Commit graph

1,403,262 commits

Author SHA1 Message Date
Nobuhiro Iwamatsu
0aee6faf5b MAINTAINERS: Update Nobuhiro Iwamatsu's email address
The company's email address has been changed, so update my email
address in MAINTAINERS and .mailmap files.

Signed-off-by: Nobuhiro Iwamatsu <nobuhiro.iwamatsu.x90@mail.toshiba>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2025-09-01 10:36:10 +02:00
Arnd Bergmann
2050458610 OP-TEE driver fix for v6.17
Fixing a typo in a function name.
 -----BEGIN PGP SIGNATURE-----
 
 iQJOBAABCgA4FiEE0qerISgy2SKkqO79Wr/6JGat8H4FAmikTOQaHGplbnMud2lr
 bGFuZGVyQGxpbmFyby5vcmcACgkQWr/6JGat8H7DYBAAxaF20ZnzuhpWgp3sDpfB
 KC9IvYCzERhP5gPouVCatPB1jBgOcPqSYyCVft1Y6ZmB8EHxZ0eEwkgb8UJg3o00
 KtYw8kEatOavjTvm9YRjFRTNuGdBvfKpBpfipP1g95uo2n2wDL7c8akQP8YJZQwQ
 oVHtILhNFBg9xPDLB/wme94I42EQdtJHopd+3MYLyraMkjcIJd+8EnBka8Fe+v9U
 d/Y7aJIJcR3+CuyAOLcmlcg+f0hXguJtGB62jhBsNPQIZR1eKuIL3/M3/WZs7lz9
 sPLgZD9QMAixomXerJAX3MOSbvrAzwUHoHPAevCxdxj5U2B1y7JHJ/9t+09XEx6s
 qRvRSR9cUf6IFply06U8/xElpJP+e+FYyD8D8OCkTJdineV8ifOmdO4ctzA0ANti
 9ADstF1coSpRY0Xp5Mo8KBSuW9fNTKditozPXCykQ7T3nMr3ztkWebbyFbcn+omz
 Ok1S+1s5l1vgk2SqJgezsi40peZuFC08wlaKUbGN50f7aWLtMJWIglTGGaA7Vc/2
 mfT7qVwHlc3DXVH7LQmiYqoSg8lE1sH7ORBZf3p5kGNJSD3Cxj6kecsSggK0hzM8
 VioJW/6IG/rQLZtk/PSkG02odrwN7FMFT/uZ7MD7JRDqwxr4twvycrXp07Tct0TA
 FwKm+No0Xr3xhrxqcFKGtpg=
 =dTsR
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmi1WrgACgkQmmx57+YA
 GNmmsg//Wm6kKXMe9tUSDmM3cGmFg4ySBLy1nWCKGWnjxx/gFJ4LBeks47nyRXDv
 5l11uv0vJNtIQH9X5JGBg8AB2PH9hVO60i21dDWkxlJEKp2RAuPVZvFl51Wi39kP
 jcD09SPh+40KWshM2BhK8ntnWnfTZKXBJw0eTMi6CJUKWjbKm01TiqsNKrOJL9gz
 TQcutpKJTfRusTwJwrsNmEMldJQeiWAejtvQMoS0y1aI1AFCL4HLvMU0n3JS03re
 gBOqHdmhkADnrI05ItQ4hwsgO244xA+X/QPwyPRT/N8WOtb+ZR39jnW2HWGVi9w3
 M3LSMLWCtkL82l1s4NjPigBCvOXM3ARDyAqVmhHnq+Zh/EEFR2BBDOSbYKjvJlWJ
 E/4buogg/MSF+bZU8l+n2LvxhGr//SGsg33gQeFxBk62qv5wdL0DA/9FS4vEMfW9
 RQRZUnzIftlDcOc60Z+FcOXIb+FT9mO0k74BQA6Hwv2HTYvFAY4qnrg0CW+tigyl
 YN6pZSpdgVX2H6DqK0DAmqJ0RLgtqFOJ+fobmIfPXhlkKKFRbFX2c61KFuUO9Mx8
 3PNMFMXazqhoD0juFBz0Weprwaz9bwbZm8aEfO/6DdO1zDKu0XXH40Wtec825xzE
 qyLT72eBlYFnuJfXJjv22eaH8hdHK8MmcDYxKEtredVaLTjhpiA=
 =oap8
 -----END PGP SIGNATURE-----

Merge tag 'optee-typo-fix-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into arm/fixes

OP-TEE driver fix for v6.17

Fixing a typo in a function name.

* tag 'optee-typo-fix-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee:
  tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible"

Link: https://lore.kernel.org/r/20250819122917.GB3486750@rayden
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2025-09-01 10:35:03 +02:00
Arnd Bergmann
84bc3c0b58 TEE fixes for v6.17
- Fixing a memory leak in the error path for tee_dyn_shm_alloc_helper()
 - Fixing a NULL pointer dereference in tee_shm_put()
 -----BEGIN PGP SIGNATURE-----
 
 iQJOBAABCgA4FiEE0qerISgy2SKkqO79Wr/6JGat8H4FAmikTdgaHGplbnMud2lr
 bGFuZGVyQGxpbmFyby5vcmcACgkQWr/6JGat8H57khAA4GAWaj/g2Y7rI8JVoKfG
 mtCUOmB4cDechzI/QQwkSLdCgBRo4q3pwpgnSCgYSoPRna8TsFTUdj02QzIWbT3z
 f15hCSOaX5WsgNp9mZc3FiAMwOXlpAXKUREa72MrC8WvTLEmVqpI0JyybDlahjrk
 w2H1X/V94PH+YQnyoSntLOApA+r54RJwtmuOs6PacCapftHROpon4ezyRSbE/FCM
 MkuTQ8CliazFMDr1e7W168iT4RgQo8ST+Umr9DUwC0xfIbIAcMyVScYKFzmKYWke
 iS7p/mB0gsikTydmPgy6Smw3ynCN7bsiZlk/gZkv0zczkG6u3szWwXmhzsuCy/qk
 IyZPANAnlr3lh6bbPHwDBrJsnxshDvMB9ls4NG2vV7iKIv47bDqJEJ9Gp7iDYKGg
 IngHuc0qajmZlaaC5tV6eDy7fxOoUidbGtdRhCmniJl9Rz/IYvxvXmQtYo4t+IKw
 1UE3RAcjHJNqzOhJtjbfK/tDM143dNgSwttbXMuesr3Se647s8VWdrvHwmznpfG+
 yq5CP4oWv5u/sDg38wvPHscyBRkjKVmhnFWsIIFjMBwjwmXCIrgbSAPzCkB7jufx
 D3iy1r4xS4m1hTRBlY96tR0FXvPki4WR3kjogJeonbkpjBDHHTTcQXYUn4teLYmI
 9zQkFWw2GdGTkKP2LCTq9EA=
 =AfU2
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmi1Wp4ACgkQmmx57+YA
 GNmXKg/9H+UYN6h8UBmm1guxYFN695gnwXtmvBN10Y2U4OkwjMX6HgfNKrwXRnw5
 nok/jLGihcRfqm+fMTJUS9PrOj+6cVKtww63DHpd+RX1LjNbbvKr8ErhM7JifNGd
 5hS5MQ48xlmAdloJCTxbV0OjmABD9Ka8CUvdfPuJRaGTqj1kauBHbUWLijmDloLl
 wf1lpkof0zn1Cxgn+A1VQwz+KlIXtCPcFpefZDmi81daOpj53kterI7MdJiTP0rn
 aELO99+QNeiGqFqN3LXSml2qQAzdsrJ/WdIG6IIZlABxo7Vk91nCwLhi3cPwGKQn
 ib0wPdyI4gNK02FgCRuRda0VNlgoBiGTPUYoR/JOHgHGCBatv1H60b1hoPpNSMvx
 aZo/FkqgPWBz3A/p4ASbGaIhIMrR/NFLgkKjQlyp3M2UwlANCZQ59q45kD4hWsz5
 q80IRvGj+mdV2LyZrmY2i9FJyzXMkPM+1allItnCR3ZhkXQuf3r90ltUUh/nMneC
 KIqBDPe+nyY5i9lHh/w/u64iwEhSqtgvIYgwm5BtoeCssNVXoUNbHJ6JZu+BYr0H
 RcTgAHYKIL+aQzRjwfI3GL3M60DvfsrXyGxMdH1XDCa7AAbkRRrJHIoPzmh++h+g
 Tt7+2KIIBC/OJy/a+/A6J1YgTO/LzC94JOivu+9zN0KzCzpmgC4=
 =Lyrr
 -----END PGP SIGNATURE-----

Merge tag 'tee-fixes-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into arm/fixes

TEE fixes for v6.17

- Fixing a memory leak in the error path for tee_dyn_shm_alloc_helper()
- Fixing a NULL pointer dereference in tee_shm_put()

* tag 'tee-fixes-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee:
  tee: fix memory leak in tee_dyn_shm_alloc_helper
  tee: fix NULL pointer dereference in tee_shm_put

Link: https://lore.kernel.org/r/20250819122641.GA3486750@rayden
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2025-09-01 10:34:38 +02:00
Prathamesh Shete
db12ee0872 gpio: tegra186: Add support for Tegra256
Extend the existing Tegra186 GPIO controller driver with support for the
GPIO controller found on Tegra256. While the programming model remains
the same, the number of pins has slightly changed.

Signed-off-by: Prathamesh Shete <pshete@nvidia.com>
Link: https://lore.kernel.org/r/20250823055420.24664-2-pshete@nvidia.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-09-01 10:20:42 +02:00
Prathamesh Shete
eef6dcbc52 dt-bindings: gpio: Add Tegra256 support
Extend the existing Tegra186 GPIO controller device tree bindings with
support for the GPIO controller found on Tegra256. The number of pins is
slightly different, but the programming model remains the same

Add a new header, include/dt-bindings/gpio/tegra256-gpio.h,
that defines port IDs as well as the TEGRA256_MAIN_GPIO() helper,
both of which are used in conjunction to create a unique specifier
for each pin. The OS can reconstruct the port ID and pin from
these values to determine the register region for the corresponding
GPIO. However, the OS does not use the macro definitions in this file.

The symbolic names help associate these GPIO specifiers with the names
used in the technical documentation available for the chip.

Signed-off-by: Prathamesh Shete <pshete@nvidia.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://lore.kernel.org/r/20250823055420.24664-1-pshete@nvidia.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-09-01 10:20:42 +02:00
Miaoqian Lin
5d5f08fd0c xtensa: simdisk: add input size check in proc_write_simdisk
A malicious user could pass an arbitrarily bad value
to memdup_user_nul(), potentially causing kernel crash.

This follows the same pattern as commit ee76746387
("netdevsim: prevent bad user input in nsim_dev_health_break_write()")

Fixes: b6c7e873da ("xtensa: ISS: add host file-based simulated disk")
Fixes: 16e5c1fc36 ("convert a bunch of open-coded instances of memdup_user_nul()")
Cc: stable@vger.kernel.org
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Message-Id: <20250829083015.1992751-1-linmq006@gmail.com>
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
2025-09-01 01:14:45 -07:00
Kienan Stewart
46104a7d3c kbuild: Add missing $(objtree) prefix to powerpc crtsavres.o artifact
In the upstream commit 214c0eea43
("kbuild: add $(objtree)/ prefix to some in-kernel build artifacts")
artifacts required for building out-of-tree kernel modules had
$(objtree) prepended to them to prepare for building in other
directories.

When building external modules for powerpc,
arch/powerpc/lib/crtsavres.o is required for certain
configurations. This artifact is missing the prepended $(objtree).

Fixes: 13b25489b6 ("kbuild: change working directory to external module directory with M=")
Acked-by: Masahiro Yamada <masahiroy@kernel.org>
Reviewed-by: Nicolas Schier <n.schier@avm.de>
Tested-by: Nicolas Schier <n.schier@avm.de>
Signed-off-by: Kienan Stewart <kstewart@efficios.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20250218-buildfix-extmod-powerpc-v2-1-1e78fcf12b56@efficios.com
2025-09-01 13:41:57 +05:30
Ruben Wauters
3d9c9e1da9 powerpc/xmon: replace sizeof calculations with ARRAY_SIZE macro
The calculations for operand/opcode/macro numbers are done in an
identical manner to the already existing ARRAY_SIZE macro in
linux/array_size.h

This patch replaces the sizeof calculations with the macro to make the
code cleaner and more immediately obvious what it is doing.

Signed-off-by: Ruben Wauters <rubenru09@aol.com>
Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20250719225225.2132-2-rubenru09@aol.com
2025-09-01 13:40:46 +05:30
Nam Cao
a39087905a powerpc/powernv/pci: Fix underflow and leak issue
pnv_irq_domain_alloc() allocates interrupts at parent's interrupt
domain. If it fails in the progress, all allocated interrupts are
freed.

The number of successfully allocated interrupts so far is stored
"i". However, "i - 1" interrupts are freed. This is broken:

    - One interrupt is not be freed

    - If "i" is zero, "i - 1" wraps around

Correct the number of freed interrupts to "i".

Fixes: 0fcfe2247e ("powerpc/powernv/pci: Add MSI domains")
Signed-off-by: Nam Cao <namcao@linutronix.de>
Cc: stable@vger.kernel.org
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/70f8debe8688e0b467367db769b71c20146a836d.1754300646.git.namcao@linutronix.de
2025-09-01 13:39:40 +05:30
Nam Cao
3443ff3be6 powerpc/pseries/msi: Fix potential underflow and leak issue
pseries_irq_domain_alloc() allocates interrupts at parent's interrupt
domain. If it fails in the progress, all allocated interrupts are
freed.

The number of successfully allocated interrupts so far is stored
"i". However, "i - 1" interrupts are freed. This is broken:

  - One interrupt is not be freed

  - If "i" is zero, "i - 1" wraps around

Correct the number of freed interrupts to 'i'.

Fixes: a5f3d2c17b ("powerpc/pseries/pci: Add MSI domains")
Signed-off-by: Nam Cao <namcao@linutronix.de>
Cc: stable@vger.kernel.org
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/a980067f2b256bf716b4cd713bc1095966eed8cd.1754300646.git.namcao@linutronix.de
2025-09-01 13:39:39 +05:30
Arnd Bergmann
e6e709901c Qualcomm driver fixes for v6.17-rc1
The recently extended sanity checks for the Qualcomm firmware files
 turned out to be too restrictive, preventing a variety of firmware
 images from being loaded. Adjust the checks to allow section header
 sizes of 0 when sections aren't used.
 -----BEGIN PGP SIGNATURE-----
 
 iQJJBAABCAAzFiEEBd4DzF816k8JZtUlCx85Pw2ZrcUFAmiaBEIVHGFuZGVyc3Nv
 bkBrZXJuZWwub3JnAAoJEAsfOT8Nma3FEzMQAL1fo13UqDYeVOUGZzw0M3nMMYgT
 DRW/GjtklIKHLvwwmTBEhgM3lPoNmpUVqV3hC/mMxQRkGaG+RmiUbD9+IgKqIgyp
 5o6LXmRIvuhIPY+7GA4iXf+VgPTpps1AzdkvXBQgBbJZ6RTzGrB1WGrAf746hprA
 A8RQVfQFM7DHiLNt5dbqrbqdu2/vn9Q5SU3F1MFq22EA9VU6UYHFBZ03Ar+lkpVT
 CHoUhUdV139xvjXNph+pRkS6ykJyCo9RONXG19ssC+LUkg4YevCJV20q/qFWBOrq
 rUpqhQUKWtQNdGWEg8sjvdu1s4/NYIBNFz3V9Ys2OVfg3RqnGOcpZThjbzTuHJV0
 AaCzBmEgGCuHasyzNxhhzVfn7PGJ6Fhb0cOKev1z0ilXMUeTpbW/xQLr8OK6mdwN
 NR4d0P7aDSLzaUEmbm557vz9vkuBaGod2LaKPcXN1trFt/p0Ie467aLeY2gFu4TC
 aNP/bo1z3XdUWrW8noU3zJSVjk45pO/sAik2aaDk/dD6A41UHup/GvuXw59nmFU0
 E/LxRc9Ig8s/kS8wpU1dCCvOrCD72ljU58DUVciIGdxdJpo0VuxaxRBPHoTvDkh9
 ywDlTYPcTJCBOfNNCq7lA8UHRaUJ4XYaOkhV5isjZJDGbNjUOPFBRy4g4e5p3XFl
 GdZB5hA5P4obN33y
 =UVX0
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmi1VI0ACgkQmmx57+YA
 GNmh5Q/+MqfYPlBhnFsyFa/418pcU/C7qnODlWKSw1Q9ia0coRwQofMoo5yeERQc
 3pPY9bnyS+Owfk8n26iMLkNht6IaAYNepfST0nVEklveywszJiz1x1u73+1Ngknd
 ajkgAugH8+iduqbRzIpGodLiwTnGJikfLJ3wgMQ9yyK0SwLIZ3/a8/2P9LWN2+d1
 WLV62XpvP5+1kGeO76gekbnzpU4F9bquaoYSR9pwnQ8AKkZNWOgSWuZWPW4muCpD
 0c6bX9JFHJ2iITPIPlKxMijP9/dHXqO8E8hGCVYqLZOhbBgPwtx77US5c51txOPK
 V6WFduaTjAGNLcJz7WGJuYyBT2Sva037hRo6Z0GTp2jRoNLPkfdJZcJ7GhHO+fjz
 VVckN+51sts6ESAZBEpnQy7C0hIDIwha2vBeKt6nxYCR0DB7dT4ey+FwysuwurBL
 6A1j+1qI7q0JKOA7LQkS6ofHHHbZUuOvgjyUBG3eDkg5BApbcfa3x0rLeq9cZvDr
 xtlFd5P+hctF5qeCQ6VL7MjHG7Yks6pUC2Bwaxm2h2Rbz1NtYkrri/NUk31wnU73
 Nv/RKEMWTZmwBaAV6Whuz7/M9zehGmzDkEJGhv1ikbWC5zm8YUkYwckKShun41bV
 DwB6At01DI7QbTsAS5ZlOKQyS3a7rc0XEyI+bACCp2I0Urnom7k=
 =zaMo
 -----END PGP SIGNATURE-----

Merge tag 'qcom-drivers-fixes-for-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes

Qualcomm driver fixes for v6.17-rc1

The recently extended sanity checks for the Qualcomm firmware files
turned out to be too restrictive, preventing a variety of firmware
images from being loaded. Adjust the checks to allow section header
sizes of 0 when sections aren't used.

* tag 'qcom-drivers-fixes-for-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux:
  soc: qcom: mdt_loader: Deal with zero e_shentsize

Link: https://lore.kernel.org/r/20250811145613.120917-1-andersson@kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2025-09-01 10:08:44 +02:00
Nysal Jan K.A.
4f61d54d22 powerpc/qspinlock: Add spinlock contention tracepoint
Add a lock contention tracepoint in the queued spinlock slowpath.
Also add the __lockfunc annotation so that in_lock_functions()
works as expected.

Signed-off-by: Nysal Jan K.A. <nysal@linux.ibm.com>
Reviewed-by: Shrikanth Hegde <sshegde@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20250731061856.1858898-1-nysal@linux.ibm.com
2025-09-01 13:38:12 +05:30
Thomas Huth
74db6cc331 powerpc: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers
While the GCC and Clang compilers already define __ASSEMBLER__
automatically when compiling assembler code, __ASSEMBLY__ is a
macro that only gets defined by the Makefiles in the kernel.
This is bad since macros starting with two underscores are names
that are reserved by the C language. It can also be very confusing
for the developers when switching between userspace and kernelspace
coding, or when dealing with uapi headers that rather should use
__ASSEMBLER__  instead. So let's standardize now on the __ASSEMBLER__
macro that is provided by the compilers.

This is almost a completely mechanical patch (done with a simple
"sed -i" statement), apart from tweaking two comments manually in
arch/powerpc/include/asm/bug.h and arch/powerpc/include/asm/kasan.h
(which did not have proper underscores at the end) and fixing a
checkpatch error about spaces in arch/powerpc/include/asm/spu_csa.h.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20250801082007.32904-3-thuth@redhat.com
2025-09-01 13:23:29 +05:30
Thomas Huth
8e0665eb85 powerpc: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers
__ASSEMBLY__ is only defined by the Makefile of the kernel, so
this is not really useful for uapi headers (unless the userspace
Makefile defines it, too). Let's switch to __ASSEMBLER__ which
gets set automatically by the compiler when compiling assembler
code.

This is a completely mechanical patch (done with a simple "sed -i"
statement).

Acked-by: Segher Boessenkool <segher@kernel.crashing.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20250801082007.32904-2-thuth@redhat.com
2025-09-01 13:23:29 +05:30
Maxime Ripard
7287177e5a drm/tidss: dispc: Define field masks being used
Now that we have all the accessors taking masks, we can create defines
for them and reuse them as needed.

It makes the driver easier to read, less prone to consistency issues,
and allows to reuse defines when needed.

Signed-off-by: Maxime Ripard <mripard@kernel.org>
Link: https://lore.kernel.org/r/20250827-drm-tidss-field-api-v3-14-7689b664cc63@kernel.org
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-09-01 10:37:20 +03:00
Maxime Ripard
9b74ce7a69 drm/tidss: dispc: Switch OVR_REG_FLD_MOD to using a mask
The OVR_REG_FLD_MOD function takes the start and end bits as parameter
and will generate a mask out of them.

This makes it difficult to share the masks between callers, since we now
need two arguments and to keep them consistent.

Let's change OVR_REG_FLD_MOD to take the mask as an argument instead,
and let the caller create the mask. Eventually, this mask will be moved
to a define.

Signed-off-by: Maxime Ripard <mripard@kernel.org>
Link: https://lore.kernel.org/r/20250827-drm-tidss-field-api-v3-13-7689b664cc63@kernel.org
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-09-01 10:37:19 +03:00
Maxime Ripard
68f7fa2477 drm/tidss: dispc: Switch VP_REG_FLD_MOD to using a mask
The VP_REG_FLD_MOD function takes the start and end bits as parameter
and will generate a mask out of them.

This makes it difficult to share the masks between callers, since we now
need two arguments and to keep them consistent.

Let's change VP_REG_FLD_MOD to take the mask as an argument instead, and
let the caller create the mask. Eventually, this mask will be moved to a
define.

Signed-off-by: Maxime Ripard <mripard@kernel.org>
Link: https://lore.kernel.org/r/20250827-drm-tidss-field-api-v3-12-7689b664cc63@kernel.org
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-09-01 10:37:19 +03:00
Maxime Ripard
b695ff1e7a drm/tidss: dispc: Switch VP_REG_GET to using a mask
The VP_REG_GET function takes the start and end bits as parameter and
will generate a mask out of them.

This makes it difficult to share the masks between callers, since we now
need two arguments and to keep them consistent.

Let's change VP_REG_GET to take the mask as an argument instead, and let
the caller create the mask. Eventually, this mask will be moved to a
define.

Signed-off-by: Maxime Ripard <mripard@kernel.org>
Link: https://lore.kernel.org/r/20250827-drm-tidss-field-api-v3-11-7689b664cc63@kernel.org
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-09-01 10:37:19 +03:00
Maxime Ripard
aeaef1ba6b drm/tidss: dispc: Switch VID_REG_FLD_MOD to using a mask
The VID_REG_FLD_MOD function takes the start and end bits as parameter
and will generate a mask out of them.

This makes it difficult to share the masks between callers, since we now
need two arguments and to keep them consistent.

Let's change VID_REG_FLD_MOD to take the mask as an argument instead,
and let the caller create the mask. Eventually, this mask will be moved
to a define.

Signed-off-by: Maxime Ripard <mripard@kernel.org>
Link: https://lore.kernel.org/r/20250827-drm-tidss-field-api-v3-10-7689b664cc63@kernel.org
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-09-01 10:37:19 +03:00
Maxime Ripard
990e6f28e7 drm/tidss: dispc: Switch VID_REG_GET to using a mask
The VID_REG_GET function takes the start and end bits as parameter and
will generate a mask out of them.

This makes it difficult to share the masks between callers, since we now
need two arguments and to keep them consistent.

Let's change VID_REG_GET to take the mask as an argument instead, and
let the caller create the mask. Eventually, this mask will be moved to a
define.

Signed-off-by: Maxime Ripard <mripard@kernel.org>
Link: https://lore.kernel.org/r/20250827-drm-tidss-field-api-v3-9-7689b664cc63@kernel.org
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-09-01 10:37:19 +03:00
Maxime Ripard
e6b571e6ff drm/tidss: dispc: Switch REG_FLD_MOD to using a mask
The REG_FLD_MOD function takes the start and end bits as parameter and
will generate a mask out of them.

This makes it difficult to share the masks between callers, since we now
need two arguments and to keep them consistent.

Let's change REG_FLD_MOD to take the mask as an argument instead, and
let the caller create the mask. Eventually, this mask will be moved to a
define.

Signed-off-by: Maxime Ripard <mripard@kernel.org>
Link: https://lore.kernel.org/r/20250827-drm-tidss-field-api-v3-8-7689b664cc63@kernel.org
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-09-01 10:37:19 +03:00
Maxime Ripard
8bd839a3ec drm/tidss: dispc: Switch REG_GET to using a mask
The REG_GET function takes the start and end bits as parameter and will
generate a mask out of them.

This makes it difficult to share the masks between callers, since we now
need two arguments and to keep them consistent.

Let's change REG_GET to take the mask as an argument instead, and let
the caller create the mask. Eventually, this mask will be moved to a
define.

Signed-off-by: Maxime Ripard <mripard@kernel.org>
Link: https://lore.kernel.org/r/20250827-drm-tidss-field-api-v3-7-7689b664cc63@kernel.org
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-09-01 10:37:19 +03:00
Maxime Ripard
13925ccb0d drm/tidss: dispc: Get rid of FLD_MOD
The FLD_MOD function is an equivalent to what FIELD_MODIFY + GENMASK
provide, so let's drop it and switch to the latter.

Signed-off-by: Maxime Ripard <mripard@kernel.org>
Link: https://lore.kernel.org/r/20250827-drm-tidss-field-api-v3-6-7689b664cc63@kernel.org
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-09-01 10:37:19 +03:00
Maxime Ripard
6e50765b82 drm/tidss: dispc: Get rid of FLD_GET
The FLD_GET function is an equivalent to what FIELD_GET + GENMASK
provide, so let's drop it and switch to the latter.

Signed-off-by: Maxime Ripard <mripard@kernel.org>
Link: https://lore.kernel.org/r/20250827-drm-tidss-field-api-v3-5-7689b664cc63@kernel.org
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-09-01 10:37:19 +03:00
Maxime Ripard
9accc8b10d drm/tidss: dispc: Get rid of FLD_VAL
The FLD_VAL function is an equivalent to what FIELD_PREP + GENMASK
provide, so let's drop it and switch to the latter.

Signed-off-by: Maxime Ripard <mripard@kernel.org>
Link: https://lore.kernel.org/r/20250827-drm-tidss-field-api-v3-4-7689b664cc63@kernel.org
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-09-01 10:37:19 +03:00
Maxime Ripard
db7c13ebf2 drm/tidss: dispc: Switch to GENMASK instead of FLD_MASK
The dispc FLD_MASK function is an exact equivalent of the GENMASK macro.
Let's convert the dispc driver to the latter.

Signed-off-by: Maxime Ripard <mripard@kernel.org>
Link: https://lore.kernel.org/r/20250827-drm-tidss-field-api-v3-3-7689b664cc63@kernel.org
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-09-01 10:37:19 +03:00
Maxime Ripard
e8e202bcbd drm/tidss: dispc: Convert accessors to macros
The dispc driver uses upper-cased, inlined, functions to provide
macro-like accessors to the dispc registers.

This is confusing, since upper-case is usually used by macros, and that
pattern will create gcc errors later on in this series.

Let's switch to macros to make it more consistent, and prevent those
errors down the line.

Signed-off-by: Maxime Ripard <mripard@kernel.org>
Link: https://lore.kernel.org/r/20250827-drm-tidss-field-api-v3-2-7689b664cc63@kernel.org
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-09-01 10:37:19 +03:00
Maxime Ripard
d42ce9ea57 drm/tidss: dispc: Remove unused OVR_REG_GET
The OVR_REG_GET function in the dispc driver is not used anywhere. Let's
drop it.

Signed-off-by: Maxime Ripard <mripard@kernel.org>
Link: https://lore.kernel.org/r/20250827-drm-tidss-field-api-v3-1-7689b664cc63@kernel.org
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
2025-09-01 10:37:19 +03:00
Sabrina Dubroca
cd8ae32e4e xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
x->id.spi == 0 means "no SPI assigned", but since commit
94f39804d8 ("xfrm: Duplicate SPI Handling"), we now create states
and add them to the byspi list with this value.

__xfrm_state_delete doesn't remove those states from the byspi list,
since they shouldn't be there, and this shows up as a UAF the next
time we go through the byspi list.

Reported-by: syzbot+a25ee9d20d31e483ba7b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a25ee9d20d31e483ba7b
Fixes: 94f39804d8 ("xfrm: Duplicate SPI Handling")
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
2025-09-01 08:56:00 +02:00
Ruben Wauters
73cfd166e0 drm/gud: Replace simple display pipe with DRM atomic helpers
The simple display pipe is obsolete and the atomic helpers allow for
more control over the rendering process. As such, this patch replaces
the old simple display pipe system with the newer atomic helpers.

As the code is mainly the same, merely replaced with the new atomic
system, there should be no change in functionality.

Signed-off-by: Ruben Wauters <rubenru09@aol.com>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://lore.kernel.org/r/20250818193553.2162-1-rubenru09@aol.com
2025-09-01 08:42:51 +02:00
SeonGu Kang
d4ac729964 pinctrl: samsung: Add ARTPEC-8 SoC specific configuration
Add Axis ARTPEC-8 SoC specific configuration data to enable pinctrl.

Signed-off-by: SeonGu Kang <ksk4725@coasia.com>
Signed-off-by: Priyadarsini G <priya.ganesh@samsung.com>
Signed-off-by: Ravi Patel <ravi.patel@samsung.com>
Link: https://lore.kernel.org/r/20250901051926.59970-3-ravi.patel@samsung.com
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
2025-09-01 08:32:02 +02:00
SeonGu Kang
03724b3496 dt-bindings: pinctrl: samsung: Add compatible for ARTPEC-8 SoC
Document the compatible string for ARTPEC-8 SoC pinctrl block,
which is similar to other Samsung SoC pinctrl blocks.

Signed-off-by: SeonGu Kang <ksk4725@coasia.com>
Signed-off-by: Ravi Patel <ravi.patel@samsung.com>
Acked-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://lore.kernel.org/r/20250901051926.59970-2-ravi.patel@samsung.com
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
2025-09-01 08:31:58 +02:00
Dennis Beier
592532a77b cpufreq/longhaul: handle NULL policy in longhaul_exit
longhaul_exit() was calling cpufreq_cpu_get(0) without checking
for a NULL policy pointer. On some systems, this could lead to a
NULL dereference and a kernel warning or panic.

This patch adds a check using unlikely() and returns early if the
policy is NULL.

Bugzilla: #219962

Signed-off-by: Dennis Beier <nanovim@gmail.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
2025-09-01 10:50:28 +05:30
Pierre-Eric Pelloux-Prayer
256576ed68 drm/amdgpu: give each kernel job a unique id
Userspace jobs have drm_file.client_id as a unique identifier
as job's owners. For kernel jobs, we can allocate arbitrary
values - the risk of overlap with userspace ids is small (given
that it's a u64 value).
In the unlikely case the overlap happens, it'll only impact
trace events.

Since this ID is traced in the gpu_scheduler trace events, this
allows to determine the source of each job sent to the hardware.

To make grepping easier, the IDs are defined as they will appear
in the trace output.

Signed-off-by: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com>
Link: https://lore.kernel.org/r/20250604122827.2191-1-pierre-eric.pelloux-prayer@amd.com
2025-09-01 10:49:31 +05:30
Liao Yuanhong
35ded83be0 wifi: rtw89: 8852bt: Remove redundant off_reverse variables
The variable off_reverse and its related code are completely redundant in
the function. Remove them to clean the code.

Signed-off-by: Liao Yuanhong <liaoyuanhong@vivo.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20250828094717.599527-1-liaoyuanhong@vivo.com
2025-09-01 11:41:23 +08:00
Qianfeng Rong
a650d86bca wifi: rtw89: use int type to store negative error codes
The 'ret' variable stores returns from other functions, which return
either zero on success or negative error codes on failure.  Storing
error codes in u32 (an unsigned type) causes no runtime issues but is
stylistically inconsistent and very ugly.  Change 'ret' from u32 to
int - this has no runtime impact.

Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20250827150620.550641-1-rongqianfeng@vivo.com
2025-09-01 11:27:36 +08:00
Ping-Ke Shih
e83a2a996b wifi: rtw89: add getting function of DMA channel v1
The coming RTL8922DE uses new mapping of DMA channel. Add it accordingly.

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20250826085424.28713-1-pkshih@realtek.com
2025-09-01 10:56:30 +08:00
Ping-Ke Shih
571ce803c2 wifi: rtw89: abstract getting function of DMA channel
The mapping function from QSEL (almost equivalent EDCA queue) to PCI DMA
channel. Since coming chips change the definition, abstract this function
as a chip_ops.

Don't change logic at all.

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20250826085339.28512-1-pkshih@realtek.com
2025-09-01 10:55:03 +08:00
Ping-Ke Shih
110f3c11f4 wifi: rtw89: pci: add RPP parser v1
The new format contains more information including TX DMA channel, actual
TX link and etc.

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20250826085332.28463-1-pkshih@realtek.com
2025-09-01 10:54:41 +08:00
Ping-Ke Shih
83d823ab27 wifi: rtw89: pci: abstract RPP parser
RPP is short for release report of payload, which carries information
assisting TX completion. Since coming chips change the format, abstract
the parser ahead.

Don't change logic at all.

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20250826085324.28414-1-pkshih@realtek.com
2025-09-01 10:54:15 +08:00
Ping-Ke Shih
2d75148299 wifi: rtw89: pci: add group BD address design
The newly designed group BD address is to use the same starting DMA address
with offset as below picture:

 Original            DMA memory         Group BD address

 +--------+  (*1)   +---------+   (*2)  +--------+
 |  CH 0 -|-------> |         | <-------|- CH 0  | <-+--+--+--+
 +--------+         |         |         |        |   |  |  |  |
 |  CH 1 -|-------> |         |         |  CH 1 -|---+  |  |  |
 +--------+         |         |         |        |      |  |  |
 |  CH 2 -|-------> |         |         |  CH 2 -|------+  |  |
 +--------+         |         |         |        |         |  |
 |  CH 3 -|-------> |         |         |  CH 3 -|---------+  |
 +--------+         |         |         |        |            |
 |    :  -|-------> |         |         |    :  -|------------+
 +--------+         |         |         +--------+   (*3; offset from CH 0)
 |  CH 8 -|-------> |         | <-------|- CH 8  | <-+
 +--------+         |         |         |        |   | (offset from CH 8)
 |    :  -|-------> |         |         |    :  -|---+
 +--------+         +---------+         +--------+

Compare (*1) and (*2), for original design, each DMA channel has
individual DMA address, so it is not necessary to allocate continual
DMA address across channels. For group BD address, only two DMA address
are set, and each channel set the offset (*3) from base address.

The element number and offset of a channel are encoded rather than a
raw number, so add a function to translate numbers into hardware format.

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20250826085318.28361-1-pkshih@realtek.com
2025-09-01 10:53:51 +08:00
Ping-Ke Shih
a86a0fea19 wifi: rtw89: pci: define TX/RX buffer descriptor pool
Buffer descriptor (BD) is a helper of DMA for each ring. The new hardware
design expects a continual memory across all rings, so allocate a pool
and assign to each ring rather than allocate a buffer for a ring
individually.

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20250826085258.28308-1-pkshih@realtek.com
2025-09-01 10:53:30 +08:00
Ping-Ke Shih
7bd90ec75e wifi: rtw89: pci: add struct rtw89_{tx,rx}_rings to put related fields
The new hardware design will expect a continual memory region across
all rings, so a new field will be added to describe the region. To
help the changes, add struct and make changes ahead.

Don't change logic at all.

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20250826085152.28164-5-pkshih@realtek.com
2025-09-01 10:53:08 +08:00
Ping-Ke Shih
d6303028ae wifi: rtw89: pci: use RDU status of R_BE_PCIE_DMA_IMR_0_V1 instead for 8922DE
The original RDU status of R_BE_HAXI_HIMR00 needs additional IO to get
the status. The new WiFi 7 8922DE add the status to R_BE_PCIE_DMA_IMR_0_V1
which is read already, so we can reduce one reading IO.

After the changes, interrupt behavior of RTL8922DE in low power mode is
the same as normal mode, so remove the configuration function for low
power mode.

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20250826085152.28164-4-pkshih@realtek.com
2025-09-01 10:52:47 +08:00
Ping-Ke Shih
862132fbfc wifi: rtw89: pci: prepare interrupt related registers and functions for 8922DE
The 8922DE is very similar to 8922AE except to RDU (RX desc unavailable)
registers. The following patch will adjust to read this status from
another register to reduce one reading IO, so create a set of functions
ahead.

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20250826085152.28164-3-pkshih@realtek.com
2025-09-01 10:52:25 +08:00
Ping-Ke Shih
5cc73513f9 wifi: rtw89: pci: move chip ISR definition out from chip generation
The existing WiFi 6 chips can share the same ISR (interrupt status
registers), but the coming WiFi 7 chip 8922DE can't share the same
definition with existing WiFi 7 chip, so move the definition to an
individual struct.

Don't change logic at all.

Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20250826085152.28164-2-pkshih@realtek.com
2025-09-01 10:52:00 +08:00
Aleksej Smirnov
f46edd9204 wifi: rtl8xxxu: Remove TL-WN722N V2 (0x2357: 0x010c) from untested devices
This Wi-Fi dongle has been used for many years now and have had no problems
with it. The device is quite old and known, dumping its efuse to the log
and asking the user to send the results to Jes.Sorensen@gmail.com on every
boot makes little sense.

Signed-off-by: Aleksej Smirnov <debugger94@gmail.com>
Reviewed-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/CAAN7eZ7QKEeQgNHEBuZKy4Gqg3oqpGi6BUdOVBOxPN7dedhVJQ@mail.gmail.com
2025-09-01 10:30:31 +08:00
Viacheslav Dubeyko
18b07c44f2 hfs: clear offset and space out of valid records in b-tree node
Currently, hfs_brec_remove() executes moving records
towards the location of deleted record and it updates
offsets of moved records. However, the hfs_brec_remove()
logic ignores the "mess" of b-tree node's free space and
it doesn't touch the offsets out of records number.
Potentially, it could confuse fsck or driver logic or
to be a reason of potential corruption cases.

This patch reworks the logic of hfs_brec_remove()
by means of clearing freed space of b-tree node
after the records moving. And it clear the last
offset that keeping old location of free space
because now the offset before this one is keeping
the actual offset to the free space after the record
deletion.

Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
cc: Yangtao Li <frank.li@vivo.com>
cc: linux-fsdevel@vger.kernel.org
Link: https://lore.kernel.org/r/20250815194918.38165-1-slava@dubeyko.com
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
2025-08-31 18:16:00 -07:00
Viacheslav Dubeyko
a06ec283e1 hfs: add logic of correcting a next unused CNID
The generic/736 xfstest fails for HFS case:

BEGIN TEST default (1 test): hfs Mon May 5 03:18:32 UTC 2025
DEVICE: /dev/vdb
HFS_MKFS_OPTIONS:
MOUNT_OPTIONS: MOUNT_OPTIONS
FSTYP -- hfs
PLATFORM -- Linux/x86_64 kvm-xfstests 6.15.0-rc4-xfstests-g00b827f0cffa #1 SMP PREEMPT_DYNAMIC Fri May 25
MKFS_OPTIONS -- /dev/vdc
MOUNT_OPTIONS -- /dev/vdc /vdc

generic/736 [03:18:33][ 3.510255] run fstests generic/736 at 2025-05-05 03:18:33
_check_generic_filesystem: filesystem on /dev/vdb is inconsistent
(see /results/hfs/results-default/generic/736.full for details)
Ran: generic/736
Failures: generic/736
Failed 1 of 1 tests

The HFS volume becomes corrupted after the test run:

sudo fsck.hfs -d /dev/loop50
** /dev/loop50
Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K.
Executing fsck_hfs (version 540.1-Linux).
** Checking HFS volume.
The volume name is untitled
** Checking extents overflow file.
** Checking catalog file.
** Checking catalog hierarchy.
** Checking volume bitmap.
** Checking volume information.
invalid MDB drNxtCNID
Master Directory Block needs minor repair
(1, 0)
Verify Status: VIStat = 0x8000, ABTStat = 0x0000 EBTStat = 0x0000
CBTStat = 0x0000 CatStat = 0x00000000
** Repairing volume.
** Rechecking volume.
** Checking HFS volume.
The volume name is untitled
** Checking extents overflow file.
** Checking catalog file.
** Checking catalog hierarchy.
** Checking volume bitmap.
** Checking volume information.
** The volume untitled was repaired successfully.

The main reason of the issue is the absence of logic that
corrects mdb->drNxtCNID/HFS_SB(sb)->next_id (next unused
CNID) after deleting a record in Catalog File. This patch
introduces a hfs_correct_next_unused_CNID() method that
implements the necessary logic. In the case of Catalog File's
record delete operation, the function logic checks that
(deleted_CNID + 1) == next_unused_CNID and it finds/sets the new
value of next_unused_CNID.

sudo ./check generic/736
FSTYP -- hfs
PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.15.0+ #6 SMP PREEMPT_DYNAMIC Tue Jun 10 15:02:48 PDT 2025
MKFS_OPTIONS -- /dev/loop51
MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch

generic/736 33s
Ran: generic/736
Passed all 1 tests

sudo fsck.hfs -d /dev/loop50
** /dev/loop50
Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K.
Executing fsck_hfs (version 540.1-Linux).
** Checking HFS volume.
The volume name is untitled
** Checking extents overflow file.
** Checking catalog file.
** Checking catalog hierarchy.
** Checking volume bitmap.
** Checking volume information.
** The volume untitled appears to be OK

Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
Link: https://lore.kernel.org/r/20250610231609.551930-1-slava@dubeyko.com
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
2025-08-31 18:15:21 -07:00
Viacheslav Dubeyko
9b3d15a758 hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat()
The syzbot reported issue in hfsplus_delete_cat():

[   70.682285][ T9333] =====================================================
[   70.682943][ T9333] BUG: KMSAN: uninit-value in hfsplus_subfolders_dec+0x1d7/0x220
[   70.683640][ T9333]  hfsplus_subfolders_dec+0x1d7/0x220
[   70.684141][ T9333]  hfsplus_delete_cat+0x105d/0x12b0
[   70.684621][ T9333]  hfsplus_rmdir+0x13d/0x310
[   70.685048][ T9333]  vfs_rmdir+0x5ba/0x810
[   70.685447][ T9333]  do_rmdir+0x964/0xea0
[   70.685833][ T9333]  __x64_sys_rmdir+0x71/0xb0
[   70.686260][ T9333]  x64_sys_call+0xcd8/0x3cf0
[   70.686695][ T9333]  do_syscall_64+0xd9/0x1d0
[   70.687119][ T9333]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   70.687646][ T9333]
[   70.687856][ T9333] Uninit was stored to memory at:
[   70.688311][ T9333]  hfsplus_subfolders_inc+0x1c2/0x1d0
[   70.688779][ T9333]  hfsplus_create_cat+0x148e/0x1800
[   70.689231][ T9333]  hfsplus_mknod+0x27f/0x600
[   70.689730][ T9333]  hfsplus_mkdir+0x5a/0x70
[   70.690146][ T9333]  vfs_mkdir+0x483/0x7a0
[   70.690545][ T9333]  do_mkdirat+0x3f2/0xd30
[   70.690944][ T9333]  __x64_sys_mkdir+0x9a/0xf0
[   70.691380][ T9333]  x64_sys_call+0x2f89/0x3cf0
[   70.691816][ T9333]  do_syscall_64+0xd9/0x1d0
[   70.692229][ T9333]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   70.692773][ T9333]
[   70.692990][ T9333] Uninit was stored to memory at:
[   70.693469][ T9333]  hfsplus_subfolders_inc+0x1c2/0x1d0
[   70.693960][ T9333]  hfsplus_create_cat+0x148e/0x1800
[   70.694438][ T9333]  hfsplus_fill_super+0x21c1/0x2700
[   70.694911][ T9333]  mount_bdev+0x37b/0x530
[   70.695320][ T9333]  hfsplus_mount+0x4d/0x60
[   70.695729][ T9333]  legacy_get_tree+0x113/0x2c0
[   70.696167][ T9333]  vfs_get_tree+0xb3/0x5c0
[   70.696588][ T9333]  do_new_mount+0x73e/0x1630
[   70.697013][ T9333]  path_mount+0x6e3/0x1eb0
[   70.697425][ T9333]  __se_sys_mount+0x733/0x830
[   70.697857][ T9333]  __x64_sys_mount+0xe4/0x150
[   70.698269][ T9333]  x64_sys_call+0x2691/0x3cf0
[   70.698704][ T9333]  do_syscall_64+0xd9/0x1d0
[   70.699117][ T9333]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   70.699730][ T9333]
[   70.699946][ T9333] Uninit was created at:
[   70.700378][ T9333]  __alloc_pages_noprof+0x714/0xe60
[   70.700843][ T9333]  alloc_pages_mpol_noprof+0x2a2/0x9b0
[   70.701331][ T9333]  alloc_pages_noprof+0xf8/0x1f0
[   70.701774][ T9333]  allocate_slab+0x30e/0x1390
[   70.702194][ T9333]  ___slab_alloc+0x1049/0x33a0
[   70.702635][ T9333]  kmem_cache_alloc_lru_noprof+0x5ce/0xb20
[   70.703153][ T9333]  hfsplus_alloc_inode+0x5a/0xd0
[   70.703598][ T9333]  alloc_inode+0x82/0x490
[   70.703984][ T9333]  iget_locked+0x22e/0x1320
[   70.704428][ T9333]  hfsplus_iget+0x5c/0xba0
[   70.704827][ T9333]  hfsplus_btree_open+0x135/0x1dd0
[   70.705291][ T9333]  hfsplus_fill_super+0x1132/0x2700
[   70.705776][ T9333]  mount_bdev+0x37b/0x530
[   70.706171][ T9333]  hfsplus_mount+0x4d/0x60
[   70.706579][ T9333]  legacy_get_tree+0x113/0x2c0
[   70.707019][ T9333]  vfs_get_tree+0xb3/0x5c0
[   70.707444][ T9333]  do_new_mount+0x73e/0x1630
[   70.707865][ T9333]  path_mount+0x6e3/0x1eb0
[   70.708270][ T9333]  __se_sys_mount+0x733/0x830
[   70.708711][ T9333]  __x64_sys_mount+0xe4/0x150
[   70.709158][ T9333]  x64_sys_call+0x2691/0x3cf0
[   70.709630][ T9333]  do_syscall_64+0xd9/0x1d0
[   70.710053][ T9333]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   70.710611][ T9333]
[   70.710842][ T9333] CPU: 3 UID: 0 PID: 9333 Comm: repro Not tainted 6.12.0-rc6-dirty #17
[   70.711568][ T9333] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   70.712490][ T9333] =====================================================
[   70.713085][ T9333] Disabling lock debugging due to kernel taint
[   70.713618][ T9333] Kernel panic - not syncing: kmsan.panic set ...
[   70.714159][ T9333] CPU: 3 UID: 0 PID: 9333 Comm: repro Tainted: G    B              6.12.0-rc6-dirty #17
[   70.715007][ T9333] Tainted: [B]=BAD_PAGE
[   70.715365][ T9333] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[   70.716311][ T9333] Call Trace:
[   70.716621][ T9333]  <TASK>
[   70.716899][ T9333]  dump_stack_lvl+0x1fd/0x2b0
[   70.717350][ T9333]  dump_stack+0x1e/0x30
[   70.717743][ T9333]  panic+0x502/0xca0
[   70.718116][ T9333]  ? kmsan_get_metadata+0x13e/0x1c0
[   70.718611][ T9333]  kmsan_report+0x296/0x2a0
[   70.719038][ T9333]  ? __msan_metadata_ptr_for_load_4+0x24/0x40
[   70.719859][ T9333]  ? __msan_warning+0x96/0x120
[   70.720345][ T9333]  ? hfsplus_subfolders_dec+0x1d7/0x220
[   70.720881][ T9333]  ? hfsplus_delete_cat+0x105d/0x12b0
[   70.721412][ T9333]  ? hfsplus_rmdir+0x13d/0x310
[   70.721880][ T9333]  ? vfs_rmdir+0x5ba/0x810
[   70.722458][ T9333]  ? do_rmdir+0x964/0xea0
[   70.722883][ T9333]  ? __x64_sys_rmdir+0x71/0xb0
[   70.723397][ T9333]  ? x64_sys_call+0xcd8/0x3cf0
[   70.723915][ T9333]  ? do_syscall_64+0xd9/0x1d0
[   70.724454][ T9333]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   70.725110][ T9333]  ? vprintk_emit+0xd1f/0xe60
[   70.725616][ T9333]  ? vprintk_default+0x3f/0x50
[   70.726175][ T9333]  ? vprintk+0xce/0xd0
[   70.726628][ T9333]  ? _printk+0x17e/0x1b0
[   70.727129][ T9333]  ? __msan_metadata_ptr_for_load_4+0x24/0x40
[   70.727739][ T9333]  ? kmsan_get_metadata+0x13e/0x1c0
[   70.728324][ T9333]  __msan_warning+0x96/0x120
[   70.728854][ T9333]  hfsplus_subfolders_dec+0x1d7/0x220
[   70.729479][ T9333]  hfsplus_delete_cat+0x105d/0x12b0
[   70.729984][ T9333]  ? kmsan_get_shadow_origin_ptr+0x4a/0xb0
[   70.730646][ T9333]  ? __msan_metadata_ptr_for_load_4+0x24/0x40
[   70.731296][ T9333]  ? kmsan_get_metadata+0x13e/0x1c0
[   70.731863][ T9333]  hfsplus_rmdir+0x13d/0x310
[   70.732390][ T9333]  ? __pfx_hfsplus_rmdir+0x10/0x10
[   70.732919][ T9333]  vfs_rmdir+0x5ba/0x810
[   70.733416][ T9333]  ? kmsan_get_shadow_origin_ptr+0x4a/0xb0
[   70.734044][ T9333]  do_rmdir+0x964/0xea0
[   70.734537][ T9333]  __x64_sys_rmdir+0x71/0xb0
[   70.735032][ T9333]  x64_sys_call+0xcd8/0x3cf0
[   70.735579][ T9333]  do_syscall_64+0xd9/0x1d0
[   70.736092][ T9333]  ? irqentry_exit+0x16/0x60
[   70.736637][ T9333]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   70.737269][ T9333] RIP: 0033:0x7fa9424eafc9
[   70.737775][ T9333] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 48
[   70.739844][ T9333] RSP: 002b:00007fff099cd8d8 EFLAGS: 00000202 ORIG_RAX: 0000000000000054
[   70.740760][ T9333] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa9424eafc9
[   70.741642][ T9333] RDX: 006c6f72746e6f63 RSI: 000000000000000a RDI: 0000000020000100
[   70.742543][ T9333] RBP: 00007fff099cd8e0 R08: 00007fff099cd910 R09: 00007fff099cd910
[   70.743376][ T9333] R10: 0000000000000000 R11: 0000000000000202 R12: 0000565430642260
[   70.744247][ T9333] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[   70.745082][ T9333]  </TASK>

The main reason of the issue that struct hfsplus_inode_info
has not been properly initialized for the case of root folder.
In the case of root folder, hfsplus_fill_super() calls
the hfsplus_iget() that implements only partial initialization of
struct hfsplus_inode_info and subfolders field is not
initialized by hfsplus_iget() logic.

This patch implements complete initialization of
struct hfsplus_inode_info in the hfsplus_iget() logic with
the goal to prevent likewise issues for the case of
root folder.

Reported-by: syzbot <syzbot+fdedff847a0e5e84c39f@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=fdedff847a0e5e84c39f
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
cc: Yangtao Li <frank.li@vivo.com>
cc: linux-fsdevel@vger.kernel.org
Link: https://lore.kernel.org/r/20250825225103.326401-1-slava@dubeyko.com
Signed-off-by: Viacheslav Dubeyko <slava@dubeyko.com>
2025-08-31 18:14:32 -07:00