Commit graph

1,399,042 commits

Author SHA1 Message Date
Rob Herring (Arm)
da8dd0a937 MAINTAINERS: Add FSI bindings to FSI subsystem entry
Maintainers of a subsystem should also be the maintainer for
corresponding DT bindings. Add the FSI bindings to the FSI subsystem
entry.

Acked-by: Eddie James <eajames@linux.ibm.com>
Link: https://lore.kernel.org/r/20250731-dt-fsi-cleanups-v1-4-e7b695a29fc3@kernel.org
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-08-11 08:10:39 -05:00
Rob Herring (Arm)
a54ef14188
regulator: dt-bindings: Clean-up active-semi,act8945a duplication
The active-semi,act8945a binding is documented in multiple places. The
charger child node is documented in regulator/active-semi,act8945a.yaml
and power/supply/active-semi,act8945a-charger.yaml. An old text binding
is in mfd/act8945a.txt.

Update the regulator/active-semi,act8945a.yaml with the additional
descriptions and constraints from
power/supply/active-semi,act8945a-charger.yaml, and then remove it and
mfd/act8945a.txt.

Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://patch.msgid.link/20250807214459.4173892-1-robh@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-08-11 14:08:54 +01:00
Dzmitry Sankouski
bb24414023
regulator: add s2dos05 regulator support
S2DOS05 has 1 buck and 4 LDO regulators, used for powering
panel/touchscreen.

Signed-off-by: Dzmitry Sankouski <dsankouski@gmail.com>
Link: https://patch.msgid.link/20250805-starqltechn_integration_upstream-v8-1-09d8a321fafe@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-08-11 14:08:53 +01:00
Liao Yuanhong
f6cc4140e1
regulator: tps6524x: Remove unnecessary memset
devm_kzalloc() has already been initialized to full 0 space, there is no
need to use memset() to initialize again.

Signed-off-by: Liao Yuanhong <liaoyuanhong@vivo.com>
Link: https://patch.msgid.link/20250807123949.495193-1-liaoyuanhong@vivo.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-08-11 14:08:52 +01:00
Rob Herring (Arm)
c072d2b495 scripts/dtc: Update to upstream version v1.7.2-35-g52f07dcca47c
This adds the following commits from upstream:

52f07dcca47c dtc: Add informative error for stray identifier
9cabae6b0351 checks: Fix detection of 'i2c-bus' node
605dc044c3fe New helper to add markers
7da5d106c740 fdtput: Fix documentation about existing nodes
53c63dd421d7 dtdiff: Use input format dtb for dtbo files
84d9dd2fcbc8 dtc: Add data_insert_data function
97011d1f4e98 meson: use override_find_program/override_dependency
b841391bbd08 srcpos: Define srcpos_free
e0b7749c26a9 Add alloc_marker
ecb21febfdd3 meson: port python bindings to build natively via meson and meson-python
7ebfcac8520e Makefile: deprecate in favor of Meson
f4c53f4ebf78 Use __ASSEMBLER__ instead of __ASSEMBLY__
205fbef17b7b Fix some typos
da85f91931e5 Remove duplicated words in documentation and comments
dd1b3e532d22 meson: support building libfdt without static library
1ccd232709d4 meson: don't build test programs by default
ce1d8588880a tests: When building .so from -O asm output mark as non-executable stack
915daadbb62d Start with empty __local_fixups__ and __fixups__ nodes
4ea851f5a44d Let get_subnode() not return deleted nodes
175d2a564c47 Use build_root_node() instead of open-coding it
18f4f305fdd7 build: fix -Dtools=false build
267efc7d4694 checks: Warn about missing #address-cells for interrupt parents
755db115355b libfdt: Add fdt_setprop_namelen_string()
bdca8612009e libfdt: Add fdt_setprop_namelen()
0f69cedc08fc libfdt_internal: fdt_find_string_len_()
56b2b30c5bd0 libfdt: add fdt_get_property_namelen_w()
1e8c5f60e127 Add clang-format config
6f183c7d9246 checks: Relax avoid_unnecessary_addr_size check to allow child ranges properties
66c7d0e6f4f3 tests/sw_tree1.c: fix unitialized saveptr
9a969f3b70b0 pylibfdt/libfdt.i: fix backwards compatibility of return values
4292b072a23a .github/workflows: update ubuntu runner to supported version
1c745a9bd169 libfdt: Remove fdt parameter from overlay_fixup_one_phandle
b3bbee6b1242 libfdt: Move the SBOM authors section
d1656730abfb Add a SBOM file in CycloneDX format
b75515af4576 libfdt: Remove extra semi-colons outside functions
2d10aa2afe35 Bump version to v1.7.2
48795c82bdb6 pylibfdt: Don't emit warnings from swig generate C code
838f11e830e3 fdtoverlay: provide better error message for missing `/__symbols__`
d1e2384185c5 pylibfdt/libfdt.i: Use SWIG_AppendOutput
18aa49a9f68d Escape spaces in depfile with backslashes.
f9968fa06921 libfdt.h: whitespace consistency fixups
9b5f65fb3d8d libfdt.h: typo and consistency fixes
99031e3a4a6e Bump version to v1.7.1
3d5e376925fd setup: Move setting of srcdir down to the bottom
e277553b9880 setup: Collect top-level code together
7e5a88984081 setup: Move version and full_description into a function
78b6a85c113b Tidy up some pylint warnings
3501d373f0a2 Require Python 3

The added include of string.h in libfdt_internal.h breaks the kernel
overriding libfdt_env.h with its own string functions, so it is dropped.
An upstream fix is pending.

Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-08-11 08:08:51 -05:00
Chen Ni
c6871d56b5
regulator: tps6594-regulator: Remove unneeded semicolon
Remove unnecessary semicolons reported by Coccinelle/coccicheck and the
semantic patch at scripts/coccinelle/misc/semicolon.cocci.

Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
Link: https://patch.msgid.link/20250729040044.1851988-1-nichen@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-08-11 14:08:51 +01:00
Geert Uytterhoeven
6ec4b94e8e gpio: TODO: remove the task for converting to the new line setters
The task is complete, but this was not reflected in the TODO file.

Fixes: d9d87d90cc ("treewide: rename GPIO set callbacks back to their original names")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/417af7e5a110c527eb759289bd5d2fd6885f4e01.1754917104.git.geert+renesas@glider.be
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
2025-08-11 15:03:57 +02:00
Patrice Chotard
d140f3ba76 memory: stm32_omm: Fix req2ack update test
If "st,omm-req2ack-ns" property is found and its value is not 0,
the current test doesn't allow to compute and set req2ack value,
Fix this test.

Fixes: 8181d061dc ("memory: Add STM32 Octo Memory Manager driver")
Signed-off-by: Patrice Chotard <patrice.chotard@foss.st.com>
Link: https://lore.kernel.org/r/20250807-upstream_omm_fix_req2ack_test_condition-v2-1-d7df4af2b48b@foss.st.com
Cc: <stable@vger.kernel.org>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
2025-08-11 14:53:13 +02:00
Christian Brauner
573015dfa6
Merge patch series "fscontext: do not consume log entries when returning -EMSGSIZE"
Aleksa Sarai <cyphar@cyphar.com> says:

Userspace generally expects APIs that return -EMSGSIZE to allow for them
to adjust their buffer size and retry the operation. However, the
fscontext log would previously clear the message even in the -EMSGSIZE
case.

Given that it is very cheap for us to check whether the buffer is too
small before we remove the message from the ring buffer, let's just do
that instead. While we're at it, refactor some fscontext_read() into a
separate helper to make the ring buffer logic a bit easier to read.

* patches from https://lore.kernel.org/20250807-fscontext-log-cleanups-v3-0-8d91d6242dc3@cyphar.com:
  selftests/filesystems: add basic fscontext log tests
  fscontext: do not consume log entries when returning -EMSGSIZE

Link: https://lore.kernel.org/20250807-fscontext-log-cleanups-v3-0-8d91d6242dc3@cyphar.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-08-11 14:52:41 +02:00
Christian Brauner
bfa8ee11dc
Merge patch series "vfs: output mount_too_revealing() errors to fscontext"
Aleksa Sarai <cyphar@cyphar.com> says:

It makes little sense for fsmount() to output the warning message when
mount_too_revealing() is violated to kmsg. Instead, the warning should
be output (with a "VFS" prefix) to the fscontext log. In addition,
include the same log message for mount_too_revealing() when doing a
regular mount for consistency.

With the newest fsopen()-based mount(8) from util-linux, the error
messages now look like

  # mount -t proc proc /tmp
  mount: /tmp: fsmount() failed: VFS: Mount too revealing.
	 dmesg(1) may have more information after failed mount system call.

which could finally result in mount_too_revealing() errors being easier
for users to detect and understand.

* patches from https://lore.kernel.org/20250806-errorfc-mount-too-revealing-v2-0-534b9b4d45bb@cyphar.com:
  vfs: output mount_too_revealing() errors to fscontext
  fscontext: add custom-prefix log helpers

Link: https://lore.kernel.org/20250806-errorfc-mount-too-revealing-v2-0-534b9b4d45bb@cyphar.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-08-11 14:52:41 +02:00
Aleksa Sarai
df579e4711
selftests/filesystems: add basic fscontext log tests
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
Link: https://lore.kernel.org/20250807-fscontext-log-cleanups-v3-2-8d91d6242dc3@cyphar.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-08-11 14:52:41 +02:00
Aleksa Sarai
72d271a7ba
fscontext: do not consume log entries when returning -EMSGSIZE
Userspace generally expects APIs that return -EMSGSIZE to allow for them
to adjust their buffer size and retry the operation. However, the
fscontext log would previously clear the message even in the -EMSGSIZE
case.

Given that it is very cheap for us to check whether the buffer is too
small before we remove the message from the ring buffer, let's just do
that instead. While we're at it, refactor some fscontext_read() into a
separate helper to make the ring buffer logic a bit easier to read.

Fixes: 007ec26cdc ("vfs: Implement logging through fs_context")
Cc: David Howells <dhowells@redhat.com>
Cc: stable@vger.kernel.org # v5.2+
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
Link: https://lore.kernel.org/20250807-fscontext-log-cleanups-v3-1-8d91d6242dc3@cyphar.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-08-11 14:52:41 +02:00
Christian Brauner
5e6de2a72e
Merge patch series "fs: Remove old mount API helpers"
Pedro Falcato <pfalcato@suse.de> says:

This patchset contains a very small cleanup, where we remove mount_nodev
(unused since 6.15) and mount_bdev (unused since f2fs converted their
mount API usage, still in -next). While we're at it, we also get to
removing some stale mount API docs.

* patches from https://lore.kernel.org/20250723132156.225410-1-pfalcato@suse.de:
  docs/vfs: Remove mentions to the old mount API helpers
  fs: Remove mount_bdev
  fs: Remove mount_nodev

Link: https://lore.kernel.org/20250723132156.225410-1-pfalcato@suse.de
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-08-11 14:52:40 +02:00
Aleksa Sarai
807602d8cf
vfs: output mount_too_revealing() errors to fscontext
It makes little sense for fsmount() to output the warning message when
mount_too_revealing() is violated to kmsg. Instead, the warning should
be output (with a "VFS" prefix) to the fscontext log. In addition,
include the same log message for mount_too_revealing() when doing a
regular mount for consistency.

With the newest fsopen()-based mount(8) from util-linux, the error
messages now look like

  # mount -t proc proc /tmp
  mount: /tmp: fsmount() failed: VFS: Mount too revealing.
         dmesg(1) may have more information after failed mount system call.

which could finally result in mount_too_revealing() errors being easier
for users to detect and understand.

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
Link: https://lore.kernel.org/20250806-errorfc-mount-too-revealing-v2-2-534b9b4d45bb@cyphar.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-08-11 14:52:40 +02:00
Pedro Falcato
92becd1701
docs/vfs: Remove mentions to the old mount API helpers
Now that mount_bdev(), mount_nodev() and mount_single() have all been
removed, remove mentions to them in vfs.rst.

While we're at it, redirect people looking for mount API docs to
mount_api.rst (which documents the newer API).

Signed-off-by: Pedro Falcato <pfalcato@suse.de>
Link: https://lore.kernel.org/20250723132156.225410-4-pfalcato@suse.de
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-08-11 14:52:40 +02:00
Aleksa Sarai
ad7fe23b4b
fscontext: add custom-prefix log helpers
Sometimes, errors associated with an fscontext come from the VFS or
otherwise outside of the filesystem driver itself. However, the default
logging of errorfc will always prefix the message with the filesystem
name.

So, add some *fcp() wrappers that allow for custom prefixes to be used
when emitting information to the fscontext log.

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
Link: https://lore.kernel.org/20250806-errorfc-mount-too-revealing-v2-1-534b9b4d45bb@cyphar.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-08-11 14:52:40 +02:00
Pedro Falcato
f7d161c280
fs: Remove mount_bdev
mount_bdev has no in-tree users ever since f2fs adopted the new mount
API. Remove it.

Signed-off-by: Pedro Falcato <pfalcato@suse.de>
Link: https://lore.kernel.org/20250723132156.225410-3-pfalcato@suse.de
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-08-11 14:52:40 +02:00
Pedro Falcato
56ecfd9175
fs: Remove mount_nodev
mount_nodev has had no in-tree users since
cc0876f817 ("vfs: Convert devpts to use the new mount API").
Remove it.

Signed-off-by: Pedro Falcato <pfalcato@suse.de>
Link: https://lore.kernel.org/20250723132156.225410-2-pfalcato@suse.de
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-08-11 14:52:40 +02:00
Thomas Weißschuh
708c04a5c2
fs: always return zero on success from replace_fd()
replace_fd() returns the number of the new file descriptor through the
return value of do_dup2(). However its callers never care about the
specific returned number. In fact the caller in receive_fd_replace() treats
any non-zero return value as an error and therefore never calls
__receive_sock() for most file descriptors, which is a bug.

To fix the bug in receive_fd_replace() and to avoid the same issue
happening in future callers, signal success through a plain zero.

Suggested-by: Al Viro <viro@zeniv.linux.org.uk>
Link: https://lore.kernel.org/lkml/20250801220215.GS222315@ZenIV/
Fixes: 173817151b ("fs: Expand __receive_fd() to accept existing fd")
Fixes: 42eb0d54c0 ("fs: split receive_fd_replace from __receive_fd")
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Link: https://lore.kernel.org/20250805-fix-receive_fd_replace-v3-1-b72ba8b34bac@linutronix.de
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-08-11 14:52:25 +02:00
Xichao Zhao
f7d812357e
fs: fix "writen"->"written"
Trivial fix to spelling mistake in comment text.

Signed-off-by: Xichao Zhao <zhao.xichao@vivo.com>
Link: https://lore.kernel.org/20250808083758.229563-1-zhao.xichao@vivo.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-08-11 14:52:25 +02:00
Kriish Sharma
4e02192081
fs: document 'name' parameter for name_contains_dotdot()
The kernel-doc for name_contains_dotdot() was missing the @name
parameter description, leading to a warning during make htmldocs.

Add the missing documentation to resolve this warning.

Signed-off-by: Kriish Sharma <kriish.sharma2006@gmail.com>
Link: https://lore.kernel.org/20250730201853.8436-1-kriish.sharma2006@gmail.com
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-08-11 14:52:25 +02:00
Christoph Hellwig
17e8b7e08f
fs: mark file_remove_privs_flags static
file_remove_privs_flags is only used inside of inode.c, mark it static.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/20250724074854.3316911-1-hch@lst.de
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-08-11 14:52:24 +02:00
Thiago Becker
15a04f94f4
locks: Remove the last reference to EXPORT_OP_ASYNC_LOCK.
Commit b875bd5b38 ("exportfs: Remove EXPORT_OP_ASYNC_LOCK") removed
all references to EXPORT_OP_ASYNC_LOCK, but one lasted in the
comments for fs/locks.c. Remove it.

Signed-off-by: Thiago Becker <tbecker@redhat.com>
Link: https://lore.kernel.org/20250724203516.153616-1-tbecker@redhat.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-08-11 14:52:24 +02:00
Joanne Koong
542ede096e
fuse: keep inode->i_blkbits constant
With fuse now using iomap for writeback handling, inode blkbits changes
are problematic because iomap relies on inode->i_blkbits for its
internal bitmap logic. Currently we change inode->i_blkbits in fuse to
match the attr->blksize value passed in by the server.

This commit keeps inode->i_blkbits constant in fuse. Any attr->blksize
values passed in by the server will not update inode->i_blkbits. The
client-side behavior for stat is unaffected, stat will still reflect the
blocksize passed in by the server.

Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
Link: https://lore.kernel.org/20250807175015.515192-1-joannelkoong@gmail.com
Fixes: ef7e7cbb32 ("fuse: use iomap for writeback")
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-08-11 14:51:50 +02:00
Christian Brauner
bef2981bad
Merge patch series "open_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE"
Aleksa Sarai <cyphar@cyphar.com> says:

As described in commit 7a54947e72 ('Merge patch series "fs: allow
changing idmappings"'), open_tree_attr(2) was necessary in order to
allow for a detached mount to be created and have its idmappings changed
without the risk of any racing threads operating on it. For this reason,
mount_setattr(2) still does not allow for id-mappings to be changed.

However, there was a bug in commit 2462651ffa ("fs: allow changing
idmappings") which allowed users to bypass this restriction by calling
open_tree_attr(2) *without* OPEN_TREE_CLONE.

can_idmap_mount() prevented this bug from allowing an attached
mountpoint's id-mapping from being modified (thanks to an is_anon_ns()
check), but this still allows for detached (but visible) mounts to have
their be id-mapping changed. This risks the same UAF and locking issues
as described in the merge commit, and was likely unintentional.

For what it's worth, I found this while working on the open_tree_attr(2)
man page, and was trying to figure out what open_tree_attr(2)'s
behaviour was in the (slightly fruity) ~OPEN_TREE_CLONE case.

* patches from https://lore.kernel.org/20250808-open_tree_attr-bugfix-idmap-v1-0-0ec7bc05646c@cyphar.com:
  selftests/mount_setattr: add smoke tests for open_tree_attr(2) bug
  open_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE

Link: https://lore.kernel.org/20250808-open_tree_attr-bugfix-idmap-v1-0-0ec7bc05646c@cyphar.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-08-11 14:51:50 +02:00
Jan Kara
6b65028e2b
iomap: Fix broken data integrity guarantees for O_SYNC writes
Commit d279c80e0b ("iomap: inline iomap_dio_bio_opflags()") has broken
the logic in iomap_dio_bio_iter() in a way that when the device does
support FUA (or has no writeback cache) and the direct IO happens to
freshly allocated or unwritten extents, we will *not* issue fsync after
completing direct IO O_SYNC / O_DSYNC write because the
IOMAP_DIO_WRITE_THROUGH flag stays mistakenly set. Fix the problem by
clearing IOMAP_DIO_WRITE_THROUGH whenever we do not perform FUA write as
it was originally intended.

CC: John Garry <john.g.garry@oracle.com>
CC: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Fixes: d279c80e0b ("iomap: inline iomap_dio_bio_opflags()")
CC: stable@vger.kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/20250730102840.20470-2-jack@suse.cz
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Reviewed-by: John Garry <john.g.garry@oracle.com>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-08-11 14:51:49 +02:00
Aleksa Sarai
81e4b9cf36
selftests/mount_setattr: add smoke tests for open_tree_attr(2) bug
There appear to be no other open_tree_attr(2) tests at the moment, but
as a minimal solution just add some additional checks in the existing
MOUNT_ATTR_IDMAP tests to make sure that open_tree_attr(2) cannot be
used to bypass the tested restrictions that apply to mount_setattr(2).

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
Link: https://lore.kernel.org/20250808-open_tree_attr-bugfix-idmap-v1-2-0ec7bc05646c@cyphar.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-08-11 14:51:49 +02:00
Aleksa Sarai
9308366f06
open_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE
As described in commit 7a54947e72 ('Merge patch series "fs: allow
changing idmappings"'), open_tree_attr(2) was necessary in order to
allow for a detached mount to be created and have its idmappings changed
without the risk of any racing threads operating on it. For this reason,
mount_setattr(2) still does not allow for id-mappings to be changed.

However, there was a bug in commit 2462651ffa ("fs: allow changing
idmappings") which allowed users to bypass this restriction by calling
open_tree_attr(2) *without* OPEN_TREE_CLONE.

can_idmap_mount() prevented this bug from allowing an attached
mountpoint's id-mapping from being modified (thanks to an is_anon_ns()
check), but this still allows for detached (but visible) mounts to have
their be id-mapping changed. This risks the same UAF and locking issues
as described in the merge commit, and was likely unintentional.

Fixes: 2462651ffa ("fs: allow changing idmappings")
Cc: stable@vger.kernel.org # v6.15+
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
Link: https://lore.kernel.org/20250808-open_tree_attr-bugfix-idmap-v1-1-0ec7bc05646c@cyphar.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-08-11 14:51:49 +02:00
Jiufei Xue
d02d2c98d2
fs: writeback: fix use-after-free in __mark_inode_dirty()
An use-after-free issue occurred when __mark_inode_dirty() get the
bdi_writeback that was in the progress of switching.

CPU: 1 PID: 562 Comm: systemd-random- Not tainted 6.6.56-gb4403bd46a8e #1
......
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __mark_inode_dirty+0x124/0x418
lr : __mark_inode_dirty+0x118/0x418
sp : ffffffc08c9dbbc0
........
Call trace:
 __mark_inode_dirty+0x124/0x418
 generic_update_time+0x4c/0x60
 file_modified+0xcc/0xd0
 ext4_buffered_write_iter+0x58/0x124
 ext4_file_write_iter+0x54/0x704
 vfs_write+0x1c0/0x308
 ksys_write+0x74/0x10c
 __arm64_sys_write+0x1c/0x28
 invoke_syscall+0x48/0x114
 el0_svc_common.constprop.0+0xc0/0xe0
 do_el0_svc+0x1c/0x28
 el0_svc+0x40/0xe4
 el0t_64_sync_handler+0x120/0x12c
 el0t_64_sync+0x194/0x198

Root cause is:

systemd-random-seed                         kworker
----------------------------------------------------------------------
___mark_inode_dirty                     inode_switch_wbs_work_fn

  spin_lock(&inode->i_lock);
  inode_attach_wb
  locked_inode_to_wb_and_lock_list
     get inode->i_wb
     spin_unlock(&inode->i_lock);
     spin_lock(&wb->list_lock)
  spin_lock(&inode->i_lock)
  inode_io_list_move_locked
  spin_unlock(&wb->list_lock)
  spin_unlock(&inode->i_lock)
                                    spin_lock(&old_wb->list_lock)
                                      inode_do_switch_wbs
                                        spin_lock(&inode->i_lock)
                                        inode->i_wb = new_wb
                                        spin_unlock(&inode->i_lock)
                                    spin_unlock(&old_wb->list_lock)
                                    wb_put_many(old_wb, nr_switched)
                                      cgwb_release
                                      old wb released
  wb_wakeup_delayed() accesses wb,
  then trigger the use-after-free
  issue

Fix this race condition by holding inode spinlock until
wb_wakeup_delayed() finished.

Signed-off-by: Jiufei Xue <jiufei.xue@samsung.com>
Link: https://lore.kernel.org/20250728100715.3863241-1-jiufei.xue@samsung.com
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-08-11 14:51:45 +02:00
Thomas Zimmermann
08c51f5bdd Merge drm/drm-next into drm-misc-n
Updating drm-misc-next to the state of v6.17-rc1. Begins a new release
cycle.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
2025-08-11 14:37:45 +02:00
Christoph Hellwig
f76823e3b2 xfs: split xfs_zone_record_blocks
xfs_zone_record_blocks not only records successfully written blocks that
now back file data, but is also used for blocks speculatively written by
garbage collection that were never linked to an inode and instantly
become invalid.

Split the latter functionality out to be easier to understand.  This also
make it clear that we don't need to attach the rmap inode to a
transaction for the skipped blocks case as we never dirty any peristent
data structure.

Also make the argument order to xfs_zone_record_blocks a bit more
natural.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
2025-08-11 14:04:20 +02:00
Andrey Albershteyn
5d94b19f06 xfs: fix scrub trace with null pointer in quotacheck
The quotacheck doesn't initialize sc->ip.

Cc: stable@vger.kernel.org # v6.8
Fixes: 21d7500929 ("xfs: improve dquot iteration for scrub")
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Andrey Albershteyn <aalbersh@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
2025-08-11 14:04:14 +02:00
John Garry
8dc5e9b037 xfs: reject max_atomic_write mount option for no reflink
If the FS has no reflink, then atomic writes greater than 1x block are not
supported. As such, for no reflink it is pointless to accept setting
max_atomic_write when it cannot be supported, so reject max_atomic_write
mount option in this case.

It could be still possible to accept max_atomic_write option of size 1x
block if HW atomics are supported, so check for this specifically.

Fixes: 4528b90527 ("xfs: allow sysadmins to specify a maximum atomic write limit at mount time")
Signed-off-by: John Garry <john.g.garry@oracle.com>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
2025-08-11 14:04:01 +02:00
John Garry
68456d05eb xfs: disallow atomic writes on DAX
Atomic writes are not currently supported for DAX, but two problems exist:
- we may go down DAX write path for IOCB_ATOMIC, which does not handle
  IOCB_ATOMIC properly
- we report non-zero atomic write limits in statx (for DAX inodes)

We may want atomic writes support on DAX in future, but just disallow for
now.

For this, ensure when IOCB_ATOMIC is set that we check the write size
versus the atomic write min and max before branching off to the DAX write
path. This is not strictly required for DAX, as we should not get this far
in the write path as FMODE_CAN_ATOMIC_WRITE should not be set.

In addition, due to reflink being supported for DAX, we automatically get
CoW-based atomic writes support being advertised. Remedy this by
disallowing atomic writes for a DAX inode for both sw and hw modes.

Reported-by: Darrick J. Wong <djwong@kernel.org>
Fixes: 9dffc58f23 ("xfs: update atomic write limits")
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: John Garry <john.g.garry@oracle.com>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
2025-08-11 14:03:44 +02:00
Chen Ni
3bffbe0497
platform/x86: wmi-capdata01: Remove unneeded semicolon
Remove unnecessary semicolons reported by Coccinelle/coccicheck and the
semantic patch at scripts/coccinelle/misc/semicolon.cocci.

Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
Link: https://lore.kernel.org/r/20250729031631.1644740-1-nichen@iscas.ac.cn
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2025-08-11 15:03:39 +03:00
John Garry
e7fb9b7132 fs/dax: Reject IOCB_ATOMIC in dax_iomap_rw()
The DAX write path does not support IOCB_ATOMIC, so reject it when set.

Suggested-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: John Garry <john.g.garry@oracle.com>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
2025-08-11 14:03:38 +02:00
Christoph Hellwig
82efde9cf2 xfs: remove XFS_IBULK_SAME_AG
Add a new field to struct xfs_ibulk to directly pass XFS_IWALK* flags,
and thus remove the need to indirect the SAME_AG flag through
XFS_IBULK*.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
2025-08-11 14:03:31 +02:00
Christoph Hellwig
d2845519b0 xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags
Fix up xfs_inumbers to now pass in the XFS_IBULK* flags into the flags
argument to xfs_inobt_walk, which expects the XFS_IWALK* flags.

Currently passing the wrong flags works for non-debug builds because
the only XFS_IWALK* flag has the same encoding as the corresponding
XFS_IBULK* flag, but in debug builds it can trigger an assert that no
incorrect flag is passed.  Instead just extra the relevant flag.

Fixes: 5b35d922c5 ("xfs: Decouple XFS_IBULK flags from XFS_IWALK flags")
Cc: <stable@vger.kernel.org> # v5.19
Reported-by: cen zhang <zzzccc427@gmail.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
2025-08-11 14:03:19 +02:00
Christoph Hellwig
647b3d59c7 xfs: fix frozen file system assert in xfs_trans_alloc
Commit 83a80e95e7 ("xfs: decouple xfs_trans_alloc_empty from
xfs_trans_alloc") move the place of the assert for a frozen file system
after the sb_start_intwrite call that ensures it doesn't run on frozen
file systems, and thus allows to incorrect trigger it.

Fix that by moving it back to where it belongs.

Fixes: 83a80e95e7 ("xfs: decouple xfs_trans_alloc_empty from xfs_trans_alloc")
Reported-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
2025-08-11 14:03:07 +02:00
Darshan Rathod
1ccc2e20fe
platform/x86: dell_rbu: fix assignment in if condition warning
Refactor to remove assignments from inside if conditions, as required
by kernel coding style. This improves code readability and resolves
checkpatch.pl warnings:

    ERROR: do not use assignment in if condition

Signed-off-by: Darshan Rathod <darshanrathod475@gmail.com>
Link: https://lore.kernel.org/r/20250801104705.1824495-1-darshanrathod475@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2025-08-11 15:02:25 +03:00
Aaron Ma
a7fc15ed62 HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save
Improper use of secondary pointer (&dev->i2c_subip_regs) caused
kernel crash and out-of-bounds error:

 BUG: KASAN: slab-out-of-bounds in _regmap_bulk_read+0x449/0x510
 Write of size 4 at addr ffff888136005dc0 by task kworker/u33:5/5107

 CPU: 3 UID: 0 PID: 5107 Comm: kworker/u33:5 Not tainted 6.16.0+ #3 PREEMPT(voluntary)
 Workqueue: async async_run_entry_fn
 Call Trace:
  <TASK>
  dump_stack_lvl+0x76/0xa0
  print_report+0xd1/0x660
  ? __pfx__raw_spin_lock_irqsave+0x10/0x10
  ? kasan_complete_mode_report_info+0x26/0x200
  kasan_report+0xe1/0x120
  ? _regmap_bulk_read+0x449/0x510
  ? _regmap_bulk_read+0x449/0x510
  __asan_report_store4_noabort+0x17/0x30
  _regmap_bulk_read+0x449/0x510
  ? __pfx__regmap_bulk_read+0x10/0x10
  regmap_bulk_read+0x270/0x3d0
  pio_complete+0x1ee/0x2c0 [intel_thc]
  ? __pfx_pio_complete+0x10/0x10 [intel_thc]
  ? __pfx_pio_wait+0x10/0x10 [intel_thc]
  ? regmap_update_bits_base+0x13b/0x1f0
  thc_i2c_subip_pio_read+0x117/0x270 [intel_thc]
  thc_i2c_subip_regs_save+0xc2/0x140 [intel_thc]
  ? __pfx_thc_i2c_subip_regs_save+0x10/0x10 [intel_thc]
[...]
 The buggy address belongs to the object at ffff888136005d00
  which belongs to the cache kmalloc-rnd-12-192 of size 192
 The buggy address is located 0 bytes to the right of
  allocated 192-byte region [ffff888136005d00, ffff888136005dc0)

Replaced with direct array indexing (&dev->i2c_subip_regs[i]) to ensure
safe memory access.

Fixes: 4228966def ("HID: intel-thc-hid: intel-thc: Add THC I2C config interfaces")
Signed-off-by: Aaron Ma <aaron.ma@canonical.com>
Reviewed-by: Even Xu <even.xu@intel.com>
Tested-by: Even Xu <even.xu@intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-11 13:38:16 +02:00
Aaron Ma
1db9df89a2 HID: intel-thc-hid: intel-quicki2c: Fix ACPI dsd ICRS/ISUB length
The QuickI2C ACPI _DSD methods return ICRS and ISUB data with a
trailing byte, making the actual length is one more byte than the
structs defined.

It caused stack-out-of-bounds and kernel crash:

kernel: BUG: KASAN: stack-out-of-bounds in quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c]
kernel: Write of size 12 at addr ffff888106d1f900 by task kworker/u33:2/75
kernel:
kernel: CPU: 3 UID: 0 PID: 75 Comm: kworker/u33:2 Not tainted 6.16.0+ #3 PREEMPT(voluntary)
kernel: Workqueue: async async_run_entry_fn
kernel: Call Trace:
kernel:  <TASK>
kernel:  dump_stack_lvl+0x76/0xa0
kernel:  print_report+0xd1/0x660
kernel:  ? __pfx__raw_spin_lock_irqsave+0x10/0x10
kernel:  ? __kasan_slab_free+0x5d/0x80
kernel:  ? kasan_addr_to_slab+0xd/0xb0
kernel:  kasan_report+0xe1/0x120
kernel:  ? quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c]
kernel:  ? quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c]
kernel:  kasan_check_range+0x11c/0x200
kernel:  __asan_memcpy+0x3b/0x80
kernel:  quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c]
kernel:  ? __pfx_quicki2c_acpi_get_dsd_property.constprop.0+0x10/0x10 [intel_quicki2c]
kernel:  quicki2c_get_acpi_resources+0x237/0x730 [intel_quicki2c]
[...]
kernel:  </TASK>
kernel:
kernel: The buggy address belongs to stack of task kworker/u33:2/75
kernel:  and is located at offset 48 in frame:
kernel:  quicki2c_get_acpi_resources+0x0/0x730 [intel_quicki2c]
kernel:
kernel: This frame has 3 objects:
kernel:  [32, 36) 'hid_desc_addr'
kernel:  [48, 59) 'i2c_param'
kernel:  [80, 224) 'i2c_config'

ACPI DSD methods return:

\_SB.PC00.THC0.ICRS Buffer       000000003fdc947b 001 Len 0C = 0A 00 80 1A 06 00 00 00 00 00 00 00
\_SB.PC00.THC0.ISUB Buffer       00000000f2fcbdc4 001 Len 91 = 00 00 00 00 00 00 00 00 00 00 00 00

Adding reserved padding to quicki2c_subip_acpi_parameter/config.

Fixes: 5282e45ccb ("HID: intel-thc-hid: intel-quicki2c: Add THC QuickI2C ACPI interfaces")
Signed-off-by: Aaron Ma <aaron.ma@canonical.com>
Reviewed-by: Even Xu <even.xu@intel.com>
Tested-by: Even Xu <even.xu@intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
2025-08-11 13:38:16 +02:00
Mikulas Patocka
1071d560af dm-stripe: fix a possible integer overflow
There's a possible integer overflow in stripe_io_hints if we have too
large chunk size. Test if the overflow happened, and if it did, don't set
limits->io_min and limits->io_opt;

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Reviewed-by: John Garry <john.g.garry@oracle.com>
Suggested-by: Dongsheng Yang <dongsheng.yang@linux.dev>
Cc: stable@vger.kernel.org
2025-08-11 13:17:32 +02:00
Oreoluwa Babatunde
2c223f7239 of: reserved_mem: Restructure call site for dma_contiguous_early_fixup()
Restructure the call site for dma_contiguous_early_fixup() to
where the reserved_mem nodes are being parsed from the DT so that
dma_mmu_remap[] is populated before dma_contiguous_remap() is called.

Fixes: 8a6e02d0c0 ("of: reserved_mem: Restructure how the reserved memory regions are processed")
Signed-off-by: Oreoluwa Babatunde <oreoluwa.babatunde@oss.qualcomm.com>
Tested-by: William Zhang <william.zhang@broadcom.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://lore.kernel.org/r/20250806172421.2748302-1-oreoluwa.babatunde@oss.qualcomm.com
2025-08-11 13:05:38 +02:00
Dan Carpenter
b26fc701a2 PCI: xgene-msi: Return negative -EINVAL in xgene_msi_handler_setup()
There is a typo so we accidentally return positive EINVAL instead of
negative -EINVAL. Add the missing '-' character.

Fixes: 6aceb36f17 ("PCI: xgene-msi: Restructure handler setup/teardown")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Acked-by: Marc Zyngier <maz@kernel.org>
Link: https://patch.msgid.link/aIzCbVd93ivPinne@stanley.mountain
2025-08-11 16:30:43 +05:30
Dan Carpenter
57a75fa9d5 PCI: endpoint: pci-ep-msi: Fix NULL vs IS_ERR() check in pci_epf_write_msi_msg()
The pci_epc_get() function returns error pointers. It never returns NULL.
Update the check to match.

Fixes: 1c3b002c6b ("PCI: endpoint: Add RC-to-EP doorbell support using platform MSI controller")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/aIzCdV8jyBeql-Oa@stanley.mountain
2025-08-11 16:28:33 +05:30
Nick Li
2291a21863
MAINTAINERS: Add entry for FourSemi audio amplifiers
Add entry for FourSemi maintainer and related files

Signed-off-by: Nick Li <nick.li@foursemi.com>
Link: https://patch.msgid.link/B9209BC5189B8946+20250811104610.8993-6-nick.li@foursemi.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-08-11 11:57:32 +01:00
Nick Li
7561177017
ASoC: codecs: Add FourSemi FS2104/5S audio amplifier driver
The FS2104/5S are FourSemi digital audio amplifiers
with I2C control. They are Inductor-Less, Stereo, Closed-Loop,
Digital Input Class-D Power Amplifiers with Enhanced Signal Processing.

Signed-off-by: Nick Li <nick.li@foursemi.com>
Link: https://patch.msgid.link/75A0F7CC495E9662+20250811104610.8993-5-nick.li@foursemi.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-08-11 11:57:30 +01:00
Nick Li
e0bbbcaceb
ASoC: codecs: Add library for FourSemi audio amplifiers
This patch adds firmware loading and parsing support for FourSemi audio
amplifiers. The library handles firmware file (*.bin) generated by the
FourSemi tuning tool, which contains:
- Register initialization settings
- DSP effect parameters
- Multi-scene sound effect switching configurations(optional)

The firmware is required for proper initialization and configuration
of FourSemi amplifier devices.

Signed-off-by: Nick Li <nick.li@foursemi.com>
Link: https://patch.msgid.link/77822D0108CCC1D0+20250811104610.8993-4-nick.li@foursemi.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-08-11 11:57:28 +01:00
Nick Li
fd90680da7
ASoC: dt-bindings: Add FS2104/5S audio amplifiers
Add a DT schema for describing FourSemi FS2104/5S
audio amplifiers which support both I2S and I2C interface.

Signed-off-by: Nick Li <nick.li@foursemi.com>
Reviewed-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://patch.msgid.link/350C011186D85903+20250811104610.8993-3-nick.li@foursemi.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-08-11 11:57:27 +01:00