Both mt8195-afe-pcm and mt8365-afe-pcm drivers use devm_pm_runtime_enable()
in probe function, which automatically calls pm_runtime_disable() on device
removal via devres mechanism. However, the remove callbacks explicitly call
pm_runtime_disable() again, resulting in double pm_runtime_disable() calls.
Fix by removing the redundant pm_runtime_disable() calls from remove
functions, letting the devres framework handle it automatically.
Fixes: 2ca0ec01d4 ("ASoC: mediatek: mt8195-afe-pcm: Simplify runtime PM during probe")
Fixes: e1991d102b ("ASoC: mediatek: mt8365: Add the AFE driver support")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20251020170440.585-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
- A bug caused a kernel panic when reading enabled_monitors was reported.
Change callbacks functions to always use list_head iterators and by
doing so, fix the wrong pointer that was leading to the panic.
- The rtapp/pagefault monitor relies on the MMU to be present
(pagefaults exist) but that was not enforced via kconfig, leading to
potential build errors on systems without an MMU. Add that kconfig
dependency.
-----BEGIN PGP SIGNATURE-----
iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCaPqYBRQccm9zdGVkdEBn
b29kbWlzLm9yZwAKCRAp5XQQmuv6qrZjAQC02FScGQM+TTQ2kvIFAscKEfZddks9
iiodkKWxMTZoxwD/VxXKQUD8CP2HW9uSpJw/O3Zv+NAU80Eq8V2f7/0d9gw=
=AnZN
-----END PGP SIGNATURE-----
Merge tag 'trace-rv-v6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull tracing fixes from Steven Rostedt:
"A couple of fixes for Runtime Verification:
- A bug caused a kernel panic when reading enabled_monitors was
reported.
Change callback functions to always use list_head iterators and by
doing so, fix the wrong pointer that was leading to the panic.
- The rtapp/pagefault monitor relies on the MMU to be present
(pagefaults exist) but that was not enforced via kconfig, leading
to potential build errors on systems without an MMU.
Add that kconfig dependency"
* tag 'trace-rv-v6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
rv: Make rtapp/pagefault monitor depends on CONFIG_MMU
rv: Fully convert enabled_monitors to use list_head as iterator
Masahiro Yamada stepped down as Kbuild and Kconfig maintainer in
commit 8d6841d5cb ("MAINTAINERS: hand over Kbuild maintenance"),
leaving Kconfig officially orphaned and handing Kbuild over to Nicolas
and myself. Since then, there have been a few simple patches to Kconfig
that have ended up on the linux-kbuild mailing list without clear
direction on who will take them, as they are not really sent to anybody
officially, although the list is obviously watched by the Kbuild
maintainers.
Make Nicolas and I official maintainers of Kconfig in "Odd Fixes"
status, similar to Kbuild, so that the subsystem has clear points of
contact for contributors, even if significant contributions may not be
accepted.
Additionally, add the Kbuild tree to this section.
Acked-by: Nicolas Schier <nsc@kernel.org>
Acked-by: Randy Dunlap <rdunlap@infradead.org>
Link: https://patch.msgid.link/20251023-update-kconfig-maintainers-v1-1-0ebd5b4ecced@kernel.org
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
for 6.18, please pull the following:
- Peter describes the VGIC interrupt line such that KVM can be used on
Raspberry Pi 5 systems.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEm+Rq3+YGJdiR9yuFh9CWnEQHBwQFAmjtOFUACgkQh9CWnEQH
BwQBPA//Vprvr5vayscbrpCdKkzpvSIR1S5TRn8DUfVsW6qjniPsjSLn16NN/uDp
6KuC7DQYg5w0QIbEwsGFr6m8byTRgckDcYTHmE95FRTcVfvnZAozbI27WZDjj3z6
4uSRxgDhST9QK2XFD5N9+uTqXG09UrH/Re3UBVUgrJwUto2LHaH58SS5njrNunmW
TtNPYDvhYWASlT6kHAG0Y2LaqRaBnykAbE3scr1Bds3EzNds9BdOh4JmaN55lqci
fp4cOiIc0Zj8IAg+QZH4bWI0ap9YnDIQJrPfx/atgfLpMqKAAKOWo/XZ+Q8B/iUd
bfqggHTHNszVJIl8vMHccfAG3gsYPRxtzK3NmP9T375xJnLH+7ke5oEmfMh6Gwzd
WpuFQf7INpKYP/558HNyLW5oCB8EvgG49PyWsamSlX7BVOEvUFiAbEPGVFaf8IV4
EDDSlyg+E3XiTF9O87QxeFnAmHwPDT6cB7ru+xbPai9kdWegx35RNPFxGfHWnKaO
mp2K+lHwkUZfcyllU4JecGvFGFr+MY5WTZCO6qpdNmvO8Jw7ST9lYQhfb1Kw3BWO
MoV23+uPMd5IbciI4jKM0OmskkZT0cHfrsqtF7qkEWDoZJLUfFpBQnUETVEs0pHX
JE7dg82ZOjUAfQw2y9Ie9gVz2F3cTXNZ5jvdximhhqp4kpkHoEE=
=4aSE
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmj6kHMACgkQmmx57+YA
GNn2tg//cdqODIOrDtkRVkNDRpdoCnVtoMI+gE/S4hujOd1zd9CvNGryHoabJjnV
WVZ+CR0nU893hKrJ3j0sYMbeTjrSA5ZkmF5CsRyBKpy2l2REH/32JhjwVYryIgHL
s8kXHDaNyRl1YXEeXc0S4G8larU8gJjceiuAiB7ECJ/AdPV3VcD5mkq6OcXPB/Zz
KtwkIcoFsjL96QNNlXvk6n0MSuH04oHA4H1zxuCU7nJiEM5RJvH6mMUcya+Ot16e
LJlLEiG5sdCMzIp4rDabEoV6CBptLHnk1zdhByZS5Wetuf0oyW7TzFO1znm/ZwPR
AYp/K1rzIrcvtiufM/wJZ2id07szUx/EGisFRmRPWFhZlkjwbUg7YtflxmdphqMJ
UQF5WEprJalZPLCSg8Tcorgg4vKIqKe7RDeLIvv2oqWXCPGgScBPpyVuYuZANU0X
l1yuGBG0sqlF1b+fgKXtIu++SuRuHSqWPSiNiuj/4CM5omZlsVjrvPc8YKVDWKXQ
f9xTs+YsbY7+PtdU3LpeAEOXLDgiL7Ch5G8k6nnY/O2k+NEg66axBaQ2lv7cFf66
1b80cftYTv5Po/dovI1vTIC9ycut+xu8n5motFXH2Zwk0xsck2BAWqBy9n+QJXCo
hVzbRNezwWsw51FuMvk32VmOTKb5sBmtTQAKmq+o/FFlc/9MQIs=
=5veY
-----END PGP SIGNATURE-----
Merge tag 'arm-soc/for-6.18/devicetree-arm64-fixes' of https://github.com/Broadcom/stblinux into arm/fixes
This pull request contains Broadcom ARM64-based SoCs Device Tree fixes
for 6.18, please pull the following:
- Peter describes the VGIC interrupt line such that KVM can be used on
Raspberry Pi 5 systems.
* tag 'arm-soc/for-6.18/devicetree-arm64-fixes' of https://github.com/Broadcom/stblinux:
arm64: dts: broadcom: bcm2712: Define VGIC interrupt
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
6.18, please pull the following:
- Stefan switches the V3D block to use the firmware clock, rather than
the bare metal clock. This fixes hangs on boot after recent changes to
the V3D driver clocking went in.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEm+Rq3+YGJdiR9yuFh9CWnEQHBwQFAmjtOAIACgkQh9CWnEQH
BwQSaQ/+I3bSYTyUX0VufFlcGZkS1klGNjLppijn8Vm/4i1rWYOFnkRHjOaXS0Zy
gBgyke7FaqGGFf40pgucVYsC8LmcOu2mQ72NjNcbSNpwbCn9/1vG+FMeVjne+zij
r7ICmKYwLf8vHbMwI+ggkd50muW1xhjPe7CPZn2Qj6FApAzvUW4s8W9TKj1DqzsS
tIEuQbYup96VoFLS8sL5BcNbkVkvkriQ9Zk/p8DzgdVh72F0i7u2d01/Lj9Mktlr
nfFBE9EWRrudkEi6HdVxyHORfF69Zt+/3zE8Q7b+3u/PpQWE7f+bQWMK8hT+ukvu
b5br9K35w4oC5Zsy+9CIsnkagYvgw3VrPBybguqmQZ0rjuEuJK4VX7vRkywpZ3Al
GFC+dCtljeK3kD1cXREhwxfBqLGlnUeU6Wauii6A82HRSfSKpFg9n7yFsoqiKUyL
YgEm9eg0fihlJ0DL/C96K75Qez+x9aaD+P4cXZED3M4P+ovme2vV7viIPUKFvpzI
5sCl9jW7kvEJoN7t0Y9cDzYQwFTbvc1l/g+zF4qAV9H5tgUBNoi5ha02VbAduk9C
M+JfMYYUM875wH1WTcm51iUGN6xsKIGbHxXzOEztipePwatst5/ancRAoGNq2Zjs
m7rdmHhUoCCSxxo1jsN1O+tuZWjIvfwjAR7d2i3ToZiJbhfz4Us=
=3g/p
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmj6kGcACgkQmmx57+YA
GNnryxAAjU4l7AgkepcXlOdya4LpQZXmKQICOSo78QSbnFdqW7Y7DHGU/uUVI1JH
C7A+keTUCiVSvyfUKkRY/bDn57MPoK7HJwquGqPdqD9F8BJJBciVmiaUlXiF+K5u
Z17dY5n9TjAu6HeH/2e+wuoK9qWHe3SSTaopC667so1gw/c0ZnKEVeAruDCu3230
+ZJ08VUDQta8Ti9bojee2G67aS/kNdSCQCWKaDErp233bJcq89VTsbQ6/1HGdWA+
Xwh12zZCTB7mcOZmxA0WzEOxR30LkrKnwZlxW52X0O1aNzZt5qQeagSfdtcSR7hS
gkvql/Dolw3qPbBsSfT/DVUxSqPvSxevY6k4Q5Wsh/gjzEf1NZxQd58/8LaZq+dS
TWYpoOlOEoNWAH7P+vBWX6lKkM/XJhn/PugBk6/+QnRdhcAZL7tWUN0vNFQ5Is9K
FBh6RMKBmy7jpEtY5/1YdCDjBdmd5FsoFbM7i7sQTTtY4PsLYAzWVXRB2021dxZ7
S6OqEZxHsMQLmb3/V+3GQiqYkOrtwjzFWo5ELo+yks58lxYHf+Y2DLfNGMJr+Cry
hLU7adMDxDxKWeC1J/RumdgFp6crsDkFMbGui/vUmoNXdVtT0akjfUQteB2CdzRG
iPsEARJiqNZ6dnVhdIRs9GKFMLMb0r1A+20Oi0cEWmwlbO0y+nc=
=O7I1
-----END PGP SIGNATURE-----
Merge tag 'arm-soc/for-6.18/devicetree-fixes' of https://github.com/Broadcom/stblinux into arm/fixes
This pull request contains Broadcom ARM-based SoCs Device Tree fixes for
6.18, please pull the following:
- Stefan switches the V3D block to use the firmware clock, rather than
the bare metal clock. This fixes hangs on boot after recent changes to
the V3D driver clocking went in.
* tag 'arm-soc/for-6.18/devicetree-fixes' of https://github.com/Broadcom/stblinux:
ARM: dts: broadcom: rpi: Switch to V3D firmware clock
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
This series contains a set of small, focused fixes that address
robustness and lifecycle issues in the Arm SCMI core and debug support,
ensuring safer handling of debug initialization failures, correct flag
management in raw mode, and consistent inflight counter tracking.
Brief summary:
- Fix raw xfer flag clearing
- Skip RAW debug initialization on failure
- Make inflight counter helpers null-safe, preventing crashes if debug
initialization fails
- Account for failed debug initialization globally
There is no functional change for standard SCMI operation, but these
fixes improve stability in debug and raw modes, particularly in error
paths.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEunHlEgbzHrJD3ZPhAEG6vDF+4pgFAmjvtCIACgkQAEG6vDF+
4phtFw//em6TYEkBTgJVq94ULfLcuzOVRwH+WmhK1VaXKz0jLlzrN6sVEiJnwQA3
p9gDIJ+TjXozgVZzBa5eZIfeP/BmbPSPtsSGDlvhQl5smT4r/CG7fS17VhFNGx/o
6DYP8X44Fx3qGuDe3tJiuw9F7IaXmDE03uslD7a9MdtPR2K1KwfD/Y6fXmZbx36B
M67E48dyWQymE0gDnYupQtUe7+JENDHYXuLySMfAEjk7+Fjis/u5aFXH2aCWAM5P
PV1VVAq4f8QEs2sI3Lwd45cJsYBu4dEpKTTWEpBc1vASkdFhUIXJ9FUKVvNunwi1
yW038FsyRsmnc+4Aq7Aj0hAJsyaFEogHMS6zqoTX/0QGjKPdrHgS+CkBNk7OTDyo
WlBAi4HbInIzYDC8tbo1hiXBvcZzZnPvbFCEpi521W1bJN79hhflC09mNg5uRI+T
obkmVMjlYq4vH+kY56cfVTVoejG38T3S5UYp97NmmP4/ilxpJ7oeoSLO3vC2IE7F
GN9mOqHpbwdpN4zN259bepBkrRbySUlPi9MB+HvdBJZqxEbedkuOPtBQUiYA2Opf
Xcg1WcHEdImrMyjJkYPk92MtWaHpTDZ6WlKe00oK7YJS+qpNaO5uOTvtbtOZsMwW
MBvrdxBBcmZpZiosjMQPNXHMi/P8UeswLBrjqjzznUnwteOLyUE=
=2mq1
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmj6kE0ACgkQmmx57+YA
GNlItw/+KprSMkb+gVY8DgCgMXpku4ObDwryI16UbBxjIVlLlhE0mc58vooY43nz
NQLZ9GU7rQygVr8mEK0LxWMt7Fm0x8w/omvwgsKuPVifNCGWEvOlEXqJGGLoThGB
msU3CJDPDo0C3bgXDu9sbQZOxEYMnIwqnBzUuuzHxiftGP14XevSjy/dlCjSRy0K
DlfIxZaQY0Rwhe5XoH6TLC99QHNRvvP1MmoMyerzTi91Lwvcx98URgZta7N230Me
R9uQLStxKyBRDIW+Z0uDnCDAltQvy3UHtGd240GS9aK1Cs2tbBQ9G79hHEMfj/us
N7cgDFZHEHuTk8d71bMSiwmoQLFsmjbAAS6pBUbE3K3WP76w37N7/cIA78WVvG1O
FcIDM0cTePHimlI9bDF12GJ1tT6punh6NtjBJVGx1NIjo9LFJaTx1rBC/BgQzIY7
Um1eF76/ciZK3gOnlPRrYSuAEIhoPSxRIgOBlWLCuAZmjW5v/F3SdqNPkZ8i5Oo/
PkJEIPIT2nFEtvGg34RcRsh/9OtGQi03HM7/iFuc8dCUuJDwj/h7luN5FOCwcQqE
Cu1eEqWIWiE0rdI4pjmzTXRHqH8LrWk7oTakrvL9WWGdjF72Ceay3Z0disFDPN1c
85N5mXohiznQsdv+p62DnyW4ZoRn6uOy9YpJjRAN+5PezV5nXDc=
=12z8
-----END PGP SIGNATURE-----
Merge tag 'scmi-fixes-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes
Arm SCMI fixes for v6.18
This series contains a set of small, focused fixes that address
robustness and lifecycle issues in the Arm SCMI core and debug support,
ensuring safer handling of debug initialization failures, correct flag
management in raw mode, and consistent inflight counter tracking.
Brief summary:
- Fix raw xfer flag clearing
- Skip RAW debug initialization on failure
- Make inflight counter helpers null-safe, preventing crashes if debug
initialization fails
- Account for failed debug initialization globally
There is no functional change for standard SCMI operation, but these
fixes improve stability in debug and raw modes, particularly in error
paths.
* tag 'scmi-fixes-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux:
firmware: arm_scmi: Fix premature SCMI_XFER_FLAG_IS_RAW clearing in raw mode
firmware: arm_scmi: Skip RAW initialization on failure
include: trace: Fix inflight count helper on failed initialization
firmware: arm_scmi: Account for failed debug initialization
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
The FF-A driver was updated to support specification version 1.2 but omitted
support for the 16-byte implementation-defined (IMPDEF) field introduced in
FF-A v1.2 within the Endpoint Memory Access Descriptor (EMAD). This omission
breaks all memory interfaces.
This change updates the EMAD sizing and offset logic to correctly handle the
FF-A v1.2 layout while preserving backward compatibility with older versions.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEunHlEgbzHrJD3ZPhAEG6vDF+4pgFAmjvqvQACgkQAEG6vDF+
4pjTlBAAqdtLdU5yPTZF5twgMD0FFIZYXKAFrp6u9DuSAnI8bJkMuLdl67SFarSP
csOOLg8OmHCmRIQ0I45UGUbz+IfgxzBIPi/A9zxxAVuOzMgWH5aE6zewlH01bz+X
sfxsN/zluj2jF/WgDDH0vMsUwYDancfJBvm9Smf7mLuaHEo5KQJiqWPnMIgApyZL
dx0Lh54cB3DYUHxZi7yE8ZOrzqKIwnGrzL020npcHLUCCZFdPi2kDMYhFVDqH32r
X0PoYKHuclG3PnWZOLRzYr0n+FnsNMip1Cx52dPkzeOiNdB+rH39e3/Mba0FQ4yt
2cTHV6kjXvACCbYKVoZHATeBXrX8HBYnn12x90OUYDxGlbMnrQpDBvVSRdUnZ74g
CQ3k2E8dH8IvSY+z4Yixh1BYmF0n1kkcJTjJ92DfF1GsN5QNO0wv7S24p4mdweu6
YOhI7WcvRrFMudrsgds9i0BtJpHgKv7sWcdJRD8h0riTiF2vsjWwTPBEWgf7j2+T
1/IWWvjgDr1CrBib2+3eHRlMdmUqOqxStFmFz8GrnTvHoZr2LVTEhr4hJ/vopuB2
N/4mf5naoDepnmDd+CtAdjnYFGbiwlOc/o4jDk2vPhcBcryvPMXfeYKrNye6lHCH
4l8S8KcMwUf+Hvn4seEFoqt8XP3HHC9Ru2mZRXCZA5C1z2VbqoQ=
=RowC
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmj6kD8ACgkQmmx57+YA
GNl6Rw/+Ipy2jWp+QD5uWb7isFoiUYicxYlIfqxRO9RvNLTflDJ5vt4V2O5uwxmH
hSg3NCUYr103kQey51y2i2efWHILpCX394kNqPZv3g9pYdFBJbqMSfUXeawJjeMu
4Jn14kPzfb2zxXH88Y3NbkGT3wAlI00UAZTPT5pBGe5MWncptJTk1EJRZAdA5cV/
D8oL1DEuSQjHXhkn46uaIepIG42AMX27PwwjHIGD+UfNHleaRI/c2mff68Pcm1kv
9WDnC2RXnXRn5Z6XlskvcGp/fKQ/6mUSgOxPfB/sXCAMn/iwx+kDkgvemprEo2yR
pi8YZ40+p4FYpyZ8oTIu0v4brwWeoJpf9qTQ7aRig5UD8cFLm/eKA5tjWIaDvhzx
+d89PYGDRHApPZI4r8BIo1FjJFxooEnfb3gbGhrvqk1VNm5PIGtyySMzr0p9Y+TN
iNwjzJxE6Pga6RBu3uxGPbinqVqqVndwYJPJ8UW8Ur3xFyXpWgF/ltAo4cU0M6VN
GvmyEn4tWkNaV9/xU98gB0rNmcZI3IP9DptWlm5lqu7aw3vXadMlJ7y7VFpKYmcZ
kKrKnHkoxs/B/vVpV3nvoFptelfxkSfrJP6VUGAX7FZiPlZ2jtmDLzGz7scxQtNy
hT4Ccx0DHIPSfRrFCCeL9NAdE2nomJYRAZwnKQ4a9EHvA6FCrJ4=
=ChU3
-----END PGP SIGNATURE-----
Merge tag 'ffa-fix-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes
Arm FF-A fix for v6.18
The FF-A driver was updated to support specification version 1.2 but omitted
support for the 16-byte implementation-defined (IMPDEF) field introduced in
FF-A v1.2 within the Endpoint Memory Access Descriptor (EMAD). This omission
breaks all memory interfaces.
This change updates the EMAD sizing and offset logic to correctly handle the
FF-A v1.2 layout while preserving backward compatibility with older versions.
* tag 'ffa-fix-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux:
firmware: arm_ffa: Add support for IMPDEF value in the memory access descriptor
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
- Do not make a clean PTE dirty in pte_mkwrite()
The Arm architecture, for backwards compatibility reasons (ARMv8.0
before in-hardware dirty bit management - DBM), uses the PTE_RDONLY
bit to mean !dirty while the PTE_WRITE bit means DBM enabled. The
arm64 pte_mkwrite() simply clears the PTE_RDONLY bit and this
inadvertently makes the PTE pte_hw_dirty(). Most places making a PTE
writable also invoke pte_mkdirty() but do_swap_page() does not and we
end up with dirty, freshly swapped in, writeable pages.
- Do not warn if the destination page is already MTE-tagged in
copy_highpage()
In the majority of the cases, a destination page copied into is
freshly allocated without the PG_mte_tagged flag set. However, the
folio migration may be restarted if __folio_migrate_mapping() failed,
triggering the benign WARN_ON_ONCE().
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE5RElWfyWxS+3PLO2a9axLQDIXvEFAmj6bJwACgkQa9axLQDI
XvF/Kg//TumWHlM3o07ol2yhK+EXUTMW8DNwzGwKAqPKl19iElZ+F3yVSfgXOxAi
hjZk9qIPGNokKulKX0drJahuhaXVW30ynh9EX6xPhXN6+faqCv8JR7zSABvMXm9E
FYmqEz678RNkIrfSn0uJw6kF3Dakn6IrZbarD2WRWg9kcwQIZCHfdxbiSbuBKQ+m
oXk5pjndTjuKujMWAhZbmuWGPNc1EfzulwhgpARgQNUxtvToLR/aS+TLykGKXPTL
GieHWR3/AiN1Jhwvsp4ElxLvnM1cau/QhnMX9kCAUjwRfnPBUa+jt/OPziO7s9Gh
NeImrwdtSBi/B5a7GaozZwsyeTAahrmSpaTjzQOrw3jr+Scn7seXtRJMFwYBiXNv
7GGDKsNXc6qmmrdC1Epqvzk6EDFpv2SPkeXIUJVxxaM7qpkhTgxnScqZzaYYmTu+
0CPKMmVtRfHr4GJqkhFcfHQMEHtxpOsA803t4w5iIgVQQQciEcHM7v21h5PWBIqO
vZydWITX/cGk2rwXtfZ4EATG1fl8jt1gwUD6FSUz73gBueLD1DHBhS3AkRCptdeR
AraXxdxdUZAH/7k1k0WOzBCoVBmbT8yjyTdKLH7KlHVaHIQDp+dmcR9mj1VoF5VP
sQXl9pG/WqrIz7pBBWEW83eeSlDK0mD7R9n8k9yHpsEy/ditFXI=
=3tTN
-----END PGP SIGNATURE-----
Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
Pull arm64 fixes from Catalin Marinas:
- Do not make a clean PTE dirty in pte_mkwrite()
The Arm architecture, for backwards compatibility reasons (ARMv8.0
before in-hardware dirty bit management - DBM), uses the PTE_RDONLY
bit to mean !dirty while the PTE_WRITE bit means DBM enabled. The
arm64 pte_mkwrite() simply clears the PTE_RDONLY bit and this
inadvertently makes the PTE pte_hw_dirty(). Most places making a PTE
writable also invoke pte_mkdirty() but do_swap_page() does not and we
end up with dirty, freshly swapped in, writeable pages.
- Do not warn if the destination page is already MTE-tagged in
copy_highpage()
In the majority of the cases, a destination page copied into is
freshly allocated without the PG_mte_tagged flag set. However, the
folio migration may be restarted if __folio_migrate_mapping() failed,
triggering the benign WARN_ON_ONCE().
* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
arm64: mte: Do not warn if the page is already tagged in copy_highpage()
arm64, mm: avoid always making PTE dirty in pte_mkwrite()
The switch_brightness_work delayed work accesses device->brightness
and device->backlight, freed by acpi_video_dev_unregister_backlight()
during device removal.
If the work executes after acpi_video_bus_unregister_backlight()
frees these resources, it causes a use-after-free when
acpi_video_switch_brightness() dereferences device->brightness or
device->backlight.
Fix this by calling cancel_delayed_work_sync() for each device's
switch_brightness_work in acpi_video_bus_remove_notify_handler()
after removing the notify handler that queues the work. This ensures
the work completes before the memory is freed.
Fixes: 8ab58e8e7e ("ACPI / video: Fix backlight taking 2 steps on a brightness up/down keypress")
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Yuhao Jiang <danisjiang@gmail.com>
Reviewed-by: Hans de Goede <hansg@kernel.org>
[ rjw: Changelog edit ]
Link: https://patch.msgid.link/20251022200704.2655507-1-danisjiang@gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
retsnoop's build on powerpc (ppc64le) architecture ([0]) failed due to
wrong definition of PT_REGS_SP() macro. Looking at powerpc's
implementation of stack unwinding in perf_callchain_user_64() clearly
shows that stack pointer register is gpr[1].
Fix libbpf's definition of __PT_SP_REG for powerpc to fix all this.
[0] https://kojipkgs.fedoraproject.org/work/tasks/1544/137921544/build.log
Fixes: 138d6153a1 ("samples/bpf: Enable powerpc support")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Reviewed-by: Naveen N Rao (AMD) <naveen@kernel.org>
Link: https://lore.kernel.org/r/20251020203643.989467-1-andrii@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
The checkpatch script is reporting multiple instances of:
Argument 'x' is not used in function-like macro
Fix these by renaming the argument to match the usage. In the process,
also add parenthesis to the usage to avoid MACRO_ARG_PRECEDENCE
issues.
Compile tested only.
Link: https://patch.msgid.link/20251022-ath11k-bad-macro-arg-v1-1-93a8eadb6191@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
really started testing.
Current release - new code bugs:
- eth: mlx5e:
- psp: avoid 'accel' NULL pointer dereference
- skip PPHCR register query for FEC histogram if not supported
Previous releases - regressions:
- bonding: update the slave array for broadcast mode
- rtnetlink: re-allow deleting FDB entries in user namespace
- eth: dpaa2: fix the pointer passed to PTR_ALIGN on Tx path
Previous releases - always broken:
- can: drop skb on xmit if device is in listen-only mode
- gro: clear skb_shinfo(skb)->hwtstamps in napi_reuse_skb()
- eth: mlx5e
- RX, fix generating skb from non-linear xdp_buff if program
trims frags
- make devcom init failures non-fatal, fix races with IPSec
Misc:
- some documentation formatting "fixes"
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE6jPA+I1ugmIBA4hXMUZtbf5SIrsFAmj6QcgACgkQMUZtbf5S
IrsRvw/+N4rc/M7X6kYXftxW+DchJ9daXVFFXDR6/L05LyOhNL6wDi0TNT0MM2f0
RLQQ6ReOyCGhDGDzUJN6FNdn6B75HSzoeZKDoCVBoCpHg8C55X2YXMpTZILlKxH+
A7yI8H6Zb5ljiXlOwhqSrIzth6orNxjqUBAOIiu0JUhvfvuYnRh1RZPYX+3babjS
2DcEGK36GLe671PR6S33tu2q/xcmPonbBtQjplEtDKyGrV6+/BtvHSJ/bnKjtnar
5DR1yJE8PdtujdXyxzaS7x2xfVnbnX/huNepqY3K0d5ZXJphQGxCEfY5DTWAsooF
zX7Q/lRe56bmNzjg+LRhYzIeKaSFlXw23FQe2b+Dpz/qPMKkm4F2LdIq1C9GOXom
StX0zz7v6C332N/fABAzCUbklaclZA+HyVmjEJYIdK037xaIpYdh9AfkX0Byd8xP
JOGFeVtqlW/Vg7yqmiJ8N66yaMKOtmzfA3yyQid0F0CVwy/h3z/fDp78rfTjgORp
tXX2DO9jF5aUZXE5p6VAWQGHOylpVP83GHKzTZtLxDgzK0d4VBXUGslwifn1rhTz
yzr//qwt18Rcbv7ezmpsLT+Q2S7pTXtEblWZgf/IM5HE0AGdJIItbhYm3sjUYMiM
UGZgBr0AwWywXcUmtiD/IdA85UJLUGjDKx88Du356VGPBizIG3A=
=rD+V
-----END PGP SIGNATURE-----
Merge tag 'net-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Jakub Kicinski:
"Including fixes from can. Slim pickings, I'm guessing people haven't
really started testing.
Current release - new code bugs:
- eth: mlx5e:
- psp: avoid 'accel' NULL pointer dereference
- skip PPHCR register query for FEC histogram if not supported
Previous releases - regressions:
- bonding: update the slave array for broadcast mode
- rtnetlink: re-allow deleting FDB entries in user namespace
- eth: dpaa2: fix the pointer passed to PTR_ALIGN on Tx path
Previous releases - always broken:
- can: drop skb on xmit if device is in listen-only mode
- gro: clear skb_shinfo(skb)->hwtstamps in napi_reuse_skb()
- eth: mlx5e
- RX, fix generating skb from non-linear xdp_buff if program
trims frags
- make devcom init failures non-fatal, fix races with IPSec
Misc:
- some documentation formatting 'fixes'"
* tag 'net-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (47 commits)
net/mlx5: Fix IPsec cleanup over MPV device
net/mlx5: Refactor devcom to return NULL on failure
net/mlx5e: Skip PPHCR register query if not supported by the device
net/mlx5: Add PPHCR to PCAM supported registers mask
virtio-net: zero unused hash fields
net: phy: micrel: always set shared->phydev for LAN8814
vsock: fix lock inversion in vsock_assign_transport()
ovpn: use datagram_poll_queue for socket readiness in TCP
espintcp: use datagram_poll_queue for socket readiness
net: datagram: introduce datagram_poll_queue for custom receive queues
net: bonding: fix possible peer notify event loss or dup issue
net: hsr: prevent creation of HSR device with slaves from another netns
sctp: avoid NULL dereference when chunk data buffer is missing
ptp: ocp: Fix typo using index 1 instead of i in SMA initialization loop
net: ravb: Ensure memory write completes before ringing TX doorbell
net: ravb: Enforce descriptor type ordering
net: hibmcge: select FIXED_PHY
net: dlink: use dev_kfree_skb_any instead of dev_kfree_skb
Documentation: networking: ax25: update the mailing list info.
net: gro_cells: fix lock imbalance in gro_cells_receive()
...
- Fix a recent coding mistake causing __acpi_node_get_property_reference()
arguments to be put in an incorrect order (Sunil V L)
- Work around bogus -Wstringop-overread warning on LoongArch since
GCC 11 in ACPICA (Xi Ruoyao)
-----BEGIN PGP SIGNATURE-----
iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmj6IhISHHJqd0Byand5
c29ja2kubmV0AAoJEO5fvZ0v1OO1XNoIAJHXoSu9daR9x8GgxYj4fKRDv4NEeVJF
W2ilgU1WUSIOR4YBRPiqjWqi2jGNVMP3gycmoMmusQnfIJYBVQH/Q5AtxkT4HLYB
jaNlQYUiUYi6KWwhnLs+NJu6ey5SvuxOffyIKnlvyl5N2tVDLF/50vLsknSEdR/z
3/g5RGkQ7oZTQrt9OguWq2lsn/c/FSPED/wBv4GjzNAgRLx2TGoHlflaDxN9le5o
2gDFk8gfVvaP/z7qcpsgmTx3RwVpelxV9MUgWur65i2YCkOWBlJL0a4Sr1JWKyzL
dJij0f/KH5RezuGzcDeGn2YgdttwV3dBhTn3bEvxmgpXvLLZcj0V6jk=
=SGjm
-----END PGP SIGNATURE-----
Merge tag 'acpi-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull ACPI fixes from Rafael Wysocki:
"These fix a fallout of a recent ACPI properties management update and
work around a compiler bug in ACPICA:
- Fix a recent coding mistake causing __acpi_node_get_property_reference()
arguments to be put in an incorrect order (Sunil V L)
- Work around bogus -Wstringop-overread warning on LoongArch since
GCC 11 in ACPICA (Xi Ruoyao)"
* tag 'acpi-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
ACPICA: Work around bogus -Wstringop-overread warning since GCC 11
ACPI: property: Fix argument order in __acpi_node_get_property_reference()
- Add missing _RET == 0 condition to recently introduced conditional
guard definitions for runtime PM (Rafael Wysocki)
- Revert a cpuidle menu governor change that introduced a serious
performance regression on Chromebooks with Intel Jasper Lake
processors (Rafael Wysocki)
- Fix an amd-pstate driver regression leading to EPP=0 after
hibernation (Mario Limonciello)
-----BEGIN PGP SIGNATURE-----
iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmj6D/ASHHJqd0Byand5
c29ja2kubmV0AAoJEO5fvZ0v1OO1+eoIAJ1sl2E0tpzsThg4yEjcPH+6Xa4KdYbQ
dHQ1vvdIMZ9D+mi0ububT6fjmd9CsIcZElst9aEeXqLO1BoQrtApHWXuJ6RRkLWz
iEeMusB2wNkUBv/I3jgtYJCOsSdwFEpl8172qrG9RBQftOO3rsUv1RVgTZ+8C8fM
Fb1BpoSgYFCq1nBXhHMaJZElAIECGwEpTQOQ2/DlfTf6uVVIm20ijmLb2idgcgnt
ijeu2qGHUQK4ZaABDL/60CbA7+f21AmtzRX7VV95h2ALv5sPnCa5o/ZKthhGhR2b
wcPejPeVqJc9XHSEFUdOtLGnjZl7xBrW/HeyclAozdqG/ma4zUADHXA=
=z5JQ
-----END PGP SIGNATURE-----
Merge tag 'pm-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull power management fixes from Rafael Wysocki:
"These revert a cpuidle menu governor commit leading to a performance
regression, fix an amd-pstate driver regression introduced recently,
and fix new conditional guard definitions for runtime PM.
- Add missing _RET == 0 condition to recently introduced conditional
guard definitions for runtime PM (Rafael Wysocki)
- Revert a cpuidle menu governor change that introduced a serious
performance regression on Chromebooks with Intel Jasper Lake
processors (Rafael Wysocki)
- Fix an amd-pstate driver regression leading to EPP=0 after
hibernation (Mario Limonciello)"
* tag 'pm-6.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
PM: runtime: Fix conditional guard definitions
Revert "cpuidle: menu: Avoid discarding useful information"
cpufreq/amd-pstate: Fix a regression leading to EPP 0 after hibernate
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE8rQSAMVO+zA4DBdWxWXV+ddtWDsFAmj50JgACgkQxWXV+ddt
WDvXYg//SPHH0s7DEnPgMEz/RE9wQXVtvJhzzICDzTk2hawc05K9P1p/2mB2Etio
CFya4Cuzs9sfw5HW5BYZcyi1bzMkAOMA5lPI+sHOqGdKhomYXj/5TlxMVNuh83uP
Bk/Ycw4k5pIQRtIlen6Km9ViM9Zi7xFqn41c5c8V7GtYXrcgB5ob2LVL5UIEw/y1
RpaXlNZ+/DVRiH+UcvdqvnsdasjzVeugqb7aGiEhSIhm851D6UvBb+X5lqxWwcxY
GEBUqU8+FnkuTnru1V3Y/WlHE7NnXyDPYJaLkta3Wru9f2faOEdT4rvnIe4uQHPc
NNZ4B/fxRjqzFWCZ+T9s/Rm7jOxIpgPj1UZPqDMiq87bqy5AWxH3PIq+rmsu8nVF
rVB7qNdP3iW0CtA7U68D0Y4xYOQIEsVHfx7LY+Q+P/4epTFOZBix51vPoCF73CCY
uoQ6gMbeUp109CzQAYa8rGPv+nn7cFLDkl4wSWWg2LssAqEKQLkHK0goHjLCu6mp
qHW1gw97qonTtmoUURIzJUYTuMWOlvC90r/e4C46ZTOhM9ndfuZJc28thRCJPsvD
P+suVPMDuBBwdcGIOCy+uS9vOnm+KfZp10zQ0uAnYU35foUnE8V/4uaxHlzE0jmb
wPFIu07Rb/O3hx4cvSSckevrjBbK8M0TCG5JuhQIEYqXiU1utP0=
=YN21
-----END PGP SIGNATURE-----
Merge tag 'for-6.18-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux
Pull btrfs fixes from David Sterba:
- in send, fix duplicated rmdir operations when using extrefs
(hardlinks), receive can fail with ENOENT
- fixup of error check when reading extent root in ref-verify and
damaged roots are allowed by mount option (found by smatch)
- fix freeing partially initialized fs info (found by syzkaller)
- fix use-after-free when printing ref_tracking status of delayed
inodes
* tag 'for-6.18-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
btrfs: ref-verify: fix IS_ERR() vs NULL check in btrfs_build_ref_tree()
btrfs: fix delayed_node ref_tracker use after free
btrfs: send: fix duplicated rmdir operations when using extrefs
btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots()
The arm64 copy_highpage() assumes that the destination page is newly
allocated and not MTE-tagged (PG_mte_tagged unset) and warns
accordingly. However, following commit 060913999d ("mm: migrate:
support poisoned recover from migrate folio"), folio_mc_copy() is called
before __folio_migrate_mapping(). If the latter fails (-EAGAIN), the
copy will be done again to the same destination page. Since
copy_highpage() already set the PG_mte_tagged flag, this second copy
will warn.
Replace the WARN_ON_ONCE(page already tagged) in the arm64
copy_highpage() with a comment.
Reported-by: syzbot+d1974fc28545a3e6218b@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/68dda1ae.a00a0220.102ee.0065.GAE@google.com
Reviewed-by: David Hildenbrand <david@redhat.com>
Cc: Will Deacon <will@kernel.org>
Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: stable@vger.kernel.org # 6.12.x
Reviewed-by: Yang Shi <yang@os.amperecomputing.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Since commit af92793e52 ("slab: Introduce kmalloc_nolock() and
kfree_nolock().") there's a possibility in alloc_single_from_new_slab()
that we discard the newly allocated slab if we can't spin and we fail to
trylock. As a result we don't perform inc_slabs_node() later in the
function. Instead we perform a deferred deactivate_slab() which can
either put the unacounted slab on partial list, or discard it
immediately while performing dec_slabs_node(). Either way will cause an
accounting imbalance.
Fix this by not marking the slab as frozen, and using free_slab()
instead of deactivate_slab() for non-frozen slabs in
free_deferred_objects(). For CONFIG_SLUB_TINY, that's the only possible
case. By not using discard_slab() we avoid dec_slabs_node().
Fixes: af92793e52 ("slab: Introduce kmalloc_nolock() and kfree_nolock().")
Link: https://patch.msgid.link/20251023-fix-slab-accounting-v2-1-0e62d50986ea@suse.cz
Reviewed-by: Harry Yoo <harry.yoo@oracle.com>
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Commit 4e65bda827 ("ASoC: wcd934x: fix error handling in
wcd934x_codec_parse_data()") revealed the problem in the slimbus regmap.
That commit breaks audio playback, for instance, on sdm845 Thundercomm
Dragonboard 845c board:
Unable to handle kernel paging request at virtual address ffff8000847cbad4
...
CPU: 5 UID: 0 PID: 776 Comm: aplay Not tainted 6.18.0-rc1-00028-g7ea30958b305 #11 PREEMPT
Hardware name: Thundercomm Dragonboard 845c (DT)
...
Call trace:
slim_xfer_msg+0x24/0x1ac [slimbus] (P)
slim_read+0x48/0x74 [slimbus]
regmap_slimbus_read+0x18/0x24 [regmap_slimbus]
_regmap_raw_read+0xe8/0x174
_regmap_bus_read+0x44/0x80
_regmap_read+0x60/0xd8
_regmap_update_bits+0xf4/0x140
_regmap_select_page+0xa8/0x124
_regmap_raw_write_impl+0x3b8/0x65c
_regmap_bus_raw_write+0x60/0x80
_regmap_write+0x58/0xc0
regmap_write+0x4c/0x80
wcd934x_hw_params+0x494/0x8b8 [snd_soc_wcd934x]
snd_soc_dai_hw_params+0x3c/0x7c [snd_soc_core]
__soc_pcm_hw_params+0x22c/0x634 [snd_soc_core]
dpcm_be_dai_hw_params+0x1d4/0x38c [snd_soc_core]
dpcm_fe_dai_hw_params+0x9c/0x17c [snd_soc_core]
snd_pcm_hw_params+0x124/0x464 [snd_pcm]
snd_pcm_common_ioctl+0x110c/0x1820 [snd_pcm]
snd_pcm_ioctl+0x34/0x4c [snd_pcm]
__arm64_sys_ioctl+0xac/0x104
invoke_syscall+0x48/0x104
el0_svc_common.constprop.0+0x40/0xe0
do_el0_svc+0x1c/0x28
el0_svc+0x34/0xec
el0t_64_sync_handler+0xa0/0xf0
el0t_64_sync+0x198/0x19c
The __devm_regmap_init_slimbus() started to be used instead of
__regmap_init_slimbus() after the commit mentioned above and turns out
the incorrect bus_context pointer (3rd argument) was used in
__devm_regmap_init_slimbus(). It should be just "slimbus" (which is equal
to &slimbus->dev). Correct it. The wcd934x codec seems to be the only or
the first user of devm_regmap_init_slimbus() but we should fix it till
the point where __devm_regmap_init_slimbus() was introduced therefore
two "Fixes" tags.
While at this, also correct the same argument in __regmap_init_slimbus().
Fixes: 4e65bda827 ("ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()")
Fixes: 7d6f7fb053 ("regmap: add SLIMbus support")
Cc: stable@vger.kernel.org
Cc: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Cc: Ma Ke <make24@iscas.ac.cn>
Cc: Steev Klimaszewski <steev@kali.org>
Cc: Srinivas Kandagatla <srini@kernel.org>
Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://patch.msgid.link/20251022201013.1740211-1-alexey.klimov@linaro.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Devcom device and component registration isn't always critical to the
functionality of the caller, hence the registration can fail and we can
continue working with an ERR_PTR value saved inside a variable.
In order to avoid that make sure all devcom failures return NULL.
Signed-off-by: Patrisious Haddad <phaddad@nvidia.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/1761136182-918470-4-git-send-email-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Check the PCAM supported registers mask before querying the PPHCR
register, as it is not supported in older devices.
Fixes: 44907e7c8f ("net/mlx5e: Add logic to read RS-FEC histogram bin ranges from PPHCR")
Signed-off-by: Alexei Lazar <alazar@nvidia.com>
Reviewed-by: Yael Chemla <ychemla@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/1761136182-918470-3-git-send-email-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Add the PPHCR bit to the port_access_reg_cap_mask field of PCAM
register to indicate that the device supports the PPHCR register
and the RS-FEC histogram feature.
Signed-off-by: Alexei Lazar <alazar@nvidia.com>
Reviewed-by: Yael Chemla <ychemla@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/1761136182-918470-2-git-send-email-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
When GSO tunnel is negotiated virtio_net_hdr_tnl_from_skb() tries to
initialize the tunnel metadata but forget to zero unused rxhash
fields. This may leak information to another side. Fixing this by
zeroing the unused hash fields.
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Fixes: a2fb4bc4e2 ("net: implement virtio helpers to handle UDP GSO tunneling")
Cc: <stable@vger.kernel.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Link: https://patch.msgid.link/20251022034421.70244-1-jasowang@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Currently, during the LAN8814 PTP probe shared->phydev is only set if PTP
clock gets actually set, otherwise the function will return before setting
it.
This is an issue as shared->phydev is unconditionally being used when IRQ
is being handled, especially in lan8814_gpio_process_cap and since it was
not set it will cause a NULL pointer exception and crash the kernel.
So, simply always set shared->phydev to avoid the NULL pointer exception.
Fixes: b3f1a08fcf ("net: phy: micrel: Add support for PTP_PF_EXTTS for lan8814")
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Tested-by: Horatiu Vultur <horatiu.vultur@microchip.com>
Link: https://patch.msgid.link/20251021132034.983936-1-robert.marko@sartura.hr
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Do not block PCI config accesses through pci_cfg_access_lock() when
executing the s390 variant of PCI error recovery: Acquire just
device_lock() instead of pci_dev_lock() as powerpc's EEH and
generig PCI AER processing do.
During error recovery testing a pair of tasks was reported to be hung:
mlx5_core 0000:00:00.1: mlx5_health_try_recover:338:(pid 5553): health recovery flow aborted, PCI reads still not working
INFO: task kmcheck:72 blocked for more than 122 seconds.
Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kmcheck state:D stack:0 pid:72 tgid:72 ppid:2 flags:0x00000000
Call Trace:
[<000000065256f030>] __schedule+0x2a0/0x590
[<000000065256f356>] schedule+0x36/0xe0
[<000000065256f572>] schedule_preempt_disabled+0x22/0x30
[<0000000652570a94>] __mutex_lock.constprop.0+0x484/0x8a8
[<000003ff800673a4>] mlx5_unload_one+0x34/0x58 [mlx5_core]
[<000003ff8006745c>] mlx5_pci_err_detected+0x94/0x140 [mlx5_core]
[<0000000652556c5a>] zpci_event_attempt_error_recovery+0xf2/0x398
[<0000000651b9184a>] __zpci_event_error+0x23a/0x2c0
INFO: task kworker/u1664:6:1514 blocked for more than 122 seconds.
Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u1664:6 state:D stack:0 pid:1514 tgid:1514 ppid:2 flags:0x00000000
Workqueue: mlx5_health0000:00:00.0 mlx5_fw_fatal_reporter_err_work [mlx5_core]
Call Trace:
[<000000065256f030>] __schedule+0x2a0/0x590
[<000000065256f356>] schedule+0x36/0xe0
[<0000000652172e28>] pci_wait_cfg+0x80/0xe8
[<0000000652172f94>] pci_cfg_access_lock+0x74/0x88
[<000003ff800916b6>] mlx5_vsc_gw_lock+0x36/0x178 [mlx5_core]
[<000003ff80098824>] mlx5_crdump_collect+0x34/0x1c8 [mlx5_core]
[<000003ff80074b62>] mlx5_fw_fatal_reporter_dump+0x6a/0xe8 [mlx5_core]
[<0000000652512242>] devlink_health_do_dump.part.0+0x82/0x168
[<0000000652513212>] devlink_health_report+0x19a/0x230
[<000003ff80075a12>] mlx5_fw_fatal_reporter_err_work+0xba/0x1b0 [mlx5_core]
No kernel log of the exact same error with an upstream kernel is
available - but the very same deadlock situation can be constructed there,
too:
- task: kmcheck
mlx5_unload_one() tries to acquire devlink lock while the PCI error
recovery code has set pdev->block_cfg_access by way of
pci_cfg_access_lock()
- task: kworker
mlx5_crdump_collect() tries to set block_cfg_access through
pci_cfg_access_lock() while devlink_health_report() had acquired
the devlink lock.
A similar deadlock situation can be reproduced by requesting a
crdump with
> devlink health dump show pci/<BDF> reporter fw_fatal
while PCI error recovery is executed on the same <BDF> physical function
by mlx5_core's pci_error_handlers. On s390 this can be injected with
> zpcictl --reset-fw <BDF>
Tests with this patch failed to reproduce that second deadlock situation,
the devlink command is rejected with "kernel answers: Permission denied" -
and we get a kernel log message of:
mlx5_core 1ed0:00:00.1: mlx5_crdump_collect:50:(pid 254382): crdump: failed to lock vsc gw err -5
because the config read of VSC_SEMAPHORE is rejected by the underlying
hardware.
Two prior attempts to address this issue have been discussed and
ultimately rejected [see link], with the primary argument that s390's
implementation of PCI error recovery is imposing restrictions that
neither powerpc's EEH nor PCI AER handling need. Tests show that PCI
error recovery on s390 is running to completion even without blocking
access to PCI config space.
Link: https://lore.kernel.org/all/20251007144826.2825134-1-gbayer@linux.ibm.com/
Cc: stable@vger.kernel.org
Fixes: 4cdf2f4e24 ("s390/pci: implement minimal PCI error recovery")
Reviewed-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Gerd Bayer <gbayer@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Syzbot reported a potential lock inversion deadlock between
vsock_register_mutex and sk_lock-AF_VSOCK when vsock_linger() is called.
The issue was introduced by commit 687aa0c558 ("vsock: Fix
transport_* TOCTOU") which added vsock_register_mutex locking in
vsock_assign_transport() around the transport->release() call, that can
call vsock_linger(). vsock_assign_transport() can be called with sk_lock
held. vsock_linger() calls sk_wait_event() that temporarily releases and
re-acquires sk_lock. During this window, if another thread hold
vsock_register_mutex while trying to acquire sk_lock, a circular
dependency is created.
Fix this by releasing vsock_register_mutex before calling
transport->release() and vsock_deassign_transport(). This is safe
because we don't need to hold vsock_register_mutex while releasing the
old transport, and we ensure the new transport won't disappear by
obtaining a module reference first via try_module_get().
Reported-by: syzbot+10e35716f8e4929681fa@syzkaller.appspotmail.com
Tested-by: syzbot+10e35716f8e4929681fa@syzkaller.appspotmail.com
Fixes: 687aa0c558 ("vsock: Fix transport_* TOCTOU")
Cc: mhal@rbox.co
Cc: stable@vger.kernel.org
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Link: https://patch.msgid.link/20251021121718.137668-1-sgarzare@redhat.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Now that driver is capable of inserting Tx power, advertise the support
for the same to upper layers.
Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.9.0.1-02146-QCAHKSWPL_SILICONZ-1
Signed-off-by: Aditya Kumar Singh <aditya.kumar.singh@oss.qualcomm.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20251017-add_tx_power_insertion_support-v1-4-f08feacfca93@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
For certain action frames like the TPC Report IE in the spectrum management
TPC Report action frame, and in the Radio Measurement Link Measurement
Report action frame there is a requirement to fill in the current
and max Tx power of the device in the packet.
Add support to populate these fields in the relevant packets.
In software-encrypted cases such as PMF, skip insertion since the packets
are already encrypted and cannot be modified.
Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.9.0.1-02146-QCAHKSWPL_SILICONZ-1
Signed-off-by: Aditya Kumar Singh <aditya.kumar.singh@oss.qualcomm.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20251017-add_tx_power_insertion_support-v1-3-f08feacfca93@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Refactor ath11k_mac_op_get_txpower() by introducing a new internal function
ath11k_mac_handle_get_txpower(), which assumes the caller holds the
appropriate lock. This prepares the codebase for future change where the
internal function may be invoked directly with the lock already acquired,
improving modularity and lock handling consistency.
No functional change intended.
Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.9.0.1-02146-QCAHKSWPL_SILICONZ-1
Signed-off-by: Aditya Kumar Singh <aditya.kumar.singh@oss.qualcomm.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20251017-add_tx_power_insertion_support-v1-2-f08feacfca93@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
A forthcoming change necessitates that these functions be defined prior to
their usage. Therefore, relocate them now as a preparatory step for the
upcoming modifications.
Compile tested only.
Signed-off-by: Aditya Kumar Singh <aditya.kumar.singh@oss.qualcomm.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20251017-add_tx_power_insertion_support-v1-1-f08feacfca93@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
In ath11k_wmi_send_peer_assoc_cmd(), peer's transmit MCS is sent to
firmware as receive MCS while peer's receive MCS sent as transmit MCS,
which goes against firmwire's definition.
While connecting to a misbehaved AP that advertises 0xffff (meaning not
supported) for 160 MHz transmit MCS map, firmware crashes due to 0xffff
is assigned to he_mcs->rx_mcs_set field.
Ext Tag: HE Capabilities
[...]
Supported HE-MCS and NSS Set
[...]
Rx and Tx MCS Maps 160 MHz
[...]
Tx HE-MCS Map 160 MHz: 0xffff
Swap the assignment to fix this issue.
As the HE rate control mask is meant to limit our own transmit MCS, it
needs to go via he_mcs->rx_mcs_set field. With the aforementioned swapping
done, change is needed as well to apply it to the peer's receive MCS.
Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
Fixes: 61fe43e721 ("ath11k: add support for setting fixed HE rate/gi/ltf")
Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Link: https://patch.msgid.link/20251017-ath11k-mcs-assignment-v1-2-da40825c1783@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
While associating, firmware needs to know peer's receive capability to
calculate its own VHT transmit MCS, currently host sends this information
to firmware via mcs->rx_mcs_set field, this is wrong as firmware actually
takes it from mcs->tx_mcs_set field. Till now there is no failure seen
due to this, most likely because almost all peers are advertising the
same capability for both transmit and receive. Swap the assignment to
fix it.
Besides, rate control mask is meant to limit our own transmit MCS, hence
need to go via mcs->tx_mcs_set field. With the aforementioned swapping
done, change is needed as well to apply it to the peer's receive
capability rather than transmit capability.
Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1
Fixes: d5c65159f2 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Signed-off-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Link: https://patch.msgid.link/20251017-ath11k-mcs-assignment-v1-1-da40825c1783@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Ralf Lici says:
====================
fix poll behaviour for TCP-based tunnel protocols
This patch series introduces a polling function for datagram-style
sockets that operates on custom skb queues, and updates ovpn (the
OpenVPN data-channel offload module) and espintcp (the TCP Encapsulation
of IKE and IPsec Packets implementation) to use it accordingly.
Protocols like the aforementioned one decapsulate packets received over
TCP and deliver userspace-bound data through a separate skb queue, not
the standard sk_receive_queue. Previously, both relied on
datagram_poll(), which would signal readiness based on non-userspace
packets, leading to misleading poll results and unnecessary recv
attempts in userspace.
Patch 1 introduces datagram_poll_queue(), a variant of datagram_poll()
that accepts an explicit receive queue. This builds on the approach
introduced in commit b50b058, which extended other skb-related functions
to support custom queues. Patch 2 and 3 update espintcp_poll() and
ovpn_tcp_poll() respectively to use this helper, ensuring readiness is
only signaled when userspace data is available.
Each patch is self-contained and the ovpn one includes rationale and
lifecycle enforcement where appropriate.
====================
Link: https://patch.msgid.link/20251021100942.195010-1-ralf@mandelbit.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
openvpn TCP encapsulation uses a custom queue to deliver packets to
userspace. Currently it relies on datagram_poll, which checks
sk_receive_queue, leading to false readiness signals when that queue
contains non-userspace packets.
Switch ovpn_tcp_poll to use datagram_poll_queue with the peer's
user_queue, ensuring poll only signals readiness when userspace data is
actually available. Also refactor ovpn_tcp_poll in order to enforce the
assumption we can make on the lifetime of ovpn_sock and peer.
Fixes: 11851cbd60 ("ovpn: implement TCP transport")
Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
Signed-off-by: Ralf Lici <ralf@mandelbit.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Link: https://patch.msgid.link/20251021100942.195010-4-ralf@mandelbit.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
espintcp uses a custom queue (ike_queue) to deliver packets to
userspace. The polling logic relies on datagram_poll, which checks
sk_receive_queue, which can lead to false readiness signals when that
queue contains non-userspace packets.
Switch espintcp_poll to use datagram_poll_queue with ike_queue, ensuring
poll only signals readiness when userspace data is actually available.
Fixes: e27cca96cd ("xfrm: add espintcp (RFC 8229)")
Signed-off-by: Ralf Lici <ralf@mandelbit.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Link: https://patch.msgid.link/20251021100942.195010-3-ralf@mandelbit.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Some protocols using TCP encapsulation (e.g., espintcp, openvpn) deliver
userspace-bound packets through a custom skb queue rather than the
standard sk_receive_queue.
Introduce datagram_poll_queue that accepts an explicit receive queue,
and convert datagram_poll into a wrapper around datagram_poll_queue.
This allows protocols with custom skb queues to reuse the core polling
logic without relying on sk_receive_queue.
Cc: Sabrina Dubroca <sd@queasysnail.net>
Cc: Antonio Quartulli <antonio@openvpn.net>
Signed-off-by: Ralf Lici <ralf@mandelbit.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Reviewed-by: Antonio Quartulli <antonio@openvpn.net>
Link: https://patch.msgid.link/20251021100942.195010-2-ralf@mandelbit.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
The __must_hold annotation references &req->ctx->uring_lock, but req
is not in scope in io_install_fixed_file. This change updates the
annotation to reference the correct ctx->uring_lock.
improving code clarity.
Fixes: f110ed8498 ("io_uring: split out fixed file installation and removal")
Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
The DSD format supported by micfil is that oldest bit is in bit 31, so
the format should be DSD little endian format.
Fixes: 21aa330fec ("ASoC: fsl_micfil: Add decimation filter bypass mode support")
Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
Link: https://patch.msgid.link/20251023064538.368850-3-shengjiu.wang@nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The DSD little endian format requires the msb first, because oldest bit
is in msb.
found this issue by testing with pipewire.
Fixes: c111c2ddb3 ("ASoC: fsl_sai: Add PDM daifmt support")
Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Link: https://patch.msgid.link/20251023064538.368850-2-shengjiu.wang@nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The data probing is a debug feature. Currently parameters channels and
rate specified by the application are read while the format is ignored.
More robust approach is to read all of them.
Audio format, while not used by the Probe module for PCM streaming,
takes part in the gateway initialization on the DSP side. With full
parametrization we gain better coverage with the data probing feature.
Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
Link: https://patch.msgid.link/20251023092348.3119313-4-cezary.rojewski@intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
avs_dai_fe_shutdown() handles the shutdown procedure for HOST HDAudio
stream while period-elapsed work services its IRQs. As the former
frees the DAI's private context, these two operations shall be
synchronized to avoid slab-use-after-free or worse errors.
Fixes: 0dbb186c35 ("ASoC: Intel: avs: Update stream status in a separate thread")
Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
Link: https://patch.msgid.link/20251023092348.3119313-3-cezary.rojewski@intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The pcm->prepare() function may be called multiple times in a row by the
userspace, as mentioned in the documentation. The driver shall take that
into account and prevent redundancy. However, the exact same function is
called during XRUNs and in such case, the particular stream shall be
reset and setup anew.
Fixes: 9114700b49 ("ASoC: Intel: avs: Generic PCM FE operations")
Signed-off-by: Cezary Rojewski <cezary.rojewski@intel.com>
Link: https://patch.msgid.link/20251023092348.3119313-2-cezary.rojewski@intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The generic_handle_domain_irq() function resolves the hardware IRQ
internally. The driver performed a duplicative mapping by calling
irq_find_mapping() first, which could lead to an RCU stall.
Delete the redundant irq_find_mapping() call and pass the hardware IRQ
directly to generic_handle_domain_irq().
Fixes: c5a4b6fd31 ("gpio: Add support for Intel LJCA USB GPIO driver")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Link: https://lore.kernel.org/r/20251023070231.1305-1-vulab@iscas.ac.cn
[Bartosz: remove unused variable]
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Merge an ACPI device properties handling change fixing the order of
__acpi_node_get_property_reference() arguments broken by a recent
update (Sunil V L)
* 'acpi-property':
ACPI: property: Fix argument order in __acpi_node_get_property_reference()
Merge cpuidle and cpufreq fixes for 6.18-rc3:
- Revert a cpuidle menu governor change that introduced a serious
performance regression on Chromebooks with Intel Jasper Lake
processors (Rafael Wysocki)
- Fix an amd-pstate driver regression leading to EPP=0 after
hibernation (Mario Limonciello)
* pm-cpuidle:
Revert "cpuidle: menu: Avoid discarding useful information"
* pm-cpufreq:
cpufreq/amd-pstate: Fix a regression leading to EPP 0 after hibernate
The lan8814 has 4 different SKUs and for 2 of these SKUs the PTP is
disabled. All these SKUs have the same value in the register 2 and 3.
Meaning that we can't differentiate them based on device id, therefore
check the SKU register and based on this allow or not to create a PTP
device.
Signed-off-by: Horatiu Vultur <horatiu.vultur@microchip.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/20251021070726.3690685-1-horatiu.vultur@microchip.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
If the send_peer_notif counter and the peer event notify are not synchronized.
It may cause problems such as the loss or dup of peer notify event.
Before this patch:
- If should_notify_peers is true and the lock for send_peer_notif-- fails, peer
event may be sent again in next mii_monitor loop, because should_notify_peers
is still true.
- If should_notify_peers is true and the lock for send_peer_notif-- succeeded,
but the lock for peer event fails, the peer event will be lost.
This patch locks the RTNL for send_peer_notif, events, and commit simultaneously.
Fixes: 07a4ddec3c ("bonding: add an option to specify a delay between peer notifications")
Cc: Jay Vosburgh <jv@jvosburgh.net>
Cc: Andrew Lunn <andrew+netdev@lunn.ch>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Hangbin Liu <liuhangbin@gmail.com>
Cc: Nikolay Aleksandrov <razor@blackwall.org>
Cc: Vincent Bernat <vincent@bernat.ch>
Cc: <stable@vger.kernel.org>
Signed-off-by: Tonghao Zhang <tonghao@bamaicloud.com>
Acked-by: Jay Vosburgh <jv@jvosburgh.net>
Link: https://patch.msgid.link/20251021050933.46412-1-tonghao@bamaicloud.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
