Commit graph

1,400,491 commits

Author SHA1 Message Date
Amirreza Zarrabi
e19d7f7e92 tee: qcomtee: initialize result before use in release worker
Initialize result to 0 so the error path doesn't read it
uninitialized when the invoke fails. Fixes a Smatch warning.

Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/op-tee/7c1e0de2-7d42-4c6b-92fe-0e4fe5d650b5@oss.qualcomm.com/
Fixes: d6e290837e ("tee: add Qualcomm TEE driver")
Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
2025-11-17 10:19:29 +01:00
Linus Torvalds
6a23ae0a96 Linux 6.18-rc6 v6.18-rc6 2025-11-16 14:25:38 -08:00
Linus Torvalds
998ccc327b perf tools fixes for v6.18: 2nd batch
- Fix writing bpf_prog (infos|btfs)_cnt to data file, to not generate
   invalid perf.data files in some corner cases.
 
 - Fix 'perf top' segfault by ensuring libbfd is initialized. This is an
   opt-in feature due to license incompatibilities.
 
 - Fix segfault in 'perf lock' due to missing kernel map.
 
 - Fix 'perf lock contention' test.
 
 - Don't fail fast path detection if binutils-devel isn't available.
 
 - Sync KVM's vmx.h with the kernel to pick SEAMCALL exit reason.
 
 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQR2GiIUctdOfX2qHhGyPKLppCJ+JwUCaRokLwAKCRCyPKLppCJ+
 JwEYAQDuSXq1QraQr4ADvGpLAGVyWCxnXbhNqSmcCVB07OO5AQEA69kNlvoKHm3L
 ml2BiY6MMRQAXaTs4vi9hJnEdSnzcg0=
 =vvjd
 -----END PGP SIGNATURE-----

Merge tag 'perf-tools-fixes-for-v6.18-2-2025-11-16' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools

Pull perf tools fixes from Arnaldo Carvalho de Melo:

 - Fix writing bpf_prog (infos|btfs)_cnt to data file, to not generate
   invalid perf.data files in some corner cases.

 - Fix 'perf top' segfault by ensuring libbfd is initialized. This is an
   opt-in feature due to license incompatibilities.

 - Fix segfault in 'perf lock' due to missing kernel map.

 - Fix 'perf lock contention' test.

 - Don't fail fast path detection if binutils-devel isn't available.

 - Sync KVM's vmx.h with the kernel to pick SEAMCALL exit reason.

* tag 'perf-tools-fixes-for-v6.18-2-2025-11-16' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools:
  perf libbfd: Ensure libbfd is initialized prior to use
  perf test: Fix lock contention test
  perf lock: Fix segfault due to missing kernel map
  tools headers UAPI: Sync KVM's vmx.h with the kernel to pick SEAMCALL exit reason
  perf build: Don't fail fast path feature detection when binutils-devel is not available
  perf header: Write bpf_prog (infos|btfs)_cnt to data file
2025-11-16 13:45:03 -08:00
Linus Torvalds
7ba45f1504 7 hotfixes. 5 are cc:stable, 4 are against mm/.
All are singletons - please see the respective changelogs for details.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCaRoauQAKCRDdBJ7gKXxA
 jtNFAQDEMH0+zRGz/Larkf9cgmdKcDgij1DP2gP/3i8PWAoaGQD8C9evZxu1h9wC
 rFbaSkPDeSdDafo3RZfpo1gqE0LdEA4=
 =oew8
 -----END PGP SIGNATURE-----

Merge tag 'mm-hotfixes-stable-2025-11-16-10-40' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull misc fixes from Andrew Morton:
 "7 hotfixes.  5 are cc:stable, 4 are against mm/

  All are singletons - please see the respective changelogs for details"

* tag 'mm-hotfixes-stable-2025-11-16-10-40' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
  mm, swap: fix potential UAF issue for VMA readahead
  selftests/user_events: fix type cast for write_index packed member in perf_test
  lib/test_kho: check if KHO is enabled
  mm/huge_memory: fix folio split check for anon folios in swapcache
  MAINTAINERS: update David Hildenbrand's email address
  crash: fix crashkernel resource shrink
  mm: fix MAX_FOLIO_ORDER on powerpc configs with hugetlb
2025-11-16 13:31:14 -08:00
Chen Pei
e2cb69263e tools: riscv: Fixed misalignment of CSR related definitions
The file tools/arch/riscv/include/asm/csr.h borrows from
arch/riscv/include/asm/csr.h, and subsequent modifications
related to CSR should maintain consistency.

Signed-off-by: Chen Pei <cp0613@linux.alibaba.com>
Link: https://patch.msgid.link/20251114071215.816-1-cp0613@linux.alibaba.com
[pjw@kernel.org: dropped Fixes: lines for patches that weren't broken; removed superfluous blank line]
Signed-off-by: Paul Walmsley <pjw@kernel.org>
2025-11-16 10:37:38 -07:00
Mayuresh Chitale
7b090e7b91 riscv: sbi: Prefer SRST shutdown over legacy
Currently, the sbi_init() always attempts to register the legacy shutdown
function as the sys-off handler which is fine when RISCV_SBI_V01 is not
enabled. However, if RISCV_SBI_V01 is enabled in the kernel and the SBI
v0.1 is not supported by the underlying SBI implementation then the
legacy shutdown fails. Fix this by not registering the legacy shutdown
when SRST shutdown is available.

Fixes: 70ddf86d76 ("riscv: sbi: Switch to new sys-off handler API")
Signed-off-by: Mayuresh Chitale <mchitale@ventanamicro.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://patch.msgid.link/20251114065808.304430-1-mchitale@ventanamicro.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
2025-11-16 10:37:27 -07:00
Marc Kleine-Budde
6fe9f3279f can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header
The driver expects to receive a struct gs_host_frame in
gs_usb_receive_bulk_callback().

Use struct_group to describe the header of the struct gs_host_frame and
check that we have at least received the header before accessing any
members of it.

To resubmit the URB, do not dereference the pointer chain
"dev->parent->hf_size_rx" but use "parent->hf_size_rx" instead. Since
"urb->context" contains "parent", it is always defined, while "dev" is not
defined if the URB it too short.

Fixes: d08e973a77 ("can: gs_usb: Added support for the GS_USB CAN devices")
Link: https://patch.msgid.link/20251114-gs_usb-fix-usb-callbacks-v1-2-a29b42eacada@pengutronix.de
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2025-11-16 17:04:13 +01:00
Marc Kleine-Budde
516a0cd1c0 can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs
The driver lacks the cleanup of failed transfers of URBs. This reduces the
number of available URBs per error by 1. This leads to reduced performance
and ultimately to a complete stop of the transmission.

If the sending of a bulk URB fails do proper cleanup:
- increase netdev stats
- mark the echo_sbk as free
- free the driver's context and do accounting
- wake the send queue

Closes: https://github.com/candle-usb/candleLight_fw/issues/187
Fixes: d08e973a77 ("can: gs_usb: Added support for the GS_USB CAN devices")
Link: https://patch.msgid.link/20251114-gs_usb-fix-usb-callbacks-v1-1-a29b42eacada@pengutronix.de
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2025-11-16 17:03:43 +01:00
Thomas Mühlbacher
30db4451c7 can: sja1000: fix max irq loop handling
Reading the interrupt register `SJA1000_IR` causes all of its bits to be
reset. If we ever reach the condition of handling more than
`SJA1000_MAX_IRQ` IRQs, we will have read the register and reset all its
bits but without actually handling the interrupt inside of the loop
body.

This may, among other issues, cause us to never `netif_wake_queue()`
again after a transmission interrupt.

Fixes: 429da1cc84 ("can: Driver for the SJA1000 CAN controller")
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Mühlbacher <tmuehlbacher@posteo.net>
Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://patch.msgid.link/20251115153437.11419-1-tmuehlbacher@posteo.net
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2025-11-16 16:34:41 +01:00
Seungjin Bae
0c73772cd2 can: kvaser_usb: leaf: Fix potential infinite loop in command parsers
The `kvaser_usb_leaf_wait_cmd()` and `kvaser_usb_leaf_read_bulk_callback`
functions contain logic to zero-length commands. These commands are used
to align data to the USB endpoint's wMaxPacketSize boundary.

The driver attempts to skip these placeholders by aligning the buffer
position `pos` to the next packet boundary using `round_up()` function.

However, if zero-length command is found exactly on a packet boundary
(i.e., `pos` is a multiple of wMaxPacketSize, including 0), `round_up`
function will return the unchanged value of `pos`. This prevents `pos`
to be increased, causing an infinite loop in the parsing logic.

This patch fixes this in the function by using `pos + 1` instead.
This ensures that even if `pos` is on a boundary, the calculation is
based on `pos + 1`, forcing `round_up()` to always return the next
aligned boundary.

Fixes: 7259124eac ("can: kvaser_usb: Split driver into kvaser_usb_core.c and kvaser_usb_leaf.c")
Signed-off-by: Seungjin Bae <eeodqql09@gmail.com>
Reviewed-by: Jimmy Assarsson <extja@kvaser.com>
Tested-by: Jimmy Assarsson <extja@kvaser.com>
Link: https://patch.msgid.link/20251023162709.348240-1-eeodqql09@gmail.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
2025-11-16 16:23:04 +01:00
Linus Torvalds
7254a2b522 firewire fixes for 6.18-rc6
This includes some fixes for bugs to generate topology map, newly
 introduced in v6.18 kernel.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQE66IEYNDXNBPeGKSsLtaWM8LwEwUCaRnGhQAKCRCsLtaWM8Lw
 E+wNAQDH0TMsY74+RNGNx+qqObPIYETYF+8It4ToktG06DpY/QEArbuXoXich3IN
 NumMhjT2kPbJd5iSSn9Vg5ueHAKzLwc=
 =uzc3
 -----END PGP SIGNATURE-----

Merge tag 'firewire-fixes-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394

Pull firewire fixes from Takashi Sakamoto:
 "This includes some fixes for the topology map, newly introduced in
  v6.18 kernel"

* tag 'firewire-fixes-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394:
  firewire: core: fix to update generation field in topology map
  firewire: core: Initialize topology_map.lock
2025-11-16 07:08:28 -08:00
Linus Torvalds
87751e715e - In Versalnet, handle the reporting of non-standard hw errors whose
information can come in more than one remote processor message.
 
 - Explicitly reenable ECC checking after a warm reset in Altera OCRAM as those
   registers are reset to default otherwise
 
 - Fix single-bit error injection in Altera EDAC to not inject errors directly
   in ECC RAM and thus lead to false double-bit errors due to same ECC RAM
   being in concurrent use
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmkZrFYACgkQEsHwGGHe
 VUrv1xAAviijUhOhHWUOi60rwA+x49gbpOPCj6vEOIpimb1OxujuDpovMeoPFPLr
 OtY7ktmkSoWkmOut2cVMK24GswHPEpFlSDTfqNDiMIIrGOf/K+uV8OSLEzCbvnHg
 nr0bK5NumrowtM2ztEXQieDLcWy/mWmzmlWiFaxczsQ/y8dt5j4ZJyvTjtP/QVPg
 uCRIiXhbNDPTbR1TFCaB2cEjPBowG4msxvJOeneN68cXxetAFQxg2zFBBPm4yu2v
 UwKqwaGNLTn56mVaB3mVFCVdhYOJisAeih9ezU0iQU7Jez0/56ZSnNEUQyJcvzdX
 iJUPbOalus3i0zZGMvSMaH3WmtNCmDJOVeGWOIhhLSdlBrL0+A8wUYaBAkjH72fR
 b3Nc9p4VIpv3kUvp6u65HyklyeBGHtCSj2tZgTbqQnBGOtmFZEfKFNEvRYkAlIOx
 uuuwaRjeQzQ3RhFPVMzzDPLFGb18kyFtSvuU44bvaVmaUxnAm5ej4J9CNB19Qyyz
 bBiJizqZsJbcea0K6NwYL//PFOxUsIQlrf0wZIfLX4Zw9NlgLd/qTuWtQ75fjo/N
 LWERjfJWtOspGCAzfDT01enraGi5/eueQho2N4bQT1Ngi4b8GAcYjQRu7Fev8bse
 fgZbrUv3UduH094iH8KNIZDQfzn+YYPSEO2A+iNrUNraoveLpTg=
 =ebJr
 -----END PGP SIGNATURE-----

Merge tag 'edac_urgent_for_v6.18_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras

Pull EDAC fixes from Borislav Petkov:

 - In Versalnet, handle the reporting of non-standard hw errors whose
   information can come in more than one remote processor message.

 - Explicitly reenable ECC checking after a warm reset in Altera OCRAM
   as those registers are reset to default otherwise

 - Fix single-bit error injection in Altera EDAC to not inject errors
   directly in ECC RAM and thus lead to false double-bit errors due to
   same ECC RAM being in concurrent use

* tag 'edac_urgent_for_v6.18_rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras:
  EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection
  EDAC/altera: Handle OCRAM ECC enable after warm reset
  EDAC/versalnet: Handle split messages for non-standard errors
2025-11-16 07:05:24 -08:00
Xu Yang
e89ee35567 arm64: dts: imx8qm-mek: fix mux-controller select/enable-gpios polarity
According to the board design, set SEL to high means flipped
connection (TX2/RX2). And the TCPM will output logical 1 if it needs
flipped connection. So switch to active high for select-gpios.
The EN pin on mux chip is low active, so switch to active low for
enable-gpios too.

Fixes: b237975b2c ("arm64: dts: imx8qm-mek: add usb 3.0 and related type C nodes")
Cc: stable@vger.kernel.org
Reviewed-by: Jun Li <jun.li@nxp.com>
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-11-16 21:10:06 +08:00
Takashi Sakamoto
1107aac1ad firewire: core: fix to update generation field in topology map
The generation field of topology map is updated after initialized by zero.
The updated value of generation field is always zero, and is against
specification.

This commit fixes the bug.

Fixes: 7d138cb269 ("firewire: core: use spin lock specific to topology map")
Link: https://lore.kernel.org/r/20251114144421.415278-1-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
2025-11-16 21:30:26 +09:00
Chao-ying Fu
91f815b707 riscv: Update MIPS vendor id to 0x127
[1] defines MIPS vendor id as 0x127. All previous MIPS RISC-V patches
were tested on QEMU, also modified to use 0x722 as MIPS_VENDOR_ID. This
new value should reflect real hardware.

[1] https://mips.com/wp-content/uploads/2025/06/P8700_Programmers_Reference_Manual_Rev1.84_5-31-2025.pdf

Fixes: a8fed1bc03 ("riscv: Add xmipsexectl as a vendor extension")
Signed-off-by: Chao-ying Fu <cfu@wavecomp.com>
Signed-off-by: Aleksa Paunovic <aleksa.paunovic@htecgroup.com>
Link: https://patch.msgid.link/20251113-mips-vendorid-v2-1-3279489b7f84@htecgroup.com
Cc: <stable@vger.kernel.org>
Signed-off-by: Paul WAlmsley <pjw@kernel.org>
2025-11-15 15:27:02 -07:00
Kairui Song
1c2a936edd mm, swap: fix potential UAF issue for VMA readahead
Since commit 78524b05f1 ("mm, swap: avoid redundant swap device
pinning"), the common helper for allocating and preparing a folio in the
swap cache layer no longer tries to get a swap device reference
internally, because all callers of __read_swap_cache_async are already
holding a swap entry reference.  The repeated swap device pinning isn't
needed on the same swap device.

Caller of VMA readahead is also holding a reference to the target entry's
swap device, but VMA readahead walks the page table, so it might encounter
swap entries from other devices, and call __read_swap_cache_async on
another device without holding a reference to it.

So it is possible to cause a UAF when swapoff of device A raced with
swapin on device B, and VMA readahead tries to read swap entries from
device A.  It's not easy to trigger, but in theory, it could cause real
issues.

Make VMA readahead try to get the device reference first if the swap
device is a different one from the target entry.

Link: https://lkml.kernel.org/r/20251111-swap-fix-vma-uaf-v1-1-41c660e58562@tencent.com
Fixes: 78524b05f1 ("mm, swap: avoid redundant swap device pinning")
Suggested-by: Huang Ying <ying.huang@linux.alibaba.com>
Signed-off-by: Kairui Song <kasong@tencent.com>
Acked-by: Chris Li <chrisl@kernel.org>
Cc: Baoquan He <bhe@redhat.com>
Cc: Barry Song <baohua@kernel.org>
Cc: Kemeng Shi <shikemeng@huaweicloud.com>
Cc: Nhat Pham <nphamcs@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-11-15 10:52:02 -08:00
Ankit Khushwaha
216158f063 selftests/user_events: fix type cast for write_index packed member in perf_test
Accessing 'reg.write_index' directly triggers a -Waddress-of-packed-member
warning due to potential unaligned pointer access:

perf_test.c:239:38: warning: taking address of packed member 'write_index'
of class or structure 'user_reg' may result in an unaligned pointer value
[-Waddress-of-packed-member]
  239 |         ASSERT_NE(-1, write(self->data_fd, &reg.write_index,
      |                                             ^~~~~~~~~~~~~~~

Since write(2) works with any alignment. Casting '&reg.write_index'
explicitly to 'void *' to suppress this warning.

Link: https://lkml.kernel.org/r/20251106095532.15185-1-ankitkhushwaha.linux@gmail.com
Fixes: 42187bdc3c ("selftests/user_events: Add perf self-test for empty arguments events")
Signed-off-by: Ankit Khushwaha <ankitkhushwaha.linux@gmail.com>
Cc: Beau Belgrave <beaub@linux.microsoft.com>
Cc: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: sunliming <sunliming@kylinos.cn>
Cc: Wei Yang <richard.weiyang@gmail.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-11-15 10:52:02 -08:00
Pasha Tatashin
a26ec8f3d4 lib/test_kho: check if KHO is enabled
We must check whether KHO is enabled prior to issuing KHO commands,
otherwise KHO internal data structures are not initialized.

Link: https://lkml.kernel.org/r/20251106220635.2608494-1-pasha.tatashin@soleen.com
Fixes: b753522bed ("kho: add test for kexec handover")
Signed-off-by: Pasha Tatashin <pasha.tatashin@soleen.com>
Reported-by: kernel test robot <oliver.sang@intel.com>
Closes: https://lore.kernel.org/oe-lkp/202511061629.e242724-lkp@intel.com
Reviewed-by: Pratyush Yadav <pratyush@kernel.org>
Reviewed-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Cc: Alexander Graf <graf@amazon.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-11-15 10:52:01 -08:00
Zi Yan
f1d47cafe5 mm/huge_memory: fix folio split check for anon folios in swapcache
Both uniform and non uniform split check missed the check to prevent
splitting anon folios in swapcache to non-zero order.

Splitting anon folios in swapcache to non-zero order can cause data
corruption since swapcache only support PMD order and order-0 entries. 
This can happen when one use split_huge_pages under debugfs to split
anon folios in swapcache.

In-tree callers do not perform such an illegal operation.  Only debugfs
interface could trigger it.  I will put adding a test case on my TODO
list.

Fix the check.

Link: https://lkml.kernel.org/r/20251105162910.752266-1-ziy@nvidia.com
Fixes: 58729c04cf ("mm/huge_memory: add buddy allocator like (non-uniform) folio_split()")
Signed-off-by: Zi Yan <ziy@nvidia.com>
Reported-by: "David Hildenbrand (Red Hat)" <david@kernel.org>
Closes: https://lore.kernel.org/all/dc0ecc2c-4089-484f-917f-920fdca4c898@kernel.org/
Acked-by: David Hildenbrand (Red Hat) <david@kernel.org>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Barry Song <baohua@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Nico Pache <npache@redhat.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Wei Yang <richard.weiyang@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-11-15 10:52:01 -08:00
David Hildenbrand (Red Hat)
3470715e5c MAINTAINERS: update David Hildenbrand's email address
Switch to kernel.org email address as I will be leaving Red Hat.  The old
address will remain active until end of January 2026, so performing the
change now should make sure that most mails will reach me.

Link: https://lkml.kernel.org/r/20251103103659.379335-1-david@kernel.org
Signed-off-by: David Hildenbrand <david@redhat.com>
Signed-off-by: David Hildenbrand (Red Hat) <david@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-11-15 10:52:01 -08:00
Sourabh Jain
00fbff75c5 crash: fix crashkernel resource shrink
When crashkernel is configured with a high reservation, shrinking its
value below the low crashkernel reservation causes two issues:

1. Invalid crashkernel resource objects
2. Kernel crash if crashkernel shrinking is done twice

For example, with crashkernel=200M,high, the kernel reserves 200MB of high
memory and some default low memory (say 256MB).  The reservation appears
as:

cat /proc/iomem | grep -i crash
af000000-beffffff : Crash kernel
433000000-43f7fffff : Crash kernel

If crashkernel is then shrunk to 50MB (echo 52428800 >
/sys/kernel/kexec_crash_size), /proc/iomem still shows 256MB reserved:
af000000-beffffff : Crash kernel

Instead, it should show 50MB:
af000000-b21fffff : Crash kernel

Further shrinking crashkernel to 40MB causes a kernel crash with the
following trace (x86):

BUG: kernel NULL pointer dereference, address: 0000000000000038
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
<snip...>
Call Trace: <TASK>
? __die_body.cold+0x19/0x27
? page_fault_oops+0x15a/0x2f0
? search_module_extables+0x19/0x60
? search_bpf_extables+0x5f/0x80
? exc_page_fault+0x7e/0x180
? asm_exc_page_fault+0x26/0x30
? __release_resource+0xd/0xb0
release_resource+0x26/0x40
__crash_shrink_memory+0xe5/0x110
crash_shrink_memory+0x12a/0x190
kexec_crash_size_store+0x41/0x80
kernfs_fop_write_iter+0x141/0x1f0
vfs_write+0x294/0x460
ksys_write+0x6d/0xf0
<snip...>

This happens because __crash_shrink_memory()/kernel/crash_core.c
incorrectly updates the crashk_res resource object even when
crashk_low_res should be updated.

Fix this by ensuring the correct crashkernel resource object is updated
when shrinking crashkernel memory.

Link: https://lkml.kernel.org/r/20251101193741.289252-1-sourabhjain@linux.ibm.com
Fixes: 16c6006af4 ("kexec: enable kexec_crash_size to support two crash kernel regions")
Signed-off-by: Sourabh Jain <sourabhjain@linux.ibm.com>
Acked-by: Baoquan He <bhe@redhat.com>
Cc: Zhen Lei <thunder.leizhen@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-11-15 10:52:01 -08:00
David Hildenbrand (Red Hat)
39231e8d6b mm: fix MAX_FOLIO_ORDER on powerpc configs with hugetlb
In the past, CONFIG_ARCH_HAS_GIGANTIC_PAGE indicated that we support
runtime allocation of gigantic hugetlb folios.  In the meantime it evolved
into a generic way for the architecture to state that it supports gigantic
hugetlb folios.

In commit fae7d834c4 ("mm: add __dump_folio()") we started using
CONFIG_ARCH_HAS_GIGANTIC_PAGE to decide MAX_FOLIO_ORDER: whether we could
have folios larger than what the buddy can handle.  In the context of that
commit, we started using MAX_FOLIO_ORDER to detect page corruptions when
dumping tail pages of folios.  Before that commit, we assumed that we
cannot have folios larger than the highest buddy order, which was
obviously wrong.

In commit 7b4f21f5e0 ("mm/hugetlb: check for unreasonable folio sizes
when registering hstate"), we used MAX_FOLIO_ORDER to detect
inconsistencies, and in fact, we found some now.

Powerpc allows for configs that can allocate gigantic folio during boot
(not at runtime), that do not set CONFIG_ARCH_HAS_GIGANTIC_PAGE and can
exceed PUD_ORDER.

To fix it, let's make powerpc select CONFIG_ARCH_HAS_GIGANTIC_PAGE with
hugetlb on powerpc, and increase the maximum folio size with hugetlb to 16
GiB on 64bit (possible on arm64 and powerpc) and 1 GiB on 32 bit
(powerpc).  Note that on some powerpc configurations, whether we actually
have gigantic pages depends on the setting of CONFIG_ARCH_FORCE_MAX_ORDER,
but there is nothing really problematic about setting it unconditionally:
we just try to keep the value small so we can better detect problems in
__dump_folio() and inconsistencies around the expected largest folio in
the system.

Ideally, we'd have a better way to obtain the maximum hugetlb folio size
and detect ourselves whether we really end up with gigantic folios.  Let's
defer bigger changes and fix the warnings first.

While at it, handle gigantic DAX folios more clearly: DAX can only end up
creating gigantic folios with HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD.

Add a new Kconfig option HAVE_GIGANTIC_FOLIOS to make both cases clearer. 
In particular, worry about ARCH_HAS_GIGANTIC_PAGE only with HUGETLB_PAGE.

Note: with enabling CONFIG_ARCH_HAS_GIGANTIC_PAGE on powerpc, we will now
also allow for runtime allocations of folios in some more powerpc configs.
I don't think this is a problem, but if it is we could handle it through
__HAVE_ARCH_GIGANTIC_PAGE_RUNTIME_SUPPORTED.

While __dump_page()/__dump_folio was also problematic (not handling
dumping of tail pages of such gigantic folios correctly), it doesn't seem
critical enough to mark it as a fix.

Link: https://lkml.kernel.org/r/20251114214920.2550676-1-david@kernel.org
Fixes: 7b4f21f5e0 ("mm/hugetlb: check for unreasonable folio sizes when registering hstate")
Reported-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Closes: https://lore.kernel.org/r/3e043453-3f27-48ad-b987-cc39f523060a@csgroup.eu/
Reported-by: Sourabh Jain <sourabhjain@linux.ibm.com>
Closes: https://lore.kernel.org/r/94377f5c-d4f0-4c0f-b0f6-5bf1cd7305b1@linux.ibm.com/
Signed-off-by: David Hildenbrand (Red Hat) <david@kernel.org>
Cc: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
Cc: Donet Tom <donettom@linux.ibm.com>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Christophe Leroy <christophe.leroy@csgroup.eu>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: "Liam R. Howlett" <Liam.Howlett@oracle.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-11-15 10:52:00 -08:00
Linus Torvalds
f824272b6e s390 fixes for 6.18-rc6
- Fix a bug in the __ptep_rdp() inline assembly which may lead to
   missing TLB flushes
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEECMNfWEw3SLnmiLkZIg7DeRspbsIFAmkYpckACgkQIg7DeRsp
 bsI0mg/+NMbrwwaj5G9nJuBxGuvWjXkQJalYxd/uLZIG5ErzpCitoLyBNgCWx3Ec
 wDR2W3tWeTtzRB1aXBN3ZZuYn2ADwe5jR/YMqqR5IT9XBoYsbxgRHnKaS4yD5D1i
 4UPdhkrZ8Kuw9+tnAepohYr4K29qCBQ1v3rH1O7RwfQ/ZccxgxS6KRlCrwAc2yx5
 d7r18q32fljg0uwaJB3vWjH35b8XG2XGALRRyF5uW4HjGrNje38d8eHRNbQ6aO12
 Mrf7Pj5WV68bTMQOP5gV2uQHv9oG8UiAnvGREBQXqAONGnqXKy4xHf+NHI0QT97Y
 lco7DyCaTCVjw9J6KZk7uHRwE12kcJPdDuU40csq3XOOL8jU2lC+G31fXf0gnW+N
 QKYNRQnN2F8oKwxhccnuGgrMEEengO77jfgfEtoVZM3uK9OeLAGX77M3koNTorgj
 BCTZEYlOPN1Ql6xGVJpB0ZyhtPBqd1lVE55SvRwGDFNZGtm/seMMj3ELrt+VNwgG
 bICeY8Tv8+5yji+icZPJSh76mvjw7uuksNYQQpqMp5idjtGkigEO4PiP1PZtKc6Y
 FZPldwzXue5Y5P0SiOjPRk/qgxeXFEtlYrWXuKybQWOfSWjwiTyJ0fZdPss2nMf7
 3lBN1GfPxH54OBkmNPrNkIBbrYxypcY65FVro7r3p4PGj7vPGlA=
 =5CBh
 -----END PGP SIGNATURE-----

Merge tag 's390-6.18-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux

Pull s390 fix from Heiko Carstens:

 - Fix a bug in the __ptep_rdp() inline assembly which may lead to
   missing TLB flushes

* tag 's390-6.18-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/mm: Fix __ptep_rdp() inline assembly
2025-11-15 09:01:00 -08:00
Linus Torvalds
b8a2c32b22 Miscellaneous fixes:
- Update the list of AMD microcode minimum Entrysign revisions
 
  - Add additional fixed AMD RDSEED microcode revisions
 
  - Update the language transliteration for Kiryl Shutsemau's
    name in the MAINTAINERS entry
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmkYRacRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1iM3BAArKOmHR83umO4nz9/zs0EsuSTeYJubx9C
 1lYsFBwe/Yu8qE9ALAkxOiSsah8g5uw+eAjNoyn3XoyEa879w6lBbc/AhbECCLD7
 ZELNeuSf54Z8BkSSFXrYop2+Zdi1fKGcUxI1ZBf4qFTdhdsBcST1BgRqi5piUORY
 UajSaOKf5UluzW1Yvi75GuNuDiVqWRieu37lNH4JFl21yqKvjPE8N6Vd1T2PtZCD
 ZYM2oUsoMZZYxnlSFcA3KRoMaeQ0dUufQ7jXvlB5+WwSAO0dzQScH2a5UVjPatG8
 9gT9IQPsUxJZsnUWjsSOeU2Z2ALEVeKFkTTTp7kn18aFAtI4vXDYS77SjxInpkgf
 P7goWDVNKR6oLJR7wIVNnfBWwgR9WBtgPXyu4DVIghPx0k47p+fvBcZaeMFoD44E
 GD7NjYmq9Qr2GauOAgGY9v7flZO3AyUJOiTyBVEjTphGIKCcWhKwRmak78n/nu2+
 j/OLwQdjlCBVMU46Uo/XbziiCQJ2WxyJlu4+nxIhp93sCl81EhMeiyOsRE4LH5Vu
 Do+XPCf9ARRa+fEao19UrNjJLg4Lj+gY6OvMx5cvgDXLyZU46OuKSAVXqWbmIAnH
 vOOH9OzyLTn1lPXdS6ih7xIbD8PJbXrJK4GZE5EKQEfgECEjOeTnDX1cg5zZqD7V
 8XIwafes3Ik=
 =r/gL
 -----END PGP SIGNATURE-----

Merge tag 'x86-urgent-2025-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86 fixes from Ingo Molnar:

 - Update the list of AMD microcode minimum Entrysign revisions

 - Add additional fixed AMD RDSEED microcode revisions

 - Update the language transliteration for Kiryl Shutsemau's name
   in the MAINTAINERS entry

* tag 'x86-urgent-2025-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/microcode/AMD: Add Zen5 model 0x44, stepping 0x1 minrev
  x86/CPU/AMD: Add additional fixed RDSEED microcode revisions
  MAINTAINERS: Update name spelling
2025-11-15 08:55:29 -08:00
Linus Torvalds
bb1a6ddcfa Fix a memory leak in the posix timer creation logic.
Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmkYQ4URHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1gwPhAAuwspuw4ODgk3qpEcYzK8AypsARxD5dC9
 Dzm+kcWLOk2hDGCQIRnxm7HVE1/wogprmtr8OUorqvOzKXAxl+4Wi+Pwof3i7TRY
 8qKAJBcapFOx5wi6h6CTpfHkWRPtfV4F4FG/bJuqHUAOKWjYdTZt+Vlod4jrDteM
 ySYxmIdBMiAzRGp3VJwjoSIA0FxssqyCGgwwBBp8a9sncdvGHvLKKM3Vdr18LgOH
 Tdtq32n2x09FgyFsffkc7gGTvmMhP4Ln5vQBltuMNXWcQoOv85tTCCLXzHyfQvYk
 OGhyq6OALJIX9xqqQoxZBAf3gil6F7fLrUZrgIgeZw1FWeMqtqvdUk22H9o5Vm7u
 FKbX4imDApDRlFhFAz0SSJWHGrggJ9cKR5BON6Rk0BpF+6koGeJlhjs7rCvHX33X
 7qdiRLsi9Fu79lo+nEJC+EbvghhpNeQG38uqty+3VU1c/LDM5Hv50EJz5G7AgL1t
 akKvSEIRixLjT5FtPp9jdecjh17F//Nm0M/zG44cxof46jF8cGzVyPdkFrBMY2mG
 FEJwAsFqiiFNfrC27gC08KFowuKJbiwEfOZYFCj3BtBZGgPKv/uh5zO+4ZtNRdLW
 Fy9ykQ7hL0JH2qekK1mdbhenjbrxORqSBiPztv7ziMkkd4pRs2cmVrz+8gnNoOmi
 7in63SMSjWw=
 =fTUR
 -----END PGP SIGNATURE-----

Merge tag 'timers-urgent-2025-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull timer fix from Ingo Molnar:
 "Fix a memory leak in the posix timer creation logic"

* tag 'timers-urgent-2025-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  posix-timers: Plug potential memory leak in do_timer_create()
2025-11-15 08:51:43 -08:00
Linus Torvalds
fa3ade5e8e Fix an irqchip driver release bug in the riscv-intc irqchip driver.
Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmkYQt8RHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1gZghAAnWBR9hoRHQN+TBd8JufF5R2vebxJZNjB
 Ht9nYV6lleEDFkBMIkFDoCCynqyIreR98NdFE/40tz7srObwYloNEGqscyXG/1yF
 m/bmLN2ngZ85CRLlqWANgXjqZpJcE37bIxnb+bTcrdfgpk2afUfgV3skPkpj+JWX
 5kqk5JsFMjRAnwGBreSzmB0tTAjTLjzulCn1IZR0m2EbaJpomxjfHZ8zQmZmucVL
 klJE7gJNjgDv2aNho9zKz5mIS3C4Yb9EEZq/YGWSQ/0X3IUKzFZxQ2P5FqZdUxSo
 HI4IBsbPCcm0GbiKdMPE21fxIUKD78F+uXQISIniM9dW6I9dmuCV5H8duMxT+Yoq
 ec8UHy1Su5kY4LKeTd+IKokkeT9GiLo9u3I74/wSrV1rMFRdv7XivslEWtUTQaWn
 /ARu0C27BRg+OrqVBymj3+MCcub3UeIc+nNoFkI0gCvNUxGOw7tsTy3Oi31MLlwx
 967tF/DtVYEzhiHm6GMyqekfBGapV9CTusZzyYCHJ0AQ3d3skzP1g8gnI+DMm8yA
 ZGgM1fkzeGQgGfJ5rrKeVFOXCZdYRBp5ljQT4LHDZgwoDbpi+/F86sqZ3ZHfoL3h
 RnLKJ3Icvy1QpedNE0G/3D7Yawi+WvYYs6oAwKc/vFFNVPIHdbYixZY/s+3roe5a
 nucem7bRO5w=
 =XvbG
 -----END PGP SIGNATURE-----

Merge tag 'irq-urgent-2025-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull irq fix from Ingo Molnar:
 "Fix an irqchip driver release bug in the riscv-intc irqchip driver"

* tag 'irq-urgent-2025-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  irqchip/riscv-intc: Add missing free() callback in riscv_intc_domain_ops
2025-11-15 08:48:51 -08:00
Linus Torvalds
e256f7b4e5 Fix a broken #ifndef in the <linux/entry-virt.h> header, which
hasn't caused problems upstream yet because no arch overrides
 arch_xfer_to_guest_mode_handle_work() at this moment.
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmkYQbERHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1jEUQ/8CUp5lWXbahK69XGn4ZPMRvdgxE4qnci+
 YTCvoQYsQUheBhDZ08QWujj5DgSErJi+3KD6oRbvYBDStS5u711LdvSOg+Kr6ql7
 1ATSegZnEz6M/ntAlcYmcLkQtAKbl3nrODfRfU9ZBDQFHwd+BYgMUzOJ8W73O3tA
 AiqXxlOTzykk9pDG/fxH6PMHQlKAf3uOBR8rG+NzLhsEF+WZFXoloQ+HGEgSvrnq
 oRPiSdNLeb007vDr+qprnXapmuTziTbcE+BUZ1FD1ze7rFLmH2pFiyuqKTlL1gDH
 nfRIIrVG8uLEzTTtu+U5oM/J9a0sHA0QaI8XJa2gOGhb2nOKcv2CfhxJ9HHRqrZv
 IfolXsRIdVXmVmPX4ksXg2q1H7fSuqpz4220WhQqe3CKoimOsTQ7t6F7gt7B8pnU
 6BKjlAA9aPBpRSQh/WWmkRsQsaaCy9ni3xFwNaUDoPOqbIxlZL1u0dLjTwHYcIvB
 +BSyvYx/70qNPgF4ounp7/jWQ/hG+U4JbogXLKWAD9pqUsR9n97S1/Z00gUEl8Ka
 oyLrOrq/NlS/ytBc/GgjMk/qq2hdGaQ1ztJc9lQGCfZvLtRGUh0pAhoopanTg56q
 zs3/lTADRANLsD+0f9pWY66zOFKt8fF8h0fO8lXVMp3aQ/PVeDwxpcYwbN7vh4Q8
 23Vfh+aOsTA=
 =7by8
 -----END PGP SIGNATURE-----

Merge tag 'core-urgent-2025-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull core fix from Ingo Molnar:
 "Fix a broken #ifndef in the <linux/entry-virt.h> header.

  It hasn't caused problems upstream yet because no arch overrides
  arch_xfer_to_guest_mode_handle_work() at this moment"

* tag 'core-urgent-2025-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  entry: Fix ifndef around arch_xfer_to_guest_mode_handle_work() stub
2025-11-15 08:46:18 -08:00
Jesper Dangaard Brouer
5442a9da69 veth: more robust handing of race to avoid txq getting stuck
Commit dc82a33297 ("veth: apply qdisc backpressure on full ptr_ring to
reduce TX drops") introduced a race condition that can lead to a permanently
stalled TXQ. This was observed in production on ARM64 systems (Ampere Altra
Max).

The race occurs in veth_xmit(). The producer observes a full ptr_ring and
stops the queue (netif_tx_stop_queue()). The subsequent conditional logic,
intended to re-wake the queue if the consumer had just emptied it (if
(__ptr_ring_empty(...)) netif_tx_wake_queue()), can fail. This leads to a
"lost wakeup" where the TXQ remains stopped (QUEUE_STATE_DRV_XOFF) and
traffic halts.

This failure is caused by an incorrect use of the __ptr_ring_empty() API
from the producer side. As noted in kernel comments, this check is not
guaranteed to be correct if a consumer is operating on another CPU. The
empty test is based on ptr_ring->consumer_head, making it reliable only for
the consumer. Using this check from the producer side is fundamentally racy.

This patch fixes the race by adopting the more robust logic from an earlier
version V4 of the patchset, which always flushed the peer:

(1) In veth_xmit(), the racy conditional wake-up logic and its memory barrier
are removed. Instead, after stopping the queue, we unconditionally call
__veth_xdp_flush(rq). This guarantees that the NAPI consumer is scheduled,
making it solely responsible for re-waking the TXQ.
  This handles the race where veth_poll() consumes all packets and completes
NAPI *before* veth_xmit() on the producer side has called netif_tx_stop_queue.
The __veth_xdp_flush(rq) will observe rx_notify_masked is false and schedule
NAPI.

(2) On the consumer side, the logic for waking the peer TXQ is moved out of
veth_xdp_rcv() and placed at the end of the veth_poll() function. This
placement is part of fixing the race, as the netif_tx_queue_stopped() check
must occur after rx_notify_masked is potentially set to false during NAPI
completion.
  This handles the race where veth_poll() consumes all packets, but haven't
finished (rx_notify_masked is still true). The producer veth_xmit() stops the
TXQ and __veth_xdp_flush(rq) will observe rx_notify_masked is true, meaning
not starting NAPI.  Then veth_poll() change rx_notify_masked to false and
stops NAPI.  Before exiting veth_poll() will observe TXQ is stopped and wake
it up.

Fixes: dc82a33297 ("veth: apply qdisc backpressure on full ptr_ring to reduce TX drops")
Reviewed-by: Toshiaki Makita <toshiaki.makita1@gmail.com>
Signed-off-by: Jesper Dangaard Brouer <hawk@kernel.org>
Link: https://patch.msgid.link/176295323282.307447.14790015927673763094.stgit@firesoul
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-11-14 18:16:53 -08:00
Ilya Maximets
dfe28c4167 net: openvswitch: remove never-working support for setting nsh fields
The validation of the set(nsh(...)) action is completely wrong.
It runs through the nsh_key_put_from_nlattr() function that is the
same function that validates NSH keys for the flow match and the
push_nsh() action.  However, the set(nsh(...)) has a very different
memory layout.  Nested attributes in there are doubled in size in
case of the masked set().  That makes proper validation impossible.

There is also confusion in the code between the 'masked' flag, that
says that the nested attributes are doubled in size containing both
the value and the mask, and the 'is_mask' that says that the value
we're parsing is the mask.  This is causing kernel crash on trying to
write into mask part of the match with SW_FLOW_KEY_PUT() during
validation, while validate_nsh() doesn't allocate any memory for it:

  BUG: kernel NULL pointer dereference, address: 0000000000000018
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  PGD 1c2383067 P4D 1c2383067 PUD 20b703067 PMD 0
  Oops: Oops: 0000 [#1] SMP NOPTI
  CPU: 8 UID: 0 Kdump: loaded Not tainted 6.17.0-rc4+ #107 PREEMPT(voluntary)
  RIP: 0010:nsh_key_put_from_nlattr+0x19d/0x610 [openvswitch]
  Call Trace:
   <TASK>
   validate_nsh+0x60/0x90 [openvswitch]
   validate_set.constprop.0+0x270/0x3c0 [openvswitch]
   __ovs_nla_copy_actions+0x477/0x860 [openvswitch]
   ovs_nla_copy_actions+0x8d/0x100 [openvswitch]
   ovs_packet_cmd_execute+0x1cc/0x310 [openvswitch]
   genl_family_rcv_msg_doit+0xdb/0x130
   genl_family_rcv_msg+0x14b/0x220
   genl_rcv_msg+0x47/0xa0
   netlink_rcv_skb+0x53/0x100
   genl_rcv+0x24/0x40
   netlink_unicast+0x280/0x3b0
   netlink_sendmsg+0x1f7/0x430
   ____sys_sendmsg+0x36b/0x3a0
   ___sys_sendmsg+0x87/0xd0
   __sys_sendmsg+0x6d/0xd0
   do_syscall_64+0x7b/0x2c0
   entry_SYSCALL_64_after_hwframe+0x76/0x7e

The third issue with this process is that while trying to convert
the non-masked set into masked one, validate_set() copies and doubles
the size of the OVS_KEY_ATTR_NSH as if it didn't have any nested
attributes.  It should be copying each nested attribute and doubling
them in size independently.  And the process must be properly reversed
during the conversion back from masked to a non-masked variant during
the flow dump.

In the end, the only two outcomes of trying to use this action are
either validation failure or a kernel crash.  And if somehow someone
manages to install a flow with such an action, it will most definitely
not do what it is supposed to, since all the keys and the masks are
mixed up.

Fixing all the issues is a complex task as it requires re-writing
most of the validation code.

Given that and the fact that this functionality never worked since
introduction, let's just remove it altogether.  It's better to
re-introduce it later with a proper implementation instead of trying
to fix it in stable releases.

Fixes: b2d0f5d5dc ("openvswitch: enable NSH support")
Reported-by: Junvy Yang <zhuque@tencent.com>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
Acked-by: Eelco Chaudron <echaudro@redhat.com>
Reviewed-by: Aaron Conole <aconole@redhat.com>
Link: https://patch.msgid.link/20251112112246.95064-1-i.maximets@ovn.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-11-14 18:13:24 -08:00
Eric Dumazet
035bca3f01 mptcp: fix race condition in mptcp_schedule_work()
syzbot reported use-after-free in mptcp_schedule_work() [1]

Issue here is that mptcp_schedule_work() schedules a work,
then gets a refcount on sk->sk_refcnt if the work was scheduled.
This refcount will be released by mptcp_worker().

[A] if (schedule_work(...)) {
[B]     sock_hold(sk);
        return true;
    }

Problem is that mptcp_worker() can run immediately and complete before [B]

We need instead :

    sock_hold(sk);
    if (schedule_work(...))
        return true;
    sock_put(sk);

[1]
refcount_t: addition on 0; use-after-free.
 WARNING: CPU: 1 PID: 29 at lib/refcount.c:25 refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:25
Call Trace:
 <TASK>
 __refcount_add include/linux/refcount.h:-1 [inline]
  __refcount_inc include/linux/refcount.h:366 [inline]
  refcount_inc include/linux/refcount.h:383 [inline]
  sock_hold include/net/sock.h:816 [inline]
  mptcp_schedule_work+0x164/0x1a0 net/mptcp/protocol.c:943
  mptcp_tout_timer+0x21/0xa0 net/mptcp/protocol.c:2316
  call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747
  expire_timers kernel/time/timer.c:1798 [inline]
  __run_timers kernel/time/timer.c:2372 [inline]
  __run_timer_base+0x648/0x970 kernel/time/timer.c:2384
  run_timer_base kernel/time/timer.c:2393 [inline]
  run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403
  handle_softirqs+0x22f/0x710 kernel/softirq.c:622
  __do_softirq kernel/softirq.c:656 [inline]
  run_ktimerd+0xcf/0x190 kernel/softirq.c:1138
  smpboot_thread_fn+0x542/0xa60 kernel/smpboot.c:160
  kthread+0x711/0x8a0 kernel/kthread.c:463
  ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Cc: stable@vger.kernel.org
Fixes: 3b1d6210a9 ("mptcp: implement and use MPTCP-level retransmission")
Reported-by: syzbot+355158e7e301548a1424@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6915b46f.050a0220.3565dc.0028.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251113103924.3737425-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-11-14 18:12:35 -08:00
Pavel Zhigulin
b0c959fec1 net: mlxsw: linecards: fix missing error check in mlxsw_linecard_devlink_info_get()
The call to devlink_info_version_fixed_put() in
mlxsw_linecard_devlink_info_get() did not check for errors,
although it is checked everywhere in the code.

Add missed 'err' check to the mlxsw_linecard_devlink_info_get()

Fixes: 3fc0c51905 ("mlxsw: core_linecards: Expose device PSID over device info")
Signed-off-by: Pavel Zhigulin <Pavel.Zhigulin@kaspersky.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20251113161922.813828-1-Pavel.Zhigulin@kaspersky.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-11-14 18:01:32 -08:00
Pavel Zhigulin
e6751b0b19 net: dsa: hellcreek: fix missing error handling in LED registration
The LED setup routine registered both led_sync_good
and led_is_gm devices without checking the return
values of led_classdev_register(). If either registration
failed, the function continued silently, leaving the
driver in a partially-initialized state and leaking
a registered LED classdev.

Add proper error handling

Fixes: 7d9ee2e8ff ("net: dsa: hellcreek: Add PTP status LEDs")
Signed-off-by: Pavel Zhigulin <Pavel.Zhigulin@kaspersky.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Acked-by: Kurt Kanzenbach <kurt@linutronix.de>
Link: https://patch.msgid.link/20251113135745.92375-1-Pavel.Zhigulin@kaspersky.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-11-14 17:46:32 -08:00
Linus Torvalds
7a0892d283 pci-v6.18-fixes-5
-----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCgAyFiEEgMe7l+5h9hnxdsnuWYigwDrT+vwFAmkXokcUHGJoZWxnYWFz
 QGdvb2dsZS5jb20ACgkQWYigwDrT+vyejw/8CN4kM8PROTw3p6QBJQF6am5uPCA4
 nQans+groD/XJXJd7T4aqwuvLXvIrrEd3K+PegBLiGgk3Wgw9fq5pEWDafUH8IAv
 LG5g462aHyrHPMV8XI6lIrDLD7PCltmpoIu22Xkri4l4gkca7Ros/4Q5gU+AgtCz
 LtsO9UmcK0PaR95NCdYFf2VZ1PsdZu/ezTb90S1xT5gty9uwpxCmHje5gg07MXXO
 12i/SNczU9gFYo8P6XMeD7q0Ixwt7JLC+xa1iBlBEODvcPkyf8Al2dIkxWlnrwGn
 kxi4K/PKM4f7ZhtyTHh/G8EiFYh/QwbHGvnCBj5XQAKOLWkjZCn8l5MxqGAKKvnz
 Dem3/MFwJQ79+y/vrseg5beBiLPahd5fsAITOFIxmQZsEjvL+B8fhU52QBkLVFUw
 iJg7PJXHJ9Jy/NRGT/rinu9mi2K+z1baZHZm11QK5khTTbYAs+qsvwWck9Jcr004
 OEsQGngomUv09WjHv0/26dJzVI5wpnn+C+DFAximlIMZnTaQguN/WNplYYyXBRzB
 T09qK1ZzpJM6QEU5i2ZForGpFtKSbGHwJrC6DYjLiVV3P4EzpHWSmTy2dqM7GUNa
 Wrvaxy3j/MT2kudfyIs10Qwu1EJ+rHYb/QfS3pqlggSDic9WFg9P4uUlFR1YUKPb
 h+Peip6NV/tQNHI=
 =2eqF
 -----END PGP SIGNATURE-----

Merge tag 'pci-v6.18-fixes-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci

Pull pci fixes from Bjorn Helgaas:

 - Cache the ASPM L0s/L1 Supported bits early so quirks can override
   them if necessary (Bjorn Helgaas)

 - Add quirks for PA Semi and Freescale Root Ports and a HiSilicon Wi-Fi
   device that are reported to have broken L0s and L1 (Shawn Lin, Bjorn
   Helgaas)

* tag 'pci-v6.18-fixes-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:
  PCI/ASPM: Avoid L0s and L1 on Hi1105 [19e5:1105] Wi-Fi
  PCI/ASPM: Avoid L0s and L1 on PA Semi [1959:a002] Root Ports
  PCI/ASPM: Avoid L0s and L1 on Freescale [1957:0451] Root Ports
  PCI/ASPM: Convert quirks to override advertised link states
  PCI/ASPM: Add pcie_aspm_remove_cap() to override advertised link states
  PCI/ASPM: Cache L0s/L1 Supported so advertised link states can be overridden
2025-11-14 15:45:31 -08:00
Linus Torvalds
cbba5d1b53 bpf-fixes
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE+soXsSLHKoYyzcli6rmadz2vbToFAmkXpZUACgkQ6rmadz2v
 bTrGCw//UCx+KBXbzvv7m0A1QGOUL3oHL/Qd+OJA3RW3B+saVbYYzn9jjl0SRgFP
 X0q/DwbDOjFtOSORV9oFgJkrucn7+BM/yxPaC4sE1SQZJAjDFA/CSaF0r8duuGsM
 Mvat9TTiwwetOMAkNB9WZ1e6AKGovBLguLFGAWZc6vLeQZopcER5+pFwS44a9RrK
 dq0Th8O/oY3VmUDgSKJ2KyY51KxpJU7k2ipifiIbu1M1MWZ7s2vERkMEkzJ/lB8/
 nldMsTZUdknGFzVH/W6Rc9ScFYlH+h/x1gkOHwTibMsqDBm92mWVo6O7hvuUbsEO
 NlPDgMtkhBp7PDSx9SA0UBcriMs1M6ovNBOpj/cI4AL1k8WNubf/FHZtrBwoy8C9
 3HaM+8lkA2uiHVPUvT5dImzWqshweN0GXoXAoa9xPSQPchJ38UdzCHqYRAg/kWFZ
 5jUK2j4e5+yyII44pD7Xti0PrfoP81giliqmTbGFV8+Y89dQnk+WK12vnbv34ER7
 unLwId8HLtq0ZN7FVG4F6s/4qNdEMKqXbAkve0WWFXn4vKZMCju4ol6NYVGisRAg
 zcn7Yk+weSuY3UOzC+/4SxhfTEAD0Kg6fUoG/1JdflgNsm8XhLBja0DZaAlIVO0p
 xz5UaljwcNvjAKGGMYbCGrf3XN2tOmGpVyJkMj17Vcq88y3bJBU=
 =JJui
 -----END PGP SIGNATURE-----

Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Pull bpf fixes from Alexei Starovoitov:

 - Fix interaction between livepatch and BPF fexit programs (Song Liu)
   With Steven and Masami acks.

 - Fix stack ORC unwind from BPF kprobe_multi (Jiri Olsa)
   With Steven and Masami acks.

 - Fix out of bounds access in widen_imprecise_scalars() in the verifier
   (Eduard Zingerman)

 - Fix conflicts between MPTCP and BPF sockmap (Jiayuan Chen)

 - Fix net_sched storage collision with BPF data_meta/data_end (Eric
   Dumazet)

 - Add _impl suffix to BPF kfuncs with implicit args to avoid breaking
   them in bpf-next when KF_IMPLICIT_ARGS is added (Mykyta Yatsenko)

* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
  selftests/bpf: Test widen_imprecise_scalars() with different stack depth
  bpf: account for current allocated stack depth in widen_imprecise_scalars()
  bpf: Add bpf_prog_run_data_pointers()
  selftests/bpf: Add mptcp test with sockmap
  mptcp: Fix proto fallback detection with BPF
  mptcp: Disallow MPTCP subflows from sockmap
  selftests/bpf: Add stacktrace ips test for raw_tp
  selftests/bpf: Add stacktrace ips test for kprobe_multi/kretprobe_multi
  x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe
  Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()"
  bpf: add _impl suffix for bpf_stream_vprintk() kfunc
  bpf:add _impl suffix for bpf_task_work_schedule* kfuncs
  selftests/bpf: Add tests for livepatch + bpf trampoline
  ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct()
  ftrace: Fix BPF fexit with livepatch
2025-11-14 15:39:39 -08:00
Linus Torvalds
a752782a28 Rust fixes for v6.18 (2nd)
Toolchain and infrastructure:
 
   - Fix a Rust 1.91.0 build issue due to 'bindings.o' not containing
     DWARF debug information anymore by teaching gendwarfksyms to skip
     object files without exports.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEPjU5OPd5QIZ9jqqOGXyLc2htIW0FAmkXorAACgkQGXyLc2ht
 IW3fIw/+IKI2iM5bbyQ9WbS3GDtUzSBxu/4OXL25UarD/vEA3xAo2XeHlpBnwhZ6
 wK439HSqtKNF3iMMVUZO0A81YnBVPCUE6y3QKvRWbNj4X0s+fb8/TNnSKIsjSIiV
 j3Wf2d/ssXfPGknKhzHIMWY2YxhS+QjX31oPbnDPeXw0tomL9wb8xl/xeWlARKYQ
 R3YhE9FLBtaVNVGEKwL4QY4GpubZ098sQo5wkL9MuqcB79A34X5hXoNj9A2vAWhx
 iLHCwIcmcyNNcFzfwy9L9xScal63E+FPENIx5gtVaxV5NsUuis/7CRcDAl8WPXVz
 G60fC1c42stho/Tv/Ymt55vqYjdbgyCyQg68vQIvcMofyU5zQocm1+5re9JaVj7G
 r/QJ6eL9sRON7ym//FZirk352ttwad2T4yhUmG933iVAjDoZAvBBw4ocX2LpdHxq
 1b7PzDCpTl+eFbUc2vTfx33OsnE7gj5vJeSvMmcrlxFbEd1GLb9PEBcBdF6OR77L
 +H6aWbkJ53dsji8veL/9UkhNJAGLEJyfNnaOtjgWA2XthyHAz2U6GSR176KY4fFK
 pEsImpLyTJKd5mlwYaZwhDEVa+kdz8RCNxY1k8BDSFRk8gvDNlAioCqcddRdqoOt
 0BTTlYEMzHz78FeGth33w+eYCT8tp1fHiovWReD3TJcgVuJjpE8=
 =FPGX
 -----END PGP SIGNATURE-----

Merge tag 'rust-fixes-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux

Pull Rust fix from Miguel Ojeda:

 - Fix a Rust 1.91.0 build issue due to 'bindings.o' not containing
   DWARF debug information anymore by teaching gendwarfksyms to skip
   object files without exports

* tag 'rust-fixes-6.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:
  gendwarfksyms: Skip files with no exports
2025-11-14 15:36:15 -08:00
Linus Torvalds
1cc41c88ef More NFS Client Bugfixes for Linux 6.18-rc
Bugfixes:
  * Various fixes when using NFS with TLS
  * Localio direct-IO fixes
  * Fix error handling in nfs_atomic_open_v23()
  * Fix sysfs memory leak when nfs_client kobject add fails
  * Fix an incorrect parameter when calling nfs4_call_sync()
  * Fix a failing LTP test when using delegated timestamps
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEnZ5MQTpR7cLU7KEp18tUv7ClQOsFAmkXmqIACgkQ18tUv7Cl
 QOsdlg/8CgomAZvepcW9e5H/bXi0x3Q4gUTcXWV49/oqwfnpVJ1C0Xanx1zdtY6P
 QhchYwHv1r989IEJWaeO4U/ppCei8LoOSq2dkb1TzWohZuUbIg44KnpPtcbkXTgy
 cDcGZu3PNLtvwodljDOtaF4ZVLaWl0MwTYnp0I4xQJc12InHUQ9TPPCSOBb262nN
 BeFPRguhQXZl1jUOv/F0SE/bEcoAnNX8MnbXMaIN3aHy2d9Vq5m4IpJCgyeXQwle
 KvEE6hAmJGm3rG+wpkz7x56KOn7k/K/Py772T7qzEADLcr4Qmusi1++ffnxikVIc
 F9EElTw5pgAvdTuKr+sVw+gktaYWu0LeTFbcIK9dwC5N+uksb7l/TcP9cmhA6lxE
 7KVVmYZGzPV8rwDIztoO8qPSePQTaJB8P3mQmZ8XVd1bz75BQ1zi4SSz578kl84E
 YMHVLHBHiR/chA1z1YSrh8fV8inOiijwrjXU3Oa/blaRhhaH1AvEFboMbn7FyW17
 GjmtL2rfC+hg+kWuvflJiK/zlVJOSNyZBNoD3iQaHq/D4vwXqVETETZnT8002kwL
 sWVFmHdv1Y0fF3K/VsB8QFVhW46K6urJlKU694bWVzo9aK2pX7oj+ElcyXqyFv/p
 Hq1sxe4KPlsVPoG/ClVvtH2a56vNRTOO0LySUN/ZAfUruLQeVv8=
 =7pf4
 -----END PGP SIGNATURE-----

Merge tag 'nfs-for-6.18-3' of git://git.linux-nfs.org/projects/anna/linux-nfs

Pull NFS client fixes from Anna Schumaker:

 - Various fixes when using NFS with TLS

 - Localio direct-IO fixes

 - Fix error handling in nfs_atomic_open_v23()

 - Fix sysfs memory leak when nfs_client kobject add fails

 - Fix an incorrect parameter when calling nfs4_call_sync()

 - Fix a failing LTP test when using delegated timestamps

* tag 'nfs-for-6.18-3' of git://git.linux-nfs.org/projects/anna/linux-nfs:
  NFS: Fix LTP test failures when timestamps are delegated
  NFSv4: Fix an incorrect parameter when calling nfs4_call_sync()
  NFS: sysfs: fix leak when nfs_client kobject add fails
  NFSv2/v3: Fix error handling in nfs_atomic_open_v23()
  nfs/localio: do not issue misaligned DIO out-of-order
  nfs/localio: Ensure DIO WRITE's IO on stable storage upon completion
  nfs/localio: backfill missing partial read support for misaligned DIO
  nfs/localio: add refcounting for each iocb IO associated with NFS pgio header
  nfs/localio: remove unecessary ENOTBLK handling in DIO WRITE support
  NFS: Check the TLS certificate fields in nfs_match_client()
  pnfs: Set transport security policy to RPC_XPRTSEC_NONE unless using TLS
  pnfs: Fix TLS logic in _nfs4_pnfs_v4_ds_connect()
  pnfs: Fix TLS logic in _nfs4_pnfs_v3_ds_connect()
2025-11-14 13:44:23 -08:00
Linus Torvalds
d5c1b4b432 drm fixes for 6.18-rc6
client:
 - Fix description of module parameter
 
 panthor:
 - Flush writes before mapping buffers
 
 vmwgfx:
 - Improve command validation
 - Improve ref counting
 - Fix cursor-plane support
 
 amdgpu:
 - Disallow P2P DMA for GC 12 DCC surfaces
 - ctx error handling fix
 - UserQ fixes
 - VRR fix
 - ISP fix
 - JPEG 5.0.1 fix
 
 amdkfd:
 - Save area check fix
 - Fix GPU mappings for APU after prefetch
 
 i915:
 - Fix PSR's pipe to vblank conversion
 - Disable Panel Replay on MST links
 
 xe:
 - New HW workarounds affecting PTL and WCL platforms
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmkXkdEACgkQDHTzWXnE
 hr5npQ//exMOLUD1T7V4e8uGn5SZKrJGh2Q/6rfC3Kf8+rjlNVXtAh6fxGZlOyOz
 qA4Z4d6Cvy6t96PyVohjQMW5WVl6AtCyPljaXf+EDx1jihtGY2dGI6ccMrkitEX4
 GuEO2EtiI9VA6vtr7/GWwUcQiUJrGmFYVhGhy8JzRGnZZMsJjCn2KFJ7jB6NN/BR
 PfIj2f23KfWW4wCNrt8uZ6s6SLcXvGUVxD7SZb12Ze3zg2OL3iZsypRKsFwstF0o
 dZBsCdea0LkmDCVpSWxIvltBP4vfoPhRlm9LC/Vy2iJoa2ALQ7w+xWO0CPpgOvgY
 guj765FHUsKWBv0lyaFj86NrXOTrY1CRQ9toNaIp7vKgH5zmOaS8O8+Ganr34yGc
 A75qn1+jBNC4YUV/99KW9mola7wraGDYi96MBSWtHg7fZTDraclca+WUUHK+gI6s
 Vu4uUD1rWOkDO6gzJOXxrMwVy/+/S/qUS9CCojg/u1YYw2xg1lVP8yVyq8/oPXR1
 t5qgJZweCXJ5Ev4dygVEl4VOZUQnbe+5QDO3euRFM1r19vhlb2jwcE0WW2BQjRK0
 Hl3P5Lk9IVmdEd7ew+xgCqgwPkccP5lYzM/ygRw4oNO+u/TcIzEcsYucsYLc7WRU
 bwlvwdxPJFghW634cbQTlnC2BfrzeP5VrOKWsu9dfmlkYniBc4o=
 =VOqX
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2025-11-15' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "Weekly fixes, amdgpu and vmwgfx making up the most of it, along with
  panthor and i915/xe.

  Seems about right for this time of development, nothing major
  outstanding.

  client:
   - Fix description of module parameter

  panthor:
   - Flush writes before mapping buffers

  vmwgfx:
   - Improve command validation
   - Improve ref counting
   - Fix cursor-plane support

  amdgpu:
   - Disallow P2P DMA for GC 12 DCC surfaces
   - ctx error handling fix
   - UserQ fixes
   - VRR fix
   - ISP fix
   - JPEG 5.0.1 fix

  amdkfd:
   - Save area check fix
   - Fix GPU mappings for APU after prefetch

  i915:
   - Fix PSR's pipe to vblank conversion
   - Disable Panel Replay on MST links

  xe:
   - New HW workarounds affecting PTL and WCL platforms

* tag 'drm-fixes-2025-11-15' of https://gitlab.freedesktop.org/drm/kernel:
  drm/client: fix MODULE_PARM_DESC string for "active"
  drm/i915/dp_mst: Disable Panel Replay
  drm/amdkfd: Fix GPU mappings for APU after prefetch
  drm/amdkfd: relax checks for over allocation of save area
  drm/amdgpu/jpeg: Add parse_cs for JPEG5_0_1
  drm/amd/amdgpu: Ensure isp_kernel_buffer_alloc() creates a new BO
  drm/amd/display: Allow VRR params change if unsynced with the stream
  drm/amdgpu: fix lock warning in amdgpu_userq_fence_driver_process
  drm/amdgpu: jump to the correct label on failure
  drm/amdgpu: disable peer-to-peer access for DCC-enabled GC12 VRAM surfaces
  drm/xe/xe3lpg: Extend Wa_15016589081 for xe3lpg
  drm/xe/xe3: Extend wa_14023061436
  drm/xe/xe3: Add WA_14024681466 for Xe3_LPG
  drm/i915/psr: fix pipe to vblank conversion
  drm/panthor: Flush shmem writes before mapping buffers CPU-uncached
  drm/vmwgfx: Restore Guest-Backed only cursor plane support
  drm/vmwgfx: Use kref in vmw_bo_dirty
  drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
2025-11-14 13:39:15 -08:00
Linus Torvalds
ccc0011804 MMC host:
- dw_mmc-rockchip: Fix internal phase calculation
  - pxamci: Simplify and fix ->probe() error handling
  - sdhci-of-dwcmshc: Fix strbin signal delay
  - wmt-sdmmc: Fix compile test default
 -----BEGIN PGP SIGNATURE-----
 
 iQJLBAABCgA1FiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmkXV0IXHHVsZi5oYW5z
 c29uQGxpbmFyby5vcmcACgkQ/iaEJXNYjCn4cg//dgxz5D8jpFvEingdOeUzw0iq
 47Xb8zgqtP9kRrGoi8s4DcBc3kratVgndUaPC0g0ZR0I2yV9yKheOSXaph8/yA/g
 L37sVPNIGIFSQ4cvpcRyXMQ1EmILp0Uw6SK0wGvKwnfe71Bv1iWzr+3j4WBPMuKp
 CU7L3GWIkWSmcSGqQk0WM+E5kWwHfsUSw/qHGsji+i2GL6LMS/g1Y1NI6EXRJq0t
 QfiFeQ+2Mm4ZGeqeRlez5OErrXNIZm83mC5wXHBLmc6vK0GY38IzTE39xkvTaiRw
 5/x8ivQghDREmIDDIXT/tDGrLsTBwBxBuQ59lZw5yBD0orTCVZOFvNnli70j0xc4
 mKgdVdG0WwURXPHhBv2Z8TvHQnZcZ3b3aUBiR4+PBvFspWtED9GsrgSrpDmpSbRk
 EnLNOW+sWDRSdoIMwHLCZ0QNYlfDMZjrjyTMhFwdxWiLQaz6Rr4EspMA55jYYCRP
 9nodxGya8EdeRnCZQYCSr8mEz34xwZELX23rw/IcKXTWbMJ2Fuwsjx3Bb2nQn0iZ
 b+L+wrsp2nIZTpUT6iIbHFWGJoX8+hmMpH7LwUbGnbB/PavVnDFpLw1qLnFIK/wb
 JXCAx67Ldclq4ikwi7lkiHw/GFPCDI7g5uEMt/TFe/aO5M5hDEoIN3MxjPH41D71
 YI6/SjrANHAgKXh06iI=
 =V0qh
 -----END PGP SIGNATURE-----

Merge tag 'mmc-v6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc

Pull MMC fixes from Ulf Hansson:

 - dw_mmc-rockchip: Fix internal phase calculation

 - pxamci: Simplify and fix ->probe() error handling

 - sdhci-of-dwcmshc: Fix strbin signal delay

 - wmt-sdmmc: Fix compile test default

* tag 'mmc-v6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
  mmc: dw_mmc-rockchip: Fix wrong internal phase calculate
  mmc: pxamci: Simplify pxamci_probe() error handling using devm APIs
  mmc: sdhci-of-dwcmshc: Change DLL_STRBIN_TAPNUM_DEFAULT to 0x4
  mmc: wmt-sdmmc: fix compile test default
2025-11-14 13:34:36 -08:00
Linus Torvalds
241e99dbdc pmdomain providers:
- imx: Fix reference count leak in ->remove()
  - samsung: Rework legacy splash-screen handover workaround
  - samsung: Fix potential memleak during ->probe()
  - arm: Fix genpd leak on provider registration failure for scmi
 -----BEGIN PGP SIGNATURE-----
 
 iQJLBAABCgA1FiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmkXVCkXHHVsZi5oYW5z
 c29uQGxpbmFyby5vcmcACgkQ/iaEJXNYjCkfsg/+Jl5eA/yPBcIBarNR57zVVw7+
 AkR6Swf1nqWBsbsSzI+5glSMvt8zvdK5xAbLJ4FgTXZG8lZAhDrYQW487kLW2T3x
 ovc+EnoN++nEgbtQSawda7zIkoQTnDbmv63M3hcV8+r4i0fpLizgruAnn2hXl+Rz
 75n2jMVYpbCQwKdtvPF8GJxOgcxqAwWoZF/mq2ZgRJZAMsRCBNtfhnGOLss0nB38
 g15WC6KQw7rQGBiNNkWkSsXXFL1DIypHaXyc50ckIz07tndzj9D2jLbinv85H4Bc
 oM0PMCpfabMM53uIq451CLil3hBkjFWC7sxL4hY3egWnGq1+Ng1SOCom4u7Sq0LW
 2MmK9YoDNB8HrGfK8KXJhseHwdB4nyhBTBPQPr2QED4w668I1ItJIQh8MD/5zZrd
 LfB/pDBpbTxob7sCHBuENS9HOp0Cq3PRkDjw8U1PaFqm7/9VuHcXXTqLFLbngUJ2
 UzOUileCc0XlHe/S1NESe8ddvgbtvxjm9mtPwLCLXQDpQSy9pBkqLU8ApnsqJkH3
 xCEE+T6EADqkHMGDyMjMO1RdvCWVmdVCApX/tinxuSQ62r98gUCs7zjc9SI1dJr6
 NHROUkVd02e2iMRSGASgpFsb+1BHhPizeNAtFLRJq5p8l1fTR3+mRaL8mQ33Uj7r
 g7weleTpL/3nxyrkXT4=
 =kbt7
 -----END PGP SIGNATURE-----

Merge tag 'pmdomain-v6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm

Pull pmdomain fixes from Ulf Hansson:

 - imx: Fix reference count leak in ->remove()

 - samsung: Rework legacy splash-screen handover workaround

 - samsung: Fix potential memleak during ->probe()

 - arm: Fix genpd leak on provider registration failure for scmi

* tag 'pmdomain-v6.18-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm:
  pmdomain: imx: Fix reference count leak in imx_gpc_remove
  pmdomain: samsung: Rework legacy splash-screen handover workaround
  pmdomain: arm: scmi: Fix genpd leak on provider registration failure
  pmdomain: samsung: plug potential memleak during probe
2025-11-14 13:29:15 -08:00
Linus Torvalds
6014e75e87 cxl and related fixes for v6.18-rc6
- Fix incorrect device handle check for Generic Initiator
 - Fix offset calculation for extended linear cache poison injection
 - Fix lockdep warning for hmem_register_resource()
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE5DAy15EJMCV1R6v9YGjFFmlTOEoFAmkXTxYACgkQYGjFFmlT
 OEodJxAAnlN6Fmlb4K5I/CSJ+gACjBPEZRSBD2C2e7jk2bzg/VQlvdlpSxst6u0d
 tKFZ/+MJ3g4rCy1E6ePfukyl5wzUvh/oCdDdnaAAKOZyHB1SE0LUxKovbePLBCyl
 TRVT5VjQ8C3LI8pxMJ9oPLLdyrqpDof69EKdi3qAJchOwjGL7/2mekMbtBOpVIvo
 ds+huV0e2qYrVkz/+UWJCTtvOQZ8Tx+PCRkk/0I9QclILdkIK0ABoryAN8EDaKPD
 LtHj7W61FYV1gbfWXLjOBKq1oMfiayYm0ZKNSomxZfqw3OK2qvcjSkXosmWqw8I/
 9r9/asmW/ivedtv53m2W/2QOIvaFPgB6e2i0Rb7a2Bskh2/RAdeqXajqNJNBGWKo
 70gp3UvEGpHibY1/LIhjeCZhsGjv0UjzEaC5PhhvlZOy6VsGtue/kv8kJcTcDOMT
 MGz4q6kbPmNB165kfsF/9LYgM+0zc/gpG+HRs+7qBhWVEmKTkAWmo60SfP89vJn+
 pjEhOEYIm1TGO9J9fSsPrAg1UDJkCWADYYAskZNWB6leDPHGQ08axedO4JwI8qq8
 ATfzUDw7zLlHO/6QrHp+d6Wk+6XOQRSjufwyW/K/0OvC9Br9yOFt41o0qGpP8bQI
 xQdh0HTDzCSbKlpn73r1IkAsK3HN/syOnC4HkbXvEviYBr/ZTYE=
 =FnRL
 -----END PGP SIGNATURE-----

Merge tag 'cxl-fixes-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl

Pull cxl fixes from Dave Jiang:

 - Fix incorrect device handle check for Generic Initiator

 - Fix offset calculation for extended linear cache poison injection

 - Fix lockdep warning for hmem_register_resource()

* tag 'cxl-fixes-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl:
  acpi/hmat: Fix lockdep warning for hmem_register_resource()
  cxl: Adjust offset calculation for poison injection
  acpi,srat: Fix incorrect device handle check for Generic Initiator
2025-11-14 13:25:00 -08:00
Arnd Bergmann
124c98b100 TEE kernel-doc fixes for v6.18
-----BEGIN PGP SIGNATURE-----
 
 iQJOBAABCgA4FiEE0qerISgy2SKkqO79Wr/6JGat8H4FAmkW2ocaHGplbnMud2lr
 bGFuZGVyQGxpbmFyby5vcmcACgkQWr/6JGat8H4eYhAAneMo7XeOE2939WbTrFUJ
 yF34fhCiKpxZ/IHqDJzCa1gVdEFW7oyedwOH+Q4k61ch7KmbvL3syilrrhch/Gai
 3K+B5500new57tl8DoKGuO0w2e6Oxw1ZrNzw+aJSflckgyHYXqRtKD7B5PHYyWjN
 tDm6F2CNpgkcuV7V8EBHCPWiRZPqx3BcH9ghtLPlK7B75i6+o8oWWjqqxhB0OxB2
 WhFM7ny73JaN6kCUeAz+Hx7OHE7Y3qHqg5bdC2q3rHOnWWjEt8YILUYZBPw8Z0W2
 lYUmOgbCxaTTM0CbV3Ye4m2YL6jffqUv9JaHxDzoeffhuKiQd/6PfzB3N7n849c6
 6SO72nMzYijZg2aXpJYrlgW2/6/WuThH2qUYvex21N61+yXPeKYoFDh2HBs9uMPj
 46MZ7ExKkZiRi53LkGUjH0KxOABlmPO510wiPlk/uvOm+hlGEgku070jKahGDunW
 pGVAqri8sowqkjNo9EPkv2in9PBjZsf3Q4lH0uQ2a9plD3ZP94Hp3j9qvtb4Gepv
 5kd/OBDzbY8OkXDgEJj+VJIfHc8zxeQ8PUe28icsX3inoddgdJYXg3dPjx69tfv9
 g1AAxGIAmtx2CTv6UNep9sNBpx1blzV4ThFURKobvzzXTZ+HK2HrzKrsjRfKe4bv
 PHVCUDd7RkujkcU4gOvCFIg=
 =xhar
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmkXnXkACgkQmmx57+YA
 GNnZDw//d+5ko5rX/5QPpnh0BrHEFdsUYDDcbjPOJ+z0YJcXM9MnXozX0ubTK1HT
 B80yTG0mS50kBuRf9ZdIt3WFHsXgJfr8b1LLhLOrPBVgns7RTRLlFvr7CjLmSooM
 IEcHj7TrUTXS30XE2gHON2rhwlCwNxwht/kQlomyEf/6zHMSHqi1xXDsXeySHEkB
 QA6VkSLZOLMsgcqvwFUozv9DV/a+PVMv1LJvvAgFuvnpCacydyhBGJWzPFdUkFgk
 qfbO/OezPbXwt/XJTDIxbp6u5w1q0RhCXFCrg+WWcwPCBjS1yBa6o1apz00kjl0M
 RnZyR4F5Lg0vmDKTYePBA+ELdjWNrcAuCn9/kmm9E/taN59uqf7uF9X9oXXUlTQu
 eFGmDs9yWonX6KqjBTRKVCfYCagimpNQQ2xao1VDq58BxrpfjWfAJltgYxiTokdU
 BDuWsc9084xlH/fO9L+2WxW8weLYOaV+NE68zD6y8PyoPle7mA5XlSnFTuHi8gm5
 LXCj7+PZ5sT2X0VS++U+Sx1TtEOwD5bYkiEwhrTe6+dumzAKl9/vIKriGgCAv97x
 Leahlh3nN7v7JIpGs0BZZ61XcvUOBARK7ceLvIRSaNrDzXmnbixeVRAIrenqCPXE
 aa0/vch4MyctXPHtN/TyhQI1hmD3bggx9UqtN0XnCT4PuwnZDT8=
 =nT6/
 -----END PGP SIGNATURE-----

Merge tag 'tee-fix-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into arm/fixes

TEE kernel-doc fixes for v6.18

* tag 'tee-fix-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee:
  tee: <uapi/linux/tee.h: fix all kernel-doc issues

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2025-11-14 22:22:00 +01:00
Arnd Bergmann
4e08ec0054 This pull request contains Broadcom ARM64-based SoCs Device Tree fixes
for 6.18, please pull the following:
 
 - Andrea assigns clocks rates for the Ethernet controller for the
   Raspberry Pi 5 systems
 
 - Laurent adds an ethernet0 alias to allow client programs consuming
   that alias to populate the correct Ethernet address for the Raspberry
   Pi 5 systems
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEm+Rq3+YGJdiR9yuFh9CWnEQHBwQFAmkLl74ACgkQh9CWnEQH
 BwSpVRAAqrOwv98RkKxbWX6GTaTae3tL6b7jfhtjNKsY5uSaGzAzlJAUs0+czshG
 OiRC7orymNKVeQoIrrp/+73BjNN0cJXDesvBu3tSbbYS6IwkQQmwkUUf9QBDY1jK
 ndpRKWj7iotA5H1RTiCduloh6cp1MRL+b3wb5LCySid4PCtXcpZufeJkkLSB4MlL
 IS7fnRltRtMaBFI92lU/W718sLorH1QewdAfubxTysg07a2rlfZZPeVCQ4sFmntt
 LDP0AZvyxFSA7942GynWcZniP8cw6mfj+JyZxZgaKBK34438iDRcYzuPpT3zNv6k
 xL1NMqY0ZrE7NIIOXosdUB7BdsQLN+bgOsQOVWz4iMoPB4cLSHjg20kXrOXzUIKh
 IC3WBXzW4oYNlqq9k1IjJ2oxtbrukaF/b0jf2TWs7VOKHUIVjYO+imgs1ofw/krT
 oPQuXTZrBBnjxPbt0DdQCqnoHqXfZ0Sr/6WqCNLpeOxS0AWqpJsHywg+A5RgTYrJ
 pFrDJ0tQuwUVdRTxf5sDoJ1TV2u3U4uq/LWVTA0s1IxCus6ifawKQNJBxEBGm+dj
 QmmEuNWzNtmjfJIeYBDFfTkeDmFGn1J3zLbwQ0zQmuut5BuwOkaR5PWTQQj/oDm8
 G4jXoUwAvxQHvpx9ESO9kxHS2sck2pxJcp+aseS5uDUM5xiGA3A=
 =cj42
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmkXnQwACgkQmmx57+YA
 GNnCJhAAs0t2zUWzIL/faE15mGkwRqAEYtqG4vTviF6v8DusbNl++E2fN5Knut1q
 LYl8FIFeVV6NPl/iY5lfPb9WYWBVt1/WNZKU/Uvkw3X4TAHz0xKURdnpU9HYw92k
 /WptZp7RNYkngIt+aH1nxlt5EBiPbS+8rbpgDC3wLsVwjJ+hu765h9H9xsVOjf5r
 4JC3N9MPGT4pxUpohnFUO+s6LD5UkBMfnNCIpaHyABrqlPQcV+eb7v8LqETQm0ZH
 EALqi+0JDdE2I1/66QeAVjRNxskEGTuK0qXbTzINpDA6axH+CdpCDmRKTS64KGp7
 lbjxm5py/0RjwIMs7ocrXx9ckvpqB4FABj8Cd9HPaqhtA2yAnlfLykB9F8YWpUro
 +z5rvffP57eNW5xG+E9O4Msbo4gDazs8GnTeEPqdD12llfXOC7YMkN9Hx3t4x2OX
 /eVzW/vQydoqb3R0WCVHfDAGpnAelYBgq93GodnY6Sc3nxjbvxyp9m6xKj/gaOWZ
 w0vJTfIXCORMq0KuKf5bSyPXKVYkkFXGTDVr0hGgR1cyQsNvUI2lj8X0DhV3gbSD
 QvIF9c1TXFY9o/NEXdW67ejqTekEmRflbN0fDVQAfGBZJnSSde7ydvhJNZinkSrn
 NV1JLF5Ih2KM0XkkLryHFffztPpb2b7kzFBR3DEaSALGK6pURlA=
 =MR10
 -----END PGP SIGNATURE-----

Merge tag 'arm-soc/for-6.18/devicetree-arm64-fixes-v2' of https://github.com/Broadcom/stblinux into arm/fixes

This pull request contains Broadcom ARM64-based SoCs Device Tree fixes
for 6.18, please pull the following:

- Andrea assigns clocks rates for the Ethernet controller for the
  Raspberry Pi 5 systems

- Laurent adds an ethernet0 alias to allow client programs consuming
  that alias to populate the correct Ethernet address for the Raspberry
  Pi 5 systems

* tag 'arm-soc/for-6.18/devicetree-arm64-fixes-v2' of https://github.com/Broadcom/stblinux:
  arm64: dts: broadcom: bcm2712: rpi-5: Add ethernet0 alias
  arm64: dts: broadcom: Assign clock rates in eth node for RPi5

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2025-11-14 22:20:06 +01:00
Arnd Bergmann
c3216f1d62 Reset controller fixes for v6.18
* Fix incorrect EARC reset masks in the reset-imx8mp-audiomix driver,
   introduced in commit a83bc87cd3.
 -----BEGIN PGP SIGNATURE-----
 
 iI0EABYKADUWIQRRO6F6WdpH1R0vGibVhaclGDdiwAUCaQuFzBcccC56YWJlbEBw
 ZW5ndXRyb25peC5kZQAKCRDVhaclGDdiwJbTAQD6yRgElpGmbmIeABbfwZencdto
 M//+G1SC5VPVIgBwxwEA0L0ydtCuE5i9qGnSObdMwofbruj0qKyCZuei1MC01A8=
 =HwNS
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmkXnKQACgkQmmx57+YA
 GNnMsQ//V98xJEU0gIS1jVcduEAlQubgM04bzyVck5VH/dw8spNJmybhSxPCD0va
 WBc+aAa+sjBF6lB9UnDg3SQt2Gz/WuENiTvq4NNGiYtCDyworZYFzqrG/gTDsZi4
 jDLTf98I8yfqrAm7n0PamrHa/+Tgv1my0SNlerXyDtx3caG8yebyH1gRE1gD2/nZ
 g4TJy7BqeJ+JDPfSR37lU3vry9PzBPF7wRP7tVPBhF5WTI9SgA0wWpO9JA6QfV/J
 GNCQE4eKcohARioVD3Xw2hoO2IVDx7n+qXeQ6GjjQkg7+g9xYfOHuB0gd17k9gMF
 +UltNSQaDK08h81imb0JMSRGqMMMMCh5NPtduQQfv+x9SrEwS89r5+7LEwZ2E+K9
 rxQ7OqTjwPdYtg2ooAhyOkKpF4mfY8fvfZgmucXiuMCtbf9o9YzrNdwynIv0oHoW
 RhfKWrXrMzaX8C2Fpdv6L6xLPkczQFlqsz5gs+EFq519bVLTzKbgLZZcl3EEA2Mj
 +GkQ09ayibfLJsEN4l6jzpsQgqbHFPrFnnZfTol26L3Y9TujEZVQ+wYr3vNBYy7K
 gZ89Ydw0GjyxWyJzGKMXOw//INQOyEb413sJqE/MqsabEwLdKr9Z4o2HZg5SRHIp
 X7fCjjZ5iVe8cjLvhYl1mUifeqRRXUxyv18/Zd2Pamz2vQgOAeA=
 =zPNo
 -----END PGP SIGNATURE-----

Merge tag 'reset-fixes-for-v6.18' of https://git.pengutronix.de/git/pza/linux into arm/fixes

Reset controller fixes for v6.18

* Fix incorrect EARC reset masks in the reset-imx8mp-audiomix driver,
  introduced in commit a83bc87cd3.

* tag 'reset-fixes-for-v6.18' of https://git.pengutronix.de/git/pza/linux:
  reset: imx8mp-audiomix: Fix bad mask values

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2025-11-14 22:18:11 +01:00
Arnd Bergmann
7b52117eea This pull request contains Broadcom ARM-based SoCs Device Tree files updates
for 6.18, please pull the following:
 
 - Rafal fixes the Ethernet PHY address on the Luxul XAP-1440
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEm+Rq3+YGJdiR9yuFh9CWnEQHBwQFAmkKfd8ACgkQh9CWnEQH
 BwSamA//fF+GHUdDVMmZWaby49yBUm5RG77TxCwe2ZSEsgpPchLICey8Ff+Yg7aC
 TUCFZd4d7BKWy8NeAh4sFj7aqc2lSpytbC1oX5yb0TyOQJ5b4pc4cCTBytdJK16d
 YQg8scp8L7fRMUjTQb5IypYpIQ548d4KQ41U/66wd4TS7iJMHjFNK58z4cwOeRR2
 WmMkUkTtKTKWiSV8f3pbQHBmQHuIS0LP2FbY8MHUuXZ8qJu1/cndlZ96h4EX8fe+
 LMQH5QP1Bb8EqwJJUnazroZ4fJSfFzA5oTyob+eRAiMu4uXDueTKQSVmkaLgscwE
 fYidQ67U/Q7/DanhWkGty4Ogvr7dtATPNlqkAgmGRHDPdG5sKGh5z70RxwBSqGcd
 4PBmbIDgY5xcZdi3gS57DNWlkoqjC3MwnbGpXjJtGm9ei4vx7CRqbrS+7NIfwwAE
 wc3HQif8von7gKDF4XsKRSbi16r0kZUl8nV4hPXtEUkU/cZB/0pT3IK5K+Kb85Mx
 FxAhkDPvze6MHjFOaEE/rAep6VJ0Wwm8jpHaX3gt6CO+wBt8xloYmW58PFpGxwku
 sQksy+8FUn7rOYn7UKMGcPg/QYjFHDpDj8ZxQcbA4NTKuuVTxWcmr6h8BRp215v5
 a8K5BqGEWCDqOiyFspjwqLhe5jnq9bLFpE1ltP0nU2eHH2jKkA8=
 =UrIL
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmkXm9UACgkQmmx57+YA
 GNmiUw/+Myr9IuBnUU4Fr7yTZGFJbHfLeHRz/ybRYp4p0Qr4E+5mdNEyS4HP6Qjo
 97p3rSa8Kmoja/FwDv+KlqZ/ylLE1b7Ir1rjmMqhb34U4PhFllLH4WR67nn3989W
 LuYd1Nn/z73j4KH9osAV0RlHHZY62sG5mPNoYkM5NRky6QTDowTDyd0hAX6byWh6
 IT/VDWeFmuTHX9T8LTJ89hWnpsZbOAGqdQxdjORAtx6Fl+NkbSCjisegRz633Oh0
 JnONeBzLW0yHKK4rNzooOJ0gm9DDPZ5l5ha44snENf85zciK3nZfPWG66YCEhpHb
 rKSH7gwoMx9jERpg9KnMGBzQfWOqYRU7sHVQwyYk45HN99658OdNuhJX8FXgv+Hx
 OPpiDvQ3J1trHnVdwXt6cgo/6r8bXnlSUrYwxjrI/N/8sgY6VosG5D+YVR9fWzQc
 jEsyzlX+Q/5SaWhEYdpGxdOxksinfeGoKJo6jRUsp9RJ1JxhPx2nAMWZ0MWeBqs6
 xfUM2/RWUEikzC2PlWl6zlxuFjj3eq5xI9IHXUW86kMzTDGgkh9GQIFhcdDM6eQP
 b52u9Yi0Eki2TiCU0QEdgNdMk0u/oiWHaK3gHiKQrISug0iL9w4W+2SINaJ1y9Jv
 ENdeb03fXChSDcqxcBO0N6wzS/8BNao+V1oJhEiXENlhgQ3zS0A=
 =udy1
 -----END PGP SIGNATURE-----

Merge tag 'arm-soc/for-6.18/devicetree-fixes-part2' of https://github.com/Broadcom/stblinux into arm/fixes

This pull request contains Broadcom ARM-based SoCs Device Tree files updates
for 6.18, please pull the following:

- Rafal fixes the Ethernet PHY address on the Luxul XAP-1440

* tag 'arm-soc/for-6.18/devicetree-fixes-part2' of https://github.com/Broadcom/stblinux:
  ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2025-11-14 22:14:49 +01:00
Arnd Bergmann
020e792ca3 This pull request contains Broadcom ARM64 defconfig updates for 6.18,
please pull the following:
 
 - Stefan ensures that the clk-raspberrypi driver which is now the clock
   provider is built into the kernel image to satisfy root over NFS
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEm+Rq3+YGJdiR9yuFh9CWnEQHBwQFAmkKfTYACgkQh9CWnEQH
 BwR2rBAAlN03DYB81RQh/WWTobuVw3IgnqZ2EgplA88motyTxuju9zB9A/eaWtiz
 9gORra9bl06Bk8d9vjoklowQdju1ncN3CJl/O//HcGbSwd+j1Y6jgIScOsI7Wtm+
 aZT7gRCjM1qikPJLUVUwGApSMnP654leGltYsD292d72BM7atzAbogLYH0W6v9nw
 oYPREyq6Ls6ToBvfpy1S1a1JnvFlxB4Ya7BPZUJePb2vxqTNwpxyX0qIiQx9lozL
 ReichWegjMjo0IQDcldHSRGZLyAJ7OzOECYXGdsVWBngUSZMhzb98Y8zssZVYmYt
 vX/+MUkmPNJhv8HZfGPV8lij5IFcfqA/jv5o8uO15pQa00bOa84wsEAvACy9tKWs
 BL80Ot4ODoG+SbxOCSXbzPqYuF5FakgH2beDE+1W5GwuZKhWRrYZPAEeU2BXg8J1
 MQsewm/2PHhC7hcIXX6k6KJJ/IJPeOe/yh8OaKn0uYRShPIj+x7aEMIWyzlgyS4z
 2gdSCoAwhOUM2kfJaXjfa+dKOCe2lP9YYxH4hL3wqGnduUbMgqF8uod5jRjA63Bf
 me+8EOt1GQj/izpKeutFyQaiTaemLq+1wxBxhSejhfzszTbLm83+tw+WeaihoFf+
 EH0RAmUar6f7dfuNHc6y/f/Y0z7u6OALHo6oWt3YFYotQX5hp/E=
 =vB8/
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmkXm4QACgkQmmx57+YA
 GNmDmQ/+NJAkddrqs+9r6hGOhDDN3p1Cp2/ZdzWlf9o2FeXQzJCHnTWj4NiG4zju
 kjzNqyyYcHdiD8dJInokTofpGknI0+1jOUK5VoiyeLRR3rivbWFnY7HMFaUHAFl/
 QMoPfj9eT3QOLPhvojbZpTDgh3VVOU0/D627kY9GXTk0Njs8hw07PsOVw39K3mTO
 LEg2IAs6KRxtkuf0fPMX0ebUbBJMJaaHIGo7Rw+DJ86mzOmOta81+8KALHcAOAqW
 1vdkPTeQP83nmthTNp+W1X26HH9X7hVIUq49d4yJRiFIrKM4vExwpIZJYqWa4AgK
 2uLLZl7UV4bU9kWXOOJa9/YqvdhVKFZiNic1RnxJFxmRDJr6H13mH3WmKLojtCoL
 K+kmGYUnGXkpByHPV8BlhBrU80SztBvUbcS2+NKTDdfYUjWxh37kRBIVwQiKF81P
 EK5FwLpjG1+0rVB4eoVrpDaKgIawxRdO8trseASzacI4DQXSKjF1iOhgwKUUz+Rd
 JqZEZbXBdStcDpGUVBQN3yVV3XbBddz7U4Xowuc1X5biCjnAalJnPbhHOC3lPQGp
 8Y2ptZYyhYyMlJpLOjE39crDb8IrJpAYaUQliauTxDThapTYlJ5JR+xsagprd75y
 iDlz7fzWe34P732i718mhC70z+jkFdYS0a7pJ3ShmCyNJs1X/uM=
 =zJLd
 -----END PGP SIGNATURE-----

Merge tag 'arm-soc/for-6.18/defconfig-arm64-fixes' of https://github.com/Broadcom/stblinux into arm/fixes

This pull request contains Broadcom ARM64 defconfig updates for 6.18,
please pull the following:

- Stefan ensures that the clk-raspberrypi driver which is now the clock
  provider is built into the kernel image to satisfy root over NFS

* tag 'arm-soc/for-6.18/defconfig-arm64-fixes' of https://github.com/Broadcom/stblinux:
  arm64: defconfig: Fix V3D deferred probe timeout

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2025-11-14 22:13:21 +01:00
Arnd Bergmann
f4f012b0ee i.MX fixes for 6.18:
- Enable ext4 support explicitly in imx_v6_v7_defconfig to fix a regression
   caused by commit d6ace46c82 ("ext4: remove obsolete EXT3 config options")
 - Correct report-rate-hz setting for imx6ull-engicam-microgea-rmm board
 - Fix MSI mapping for i.MX95 PCIe endpoint device nodes
 - Fix USB OTG role switching for imx8mp-kontron board
 - Fix a dt-schema warning caused by audmux node for imx51-zii-rdu1 board
 - Avoid gpio0_mipi_csi GPIOs being deferred for i.MX8 img subsystem
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEFmJXigPl4LoGSz08UFdYWoewfM4FAmkGsFEACgkQUFdYWoew
 fM6C1QgAjoBx7lJEXgBwijv/KF25q4vMxtT03D25QApiwD+LPgnecZcXydcpUjQU
 4dXkEsQXFp5hY4Vqhqjd7T6p7kk1EO7oZru7bp+vkErlEru4Q7pTZoz0z3pql3Bk
 TQnnxSDyWqYO9gswgeT9fWGENkbtEj6Dk5N1dzgoAm2QdwS/zXlyemtbl2GpAA92
 IIlIDwEUkq83e8bu4LfP6l/0hRzhQa0lWuWXmcWVoCUCHR39TScKBxCMVSrhcIsk
 7TU7ip3v9iyhglYhFfK6q8AEYAQ8UcL23znvHFMjsVIjsovD7Q9RwADJ0Oodxxfn
 cH8X2nc0cVkVdUb79QipTWht7lRM4Q==
 =zU1F
 -----END PGP SIGNATURE-----

Merge tag 'imx-fixes-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes

i.MX fixes for 6.18:

- Enable ext4 support explicitly in imx_v6_v7_defconfig to fix a regression
  caused by commit d6ace46c82 ("ext4: remove obsolete EXT3 config options")
- Correct report-rate-hz setting for imx6ull-engicam-microgea-rmm board
- Fix MSI mapping for i.MX95 PCIe endpoint device nodes
- Fix USB OTG role switching for imx8mp-kontron board
- Fix a dt-schema warning caused by audmux node for imx51-zii-rdu1 board
- Avoid gpio0_mipi_csi GPIOs being deferred for i.MX8 img subsystem

* tag 'imx-fixes-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux:
  arm64: dts: imx8mp-kontron: Fix USB OTG role switching
  arm64: dts: imx95: Fix MSI mapping for PCIe endpoint nodes
  arm64: dts: imx8-ss-img: Avoid gpio0_mipi_csi GPIOs being deferred
  arm: imx_v6_v7_defconfig: enable ext4 directly
  ARM: dts: imx51-zii-rdu1: Fix audmux node names
  ARM: dts: imx6ull-engicam-microgea-rmm: fix report-rate-hz value

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2025-11-14 22:10:31 +01:00
Krzysztof Kozlowski
ec0ca4be11
MAINTAINERS: Update Krzysztof Kozlowski's email
Update Krzysztof Kozlowski's email address in mailmap to stay reachable.

Link: https://patch.msgid.link/20251021095426.86549-2-krzysztof.kozlowski@linaro.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20251031135041.78789-2-krzysztof.kozlowski@linaro.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2025-11-14 22:09:51 +01:00
Arnd Bergmann
64bdb49f2d Memory controller drivers - fixes for v6.18
Correct incorrect ID used for the memory controller client IDs in
 Tegra210 Memory Controller driver, introduced in v6.18-rc1.
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEE3dJiKD0RGyM7briowTdm5oaLg9cFAmkEvigQHGtyemtAa2Vy
 bmVsLm9yZwAKCRDBN2bmhouD13fID/oDWRwWSDAjg2rMWM7AbO15oFUQe9vmEe3a
 aWT0h6fi9gKKMVunIwokHz/RPS16+BT4xnr9E5PJQ5HOHy45eUd4gZcdR9v8L/EK
 Wtnv997LATibExLHZVA/ToxAADKNifV9TCHxAC/7Txu0aakzTAlhU3xELOMDh6AP
 5HRUnlHrqObf4NHodgdsCZB4IXPqUFcAkas4u0fDNVmO1Z4VHqoYk2SO50ThIEAD
 Yxr4kJP6RbQJoFcXx62mIgYe4rZ/6FZMKScYgeM+BCgUFi2PkRuvied1Y98o3ORK
 BNlD3I68kWyYj4LwV19iKyBO/M+/f6el/nlsZwj2Lb00MqhPzq6uXN/UViE8QJpj
 53Vxcp+Wg/fB8BYI/2yIdn6F21/lSLpVUthDPGQH2fWqXUZOgPEopwYYPNX9zH3L
 Yop6ta8ejMlq6L/Pq5d3cvzwmNlGogLXVYkfNDRZEzjeBSK3E9mfU03WBS3yXHQt
 afudLvkJgFFCDMSx9tnvzSxqj9Ze/P4foEt0W4QSveHMdOOKsIm5IjC81x+IPXlH
 OleAjgTZUxUEC0LPKCGF4/GXo3bjekYeMl3uM+vBkQc9oTxYY1mBxfLeshBsqHGI
 QfFuiNMRrgkz7984RQqc3gYH7kr6yvW2Gsj2BBxLHmyiMrkG/Og/tY9d6jQth+Yi
 7IBELZqn5w==
 =u+Wa
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmkXma0ACgkQmmx57+YA
 GNkAVg//XNG+Dme1XYsU0YgrFuHvJvkArL0MVb/KvRWzPettjFzu+OW/cqH2Xq0Q
 m6svgK5q2ogmVnqoteBGnOINKQGCMjOkyK/XdIzGUY2beGT/+UMv58tywvGkcFK7
 XzxfNGs8C1pq2fwkM73t9VrQ848BXmT4IHH7emhzK65TUdHk5ThCKCm8T+RCWK/n
 SXoU/MGI+WepVG3V6qjdaJLBOWPyKVx73se++Rj3lEqyCLFhVcEGzZoZOBlRL35a
 lXfEtw+2KOYPOtIjmQRCNK0Ygk5aOf2T4EzhSLWOVS68XI28/46GibqCxb7QIW6d
 LKyyHjn9GRRqR5e2TDwHxiD+a9zXyGGMImLo5eDm7m92Y1dJwLSn9mKpNSJlFQ4v
 NAs20LPtxLHZ3rStWJ9mTf92SPX5b5xfmqmPP8m7+bO8uQIIDLYT+X2saQPUm4El
 mowiwOLxrkHx3WS5uiEs/0KqZAuS1FndjblqBhs98NKOIgv5AiuU6DeDhy6nBXv8
 3CmUDmstPwI5XnuoxF0FWCrhjWs7SdGYCQuqoWFRY46s86qZiis++8pSEmOQmQXf
 1pZLY0/41Bhq303Dp2RsQydYd0c0Xpett1pFbQXlUuQOhA86IucYNYL2xQRusd+r
 tExwtNQe6+s8O47kimZzYmSESKFFowSxz/9PK5MNLtAgoaVYE1o=
 =EHXu
 -----END PGP SIGNATURE-----

Merge tag 'memory-controller-drv-fixes-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into arm/fixes

Memory controller drivers - fixes for v6.18

Correct incorrect ID used for the memory controller client IDs in
Tegra210 Memory Controller driver, introduced in v6.18-rc1.

* tag 'memory-controller-drv-fixes-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl:
  memory: tegra210: Fix incorrect client ids

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2025-11-14 22:05:41 +01:00
Linus Torvalds
de90cc610e spi: Fixes for v6.18
A few standard fixes here, plus one more interesting one from Hans which
 addresses an issue where a move in when we requested GPIOs on ACPI
 systems caused us to stop doing pinmuxing and leave things floating that
 we'd really rather not have floating.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmkXP5oACgkQJNaLcl1U
 h9AaBwf8DS6cv1xTWZw9YNXWgqr09UcK8ISniIIaS8h8+AZ+uWX0NFpRjMegIyUq
 TQTGkSqlIF+qSslkso+lWcYRblrUmQuLzDPOCHbDqpa2Dckio8fvVbyN9dV7sk4m
 4pqteHdPF8HIbys0aZvB4gPl4n8SR77Q2t9zrx7Ey6ZMOQn+AxwkxDeF6ZwMkA6W
 FBZ1uY2O063IMVv4Bx79jEIlGMrWxWzQVEK8MvK10ZBp5ds8DzyflHmYEUIGr5t2
 /fxqSHT8RNLnOeffI9Lch0XN3VIJ7b7Yo8hOzFzc4rdMjmtB2AtdWx6hFr2Yb99F
 1rtq495LIBaGojcyfJoqVpCb+lK3KA==
 =nO9q
 -----END PGP SIGNATURE-----

Merge tag 'spi-fix-v6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi

Pull spi fixes from Mark Brown:
 "A few standard fixes here, plus one more interesting one from Hans
  which addresses an issue where a move in when we requested GPIOs on
  ACPI systems caused us to stop doing pinmuxing and leave things
  floating that we'd really rather not have floating"

* tag 'spi-fix-v6.18-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: Add TODO comment about ACPI GPIO setup
  spi: xilinx: increase number of retries before declaring stall
  spi: imx: keep dma request disabled before dma transfer setup
  spi: Try to get ACPI GPIO IRQ earlier
2025-11-14 13:04:35 -08:00
Arnd Bergmann
dc00a9fea2 First batch of ASPEED fixes for 6.18
This time it's just the one fix addressing a PHY configuration regression in the
 Fuji (Meta) platform's mac3 devicetree node.
 -----BEGIN PGP SIGNATURE-----
 
 iJIEABYKADoWIQSoUT1x3bOSX/nAa8ajM9GZTrjhpgUCaQPo1RwcYW5kcmV3QGNv
 ZGVjb25zdHJ1Y3QuY29tLmF1AAoJEKMz0ZlOuOGm/d4A/3wtf6Pvwg9TWI93klwL
 dzGM/H/Tp7H/e9Hgx62774h9AP0V/HWc/zUP71bNdXJ5XXt5UDenxyX7Zwi6W4jU
 uYMDBg==
 =W+qi
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmkXmUAACgkQmmx57+YA
 GNl6bw//QSCsTHTznD7Grd3pgHOw14NxwYBCGU/IifdxAo93DHkjGxsb643Z0UdZ
 SBfnAX9JmSm4IGlxu597M7VyNGtQ8upXSSoWARaRgdfP/um0h8kq345pnZafy7q3
 ShXsjLgZHYCWSyVHLabbrY9vWgYqLWopQ8oTDLhJ5CtwLlnLLqZW+nPpAgqsBR5F
 diiygILOzURFPNX7jxHk7WBZb5MmDTNjjXPAoqUkLqbEJ2+TTAVjdys6eMNPTRcf
 IjhAjpKiR4fOQnMOkTXII+lg9Jy40vgPXfeg86CCnjhWzRKhWezP/FEAxNpvgfse
 8dbC0sw5kvDVGfQDjTBQQLmXvO0QtRHMQdxTxdJAuv2LLXXf6GgMD5PmEZJErb17
 og8tjsQIwqBmOlRh6p/2cobxeR+JwgNMaPx8yWykME17rjDX2DLSipctl6X3tq1K
 1gBeYCscQitDbRqPIy+OnpZ3D4K36Ucl3i3MSjGYcMUeSGA/i3cjYlas5O3g7Jvz
 rEbpafNoO6QHylCHZ6xgJHeQzzHb8KAdUohas5qVdwz9TMBdsChC0e4RNiiFLfN3
 DSPjdJxyTa4OFKYihJwjMe4HZqrGP4YsqcMFeiU0IR0fVQy93eBp4WWZUe5jd5+w
 Z/gCJ5elKCPKexPjPDbkc0cvELRlVSael6gVSAb03rYcchaK69Q=
 =lSRq
 -----END PGP SIGNATURE-----

Merge tag 'aspeed-6.18-fixes-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux into arm/fixes

First batch of ASPEED fixes for 6.18

This time it's just the one fix addressing a PHY configuration regression in the
Fuji (Meta) platform's mac3 devicetree node.

* tag 'aspeed-6.18-fixes-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux:
  ARM: dts: aspeed: fuji-data64: Enable mac3 controller

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2025-11-14 22:03:53 +01:00