syzbot reported use-after-free in mptcp_schedule_work() [1]
Issue here is that mptcp_schedule_work() schedules a work,
then gets a refcount on sk->sk_refcnt if the work was scheduled.
This refcount will be released by mptcp_worker().
[A] if (schedule_work(...)) {
[B] sock_hold(sk);
return true;
}
Problem is that mptcp_worker() can run immediately and complete before [B]
We need instead :
sock_hold(sk);
if (schedule_work(...))
return true;
sock_put(sk);
[1]
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 1 PID: 29 at lib/refcount.c:25 refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:25
Call Trace:
<TASK>
__refcount_add include/linux/refcount.h:-1 [inline]
__refcount_inc include/linux/refcount.h:366 [inline]
refcount_inc include/linux/refcount.h:383 [inline]
sock_hold include/net/sock.h:816 [inline]
mptcp_schedule_work+0x164/0x1a0 net/mptcp/protocol.c:943
mptcp_tout_timer+0x21/0xa0 net/mptcp/protocol.c:2316
call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747
expire_timers kernel/time/timer.c:1798 [inline]
__run_timers kernel/time/timer.c:2372 [inline]
__run_timer_base+0x648/0x970 kernel/time/timer.c:2384
run_timer_base kernel/time/timer.c:2393 [inline]
run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403
handle_softirqs+0x22f/0x710 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
run_ktimerd+0xcf/0x190 kernel/softirq.c:1138
smpboot_thread_fn+0x542/0xa60 kernel/smpboot.c:160
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Cc: stable@vger.kernel.org
Fixes: 3b1d6210a9 ("mptcp: implement and use MPTCP-level retransmission")
Reported-by: syzbot+355158e7e301548a1424@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6915b46f.050a0220.3565dc.0028.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251113103924.3737425-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
The call to devlink_info_version_fixed_put() in
mlxsw_linecard_devlink_info_get() did not check for errors,
although it is checked everywhere in the code.
Add missed 'err' check to the mlxsw_linecard_devlink_info_get()
Fixes: 3fc0c51905 ("mlxsw: core_linecards: Expose device PSID over device info")
Signed-off-by: Pavel Zhigulin <Pavel.Zhigulin@kaspersky.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20251113161922.813828-1-Pavel.Zhigulin@kaspersky.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
The LED setup routine registered both led_sync_good
and led_is_gm devices without checking the return
values of led_classdev_register(). If either registration
failed, the function continued silently, leaving the
driver in a partially-initialized state and leaking
a registered LED classdev.
Add proper error handling
Fixes: 7d9ee2e8ff ("net: dsa: hellcreek: Add PTP status LEDs")
Signed-off-by: Pavel Zhigulin <Pavel.Zhigulin@kaspersky.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Acked-by: Kurt Kanzenbach <kurt@linutronix.de>
Link: https://patch.msgid.link/20251113135745.92375-1-Pavel.Zhigulin@kaspersky.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJIBAABCgAyFiEEgMe7l+5h9hnxdsnuWYigwDrT+vwFAmkXokcUHGJoZWxnYWFz
QGdvb2dsZS5jb20ACgkQWYigwDrT+vyejw/8CN4kM8PROTw3p6QBJQF6am5uPCA4
nQans+groD/XJXJd7T4aqwuvLXvIrrEd3K+PegBLiGgk3Wgw9fq5pEWDafUH8IAv
LG5g462aHyrHPMV8XI6lIrDLD7PCltmpoIu22Xkri4l4gkca7Ros/4Q5gU+AgtCz
LtsO9UmcK0PaR95NCdYFf2VZ1PsdZu/ezTb90S1xT5gty9uwpxCmHje5gg07MXXO
12i/SNczU9gFYo8P6XMeD7q0Ixwt7JLC+xa1iBlBEODvcPkyf8Al2dIkxWlnrwGn
kxi4K/PKM4f7ZhtyTHh/G8EiFYh/QwbHGvnCBj5XQAKOLWkjZCn8l5MxqGAKKvnz
Dem3/MFwJQ79+y/vrseg5beBiLPahd5fsAITOFIxmQZsEjvL+B8fhU52QBkLVFUw
iJg7PJXHJ9Jy/NRGT/rinu9mi2K+z1baZHZm11QK5khTTbYAs+qsvwWck9Jcr004
OEsQGngomUv09WjHv0/26dJzVI5wpnn+C+DFAximlIMZnTaQguN/WNplYYyXBRzB
T09qK1ZzpJM6QEU5i2ZForGpFtKSbGHwJrC6DYjLiVV3P4EzpHWSmTy2dqM7GUNa
Wrvaxy3j/MT2kudfyIs10Qwu1EJ+rHYb/QfS3pqlggSDic9WFg9P4uUlFR1YUKPb
h+Peip6NV/tQNHI=
=2eqF
-----END PGP SIGNATURE-----
Merge tag 'pci-v6.18-fixes-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci
Pull pci fixes from Bjorn Helgaas:
- Cache the ASPM L0s/L1 Supported bits early so quirks can override
them if necessary (Bjorn Helgaas)
- Add quirks for PA Semi and Freescale Root Ports and a HiSilicon Wi-Fi
device that are reported to have broken L0s and L1 (Shawn Lin, Bjorn
Helgaas)
* tag 'pci-v6.18-fixes-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:
PCI/ASPM: Avoid L0s and L1 on Hi1105 [19e5:1105] Wi-Fi
PCI/ASPM: Avoid L0s and L1 on PA Semi [1959:a002] Root Ports
PCI/ASPM: Avoid L0s and L1 on Freescale [1957:0451] Root Ports
PCI/ASPM: Convert quirks to override advertised link states
PCI/ASPM: Add pcie_aspm_remove_cap() to override advertised link states
PCI/ASPM: Cache L0s/L1 Supported so advertised link states can be overridden
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEE+soXsSLHKoYyzcli6rmadz2vbToFAmkXpZUACgkQ6rmadz2v
bTrGCw//UCx+KBXbzvv7m0A1QGOUL3oHL/Qd+OJA3RW3B+saVbYYzn9jjl0SRgFP
X0q/DwbDOjFtOSORV9oFgJkrucn7+BM/yxPaC4sE1SQZJAjDFA/CSaF0r8duuGsM
Mvat9TTiwwetOMAkNB9WZ1e6AKGovBLguLFGAWZc6vLeQZopcER5+pFwS44a9RrK
dq0Th8O/oY3VmUDgSKJ2KyY51KxpJU7k2ipifiIbu1M1MWZ7s2vERkMEkzJ/lB8/
nldMsTZUdknGFzVH/W6Rc9ScFYlH+h/x1gkOHwTibMsqDBm92mWVo6O7hvuUbsEO
NlPDgMtkhBp7PDSx9SA0UBcriMs1M6ovNBOpj/cI4AL1k8WNubf/FHZtrBwoy8C9
3HaM+8lkA2uiHVPUvT5dImzWqshweN0GXoXAoa9xPSQPchJ38UdzCHqYRAg/kWFZ
5jUK2j4e5+yyII44pD7Xti0PrfoP81giliqmTbGFV8+Y89dQnk+WK12vnbv34ER7
unLwId8HLtq0ZN7FVG4F6s/4qNdEMKqXbAkve0WWFXn4vKZMCju4ol6NYVGisRAg
zcn7Yk+weSuY3UOzC+/4SxhfTEAD0Kg6fUoG/1JdflgNsm8XhLBja0DZaAlIVO0p
xz5UaljwcNvjAKGGMYbCGrf3XN2tOmGpVyJkMj17Vcq88y3bJBU=
=JJui
-----END PGP SIGNATURE-----
Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf
Pull bpf fixes from Alexei Starovoitov:
- Fix interaction between livepatch and BPF fexit programs (Song Liu)
With Steven and Masami acks.
- Fix stack ORC unwind from BPF kprobe_multi (Jiri Olsa)
With Steven and Masami acks.
- Fix out of bounds access in widen_imprecise_scalars() in the verifier
(Eduard Zingerman)
- Fix conflicts between MPTCP and BPF sockmap (Jiayuan Chen)
- Fix net_sched storage collision with BPF data_meta/data_end (Eric
Dumazet)
- Add _impl suffix to BPF kfuncs with implicit args to avoid breaking
them in bpf-next when KF_IMPLICIT_ARGS is added (Mykyta Yatsenko)
* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
selftests/bpf: Test widen_imprecise_scalars() with different stack depth
bpf: account for current allocated stack depth in widen_imprecise_scalars()
bpf: Add bpf_prog_run_data_pointers()
selftests/bpf: Add mptcp test with sockmap
mptcp: Fix proto fallback detection with BPF
mptcp: Disallow MPTCP subflows from sockmap
selftests/bpf: Add stacktrace ips test for raw_tp
selftests/bpf: Add stacktrace ips test for kprobe_multi/kretprobe_multi
x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe
Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()"
bpf: add _impl suffix for bpf_stream_vprintk() kfunc
bpf:add _impl suffix for bpf_task_work_schedule* kfuncs
selftests/bpf: Add tests for livepatch + bpf trampoline
ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct()
ftrace: Fix BPF fexit with livepatch
Toolchain and infrastructure:
- Fix a Rust 1.91.0 build issue due to 'bindings.o' not containing
DWARF debug information anymore by teaching gendwarfksyms to skip
object files without exports.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEPjU5OPd5QIZ9jqqOGXyLc2htIW0FAmkXorAACgkQGXyLc2ht
IW3fIw/+IKI2iM5bbyQ9WbS3GDtUzSBxu/4OXL25UarD/vEA3xAo2XeHlpBnwhZ6
wK439HSqtKNF3iMMVUZO0A81YnBVPCUE6y3QKvRWbNj4X0s+fb8/TNnSKIsjSIiV
j3Wf2d/ssXfPGknKhzHIMWY2YxhS+QjX31oPbnDPeXw0tomL9wb8xl/xeWlARKYQ
R3YhE9FLBtaVNVGEKwL4QY4GpubZ098sQo5wkL9MuqcB79A34X5hXoNj9A2vAWhx
iLHCwIcmcyNNcFzfwy9L9xScal63E+FPENIx5gtVaxV5NsUuis/7CRcDAl8WPXVz
G60fC1c42stho/Tv/Ymt55vqYjdbgyCyQg68vQIvcMofyU5zQocm1+5re9JaVj7G
r/QJ6eL9sRON7ym//FZirk352ttwad2T4yhUmG933iVAjDoZAvBBw4ocX2LpdHxq
1b7PzDCpTl+eFbUc2vTfx33OsnE7gj5vJeSvMmcrlxFbEd1GLb9PEBcBdF6OR77L
+H6aWbkJ53dsji8veL/9UkhNJAGLEJyfNnaOtjgWA2XthyHAz2U6GSR176KY4fFK
pEsImpLyTJKd5mlwYaZwhDEVa+kdz8RCNxY1k8BDSFRk8gvDNlAioCqcddRdqoOt
0BTTlYEMzHz78FeGth33w+eYCT8tp1fHiovWReD3TJcgVuJjpE8=
=FPGX
-----END PGP SIGNATURE-----
Merge tag 'rust-fixes-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux
Pull Rust fix from Miguel Ojeda:
- Fix a Rust 1.91.0 build issue due to 'bindings.o' not containing
DWARF debug information anymore by teaching gendwarfksyms to skip
object files without exports
* tag 'rust-fixes-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:
gendwarfksyms: Skip files with no exports
Bugfixes:
* Various fixes when using NFS with TLS
* Localio direct-IO fixes
* Fix error handling in nfs_atomic_open_v23()
* Fix sysfs memory leak when nfs_client kobject add fails
* Fix an incorrect parameter when calling nfs4_call_sync()
* Fix a failing LTP test when using delegated timestamps
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEnZ5MQTpR7cLU7KEp18tUv7ClQOsFAmkXmqIACgkQ18tUv7Cl
QOsdlg/8CgomAZvepcW9e5H/bXi0x3Q4gUTcXWV49/oqwfnpVJ1C0Xanx1zdtY6P
QhchYwHv1r989IEJWaeO4U/ppCei8LoOSq2dkb1TzWohZuUbIg44KnpPtcbkXTgy
cDcGZu3PNLtvwodljDOtaF4ZVLaWl0MwTYnp0I4xQJc12InHUQ9TPPCSOBb262nN
BeFPRguhQXZl1jUOv/F0SE/bEcoAnNX8MnbXMaIN3aHy2d9Vq5m4IpJCgyeXQwle
KvEE6hAmJGm3rG+wpkz7x56KOn7k/K/Py772T7qzEADLcr4Qmusi1++ffnxikVIc
F9EElTw5pgAvdTuKr+sVw+gktaYWu0LeTFbcIK9dwC5N+uksb7l/TcP9cmhA6lxE
7KVVmYZGzPV8rwDIztoO8qPSePQTaJB8P3mQmZ8XVd1bz75BQ1zi4SSz578kl84E
YMHVLHBHiR/chA1z1YSrh8fV8inOiijwrjXU3Oa/blaRhhaH1AvEFboMbn7FyW17
GjmtL2rfC+hg+kWuvflJiK/zlVJOSNyZBNoD3iQaHq/D4vwXqVETETZnT8002kwL
sWVFmHdv1Y0fF3K/VsB8QFVhW46K6urJlKU694bWVzo9aK2pX7oj+ElcyXqyFv/p
Hq1sxe4KPlsVPoG/ClVvtH2a56vNRTOO0LySUN/ZAfUruLQeVv8=
=7pf4
-----END PGP SIGNATURE-----
Merge tag 'nfs-for-6.18-3' of git://git.linux-nfs.org/projects/anna/linux-nfs
Pull NFS client fixes from Anna Schumaker:
- Various fixes when using NFS with TLS
- Localio direct-IO fixes
- Fix error handling in nfs_atomic_open_v23()
- Fix sysfs memory leak when nfs_client kobject add fails
- Fix an incorrect parameter when calling nfs4_call_sync()
- Fix a failing LTP test when using delegated timestamps
* tag 'nfs-for-6.18-3' of git://git.linux-nfs.org/projects/anna/linux-nfs:
NFS: Fix LTP test failures when timestamps are delegated
NFSv4: Fix an incorrect parameter when calling nfs4_call_sync()
NFS: sysfs: fix leak when nfs_client kobject add fails
NFSv2/v3: Fix error handling in nfs_atomic_open_v23()
nfs/localio: do not issue misaligned DIO out-of-order
nfs/localio: Ensure DIO WRITE's IO on stable storage upon completion
nfs/localio: backfill missing partial read support for misaligned DIO
nfs/localio: add refcounting for each iocb IO associated with NFS pgio header
nfs/localio: remove unecessary ENOTBLK handling in DIO WRITE support
NFS: Check the TLS certificate fields in nfs_match_client()
pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS
pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect()
pnfs: Fix TLS logic in _nfs4_pnfs_v3_ds_connect()
client:
- Fix description of module parameter
panthor:
- Flush writes before mapping buffers
vmwgfx:
- Improve command validation
- Improve ref counting
- Fix cursor-plane support
amdgpu:
- Disallow P2P DMA for GC 12 DCC surfaces
- ctx error handling fix
- UserQ fixes
- VRR fix
- ISP fix
- JPEG 5.0.1 fix
amdkfd:
- Save area check fix
- Fix GPU mappings for APU after prefetch
i915:
- Fix PSR's pipe to vblank conversion
- Disable Panel Replay on MST links
xe:
- New HW workarounds affecting PTL and WCL platforms
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmkXkdEACgkQDHTzWXnE
hr5npQ//exMOLUD1T7V4e8uGn5SZKrJGh2Q/6rfC3Kf8+rjlNVXtAh6fxGZlOyOz
qA4Z4d6Cvy6t96PyVohjQMW5WVl6AtCyPljaXf+EDx1jihtGY2dGI6ccMrkitEX4
GuEO2EtiI9VA6vtr7/GWwUcQiUJrGmFYVhGhy8JzRGnZZMsJjCn2KFJ7jB6NN/BR
PfIj2f23KfWW4wCNrt8uZ6s6SLcXvGUVxD7SZb12Ze3zg2OL3iZsypRKsFwstF0o
dZBsCdea0LkmDCVpSWxIvltBP4vfoPhRlm9LC/Vy2iJoa2ALQ7w+xWO0CPpgOvgY
guj765FHUsKWBv0lyaFj86NrXOTrY1CRQ9toNaIp7vKgH5zmOaS8O8+Ganr34yGc
A75qn1+jBNC4YUV/99KW9mola7wraGDYi96MBSWtHg7fZTDraclca+WUUHK+gI6s
Vu4uUD1rWOkDO6gzJOXxrMwVy/+/S/qUS9CCojg/u1YYw2xg1lVP8yVyq8/oPXR1
t5qgJZweCXJ5Ev4dygVEl4VOZUQnbe+5QDO3euRFM1r19vhlb2jwcE0WW2BQjRK0
Hl3P5Lk9IVmdEd7ew+xgCqgwPkccP5lYzM/ygRw4oNO+u/TcIzEcsYucsYLc7WRU
bwlvwdxPJFghW634cbQTlnC2BfrzeP5VrOKWsu9dfmlkYniBc4o=
=VOqX
-----END PGP SIGNATURE-----
Merge tag 'drm-fixes-2025-11-15' of https://gitlab.freedesktop.org/drm/kernel
Pull drm fixes from Dave Airlie:
"Weekly fixes, amdgpu and vmwgfx making up the most of it, along with
panthor and i915/xe.
Seems about right for this time of development, nothing major
outstanding.
client:
- Fix description of module parameter
panthor:
- Flush writes before mapping buffers
vmwgfx:
- Improve command validation
- Improve ref counting
- Fix cursor-plane support
amdgpu:
- Disallow P2P DMA for GC 12 DCC surfaces
- ctx error handling fix
- UserQ fixes
- VRR fix
- ISP fix
- JPEG 5.0.1 fix
amdkfd:
- Save area check fix
- Fix GPU mappings for APU after prefetch
i915:
- Fix PSR's pipe to vblank conversion
- Disable Panel Replay on MST links
xe:
- New HW workarounds affecting PTL and WCL platforms
* tag 'drm-fixes-2025-11-15' of https://gitlab.freedesktop.org/drm/kernel:
drm/client: fix MODULE_PARM_DESC string for "active"
drm/i915/dp_mst: Disable Panel Replay
drm/amdkfd: Fix GPU mappings for APU after prefetch
drm/amdkfd: relax checks for over allocation of save area
drm/amdgpu/jpeg: Add parse_cs for JPEG5_0_1
drm/amd/amdgpu: Ensure isp_kernel_buffer_alloc() creates a new BO
drm/amd/display: Allow VRR params change if unsynced with the stream
drm/amdgpu: fix lock warning in amdgpu_userq_fence_driver_process
drm/amdgpu: jump to the correct label on failure
drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces
drm/xe/xe3lpg: Extend Wa_15016589081 for xe3lpg
drm/xe/xe3: Extend wa_14023061436
drm/xe/xe3: Add WA_14024681466 for Xe3_LPG
drm/i915/psr: fix pipe to vblank conversion
drm/panthor: Flush shmem writes before mapping buffers CPU-uncached
drm/vmwgfx: Restore Guest-Backed only cursor plane support
drm/vmwgfx: Use kref in vmw_bo_dirty
drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
for 6.18, please pull the following:
- Andrea assigns clocks rates for the Ethernet controller for the
Raspberry Pi 5 systems
- Laurent adds an ethernet0 alias to allow client programs consuming
that alias to populate the correct Ethernet address for the Raspberry
Pi 5 systems
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEm+Rq3+YGJdiR9yuFh9CWnEQHBwQFAmkLl74ACgkQh9CWnEQH
BwSpVRAAqrOwv98RkKxbWX6GTaTae3tL6b7jfhtjNKsY5uSaGzAzlJAUs0+czshG
OiRC7orymNKVeQoIrrp/+73BjNN0cJXDesvBu3tSbbYS6IwkQQmwkUUf9QBDY1jK
ndpRKWj7iotA5H1RTiCduloh6cp1MRL+b3wb5LCySid4PCtXcpZufeJkkLSB4MlL
IS7fnRltRtMaBFI92lU/W718sLorH1QewdAfubxTysg07a2rlfZZPeVCQ4sFmntt
LDP0AZvyxFSA7942GynWcZniP8cw6mfj+JyZxZgaKBK34438iDRcYzuPpT3zNv6k
xL1NMqY0ZrE7NIIOXosdUB7BdsQLN+bgOsQOVWz4iMoPB4cLSHjg20kXrOXzUIKh
IC3WBXzW4oYNlqq9k1IjJ2oxtbrukaF/b0jf2TWs7VOKHUIVjYO+imgs1ofw/krT
oPQuXTZrBBnjxPbt0DdQCqnoHqXfZ0Sr/6WqCNLpeOxS0AWqpJsHywg+A5RgTYrJ
pFrDJ0tQuwUVdRTxf5sDoJ1TV2u3U4uq/LWVTA0s1IxCus6ifawKQNJBxEBGm+dj
QmmEuNWzNtmjfJIeYBDFfTkeDmFGn1J3zLbwQ0zQmuut5BuwOkaR5PWTQQj/oDm8
G4jXoUwAvxQHvpx9ESO9kxHS2sck2pxJcp+aseS5uDUM5xiGA3A=
=cj42
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmkXnQwACgkQmmx57+YA
GNnCJhAAs0t2zUWzIL/faE15mGkwRqAEYtqG4vTviF6v8DusbNl++E2fN5Knut1q
LYl8FIFeVV6NPl/iY5lfPb9WYWBVt1/WNZKU/Uvkw3X4TAHz0xKURdnpU9HYw92k
/WptZp7RNYkngIt+aH1nxlt5EBiPbS+8rbpgDC3wLsVwjJ+hu765h9H9xsVOjf5r
4JC3N9MPGT4pxUpohnFUO+s6LD5UkBMfnNCIpaHyABrqlPQcV+eb7v8LqETQm0ZH
EALqi+0JDdE2I1/66QeAVjRNxskEGTuK0qXbTzINpDA6axH+CdpCDmRKTS64KGp7
lbjxm5py/0RjwIMs7ocrXx9ckvpqB4FABj8Cd9HPaqhtA2yAnlfLykB9F8YWpUro
+z5rvffP57eNW5xG+E9O4Msbo4gDazs8GnTeEPqdD12llfXOC7YMkN9Hx3t4x2OX
/eVzW/vQydoqb3R0WCVHfDAGpnAelYBgq93GodnY6Sc3nxjbvxyp9m6xKj/gaOWZ
w0vJTfIXCORMq0KuKf5bSyPXKVYkkFXGTDVr0hGgR1cyQsNvUI2lj8X0DhV3gbSD
QvIF9c1TXFY9o/NEXdW67ejqTekEmRflbN0fDVQAfGBZJnSSde7ydvhJNZinkSrn
NV1JLF5Ih2KM0XkkLryHFffztPpb2b7kzFBR3DEaSALGK6pURlA=
=MR10
-----END PGP SIGNATURE-----
Merge tag 'arm-soc/for-6.18/devicetree-arm64-fixes-v2' of https://github.com/Broadcom/stblinux into arm/fixes
This pull request contains Broadcom ARM64-based SoCs Device Tree fixes
for 6.18, please pull the following:
- Andrea assigns clocks rates for the Ethernet controller for the
Raspberry Pi 5 systems
- Laurent adds an ethernet0 alias to allow client programs consuming
that alias to populate the correct Ethernet address for the Raspberry
Pi 5 systems
* tag 'arm-soc/for-6.18/devicetree-arm64-fixes-v2' of https://github.com/Broadcom/stblinux:
arm64: dts: broadcom: bcm2712: rpi-5: Add ethernet0 alias
arm64: dts: broadcom: Assign clock rates in eth node for RPi5
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
please pull the following:
- Stefan ensures that the clk-raspberrypi driver which is now the clock
provider is built into the kernel image to satisfy root over NFS
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEm+Rq3+YGJdiR9yuFh9CWnEQHBwQFAmkKfTYACgkQh9CWnEQH
BwR2rBAAlN03DYB81RQh/WWTobuVw3IgnqZ2EgplA88motyTxuju9zB9A/eaWtiz
9gORra9bl06Bk8d9vjoklowQdju1ncN3CJl/O//HcGbSwd+j1Y6jgIScOsI7Wtm+
aZT7gRCjM1qikPJLUVUwGApSMnP654leGltYsD292d72BM7atzAbogLYH0W6v9nw
oYPREyq6Ls6ToBvfpy1S1a1JnvFlxB4Ya7BPZUJePb2vxqTNwpxyX0qIiQx9lozL
ReichWegjMjo0IQDcldHSRGZLyAJ7OzOECYXGdsVWBngUSZMhzb98Y8zssZVYmYt
vX/+MUkmPNJhv8HZfGPV8lij5IFcfqA/jv5o8uO15pQa00bOa84wsEAvACy9tKWs
BL80Ot4ODoG+SbxOCSXbzPqYuF5FakgH2beDE+1W5GwuZKhWRrYZPAEeU2BXg8J1
MQsewm/2PHhC7hcIXX6k6KJJ/IJPeOe/yh8OaKn0uYRShPIj+x7aEMIWyzlgyS4z
2gdSCoAwhOUM2kfJaXjfa+dKOCe2lP9YYxH4hL3wqGnduUbMgqF8uod5jRjA63Bf
me+8EOt1GQj/izpKeutFyQaiTaemLq+1wxBxhSejhfzszTbLm83+tw+WeaihoFf+
EH0RAmUar6f7dfuNHc6y/f/Y0z7u6OALHo6oWt3YFYotQX5hp/E=
=vB8/
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmkXm4QACgkQmmx57+YA
GNmDmQ/+NJAkddrqs+9r6hGOhDDN3p1Cp2/ZdzWlf9o2FeXQzJCHnTWj4NiG4zju
kjzNqyyYcHdiD8dJInokTofpGknI0+1jOUK5VoiyeLRR3rivbWFnY7HMFaUHAFl/
QMoPfj9eT3QOLPhvojbZpTDgh3VVOU0/D627kY9GXTk0Njs8hw07PsOVw39K3mTO
LEg2IAs6KRxtkuf0fPMX0ebUbBJMJaaHIGo7Rw+DJ86mzOmOta81+8KALHcAOAqW
1vdkPTeQP83nmthTNp+W1X26HH9X7hVIUq49d4yJRiFIrKM4vExwpIZJYqWa4AgK
2uLLZl7UV4bU9kWXOOJa9/YqvdhVKFZiNic1RnxJFxmRDJr6H13mH3WmKLojtCoL
K+kmGYUnGXkpByHPV8BlhBrU80SztBvUbcS2+NKTDdfYUjWxh37kRBIVwQiKF81P
EK5FwLpjG1+0rVB4eoVrpDaKgIawxRdO8trseASzacI4DQXSKjF1iOhgwKUUz+Rd
JqZEZbXBdStcDpGUVBQN3yVV3XbBddz7U4Xowuc1X5biCjnAalJnPbhHOC3lPQGp
8Y2ptZYyhYyMlJpLOjE39crDb8IrJpAYaUQliauTxDThapTYlJ5JR+xsagprd75y
iDlz7fzWe34P732i718mhC70z+jkFdYS0a7pJ3ShmCyNJs1X/uM=
=zJLd
-----END PGP SIGNATURE-----
Merge tag 'arm-soc/for-6.18/defconfig-arm64-fixes' of https://github.com/Broadcom/stblinux into arm/fixes
This pull request contains Broadcom ARM64 defconfig updates for 6.18,
please pull the following:
- Stefan ensures that the clk-raspberrypi driver which is now the clock
provider is built into the kernel image to satisfy root over NFS
* tag 'arm-soc/for-6.18/defconfig-arm64-fixes' of https://github.com/Broadcom/stblinux:
arm64: defconfig: Fix V3D deferred probe timeout
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
A few standard fixes here, plus one more interesting one from Hans which
addresses an issue where a move in when we requested GPIOs on ACPI
systems caused us to stop doing pinmuxing and leave things floating that
we'd really rather not have floating.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmkXP5oACgkQJNaLcl1U
h9AaBwf8DS6cv1xTWZw9YNXWgqr09UcK8ISniIIaS8h8+AZ+uWX0NFpRjMegIyUq
TQTGkSqlIF+qSslkso+lWcYRblrUmQuLzDPOCHbDqpa2Dckio8fvVbyN9dV7sk4m
4pqteHdPF8HIbys0aZvB4gPl4n8SR77Q2t9zrx7Ey6ZMOQn+AxwkxDeF6ZwMkA6W
FBZ1uY2O063IMVv4Bx79jEIlGMrWxWzQVEK8MvK10ZBp5ds8DzyflHmYEUIGr5t2
/fxqSHT8RNLnOeffI9Lch0XN3VIJ7b7Yo8hOzFzc4rdMjmtB2AtdWx6hFr2Yb99F
1rtq495LIBaGojcyfJoqVpCb+lK3KA==
=nO9q
-----END PGP SIGNATURE-----
Merge tag 'spi-fix-v6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull spi fixes from Mark Brown:
"A few standard fixes here, plus one more interesting one from Hans
which addresses an issue where a move in when we requested GPIOs on
ACPI systems caused us to stop doing pinmuxing and leave things
floating that we'd really rather not have floating"
* tag 'spi-fix-v6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
spi: Add TODO comment about ACPI GPIO setup
spi: xilinx: increase number of retries before declaring stall
spi: imx: keep dma request disabled before dma transfer setup
spi: Try to get ACPI GPIO IRQ earlier
This time it's just the one fix addressing a PHY configuration regression in the
Fuji (Meta) platform's mac3 devicetree node.
-----BEGIN PGP SIGNATURE-----
iJIEABYKADoWIQSoUT1x3bOSX/nAa8ajM9GZTrjhpgUCaQPo1RwcYW5kcmV3QGNv
ZGVjb25zdHJ1Y3QuY29tLmF1AAoJEKMz0ZlOuOGm/d4A/3wtf6Pvwg9TWI93klwL
dzGM/H/Tp7H/e9Hgx62774h9AP0V/HWc/zUP71bNdXJ5XXt5UDenxyX7Zwi6W4jU
uYMDBg==
=W+qi
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmkXmUAACgkQmmx57+YA
GNl6bw//QSCsTHTznD7Grd3pgHOw14NxwYBCGU/IifdxAo93DHkjGxsb643Z0UdZ
SBfnAX9JmSm4IGlxu597M7VyNGtQ8upXSSoWARaRgdfP/um0h8kq345pnZafy7q3
ShXsjLgZHYCWSyVHLabbrY9vWgYqLWopQ8oTDLhJ5CtwLlnLLqZW+nPpAgqsBR5F
diiygILOzURFPNX7jxHk7WBZb5MmDTNjjXPAoqUkLqbEJ2+TTAVjdys6eMNPTRcf
IjhAjpKiR4fOQnMOkTXII+lg9Jy40vgPXfeg86CCnjhWzRKhWezP/FEAxNpvgfse
8dbC0sw5kvDVGfQDjTBQQLmXvO0QtRHMQdxTxdJAuv2LLXXf6GgMD5PmEZJErb17
og8tjsQIwqBmOlRh6p/2cobxeR+JwgNMaPx8yWykME17rjDX2DLSipctl6X3tq1K
1gBeYCscQitDbRqPIy+OnpZ3D4K36Ucl3i3MSjGYcMUeSGA/i3cjYlas5O3g7Jvz
rEbpafNoO6QHylCHZ6xgJHeQzzHb8KAdUohas5qVdwz9TMBdsChC0e4RNiiFLfN3
DSPjdJxyTa4OFKYihJwjMe4HZqrGP4YsqcMFeiU0IR0fVQy93eBp4WWZUe5jd5+w
Z/gCJ5elKCPKexPjPDbkc0cvELRlVSael6gVSAb03rYcchaK69Q=
=lSRq
-----END PGP SIGNATURE-----
Merge tag 'aspeed-6.18-fixes-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux into arm/fixes
First batch of ASPEED fixes for 6.18
This time it's just the one fix addressing a PHY configuration regression in the
Fuji (Meta) platform's mac3 devicetree node.
* tag 'aspeed-6.18-fixes-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux:
ARM: dts: aspeed: fuji-data64: Enable mac3 controller
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
This contains a simple fix to mark the Ethernet PHY on Jetson Xavier NX
as a wakeup source so the device can support WoL.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEiOrDCAFJzPfAjcif3SOs138+s6EFAmkDuTgACgkQ3SOs138+
s6GwmRAAwnMHZ72PGbf1T/zvAfmEA55LBjUjX7kzZPfWh2ZCSnV/W9aDV7VvRGFv
XhYFlMdyD+hDUucSMYwjD/E4R6LdSSLjYDREAuNmgte4t3XHeY09lLUrHnBgd1IZ
D4TiMV72HP3hFB8qa6RU7QsL4RxlE5HMwYQxhnFCq04AUtJmENS9KsnT6ieh66Ri
hSN1qk/deRb2w+CryrMeXqSsZf4ZRrVq3Yh9kYErrzcf1ZOWpjLMccJzkotd9L/a
xHBCy7+ZgGiWWvV5M3T6vN0em9R8iFf6HdiCpu2/Pvs7vHkMjhmxRoazanQoGC4W
ZmTZp4j/vc2INogfwMfRyW22q7rqlwimyBHO1fMU4Z7fOcvBOhwSFFSZtfO2TGvI
s49AWuuXxkp2BogpV5HTNG/xKkGXxZrQjscW3hke8Tdni0cavbhDzTCHftDQNkh6
LUOj2Tej8l96k5GAMkdFXoxjL85n+fkTNei3D5U3M92b61FmNl8ZKkNrNqwNyF6o
c8EzuYQeqIP0BcQPG+xwgrPsax88zeD7mxejIeIpEp/nSReq94NwytADB+qTFT+C
+W6d9TsFT2gBaqm1UCxdK9vRw9TCy/hb8NVLNT6siLa3N5fXXSyR63beI617OctK
geMR3KJfDwz8mwM5c28DHL0AW6hPrNUXvBx4JkplWSmsSJANjsU=
=vGwJ
-----END PGP SIGNATURE-----
Merge tag 'tegra-for-6.18-arm64-dt-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into arm/fixes
arm64: tegra: Fixes for v6.18
This contains a simple fix to mark the Ethernet PHY on Jetson Xavier NX
as a wakeup source so the device can support WoL.
* tag 'tegra-for-6.18-arm64-dt-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux:
arm64: tegra: Mark Jetson Xavier NX's PHY as a wakeup source
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
One simple fix for a GPIO descriptor leak in the probe error handling
for the fixed regulator.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmkXPkEACgkQJNaLcl1U
h9BXIQf/Ukhvnq+eZSkfaKByc/K6Xjm/zCnFeSg+eAuvEKMSG7AardtIFPYiaudD
Ck6HLstOZ1T+3u75sfFTohSJlkokV9KojcvtbGpDrYM/937ZhPCtf8kcieZw03QQ
upMRSJySetkkrOOrJhXoE5rvL7b2dLultQMR3haJ6sshE41UU0+EcfCB6+Z6oPfc
d8Yf45J2TngMb5GD8DNxbdGX8TznRyMFMyUo6lVX3r1z+dEUTbQFOdYTQaZp9job
XUQwt24MsG3w69MQnfe0Dr+Qa7TtZx8Cnyz0i0xcSfyHOmgwUiz/NJz6BUi0chpH
J4O37MpvWSoDz6YFEe+BH7oaQkwRfg==
=gy41
-----END PGP SIGNATURE-----
Merge tag 'regulator-fix-v6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
Pull regulator fix from Mark Brown:
"One simple fix for a GPIO descriptor leak in the probe error handling
for the fixed regulator"
* tag 'regulator-fix-v6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
regulator: fixed: fix GPIO descriptor leak on register failure
A collection of small fixes. All changes are device-specific, and
nothing stands out.
- A regression fix for HD-audio HDMI probe
- USB-audio hardening patches for issues spotted by fuzzers
- ASoC fixes for TAS278x, SoundWire and Cirrus
- Usual HD-audio and USB-audio quirks
-----BEGIN PGP SIGNATURE-----
iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmkXPLcOHHRpd2FpQHN1
c2UuZGUACgkQLtJE4w1nLE+9jw//e/vre+F6Pv8HcL7QjXp+9d5/sNvDG04sHONy
jIewcedg1AkFHVynLMKJqwjgdo6/lEJ/sJRh/40uYvm1NoYhu86M6zFQZg4YABIe
bFEpRsCv1nS4UwxsgGggAemlJHKsg4xvhmw533eSatDXuo7Evwl9PG31VNJBweXV
CJiIgqKa4lJHCRNcffzHOEj3YzACwNn0GfRHHzGgwyfO7bStMT3hgptzeEfT8vhe
op/tG3V5bICRE6gBTK1A4p0RCwHwRYXsLCQITgzPcbJgBYaS7+KoCQJlnIwRqQfN
F5qij0QuNzR+tR9SvNBZo2c+PYdFTroIoesXXpz2EJb5LdijOOUlj+QyXJz41nON
FzUfrtQKoWfBk+7CgUT0gmDjp9ZthwJSjCUxPenuhamXl5/Ug3wTJMuhhxts1zBg
dY6E92p9fvk8TgATiKp01LSTcemwcTSMol+288eh5/8DbUHdn0OgFp6lxIO05M3E
yq3IBsc+cimii2iHUd1XeHJZQbBq4RE+rCgU2qUce0bZctPw/NVLzPJefrVxjDzS
MnPkJtktQIZBhRmuOwMn6E2ZezprGR63X/nfe2sOA4f6+POB3NPCDdKjNkT9AoSj
Fg1qjUSGfM9R6YI3+6vN4Brx8USW5C0FmQZ81VjAkkWfZpGFI59loMi9jHWH3o04
zZpuGUo=
=Mj01
-----END PGP SIGNATURE-----
Merge tag 'sound-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"A collection of small fixes. All changes are device-specific, and
nothing stands out.
- A regression fix for HD-audio HDMI probe
- USB-audio hardening patches for issues spotted by fuzzers
- ASoC fixes for TAS278x, SoundWire and Cirrus
- Usual HD-audio and USB-audio quirks"
* tag 'sound-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series
ASoC: rsnd: fix OF node reference leak in rsnd_ssiu_probe()
ALSA: hda/tas2781: Correct the wrong project ID
ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd
ASoC: SDCA: bug fix while parsing mipi-sdca-control-cn-list
ALSA: usb-audio: Fix potential overflow of PCM transfer buffer
ALSA: hda/tas2781: Add new quirk for HP new projects
ASoC: tas2781: fix getting the wrong device number
ASoC: codecs: va-macro: fix resource leak in probe error path
ASoC: tas2783A: Fix issues in firmware parsing
ASoC: sdw_utils: fix device reference leak in is_sdca_endpoint_present()
ASoC: cs4271: Fix regulator leak on probe failure
ALSA: hda/hdmi: Fix breakage at probing nvhdmi-mcp driver
ASoC: da7213: Use component driver suspend/resume
ALSA: usb-audio: add min_mute quirk for SteelSeries Arctis
ASoC: doc: cs35l56: Update firmware filename description for B0 silicon
-----BEGIN PGP SIGNATURE-----
iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmkXIOsQHGF4Ym9lQGtl
cm5lbC5kawAKCRD301j7KXHgpsIqEADcP2pYgNZO2N2PcaeCng6JIb0MS306fG+G
d+NiBXFzW4jJ95o681aaXDdnf5iJhZXsENV5E9Dze6iYilzgCbypD48cSH0k3V89
O97DDmvfzv09fcsiCd5bqLOQIcYwbaWHOrIlvK4cypYNlTVP4aO7ZpkbkgT7BLa3
YZGLsPP7JEdA1qqEOm1MoC1ghDXBx5ztkJsY6eYUpisc5zQY8H+68ELdQB+EP9KY
MESvRsRby+Z2fwtg964Bz4VWBbqHH8tn3PhkO46DRuL6DAa6CO1gLHrNSFliQPU6
ib9SGA982uy9fcV8l2hQcFM20LmwVYPPfR2XEWpPtYWy7AH7Mg635RHTXp0RZfGq
5xmd/EBrZwWJIiqSrT2pAKnZMnsQzI/cWzfz0nhLGZeSpR68AS04HcQJ/utS/X0n
VCVyBeRWEo4kB4pM41VCA6qispLBp2mIBeqNJow8+ydmIaysBEHsaFWlSrCRrixW
GL0y05v3l/51vNgPmT839htW7sFfRqIO/Fp0arC/MKClAMhmy/dlRWaRG6T+Dz87
KA98nDvVig7LVbMpN4WaBu1zUQRY/VZpzuAFxfn7mo6TKKaEnEg3/mgH453tuOEB
OYrZS8Fw+3MQ0OPzlJM0MRsNu+jpd0CsztfYBiFy/cSVy50uDSO7gZsbXWL9zEBk
W5KvXNiawQ==
=sIJv
-----END PGP SIGNATURE-----
Merge tag 'block-6.18-20251114' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull block fixlet from Jens Axboe:
"Been sitting on this one for a week or two, planning on sending it out
when there were other block changes for 6.18. But as that hasn't
materialized in the second week of sitting on it, let's flush it out.
A previous commit updated my git tree locations, but one was missed as
it was already set to the git.kernel.org one. But the git location swap
also renamed the actual tree from linux-block to just linux, let's get
that last one updated too"
* tag 'block-6.18-20251114' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
MAINTAINERS: correct git location for block layer tree
-----BEGIN PGP SIGNATURE-----
iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmkWeqcQHGF4Ym9lQGtl
cm5lbC5kawAKCRD301j7KXHgplM6D/4jSqj7PedcnEDHNKHJR/0v5wSQWMugD0hg
Xn1EFnmPJMLBacZrkobL3v6aCvA4WYQManc1VPdC94b9ofdbjDMVtcIDoljBXuAD
A94kk4TiIsHzKn8Un5bprC20Xc/v1pQ3uFERtK7mnonGb6n+/RITIQuWqn/Fey3N
58K7njnInQXDS2U6rx4QTdyuyrg6EHHIoNh1GmKdQgSY1kcJnQz4C+Yrh3qIBlTV
AEWkoIwSp15hXvmn8J4nvbbFEZypg0qTaBREdc7KXt8kPMNCLqQ1Z4FOXYDt0qo1
zm88Z/08mwXbxFLtfse8JJ7XHPgy1+G0rXmdwv4F6CEtCyklnChLynrTpqUK5FCH
pvuzOfA3tPcyg6dgc7X2z40u3g+vISydjprs9m5eL6hgovDhH+EfDGzpWxUzuuNe
AXNXb3N9ZrxZePGfAweW2BxZ+D2OwYdQjKWSrL+438Tb3Q8QiiYCwM7eLyl0kXKH
QpjJJsbIEJgLXYRVHE5tu0XdMdYsZYZYUv0wVACQ0hw+EtgaNi2yjySBvRJUJPzZ
sL6Lnu5UzbEqSf1y8YGcdCCvOgHc6CHFAdKMgz0CXUcRC+ftmGz4iEXhGJJdMemQ
6WRLvsRykF1FO93dpfaIjWv9k/d40cGt5LrjiINfb36NDlqBth+EY+HbSJHBDI54
p2wDeoP3Kw==
=sd1e
-----END PGP SIGNATURE-----
Merge tag 'io_uring-6.18-20251113' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull io_uring fixes from Jens Axboe:
- Use the actual segments in a request when for bvec based buffers
- Fix an odd case where the iovec might get leaked for a read/write
request, if it was newly allocated, overflowed the alloc cache, and
hit an early error
- Minor tweak to the query API added in this release, returning the
number of available entries
* tag 'io_uring-6.18-20251113' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
io_uring/rsrc: don't use blk_rq_nr_phys_segments() as number of bvecs
io_uring/query: return number of available queries
io_uring/rw: ensure allocated iovec gets cleared for early failure
A test case for a situation when widen_imprecise_scalars() is called
with old->allocated_stack > cur->allocated_stack. Test structure:
def widening_stack_size_bug():
r1 = 0
for r6 in 0..1:
iterator_with_diff_stack_depth(r1)
r1 = 42
def iterator_with_diff_stack_depth(r1):
if r1 != 42:
use 128 bytes of stack
iterator based loop
iterator_with_diff_stack_depth() is verified with r1 == 0 first and
r1 == 42 next. Causing stack usage of 128 bytes on a first visit and 8
bytes on a second. Such arrangement triggered a KASAN error in
widen_imprecise_scalars().
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20251114025730.772723-2-eddyz87@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
The usage pattern for widen_imprecise_scalars() looks as follows:
prev_st = find_prev_entry(env, ...);
queued_st = push_stack(...);
widen_imprecise_scalars(env, prev_st, queued_st);
Where prev_st is an ancestor of the queued_st in the explored states
tree. This ancestor is not guaranteed to have same allocated stack
depth as queued_st. E.g. in the following case:
def main():
for i in 1..2:
foo(i) // same callsite, differnt param
def foo(i):
if i == 1:
use 128 bytes of stack
iterator based loop
Here, for a second 'foo' call prev_st->allocated_stack is 128,
while queued_st->allocated_stack is much smaller.
widen_imprecise_scalars() needs to take this into account and avoid
accessing bpf_verifier_state->frame[*]->stack out of bounds.
Fixes: 2793a8b015 ("bpf: exact states comparison for iterator convergence checks")
Reported-by: Emil Tsalapatis <emil@etsalapatis.com>
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20251114025730.772723-1-eddyz87@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Commit b6bcbce335 ("soc/tegra: pmc: Ensure power-domains are in a
known state") was introduced so that all power domains get initialized
to a known working state when booting and it does this by shutting them
down (including asserting resets and disabling clocks) before registering
each power domain with the genpd framework, leaving it to each driver to
later on power its needed domains.
This caused the Google Pixel C to hang when booting due to a workaround
in the DSI driver introduced in commit b22fd0b963 ("drm/tegra: dsi:
Clear enable register if powered by bootloader") meant to handle the case
where the bootloader enabled the DSI hardware module. The workaround relies
on reading a hardware register to determine the current status and after
b6bcbce335 that now happens in a powered down state thus leading to
the boot hang.
Fix this by reverting b22fd0b963 since currently we are guaranteed
that the hardware will be fully reset by the time we start enabling the
DSI module.
Fixes: b6bcbce335 ("soc/tegra: pmc: Ensure power-domains are in a known state")
Cc: stable@vger.kernel.org
Signed-off-by: Diogo Ivo <diogo.ivo@tecnico.ulisboa.pt>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://patch.msgid.link/20251103-diogo-smaug_ec_typec-v1-1-be656ccda391@tecnico.ulisboa.pt
Add a call to put_pid() corresponding to get_task_pid().
host1x_memory_context_alloc() does not take ownership of the PID so we
need to free it here to avoid leaking.
Signed-off-by: Prateek Agarwal <praagarwal@nvidia.com>
Fixes: e09db97889 ("drm/tegra: Support context isolation")
[mperttunen@nvidia.com: reword commit message]
Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://patch.msgid.link/20250919-host1x-put-pid-v1-1-19c2163dfa87@nvidia.com
driver_find_device() calls get_device() to increment the reference
count once a matching device is found, but there is no put_device() to
balance the reference count. To avoid reference count leakage, add
put_device() to decrease the reference count.
Found by code review.
Cc: stable@vger.kernel.org
Fixes: a31500fe70 ("drm/tegra: dc: Restore coupling of display controllers")
Signed-off-by: Ma Ke <make24@iscas.ac.cn>
Acked-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://patch.msgid.link/20251022114720.24937-1-make24@iscas.ac.cn
syzbot found that cls_bpf_classify() is able to change
tc_skb_cb(skb)->drop_reason triggering a warning in sk_skb_reason_drop().
WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 __sk_skb_reason_drop net/core/skbuff.c:1189 [inline]
WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 sk_skb_reason_drop+0x76/0x170 net/core/skbuff.c:1214
struct tc_skb_cb has been added in commit ec624fe740 ("net/sched:
Extend qdisc control block with tc control block"), which added a wrong
interaction with db58ba4592 ("bpf: wire in data and data_end for
cls_act_bpf").
drop_reason was added later.
Add bpf_prog_run_data_pointers() helper to save/restore the net_sched
storage colliding with BPF data_meta/data_end.
Fixes: ec624fe740 ("net/sched: Extend qdisc control block with tc control block")
Reported-by: syzbot <syzkaller@googlegroups.com>
Closes: https://lore.kernel.org/netdev/6913437c.a70a0220.22f260.013b.GAE@google.com/
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Reviewed-by: Victor Nogueira <victor@mojatatu.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20251112125516.1563021-1-edumazet@google.com
The irq_domain_free_irqs() helper requires that the irq_domain_ops->free
callback is implemented. Otherwise, the kernel reports the warning message
"NULL pointer, cannot free irq" when irq_dispose_mapping() is invoked to
release the per-HART local interrupts.
Set irq_domain_ops->free to irq_domain_free_irqs_top() to cure that.
Fixes: 832f15f426 ("RISC-V: Treat IPIs as normal Linux IRQs")
Signed-off-by: Nick Hu <nick.hu@sifive.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://patch.msgid.link/20251114-rv-intc-fix-v1-1-a3edd1c1a868@sifive.com
When a zero ASCE is passed to the __ptep_rdp() inline assembly, the
generated instruction should have the R3 field of the instruction set to
zero. However the inline assembly is written incorrectly: for such cases a
zero is loaded into a register allocated by the compiler and this register
is then used by the instruction.
This means that selected TLB entries may not be flushed since the specified
ASCE does not match the one which was used when the selected TLB entries
were created.
Fix this by removing the asce and opt parameters of __ptep_rdp(), since
all callers always pass zero, and use a hard-coded register zero for
the R3 field.
Fixes: 0807b85652 ("s390/mm: add support for RDP (Reset DAT-Protection)")
Cc: stable@vger.kernel.org
Reviewed-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
The PureAudio APA DAC and Lotus DAC5 series are USB Audio
2.0 Class devices that support native Direct Stream Digital (DSD)
playback via specific vendor protocols.
Without these quirks, the devices may only function in standard
PCM mode, or fail to correctly report their DSD format capabilities
to the ALSA framework, preventing native DSD playback under Linux.
This commit adds new quirk entries for the mentioned DAC models
based on their respective Vendor/Product IDs (VID:PID), for example:
0x16d0:0x0ab1 (APA DAC), 0x16d0:0xeca1 (DAC5 series), etc.
The quirk ensures correct DSD format handling by setting the required
SNDRV_PCM_FMTBIT_DSD_U32_BE format bit and defining the DSD-specific
Audio Class 2.0 (AC2.0) endpoint configurations. This allows the ALSA
DSD API to correctly address the device for high-bitrate DSD streams,
bypassing the need for DoP (DSD over PCM).
Test on APA DAC and Lotus DAC5 SE under Arch Linux.
Tested-by: Lushih Hsieh <bruce@mail.kh.edu.tw>
Signed-off-by: Lushih Hsieh <bruce@mail.kh.edu.tw>
Link: https://patch.msgid.link/20251114052053.54989-1-bruce@mail.kh.edu.tw
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Add the minimum Entrysign revision for that model+stepping to the list
of minimum revisions.
Fixes: 50cef76d5c ("x86/microcode/AMD: Load only SHA256-checksummed patches")
Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Cc: <stable@kernel.org>
Link: https://lore.kernel.org/r/e94dd76b-4911-482f-8500-5c848a3df026@citrix.com
The register addresses of ADP5585 and ADP5589 are swapped.
Fixes: 75024f97e8 ("pwm: adp5585: add support for adp5589")
Signed-off-by: Luke Wang <ziniu.wang_1@nxp.com>
Acked-by: Nuno Sá <nuno.sa@analog.com>
Tested-by: Liu Ying <victor.liu@nxp.com> # ADP5585 PWM
Link: https://patch.msgid.link/20251114065308.2074893-1-ziniu.wang_1@nxp.com
Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
The xfrm_add_acquire() function constructs an xfrm policy by calling
xfrm_policy_construct(). This allocates the policy structure and
potentially associates a security context and a device policy with it.
However, at the end of the function, the policy object is freed using
only kfree() . This skips the necessary cleanup for the security context
and device policy, leading to a memory leak.
To fix this, invoke the proper cleanup functions xfrm_dev_policy_delete(),
xfrm_dev_policy_free(), and security_xfrm_policy_free() before freeing the
policy object. This approach mirrors the error handling path in
xfrm_add_policy(), ensuring that all associated resources are correctly
released.
Fixes: 980ebd2579 ("[IPSEC]: Sync series - acquire insert")
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
A small collection of fixes, all driver specific and none especially
remarkable unless you have the hardware (many not even then).
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmkWOIUACgkQJNaLcl1U
h9D44Af9FaCTkAF1pCMuw36hVgMtzGRV7E1rQ6o7qFbt3GEhULSXdjg8i/lLZA2t
NHOgYpm0CS9F6/IordghPsXuC4OZGB6BILTWLdgA9beeMYaQJu5WuthXeIKunvio
vWd4hOcdzhxA+ikjkxLAX/lkHC+ca2GQOV/X6Ivd3J6OcY0kSZCq/2zlqEAF/nZo
W0WUc7ym3K5IPA634/5syidfb+Ai+o78O/9vZvWnTfJDgVOo/QzttVXsLigf1k6t
vUH9gPf94h7wo6UxZy1MIkV/IGeE7E/raClJM7oobU3C2+MqfDMzz77T3UfnVhFJ
x4kkTfmWYApaBXj4Wr/XewA1oEgIIQ==
=WFOO
-----END PGP SIGNATURE-----
Merge tag 'asoc-fix-v6.18-rc5' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus
ASoC: Fixes for v6.18
A small collection of fixes, all driver specific and none especially
remarkable unless you have the hardware (many not even then).
Uninitialized pointers with `__free` attribute can cause undefined
behavior as the memory assigned randomly to the pointer is freed
automatically when the pointer goes out of scope.
qcomtee doesn't have any bugs related to this as of now, but
it is better to initialize and assign pointers with `__free`
attribute in one statement to ensure proper scope-based cleanup
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/all/aPiG_F5EBQUjZqsl@stanley.mountain/
Signed-off-by: Ally Heev <allyheev@gmail.com>
Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
