This reverts commit d02c2e45b1.
Mauro reports that this breaks APEI notifications on his QEMU setup
because the "reserved for firmware" region still needs to be writable
by Linux in order to signal _back_ to the firmware after processing
the reported error:
| {1}[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 1
| ...
| [Firmware Warn]: GHES: Unhandled processor error type 0x02: cache error
| Unable to handle kernel write to read-only memory at virtual address ffff800080035018
| Mem abort info:
| ESR = 0x000000009600004f
| EC = 0x25: DABT (current EL), IL = 32 bits
| SET = 0, FnV = 0
| EA = 0, S1PTW = 0
| FSC = 0x0f: level 3 permission fault
| Data abort info:
| ISV = 0, ISS = 0x0000004f, ISS2 = 0x00000000
| CM = 0, WnR = 1, TnD = 0, TagAccess = 0
| GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
| swapper pgtable: 4k pages, 52-bit VAs, pgdp=00000000505d7000
| pgd=10000000510bc003, p4d=1000000100229403, pud=100000010022a403, pmd=100000010022b403, pte=0060000139b90483
| Internal error: Oops: 000000009600004f [#1] SMP
For now, revert the offending commit. We can presumably switch back to
PAGE_KERNEL when bringing this back in the future.
Link: https://lore.kernel.org/r/20251121224611.07efa95a@foz.lan
Reported-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Will Deacon <will@kernel.org>
This passes the address of the pointer "&punit_ipcdev" when the intent
was to pass the pointer itself "punit_ipcdev" (without the ampersand).
This means that the:
complete(&ipcdev->cmd_complete);
in intel_punit_ioc() will write to a wrong memory address corrupting it.
Fixes: fdca4f16f5 ("platform:x86: add Intel P-Unit mailbox IPC driver")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://patch.msgid.link/aSCmoBipSQ_tlD-D@stanley.mountain
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Make sure to drop the references taken to the vtg devices by
of_find_device_by_node() when looking up their driver data during
component probe.
Note that holding a reference to a platform device does not prevent its
driver data from going away so there is no point in keeping the
reference after the lookup helper returns.
Fixes: cc6b741c6f ("drm: sti: remove useless fields from vtg structure")
Cc: stable@vger.kernel.org # 4.16
Cc: Benjamin Gaignard <benjamin.gaignard@collabora.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20250922122012.27407-1-johan@kernel.org
Signed-off-by: Raphael Gallais-Pou <raphael.gallais-pou@foss.st.com>
devm_pm_runtime_enable() can fail due to memory allocation. The current
code ignores its return value, potentially causing runtime PM operations
to fail silently after autosuspend configuration.
Check the return value of devm_pm_runtime_enable() and return on failure.
Fixes: 909fac05b9 ("spi: add support for Amlogic A1 SPI Flash Controller")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20251124015852.937-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Commit 13a4b7fb62 ("pmdomain: core: Leave powered-on genpds on until
late_initcall_sync") kept power-domains on longer during boot which is
causing some GPU related tests to fail on Tegra234. While this is being
investigated, add the flag GENPD_FLAG_NO_STAY_ON for Tegra devices to
restore the previous behaviour to fix this.
Fixes: 13a4b7fb62 ("pmdomain: core: Leave powered-on genpds on until late_initcall_sync")
Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
- Lower the minimum rate for the A523 audio PLL to support
frequencies required by audio devices
- Mark a couple clks critical on A523 so that Linux doesn't turn
them off when they're used by other code like TF-A
-----BEGIN PGP SIGNATURE-----
iQJIBAABCAAyFiEE9L57QeeUxqYDyoaDrQKIl8bklSUFAmkjV3AUHHN3Ym95ZEBj
aHJvbWl1bS5vcmcACgkQrQKIl8bklSUPzw/+JyChC42SYjZAAbzT/aBE7STbjlWT
EnY4RcES5AJ9xav9wXI6UbI9941xJWfhpijqJ5UOuXiHP9pGOzrElI+iyevL5iDu
AL6qijUsE+3NL505LqwLo1IvrnCtdOy5o8JVI+A84QLs0SQCXGjFewxo1vSOCm/o
va6zyFNW11Vk4dfMw1dS3bna9yhCXkZh0nzvelsYc0KyZODd6qk838Qjnq80A3tC
5kXNFWFTuz9CLqc3emzACF3uRxT296gTLX92evyi1Pq+d69QaAdaVJQHSOJiMfT2
tbiGpOyZHGm+vlZ8O2awE71ODgqOvSXcbewCm9DA7xp3TEAf0Kdy5zz8Jl6qmVuG
PvYnhJe+B1SUm6iTwrzJTeyOD468Xi7yICbg+HKIrr1efpL4NzSIKypAJH9bv+DY
t7wySo3Yql/9LOQQKE/TG8JGi8mozYNZSTiMrBtdUw9ev2kOW0zwaM9V7SEH1WK2
urerDjloOPZ+Nf7eIN8dZfhFDi3sEO5/YcBev1FiQ+iIZtIZwltFnbvAHzrcLStb
VttJla6lN05kUdPMkTBg1oNu2FLnS47eJWHCjDysOjsGnKx+Mjm+RB+p7wjqLc3e
y0IRzlj7w2+PZFI7Q4KRfDT5srHP2TqBE2y6xAdQsU8xWx/tKSvVYgO0Vmu7AbJh
8L77KUw2tQPaFbo=
=A1l6
-----END PGP SIGNATURE-----
Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux
Pull clk fixes from Stephen Boyd:
"Fixes for the Allwinner A523 clk driver:
- Lower the minimum rate for the A523 audio PLL to support
frequencies required by audio devices
- Mark a couple clks critical on A523 so that Linux doesn't turn them
off when they're used by other code like TF-A"
* tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
clk: sunxi-ng: sun55i-a523-ccu: Lower audio0 pll minimum rate
clk: sunxi-ng: sun55i-a523-r-ccu: Mark bus-r-dma as critical
clk: sunxi-ng: Mark A523 bus-r-cpucfg clock as critical
- Fix a race in timer->function clearing in timer_shutdown_sync()
- Fix a timekeeper sysfs-setup resource leak in error paths
- Fix the NOHZ report_idle_softirq() syslog rate-limiting
logic to have no side effects on the return value
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmkivgERHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1i/0g/+ODFR6NF7cNcsZPhKdRt/A9Il72qmjteG
Fqzacev1rzaQpPSaRpOnEAnqDRmfnFLZ0I4WA36QJxfApHHg9kI8GzEaa7WDvQOc
kOL317i3vsme+tolI0fwazvMRnwgSipHVvXp76eyaEKXHM97i81XUpJYynxl+j9R
0le8wpcBQKMUnpvYWN4J7u0AOO0vXCdaKSM2r9bgecXGyaqgzdyLYqGhgPLd0tYC
Tn3pSrQIffORZQed3hKjXmC4DSs+tsdQr1npphxrzHy3Q8rXbt3eEj96IYyHdz1f
/3eetSWRcd0jnZYIjuA9xG7xMSBBitkPBzSQMaZMdzV2d03oPU2WVvoKLSPnFNxz
JQIErExLJH2AOrYNLmx+6DJ0Ql8398KdISJnb6HdX1cZcljRKmqlo9BIaPorQDqf
WFm8WvhthBXHwEbWx/ecaPkV2aBQpXTTH7AkCebBLF+YTxtHUVGjwlBQ/CltABk3
a4U93M/Zdyaxys/9YpIeWAsg0y3b54r6aFbReyt8CiMVe+gKqTOnT3Jy4hqFZPnB
x+AHtooGsN7CIV4q9NIB6EmvJ5J1HFkmGQrWo1y/OHbZp2mDJy/1sQ+rj7NXdBZA
ibrUHIWzTtZ6WpuR1ABD3wubhb7/BF3Gwh4v27AUtLFKW/cZq7ovMODVrp+Svt6X
3EOg/YofAy0=
=JVik
-----END PGP SIGNATURE-----
Merge tag 'timers-urgent-2025-11-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull timer fixes from Ingo Molnar:
- Fix a race in timer->function clearing in timer_shutdown_sync()
- Fix a timekeeper sysfs-setup resource leak in error paths
- Fix the NOHZ report_idle_softirq() syslog rate-limiting
logic to have no side effects on the return value
* tag 'timers-urgent-2025-11-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
timers: Fix NULL function pointer race in timer_shutdown_sync()
timekeeping: Fix resource leak in tk_aux_sysfs_init() error paths
tick/sched: Fix bogus condition in report_idle_softirq()
There is a race condition between timer_shutdown_sync() and timer
expiration that can lead to hitting a WARN_ON in expire_timers().
The issue occurs when timer_shutdown_sync() clears the timer function
to NULL while the timer is still running on another CPU. The race
scenario looks like this:
CPU0 CPU1
<SOFTIRQ>
lock_timer_base()
expire_timers()
base->running_timer = timer;
unlock_timer_base()
[call_timer_fn enter]
mod_timer()
...
timer_shutdown_sync()
lock_timer_base()
// For now, will not detach the timer but only clear its function to NULL
if (base->running_timer != timer)
ret = detach_if_pending(timer, base, true);
if (shutdown)
timer->function = NULL;
unlock_timer_base()
[call_timer_fn exit]
lock_timer_base()
base->running_timer = NULL;
unlock_timer_base()
...
// Now timer is pending while its function set to NULL.
// next timer trigger
<SOFTIRQ>
expire_timers()
WARN_ON_ONCE(!fn) // hit
...
lock_timer_base()
// Now timer will detach
if (base->running_timer != timer)
ret = detach_if_pending(timer, base, true);
if (shutdown)
timer->function = NULL;
unlock_timer_base()
The problem is that timer_shutdown_sync() clears the timer function
regardless of whether the timer is currently running. This can leave a
pending timer with a NULL function pointer, which triggers the
WARN_ON_ONCE(!fn) check in expire_timers().
Fix this by only clearing the timer function when actually detaching the
timer. If the timer is running, leave the function pointer intact, which is
safe because the timer will be properly detached when it finishes running.
Fixes: 0cc04e8045 ("timers: Add shutdown mechanism to the internal functions")
Signed-off-by: Yipeng Zou <zouyipeng@huawei.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20251122093942.301559-1-zouyipeng@huawei.com
- Fix for Malta PCI MMIO breakage for SOC-it
- Fix TLB shutdown caused by iniital uniquification
- Fix random seg faults
-----BEGIN PGP SIGNATURE-----
iQJOBAABCAA4FiEEbt46xwy6kEcDOXoUeZbBVTGwZHAFAmkiIKQaHHRzYm9nZW5k
QGFscGhhLmZyYW5rZW4uZGUACgkQeZbBVTGwZHA+4A//VBaGVDaIbqwE1xzBdeUQ
j5yK4l9wbD4LO67DTN4eElouct/o48I1UbQSK3vBaBRlGKLEFK/2Pu1amh6VGWr9
SyI14AYlj0vX7C6nqSrGKL+/+1mA9pCQmpz4yshn+qnwoAqHjqs+enX3BiBh+L0j
1JJRyr8qGzQ8Xma80Bx5Jvst61a5AgQZvVf70nr/0LdoqjBkS6dqVKRHtA7VOqWd
SqX1/y7FeLt6oPmzRYCy7Kp7RNDJ9sIht7ZklznV1tUBdDTRpA8eUqeSSyUEe0/7
x79jj3/On7vg84shs3u+JU8jjrVuyXQcSJq2YRw9kEm0lJ2nd2YFS13SpnT4ZMNQ
qCyzfTELLQ+NvRNaiUWWj5RXdiSo2LrZNq/Qu2EsNaSz2YYkkmrAurGOd8rOcfka
59lKvoQ18Vt3Ok5EeaatAWANJhXpEodvScuGdzBocaJ8/mSBwUzd6Vit9fma6eJ2
o1evxG7rqhXo+fT3pfjkW9ueAzCwJvF+tXV47Ga3PLssZfBvGo90LhaMf8C+VQA+
WoSAHhHlhrjhpo0/8/Z5577LV0IyRhwcnoivphBAwuCNe6SQrkKDrnx6xbemwbM1
biCbMaknli72c/KfptoOtBJYyZdEkgCigsB9unBHFXtExreoCo0PEAoJIv0GZs4M
3y7EIgkwib7OZCU2cA4/hkA=
=caJE
-----END PGP SIGNATURE-----
Merge tag 'mips-fixes_6.18_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux
Pull MIPS fixes from Thomas Bogendoerfer:
- Fix CPU type in DT for econet
- Fix for Malta PCI MMIO breakage for SOC-it
- Fix TLB shutdown caused by iniital uniquification
- Fix random seg faults due to missed vdso storage requirement
* tag 'mips-fixes_6.18_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux:
MIPS: kernel: Fix random segmentation faults
MIPS: mm: Prevent a TLB shutdown on initial uniquification
mips: dts: econet: fix EN751221 core type
MIPS: Malta: Fix !EVA SOC-it PCI MMIO
Fix another KMSAN warning that made it in while KMSAN wasn't working
reliably.
-----BEGIN PGP SIGNATURE-----
iIoEABYIADIWIQSacvsUNc7UX4ntmEPzXCl4vpKOKwUCaSITwxQcZWJpZ2dlcnNA
a2VybmVsLm9yZwAKCRDzXCl4vpKOK898AQCZFgPxQxVrkSaZuDXJ1V5ZpH/PcQVe
RWsmR6TtVE84QQD/a/mteTNxeB0xDFCrhgYG4TmF1g/RhPTTdBTmhubSdwo=
=VNQT
-----END PGP SIGNATURE-----
Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux
Pull crypto library fix from Eric Biggers:
"Fix another KMSAN warning that made it in while KMSAN wasn't working
reliably"
* tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux:
lib/crypto: tests: Fix KMSAN warning in test_sha256_finup_2x()
Signed-off-by: Carlos Maiolino <cem@kernel.org>
-----BEGIN PGP SIGNATURE-----
iJUEABMJAB0WIQSmtYVZ/MfVMGUq1GNcsMJ8RxYuYwUCaSGL+QAKCRBcsMJ8RxYu
YyvcAXsECiSerKCBGTXpRTLlxB59UWhjRkz2pKhMYLd4czYsukPqTmEergwkQeVN
Ebb5rlMBegJoUfeL//wDZ3D/w/T4E2bEMhlcVH04vEE+yBkuqKqcfNDftQl5MCoD
/1JI9xbKAQ==
=3pbL
-----END PGP SIGNATURE-----
Merge tag 'xfs-fixes-6.18-rc7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux
Pull xfs fix from Carlos Maiolino:
"A single out-of-bounds fix, nothing special"
* tag 'xfs-fixes-6.18-rc7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
xfs: fix out of bounds memory read error in symlink repair
One target driver fix and one scsi-generic one. The latter is 10
lines because the problem lock has to be dropped and re-taken around
the call causing the sleep in atomic.
Signed-off-by: James E.J. Bottomley <James.Bottomley@HansenPartnership.com>
-----BEGIN PGP SIGNATURE-----
iLgEABMIAGAWIQTnYEDbdso9F2cI+arnQslM7pishQUCaSHVghsUgAAAAAAEAA5t
YW51MiwyLjUrMS4xMSwyLDImHGphbWVzLmJvdHRvbWxleUBoYW5zZW5wYXJ0bmVy
c2hpcC5jb20ACgkQ50LJTO6YrIW+xQEAx4Sfjb+NTZ4qcDX2wjAosFUnuu5RUnn6
YG1OSrzHHP4A/RQQIxerooZPSD67LxIFVsxCV3yu6S88+n4P3emAec3V
=qUHX
-----END PGP SIGNATURE-----
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi
Pull SCSI fixes from James Bottomley:
"One target driver fix and one scsi-generic one. The latter is 10 lines
because the problem lock has to be dropped and re-taken around the
call causing the sleep in atomic"
* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
scsi: sg: Do not sleep in atomic context
scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()
- INPUT_PROP_HAPTIC_TOUCHPAD definition added early in 6.18 cycle has
been renamed to INPUT_PROP_PRESSUREPAD to better reflect the kind of
devices it is supposed to be set for
- a new ID for a touchscreen found in Ayaneo Flip DS in Goodix driver
- Goodix driver no longer tries to set reset pin as "input" as it causes
issues when there is no pull up resistor installed on the board
- fixes for cros_ec_keyb, imx_sc_key, and pegasus-notetaker drivers to
deal with potential out-of-bounds access and memory corruption issues
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCaSFbUAAKCRBAj56VGEWX
nC+zAQCmxIsTcA4GEPgelW0dRaaKCcCnr++0RQVW5hFJ+0VgTgD6AlzkMtdy5O30
91gz5ooMKSz5SMsgb97N2GlayGKezA0=
=dMey
-----END PGP SIGNATURE-----
Merge tag 'input-for-v6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
Pull input fixes from Dmitry Torokhov:
- INPUT_PROP_HAPTIC_TOUCHPAD definition added early in 6.18 cycle has
been renamed to INPUT_PROP_PRESSUREPAD to better reflect the kind of
devices it is supposed to be set for
- a new ID for a touchscreen found in Ayaneo Flip DS in Goodix driver
- Goodix driver no longer tries to set reset pin as "input" as it
causes issues when there is no pull up resistor installed on the
board
- fixes for cros_ec_keyb, imx_sc_key, and pegasus-notetaker drivers to
deal with potential out-of-bounds access and memory corruption issues
* tag 'input-for-v6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
Input: rename INPUT_PROP_HAPTIC_TOUCHPAD to INPUT_PROP_PRESSUREPAD
Input: cros_ec_keyb - fix an invalid memory access
Input: imx_sc_key - fix memory corruption on unload
Input: pegasus-notetaker - fix potential out-of-bounds access
Input: goodix - remove setting of RST pin to input
Input: goodix - add support for ACPI ID GDIX1003
- Correct the MIPS RISC-V/JEDEC vendor ID.
- Fix the system shutdown behavior in the legacy case where
CONFIG_RISCV_SBI_V01 is set, but the firmware implementation doesn't
support the older v0.1 system shutdown method.
- Align some tools/ macro definitions with the corresponding kernel headers.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEElRDoIDdEz9/svf2Kx4+xDQu9KksFAmkhEkIACgkQx4+xDQu9
Kkvwzw//argWbOhLtXyoLxPlsyeQaBh5tiJgXJJTIlqhpNb0c1JR3dG+7sSAPVCl
Hrq6blvP0ADUajdlSxuvSaBglqydFaqU689kkG79/hWcAQiRsuJz830RRlQKwnzd
FIRv+m8kN2JoFLLiCvpm2r1PNaWQBpwmphVCrfnqvJ2fqPpmC8DVk9iDP6w67Hcj
U1lSofEWxKcDaGOHuA1xU9NFAydtAd0/Jefci5C2hz0bTyJ5sAgAwJrvMoxX4n1x
Y/yUWe88sOIj8SMg2bJJSm6Ny1apOc6IuYd+GxGpN954tcjJCQ/PBLywM2FT1hx4
65I3yJv0VEDmmLSodYPrmN38bu5n7gKrbRTjBvjVRat5hvLV6iej4UHdyScc7eXV
6BxR982BYtG0Mo1W9lm1NbH1ubcyuJxDfwPffeGFYP2RhaVQgneOeczWmcyW6KKA
GB8zvLBEwDgQoSWtFGvotQhnzM9oqDYYmQ2AeMuTHqB2D+AIqoejoB8S7i95MPaB
m8zepRgN2VS0v+glOZ9tDlsbURR0Yu0SO4k/bIJ2/Surtt7G0BKcenfTNquaOW+/
evr8uS1fbQPLyyqnUmHh/FYRivQs0JcB/6yBdFYM1YZfW84PC03KdFrO+fhyna+V
wMQzEhIYxLi5gyP1KZ1s4DWynXoUdBjovsjWNjQGe0pF+uQps40=
=aw1W
-----END PGP SIGNATURE-----
Merge tag 'riscv-for-linus-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux
Pull RISC-V fixes from Paul Walmsley:
- Correct the MIPS RISC-V/JEDEC vendor ID
- Fix the system shutdown behavior in the legacy case where
CONFIG_RISCV_SBI_V01 is set, but the firmware implementation
doesn't support the older v0.1 system shutdown method
- Align some tools/ macro definitions with the corresponding
kernel headers
* tag 'riscv-for-linus-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
tools: riscv: Fixed misalignment of CSR related definitions
riscv: sbi: Prefer SRST shutdown over legacy
riscv: Update MIPS vendor id to 0x127
-----BEGIN PGP SIGNATURE-----
iQJIBAABCgAyFiEES0KozwfymdVUl37v6iDy2pc3iXMFAmkgxTMUHHBhdWxAcGF1
bC1tb29yZS5jb20ACgkQ6iDy2pc3iXMaFw//ceP1tRSZcpCEkgkks3hkSxANfqdZ
WbuSlI/bzEJjmmM/FAA1KM1+5b/FrO5gzrkfi1eEJ5DlI9Biy0Qa1qgi+21JbOGO
yC0f7poMwDtDZFl9OLtI6yJ8XyO/HP8+HIc7LqJgSjUvF4S0m8MVHS2acRvOuEGU
adw80uwnW64pBX+mgZOsf3GAZLpNFMlFwLQ2s2ERd0Hl4X1hmOgkejCTjS4BhAVE
BSOxRyNLiEjmrjypP+pmjZoedsnq5LaUZD5tj+0IieQ0SYCg//2GSwh8fpfNjRCx
C8rnBOT632VTKkUdIkHHOe8PzDN8L+WJYtiCiSyuCm+ExdElfibN+/N0jwhck/bF
pXHwtIaXbxMaWDbfJyrjblBZQwlfMwUzQtoNCeKtuVANCQqz77aDMsMxGXw/FXYm
c5Wut0FDGPnoITJu1b2hwA6XWPwBFB/lI+7M8l54ofssC27M4wp6xw5z1vVGz4bb
x3ypzOxoa0VkZrbXjb7o2FMOqsHdb/J23tXN2YRnVTeUGdK48KFBcrvMwQKZV+rD
AYmdJkzMLiFX0NLpviYqJT61tEQviWLVmeB2ACm8RbxN7+aE6ecZz6QvrtCsPqz9
iKeSNfSqwdHPQPe935pzfa/LcLDdvpEhSzuAcQICPhY3M33J4xc8y/0ZXkH6katL
nU75VPpt6EVU5XI=
=32VE
-----END PGP SIGNATURE-----
Merge tag 'selinux-pr-20251121' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux
Pull selinux fixes from Paul Moore:
"Three SELinux patches for v6.18 to fix issues around accessing the
per-task decision cache that we introduced in v6.16 to help reduce
SELinux overhead on path walks. The problem was that despite the cache
being located in the SELinux "task_security_struct", the parent struct
wasn't actually tied to the task, it was tied to a cred.
Historically SELinux did locate the task_security_struct in the
task_struct's security blob, but it was later relocated to the cred
struct when the cred work happened, as it made the most sense at the
time.
Unfortunately we never did the task_security_struct to
cred_security_struct rename work (avoid code churn maybe? who knows)
because it didn't really matter at the time. However, it suddenly
became a problem when we added a per-task cache to a per-cred object
and didn't notice because of the old, no-longer-correct struct naming.
Thanks to KCSAN for flagging this, as the silly humans running things
forgot that the task_security_struct was a big lie.
This contains three patches, only one of which actually fixes the
problem described above and moves the SELinux decision cache from the
per-cred struct to a newly (re)created per-task struct.
The other two patches, which form the bulk of the diffstat, take care
of the associated renaming tasks so we can hopefully avoid making the
same stupid mistake in the future.
For the record, I did contemplate sending just a fix for the cache,
leaving the renaming patches for the upcoming merge window, but the
type/variable naming ended up being pretty awful and would have made
v6.18 an outlier stuck between the "old" names and the "new" names in
v6.19. The renaming patches are also fairly mechanical/trivial and
shouldn't pose much risk despite their size.
TLDR; naming things may be hard, but if you mess it up bad things
happen"
* tag 'selinux-pr-20251121' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
selinux: rename the cred_security_struct variables to "crsec"
selinux: move avdcache to per-task security struct
selinux: rename task_security_struct to cred_security_struct
A report from Oleg Smirnov indicates that the unusual_devs quirks
entry for the Novatek camera does not need to override the subclass
and protocol parameters:
[3266355.209532] usb 1-3: new high-speed USB device number 10 using xhci_hcd
[3266355.333031] usb 1-3: New USB device found, idVendor=0603, idProduct=8611, bcdDevice= 1.00
[3266355.333040] usb 1-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[3266355.333043] usb 1-3: Product: YICARCAM
[3266355.333045] usb 1-3: Manufacturer: XIAO-YI
[3266355.333047] usb 1-3: SerialNumber: 966110000000100
[3266355.338621] usb-storage 1-3:1.0: USB Mass Storage device detected
[3266355.338817] usb-storage 1-3:1.0: Quirks match for vid 0603 pid 8611: 4000
[3266355.338821] usb-storage 1-3:1.0: This device (0603,8611,0100 S 06 P 50) has unneeded SubClass and Protocol entries in unusual_devs.h (kernel 6.16.10-arch1-1)
Please send a copy of this message to
<linux-usb@vger.kernel.org> and <usb-storage@lists.one-eyed-alien.net>
The overrides are harmless but they do provoke the driver into logging
this annoying message. Update the entry to remove the unneeded entries.
Reported-by: stealth <oleg.smirnov.1988@gmail.com>
Closes: https://lore.kernel.org/CAKxjRRxhC0s19iEWoN=pEMqXJ_z8w_moC0GCXSqSKCcOddnWjQ@mail.gmail.com/
Fixes: 6ca8af3c8f ("USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera")
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Cc: stable <stable@kernel.org>
Link: https://patch.msgid.link/b440f177-f0b8-4d5a-8f7b-10855d4424ee@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
- hci_sock: Prevent race in socket write iter and sock bind
- hci_core: Fix triggering cmd_timer for HCI_OP_NOP
- hci_core: lookup hci_conn on RX path on protocol side
- SMP: Fix not generating mackey and ltk when repairing
- btusb: mediatek: Fix kernel crash when releasing mtk iso interface
- btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref
-----BEGIN PGP SIGNATURE-----
iQJNBAABCgA3FiEE7E6oRXp8w05ovYr/9JCA4xAyCykFAmkgevwZHGx1aXoudm9u
LmRlbnR6QGludGVsLmNvbQAKCRD0kIDjEDILKbDwEACCWNAMYblzTH4WI/ebPIFL
JB0Ngltk7e30S51c6qcTobyTDss8Z+DypEO9Tpexdnz00QFMt+lGFtSEcLoP3Vu1
QO6zJ9gh8CFECQS+mbrPnWLe26bV2rAG8oygMH3uAJKmq03pHtSNITM/ME4pHe2u
sh8E4OoDdF+l1RyYPzIhTkFwPUF9NyvDuUgTnW+GzMNjJKf+eh75E8g34uQ+sm5z
VzEq5yNAoOKUnGkAvs2bufS8f40zoIyNikKCXMnBQiXs5rs+Ci0spIP3uE8pMDMo
W7E8tn4Leay6cixF38d7wrPYu+CAomdiqDfEulyQK+mEXxg3FVLXYqErRuo8GIO4
UyHbyeEZLO2EDsOR8S8oHB8ka7s2NJbJeWDR0qhXTFDHOQxvKW6k8cmdND7Z99nP
riNz+BWQvy5vICcEIHUyJ8rL6CbSqtmYrWGJeHYR0UNJ/JI18ZGi3dRbRMYLhqAk
Fdkjza2IF0p8jMgaaO5pTfLLsCnA7VR0DR7p99RV6/JBuu2dSjMT699/RQCB6+cA
b5vE7uHhs8nKmhcy83DCe/34Xkv0nF6QBkEg8BdfnNSL41SY7rNwevWG3ZqnZyI+
GSpTFi9G0M4L9Mu0NeqEOGPmux7agaugt/nXkLHj52WsezfQFW0caoBMxj5Bw9wq
4d5XO/ia3FoZKi1VNL2QTQ==
=3a3G
-----END PGP SIGNATURE-----
Merge tag 'for-net-2025-11-21' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth
Luiz Augusto von Dentz says:
====================
bluetooth pull request for net:
- hci_sock: Prevent race in socket write iter and sock bind
- hci_core: Fix triggering cmd_timer for HCI_OP_NOP
- hci_core: lookup hci_conn on RX path on protocol side
- SMP: Fix not generating mackey and ltk when repairing
- btusb: mediatek: Fix kernel crash when releasing mtk iso interface
- btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref
* tag 'for-net-2025-11-21' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:
Bluetooth: SMP: Fix not generating mackey and ltk when repairing
Bluetooth: btusb: mediatek: Avoid btusb_mtk_claim_iso_intf() NULL deref
Bluetooth: hci_core: lookup hci_conn on RX path on protocol side
Bluetooth: hci_sock: Prevent race in socket write iter and sock bind
Bluetooth: hci_core: Fix triggering cmd_timer for HCI_OP_NOP
Bluetooth: btusb: mediatek: Fix kernel crash when releasing mtk iso interface
====================
Link: https://patch.msgid.link/20251121145332.177015-1-luiz.dentz@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
As the interface mode doesn't need to be updated on PHYs connected with
USXGMII and integrated PHYs, gpy_update_interface() should just return 0
in these cases rather than -EINVAL which has wrongly been introduced by
commit 7a495dde27 ("net: phy: mxl-gpy: Change gpy_update_interface()
function return type"), as this breaks support for those PHYs.
Fixes: 7a495dde27 ("net: phy: mxl-gpy: Change gpy_update_interface() function return type")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Link: https://patch.msgid.link/f744f721a1fcc5e2e936428c62ff2c7d94d2a293.1763648168.git.daniel@makrotopia.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
- initialize result before use in in error path
- fix uninitialized pointers with free attribute
-----BEGIN PGP SIGNATURE-----
iQJOBAABCgA4FiEE0qerISgy2SKkqO79Wr/6JGat8H4FAmka6uoaHGplbnMud2lr
bGFuZGVyQGxpbmFyby5vcmcACgkQWr/6JGat8H625hAAkeOfInc+UE3Y7KAuQ/o4
hbZE1wEQVJmCu1X7ugMowR7PWkntgOotUQPvGzgo8041UFpHCKSX+0y3yKud92yh
imiy7Gx9OxKYHUEC8J7SIuZpqJ2x87NPpLafA3+qLcYBAguY/aibpfhbDi9oi2qk
VZwisQuz5Gc5K2WJ5WUgj9Hxh9AlQQ6K8/oFl9QDZZv1H3GSYgiQJbVOJDVwjGir
4Ttm5b1NKMd8Jpa+sFkHOwQgOSvWujcUBRA+osopkz3JRRohgUrFQ+ShDc4/+ioe
NaQr6tJEiuBHihkSexPVyKRO7WyrIB/g33K5vB1GVwx/9MD8rWm/gU69jIMQn9PL
sNt6AMZx4A8MTL56slM9d9GYHQelFSS4alXgQW4C+iVzVcRMp0fiwDbxoe2Q7goy
MNX2Ic+ffYJJNkkBFye+udlmdH9Wqzz+NqIyb/9AEDx8TA1Fvl6sd19P+JedWH2q
dnbYVt4/N4l/8YJrh/T8/kJwvFheOC1Y5nlugf3wImcZgY3T9hhDOjYxMaCbZyCS
hcYzbylrMgzz2VP51xuClvI5OILKCA9fqR7nxVJo1a6fVTrT24jDELzE/hCkkPRS
Hra1yd/ZflIysuut7B8Yb2m0eSDhcyVtuf/kTFBndzduyxYq7Zza3J/UvrQUCHKy
0aACyNlFB4amfaRFfWHc21I=
=+IKZ
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmkgyywACgkQmmx57+YA
GNmIMw/9F1n6uAP0J0uVGLiDKSvxwN93oIYSoR3ToW/W4NUa67kJ/ScTO/ac+Mze
C2XAb4tY7rW3Ts34GWcW7G5sbV96HW8h81x9LsYGDdyNOzaLgESgvmsaObLH5RkY
K4DhgIyBTSpZf3QAqOd47BI2IkgHgcnjoyrCYMdC1b/wjrScwyvBxC7hbxS8Z4nu
mD2Cfdj/l41P09miemeLCXIcOHRJShtVRzZdszTmKqi3YEESAYSw57OKfE4flcuR
NhxLRwnZfetvuqW6wqNZBeoRLgTenpG5Qj2nPxJXpXG+gVw8EMvo87U/oq3bYNgu
+04EjN2Ulc3BPuupfq5K4x3Pmf0olkDJ/qyaeUc//R6ouwH/4hQvqRWUewhJ+1MF
wbfj/fPfOlhqPa5TiwwGWC9XK0ovq7bdcbEsVkJXJ7b4Do16zWa57dIS+heN4A/Z
UlXBvjEWgYd0H9+AGkWii3iFFy86FGRxflGYDfti6iRMeo3h+RbiNx3w8KbOgLg2
il6ne2TLvLg1pFqm67suPDXfyRRIKmkvIZtEyH8cdXmJ2zKYcrfoskd2Q9nd5bZE
Bzy0KrO18mXNTjcnd3ht+6hkYcAcQFetk6DgU7aKg0WDNOeWFPlnxr7BBASVSZjI
oiCcLW8GqCqJubMBjydso3q85AW8ig5phRCxuTP3kEbZPb71hMU=
=r+Hg
-----END PGP SIGNATURE-----
Merge tag 'qcomtee-fixes2-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into arm/fixes
QCOMTEE fixes2 for v6.18
- initialize result before use in in error path
- fix uninitialized pointers with free attribute
* tag 'qcomtee-fixes2-for-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee:
tee: qcomtee: initialize result before use in release worker
tee: qcomtee: fix uninitialized pointers with free attribute
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
-Wflex-array-member-not-at-end was introduced in GCC-14, and we are
getting ready to enable it, globally.
Move the conflicting declaration to the end of the corresponding
structure. Notice that struct iommufd_vevent is a flexible
structure, this is a structure that contains a flexible-array
member.
Fix the following warning:
drivers/iommu/iommufd/iommufd_private.h:621:31: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end]
Link: https://patch.msgid.link/r/aRHOAwpATIE0oajj@kspp
Signed-off-by: "Gustavo A. R. Silva" <gustavoars@kernel.org>
Fixes: e36ba5ab80 ("iommufd: Add IOMMUFD_OBJ_VEVENTQ and IOMMUFD_CMD_VEVENTQ_ALLOC")
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
One of the requirements for counted_by annotations is that the counter
member must be initialized before the first reference to the
flexible-array member.
Move the vevent->data_len = data_len; initialization to before the
first access to flexible array vevent->event_data.
Link: https://patch.msgid.link/r/aRL7ZFFqM5bRTd2D@kspp
Cc: stable@vger.kernel.org
Fixes: e8e1ef9b77 ("iommufd/viommu: Add iommufd_viommu_report_event helper")
Signed-off-by: "Gustavo A. R. Silva" <gustavoars@kernel.org>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
-----BEGIN PGP SIGNATURE-----
iQJKBAABCAA0FiEEzOlt8mkP+tbeiYy5AoYrw/LiJnoFAmkgH58WHGNoZW5odWFj
YWlAa2VybmVsLm9yZwAKCRAChivD8uImetIQD/90qm0rkEhYnciXeSR+yuqSKk1e
YDyXkNiVjwazAUGBo0vdTvCkLa9xs2rbxXbA4cUsRYKB8lW0fRWlNlj+DxOxAroQ
0rVsgWvp5ZHzB6ppIdNEY2PF2bwk7vTdffQXlwYKoTDt95MAqxKercQX5isPe17t
S4N23hIMiNzqM9kshxi5xxm27PvJvEpdRYRoFh9zmZBrW98pLhhc668JEGautzra
dAjm7uzdeDb/f5AQFdiB+NGlYt2fRr24EPmEqyqXJAHtL9wI2t1HHUs4lb+FUILf
ZiUfJHmYbz1v6GInPbPB3Xqi5EJrrSa0+8SmnqlUr3trEQ6whqjGoV2n5v38Ppr6
PTL+fv7ACEDbr+APgWajsLCjbSzu6LDUay+vVFLLDJSxl7eYjWMZwFS5Rzr+pAc3
UJHCG8sNXyLqiwxbwRMPR/w/YTxCaULHfBuCmxQpnhU6qHsjIzpFdztycpgcuF3B
YcvZ0rAGbq+Q3glhqIe19WhswDUB94j4+Nrz80pXqJgumK42xtIbx5K4WLYFdHFo
Wxi6mW9VGPDZVysbDry2aFVVoymlYpv7p3N/txOrYuxmrr6YUyEeued3mW+99Zjj
FbdPfCOJU1sTBZcg8AiSG3nUuStKKLFu56e8oaW5kzOOAxjHsFqo3vL0JdjjeJX/
+1pRdJ/1i9k9la4/rQ==
=rVXC
-----END PGP SIGNATURE-----
Merge tag 'loongarch-fixes-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson
Pull LoongArch fixes from Huacai Chen:
"Use UAPI types in ptrace UAPI header to fix nolibc ptrace.
Fix CPU name display, NUMA node parsing, kexec/kdump, PCI init and BPF
trampoline"
* tag 'loongarch-fixes-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson:
LoongArch: BPF: Disable trampoline for kernel module function trace
LoongArch: Don't panic if no valid cache info for PCI
LoongArch: Mask all interrupts during kexec/kdump
LoongArch: Fix NUMA node parsing with numa_memblks
LoongArch: Consolidate CPU names in /proc/cpuinfo
LoongArch: Use UAPI types in ptrace UAPI header
-----BEGIN PGP SIGNATURE-----
iQJDBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmkfngUQHGF4Ym9lQGtl
cm5lbC5kawAKCRD301j7KXHgppNrD/iFobqiPSgoIO703YfN2aS74itKMuKuJfJL
7gmLwwNYx1F78l7mfvQz5vOetHcIM2xZzRENvlgeh5UBz0537zDcaXeWjILUCdSw
UxaQgnyHjJN8a5C07FfAXVTLT38133iMVCWT9OjOffPGVFtaVE4JsNI7YLziCGBc
3W69b/uob1KBzSpcWYMl1mA8ZAIoNXk0//qUdcrYuJVeeR5Gp9Cwf09g+axERYYw
OCVf0ykWeIr6B7qhKcoV95a+BsbSwKnO8n3o5bo8/nJ/dexr+ofHbf5YhtJaPhbr
o8/CZIYcfdDaYXC2z9KVZrePjinYXYiEwZkvzfoAgbE6Kd88v62ZgHbC8LcYboQ+
w+caLJ1TuEt7aHrLJAN/HbzpAEvMgmZ8Msr26RkKEp1XkiShjAmA+MEqD6zwbZ2i
DgYMetXgQm03Iso0ZseOE3nbnimI2oWWNIyFG2Wx8etmLKR6jAwP72OZumlKZweX
ZXuEWp3Kxoy6buERnR6hWM6MbMK7dIVMVXvKAjbhgbCN2Biy32nbPhW/xj6W3Foa
/0ixGv9pPp6gBA90JmVm5CxuL35wAdScnCIlrAuaBmLlJfeciwXOH5+3ymRvqe2D
k+r8Ng6rqiv6kIoje7bZvuq+i6ZvWnMtpfTanECBnFIQtCjPQyuUJqyhqiL/6puQ
hjn50LHg
=CgZ0
-----END PGP SIGNATURE-----
Merge tag 'io_uring-6.18-20251120' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull io_uring fix from Jens Axboe:
"Just a single fix for a mixup of arguments for the skb_queue_splice()
call, in the io_uring timestamp retrieval code"
* tag 'io_uring-6.18-20251120' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
io_uring/cmd_net: fix wrong argument types for skb_queue_splice()
- Add a missing refcount decrement in ata_scsi_dev_rescan() when
the device or its queue is not running. In the case where the
device is running, the recount is already decremented properly
(Yihang Li)
- Generate the proper sense code for a Security locked device.
There was a regression caused by a recent change of how sense
data is generated for commands that did not provide any sense
data. This broke system suspend for Security locked devices.
Generate the sense data that the SCSI disk driver expects for
a Security locked device so that system supend works again
(me)
- Set capacity to zero for a Security locked device.
All I/O commands will be aborted by a Security locked device.
Thus, the block layer disk partition scanning will result in
a bunch of, for the user, confusing I/O errors in dmesg during
boot. Since a Security locked device is unusable anyway, set
the capacity to zero, to avoid the disk partition scanning
during boot. We still create the block device in /dev such
that the user may unlock the device using e.g. hdparm (me)
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRN+ES/c4tHlMch3DzJZDGjmcZNcgUCaSB/+AAKCRDJZDGjmcZN
cswtAP4l1Ui8d6PwHnxVvOlv1cWO/K+7XboiGZNFphf7QDZhPQD+J41BG/YNyNcB
Ma716tdF1UVayUB2OItsX0gSmmz9KgI=
=0b5E
-----END PGP SIGNATURE-----
Merge tag 'ata-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux
Pull ata fixes from Niklas Cassel:
- Add a missing refcount decrement in ata_scsi_dev_rescan() when
the device or its queue is not running.
In the case where the device is running, the recount is already
decremented properly (Yihang Li)
- Generate the proper sense code for a Security locked device.
There was a regression caused by a recent change of how sense
data is generated for commands that did not provide any sense
data. This broke system suspend for Security locked devices.
Generate the sense data that the SCSI disk driver expects for a
Security locked device so that system suspend works again (me)
- Set capacity to zero for a Security locked device.
All I/O commands will be aborted by a Security locked device.
Thus, the block layer disk partition scanning will result in
a bunch of, for the user, confusing I/O errors in dmesg during
boot.
Since a Security locked device is unusable anyway, set the capacity
to zero, to avoid the disk partition scanning during boot. We still
create the block device in /dev such that the user may unlock the
device using e.g. hdparm (me)
* tag 'ata-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:
ata: libata-core: Set capacity to zero for a security locked drive
ata: libata-scsi: Fix system suspend for a security locked drive
ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan()
- Fix register naming in the Mediatek mt8189 driver.
- Select REGMAP_MMIO for the Realtek RTD driver.
- Fix the number of items in groups in the Toshiba
Visconti driver.
- Fix a memory leak in the Cirrus CS42L43 driver.
- Fix a deadlock (!) in Qualcomm pinmux configuration.
- Fix use of uninitialized memory and list initialization
in the S32CC pin controller.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEElDRnuGcz/wPCXQWMQRCzN7AZXXMFAmkgkXUACgkQQRCzN7AZ
XXNxZxAAn7JgQd+ec2G8NtCXDd9CklEgnj8nrAp5k2DxdIfgmumrUWnuk0sFg5gR
r9bHZXTucbFEhSXzZklMsYY3fIBDAFc4pcZe3+T3dwvLuP9eNT9WAKCxKrZol8b4
5x/D6nqfOMbYPBGwoR/tK1QUbbWxyC/LgjgUXr7GV5jKFZSDponWqOE50JdG3g8K
ykJZFTZb++NLoBCW5IKPoKR+p2z5eyO0oiSrsgsFJvHsNy3ID6/L1lab9udJ1VdD
TNLtnGuB3FEpUOUycx/Y4OyuMoVe2ySr2mqsSAVEWXB8+reAIZF3v5Y1uYYkn7j3
TwJ4qUTm7DtOlcCuH0GfyPuA0NLwFteTBVQl1w43i2Zcuy2prpZ0sYjMLPmwZTbX
YiZgjo7lz2CxhGKkhOlcgrvxhoembEhD9Z8YL7CLn04dykjjnzTD7O1Hr2NA+ZwD
ttbc5+2adyfaewIbo1zJNwP81x1wBVzPCDQVS+/h4lQB5AAxZpcYC8pz/zx84fTO
Qg+nRk9hSjWjGqi9JGpsJRtNR04Q58qThDg3xuumq+17TtYUPTE7BCzpuV2jyodE
UV1cHwjULp9e/f3dumDG15V733xUUtHEGNkk9AFD+F5X+QtChK1uDSbYlybsr/qc
UbhoYHA+jQz5L3I4MIuU41ekVdVYlH5PKzDI5jTJOQUra9M/sag=
=dfY2
-----END PGP SIGNATURE-----
Merge tag 'pinctrl-v6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl
Pull pin control fixes from Linus Walleij:
- Fix register naming in the Mediatek mt8189 driver
- Select REGMAP_MMIO for the Realtek RTD driver
- Fix the number of items in groups in the Toshiba Visconti driver
- Fix a memory leak in the Cirrus CS42L43 driver
- Fix a deadlock (!) in Qualcomm pinmux configuration
- Fix use of uninitialized memory and list initialization in the S32CC
pin controller
* tag 'pinctrl-v6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
dt-bindings: pinctrl: xlnx,versal-pinctrl: Add missing unevaluatedProperties on '^conf' nodes
pinctrl: s32cc: initialize gpio_pin_config::list after kmalloc()
pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc
pinctrl: qcom: msm: Fix deadlock in pinmux configuration
pinctrl: cirrus: Fix fwnode leak in cs42l43_pin_probe()
dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups
pinctrl: realtek: Select REGMAP_MMIO for RTD driver
pinctrl: mediatek: mt8189: align register base names to dt-bindings ones
pinctrl: mediatek: mt8196: align register base names to dt-bindings ones
- fix a use-after-free bug in GPIO character device code
- update MAINTAINERS
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEkeUTLeW1Rh17omX8BZ0uy/82hMMFAmkgdpIACgkQBZ0uy/82
hMMt3Q/9E7I9oc89DFy9yZ6YXM8k2EpiIWvfygTMdVEx91i16L2591XFlrc6oQjQ
c7Aaw6CWDVe20VlrWNMYxUQH2TUmROeQr3DJol8DUBRshLeVOEpWU6G0hvdFSucl
lrDCS2ZkhNUswf0PLT+787OvdUhIvXGbvZv+Rcd5N+P7wxUwZkMStArl7PaAHVKt
pNlUE6R0BtwPDWhi0wgag/RAmGo8TEdBcSinak9Ph9rdQg3GSPA1AsssFPqd1a13
j2MdcWJQAEUKm6ecEcBSFeBR62LhhgIEo7iybHAtLml/qiGzz5sAj3gOBG4filLi
YLhTLxKOiGzkpg+MqYioj42JCpCobEhIkPV+/W9jmZePFH2pyKEdHnI4dF0xcp/8
+1WQo6xaZtTwADkyG3d0ardJdgZ0fc4AxQcSck29O+1NG0hd1Z+dL1cffdyJ8fxi
OHucAlO/P/k7/T83eSZhRZaxdTWXCieWEJ1VzgwOsu/DnNvIcwhbyKGeFuS7z3Xj
Gs1AFfh6GpFkK6ueZDz0ipBvtHqQTdzu1IwvosWMhmmPz/QdcxOywNK+UArvt6lg
P5Tj6Wes0/ymZTKiPHicSx8UaqC8MliMKpJAWybePox6KieirXiht+a/qJvEXsbm
ekPXH3RwsHNBlzB+dP+fa3aJWvd0F/2YVnug4T6a/QEVuNvJx7U=
=nTA4
-----END PGP SIGNATURE-----
Merge tag 'gpio-fixes-for-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux
Pull gpio fixes from Bartosz Golaszewski:
- fix a use-after-free bug in GPIO character device code
- update MAINTAINERS
* tag 'gpio-fixes-for-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
MAINTAINERS: update my email address
gpio: cdev: make sure the cdev fd is still active before emitting events
Fully initialize *ctx, including the buf field which sha256_init()
doesn't initialize, to avoid a KMSAN warning when comparing *ctx to
orig_ctx. This KMSAN warning slipped in while KMSAN was not working
reliably due to a stackdepot bug, which has now been fixed.
Fixes: 6733968be7 ("lib/crypto: tests: Add tests and benchmark for sha256_finup_2x()")
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://lore.kernel.org/r/20251121033431.34406-1-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Apparently as of version 2.42, glibc headers define AT_RENAME_NOREPLACE
and some of the other flags for renameat2() and friends in <stdio.h>.
Which would all be fine, except for inexplicable reasons glibc decided
to define them _differently_ from the kernel definitions, which then
makes some of our sample code that includes both kernel headers and user
space headers unhappy, because the compiler will (correctly) complain
about redefining things.
Now, mixing kernel headers and user space headers is always a somewhat
iffy proposition due to namespacing issues, but it's kind of inevitable
in our sample and selftest code. And this is just glibc being stupid.
Those defines come from the kernel, glibc is exposing the kernel
interfaces, and glibc shouldn't make up some random new expressions for
these values.
It's not like glibc headers changed the actual result values, but they
arbitrarily just decided to use a different expression to describe those
values. The kernel just does
#define AT_RENAME_NOREPLACE 0x0001
while glibc does
# define RENAME_NOREPLACE (1 << 0)
# define AT_RENAME_NOREPLACE RENAME_NOREPLACE
instead. Same value in the end, but very different macro definition.
For absolutely no reason.
This has since been fixed in the glibc development tree, so eventually
we'll end up with the canonical expressions and no clashes. But in the
meantime the broken headers are in the glibc-2.42 release and have made
it out into distributions.
Do a minimal work-around to make the samples build cleanly by just
undefining the affected macros in between the user space header include
and the kernel header includes.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
The ACPI ECRD and ECWR functions have a 10ms sleep at the end. It turns
out, that this is sometimes needed to avoid I2C transmission failures,
especially for functions doing regmap_update_bits (and thus read + write
shortly after each other). This fixes problems like the following
appearing in the kernel log:
leds platform::micmute: Setting an LED's brightness failed (-6)
leds platform::kbd_backlight: Setting an LED's brightness failed (-6)
The ACPI QEVT function used to read the interrupt status register also
has a 10ms sleep at the end. Without that there are problems with
reading multiple events following directly after each other resulting
in the following error message being logged:
thinkpad-t14s-ec 4-0028: Failed to read event
Fixes: 60b7ab6ce0 ("platform: arm64: thinkpad-t14s-ec: new driver")
Signed-off-by: Sebastian Reichel <sre@kernel.org>
Link: https://patch.msgid.link/20251119-thinkpad-t14s-ec-improvements-v2-2-441219857c02@kernel.org
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Fix a race condition, that an input key related interrupt might be
triggered before the input handler has been registered, which results
in a NULL pointer dereference. This can happen if the user enables
the keyboard backlight shortly before the driver is being probed.
This fixes the following backtrace visible in dmesg:
Unable to handle kernel NULL pointer dereference at virtual address 00000000000000e0
...
Call trace:
sparse_keymap_report_event+0x2c/0x978 [sparse_keymap] (P)
t14s_ec_irq_handler+0x190/0x3e8 [lenovo_thinkpad_t14s]
irq_thread_fn+0x30/0xb8
irq_thread+0x18c/0x3b0
kthread+0x148/0x228
ret_from_fork+0x10/0x20
Fixes: 60b7ab6ce0 ("platform: arm64: thinkpad-t14s-ec: new driver")
Signed-off-by: Sebastian Reichel <sre@kernel.org>
Reviewed-by: Bryan O'Donoghue <bod@kernel.org>
Link: https://patch.msgid.link/20251119-thinkpad-t14s-ec-improvements-v2-1-441219857c02@kernel.org
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
The sii902x driver was caching HDMI detection state in a sink_is_hdmi field
and checking it in mode_set() to determine whether to set HDMI or DVI
output mode. This approach had two problems:
1. With DRM_BRIDGE_ATTACH_NO_CONNECTOR (used by modern display drivers like
TIDSS), the bridge's get_modes() is never called. Instead, the
drm_bridge_connector helper calls the bridge's edid_read() and updates the
connector itself. This meant sink_is_hdmi was never populated, causing the
driver to default to DVI mode and breaking HDMI audio.
2. The mode_set() callback doesn't receive atomic state or connector
pointer, making it impossible to check connector->display_info.is_hdmi
directly at that point.
Fix this by moving the HDMI vs DVI decision from mode_set() to
atomic_enable(), where we can access the connector via
drm_atomic_get_new_connector_for_encoder(). This works for both connector
models:
- With DRM_BRIDGE_ATTACH_NO_CONNECTOR: Returns the drm_bridge_connector
created by the display driver, which has already been updated by the
helper's call to drm_edid_connector_update()
- Without DRM_BRIDGE_ATTACH_NO_CONNECTOR (legacy): Returns the connector
embedded in sii902x struct, which gets updated by the bridge's own
get_modes()
Fixes: 3de47e1309 ("drm/bridge: sii902x: use display info is_hdmi")
Signed-off-by: Devarsh Thakkar <devarsht@ti.com>
Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20251030151635.3019864-1-devarsht@ti.com
't->len' is an unsigned integer, while 'watermark' and 'txfifosize' are
u8. Using min_t with typeof(watermark) forces both values to be cast to
u8, which truncates len when it exceeds 255. For example, len = 4096
becomes 0 after casting, resulting in an incorrect watermark value.
Use a wider type in min_t to avoid truncation and ensure the correct
minimum value is applied.
Fixes: a750050349 ("spi: spi-fsl-lpspi: use min_t() to improve code")
Signed-off-by: Carlos Song <carlos.song@nxp.com>
Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
Link: https://patch.msgid.link/20251117030355.1359081-1-carlos.song@nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
When a UAS device is unplugged during data transfer, there is
a probability of a system panic occurring. The root cause is
an access to an invalid memory address during URB callback handling.
Specifically, this happens when the dma_direct_unmap_sg() function
is called within the usb_hcd_unmap_urb_for_dma() interface, but the
sg->dma_address field is 0 and the sg data structure has already been
freed.
The SCSI driver sends transfer commands by invoking uas_queuecommand_lck()
in uas.c, using the uas_submit_urbs() function to submit requests to USB.
Within the uas_submit_urbs() implementation, three URBs (sense_urb,
data_urb, and cmd_urb) are sequentially submitted. Device removal may
occur at any point during uas_submit_urbs execution, which may result
in URB submission failure. However, some URBs might have been successfully
submitted before the failure, and uas_submit_urbs will return the -ENODEV
error code in this case. The current error handling directly calls
scsi_done(). In the SCSI driver, this eventually triggers scsi_complete()
to invoke scsi_end_request() for releasing the sgtable. The successfully
submitted URBs, when being unlinked to giveback, call
usb_hcd_unmap_urb_for_dma() in hcd.c, leading to exceptions during sg
unmapping operations since the sg data structure has already been freed.
This patch modifies the error condition check in the uas_submit_urbs()
function. When a UAS device is removed but one or more URBs have already
been successfully submitted to USB, it avoids immediately invoking
scsi_done() and save the cmnd to devinfo->cmnd array. If the successfully
submitted URBs is completed before devinfo->resetting being set, then
the scsi_done() function will be called within uas_try_complete() after
all pending URB operations are finalized. Otherwise, the scsi_done()
function will be called within uas_zap_pending(), which is executed after
usb_kill_anchored_urbs().
The error handling only takes effect when uas_queuecommand_lck() calls
uas_submit_urbs() and returns the error value -ENODEV . In this case,
the device is disconnected, and the flow proceeds to uas_disconnect(),
where uas_zap_pending() is invoked to call uas_try_complete().
Fixes: eb2a86ae8c ("USB: UAS: fix disconnect by unplugging a hub")
Cc: stable <stable@kernel.org>
Signed-off-by: Yu Chen <chenyu45@xiaomi.com>
Signed-off-by: Owen Gu <guhuinan@xiaomi.com>
Acked-by: Oliver Neukum <oneukum@suse.com>
Link: https://patch.msgid.link/20251120123336.3328-1-guhuinan@xiaomi.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This patch addresses a race condition caused by unsynchronized
execution of multiple call paths invoking `dwc3_remove_requests()`,
leading to premature freeing of USB requests and subsequent crashes.
Three distinct execution paths interact with `dwc3_remove_requests()`:
Path 1:
Triggered via `dwc3_gadget_reset_interrupt()` during USB reset
handling. The call stack includes:
- `dwc3_ep0_reset_state()`
- `dwc3_ep0_stall_and_restart()`
- `dwc3_ep0_out_start()`
- `dwc3_remove_requests()`
- `dwc3_gadget_del_and_unmap_request()`
Path 2:
Also initiated from `dwc3_gadget_reset_interrupt()`, but through
`dwc3_stop_active_transfers()`. The call stack includes:
- `dwc3_stop_active_transfers()`
- `dwc3_remove_requests()`
- `dwc3_gadget_del_and_unmap_request()`
Path 3:
Occurs independently during `adb root` execution, which triggers
USB function unbind and bind operations. The sequence includes:
- `gserial_disconnect()`
- `usb_ep_disable()`
- `dwc3_gadget_ep_disable()`
- `dwc3_remove_requests()` with `-ESHUTDOWN` status
Path 3 operates asynchronously and lacks synchronization with Paths
1 and 2. When Path 3 completes, it disables endpoints and frees 'out'
requests. If Paths 1 or 2 are still processing these requests,
accessing freed memory leads to a crash due to use-after-free conditions.
To fix this added check for request completion and skip processing
if already completed and added the request status for ep0 while queue.
Fixes: 72246da40f ("usb: Introduce DesignWare USB3 DRD Driver")
Cc: stable <stable@kernel.org>
Suggested-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Signed-off-by: Manish Nagar <manish.nagar@oss.qualcomm.com>
Link: https://patch.msgid.link/20251120074435.1983091-1-manish.nagar@oss.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
When DbC is disconnected then xhci_dbc_tty_unregister_device()
is called. However if there is any user space process blocked
on write to DbC terminal device then it will never be signalled
and thus stay blocked indifinitely.
This fix adds a tty_vhangup() call in xhci_dbc_tty_unregister_device().
The tty_vhangup() wakes up any blocked writers and causes subsequent
write attempts to DbC terminal device to fail.
Cc: stable <stable@kernel.org>
Fixes: dfba2174dc ("usb: xhci: Add DbC support in xHCI driver")
Signed-off-by: Łukasz Bartosik <ukaszb@chromium.org>
Link: https://patch.msgid.link/20251119212910.1245694-1-ukaszb@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Discovered by Atuin - Automated Vulnerability Discovery Engine.
new_pba comes from the status packet returned after each write.
A bogus device could report values beyond the block count derived
from info->capacity, letting the driver walk off the end of
pba_to_lba[] and corrupt heap memory.
Reject PBAs that exceed the computed block count and fail the
transfer so we avoid touching out-of-range mapping entries.
Signed-off-by: Tianchu Chen <flynnnchen@tencent.com>
Cc: stable <stable@kernel.org>
Link: https://patch.msgid.link/B2DC73A3EE1E3A1D+202511161322001664687@tencent.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Commit 69896119dc ("MIPS: vdso: Switch to generic storage
implementation") switches to a generic vdso storage, which increases
the number of data pages from 1 to 4. But there is only one page
reserved, which causes segementation faults depending where the VDSO
area is randomized to. To fix this use the same size of reservation
and allocation of the VDSO data pages.
Fixes: 69896119dc ("MIPS: vdso: Switch to generic storage implementation")
Reviewed-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Reviewed-by: Huacai Chen <chenhuacai@loongson.cn>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Depending on the particular CPU implementation a TLB shutdown may occur
if multiple matching entries are detected upon the execution of a TLBP
or the TLBWI/TLBWR instructions. Given that we don't know what entries
we have been handed we need to be very careful with the initial TLB
setup and avoid all these instructions.
Therefore read all the TLB entries one by one with the TLBR instruction,
bypassing the content addressing logic, and truncate any large pages in
place so as to avoid a case in the second step where an incoming entry
for a large page at a lower address overlaps with a replacement entry
chosen at another index. Then preinitialize the TLB using addresses
outside our usual unique range and avoiding clashes with any entries
received, before making the usual call to local_flush_tlb_all().
This fixes (at least) R4x00 cores if TLBP hits multiple matching TLB
entries (SGI IP22 PROM for examples sets up all TLBs to the same virtual
address).
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Fixes: 35ad7e1815 ("MIPS: mm: tlb-r4k: Uniquify TLB entries on init")
Cc: stable@vger.kernel.org
Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Tested-by: Jiaxun Yang <jiaxun.yang@flygoat.com> # Boston I6400, M5150 sim
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
GFP_NOWAIT allocation may fail anytime. It needs to be changed to
GFP_NOIO. There's no need to handle an error because mempool_alloc with
GFP_NOIO can't fail.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Reviewed-by: Eric Biggers <ebiggers@kernel.org>
