Commit graph

1,399,042 commits

Author SHA1 Message Date
Luiz Augusto von Dentz
9d4b01a0bf Bluetooth: hci_core: Fix not accounting for BIS/CIS/PA links separately
This fixes the likes of hci_conn_num(CIS_LINK) returning the total of
ISO connection which includes BIS_LINK as well, so this splits the
iso_num into each link type and introduces hci_iso_num that can be used
in places where the total number of ISO connection still needs to be
used.

Fixes: 23205562ff ("Bluetooth: separate CIS_LINK and BIS_LINK link types")
Fixes: a7bcffc673 ("Bluetooth: Add PA_LINK to distinguish BIG sync and PA sync connections")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2025-08-15 10:13:41 -04:00
Neeraj Sanjay Kale
e489317d2f Bluetooth: btnxpuart: Uses threaded IRQ for host wakeup handling
This replaces devm_request_irq() with devm_request_threaded_irq().

On iMX93 11x11 EVK platform, the BT chip's BT_WAKE_OUT pin is connected
to an I2C GPIO expander instead of directly been connected to iMX GPIO.

When I2C GPIO expander's (PCAL6524) host driver receives an interrupt on
it's INTR line, the driver's interrupt handler needs to query the
interrupt source with PCAL6524 first, and then call the actual interrupt
handler, in this case the IRQ handler in BTNXPUART.

In order to handle interrupts when such I2C GPIO expanders are between
the host and interrupt source, devm_request_threaded_irq() is needed.

This commit also removes the IRQF_TRIGGER_FALLING flag, to allow setting
the IRQ trigger type from the device tree setting instead of hardcoding
in the driver.

Signed-off-by: Neeraj Sanjay Kale <neeraj.sanjaykale@nxp.com>
Reviewed-by: Sherry Sun <sherry.sun@nxp.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2025-08-15 10:13:26 -04:00
Sergey Shtylyov
0eaf7c7e85 Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync()
The commit e07a06b4eb ("Bluetooth: Convert SCO configure_datapath to
hci_sync") missed to update the *return* statement under the *case* of
BT_CODEC_TRANSPARENT in hci_enhanced_setup_sync(), which led to returning
success (0) instead of the negative error code (-EINVAL).  However, the
result of hci_enhanced_setup_sync() seems to be ignored anyway, since NULL
gets passed to hci_cmd_sync_queue() as the last argument in that case and
the only function interested in that result is specified by that argument.

Fixes: e07a06b4eb ("Bluetooth: Convert SCO configure_datapath to hci_sync")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2025-08-15 10:13:09 -04:00
Miklos Szeredi
f8f59a2c05
copy_file_range: limit size if in compat mode
If the process runs in 32-bit compat mode, copy_file_range results can be
in the in-band error range.  In this case limit copy length to MAX_RW_COUNT
to prevent a signed overflow.

Reported-by: Florian Weimer <fweimer@redhat.com>
Closes: https://lore.kernel.org/all/lhuh5ynl8z5.fsf@oldenburg.str.redhat.com/
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Link: https://lore.kernel.org/20250813151107.99856-1-mszeredi@redhat.com
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-08-15 16:11:47 +02:00
Adrian Huang (Lenovo)
0b2d71a7c8
pidfs: Fix memory leak in pidfd_info()
After running the program 'ioctl_pidfd03' of Linux Test Project (LTP) or
the program 'pidfd_info_test' in 'tools/testing/selftests/pidfd' of the
kernel source, kmemleak reports the following memory leaks:

  # cat /sys/kernel/debug/kmemleak
  unreferenced object 0xff110020e5988000 (size 8216):
    comm "ioctl_pidfd03", pid 10853, jiffies 4294800031
    hex dump (first 32 bytes):
      02 40 00 00 00 00 00 00 10 00 00 00 00 00 00 00  .@..............
      00 00 00 00 af 01 00 00 80 00 00 00 00 00 00 00  ................
    backtrace (crc 69483047):
      kmem_cache_alloc_node_noprof+0x2fb/0x410
      copy_process+0x178/0x1740
      kernel_clone+0x99/0x3b0
      __do_sys_clone3+0xbe/0x100
      do_syscall_64+0x7b/0x2c0
      entry_SYSCALL_64_after_hwframe+0x76/0x7e
  ...
  unreferenced object 0xff11002097b70000 (size 8216):
  comm "pidfd_info_test", pid 11840, jiffies 4294889165
  hex dump (first 32 bytes):
    06 40 00 00 00 00 00 00 10 00 00 00 00 00 00 00  .@..............
    00 00 00 00 b5 00 00 00 80 00 00 00 00 00 00 00  ................
  backtrace (crc a6286bb7):
    kmem_cache_alloc_node_noprof+0x2fb/0x410
    copy_process+0x178/0x1740
    kernel_clone+0x99/0x3b0
    __do_sys_clone3+0xbe/0x100
    do_syscall_64+0x7b/0x2c0
    entry_SYSCALL_64_after_hwframe+0x76/0x7e
  ...

The leak occurs because pidfd_info() obtains a task_struct via
get_pid_task() but never calls put_task_struct() to drop the reference,
leaving task->usage unbalanced.

Fix the issue by adding '__free(put_task) = NULL' to the local variable
'task', ensuring that put_task_struct() is automatically invoked when
the variable goes out of scope.

Fixes: 7477d7dce4 ("pidfs: allow to retrieve exit information")
Signed-off-by: Adrian Huang (Lenovo) <adrianhuang0701@gmail.com>
Link: https://lore.kernel.org/20250814094453.15232-1-adrianhuang0701@gmail.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-08-15 16:10:46 +02:00
Qianfeng Rong
15769d9478
fs-writeback: Remove redundant __GFP_NOWARN
GFP_NOWAIT already includes __GFP_NOWARN, so let's remove
the redundant __GFP_NOWARN.

Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
Link: https://lore.kernel.org/20250803102243.623705-5-rongqianfeng@vivo.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-08-15 16:06:32 +02:00
Linus Torvalds
8d084337a3 sound fixes for 6.17-rc2
A collection of small fixes.
 
 - Potential OOB access fixes in USB-audio driver
 - ASoC kconfig menu fix for improving the generic drivers
 - HD-audio quirks and a fix revert
 - Codec and platform-specific small fixes for ASoC
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmifC9YOHHRpd2FpQHN1
 c2UuZGUACgkQLtJE4w1nLE/BehAAwhx8yxnhV9IYxS50C6ySvKnzaV8JbLeNaUeW
 JTJjGCY+zDX4+1D0NWyw/OhFEB2/Vua4MFWqwPrR7m0lgpm9wYnCT3ALbV3JKDPu
 b1ZlX6ZYHocSoMU1N1QDTC6Kec+UbKaOQwbrVFuKfo8Q+V7qo+burcyWgdpaVcLX
 OzmCUbONRNX68NlN4ZzfzBlKVDfkzPYHGcE5lmZKYHj4EfeeiK5MQGIuCj2UJ3bh
 urMTqJ7HmTfRmiiJZh9dMYET+Z0VtFkQtKIkZqIqgB6DbNsovkUMMvE6Bafzds4h
 BbzgXdMEbfRDvaCS2OrqgamtoTD5qC+Op6/XnnvSUwaCWobe/vrwJ0N/OIMCaaOo
 2fY6ST25/z5FUqf3LPxINCtk0z1CloGB7OgiiuPLh5N0hOTV+vdbEoBFs228PHCN
 InaissJ56YBmyMiXGqcCXEG9pBFOnV0SuqvSCWWATRHA9pP05/E1iIoXCzMKDiJP
 +YGufk4hZg0bXYRbu6HaFbP2YKYY0h4hs1NxS1uewF1ORHUkAYOQ2WNH3mxwz3uz
 N1oE70WSOiz0p37NGGkNX8w3AVzT5L3Ef8UCvtfYAVAF6cRE+TipUzESFBkNLAHZ
 Zx/t4HV8MSudx2sUUIS7JiC7+DJXMhIAHwvNUeGrGsC5nvpRY0/VPCAt+t8Xgu04
 n7hNYpo=
 =gCaR
 -----END PGP SIGNATURE-----

Merge tag 'sound-6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "A collection of small fixes:

   - Potential OOB access fixes in USB-audio driver

   - ASoC kconfig menu fix for improving the generic drivers

   - HD-audio quirks and a fix revert

   - Codec and platform-specific small fixes for ASoC"

* tag 'sound-6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: hda/tas2781: Normalize the volume kcontrol name
  ALSA: usb-audio: Validate UAC3 cluster segment descriptors
  ALSA: usb-audio: Validate UAC3 power domain descriptors, too
  Revert "ALSA: hda: Add ASRock X670E Taichi to denylist"
  ALSA: azt3328: Put __maybe_unused for inline functions for gameport
  ASoC: tas2781: Normalize the volume kcontrol name
  ASoC: stm: stm32_i2s: Fix calc_clk_div() error handling in determine_rate()
  ASoC: codecs: Call strscpy() with correct size argument
  ALSA: hda/realtek: Fix headset mic on HONOR BRB-X
  ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks
  ASoC: tas2781: Fix spelling mistake "dismatch" -> "mismatch"
  ASoC: rt1320: fix random cycle mute issue
  ASoC: rt721: fix FU33 Boost Volume control not working
  ASoC: generic: tidyup standardized ASoC menu for generic
  ASoC: codec: sma1307: replace spelling mistake with new error message
  ASoC: codecs: tx-macro: correct tx_macro_component_drv name
  ASoC: fsl_sai: replace regmap_write with regmap_update_bits
2025-08-15 07:02:57 -07:00
Tomasz Pakuła
13120abdb0 HID: pidff: Reduce PID_EFFECT_OPERATION spam
Keep track of effect's loop_count to reduce the spam of ffb play
commands coming from some games. This should speed up normal magnitude
etc updates and slightly increase max possible FFB refresh rate.

Helps games like Dirt Rally 2.0, F1 2023, WRC from KT

Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-15 15:58:10 +02:00
Tomasz Pakuła
5b9cae8c64 HID: universal-pidff: clang-format pass
Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-15 15:58:10 +02:00
Tomasz Pakuła
ae42428fb4 HID: pidff: clang-format pass
Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-15 15:58:10 +02:00
Tomasz Pakuła
63cc21dd8b HID: pidff: Define all cardinal directions
Will be used by ff-effect based autocentering

Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-15 15:58:10 +02:00
Tomasz Pakuła
82b2496227 HID: pidff: Remove Anssi's email address from info msg
Some users might try to contact him about issues and he's no longer
active when it comes to the driver development/fixes.

Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-15 15:58:09 +02:00
Tomasz Pakuła
c2dc9f0b36 HID: pidff: PERMISSIVE_CONTROL quirk autodetection
Fixes force feedback for devices built with MMOS firmware and many more
not yet detected devices.

Update quirks mask debug message to always contain all 32 bits of data.

Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-15 15:58:09 +02:00
Tomasz Pakuła
c774a9d78d HID: pidff: Separate check for infinite duration
It will be used in a few more places so this makes sure it will always
work the same.

Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-15 15:58:09 +02:00
Tomasz Pakuła
7fbaa031b9 HID: pidff: Rework pidff_upload_effect
One of the more complicated functions. Expunge some of the logic to
separate functions (FF -> PID id conversion)

Add a macro for envelope check to make it more readable in the upload
function.

All this made it possible to to expunge common code from the big switch
statement and reduce the overall function size considerably. Now it can
fit on one screen.

Move the effect_cout logic from report functions to upload/erase
functions.

Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-15 15:58:09 +02:00
Tomasz Pakuła
1abfcd86e3 HID: pidff: Update debug messages
Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>

Better indicate what operation is requested on a given effect (play or
stop). Previously, we only had the info about requesting playback but
this could be misleading when the looop count is 0.

Add debug print that shows what device control command was actually sent
to the device. Print out its hex hid usage.

Make field_index const to make sure it won't be changed by mistake later.

Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-15 15:58:02 +02:00
Tomasz Pakuła
1d72e7bd34 HID: pidff: Add support for AXES_ENABLE field
AXES_ENABLE can be used in place of DIRECTION_ENABLE to indicate, which
FFB-enabled axes will be affected by a given effect. EFFECT_DIRECTION
enables all and uses the first direction only while AXES_ENABLE is a
bitmask and bit indexes are the same as the defined GD usages in the
EFFECT_DIRECTION array. Each axis can have it's own direction in this
case.

Search for AXES_ENABLE, set AXES_ENABLE for all axes if DIRECTION_ENABLE
is not used.

Search for specific axes in the direction array. Save their indexes. This
let us know what axes are actually available on the device and which bit
in the AXES_ENABLE field corresponds to which axis.

Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-15 15:58:02 +02:00
Tomasz Pakuła
b974b372a9 HID: pidff: Simplify HID field/usage searching logic
Some deduplication and splitting into separate functions. This is now
way easier to comprehend and parse mentally.

Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-15 15:58:02 +02:00
Tomasz Pakuła
7f3d7bc0df HID: pidff: Better quirk assigment when searching for fields
Assign quirks directly when they're discovered. Way easier to understand
without relying on return values.

Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-15 15:58:02 +02:00
Tomasz Pakuła
c7ad7812fb HID: pidff: Treat PID_REQUIRED_REPORTS as count, not max
It's naming suggests it's a count of the records required by the USB PID
standard and this driver.

Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
Reviewed-by: Oleg Makarenko <oleg@makarenk.ooo>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-15 15:58:02 +02:00
Tomasz Pakuła
8de2cef6d0 HID: pidff: Use ARRAY_SIZE macro instead of sizeof
Could lead to issues when arrays won't be 8 bit fields

Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
Reviewed-by: Oleg Makarenko <oleg@makarenk.ooo>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-15 15:58:02 +02:00
Tomasz Pakuła
6513cfdd83 HID: pidff: Remove unneeded debug
All the envelope settings work correctly and even if we wanted to debug
something about the envelope report, we would not only need the attack
level but it's length and fade properties to have a full image.

Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
Reviewed-by: Oleg Makarenko <oleg@makarenk.ooo>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-15 15:58:02 +02:00
Tomasz Pakuła
a02c78f708 HID: pidff: Remove unhelpful pidff_set_actuators helper
Abstracts away too little of the functionality and replaces a nice,
defined value with a magic bool. There's no actual need for it.

Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
Reviewed-by: Oleg Makarenko <oleg@makarenk.ooo>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-15 15:58:01 +02:00
Tomasz Pakuła
f345a4798d HID: pidff: Use direction fix only for conditional effects
The already fixed bug in SDL only affected conditional effects. This
should fix FFB in Forza Horizion 4/5 on Moza Devices as Forza Horizon
flips the constant force direction instead of using negative magnitude
values.

Changing the direction in the effect directly in pidff_upload_effect()
would affect it's value in further operations like comparing to the old
effect and/or just reading the effect values in the user application.

This, in turn, would lead to constant PID_SET_EFFECT spam as the effect
direction would constantly not match the value that's set by the
application.

This way, it's still transparent to any software/API.

Only affects conditional effects now so it's better for it to explicitly
state that in the name. If any HW ever needs fixed direction for other
effects, we'll add more quirks.

Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
Reviewed-by: Oleg Makarenko <oleg@makarenk.ooo>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-15 15:58:01 +02:00
David Howells
a3de58b12c
netfs: Fix unbuffered write error handling
If all the subrequests in an unbuffered write stream fail, the subrequest
collector doesn't update the stream->transferred value and it retains its
initial LONG_MAX value.  Unfortunately, if all active streams fail, then we
take the smallest value of { LONG_MAX, LONG_MAX, ... } as the value to set
in wreq->transferred - which is then returned from ->write_iter().

LONG_MAX was chosen as the initial value so that all the streams can be
quickly assessed by taking the smallest value of all stream->transferred -
but this only works if we've set any of them.

Fix this by adding a flag to indicate whether the value in
stream->transferred is valid and checking that when we integrate the
values.  stream->transferred can then be initialised to zero.

This was found by running the generic/750 xfstest against cifs with
cache=none.  It splices data to the target file.  Once (if) it has used up
all the available scratch space, the writes start failing with ENOSPC.
This causes ->write_iter() to fail.  However, it was returning
wreq->transferred, i.e. LONG_MAX, rather than an error (because it thought
the amount transferred was non-zero) and iter_file_splice_write() would
then try to clean up that amount of pipe bufferage - leading to an oops
when it overran.  The kernel log showed:

    CIFS: VFS: Send error in write = -28

followed by:

    BUG: kernel NULL pointer dereference, address: 0000000000000008

with:

    RIP: 0010:iter_file_splice_write+0x3a4/0x520
    do_splice+0x197/0x4e0

or:

    RIP: 0010:pipe_buf_release (include/linux/pipe_fs_i.h:282)
    iter_file_splice_write (fs/splice.c:755)

Also put a warning check into splice to announce if ->write_iter() returned
that it had written more than it was asked to.

Fixes: 288ace2f57 ("netfs: New writeback implementation")
Reported-by: Xiaoli Feng <fengxiaoli0714@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220445
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://lore.kernel.org/915443.1755207950@warthog.procyon.org.uk
cc: Paulo Alcantara <pc@manguebit.org>
cc: Steve French <sfrench@samba.org>
cc: Shyam Prasad N <sprasad@microsoft.com>
cc: netfs@lists.linux.dev
cc: linux-cifs@vger.kernel.org
cc: linux-fsdevel@vger.kernel.org
cc: stable@vger.kernel.org
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-08-15 15:56:49 +02:00
Linus Torvalds
7bb7780e3c gpio fixes for v6.17-rc2
- fix the way optional interrupts are retrieved from firmware in
   gpio-mlxbf3
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEFp3rbAvDxGAT0sefEacuoBRx13IFAmie81cACgkQEacuoBRx
 13ITjxAAqoSjsoODn+8rpx08uhGCa98i1BX46uOgJJzsbE2JcSDjztNodXP02eJh
 vg049tOy2YT0+OdHbuEjDoW8yzmiQRB6/nZ2FbwUFNArGr7eQEizIrDnNixEf/nD
 oYpZENd9njIzDBtdJe47ZPV4k3GB38zcAbrtGLVh2zwyZcnwuT8veymENjDl82f6
 YB83IM6fY9SQrEy6zctWS+u2hVcI+6XlaFDjOK2UAiey6REeAfEVD+B31rHdogqa
 7DvLnzGnrNsIykimmIGBrlEkskcCgh5mLagEl5n0O2K4GWDKluXrtId3Cefn34JM
 hnpIh5gVBWGeFC1IRN0N02Z8yq67/qi8rNHD8xcLjkShdPAanBh95UIRbbyM4EK3
 q8ZtC01fHV4Pjz9K/6ZV71GVmllFXHRZbWDhJRsSkIDgV03O+F/J1vNnGbQMXiDn
 aNiPicEe1hmRbi+9B+qq+he6ncqP37UxYd7C/XMKdAvXTIwQUhu9cGgl7vQl0ojN
 dySdzH/y7O/WUI+RCrepAic/PgXFXtPC6D7M3D3iWOZpMeV0IPfc5SdgidtRcVt0
 DFJZGl9Im1Dzn09kTQn6cDJmNKW6ekpp5tCPrrAmtyKY4XgOCHFcLC8kxsrBNYar
 nDip/Y2eMnnRmfmdXXt6DlkDwlc3TissTK2j9XhY3ETASp48+Dk=
 =PyWR
 -----END PGP SIGNATURE-----

Merge tag 'gpio-fixes-for-v6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux

Pull gpio fix from Bartosz Golaszewski:

 - fix the way optional interrupts are retrieved from firmware in
   gpio-mlxbf3

* tag 'gpio-fixes-for-v6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
  gpio: mlxbf3: use platform_get_irq_optional()
  Revert "gpio: mlxbf3: only get IRQ for device instance 0"
2025-08-15 06:54:37 -07:00
Bjorn Andersson
2eb676f141 Revert "arm64: dts: qcom: sm8450: add initial device tree for Samsung Galaxy S22"
This reverts commit 46952305d2 ("arm64: dts: qcom: sm8450: add initial
device tree for Samsung Galaxy S22"), as the merged version had been
superseded and received further feedback.

Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2025-08-15 08:51:32 -05:00
Thomas Bertschinger
b5ca88927e
fhandle: do_handle_open() should get FD with user flags
In f07c7cc468, do_handle_open() was switched to use the automatic
cleanup method for getting a FD. In that change it was also switched
to pass O_CLOEXEC unconditionally to get_unused_fd_flags() instead
of passing the user-specified flags.

I don't see anything in that commit description that indicates this was
intentional, so I am assuming it was an oversight.

With this fix, the FD will again be opened with, or without, O_CLOEXEC
according to what the user requested.

Fixes: f07c7cc468 ("fhandle: simplify error handling")
Signed-off-by: Thomas Bertschinger <tahbertschinger@gmail.com>
Link: https://lore.kernel.org/20250814235431.995876-4-tahbertschinger@gmail.com
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-08-15 15:46:57 +02:00
Pauli Virtanen
0b3725dbf6 Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established
BN == 0x00 in CIS Established means no isochronous data for the
corresponding direction (Core v6.1 pp. 2394). In this case SDU MTU
should be 0.

However, the specification does not say the Max_PDU_C_To_P or P_To_C are
then zero.  Intel AX210 in Framed CIS mode sets nonzero Max_PDU for
direction with zero BN.  This causes failure later when we try to LE
Setup ISO Data Path for disabled direction, which is disallowed (Core
v6.1 pp. 2750).

Fix by setting SDU MTU to 0 if BN == 0.

Fixes: 2be22f1941 ("Bluetooth: hci_event: Fix parsing of CIS Established Event")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2025-08-15 09:44:49 -04:00
Yang Li
4d19cd228b Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF
After LE Extended Scan times out, conn->sid remains 0xFF,
so the PA sync creation process should be aborted.

Btmon snippet from PA sync with SID=0xFF:

< HCI Command: LE Set Extended.. (0x08|0x0042) plen 6  #74726 [hci0] 863.107927
        Extended scan: Enabled (0x01)
        Filter duplicates: Enabled (0x01)
        Duration: 0 msec (0x0000)
        Period: 0.00 sec (0x0000)
> HCI Event: Command Complete (0x0e) plen 4            #74727 [hci0] 863.109389
      LE Set Extended Scan Enable (0x08|0x0042) ncmd 1
        Status: Success (0x00)
< HCI Command: LE Periodic Ad.. (0x08|0x0044) plen 14  #74728 [hci0] 865.141168
        Options: 0x0000
        Use advertising SID, Advertiser Address Type and address
        Reporting initially enabled
        SID: 0xff
        Adv address type: Random (0x01)
        Adv address: 0D:D7:2C:E7:42:46 (Non-Resolvable)
        Skip: 0x0000
        Sync timeout: 20000 msec (0x07d0)
        Sync CTE type: 0x0000
> HCI Event: Command Status (0x0f) plen 4              #74729 [hci0] 865.143223
      LE Periodic Advertising Create Sync (0x08|0x0044) ncmd 1
        Status: Success (0x00)

Fixes: e2d471b780 ("Bluetooth: ISO: Fix not using SID from adv report")
Signed-off-by: Yang Li <yang.li@amlogic.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2025-08-15 09:44:49 -04:00
Luiz Augusto von Dentz
3dcf7175f2 Bluetooth: hci_core: Fix using ll_privacy_capable for current settings
ll_privacy_capable only indicates that the controller supports the
feature but it doesnt' check that LE is enabled so it end up being
marked as active in the current settings when it shouldn't.

Fixes: ad383c2c65 ("Bluetooth: hci_sync: Enable advertising when LL privacy is enabled")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2025-08-15 09:44:49 -04:00
Luiz Augusto von Dentz
709788b154 Bluetooth: hci_core: Fix using {cis,bis}_capable for current settings
{cis,bis}_capable only indicates the controller supports the feature
since it doesn't check that LE is enabled so it shall not be used for
current setting, instead this introduces {cis,bis}_enabled macros that
can be used to indicate that these features are currently enabled.

Fixes: 26afbd826e ("Bluetooth: Add initial implementation of CIS connections")
Fixes: eca0ae4aea ("Bluetooth: Add initial implementation of BIS connections")
Fixes: ae75336131 ("Bluetooth: Check for ISO support in controller")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2025-08-15 09:44:49 -04:00
Jiande Lu
099799fa9b Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown
During the shutdown process, an interrupt occurs that
prematurely terminates the wait for the expected event.
This change replaces TASK_INTERRUPTIBLE with
TASK_UNINTERRUPTIBLE in the wait_on_bit_timeout call to ensure
the shutdown process completes as intended without being
interrupted by signals.

Fixes: d019930b00 ("Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c")
Signed-off-by: Jiande Lu <jiande.lu@mediatek.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2025-08-15 09:44:49 -04:00
Luiz Augusto von Dentz
3ba486c5f3 Bluetooth: hci_conn: Fix not cleaning up Broadcaster/Broadcast Source
This fixes Broadcaster/Broadcast Source not sending HCI_OP_LE_TERM_BIG
because HCI_CONN_PER_ADV where not being set.

Fixes: a7bcffc673 ("Bluetooth: Add PA_LINK to distinguish BIG sync and PA sync connections")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2025-08-15 09:44:49 -04:00
Luiz Augusto von Dentz
d36349ea73 Bluetooth: hci_conn: Fix running bis_cleanup for hci_conn->type PA_LINK
Connections with type of PA_LINK shall be considered temporary just to
track the lifetime of PA Sync setup, once the BIG Sync is established
and connection are created with BIS_LINK the existing PA_LINK
connection shall not longer use bis_cleanup otherwise it terminates the
PA Sync when that shall be left to BIS_LINK connection to do it.

Fixes: a7bcffc673 ("Bluetooth: Add PA_LINK to distinguish BIG sync and PA sync connections")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2025-08-15 09:44:49 -04:00
Luiz Augusto von Dentz
aee29c18a3 Bluetooth: ISO: Fix getname not returning broadcast fields
getname shall return iso_bc fields for both BIS_LINK and PA_LINK since
the likes of bluetoothd do use the getpeername to retrieve the SID both
when enumerating the broadcasters and when synchronizing.

Fixes: a7bcffc673 ("Bluetooth: Add PA_LINK to distinguish BIG sync and PA sync connections")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2025-08-15 09:44:49 -04:00
Luiz Augusto von Dentz
ca88be1a27 Bluetooth: hci_sync: Fix scan state after PA Sync has been established
Passive scanning is used to program the address of the peer to be
synchronized, so once HCI_EV_LE_PA_SYNC_ESTABLISHED is received it
needs to be updated after clearing HCI_PA_SYNC then call
hci_update_passive_scan_sync to return it to its original state.

Fixes: 6d0417e4e1 ("Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2025-08-15 09:44:49 -04:00
Yang Li
de5d7d3f27 Bluetooth: hci_sync: Avoid adding default advertising on startup
list_empty(&hdev->adv_instances) is always true during startup,
so an advertising instance is added by default.

Call trace:
  dump_backtrace+0x94/0xec
  show_stack+0x18/0x24
  dump_stack_lvl+0x48/0x60
  dump_stack+0x18/0x24
  hci_setup_ext_adv_instance_sync+0x17c/0x328
  hci_powered_update_adv_sync+0xb4/0x12c
  hci_powered_update_sync+0x54/0x70
  hci_power_on_sync+0xe4/0x278
  hci_set_powered_sync+0x28/0x34
  set_powered_sync+0x40/0x58
  hci_cmd_sync_work+0x94/0x100
  process_one_work+0x168/0x444
  worker_thread+0x378/0x3f4
  kthread+0x108/0x10c
  ret_from_fork+0x10/0x20

Link: https://github.com/bluez/bluez/issues/1442
Signed-off-by: Yang Li <yang.li@amlogic.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2025-08-15 09:44:49 -04:00
Linus Torvalds
66ba63d4d8 pmdomain providers:
- tegra: Ensure pmc power-domains are in a known state
 -----BEGIN PGP SIGNATURE-----
 
 iQJLBAABCgA1FiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmie6iQXHHVsZi5oYW5z
 c29uQGxpbmFyby5vcmcACgkQ/iaEJXNYjCk4MBAAg1rfgy2Ui3kP3kWVeOA3gf/k
 eTfxEYuZhJaDG5Q/WWrREQR3q3V+rLdaBxyWjdGAkT9a8LnnJV21TUsDII/Segfz
 4HcJA5txV2LcOtiZVg0S4J/aKA4klhPji/H8vN3yEq5xS2ldre9oB9z+u8yPuOhm
 zmtxjrtzNZNkcSim+wE4tfk9XmnEut71Dh2IG8whTrxNnWXJnCbfgRn6jznKGlBm
 i1Wrwdk05Z4EA4nkAHfeXWqqGcZoGhlFnFCYqKG0wymTBX0MPbT1dP1plwaKME0I
 8ZQT+41Tm0BBs0T6PtWm238RmHqTGw2kP2QWXZvlbh3BMXDdoEqAvrwEuIOzOoPC
 +lmCRhU8kHeDrI9wuMAntiuqAF2Mjq2UJs2qfyLsS2if9Di773i7U4tC9m1b+G2A
 cvTj9A3X7/xlKFw4L8eF1xZU8vJ+A8woPpNPyUTgrK2NXdKU5MZdHIXfGyFCtEuQ
 60z0iaYZt/7sksc3RfeCus4p72eFfpqK1ryHG75FhkQ/oNpxVk7VSfq9eEtnJ4H8
 K5uVjxYkS4rd2/dPmMCW0CtnHvZNXrCc/0hMnpos8qQ8rftrvEVlt4+jQLupxLTd
 L7fa9ZIxzJSBNGqQY7uuJBeC44Z2UyuOBz+qbzGTocS6If5ggd1yj+Vs4JuSEFrO
 UXFG98C0+iJN5GQ1lgI=
 =cH2o
 -----END PGP SIGNATURE-----

Merge tag 'pmdomain-v6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm

Pull pmdomain fix from Ulf Hansson:

 - tegra: Ensure pmc power-domains are in a known state

* tag 'pmdomain-v6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm:
  soc/tegra: pmc: Ensure power-domains are in a known state
2025-08-15 06:30:53 -07:00
Linus Torvalds
55ddcff735 Nine smb3 client fixes
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmiegSwACgkQiiy9cAdy
 T1GFvwv+JJajYgnBMmH/fOHpeozxV9PYpS+ACw1dTTR6wW9wH4e0P9lD1iqGR8bD
 gewwvcaf6d2rw1fs3WfrJsSaQs+wmnIKlMFpMNMMHbW127Yts0stnclVhIrYAnE+
 /JjK/d2dhpt6YJFGsYHK83OBsVsSY98KZPOuLUMo4cTmqzlEudWvcZapllNOiq6t
 ygbdB89+o5ZAASeXzTJXOrcydamlCMMsdxBzs1GdQ6I84yDgXHhyPpY3rQAxy06L
 TJkJO3IM9we0WBgh0qbglvH2D+KGJTbtB5q13CRMJ/PfeExWXdUEjXyYqa+wdyxY
 3lcYmORhVuEQ6miLLPQjeFulGOi08G2rm1LzjKSmMsVuR4IJp22w0xZ0xeElJtos
 xZEM6fX3cYYDWBbd7wSKp+XGsQLqDu505QKQY68Oyy5ji57851WfNZdCKfMkpx8a
 54U1/XpP9KzqTKTNihxrbgZWpVPM5dB1k8RCBzqVVQ5jJK85kD77UBfEWbkE8Hbl
 rXR18Et7
 =SgEg
 -----END PGP SIGNATURE-----

Merge tag '6.17-rc1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6

Pull smb client fixes from Steve French:

 - Fix unlink race and rename races

 - SMB3.1.1 compression fix

 - Avoid unneeded strlen calls in cifs_get_spnego_key

 - Fix slab out of bounds in parse_server_interfaces()

 - Fix mid leak and server buffer leak

 - smbdirect send error path fix

 - update internal version #

 - Fix unneeded response time update in negotiate protocol

* tag '6.17-rc1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
  smb: client: remove redundant lstrp update in negotiate protocol
  cifs: update internal version number
  smb: client: don't wait for info->send_pending == 0 on error
  smb: client: fix mid_q_entry memleak leak with per-mid locking
  smb3: fix for slab out of bounds on mount to ksmbd
  cifs: avoid extra calls to strlen() in cifs_get_spnego_key()
  cifs: Fix collect_sample() to handle any iterator type
  smb: client: fix race with concurrent opens in rename(2)
  smb: client: fix race with concurrent opens in unlink(2)
2025-08-15 05:58:19 -07:00
Jani Nikula
63e0b17ae7 drm/i915/bo: remove unnecessary include
intel_bo.c doesn't need intel_display_types.h for anything. Remove.

Reviewed-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/20250814132445.1573035-1-jani.nikula@intel.com
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2025-08-15 14:13:20 +03:00
Thomas Gleixner
448f97fba9 perf: Convert mmap() refcounts to refcount_t
The recently fixed reference count leaks could have been detected by using
refcount_t and refcount_t would have mitigated the potential overflow at
least.

Now that the code is properly structured, convert the mmap() related
mmap_count variants over to refcount_t.

No functional change intended.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Link: https://lore.kernel.org/r/20250812104020.071507932@infradead.org
2025-08-15 13:13:02 +02:00
Peter Zijlstra
59741451b4 perf: Identify the 0->1 transition for event::mmap_count
Needed because refcount_inc() doesn't allow the 0->1 transition.

Specifically, this is the case where we've created the RB, this means
there was no RB, and as such there could not have been an mmap.
Additionally we hold mmap_mutex to serialize everything.

This must be the first.

Suggested-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lore.kernel.org/r/20250812104019.956479989@infradead.org
2025-08-15 13:13:02 +02:00
Peter Zijlstra
d23a6dbc0a perf: Use scoped_guard() for mmap_mutex in perf_mmap()
Mostly just re-indent noise.

Suggested-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Link: https://lore.kernel.org/r/20250812104019.838047976@infradead.org
2025-08-15 13:13:01 +02:00
Peter Zijlstra
5d299897f1 perf: Split out the RB allocation
Move the RB buffer allocation branch into its own function.

Originally-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Link: https://lore.kernel.org/r/20250812104019.722214699@infradead.org
2025-08-15 13:13:01 +02:00
Peter Zijlstra
191759e5ea perf: Make RB allocation branch self sufficient
Ensure @rb usage doesn't extend out of the branch block.

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Link: https://lore.kernel.org/r/20250812104019.605285302@infradead.org
2025-08-15 13:13:01 +02:00
Peter Zijlstra
2aee376823 perf: Split out the AUX buffer allocation
Move the AUX buffer allocation branch into its own function.

Originally-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Link: https://lore.kernel.org/r/20250812104019.494205648@infradead.org
2025-08-15 13:13:00 +02:00
Peter Zijlstra
8558dca9fb perf: Reflow to get rid of aux_success label
Mostly re-indent noise needed to get rid of that label.

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Link: https://lore.kernel.org/r/20250812104019.362581570@infradead.org
2025-08-15 13:13:00 +02:00
Peter Zijlstra
b33a51564e perf: Use guard() for aux_mutex in perf_mmap()
After duplicating the common code into the rb/aux branches is it
possible to use a simple guard() for the aux_mutex. Making the aux
branch self-contained.

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Link: https://lore.kernel.org/r/20250812104019.246250452@infradead.org
2025-08-15 13:13:00 +02:00
Peter Zijlstra
41b80e1d74 perf: Remove redundant aux_unlock label
unlock and aux_unlock are now identical, remove the aux_unlock one.

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Link: https://lore.kernel.org/r/20250812104019.131293512@infradead.org
2025-08-15 13:13:00 +02:00