merge tag 's390-6.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux

Pull s390 fixes from Heiko Carstens:

 - Use correct locking in zPCI event code to avoid deadlock

 - Get rid of irqs_registered flag in zpci_dev structure and restore IRQ
   unconditionally for zPCI devices. This fixes sit uations where the
   flag was not correctly updated

 - Fix potential memory leak kernel page table dumper code

 - Disable (revert) ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP for s390 again.

   The optimized hugetlb vmemmap code modifies kernel page tables in a
   way which does not work on s390 and leads to reproducible kernel
   crashes due to stale TLB entries. This needs to be addressed with
   some larger changes. For now simply disable the feature

 - Update defconfigs

* tag 's390-6.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP
  s390/mm: Fix memory leak in add_marker() when kvrealloc() fails
  s390/pci: Restore IRQ unconditionally for the zPCI device
  s390: Update defconfigs
  s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump
2025-10-31 12:50:35 -07:00
Ian Rogers
01bc5d2f0d perf tools: Cache counter names for raw samples on s390
Searching all event names is slower now that legacy names are
included. Add a cache to avoid long iterative searches. Note, the
cache isn't cleaned up and is as such a memory leak, however, globally
reachable leaks like this aren't treated as leaks by leak sanitizer.

Reported-by: Thomas Richter <tmricht@linux.ibm.com>
Closes: https://lore.kernel.org/linux-perf-users/09943f4f-516c-4b93-877c-e4a64ed61d38@linux.ibm.com/
Signed-off-by: Ian Rogers <irogers@google.com>
Tested-by: Thomas Richter <tmricht@linux.ibm.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2025-10-31 12:46:19 -07:00
Jakub Kicinski
284987ab6c bluetooth pull request for net:
- btrtl: Fix memory leak in rtlbt_parse_firmware_v2()
  - MGMT: Fix OOB access in parse_adv_monitor_pattern()
  - hci_event: validate skb length for unknown CC opcode
 -----BEGIN PGP SIGNATURE-----
 
 iQJNBAABCgA3FiEE7E6oRXp8w05ovYr/9JCA4xAyCykFAmkE7S4ZHGx1aXoudm9u
 LmRlbnR6QGludGVsLmNvbQAKCRD0kIDjEDILKYSVD/0a4pWtXaDvUPjss1Y4nW06
 yjw1JOnD4alZRlUhueAxv+BHekhLV9ZhQ5h13+ceF2x7rX0+/7aZ8PXvTe9Iy9ta
 aV/GUVoT/D4yeZcsJnbFjriA8OI7E+bnLK2WhaTBVbnZhNYPJFyEyJkAC3oP5nab
 FmDgHDqX0Mu1ifLmimSgpneSmC9SpKV8zMqS44NXzlHvtD7WUaIXvO/13Zh/cKaJ
 /XoRTADvxLXgPSMuRqjtyCHMdzf5IAYvbiVynQlmkqoeKZHUPkcCltpYiPJz9Qrn
 +iRKsbEzwO5PU0fJZYE1mrhsogEvzUY/R7a1GSZZzl8FMKfS7YSynGFlw/biiryu
 sY/eOKh1MHriBdSdD4eE8NPglYHcBKzEzb4td80UtL5M80QDiOkru4t5qDLnM73R
 xEj5WNvryMcAz+wnBSmyb8zS8VEmFQRORfftAbQNEObMLwgQpPQlqhLMjCIRG0o3
 2+VLeszeLBuE84lZOMIC5CYvmkaZKbKDd2Ef8mo2tBqq7MEM8VMwe4UmnswAfumI
 B0VzIo7qNNVgNwjxJ09MDX/IRfGpzug1D9jujb6vfzS0IOJ4UpV1HeI2DsnY/eor
 aJbg9sN0qchDn+cKz0lx4U2I1Kp10Eoz730vg5/cRorYBVqhMYs4M8vaeC9pcojb
 rvvs7RN2y8En1Ujsnf4YNg==
 =5z+f
 -----END PGP SIGNATURE-----

Merge tag 'for-net-2025-10-31' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth

Luiz Augusto von Dentz says:

====================
bluetooth pull request for net:

 - btrtl: Fix memory leak in rtlbt_parse_firmware_v2()
 - MGMT: Fix OOB access in parse_adv_monitor_pattern()
 - hci_event: validate skb length for unknown CC opcode

* tag 'for-net-2025-10-31' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:
  Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()
  Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2()
  Bluetooth: hci_event: validate skb length for unknown CC opcode
====================

Link: https://patch.msgid.link/20251031170959.590470-1-luiz.dentz@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-31 12:33:08 -07:00
Jakub Kicinski
b7904323e7 Couple of new fixes:
- ath10k: revert a patch that had caused issues on some devices
  - cfg80211/mac80211: use hrtimers for some things where the
                       precise timing matters
  - zd1211rw: fix a long-standing potential leak
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEpeA8sTs3M8SN2hR410qiO8sPaAAFAmkDQiwACgkQ10qiO8sP
 aAD8mg//RrRLyJIrVzC/c5TtiVT/ziwyMPMe6l6aRBSN+H/15hX+QfsDt29x+BgX
 CyN9io7Tix3Szshos3XPSrWjKrRy2JYDDGQbVW1npxzAs/E4O5rhETm3SWymHkJh
 geF3W9NDbF7OQIzm6jBp7/i5Im97LU7Y6c9Pd6FxPucKBvFahvxqyDvrD2MAa6/j
 RDr9de7l7X02xymU8Z2h4qNjXQ1fbLWio1UMr+xPxPvPmXsR4aYfGb3xESryHS1y
 a2Xnui1Apzv0Bxf0j0CrsqPoZmSSMhhfB5NMclTsZluPZySRmFygoPt5fjoeaw/Q
 8Ga4nkzUW2ZMZ9CJiB8qFX8dSQ+k658AyVY0XAQkZFey4e0kPwwOG/f1xBoAeIW5
 VcvLbxIZ2Ao3K2qAg5f2bfPyjcp1t+I4iFb/WKzTzX5EcuHcxB5IfoqYfIAkLfgP
 ada9iCJzrVv0+aBCbpKvDm+BAnV/H1sQVRtPQKH09+P8Dylj/klVRYemBMzG9zH2
 zSrkllJrESKUI7Y0fDszt4G9HmWuX9+y5eKhHrLwYkUutqIJsdkW9hbe+EQGUIke
 bOL5nH5hhQDaOa5hpoTQRUKYZb+4tbttKCa9Bii+1M1NgPlQq22Ud4wBdGWqvfqF
 dFHx7vmbVAqrTl8RzXtpLj/UVbgVNhGJAIbD6IAc3DyZC4BvZJs=
 =3oN9
 -----END PGP SIGNATURE-----

Merge tag 'wireless-2025-10-30' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless

Johannes Berg says:

====================
Couple of new fixes:

 - ath10k: revert a patch that had caused issues on some devices
 - cfg80211/mac80211: use hrtimers for some things where the
                      precise timing matters
 - zd1211rw: fix a long-standing potential leak

* tag 'wireless-2025-10-30' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:
  wifi: zd1211rw: fix potential memory leak in __zd_usb_enable_rx()
  wifi: mac80211: use wiphy_hrtimer_work for csa.switch_work
  wifi: mac80211: use wiphy_hrtimer_work for ml_reconf_work
  wifi: mac80211: use wiphy_hrtimer_work for ttlm_work
  wifi: cfg80211: add an hrtimer based delayed work item
  Revert "wifi: ath10k: avoid unnecessary wait for service ready message"
====================

Link: https://patch.msgid.link/20251030104919.12871-3-johannes@sipsolutions.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-10-31 12:30:33 -07:00
Namhyung Kim
915c31f0e6 perf trace: Increase syscall handler map size to 1024
The syscalls_sys_{enter,exit} map in augmented_raw_syscalls.bpf.c has
max entries of 512.  Usually syscall numbers are smaller than this but
x86 has x32 ABI where syscalls start from 512.

That makes trace__init_syscalls_bpf_prog_array_maps() fail in the middle
of the loop when it accesses those keys.  As the loop iteration is not
ordered by syscall numbers anymore, the failure can affect non-x32
syscalls.

Let's increase the map size to 1024 so that it can handle those ABIs
too.  While most systems won't need this, increasing the size will be
safer for potential future changes.

Reviewed-by: Howard Chu <howardchu95@gmail.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2025-10-31 12:29:44 -07:00
Chu Guangqing
0d1e63183d perf vendor events AmpereOneX: Fix spelling typo in the metrics file
The json file incorrectly used "acceses" instead of "accesses".

Signed-off-by: Chu Guangqing <chuguangqing@inspur.com>
Reviewed-by: James Clark <james.clark@linaro.org>
Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2025-10-31 12:28:17 -07:00
Chu Guangqing
1d7f783809 perf vendor events arm64: Fix typo in Ampere eMag json file
Correct instruction spelling errors.

Signed-off-by: Chu Guangqing <chuguangqing@inspur.com>
Reviewed-by: James Clark <james.clark@linaro.org>
Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2025-10-31 12:27:56 -07:00
Michal Wajdeczko
6b514ed2d9 drm/xe/pf: Add documentation for sriov_admin attributes
Add initial documentation for all recently added Xe driver
specific SR-IOV sysfs files located under device/sriov_admin.

Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Cc: Lucas De Marchi <lucas.demarchi@intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
Link: https://patch.msgid.link/20251030222348.186658-18-michal.wajdeczko@intel.com
2025-10-31 20:01:52 +01:00
Michal Wajdeczko
79e419c9d1 drm/xe/pf: Allow to stop the VF using sysfs
It is expected that VFs activity will be monitored and in some
cases admin might want to silence specific VF without killing
the VM where it was attached.

Add write-only attribute to stop GuC scheduling at VFs level.

  /sys/bus/pci/drivers/xe/BDF/
  ├── sriov_admin/
      ├── vf1/
      │   └── stop		[WO] bool
      ├── vf2/
      │   └── stop		[WO] bool

Writing "1" or "y" (or whatever is recognized by the strtobool()
function) to this file will trigger the change of the VF state
to STOP (GuC will stop servicing the VF). To go back to a READY
state (to allow GuC to service this VF again) the VF FLR must be
triggered (which can be done by writing 1 to device/reset file).

Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Cc: Lucas De Marchi <lucas.demarchi@intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Reviewed-by: Piotr Piórkowski <piotr.piorkowski@intel.com>
Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
Link: https://patch.msgid.link/20251030222348.186658-17-michal.wajdeczko@intel.com
2025-10-31 20:01:51 +01:00
Michal Wajdeczko
17899358f6 drm/xe/pf: Add sysfs device symlinks to enabled VFs
For convenience, for every enabled VF add 'device' symlink from
our SR-IOV admin VF folder to enabled sysfs PCI VF device entry.
Remove all those links when disabling PCI VFs.

For completeness, add static 'device' symlink for the PF itself.

  /sys/bus/pci/drivers/xe/BDF/sriov_admin/
  ├── pf
  │   └── device -> ../../../BDF	# PF BDF
  ├── vf1
  │   └── device -> ../../../BDF'	# VF1 BDF
  ├── vf2
  │   └── device -> ../../../BDF"	# VF2 BDF

Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Cc: Lucas De Marchi <lucas.demarchi@intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Acked-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
Link: https://patch.msgid.link/20251030222348.186658-16-michal.wajdeczko@intel.com
2025-10-31 20:01:49 +01:00
Michal Wajdeczko
ae16f18a36 drm/xe/pf: Promote xe_pci_sriov_get_vf_pdev
In the upcoming patch we would like to use this private helper
during preparation of the sysfs links. Promote it.

Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Reviewed-by: Piotr Piórkowski <piotr.piorkowski@intel.com>
Link: https://patch.msgid.link/20251030222348.186658-15-michal.wajdeczko@intel.com
2025-10-31 20:01:48 +01:00
Michal Wajdeczko
b5b297b9e7 drm/xe/pf: Allow change PF scheduling priority using sysfs
We have just added bulk change of the scheduling priority for all
VFs and PF, but that only allow to select LOW and NORMAL priority.

Add read-write attribute under PF to allow changing its priority
without impacting other VFs priority settings.

For completeness also add read-only attributes under VFs, to show
currently selected priority levels used by the VFs.

  /sys/bus/pci/drivers/xe/BDF/
  ├── sriov_admin/
      ├── pf/
      │   └── profile
      │       └── sched_priority	[RW] low, normal, high
      ├── vf1/
      │   └── profile
      │       └── sched_priority	[RO] low, normal

Writing "high" to the PF read-write attribute will change PF
priority on all tiles/GTs to HIGH (schedule function in the next
time-slice after current one completes and it has work). Writing
"low" or "normal" to change priority to LOW/NORMAL is supported.

When read, those files will display the current and available
scheduling priorities. The currently active priority level will
be enclosed in square brackets, default output will be like:

 $ grep . -h sriov_admin/{pf,vf1,vf2}/profile/sched_priority
 [low] normal high
 [low] normal
 [low] normal

Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Cc: Lucas De Marchi <lucas.demarchi@intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Acked-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
Link: https://patch.msgid.link/20251030222348.186658-14-michal.wajdeczko@intel.com
2025-10-31 20:01:47 +01:00
Michal Wajdeczko
9f64d21dc3 drm/xe/pf: Allow bulk change all VFs priority using sysfs
It is expected to be a common practice to configure the same level
of scheduling priority across all VFs and PF (at least as starting
point). Due to current GuC FW limitations it is also the only way
to change VFs priority.

Add write-only sysfs attribute that will apply required priority
level to all VFs and PF at once.

  /sys/bus/pci/drivers/xe/BDF/
  ├── sriov_admin/
      ├── .bulk_profile
      │   └── sched_priority		[WO] low, normal

Writing "low" to this write-only attribute will change PF and
VFs scheduling priority on all tiles/GTs to LOW (function will
be scheduled only if it has work submitted). Similarly, writing
"normal" will change functions priority to NORMAL (functions will
be scheduled irrespective of whether there is a work or not).

Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Cc: Lucas De Marchi <lucas.demarchi@intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Acked-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
Link: https://patch.msgid.link/20251030222348.186658-13-michal.wajdeczko@intel.com
2025-10-31 20:01:45 +01:00
Michal Wajdeczko
23ceec1e03 drm/xe/pf: Add functions to provision scheduling priority
We already have function to configure PF (or VF) scheduling priority
on a single GT, but we also need function that will cover all tiles
and GTs.

However, due to the current GuC FW limitation, we can't always rely
on per-GT function as it actually only works for the PF case. The
only way to change VFs scheduling priority is to use 'sched_if_idle'
policy KLV that will change priorities for all VFs (and the PF).

We will use these new functions in the upcoming patches.

Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Reviewed-by: Piotr Piórkowski <piotr.piorkowski@intel.com>
Link: https://patch.msgid.link/20251030222348.186658-12-michal.wajdeczko@intel.com
2025-10-31 20:01:44 +01:00
Michal Wajdeczko
71f5933c4b drm/xe/pf: Allow bulk change all VFs EQ/PT using sysfs
It is expected to be a common practice to configure the same values
of execution quantum and preemption timeout parameters across all VFs.

Add write-only sysfs attributes that will apply required EQ/PT values
globally, without forcing admin to update PF and each VF separately.

  /sys/bus/pci/drivers/xe/BDF/
  ├── sriov_admin/
      ├── .bulk_profile
      │   ├── exec_quantum_ms		[WO] unsigned integer
      │   └── preempt_timeout_us	[WO] unsigned integer

Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Cc: Lucas De Marchi <lucas.demarchi@intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Acked-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
Link: https://patch.msgid.link/20251030222348.186658-11-michal.wajdeczko@intel.com
2025-10-31 20:01:43 +01:00
Michal Wajdeczko
b7a73b5775 drm/xe/pf: Add functions to bulk provision EQ/PT
We already have functions to configure EQ/PT for single VF across
all tiles/GTs. Now add helper functions that will do that for all
VFs (and the PF) at once.

Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
Link: https://patch.msgid.link/20251030222348.186658-10-michal.wajdeczko@intel.com
2025-10-31 20:01:42 +01:00
Michal Wajdeczko
4610da71fc drm/xe/pf: Add functions to bulk configure EQ/PT on GT
We already have functions to bulk configure 'hard' resources like
GGTT, LMEM or GuC context/doorbells IDs. Now add functions for the
'soft' scheduling parameters, as we will need them soon in the
upcoming patches.

Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Reviewed-by: Piotr Piórkowski <piotr.piorkowski@intel.com>
Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
Link: https://patch.msgid.link/20251030222348.186658-9-michal.wajdeczko@intel.com
2025-10-31 20:01:40 +01:00
Michal Wajdeczko
3c54ef9121 drm/xe/pf: Fix signature of internal config helpers
Both pf_get_exec_quantum() and pf_get_preempt_timeout() should
return u32 as this is a type of the underlying data.

Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Reviewed-by: Piotr Piórkowski <piotr.piorkowski@intel.com>
Link: https://patch.msgid.link/20251030222348.186658-8-michal.wajdeczko@intel.com
2025-10-31 20:01:39 +01:00
Michal Wajdeczko
0daf64b6df drm/xe/pf: Relax report helper to accept PF in bulk configs
Our current bulk configuration requests are only about VFs, but
we want to add new functions that will also include PF configs.
Update our bulk report helper to accept also PFID as first VFID.

Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
Link: https://patch.msgid.link/20251030222348.186658-7-michal.wajdeczko@intel.com
2025-10-31 20:01:38 +01:00
Michal Wajdeczko
3f984d706d drm/xe/pf: Allow change PF and VFs EQ/PT using sysfs
On current platforms, in SR-IOV virtualization, the GPU is shared
between VFs on the time-slice basis. The 'execution quantum' (EQ)
and 'preemption timeout' (PT) are two main scheduling parameters
that could be set individually per each VF.

Add EQ/PT read-write attributes for the PF and all VFs.

By exposing those two parameters over sysfs, the admin can change
their default values (infinity) and let the GuC scheduler enforce
that settings.

 /sys/bus/pci/drivers/xe/BDF/
 ├── sriov_admin/
     ├── pf/
     │   └── profile
     │       ├── exec_quantum_ms	[RW] unsigned integer
     │       └── preempt_timeout_us	[RW] unsigned integer
     ├── vf1/
     │   └── profile
     │       ├── exec_quantum_ms	[RW] unsigned integer
     │       └── preempt_timeout_us	[RW] unsigned integer

Writing 0 to these files will set infinity EQ/PT for the VF on all
tiles/GTs. This is a default value. Writing non-zero integers to
these files will change EQ/PT to new value (in their respective
units: msec or usec).

Reading from these files will return EQ/PT as previously set on
all tiles/GTs. In case of inconsistent values detected, due to
errors or low-level configuration done using debugfs, -EUCLEAN
error will be returned.

Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Cc: Lucas De Marchi <lucas.demarchi@intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Acked-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Reviewed-by: Piotr Piórkowski <piotr.piorkowski@intel.com>
Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
Link: https://patch.msgid.link/20251030222348.186658-6-michal.wajdeczko@intel.com
2025-10-31 20:01:37 +01:00
Michal Wajdeczko
83c02a7f4e drm/xe/pf: Add _locked variants of the VF PT config functions
In upcoming patches we will want to configure VF's preemption
timeout (PT) on all GTs under single lock to avoid potential
races due to parallel GT configuration attempts.

Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Cc: Lucas De Marchi <lucas.demarchi@intel.com>
Reviewed-by: Piotr Piórkowski <piotr.piorkowski@intel.com>
Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
Link: https://patch.msgid.link/20251030222348.186658-5-michal.wajdeczko@intel.com
2025-10-31 20:01:35 +01:00
Michal Wajdeczko
5186df42bd drm/xe/pf: Add _locked variants of the VF EQ config functions
In upcoming patches we will want to configure VF's execution
quantum (EQ) on all GTs under single lock to avoid potential
races in parallel GT configuration attempts.

Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Cc: Lucas De Marchi <lucas.demarchi@intel.com>
Reviewed-by: Piotr Piórkowski <piotr.piorkowski@intel.com>
Link: https://patch.msgid.link/20251030222348.186658-4-michal.wajdeczko@intel.com
2025-10-31 20:01:34 +01:00
Michal Wajdeczko
f909179475 drm/xe/pf: Take RPM during calls to SR-IOV attr.store()
We expect that all SR-IOV attr.store() handlers will require active
runtime PM reference. To simplify implementation of those handlers,
take an implicit RPM reference on their behalf. Also wait until PF
completes its restart.

Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
Link: https://patch.msgid.link/20251030222348.186658-3-michal.wajdeczko@intel.com
2025-10-31 20:01:33 +01:00
Michal Wajdeczko
5c170a4d9c drm/xe/pf: Prepare sysfs for SR-IOV admin attributes
We already have some SR-IOV specific knobs exposed as debugfs
files to allow low level tuning of the SR-IOV configurations,
but those files are mainly for the use by the developers and
debugfs might not be available on the production builds.

Start building dedicated sysfs sub-tree under xe device, where
in upcoming patches we will add selected attributes that will
help provision and manage PF and all VFs:

  /sys/bus/pci/drivers/xe/BDF/
  ├── sriov_admin/
      ├── pf/
      ├── vf1/
      ├── vf2/
      :
      └── vfN/

Add all required data types and helper macros that will be used
by upcoming patches to define actual attributes.

Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Cc: Lucas De Marchi <lucas.demarchi@intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Acked-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
Link: https://patch.msgid.link/20251030222348.186658-2-michal.wajdeczko@intel.com
2025-10-31 20:01:30 +01:00
Shuai Xue
163e5f2b96 perf record: skip synthesize event when open evsel failed
When using perf record with the `--overwrite` option, a segmentation fault
occurs if an event fails to open. For example:

  perf record -e cycles-ct -F 1000 -a --overwrite
  Error:
  cycles-ct:H: PMU Hardware doesn't support sampling/overflow-interrupts. Try 'perf stat'
  perf: Segmentation fault
      #0 0x6466b6 in dump_stack debug.c:366
      #1 0x646729 in sighandler_dump_stack debug.c:378
      #2 0x453fd1 in sigsegv_handler builtin-record.c:722
      #3 0x7f8454e65090 in __restore_rt libc-2.32.so[54090]
      #4 0x6c5671 in __perf_event__synthesize_id_index synthetic-events.c:1862
      #5 0x6c5ac0 in perf_event__synthesize_id_index synthetic-events.c:1943
      #6 0x458090 in record__synthesize builtin-record.c:2075
      #7 0x45a85a in __cmd_record builtin-record.c:2888
      #8 0x45deb6 in cmd_record builtin-record.c:4374
      #9 0x4e5e33 in run_builtin perf.c:349
      #10 0x4e60bf in handle_internal_command perf.c:401
      #11 0x4e6215 in run_argv perf.c:448
      #12 0x4e653a in main perf.c:555
      #13 0x7f8454e4fa72 in __libc_start_main libc-2.32.so[3ea72]
      #14 0x43a3ee in _start ??:0

The --overwrite option implies --tail-synthesize, which collects non-sample
events reflecting the system status when recording finishes. However, when
evsel opening fails (e.g., unsupported event 'cycles-ct'), session->evlist
is not initialized and remains NULL. The code unconditionally calls
record__synthesize() in the error path, which iterates through the NULL
evlist pointer and causes a segfault.

To fix it, move the record__synthesize() call inside the error check block, so
it's only called when there was no error during recording, ensuring that evlist
is properly initialized.

Fixes: 4ea648aec0 ("perf record: Add --tail-synthesize option")
Signed-off-by: Shuai Xue <xueshuai@linux.alibaba.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2025-10-31 12:01:02 -07:00
Namhyung Kim
553d18c98a perf lock contention: Load kernel map before lookup
On some machines, it caused troubles when it tried to find kernel
symbols.  I think it's because kernel modules and kallsyms are messed
up during load and split.

Basically we want to make sure the kernel map is loaded and the code has
it in the lock_contention_read().  But recently we added more lookups in
the lock_contention_prepare() which is called before _read().

Also the kernel map (kallsyms) may not be the first one in the group
like on ARM.  Let's use machine__kernel_map() rather than just loading
the first map.

Reviewed-by: Ian Rogers <irogers@google.com>
Fixes: 688d2e8de2 ("perf lock contention: Add -l/--lock-addr option")
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2025-10-31 11:32:51 -07:00
Puranjay Mohan
be708ed300 bpf/arm64: Fix BPF_ST into arena memory
The arm64 JIT supports BPF_ST with BPF_PROBE_MEM32 (arena) by using the
tmp2 register to hold the dst + arena_vm_base value and using tmp2 as the
new dst register. But this is broken because in case is_lsi_offset()
returns false the tmp2 will be clobbered by emit_a64_mov_i(1, tmp2, off,
ctx); and hence the emitted store instruction will be of the form:
	strb    w10, [x11, x11]
Fix this by using the third temporary register to hold the dst +
arena_vm_base.

Fixes: 339af577ec ("bpf: Add arm64 JIT support for PROBE_MEM32 pseudo instructions.")
Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
Link: https://lore.kernel.org/r/20251030121715.55214-1-puranjay@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2025-10-31 11:20:53 -07:00
Yonghong Song
14a7f2392f bpf: Make migrate_disable always inline to avoid partial inlining
The build fails with llvm 21/22:

  $ make LLVM=1 -j
    ...
    LD      vmlinux.o
    GEN     .vmlinux.objs
    ...
    BTF     .tmp_vmlinux1.btf.o
    ...
    AS      .tmp_vmlinux2.kallsyms.o
    LD      vmlinux.unstripped
    BTFIDS  vmlinux.unstripped
  WARN: resolve_btfids: unresolved symbol migrate_enable
  WARN: resolve_btfids: unresolved symbol migrate_disable
  make[2]: *** [vmlinux.unstripped] Error 255
  make[2]: *** Deleting file 'vmlinux.unstripped'
  make[1]: *** [Makefile:1242: vmlinux] Error 2
  make: *** [Makefile:248: __sub-make] Error 2

Two functions with identical names but different addresses are
considered ambiguous and removed by "pahole" from vmlinux BTF.
Later resolve_btfids warns since it cannot find them.

Commit 378b770819 ("sched: Make migrate_{en,dis}able() inline") made
them inlineable in most places, but in vmlinux built with llvm 21 and 22
there are four symbols for migrate_{enable,disable}:
three static functions and one global function.

Fix the issue by marking migrate_{enable,disable} as always inline.
The alternative is to mark them as notrace/nokprobe which is more
drastic. Only bpf programs are prevented from attaching to these
functions. The rest of the tracing shouldn't be affected.

[note: Peter ok-ed the patch, Alexei rewrote commit log]

Fixes: 378b770819 ("sched: Make migrate_{en,dis}able() inline")
Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
Acked-by: Menglong Dong <menglong.dong@linux.dev>
Link: https://lore.kernel.org/r/20251029183646.3811774-1-yonghong.song@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2025-10-31 11:14:54 -07:00
Simona Vetter
41dacb39fe Driver Changes:
- Fix xe_validation_guard() not guarding (Thomas Hellström)
  - Do not wake device during a GT reset (Matthew Brost)
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE6rM8lpABPHM5FqyDm6KlpjDL6lMFAmkDzSsACgkQm6KlpjDL
 6lMSNA/+JoTAHBHlpwbM7XRO3kthFKyfPiqwezp4XJLKCTpO6/g9AZ9klDMJWZB/
 t+yWHlQOHsGCN1CW8ycmpVOsMomYaDAhDbsWPYBWs+0sinG63M25rdydxTbetISV
 eLiiJPz4pLnvDdjZphLxteldAkeEfQU0Ulo/IzUdKGTa46AGqSSizwf0wDwI2WcB
 HEY/TtD5wbAELNsScRHd0sOfr91ZJcgHoi4yVHCEyz0ZXn01xV57cGyt097Q9dyP
 ctxYh5kmcxhgm5JlsQzv+DBtUFG3qyOl3JwH7t898SzgIAjcmLHftUPh1q51NXXW
 dSgZ6SOdSqiZsA/fuaM4niOW/XkYt6JUoHF+HFT/zwXsPB2fevy/PnWqoa/dj69+
 +3s8yrgtqYJwITUHq7zqTbPTLUMmF1J/2pZhOt4ryXNUIzFHIYLaHLAUmIwxvVY5
 4d9V+cIDgjCqHFoXX2e5RyafEv7H5auWDsJXkI+udwzXCknpyxE2GyZtwsc/B4ZK
 wzuBstwJRjtHmfT6dtPs/Fny0Fqlt1qyBlBqEOECNfYAiDD8hswetvSXWlDgwqUB
 9/UKRIf/wtRN3c3MmPmbaRxjXdZvsWNKlvgoA9d/J9Q2K6rZ3x3dTU/nEk+Sgp4E
 +UExaCL1lSAdxOtkq+YJr2jsXdpFfE7qfCT8vYLk0BIuVsoEgl4=
 =7Aac
 -----END PGP SIGNATURE-----

Merge tag 'drm-xe-fixes-2025-10-30' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes

Driver Changes:
 - Fix xe_validation_guard() not guarding (Thomas Hellström)
 - Do not wake device during a GT reset (Matthew Brost)

Signed-off-by: Simona Vetter <simona.vetter@ffwll.ch>
From: Lucas De Marchi <lucas.demarchi@intel.com>
Link: https://patch.msgid.link/o2b3lucyitafbbcd5bewpfqnslavtnnpc6ck4qatnou2wwukix@rz6seyfw75uy
2025-10-31 19:11:16 +01:00
Simona Vetter
b095398586 Short summary of fixes pull:
ast:
 - Preserve correct bits on register I/O
 
 dma-fence:
 - Use correct timeline name
 
 etnaviv:
 - Use correct GPU adress space for flush
 
 imx:
 - parallel-display: Fix bridge handling
 
 nouveau:
 - Fix locking in scheduler
 
 panel:
 - kingdisplay-kd097d04: Disable EOT packet
 - sitronix-st7789v: Use correct SYNC flags
 
 sched:
 - Fix locking to avoid race condition
 - Fix SIGKILL handling
 
 sysfb:
 - Avoid NULL-pointer access
 -----BEGIN PGP SIGNATURE-----
 
 iQFPBAABCgA5FiEEchf7rIzpz2NEoWjlaA3BHVMLeiMFAmkDws4bFIAAAAAABAAO
 bWFudTIsMi41KzEuMTEsMiwyAAoJEGgNwR1TC3ojbRsIAIZfTB5wdbtH8lp5Z+bA
 B+JzT30FM5URllVsmytKRczOb1SfdVRBiFyd0alpws6EEb5ouHpq0ZIRGk3LZsx1
 4542gu4ByVszVu5UiHRTLuc7OcdNU8anndFkERRUd6tZAm3/R4RWsHoREiHRib7/
 6EqTKq+FZjDQ4nw71Fykc/lzpM/XGXdIm2P66cfMJM/jKs0iXLRpOx6QyQyRkllv
 AkbVsHA1MSWnp9KSZzATkDsOviV7+xVQSxg0AqNlrRSxUuy08GqVrwLm/lrBVKNZ
 +YkAQ6mPxGIPgv8gS6Qgoy1B9Aoiw9RqmRnL0fgV86M4n8Dpxaw1u2kLkDmlYHSM
 Ug8=
 =LWM9
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-fixes-2025-10-30' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes

Short summary of fixes pull:

ast:
- Preserve correct bits on register I/O

dma-fence:
- Use correct timeline name

etnaviv:
- Use correct GPU adress space for flush

imx:
- parallel-display: Fix bridge handling

nouveau:
- Fix locking in scheduler

panel:
- kingdisplay-kd097d04: Disable EOT packet
- sitronix-st7789v: Use correct SYNC flags

sched:
- Fix locking to avoid race condition
- Fix SIGKILL handling

sysfb:
- Avoid NULL-pointer access

Signed-off-by: Simona Vetter <simona.vetter@ffwll.ch>
From: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patch.msgid.link/20251030195644.GA188441@localhost.localdomain
2025-10-31 19:10:04 +01:00
Simona Vetter
e28e383da3 - Fix DMC/DC6 asserts on ADL-S (Ville)
-----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEbSBwaO7dZQkcLOKj+mJfZA7rE8oFAmkDbSEACgkQ+mJfZA7r
 E8olxAf/Q1TGkkYSrFHhkczGLcW676ejYHD2j91xD5w0yKlvE9H5rWeKI4MoN0Dq
 /UaAVoRzwpIJC3JueP/xOrC+Lh/llsgq3vgUKLvhzZiX5cK5d2rBtN8Nh6sFwpnR
 m1JkEET/BjKI0eim48StmARrnc/nOPgs5JHsY2LZUADZYY34xH9vOfFQQi3DSWd+
 cSvxao51CIo15mk4hCAAiCjmARjo3TxAYl2nd7/JW9Zs2xduXFPTKtDb8gw1eHl4
 VoiJlk8XxOisbYFY9iD45oLSeb1AiFK8lX3XFWqes/mpvPaUKkSxFWYJsjx+DbOG
 c1cvJnAKBngZFAeMW7kZZJLvhayyTg==
 =EfUS
 -----END PGP SIGNATURE-----

Merge tag 'drm-intel-fixes-2025-10-30' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes

- Fix DMC/DC6 asserts on ADL-S (Ville)

Signed-off-by: Simona Vetter <simona.vetter@ffwll.ch>
From: Rodrigo Vivi <rodrigo.vivi@intel.com>
Link: https://patch.msgid.link/aQNtTV75vPaDhnXh@intel.com
2025-10-31 19:08:36 +01:00
Simona Vetter
3d8d35bf8d Merge tag 'drm-msm-fixes-2025-10-29' of https://gitlab.freedesktop.org/drm/msm into drm-fixes
Fixes for v6.18-rc4

CI
- Disable broken sanity job

GEM
- Fix vm_bind prealloc error path
- Fix dma-buf import free
- Fix last-fence update
- Reject MAP_NULL if PRR is unsupported
- Ensure vm is created in VM_BIND ioctl

GPU
- GMU fw parsing fix

DPU:
- Fixed mode_valid callback
- Fixed planes on DPU 1.x devices.

Signed-off-by: Simona Vetter <simona.vetter@ffwll.ch>
From: Rob Clark <rob.clark@oss.qualcomm.com>
Link: https://patch.msgid.link/CACSVV03kUm1ms7FBg0m9U4ZcyickSWbnayAWqYqs0XH4UjWf+A@mail.gmail.com
2025-10-31 19:07:39 +01:00
Simona Vetter
3a9f6bd54e amd-drm-fixes-6.18-2025-10-29:
amdgpu:
 - VPE idle handler fix
 - Re-enable DM idle optimizations
 - DCN3.0 fix
 - SMU fix
 - Powerplay fixes for fiji/iceland
 - License fixes
 - HDP eDP panel fix
 - Vblank fix
 
 radeon:
 - devm migration fixes
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQgO5Idg2tXNTSZAr293/aFa7yZ2AUCaQJ0lQAKCRC93/aFa7yZ
 2LQlAQDLm1P6mmHebq/02fNwAhN+GDKD2TWFwrcrWwKPq2vkSwD/V3mIVh4P/q2Q
 z8EFZt7AQdeP82ngfN+z0pNdztSpvQ4=
 =IouC
 -----END PGP SIGNATURE-----

Merge tag 'amd-drm-fixes-6.18-2025-10-29' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes

amd-drm-fixes-6.18-2025-10-29:

amdgpu:
- VPE idle handler fix
- Re-enable DM idle optimizations
- DCN3.0 fix
- SMU fix
- Powerplay fixes for fiji/iceland
- License fixes
- HDP eDP panel fix
- Vblank fix

radeon:
- devm migration fixes

Signed-off-by: Simona Vetter <simona.vetter@ffwll.ch>
From: Alex Deucher <alexander.deucher@amd.com>
Link: https://patch.msgid.link/20251029201342.8813-1-alexander.deucher@amd.com
2025-10-31 19:00:01 +01:00
Simona Vetter
dc1af502d5 Merge tag 'drm-intel-gt-next-2025-10-29' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next
Driver Changes:

Fixes/improvements/new stuff:

- Set O_LARGEFILE in __create_shmem() (Taotao Chen)
- Fix incorrect error handling in shmem_pwrite() (Taotao Chen)
- Skip GuC communication warning on reset in progress [guc] (Zhanjun Dong)
- Fix conversion between clock ticks and nanoseconds [guc] (Umesh Nerlige Ramappa)

Miscellaneous:

- Avoid accessing uninitialized context in emit_rpcs_query() [selftests] (Krzysztof Karas)
- Fix typo in comment (I915_EXEC_NO_RELOC) [gem] (Marlon Henrique Sanches)

Backmerges:

- Merge drm/drm-next into drm-intel-gt-next (Joonas Lahtinen)

Signed-off-by: Simona Vetter <simona.vetter@ffwll.ch>
From: Tvrtko Ursulin <tursulin@igalia.com>
Link: https://patch.msgid.link/aQH994lQI_iVPzTI@linux
2025-10-31 18:57:55 +01:00
Simona Vetter
ef54548455 Mediatek DRM Fixes - 20251028
1. Fix device use-after-free on unbind
 -----BEGIN PGP SIGNATURE-----
 
 iQJMBAABCgA2FiEEACwLKSDmq+9RDv5P4cpzo8lZTiQFAmkA3MQYHGNodW5rdWFu
 Zy5odUBrZXJuZWwub3JnAAoJEOHKc6PJWU4kSa8P/R6+lSSH7ARnhhUbK7Iffaht
 q0Drx7hyL2WfRHk/RisJPbRB42SlGlqore7s9BIWNHWQ9L7m8s+Z5oVjwnqNTJ0g
 yzsekndjViSNJTdZtmHQPVNgZhpIuo93eEoSZfByXIeTatTfYN6+5O8zdjSg5Q/u
 VrZWK9z9qGDLR8tzBwCCySvCRn92zQ+gqDQl1D2oa5AW0swWeYyfWMqYDLY/gezi
 6G44pfeevG45hA17XWlw8jtfKUCXF5jIGafK5eVMnWTdwYuDqG6Z5mlxQCJNhiN8
 NcmU2QwSNtNSl0KAKKAYrbbmjGUusTuGUkCuj3pSRucGf1n0Ue4zHZWpo6z5wMBE
 g94YuNLg5Bp50M4a2aJAYYPS2FuLPBMnzqtOiXUFqBFJSj6OxmZLSMB1oulQUZVc
 HBsJrsUOjF8oLsQBOYS2Ac0kFE90uG7YBmfu/65Z4Y8tmPMaxfqIBWNF131PM+Bn
 OiQkp/Twa06890Pn4R+guyK7loaTLUV7MYx0JX/6w1ndDoxKENXWgf47vLD5N42+
 fM2z9UwaEwjFsJGwFqIsc2Fx7PGUPWRH3iyOuHtHau7NXDyo1nHx3pRwNk+3rTB+
 Bh+GDf/NRweuFSJYDu5WMszqCVCqjMZkeozP45Sc4PK6rGK13P+deFh0tvtzuyv7
 Usf78hGdDFCrHHYQ6WHA
 =7uIz
 -----END PGP SIGNATURE-----

Merge tag 'mediatek-drm-fixes-20251028' of https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-fixes

Mediatek DRM Fixes - 20251028

1. Fix device use-after-free on unbind

Signed-off-by: Simona Vetter <simona.vetter@ffwll.ch>
From: Chun-Kuang Hu <chunkuang.hu@kernel.org>
Link: https://patch.msgid.link/20251028151548.3944-1-chunkuang.hu@kernel.org
2025-10-31 18:54:22 +01:00
Simona Vetter
7446fbf002 Merge tag 'drm-misc-next-2025-10-28' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next
drm-misc-next for v6.19-rc1:

UAPI Changes:

Cross-subsystem Changes:
- Update DT bindings for renesas and powervr-rogue.
- Update MAINTAINERS email and add spsc_queue.

Core Changes:
- Allow ttm page protection flags on risc-v.
- Move freeing of drm client memory to driver.

Driver Changes:
- Assorted small fixes and updates to qaic, ivpu, st7571-i2c, gud,
  amdxdna.
- Allow configuration of vkms' display through configfs.
- Add Arm Ethos-U65/U85 accel driver.

Signed-off-by: Simona Vetter <simona.vetter@ffwll.ch>
From: Maarten Lankhorst <dev@lankhorst.se>
Link: https://patch.msgid.link/32b43261-3c99-49d9-92ee-615ada1d01e8@lankhorst.se
2025-10-31 18:47:17 +01:00
Simona Vetter
f53128e376 Driver Changes:
More xe3p support (Harish, Brian, Balasubramani, Matt Roper)
 Make panic support work on VRAM for display (Maarten)
 Fix stolen size check (Shuicheng)
 xe_pci_test update (Gustavo)
 VF migration updates (Tomasz)
 A couple of fixes around allocation and PM references (Matt Brost)
 Migration update for the MEM_COPY instruction (Matt Auld)
 Initial CRI support (Balasubramani, Matt Roper)
 Use SVM range helpers in PT layer (Matt Brost)
 Drop MAX_GT_TYPE_CHARS constant (Matt Roper)
 Fix spelling and typos (Sanjay)
 Fix VF FLR synchronization between all GTs (Michal)
 Add a Workaround (Nitin)
 Access VF's register using dedicated MMIO view (Michal)
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRskUM7w1oG5rx2IZO4FpNVCsYGvwUCaQClhwAKCRC4FpNVCsYG
 v88YAQC7cmRpHNEaTPTSBHAtVzMfEG+4b6JWjXAbuhQzd6MZgwD/SXOO2xSc66ks
 JFHMzpAi/W1d3UVuj/QiN4PL3NTsjQA=
 =L+1S
 -----END PGP SIGNATURE-----

Merge tag 'drm-xe-next-2025-10-28' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next

Driver Changes:
More xe3p support (Harish, Brian, Balasubramani, Matt Roper)
Make panic support work on VRAM for display (Maarten)
Fix stolen size check (Shuicheng)
xe_pci_test update (Gustavo)
VF migration updates (Tomasz)
A couple of fixes around allocation and PM references (Matt Brost)
Migration update for the MEM_COPY instruction (Matt Auld)
Initial CRI support (Balasubramani, Matt Roper)
Use SVM range helpers in PT layer (Matt Brost)
Drop MAX_GT_TYPE_CHARS constant (Matt Roper)
Fix spelling and typos (Sanjay)
Fix VF FLR synchronization between all GTs (Michal)
Add a Workaround (Nitin)
Access VF's register using dedicated MMIO view (Michal)

Signed-off-by: Simona Vetter <simona.vetter@ffwll.ch>
From: Thomas Hellstrom <thomas.hellstrom@linux.intel.com>
Link: https://patch.msgid.link/aQCl9uJxN6CWJ8Vg@fedora
2025-10-31 18:40:54 +01:00
Simona Vetter
119348477d amd-drm-next-6.19-2025-10-24:
amdgpu:
 - HMM cleanup
 - Add new RAS framework
 - DML2.1 updates
 - YCbCr420 fixes
 - DC FP fixes
 - DMUB fixes
 - LTTPR fixes
 - DTBCLK fixes
 - DMU cursor offload handling
 - Userq validation improvements
 - Misc code cleanups
 - Unify shutdown callback handling
 - Suspend improvements
 - Power limit code cleanup
 - Fence cleanup
 - IP Discovery cleanup
 - SR-IOV fixes
 - AUX backlight fixes
 - DCN 3.5 fixes
 - HDMI compliance fixes
 - DCN 4.0.1 cursor updates
 - DCN interrupt fix
 - DC KMS full update improvements
 - Add additional HDCP traces
 - DCN 3.2 fixes
 - DP MST fixes
 - Add support for new SR-IOV mailbox interface
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQgO5Idg2tXNTSZAr293/aFa7yZ2AUCaPu8XgAKCRC93/aFa7yZ
 2Bg0AP9KOKyUnfh9t2bEKj52dZt+Q3KsZtCmop72nZ5EKjqhpQEA8ps/M1dPMg8l
 9H6yFacp8G1CMgWujl3ui+7Z5vuaUwA=
 =CfPH
 -----END PGP SIGNATURE-----

Merge tag 'amd-drm-next-6.19-2025-10-24' of https://gitlab.freedesktop.org/agd5f/linux into drm-next

amd-drm-next-6.19-2025-10-24:

amdgpu:
- HMM cleanup
- Add new RAS framework
- DML2.1 updates
- YCbCr420 fixes
- DC FP fixes
- DMUB fixes
- LTTPR fixes
- DTBCLK fixes
- DMU cursor offload handling
- Userq validation improvements
- Misc code cleanups
- Unify shutdown callback handling
- Suspend improvements
- Power limit code cleanup
- Fence cleanup
- IP Discovery cleanup
- SR-IOV fixes
- AUX backlight fixes
- DCN 3.5 fixes
- HDMI compliance fixes
- DCN 4.0.1 cursor updates
- DCN interrupt fix
- DC KMS full update improvements
- Add additional HDCP traces
- DCN 3.2 fixes
- DP MST fixes
- Add support for new SR-IOV mailbox interface

Signed-off-by: Simona Vetter <simona.vetter@ffwll.ch>
From: Alex Deucher <alexander.deucher@amd.com>
Link: https://lore.kernel.org/r/20251024175249.58099-1-alexander.deucher@amd.com
2025-10-31 18:33:43 +01:00
Ilia Gavrilov
8d59fba493 Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()
In the parse_adv_monitor_pattern() function, the value of
the 'length' variable is currently limited to HCI_MAX_EXT_AD_LENGTH(251).
The size of the 'value' array in the mgmt_adv_pattern structure is 31.
If the value of 'pattern[i].length' is set in the user space
and exceeds 31, the 'patterns[i].value' array can be accessed
out of bound when copied.

Increasing the size of the 'value' array in
the 'mgmt_adv_pattern' structure will break the userspace.
Considering this, and to avoid OOB access revert the limits for 'offset'
and 'length' back to the value of HCI_MAX_AD_LENGTH.

Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with SVACE.

Fixes: db08722fc7 ("Bluetooth: hci_core: Fix missing instances using HCI_MAX_AD_LENGTH")
Cc: stable@vger.kernel.org
Signed-off-by: Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2025-10-31 12:43:05 -04:00
Abdun Nihaal
1c21cf89a6 Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2()
The memory allocated for ptr using kvmalloc() is not freed on the last
error path. Fix that by freeing it on that error path.

Fixes: 9a24ce5e29 ("Bluetooth: btrtl: Firmware format v2 support")
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2025-10-31 12:42:47 -04:00