kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity
1,398,789 commits 117 branches 5,827 tags 6.3 GiB
Commit graph

1,398,789 commits

This branch
This branch
All branches
Author SHA1 Message Date
Biju Das
a136ffb888 dt-bindings: serial: rsci: Drop "uart-has-rtscts: false" 
commit a6cdfd69ad upstream.

Drop "uart-has-rtscts: false" from binding as the IP supports hardware
flow control on all SoCs.

Cc: stable@kernel.org
Fixes: 25422e8f46 ("dt-bindings: serial: Add compatible for Renesas RZ/T2H SoC in sci")
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Link: https://patch.msgid.link/20251114101350.106699-2-biju.das.jz@bp.renesas.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2025-12-12 18:42:46 +01:00
Magne Bruno
48e5794baf serial: add support of CPCI cards 
commit 0e5a99e0e5 upstream.

Addi-Data GmbH is manufacturing multi-serial ports cards supporting CompactPCI (known as CPCI).
Those cards are identified with different DeviceIds. Those cards integrating standard UARTs
work the same way as PCI/PCIe models already supported in the serial driver.

Signed-off-by: Magne Bruno <magne.bruno@addi-data.com>
Link: https://patch.msgid.link/20251110162456.341029-1-magne.bruno@addi-data.com
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2025-12-12 18:42:46 +01:00
Johan Hovold
64934857c8 USB: serial: ftdi_sio: match on interface number for jtag 
commit 4e31a5d0a9 upstream.

Some FTDI devices have the first port reserved for JTAG and have been
using a dedicated quirk to prevent binding to it.

As can be inferred directly or indirectly from the commit messages,
almost all of these devices are dual port devices which means that the
more recently added macro for matching on interface number can be used
instead (and some such devices do so already).

This avoids probing interfaces that will never be bound and cleans up
the match table somewhat.

Note that the JTAG quirk is kept for quad port devices, which would
otherwise require three match entries.

Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2025-12-12 18:42:45 +01:00
Fabio Porcedda
a0538d9915 USB: serial: option: move Telit 0x10c7 composition in the right place 
commit 072f2c4957 upstream.

Move Telit 0x10c7 composition right after 0x10c6 composition and
before 0x10c8 composition.

Signed-off-by: Fabio Porcedda <fabio.porcedda@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2025-12-12 18:42:45 +01:00
Fabio Porcedda
1425cc83a8 USB: serial: option: add Telit Cinterion FE910C04 new compositions 
commit c908039a29 upstream.

Add the following Telit Cinterion new compositions:

0x10c1: RNDIS + tty (AT/NMEA) + tty (AT) + tty (diag)
T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  2 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=1bc7 ProdID=10c1 Rev=05.15
S:  Manufacturer=Telit Cinterion
S:  Product=FE910
S:  SerialNumber=f71b8b32
C:  #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host
E:  Ad=82(I) Atr=03(Int.) MxPS=   8 Ivl=32ms
I:  If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:  If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=84(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
I:  If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=86(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
I:  If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms

0x10c2: MBIM + tty (AT/NMEA) + tty (AT) + tty (diag)
T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  8 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=1bc7 ProdID=10c2 Rev=05.15
S:  Manufacturer=Telit Cinterion
S:  Product=FE910
S:  SerialNumber=f71b8b32
C:  #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
E:  Ad=82(I) Atr=03(Int.) MxPS=  64 Ivl=32ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:  If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=84(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
I:  If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=86(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
I:  If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms

0x10c3: ECM + tty (AT/NMEA) + tty (AT) + tty (diag)
T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#=  9 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=1bc7 ProdID=10c3 Rev=05.15
S:  Manufacturer=Telit Cinterion
S:  Product=FE910
S:  SerialNumber=f71b8b32
C:  #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether
E:  Ad=82(I) Atr=03(Int.) MxPS=  16 Ivl=32ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:  If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=84(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
I:  If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=86(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
I:  If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms

0x10c5: RNDIS + tty (AT) + tty (AT) + tty (diag)
T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 10 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=1bc7 ProdID=10c5 Rev=05.15
S:  Manufacturer=Telit Cinterion
S:  Product=FE910
S:  SerialNumber=f71b8b32
C:  #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host
E:  Ad=82(I) Atr=03(Int.) MxPS=   8 Ivl=32ms
I:  If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:  If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=84(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
I:  If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=86(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
I:  If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms

0x10c6: MBIM + tty (AT) + tty (AT) + tty (diag)
T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 11 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=1bc7 ProdID=10c6 Rev=05.15
S:  Manufacturer=Telit Cinterion
S:  Product=FE910
S:  SerialNumber=f71b8b32
C:  #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
E:  Ad=82(I) Atr=03(Int.) MxPS=  64 Ivl=32ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:  If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=84(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
I:  If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=86(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
I:  If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms

0x10c9: MBIM + tty (AT) + tty (diag) + DPL (Data Packet Logging) + adb
T:  Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 13 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=1bc7 ProdID=10c9 Rev=05.15
S:  Manufacturer=Telit Cinterion
S:  Product=FE910
S:  SerialNumber=f71b8b32
C:  #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
E:  Ad=82(I) Atr=03(Int.) MxPS=  64 Ivl=32ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:  If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=84(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
I:  If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:  If#= 4 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none)
E:  Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:  If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms

0x10cb: RNDIS + tty (AT) + tty (diag) + DPL (Data Packet Logging) + adb
T:  Bus=01 Lev=01 Prnt=01 Port=09 Cnt=01 Dev#=  9 Spd=480 MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs=  1
P:  Vendor=1bc7 ProdID=10cb Rev=05.15
S:  Manufacturer=Telit Cinterion
S:  Product=FE910
S:  SerialNumber=f71b8b32
C:  #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=500mA
I:  If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host
E:  Ad=82(I) Atr=03(Int.) MxPS=   8 Ivl=32ms
I:  If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
E:  Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:  If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E:  Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=84(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
I:  If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E:  Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:  If#= 4 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none)
E:  Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:  If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
E:  Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E:  Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms

Cc: stable@vger.kernel.org
Signed-off-by: Fabio Porcedda <fabio.porcedda@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2025-12-12 18:42:45 +01:00
Slark Xiao
99115ab00c USB: serial: option: add Foxconn T99W760 
commit 7970b4969c upstream.

T99W760 is designed based on Qualcomm SDX35 (5G redcap) chip. There are
three serial ports to be enumerated: Modem, NMEA and Diag.

test evidence as below:
T:  Bus=03 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#=  4 Spd=5000  MxCh= 0
D:  Ver= 3.20 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs=  1
P:  Vendor=0489 ProdID=e123 Rev=05.15
S:  Manufacturer=QCOM
S:  Product=SDXBAAGHA-IDP _SN:39A8D3E4
S:  SerialNumber=39a8d3e4
C:  #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=896mA
I:  If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
E:  Ad=82(I) Atr=03(Int.) MxPS=  64 Ivl=32ms
I:  If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E:  Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I:  If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E:  Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=84(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
I:  If#= 3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
E:  Ad=85(I) Atr=03(Int.) MxPS=  64 Ivl=32ms
I:  If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E:  Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=87(I) Atr=03(Int.) MxPS=  10 Ivl=32ms
I:  If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E:  Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E:  Ad=88(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms

0&1: MBIM, 2:Modem, 3:GNSS(non-serial port), 4: NMEA, 5:Diag

Signed-off-by: Slark Xiao <slark_xiao@163.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2025-12-12 18:42:45 +01:00
Omar Sandoval
53903ac9ca KVM: SVM: Don't skip unrelated instruction if INT3/INTO is replaced 
commit 4da3768e18 upstream.

When re-injecting a soft interrupt from an INT3, INT0, or (select) INTn
instruction, discard the exception and retry the instruction if the code
stream is changed (e.g. by a different vCPU) between when the CPU
executes the instruction and when KVM decodes the instruction to get the
next RIP.

As effectively predicted by commit 6ef88d6e36 ("KVM: SVM: Re-inject
INT3/INTO instead of retrying the instruction"), failure to verify that
the correct INTn instruction was decoded can effectively clobber guest
state due to decoding the wrong instruction and thus specifying the
wrong next RIP.

The bug most often manifests as "Oops: int3" panics on static branch
checks in Linux guests.  Enabling or disabling a static branch in Linux
uses the kernel's "text poke" code patching mechanism.  To modify code
while other CPUs may be executing that code, Linux (temporarily)
replaces the first byte of the original instruction with an int3 (opcode
0xcc), then patches in the new code stream except for the first byte,
and finally replaces the int3 with the first byte of the new code
stream.  If a CPU hits the int3, i.e. executes the code while it's being
modified, then the guest kernel must look up the RIP to determine how to
handle the #BP, e.g. by emulating the new instruction.  If the RIP is
incorrect, then this lookup fails and the guest kernel panics.

The bug reproduces almost instantly by hacking the guest kernel to
repeatedly check a static branch[1] while running a drgn script[2] on
the host to constantly swap out the memory containing the guest's TSS.

[1]: https://gist.github.com/osandov/44d17c51c28c0ac998ea0334edf90b5a
[2]: https://gist.github.com/osandov/10e45e45afa29b11e0c7209247afc00b

Fixes: 6ef88d6e36 ("KVM: SVM: Re-inject INT3/INTO instead of retrying the instruction")
Cc: stable@vger.kernel.org
Co-developed-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Omar Sandoval <osandov@fb.com>
Link: https://patch.msgid.link/1cc6dcdf36e3add7ee7c8d90ad58414eeb6c3d34.1762278762.git.osandov@fb.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2025-12-12 18:42:45 +01:00
Nikita Zhandarovich
877adccfac comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel() 
commit a51f025b50 upstream.

Syzbot identified an issue [1] in pcl818_ai_cancel(), which stems from
the fact that in case of early device detach via pcl818_detach(),
subdevice dev->read_subdev may not have initialized its pointer to
&struct comedi_async as intended. Thus, any such dereferencing of
&s->async->cmd will lead to general protection fault and kernel crash.

Mitigate this problem by removing a call to pcl818_ai_cancel() from
pcl818_detach() altogether. This way, if the subdevice setups its
support for async commands, everything async-related will be
handled via subdevice's own ->cancel() function in
comedi_device_detach_locked() even before pcl818_detach(). If no
support for asynchronous commands is provided, there is no need
to cancel anything either.

[1] Syzbot crash:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]
CPU: 1 UID: 0 PID: 6050 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:pcl818_ai_cancel+0x69/0x3f0 drivers/comedi/drivers/pcl818.c:762
...
Call Trace:
 <TASK>
 pcl818_detach+0x66/0xd0 drivers/comedi/drivers/pcl818.c:1115
 comedi_device_detach_locked+0x178/0x750 drivers/comedi/drivers.c:207
 do_devconfig_ioctl drivers/comedi/comedi_fops.c:848 [inline]
 comedi_unlocked_ioctl+0xcde/0x1020 drivers/comedi/comedi_fops.c:2178
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
...

Reported-by: syzbot+fce5d9d5bd067d6fbe9b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=fce5d9d5bd067d6fbe9b
Fixes: 00aba6e7b5 ("staging: comedi: pcl818: remove 'neverending_ai' from private data")
Cc: stable <stable@kernel.org>
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://patch.msgid.link/20251023141457.398685-1-n.zhandarovich@fintech.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2025-12-12 18:42:45 +01:00
Alice Ryhl
3428831264 rust_binder: fix race condition on death_list 
commit 3e0ae02ba8 upstream.

Rust Binder contains the following unsafe operation:

	// SAFETY: A `NodeDeath` is never inserted into the death list
	// of any node other than its owner, so it is either in this
	// death list or in no death list.
	unsafe { node_inner.death_list.remove(self) };

This operation is unsafe because when touching the prev/next pointers of
a list element, we have to ensure that no other thread is also touching
them in parallel. If the node is present in the list that `remove` is
called on, then that is fine because we have exclusive access to that
list. If the node is not in any list, then it's also ok. But if it's
present in a different list that may be accessed in parallel, then that
may be a data race on the prev/next pointers.

And unfortunately that is exactly what is happening here. In
Node::release, we:

 1. Take the lock.
 2. Move all items to a local list on the stack.
 3. Drop the lock.
 4. Iterate the local list on the stack.

Combined with threads using the unsafe remove method on the original
list, this leads to memory corruption of the prev/next pointers. This
leads to crashes like this one:

	Unable to handle kernel paging request at virtual address 000bb9841bcac70e
	Mem abort info:
	  ESR = 0x0000000096000044
	  EC = 0x25: DABT (current EL), IL = 32 bits
	  SET = 0, FnV = 0
	  EA = 0, S1PTW = 0
	  FSC = 0x04: level 0 translation fault
	Data abort info:
	  ISV = 0, ISS = 0x00000044, ISS2 = 0x00000000
	  CM = 0, WnR = 1, TnD = 0, TagAccess = 0
	  GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
	[000bb9841bcac70e] address between user and kernel address ranges
	Internal error: Oops: 0000000096000044 [#1] PREEMPT SMP
	google-cdd 538c004.gcdd: context saved(CPU:1)
	item - log_kevents is disabled
	Modules linked in: ... rust_binder
	CPU: 1 UID: 0 PID: 2092 Comm: kworker/1:178 Tainted: G S      W  OE      6.12.52-android16-5-g98debd5df505-4k #1 f94a6367396c5488d635708e43ee0c888d230b0b
	Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
	Hardware name: MUSTANG PVT 1.0 based on LGA (DT)
	Workqueue: events _RNvXs6_NtCsdfZWD8DztAw_6kernel9workqueueINtNtNtB7_4sync3arc3ArcNtNtCs8QPsHWIn21X_16rust_binder_main7process7ProcessEINtB5_15WorkItemPointerKy0_E3runB13_ [rust_binder]
	pstate: 23400005 (nzCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
	pc : _RNvXs3_NtCs8QPsHWIn21X_16rust_binder_main7processNtB5_7ProcessNtNtCsdfZWD8DztAw_6kernel9workqueue8WorkItem3run+0x450/0x11f8 [rust_binder]
	lr : _RNvXs3_NtCs8QPsHWIn21X_16rust_binder_main7processNtB5_7ProcessNtNtCsdfZWD8DztAw_6kernel9workqueue8WorkItem3run+0x464/0x11f8 [rust_binder]
	sp : ffffffc09b433ac0
	x29: ffffffc09b433d30 x28: ffffff8821690000 x27: ffffffd40cbaa448
	x26: ffffff8821690000 x25: 00000000ffffffff x24: ffffff88d0376578
	x23: 0000000000000001 x22: ffffffc09b433c78 x21: ffffff88e8f9bf40
	x20: ffffff88e8f9bf40 x19: ffffff882692b000 x18: ffffffd40f10bf00
	x17: 00000000c006287d x16: 00000000c006287d x15: 00000000000003b0
	x14: 0000000000000100 x13: 000000201cb79ae0 x12: fffffffffffffff0
	x11: 0000000000000000 x10: 0000000000000001 x9 : 0000000000000000
	x8 : b80bb9841bcac706 x7 : 0000000000000001 x6 : fffffffebee63f30
	x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000000
	x2 : 0000000000004c31 x1 : ffffff88216900c0 x0 : ffffff88e8f9bf00
	Call trace:
	 _RNvXs3_NtCs8QPsHWIn21X_16rust_binder_main7processNtB5_7ProcessNtNtCsdfZWD8DztAw_6kernel9workqueue8WorkItem3run+0x450/0x11f8 [rust_binder bbc172b53665bbc815363b22e97e3f7e3fe971fc]
	 process_scheduled_works+0x1c4/0x45c
	 worker_thread+0x32c/0x3e8
	 kthread+0x11c/0x1c8
	 ret_from_fork+0x10/0x20
	Code: 94218d85 b4000155 a94026a8 d10102a0 (f9000509)
	---[ end trace 0000000000000000 ]---

Thus, modify Node::release to pop items directly off the original list.

Cc: stable@vger.kernel.org
Fixes: eafedbc7c0 ("rust_binder: add Rust Binder driver")
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
Acked-by: Miguel Ojeda <ojeda@kernel.org>
Link: https://patch.msgid.link/20251111-binder-fix-list-remove-v1-1-8ed14a0da63d@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2025-12-12 18:42:45 +01:00
Alexey Nepomnyashih
5cad18e527 ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() 
commit 0cd8feea87 upstream.

Fix a race between inline data destruction and block mapping.

The function ext4_destroy_inline_data_nolock() changes the inode data
layout by clearing EXT4_INODE_INLINE_DATA and setting EXT4_INODE_EXTENTS.
At the same time, another thread may execute ext4_map_blocks(), which
tests EXT4_INODE_EXTENTS to decide whether to call ext4_ext_map_blocks()
or ext4_ind_map_blocks().

Without i_data_sem protection, ext4_ind_map_blocks() may receive inode
with EXT4_INODE_EXTENTS flag and triggering assert.

kernel BUG at fs/ext4/indirect.c:546!
EXT4-fs (loop2): unmounting filesystem.
invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:ext4_ind_map_blocks.cold+0x2b/0x5a fs/ext4/indirect.c:546

Call Trace:
 <TASK>
 ext4_map_blocks+0xb9b/0x16f0 fs/ext4/inode.c:681
 _ext4_get_block+0x242/0x590 fs/ext4/inode.c:822
 ext4_block_write_begin+0x48b/0x12c0 fs/ext4/inode.c:1124
 ext4_write_begin+0x598/0xef0 fs/ext4/inode.c:1255
 ext4_da_write_begin+0x21e/0x9c0 fs/ext4/inode.c:3000
 generic_perform_write+0x259/0x5d0 mm/filemap.c:3846
 ext4_buffered_write_iter+0x15b/0x470 fs/ext4/file.c:285
 ext4_file_write_iter+0x8e0/0x17f0 fs/ext4/file.c:679
 call_write_iter include/linux/fs.h:2271 [inline]
 do_iter_readv_writev+0x212/0x3c0 fs/read_write.c:735
 do_iter_write+0x186/0x710 fs/read_write.c:861
 vfs_iter_write+0x70/0xa0 fs/read_write.c:902
 iter_file_splice_write+0x73b/0xc90 fs/splice.c:685
 do_splice_from fs/splice.c:763 [inline]
 direct_splice_actor+0x10f/0x170 fs/splice.c:950
 splice_direct_to_actor+0x33a/0xa10 fs/splice.c:896
 do_splice_direct+0x1a9/0x280 fs/splice.c:1002
 do_sendfile+0xb13/0x12c0 fs/read_write.c:1255
 __do_sys_sendfile64 fs/read_write.c:1323 [inline]
 __se_sys_sendfile64 fs/read_write.c:1309 [inline]
 __x64_sys_sendfile64+0x1cf/0x210 fs/read_write.c:1309
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x35/0x80 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x6e/0xd8

Fixes: c755e25135 ("ext4: fix deadlock between inline_data and ext4_expand_extra_isize_ea()")
Cc: stable@vger.kernel.org # v4.11+
Signed-off-by: Alexey Nepomnyashih <sdl@nppct.ru>
Message-ID: <20251104093326.697381-1-sdl@nppct.ru>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2025-12-12 18:42:45 +01:00
Giovanni Cabiddu
e983feaa79 crypto: zstd - fix double-free in per-CPU stream cleanup 
commit 48bc9da3c9 upstream.

The crypto/zstd module has a double-free bug that occurs when multiple
tfms are allocated and freed.

The issue happens because zstd_streams (per-CPU contexts) are freed in
zstd_exit() during every tfm destruction, rather than being managed at
the module level.  When multiple tfms exist, each tfm exit attempts to
free the same shared per-CPU streams, resulting in a double-free.

This leads to a stack trace similar to:

  BUG: Bad page state in process kworker/u16:1  pfn:106fd93
  page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106fd93
  flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff)
  page_type: 0xffffffff()
  raw: 0017ffffc0000000 dead000000000100 dead000000000122 0000000000000000
  raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
  page dumped because: nonzero entire_mapcount
  Modules linked in: ...
  CPU: 3 UID: 0 PID: 2506 Comm: kworker/u16:1 Kdump: loaded Tainted: G    B
  Hardware name: ...
  Workqueue: btrfs-delalloc btrfs_work_helper
  Call Trace:
   <TASK>
   dump_stack_lvl+0x5d/0x80
   bad_page+0x71/0xd0
   free_unref_page_prepare+0x24e/0x490
   free_unref_page+0x60/0x170
   crypto_acomp_free_streams+0x5d/0xc0
   crypto_acomp_exit_tfm+0x23/0x50
   crypto_destroy_tfm+0x60/0xc0
   ...

Change the lifecycle management of zstd_streams to free the streams only
once during module cleanup.

Fixes: f5ad93ffb5 ("crypto: zstd - convert to acomp")
Cc: stable@vger.kernel.org
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Suman Kumar Chakraborty <suman.kumar.chakraborty@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2025-12-12 18:42:45 +01:00
Alexander Sverdlin
396a9270a7 locking/spinlock/debug: Fix data-race in do_raw_write_lock 
commit c14ecb555c upstream.

KCSAN reports:

BUG: KCSAN: data-race in do_raw_write_lock / do_raw_write_lock

write (marked) to 0xffff800009cf504c of 4 bytes by task 1102 on cpu 1:
 do_raw_write_lock+0x120/0x204
 _raw_write_lock_irq
 do_exit
 call_usermodehelper_exec_async
 ret_from_fork

read to 0xffff800009cf504c of 4 bytes by task 1103 on cpu 0:
 do_raw_write_lock+0x88/0x204
 _raw_write_lock_irq
 do_exit
 call_usermodehelper_exec_async
 ret_from_fork

value changed: 0xffffffff -> 0x00000001

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 1103 Comm: kworker/u4:1 6.1.111

Commit 1a365e8223 ("locking/spinlock/debug: Fix various data races") has
adressed most of these races, but seems to be not consistent/not complete.

>From do_raw_write_lock() only debug_write_lock_after() part has been
converted to WRITE_ONCE(), but not debug_write_lock_before() part.
Do it now.

Fixes: 1a365e8223 ("locking/spinlock/debug: Fix various data races")
Reported-by: Adrian Freihofer <adrian.freihofer@siemens.com>
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@siemens.com>
Signed-off-by: Boqun Feng <boqun.feng@gmail.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Paul E. McKenney <paulmck@kernel.org>
Acked-by: Waiman Long <longman@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2025-12-12 18:42:45 +01:00
Qianchang Zhao
8229c6ca50 ksmbd: ipc: fix use-after-free in ipc_msg_send_request 
commit 1fab1fa091 upstream.

ipc_msg_send_request() waits for a generic netlink reply using an
ipc_msg_table_entry on the stack. The generic netlink handler
(handle_generic_event()/handle_response()) fills entry->response under
ipc_msg_table_lock, but ipc_msg_send_request() used to validate and free
entry->response without holding the same lock.

Under high concurrency this allows a race where handle_response() is
copying data into entry->response while ipc_msg_send_request() has just
freed it, leading to a slab-use-after-free reported by KASAN in
handle_generic_event():

  BUG: KASAN: slab-use-after-free in handle_generic_event+0x3c4/0x5f0 [ksmbd]
  Write of size 12 at addr ffff888198ee6e20 by task pool/109349
  ...
  Freed by task:
    kvfree
    ipc_msg_send_request [ksmbd]
    ksmbd_rpc_open -> ksmbd_session_rpc_open [ksmbd]

Fix by:
- Taking ipc_msg_table_lock in ipc_msg_send_request() while validating
  entry->response, freeing it when invalid, and removing the entry from
  ipc_msg_table.
- Returning the final entry->response pointer to the caller only after
  the hash entry is removed under the lock.
- Returning NULL in the error path, preserving the original API
  semantics.

This makes all accesses to entry->response consistent with
handle_response(), which already updates and fills the response buffer
under ipc_msg_table_lock, and closes the race that allowed the UAF.

Cc: stable@vger.kernel.org
Reported-by: Qianchang Zhao <pioooooooooip@gmail.com>
Reported-by: Zhitong Liu <liuzhitong1993@gmail.com>
Signed-off-by: Qianchang Zhao <pioooooooooip@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2025-12-12 18:42:44 +01:00
Deepanshu Kartikey
58df743faf ext4: refresh inline data size before write operations 
commit 892e1cf175 upstream.

The cached ei->i_inline_size can become stale between the initial size
check and when ext4_update_inline_data()/ext4_create_inline_data() use
it. Although ext4_get_max_inline_size() reads the correct value at the
time of the check, concurrent xattr operations can modify i_inline_size
before ext4_write_lock_xattr() is acquired.

This causes ext4_update_inline_data() and ext4_create_inline_data() to
work with stale capacity values, leading to a BUG_ON() crash in
ext4_write_inline_data():

  kernel BUG at fs/ext4/inline.c:1331!
  BUG_ON(pos + len > EXT4_I(inode)->i_inline_size);

The race window:
1. ext4_get_max_inline_size() reads i_inline_size = 60 (correct)
2. Size check passes for 50-byte write
3. [Another thread adds xattr, i_inline_size changes to 40]
4. ext4_write_lock_xattr() acquires lock
5. ext4_update_inline_data() uses stale i_inline_size = 60
6. Attempts to write 50 bytes but only 40 bytes actually available
7. BUG_ON() triggers

Fix this by recalculating i_inline_size via ext4_find_inline_data_nolock()
immediately after acquiring xattr_sem. This ensures ext4_update_inline_data()
and ext4_create_inline_data() work with current values that are protected
from concurrent modifications.

This is similar to commit a54c4613da ("ext4: fix race writing to an
inline_data file while its xattrs are changing") which fixed i_inline_off
staleness. This patch addresses the related i_inline_size staleness issue.

Reported-by: syzbot+f3185be57d7e8dda32b8@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=f3185be57d7e8dda32b8
Cc: stable@kernel.org
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Message-ID: <20251020060936.474314-1-kartikey406@gmail.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2025-12-12 18:42:44 +01:00
Ye Bin
aa1703f3f7 jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted 
commit 986835bf4d upstream.

There's issue when file system corrupted:
------------[ cut here ]------------
kernel BUG at fs/jbd2/transaction.c:1289!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 5 UID: 0 PID: 2031 Comm: mkdir Not tainted 6.18.0-rc1-next
RIP: 0010:jbd2_journal_get_create_access+0x3b6/0x4d0
RSP: 0018:ffff888117aafa30 EFLAGS: 00010202
RAX: 0000000000000000 RBX: ffff88811a86b000 RCX: ffffffff89a63534
RDX: 1ffff110200ec602 RSI: 0000000000000004 RDI: ffff888100763010
RBP: ffff888100763000 R08: 0000000000000001 R09: ffff888100763028
R10: 0000000000000003 R11: 0000000000000000 R12: 0000000000000000
R13: ffff88812c432000 R14: ffff88812c608000 R15: ffff888120bfc000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f91d6970c99 CR3: 00000001159c4000 CR4: 00000000000006f0
Call Trace:
 <TASK>
 __ext4_journal_get_create_access+0x42/0x170
 ext4_getblk+0x319/0x6f0
 ext4_bread+0x11/0x100
 ext4_append+0x1e6/0x4a0
 ext4_init_new_dir+0x145/0x1d0
 ext4_mkdir+0x326/0x920
 vfs_mkdir+0x45c/0x740
 do_mkdirat+0x234/0x2f0
 __x64_sys_mkdir+0xd6/0x120
 do_syscall_64+0x5f/0xfa0
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

The above issue occurs with us in errors=continue mode when accompanied by
storage failures. There have been many inconsistencies in the file system
data.
In the case of file system data inconsistency, for example, if the block
bitmap of a referenced block is not set, it can lead to the situation where
a block being committed is allocated and used again. As a result, the
following condition will not be satisfied then trigger BUG_ON. Of course,
it is entirely possible to construct a problematic image that can trigger
this BUG_ON through specific operations. In fact, I have constructed such
an image and easily reproduced this issue.
Therefore, J_ASSERT() holds true only under ideal conditions, but it may
not necessarily be satisfied in exceptional scenarios. Using J_ASSERT()
directly in abnormal situations would cause the system to crash, which is
clearly not what we want. So here we directly trigger a JBD abort instead
of immediately invoking BUG_ON.

Fixes: 470decc613 ("[PATCH] jbd2: initial copy of files from jbd")
Signed-off-by: Ye Bin <yebin10@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Message-ID: <20251025072657.307851-1-yebin@huaweicloud.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2025-12-12 18:42:44 +01:00
Bagas Sanjaya
a68b06bdc1 Documentation: process: Also mention Sasha Levin as stable tree maintainer 
commit ba2457109d upstream.

Sasha has also maintaining stable branch in conjunction with Greg
since cb5d21946d ("MAINTAINERS: Add Sasha as a stable branch
maintainer"). Mention him in 2.Process.rst.

Cc: stable@vger.kernel.org
Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
Reviewed-by: Randy Dunlap <rdunlap@infradead.org>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20251022034336.22839-1-bagasdotme@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 2025-12-12 18:42:44 +01:00
Linus Torvalds
7d0a66e4bb Linux 6.18 v6.18 2025-11-30 14:42:10 -08:00
Linus Torvalds
e69c7c1751 - Have timekeeping aux clocks sysfs interface setup function return an 
error code on failure instead of success
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmksJ6kACgkQEsHwGGHe
 VUqxARAAqEqj33/ErgPpytnpRkuJwGCGeSO879MMAoLTFpmALmoQZlqhA+WF1xYw
 T5QF7nGlBeW/GwFAVlm1riqI6iPk2iUZWczS9bq0wjtR0XNHReCqLGdRe+4DHEjb
 PtyXMrrQgq5FuvHaIkuSUxBKtyHn+KMObldxp2azpO8nfUubDSCCgw9aQfm2osHi
 JIldKOPdFKRv8uLnBBbI2A+6cFrqXr/ptAzx8C3hov7sN0jBODOitb7fNerEb+T4
 U5awKzpK3WzcilyrlEZMCFXRV5e3naTgnUDd8/7t9m0SA10K5oSIM1zggVLRWN8Z
 AA7XMpbRAl1S23GUVjSAM/vOMmaJJAuIMJ4ZXIKoTFVQJ3kenzY4GtDdObh05ID4
 971y0hXrko74Qq42oME4UHSKexcR4vIBwXC0J9g04EbtKQ/sm6uhoUlb2Xb/UfxR
 CPxzDqy1pFkjuMG49yu3JE2fUHOryiRcNUUgas2PBKjKG0KyZPcJWa/fRsk5LlLy
 oeUXx/hXOq6Nw0ydyzI7iJgAM5SbM4A5p/hxlWmQnfXJ2EQdmkORTmMkloaUvB7u
 vWaOd9I+D3iSzNaw4zP0kzgPRX70PCRn1qakT3zQ340c9vNT/lYQjRelK7gfYZF6
 HOBID2Pl3+pqUTfli6qxbXsgqH4hbCWSomDbY9t2AFK6h6K2l8Q=
 =CFYj
 -----END PGP SIGNATURE-----

Merge tag 'timers_urgent_for_v6.18_rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull timer fix from Borislav Petkov:

 - Have timekeeping aux clocks sysfs interface setup function return an
   error code on failure instead of success

* tag 'timers_urgent_for_v6.18_rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  timekeeping: Fix error code in tk_aux_sysfs_init()
 2025-11-30 08:47:10 -08:00
Linus Torvalds
6bda50f433 Fix TLB unification for cores with more than 64 TLB entries 
-----BEGIN PGP SIGNATURE-----
 
 iQJOBAABCAA4FiEEbt46xwy6kEcDOXoUeZbBVTGwZHAFAmkrXGMaHHRzYm9nZW5k
 QGFscGhhLmZyYW5rZW4uZGUACgkQeZbBVTGwZHAZ3w/5Adn6Wb0zk1MAtreYjumI
 VzERvDnfCqJE4SjJf11Fhe1TvT7RLElIUU612ILdPh5OCL0zyPT0PtvX6LlvLCzQ
 YRTCXXFtybi57rvPtlDIBh0bXcsQskAoGPExMzBJ6Re5oeeyI7qM5P9BV4eYsQD4
 tEM0RZKB0oPeUZ0p7Hq7F2xo1ZcJqFn14zAbf6ADHp+Xj1Kdal0FStTcLDMNdaKV
 QSZqxD26DZ7dCO9fEbDOO7Y/gdpLhPrN8q6rAexGlNwSFAqWWZ/1bY1a2b+oxcVN
 IyRqxhWwX6HTAzSab7VO/orT6HRCH3X50K7rXwEMGFhAjnyEcqRBhOiRDYtEJg87
 AamDQ2IPCkzeIi8UVnzoWDtszcSPs5eFW5LTBdhDCLCkt+UTnU0bi34jS/K6LCpJ
 HiQ7BbjM36nwqo8goe5Udz9KOcwZLW1+5DaSPT0yazZyxbUqp2lrKrk8Ie6SDIxt
 QLzDxAlN56lrxfd8MVDOWIrtf9LYcfdxwHsrT937Fwl/eCg+OdicTsGBfTlHHBDE
 pxTYDIu74lluAyyk1TqSBoeO/qqXLBIs4EIu5IjEqZ/SQmAPxFvP5l5mj38Uz3uP
 f99jxtUSsc2dttmkAMrTtrdouYoYaaA2XbGFkE0JJYVGWLO8oyrEagGn5OClfdqQ
 7jct1es16BKK85NWr8aUvu0=
 =8cjZ
 -----END PGP SIGNATURE-----

Merge tag 'mips-fixes_6.18_2' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux

Pull MIPS fix from Thomas Bogendoerfer:
 "Fix TLB unification for cores with more than 64 TLB entries"

* tag 'mips-fixes_6.18_2' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux:
  MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow
 2025-11-29 15:15:14 -08:00
Thomas Bogendoerfer
841ecc979b MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow 
Owing to Config4.MMUSizeExt and VTLB/FTLB MMU features later MIPSr2+
cores can have more than 64 TLB entries.  Therefore allocate an array
for uniquification instead of placing too an small array on the stack.

Fixes: 35ad7e1815 ("MIPS: mm: tlb-r4k: Uniquify TLB entries on init")
Co-developed-by: Maciej W. Rozycki <macro@orcam.me.uk>
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Cc: stable@vger.kernel.org # v6.17+: 9f048fa487: MIPS: mm: Prevent a TLB shutdown on initial uniquification
Cc: stable@vger.kernel.org # v6.17+
Tested-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Tested-by: Klara Modin <klarasmodin@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
 2025-11-29 13:36:05 +01:00
David Howells
19eef1d98e afs: Fix uninit var in afs_alloc_anon_key() 
Fix an uninitialised variable (key) in afs_alloc_anon_key() by setting it
to cell->anonymous_key.  Without this change, the error check may return a
false failure with a bad error number.

Most of the time this is unlikely to happen because the first encounter
with afs_alloc_anon_key() will usually be from (auto)mount, for which all
subsequent operations must wait - apart from other (auto)mounts.  Once the
call->anonymous_key is allocated, all further calls to afs_request_key()
will skip the call to afs_alloc_anon_key() for that cell.

Fixes: d27c712578 ("afs: Fix delayed allocation of a cell's anonymous key")
Reported-by: Paulo Alcantra <pc@manguebit.org>
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Paulo Alcantara <pc@manguebit.org>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: syzbot+41c68824eefb67cdf00c@syzkaller.appspotmail.com
cc: linux-afs@lists.infradead.org
cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
 2025-11-28 16:48:18 -08:00
Linus Torvalds
e664048784 spi: Fixes for v6.18 
A disappointingly large set of device specific fixes that have built up
 since I've been a bit tardy with sending a pull requests as people kept
 sending me new new fixes.  The bcm63xx and lpspi issues could lead to
 corruption so the fixes are fairly important for the affected parts, the
 other issues should all be relatively minor.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmkqFaIACgkQJNaLcl1U
 h9Cx4Af+N+WonkDRzn5iOEzu4dOFz4idB0mV2LkFwWgKaTXZ2G0YKwJqvWE9Yw1Z
 bxOYOmJYaZAms4qOPJJVbPm38NrkjEnRdca9+zBsyu3nuvo8QLCefgLbzgwfUFcF
 cy/9JPVdcOaI9yQsw0nfVa59NiddlnxWZM8iEbiUWkdG+Y6e6vkvs/iS0GutP39e
 XDrCLLyfzK70Pl7PwjNtSvVAQSxIuIB6Y08Q5/ck3tdQYW48Nvf48e5NIhKp/dO1
 ulIrtEYp9//pec/VRUAyNBT2JE/suDjHs+C3xeT9BLpzUlJEUq6e0yec8vtkrTiu
 S2a9nMpexxTPlu9kH31PecS/seRyHg==
 =8IkW
 -----END PGP SIGNATURE-----

Merge tag 'spi-fix-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi

Pull spi fixes from Mark Brown:
 "A disappointingly large set of device specific fixes that have built
  up since I've been a bit tardy with sending a pull requests as people
  kept sending me new new fixes.

  The bcm63xx and lpspi issues could lead to corruption so the fixes are
  fairly important for the affected parts, the other issues should all
  be relatively minor"

* tag 'spi-fix-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: nxp-fspi: Propagate fwnode in ACPI case as well
  spi: tegra114: remove Kconfig dependency on TEGRA20_APB_DMA
  spi: amlogic-spifc-a1: Handle devm_pm_runtime_enable() errors
  spi: spi-fsl-lpspi: fix watermark truncation caused by type cast
  spi: cadence-quadspi: Fix cqspi_probe() error handling for runtime pm
  spi: bcm63xx: fix premature CS deassertion on RX-only transactions
  spi: spi-cadence-quadspi: Remove duplicate pm_runtime_put_autosuspend() call
  spi: spi-cadence-quadspi: Enable pm runtime earlier to avoid imbalance
 2025-11-28 14:08:09 -08:00
Linus Torvalds
82ebd4e320 regulator: Fixes for v6.18 
A couple of fixes for incorrect device descriptions in the rtq2208
 driver.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmkqE5oACgkQJNaLcl1U
 h9ByEQf/elFORcnRnri/ZOd+QqtAsO/aUtWeooGtavmayLiQEGESqjs/n0Zjb3fQ
 Ajo1eUD2h11C+gEY4GTQr2iRG+/wksT5ogRB9B3TlOJ+MiQDkJsoZ4idv2UTeuqV
 zZueCTBV1Kt5oGVMgMC/4atRLNLackr5xqUkl8AZ2+szDK9MTA/VGhDmU5ao6dTd
 xgmXbEVGQTvOM8E+jXHEsnnHqyMIbuwXLUoDLVXvoiYww+yMqqvZCMdIqXT8Ue7W
 vtc0WZmXAZ8h4EUtD/WxVH0aq5qPJEYHy9lWNPRJs9KPdmxZ1O1eAsqEygTs0+fa
 zCdEKwIANV4cvkegX5Blf2qcv4L6Fg==
 =/5ra
 -----END PGP SIGNATURE-----

Merge tag 'regulator-fix-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator

Pull regulator fixes from Mark Brown:
 "A couple of fixes for incorrect device descriptions in the rtq2208
  driver"

* tag 'regulator-fix-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
  regulator: rtq2208: Correct LDO2 logic judgment bits
  regulator: rtq2208: Correct buck group2 phase mapping logic
 2025-11-28 14:06:05 -08:00
Linus Torvalds
9917bf8e7f io_uring-6.18-20251128 
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmkp+HsQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgphABEADEyBUKJZCpLX/l+Gx69QLtJ4lmBAQgSyPz
 RDHi6bUkH8UcsQXHHf04CDOuoUOCIbnM7EWS0zQZwX7Gq0o17POyumLvuqUsE4sA
 m+ma3RVGG0ZliF3/dGY4Nj+soUOiojuHQ4W2puB1uS5ebIgklbEfKH2/L7xyBOVD
 BqfIenjD6mIEnnFLCcsZsSXUbGhAuO4W8HILjrhYOloLVI045kSRiKGZqWih2Ixd
 d6CtNSuGbVWWeBHL746/XMyJqvo03lWYs9t/oh/FWRmfYvU8h4r91Iwwc/mgC1NY
 ArGa1iogdlwWZs4DlkREladeF70IbO9X/3CXOQUtRDNgu/5NSSFL4by+zPTopJV3
 VcDaiiCCcSM49V3lO574PWSgsXuFBtxL2MOQwoAI2PHVe2OBcNcfirfG/day8D5d
 ViW/OAoFnK2g7SsQsgwCTavNAxOrw1xyh7TRshdaX4RObekNTZpuVMue+hseazGl
 nuuBoWxQow0V26oUuCwWZh4CEbvAgykmDSMAH9ZqoB/NXfy22REtYaitPSWW/GNg
 NhtmRXc4zRL/ll7K21spOJkOqOpAVFwghQfys8mACZGOf5XYCQskZlUCJeAYRFzW
 5qTEaJJ20W9tw/xoLFWLdaWtYw4sU5zbAqtMYDHtG7E0vNBI5SxSkulLCBlw/iAS
 eE2BpBRZ4Q==
 =uvkM
 -----END PGP SIGNATURE-----

Merge tag 'io_uring-6.18-20251128' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull io_uring fixes from Jens Axboe:

 - Ensure that vectored registered buffer imports ties the lifetime of
   those to the zero-copy send notification, not the parent request

 - Fix a bug introduced in this merge window, with the introduction of
   mixed sized CQE support

* tag 'io_uring-6.18-20251128' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring: fix mixed cqe overflow handling
  io_uring/net: ensure vectored buffer node import is tied to notification
 2025-11-28 12:42:11 -08:00
Linus Torvalds
f3b17337b9 vfs-6.18-rc8.fixes 
-----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCaSmOegAKCRCRxhvAZXjc
 olHrAPwICALbFRDg/oj0kOFXEpUP2OrlCeKaZEMoxrKj1gZCUAEAzCATecAvZHZs
 ks1d77a0z9qMvQXxISws8ByNPueTMAA=
 =GH+q
 -----END PGP SIGNATURE-----

Merge tag 'vfs-6.18-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull vfs fixes from Christian Brauner:

 - afs: Fix delayed allocation of a cell's anonymous key

   The allocation of a cell's anonymous key is done in a background
   thread along with other cell setup such as doing a DNS upcall. The
   normal key lookup tries to use the key description on the anonymous
   authentication key as the reference for request_key() - but it may
   not yet be set, causing an oops

 - ovl: fail ovl_lock_rename_workdir() if either target is unhashed

   As well as checking that the parent hasn't changed after getting the
   lock, the code needs to check that the dentry hasn't been unhashed.
   Otherwise overlayfs might try to rename something that has been
   removed

 - namespace: fix a reference leak in grab_requested_mnt_ns

   lookup_mnt_ns() already takes a reference on mnt_ns, and so
   grab_requested_mnt_ns() doesn't need to take an extra reference

* tag 'vfs-6.18-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
  afs: Fix delayed allocation of a cell's anonymous key
  ovl: fail ovl_lock_rename_workdir() if either target is unhashed
  fs/namespace: fix reference leak in grab_requested_mnt_ns
 2025-11-28 10:01:24 -08:00
Linus Torvalds
7fa0d7744c soc: fixes for 6.18, part 4 
A few last minute fixes came in this week:
 
  - interrupt and gpio numbers in foud separate i.MX8 specific
    devicetree files were wrong.
 
  - The vector length property in the C906 CPU description
    used the wrong unit.
 
  - Two bugs with uninitialized stack variables in the tee
    subsystem.
 
  - Alexander Stein now maintains additional devicetree files.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmkp0T4ACgkQmmx57+YA
 GNlCyRAAkjpZqOwlAyx4w40U2GqlDQfE943/RG9/X8vASwgzIAvQ+0bhn+z2rR5R
 A2gtnKZwrKSaChEAUviDFbswdctyi1cuqwInSHEISUww8qW9Rvw3BZ1sieh5V3Ja
 r353W1feevroXqU0KO7ifkV86kB8rXnVB3o1v15/Ars2B0VJh+C9Wvpx/bvpF2QW
 SGRqRzJESoYh2E7LDjnzvas/WMkkv30CQPGV7A5OuVxJJQ1OgwSmg0yAUTCZlrxi
 evj74jCkMCEByTF2ExhEdIgJ/oWUyfiwkbMHW6FhmSRMVRV7pabnV2eoE1h2awgM
 e7Mi8T1ZjhkbKvmocHD29D5LA/CBXShMDy4omGBL59TEwHlkOzxBNFa5RKss/G6i
 BuEvH8Ko8146S5dXLXIFf9+wW5oTMVkSABr0DoAgC12NvQOkA4mtCaIApbKi8cKQ
 /GnLjdH5m1lmSVrNfJS1fgtOpd0p33aXsZbkh+vY5+qCqfpdPNb8KdHjRa4Lq1I0
 wcPNU0b2ZxolTa9+RiFJh2Chz0DytidmsoGDk5yJHVbg1ZtfWtp6gPz6iS6urcck
 bax8+Fh5n/k4lK3h4CDSo+DerBl0fnL6HB3vWwt6uqWiEoF2qq4lGTEhMWIP+NK+
 Xcz2LHzk4sfUdn51gqESLXuId/tSYpBQy+o6fgkWI0zY9DNo98Y=
 =D1Mu
 -----END PGP SIGNATURE-----

Merge tag 'soc-fixes-6.18-4' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

Pull SoC fixes from Arnd Bergmann:
 "A few last minute fixes came in this week:

   - interrupt and gpio numbers in foud separate i.MX8 specific
     devicetree files were wrong

   - The vector length property in the C906 CPU description used the
     wrong unit

   - Two bugs with uninitialized stack variables in the tee subsystem

   - Alexander Stein now maintains additional devicetree files"

* tag 'soc-fixes-6.18-4' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
  riscv: dts: allwinner: d1: fix vlenb property
  MAINTAINERS: Add entry for TQ-Systems AM335 device trees
  tee: qcomtee: initialize result before use in release worker
  arm64: dts: imx8qm-mek: fix mux-controller select/enable-gpios polarity
  tee: qcomtee: fix uninitialized pointers with free attribute
  ARM: dts: nxp: imx6ul: correct SAI3 interrupt line
  arm64: dts: imx8dxl-ss-conn: swap interrupts number of eqos
  arm64: dts: imx8dxl: Correct pcie-ep interrupt number
 2025-11-28 09:57:31 -08:00
Linus Torvalds
6cf62f0174 Char/Misc/IIO fixes for 6.18-rc8 
Here are some much-delayed char/misc/iio driver fixes for 6.18-rc8.
 
 Fixes in here include:
   - lots of iio driver bugfixes for reported issues.
   - counter driver bugfix
   - slimbus driver bugfix
   - mei tiny bugfix
   - nvmem layout uevent bugfix
 
 All of these have been in linux-next for a while, but due to travel on
 my side, I haven't had a chance to get them to you.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCaSnL1g8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ymUpACfaPn4EMLwg1fF60cmYoW0mr0RGg4An1xj6YB3
 evzxFzdPf6HwPPkxSOmx
 =3lRL
 -----END PGP SIGNATURE-----

Merge tag 'char-misc-6.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

Pull char / misc / IIO fixes from Greg KH:
 "Here are some much-delayed char/misc/iio driver fixes for 6.18-rc8.

  Fixes in here include:

   - lots of iio driver bugfixes for reported issues.

   - counter driver bugfix

   - slimbus driver bugfix

   - mei tiny bugfix

   - nvmem layout uevent bugfix

  All of these have been in linux-next for a while, but due to travel on
  my side, I haven't had a chance to get them to you"

* tag 'char-misc-6.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (23 commits)
  nvmem: layouts: fix nvmem_layout_bus_uevent
  iio: accel: bmc150: Fix irq assumption regression
  most: usb: fix double free on late probe failure
  slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves
  firmware: stratix10-svc: fix bug in saving controller data
  mei: fix error flow in probe
  iio: st_lsm6dsx: Fixed calibrated timestamp calculation
  iio: humditiy: hdc3020: fix units for thresholds and hysteresis
  iio: humditiy: hdc3020: fix units for temperature and humidity measurement
  iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields
  iio: accel: fix ADXL355 startup race condition
  iio: adc: ad7124: fix temperature channel
  iio:common:ssp_sensors: Fix an error handling path ssp_probe()
  iio: adc: ad7280a: fix ad7280_store_balance_timer()
  iio: buffer-dmaengine: enable .get_dma_dev()
  iio: buffer-dma: support getting the DMA channel
  iio: buffer: support getting dma channel from the buffer
  iio: pressure: bmp280: correct meas_time_us calculation
  iio: adc: stm32-dfsdm: fix st,adc-alt-channel property handling
  iio: adc: ad7380: fix SPI offload trigger rate
  ...
 2025-11-28 09:44:48 -08:00
Linus Torvalds
dabf127d64 Serial driver fixes for 6.18-rc8 
Here are 2 serial driver fixes for reported issues for 6.18-rc8.
 
 These are:
   - fix for a much reported symbol build loop that broke the build for
     some kernel configurations.
   - amba-pl011 driver bugfix for a reported issue
 
 Both have been in linux next (the last for weeks, the first for a
 shorter amount of time), with no reported issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCaSnMaw8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ymg5QCfeiPTQKjBjgltevx4QCaxVMyoo54AmwTVgjub
 iXAdo7xLL3tvpG1ubqgt
 =y3e3
 -----END PGP SIGNATURE-----

Merge tag 'tty-6.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

Pull serial driver fixes from Greg KH:
 "Here are two serial driver fixes for reported issues for 6.18-rc8.

  These are:

   - fix for a much reported symbol build loop that broke the build for
     some kernel configurations

   - amba-pl011 driver bugfix for a reported issue

  Both have been in linux next (the last for weeks, the first for a
  shorter amount of time), with no reported issues"

* tag 'tty-6.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  serial: 8250: Fix 8250_rsa symbol loop
  serial: amba-pl011: prefer dma_mapping_error() over explicit address checking
 2025-11-28 09:16:20 -08:00
Linus Torvalds
5d324e5159 USB/Thunderbolt fixes for 6.18-rc8 
Here are some last-minutes USB and Thunderbolt driver fixes and new
 device ids for 6.18-rc8.  Included in here are:
   - usb storage quirk fixup
   - xhci driver fixes for reported issues
   - usb gadget driver fixes
   - dwc3 driver fixes
   - UAS driver fixup
   - thunderbolt new device ids
   - usb-serial driver new ids
 
 All of these have been in linux-next with no reported issues, many for
 many weeks.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCaSnO0w8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ymqyACgvNvTnpfj8lx0L9aESj6Hra0UZ20AoKlYRFW1
 gAVcF4Wafnu7ehjAITXL
 =cH0/
 -----END PGP SIGNATURE-----

Merge tag 'usb-6.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB/Thunderbolt fixes from Greg KH:
 "Here are some last-minutes USB and Thunderbolt driver fixes and new
  device ids for 6.18-rc8. Included in here are:

   - usb storage quirk fixup

   - xhci driver fixes for reported issues

   - usb gadget driver fixes

   - dwc3 driver fixes

   - UAS driver fixup

   - thunderbolt new device ids

   - usb-serial driver new ids

  All of these have been in linux-next with no reported issues, many for
  many weeks"

* tag 'usb-6.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (21 commits)
  usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors
  USB: storage: Remove subclass and protocol overrides from Novatek quirk
  usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer
  usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths
  xhci: dbgtty: fix device unregister
  usb: storage: sddr55: Reject out-of-bound new_pba
  USB: serial: option: add support for Rolling RW101R-GL
  usb: typec: ucsi: psy: Set max current to zero when disconnected
  usb: gadget: f_eem: Fix memory leak in eem_unwrap
  usb: dwc3: pci: Sort out the Intel device IDs
  usb: dwc3: pci: add support for the Intel Nova Lake -S
  drivers/usb/dwc3: fix PCI parent check
  usb: storage: Fix memory leak in USB bulk transport
  xhci: sideband: Fix race condition in sideband unregister
  xhci: dbgtty: Fix data corruption when transmitting data form DbC to host
  xhci: fix stale flag preventig URBs after link state error is cleared
  USB: serial: ftdi_sio: add support for u-blox EVK-M101
  usb: cdns3: Fix double resource release in cdns3_pci_probe
  usb: gadget: udc: fix use-after-free in usb_gadget_state_work
  usb: renesas_usbhs: Fix synchronous external abort on unbind
  ...
 2025-11-28 09:12:40 -08:00
Linus Torvalds
24a84ea4ee omap: check for pending msgs only when mbox is exclusive 
mailbox-test: debugfs_create_dir error checking
 mtk: cmdq: fix DMA address handling
      gpueb: Add missing 'static' to mailbox ops struct
 pcc: don't zero error register
 th1520: fix clock imbalance on probe failure
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE6EwehDt/SOnwFyTyf9lkf8eYP5UFAmkpxWMACgkQf9lkf8eY
 P5UUdhAAmIWRSr8U16HdYYHZ32TCqsEn/cm38RRR9NyrYYTTTUIWwlh8S8ff0Ldh
 zuBWYzZuo4EocQOE1YVbKUM3hspgobcIJNg7hBVeMT8l6cD/Hmk0FKm4zDssyvWk
 XHC6AB3MLAVH8/n8c0NQn1mou0mOSEIFsOjnzikkkaDhKIJM14pnX5gIL8hG3kyV
 /B60QIkUCz7+3/OCQF42kQlG/l6D8m/FncK02rZcOyvPFbyiA3F/GhIrQ61dqKEm
 8iMP4+srLCek5UmL0LReFaiq69KJvKxqdaWD70o8mcC1a51MSnZAmwZSdSuFablf
 hOspEdBpxH2rBeMG/7bEvDZPpKRSvf6S9eI2d2oDK/9NusIjnmx4ryxanp+dknHS
 weEKI04VOEiFgByxBUbmB+xMman5q6AF98Mz+N/trp1yU/rxUFLvsUDO7jy2uQVn
 zXGNLPC+vW5SoLEYru6zdnJW+m0N/CWVEdz8+2ne+MHkRa+2IDHdfNDuTrFmd0J0
 /iWrAQXdMJ6BDkuYJNy16d4GLjkM2lp0K9w07ltezI7pHAQd3EPcMGXzB5BXAe+h
 CWh5oTicoAAaxKP0Ya8jYEI5c/vRbVLXdepOn/izcEy0+mE2ACqlQMrUbN4omgal
 t6c5L5/yJQsD8whS6Fio9cFLEj5esNFep38T7BuGrX9PSgVJFlc=
 =8o7Y
 -----END PGP SIGNATURE-----

Merge tag 'mailbox-fixes-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox

Pull mailbox fixes from Jassi Brar:

 - omap: check for pending msgs only when mbox is exclusive

 - mailbox-test: debugfs_create_dir error checking

 - mtk:
     - cmdq: fix DMA address handling
     - gpueb: Add missing 'static' to mailbox ops struct

 - pcc: don't zero error register

 - th1520: fix clock imbalance on probe failure

* tag 'mailbox-fixes-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox:
  mailbox: th1520: fix clock imbalance on probe failure
  mailbox: pcc: don't zero error register
  mailbox: mtk-gpueb: Add missing 'static' to mailbox ops struct
  mailbox: mtk-cmdq: Refine DMA address handling for the command buffer
  mailbox: mailbox-test: Fix debugfs_create_dir error checking
  mailbox: omap-mailbox: Check for pending msgs only when mbox is exclusive
 2025-11-28 09:09:33 -08:00
Arnd Bergmann
3ecfcf34f0 Allwinner fixes for 6.18 
Just one fix to correct the "thead,vlenb" property for the RISC-V based
 D1 SoC family.
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEE2nN1m/hhnkhOWjtHOJpUIZwPJDAFAmkluhoQHHdlbnNAa2Vy
 bmVsLm9yZwAKCRA4mlQhnA8kMAxAD/9mJbDwjSEg2ouGk6tXxXdnj8NS1qkmhbNu
 3Nwc882eMroH9CQ7uj63TadXH1UxtE/f/ZOERmnDaVjB5VFWRPuvrVYrF1XChkLF
 03D9PxDuFL2AghnWTYLiS3aAYEi65bphkBfbDFz4y0jZ1TZbzM1ePOf3K6Pq3QCq
 AC+HXxvvZw8QMRSOabHruGMTieTdJj6k5lTYKV04ZVEmgKMtp2Wz/IvYMFC9N7Nu
 PwX5+++ppP63Y/VdwLlpMJFRGcIWzC9uVdz5fYH9sHJyK/xlR11sE+n54DzvzlYl
 /JpEdgSspkJ0V4hbM5N2iTiVBZ3ufjrniyrQHVYOzOVEv6dtIVewOP+cuCxD60fa
 mpeCqaib5PZY+cLlhJTWzD9+s9hGsM6le99LLVM7nT96OKRsaKXm0zKjDN3YqZr/
 DCJMo0Ykz86z8AnOCDfb/HdYxRV4pizUP1BWFifom4OC4OybSe+6sQXDgddrWK48
 qVIEaFcd06RGw7dy2t+GmwSDxJThojKN7ayeuezhHQ99P4akapV/5rZAw4vezPdO
 b8EVyV40JsDltVcI/UHhhtcYIk3O1AxGGzK4hOUEMosb5JztS2ROGHHeTVn0A2w1
 IP99IlTNfyIaeEkopFAIMUNJXvzk5rd5fb0FmLZXpMtu2NtBdNM2+4SDripoxXB+
 X1XNyLZADg==
 =OqKr
 -----END PGP SIGNATURE-----

Merge tag 'sunxi-fixes-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into arm/fixes

Allwinner fixes for 6.18

Just one fix to correct the "thead,vlenb" property for the RISC-V based
D1 SoC family.

* tag 'sunxi-fixes-for-6.18' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux:
  riscv: dts: allwinner: d1: fix vlenb property
 2025-11-28 17:37:13 +01:00
Arnd Bergmann
a6737fe620 MAINTAINERS: Add entry for TQ-Systems AM335 device trees 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEe4dGDhaSf6n1v/EMWTcYmtP7xmUFAmkbWfwACgkQWTcYmtP7
 xmWF6A//ZxSOyanVt8NqIKqFmdOI7Duo7TgxGzXB7u4bTHHgG0rtGxPXBOcmZCZS
 0nT24q/VIZnyiS3zKC3PhUBf8oeOVdiHuKKgRhMgf/wYRWyUOOb6i6o+LdFlwqZz
 Y3LfWJbzEl0YihHzvqs5+/6viLCFKGapjWyowiIZmAGTIWCGhItLZCv+T6r8Ud/U
 q4+NmbUPtNP88PMuehQFkKbGtz6yPzY5UdHduKv9DazbcUi4it1EAFctn854NqKx
 dgkkqNRlKVXkZMoIS0kjymf2CiUtyImHmayPtd0nbEjCc8diGTX2NB5mZxR90FGz
 0LClAesX/urXo7AvT+Ho/Q6lTEnBbLB9hJRehvKHtOPbwvVNsnJSxrw7E5OkctDR
 VrwkBJnhLqdfoKUXicVIerMWph0GP/Qmvv6g/4LZFTIlOJKzp5pQZzykjg1wM7sx
 45oEdrmOB7vyj7GUqH8hp2ai4/TcZdTe8roXee4hCvW/C2PQe54TShL0hckrme/Q
 WO5efdHKOt352Q+iqwZREWmUDLRfEQE7MeqZihIYSITukXdLj/OJ0H+Pzd7mwNdL
 73QVyfa95Ki+rJMZlRlhpvIDhLRsOPS1Jj8M7ccvG4+AZTHZ8i79coQfD4uP4Dsw
 rMkFuHyyFl/ixLaKEOyeTPhryYQp1CNAxSqHJXQbvmHl+8+5PR0=
 =j5Wf
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmkpz6UACgkQmmx57+YA
 GNkUXBAAvsEa60LEtUxWJ7rBtnE416Xyf44UTbRd5yZwZEGTaewW9uqmjRp18V76
 lTtujB97UO6HVmKUnz2dHCsEvm1XntWoKHqzDv0/dKifZGczX1BVmcewxeg8jQVB
 Dk7GW/d2NMwwAwBuhH/fGj/AUW83IDC8GP8j/EIQWMJIxA+Jhw1oFtvwGGTrTy84
 R0QWISl3AQ2BiFemR44Y+UxKghellu368acaWeAnmvDNmLWrMKw9l4aWp9d48GJ9
 ZQ7UWEK8uvGnmxkn0SmLRqIYzz1Zw7RPyyAuLjOKB985sZ7WjiyMnIabnitof2Ah
 wfM0TrJQnl2VEDQ3PoHhmvo9+MCrV5Xmf1t829nkIwhy1EBNVPhIFdSPVZuzllHC
 nrSVlfp+u4G/ISstGSelzdeGAaH7J506jDcDhzIFw1jGX8CxjqS1j158gSK5tbsA
 pQzqRahS2hGr5l53CEWZFVL48yqclY+BqkDuTUCLhUni/uBghSpPZHhzgIddH4Ji
 7XTCXNLR3qLxTjfnuFE7ffMdsL/g5gUkmSf+7Wvrcz/uyPu+1gzas74gFQrmKmUM
 EIyKpimP1WPKjf9oO6h44S/ucQP4KZ+R1hTlOee9X0nyjggZg9KAJ3sj6VI5zZrx
 SajIonmQF78IjtPCcj2IyTTTO4jnLxqWhd4TrwL9x9qDpMxcJHY=
 =2aXH
 -----END PGP SIGNATURE-----

Merge tag 'omap-for-v6.19/maintainers-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap into arm/fixes

MAINTAINERS: Add entry for TQ-Systems AM335 device trees

* tag 'omap-for-v6.19/maintainers-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap:
  MAINTAINERS: Add entry for TQ-Systems AM335 device trees
 2025-11-28 17:36:52 +01:00
Linus Torvalds
4331989728 MMC host: 
- sdhci-of-dwcmshc: Fix reset handling for some variants
 -----BEGIN PGP SIGNATURE-----
 
 iQJLBAABCgA1FiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmkpoDEXHHVsZi5oYW5z
 c29uQGxpbmFyby5vcmcACgkQ/iaEJXNYjCma5Q/+IGd/TkBnzOeoaCBGX5xP9xWl
 oxowO9O5DvQe8xkjgQSR50SktRfV5A/jfNUqyiursdMothKNistjlnkUrBpl2R/f
 dHw71tKWcY4qtLi/mp8+9k4pTuym33mHVXexm9UWUE8HCG32xR2jbXGwengq/YCc
 bNLtSVgnaSSGCEs6iCSjHlIvwqdJ9tbXQljBPy1lXtpOiU6goELsCGo13rdyOU0t
 TWCmY3obNhGJCSSKzVlF6VF2nfxca41zeJKukcPiKi1Il7wIfEe+nG8PP0SLRtlQ
 bXJc2xKRjNC/SXyCC8T5Wn2/KOiuf0Fw1PmT7tPAdR8j2sO+4TPeCGmAy1eOtocI
 k4v+V3t37RGTQeO4T8N6e0VDND0swrBetG1KESyd5VmE8r4RZYybIuXNcopaCM92
 wsqlgQMJyuksuv3sfuf73g7V7Bbg4HpS4FqoVb2QHBDXOh8NrSD9Jb7zu47k0Oyw
 xHsFuw5qTzTnt/wDYKKT1vzvwKWB1EwkvvbF3unXc7mAaZIiZeyH+F7Z6gG0Iudo
 T92NMzObM2ndtSCVUKW2NEi29/A5mi3ibP+5XZpS3HfjIuIqaPckH1Ed6jmwFZ7V
 RwSgcpfaExYQTLVz/MWZVSoRLutUo7e0yxcLvum81i3u7/sw01NVzYBFNCjk3NL7
 5dtoGjSciapQk4FNGro=
 =5jmV
 -----END PGP SIGNATURE-----

Merge tag 'mmc-v6.18-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc

Pull MMC fix from Ulf Hansson:

 - sdhci-of-dwcmshc: Fix reset handling for some variants

* tag 'mmc-v6.18-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
  mmc: sdhci-of-dwcmshc: Promote the th1520 reset handling to ip level
 2025-11-28 08:20:14 -08:00
Linus Torvalds
f849f26f77 pmdomain providers: 
- mediatek: Fix spinlock recursion in probe
  - tegra: Use GENPD_FLAG_NO_STAY_ON to restore old behaviour
 -----BEGIN PGP SIGNATURE-----
 
 iQJLBAABCgA1FiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmkpnnwXHHVsZi5oYW5z
 c29uQGxpbmFyby5vcmcACgkQ/iaEJXNYjCmftBAAuVW8S8J+qHDsc7HPGAoGd9F8
 bzNLcXaBh1MeEcFBCtBsk1MWkBYqSufK+qZWBeTVrfE8dKKj61HQXGN3i+NGh0mE
 DLyscaD7E43DLMGNLRwRW04cuQjRTxOLfXGzSMp/SeDQXxmwvDvL4qIAGOkvQ93s
 WcNz7ThVFqpClYwaCPq+eC+oAVRucGQzFhIJrWAJD4pNeu97uFoHX+JQDUEuMhWO
 jSsno8eGIkzW5tahSZEvmI+M/VLjnLp48J5H+XdH6VHmgkw6F3TqQLfKh48zVQDh
 ACwyUr+lWMkcoZjZfjZ2kaePZ+9zQ7RqGrcxSUlX0kY0ZMEEpMEKAYndrPU5Engx
 7Y/XqLiamjhBvgSAN6NYnlQSyqLoWILoK7ivaVa3iakjaC4Hto4XopHbHOTp1Zsq
 ASRK9F4bLxwNeGQSiE1X0OngthvqOLBwancuUg71epq+YNZheWZi3ra8tALcSO1D
 SDQYAqD+yWEF2g1r0ZPdRvy2SzPnQhPu1QILsSNi1+XP+XGQySXZvFGB39+wqGZP
 ZZytlhLhWWhHvecVQc+6CLyc7COW7tvcsnk/8x/9oubUjCXMYXVzmlJoz9JThHhY
 DeZp77svDr7hy2WZ5Jn0v8ZdCXUoJxXKmKRuSXEts/wOPvNSWHJm+XPNO25RQSzn
 g+xxidSJf/oPiRX1/9I=
 =CrJQ
 -----END PGP SIGNATURE-----

Merge tag 'pmdomain-v6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm

Pull pmdomain fixes from Ulf Hansson:

 - mediatek: Fix spinlock recursion in probe

 - tegra: Use GENPD_FLAG_NO_STAY_ON to restore old behaviour

* tag 'pmdomain-v6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm:
  pmdomain: tegra: Add GENPD_FLAG_NO_STAY_ON flag
  pmdomains: mtk-pm-domains: Fix spinlock recursion in probe
 2025-11-28 08:08:02 -08:00
Johan Hovold
e3cee98f2f mailbox: th1520: fix clock imbalance on probe failure 
The purpose of the devm_add_action_or_reset() helper is to call the
action function in case adding an action ever fails so drop the clock
disable from the error path to avoid disabling the clocks twice.

Fixes: 5d4d263e1c ("mailbox: Introduce support for T-head TH1520 Mailbox driver")
Cc: Michal Wilczynski <m.wilczynski@samsung.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Michal Wilczynski <m.wilczynski@samsung.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
 2025-11-28 09:47:44 -06:00
Jamie Iles
ff0e4d4c97 mailbox: pcc: don't zero error register 
The error status mask for a type 3/4 subspace is used for reading the
error status, and the bitwise inverse is used for clearing the error
with the intent being to preserve any of the non-error bits.  However,
we were previously applying the mask to extract the status and then
applying the inverse to the result which ended up clearing all bits.

Instead, store the inverse mask in the preserve mask and then use that
on the original value read from the error status so that only the error
is cleared.

Fixes: c45ded7e11 ("mailbox: pcc: Add support for PCCT extended PCC subspaces(type 3/4)")
Signed-off-by: Jamie Iles <jamie.iles@oss.qualcomm.com>
Signed-off-by: Punit Agrawal <punit.agrawal@oss.qualcomm.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
 2025-11-28 09:31:53 -06:00
Nicolas Frattaroli
094b53ecaa mailbox: mtk-gpueb: Add missing 'static' to mailbox ops struct 
mtk_gpueb_mbox_ops should be declared static. However, due to its const
nature, this specifier was missed, as it compiled fine without it and
with no warning by the compiler.

arc-linux-gcc (GCC) 12.5.0 doesn't seem to like it however, so add the
static to fix that.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202510100629.3nGvrhEU-lkp@intel.com/
Fixes: dbca0eabb8 ("mailbox: add MediaTek GPUEB IPI mailbox")
Signed-off-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
 2025-11-28 09:31:53 -06:00
Jason-JH Lin
a195c7ccfb mailbox: mtk-cmdq: Refine DMA address handling for the command buffer 
GCE can only fetch the command buffer address from a 32-bit register.
Some SoCs support a 35-bit command buffer address for GCE, which
requires a right shift of 3 bits before setting the address into
the 32-bit register. A comment has been added to the header of
cmdq_get_shift_pa() to explain this requirement.

To prevent the GCE command buffer address from being DMA mapped beyond
its supported bit range, the DMA bit mask for the device is set during
initialization.

Additionally, to ensure the correct shift is applied when setting or
reading the register that stores the GCE command buffer address,
new APIs, cmdq_convert_gce_addr() and cmdq_revert_gce_addr(), have
been introduced for consistent operations on this register.

The variable type for the command buffer address has been standardized
to dma_addr_t to prevent handling issues caused by type mismatches.

Fixes: 0858fde496 ("mailbox: cmdq: variablize address shift in platform")
Signed-off-by: Jason-JH Lin <jason-jh.lin@mediatek.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
 2025-11-28 09:31:53 -06:00
Haotian Zhang
3acf1028f5 mailbox: mailbox-test: Fix debugfs_create_dir error checking 
The debugfs_create_dir() function returns ERR_PTR() on error, not NULL.
The current null-check fails to catch errors.

Use IS_ERR() to correctly check for errors.

Fixes: 8ea4484d0c ("mailbox: Add generic mechanism for testing Mailbox Controllers")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
 2025-11-28 09:31:52 -06:00
Beleswar Padhi
060e4e835f mailbox: omap-mailbox: Check for pending msgs only when mbox is exclusive 
On TI K3 devices, the mailbox resides in the Always-On power domain
(LPSC_main_alwayson) and is shared among multiple processors. The
mailbox is not solely exclusive to Linux.

Currently, the suspend path checks all FIFO queues for pending messages
and blocks suspend if any are present. This behavior is unnecessary for
K3 devices, since some of the FIFOs are used for RTOS<->RTOS
communication and are independent of Linux.

For FIFOs used in Linux<->RTOS communication, any pending message would
trigger an interrupt, which naturally prevents suspend from completing.
Hence, there is no need for the mailbox driver to explicitly check for
pending messages on K3 platforms.

Introduce a device match flag to indicate whether the mailbox instance
is exclusive to Linux, and skip the pending message check for
non-exclusive instances (such as in K3).

Fixes: a49f991e74 ("arm64: dts: ti: k3-am62-verdin: Add missing cfg for TI IPC Firmware")
Closes: https://lore.kernel.org/all/sid7gtg5vay5qgicsl6smnzwg5mnneoa35cempt5ddwjvedaio@hzsgcx6oo74l/
Signed-off-by: Beleswar Padhi <b-padhi@ti.com>
Tested-by: Hiago De Franco <hiago.franco@toradex.com>
Reviewed-by: Andrew Davis <afd@ti.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
 2025-11-28 09:31:52 -06:00
David Howells
d27c712578
 		afs: Fix delayed allocation of a cell's anonymous key 
The allocation of a cell's anonymous key is done in a background thread
along with other cell setup such as doing a DNS upcall.  In the reported
bug, this is triggered by afs_parse_source() parsing the device name given
to mount() and calling afs_lookup_cell() with the name of the cell.

The normal key lookup then tries to use the key description on the
anonymous authentication key as the reference for request_key() - but it
may not yet be set and so an oops can happen.

This has been made more likely to happen by the fix for dynamic lookup
failure.

Fix this by firstly allocating a reference name and attaching it to the
afs_cell record when the record is created.  It can share the memory
allocation with the cell name (unfortunately it can't just overlap the cell
name by prepending it with "afs@" as the cell name already has a '.'
prepended for other purposes).  This reference name is then passed to
request_key().

Secondly, the anon key is now allocated on demand at the point a key is
requested in afs_request_key() if it is not already allocated.  A mutex is
used to prevent multiple allocation for a cell.

Thirdly, make afs_request_key_rcu() return NULL if the anonymous key isn't
yet allocated (if we need it) and then the caller can return -ECHILD to
drop out of RCU-mode and afs_request_key() can be called.

Note that the anonymous key is kind of necessary to make the key lookup
cache work as that doesn't currently cache a negative lookup, but it's
probably worth some investigation to see if NULL can be used instead.

Fixes: 330e2c5148 ("afs: Fix dynamic lookup to fail on cell lookup failure")
Reported-by: syzbot+41c68824eefb67cdf00c@syzkaller.appspotmail.com
Signed-off-by: David Howells <dhowells@redhat.com>
Link: https://patch.msgid.link/800328.1764325145@warthog.procyon.org.uk
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
cc: linux-fsdevel@vger.kernel.org
Signed-off-by: Christian Brauner <brauner@kernel.org>
 2025-11-28 11:30:10 +01:00
NeilBrown
e9c70084a6
 		ovl: fail ovl_lock_rename_workdir() if either target is unhashed 
As well as checking that the parent hasn't changed after getting the
lock we need to check that the dentry hasn't been unhashed.
Otherwise we might try to rename something that has been removed.

Reported-by: syzbot+bfc9a0ccf0de47d04e8c@syzkaller.appspotmail.com
Fixes: d2c995581c ("ovl: Call ovl_create_temp() without lock held.")
Signed-off-by: NeilBrown <neil@brown.name>
Link: https://patch.msgid.link/176429295510.634289.1552337113663461690@noble.neil.brown.name
Tested-by: syzbot+bfc9a0ccf0de47d04e8c@syzkaller.appspotmail.com
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
 2025-11-28 10:42:32 +01:00
Linus Torvalds
e538109ac7 drm fixes for 6.18 final 
i915:
 - Reject async flips when PSR's selective fetch is enabled
 
 xe:
 - Fix resource leak in xe_guc_ct_init_noalloc()'s error path
 - Fix stack_depot usage without STACKDEPOT_ALWAYS_INIT
 - Fix overflow in conversion from clock tics to msec
 
 amdgpu:
 - Unified MES fix
 - HDMI fix
 - Cursor fix
 - Bightness fix
 - EDID reading improvement
 - UserQ fix
 - Cyan Skillfish IP discovery fix
 
 bridge:
 - sil902x: Fix HDMI detection
 
 imagination:
 - Update documentation
 
 sti:
 - Fix leaks in probe
 
 vga_switcheroo:
 - Avoid race condition during fbcon initialization
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmkpH74ACgkQDHTzWXnE
 hr47/xAAjPXx0uopgvf3arcu0qhPE5jeZbFiVZ9//kyuaG/UujjYLrA9ftgAlCSQ
 6iIQVsOfXeuM4VzNmHWg+CFiKVn8shFjvpYb3Fms6RuLhw3O3+8JGZKHinfVtpv4
 vakF56T1DuS9PvV6HEs6rDT266IbwUWAr6waraRDwsolsqsWXtnof8V7I1Px5MA4
 wQ49clDRN76tvP6K3fUdsaxla+Whdi80XMIs9/Cldr16JQr+NV7bo8zUK/cw0NsK
 lVcQq7i7LqkY2nUTVLBelw5N5dW0VwZBVoQbwjBYI6DKOCtwcRFyEJ8pluUu+TOw
 jhQj0zlTf8BsiIwvKcbr8RkCpLLepzY7iYitOCZ4nAQ1yEdMrz0960cUDhBhydFQ
 WqrXakR7EngI/ulMHj+Uw0bqHf6qNgcH41VD8Z1rsQKL5kzrZoGbwA3oOmav76bP
 QtVdhAFimZSsQnNr1ur0TTFjXSOqWLImXjBnbFZGibFOpwc8px5KgzeBi8E4hmKl
 +GhyO69hQcwnvwA2jMkr8sTZQ2Lom3o02K14uY3TvoPeclW6vVkLYODzG5Y/l1UU
 pn1O5U4O84VnwhlkULAoPSFmdSye3NUvaA2XTUqDFWOalZ9LmPYk1ggayC9PkffE
 yk/kvDpR3A9dVxZnWhEMW8MyItg0PSxYIa9+0syqsILGENBTf7s=
 =plBx
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2025-11-28' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "Last one for this round hopefully, mostly the usual suspects,
  xe/amdgpu, with some single fixes otherwise.

  There is one amdgpu HDMI blackscreen bug that came in late in the
  cycle, but it was bisected and the revert is in here.

  i915:
   - Reject async flips when PSR's selective fetch is enabled

  xe:
   - Fix resource leak in xe_guc_ct_init_noalloc()'s error path
   - Fix stack_depot usage without STACKDEPOT_ALWAYS_INIT
   - Fix overflow in conversion from clock tics to msec

  amdgpu:
   - Unified MES fix
   - HDMI fix
   - Cursor fix
   - Bightness fix
   - EDID reading improvement
   - UserQ fix
   - Cyan Skillfish IP discovery fix

  bridge:
   - sil902x: Fix HDMI detection

  imagination:
   - Update documentation

  sti:
   - Fix leaks in probe

  vga_switcheroo:
   - Avoid race condition during fbcon initialization"

* tag 'drm-fixes-2025-11-28' of https://gitlab.freedesktop.org/drm/kernel:
  drm/amdgpu: fix cyan_skillfish2 gpu info fw handling
  drm/amdgpu: attach tlb fence to the PTs update
  drm/amd/display: Increase EDID read retries
  drm/amd/display: Don't change brightness for disabled connectors
  drm/amd/display: Check NULL before accessing
  Revert "drm/amd/display: Move setup_stream_attribute"
  drm/xe: Fix conversion from clock ticks to milliseconds
  drm/xe/guc: Fix stack_depot usage
  drm/xe/guc: Fix resource leak in xe_guc_ct_init_noalloc()
  drm/i915/psr: Reject async flips when selective fetch is enabled
  drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup
  drm/amd/amdgpu: reserve vm invalidation engine for uni_mes
  drm: sti: fix device leaks at component probe
  drm/imagination: Document pvr_device.power member
  drm/bridge: sii902x: Fix HDMI detection with DRM_BRIDGE_ATTACH_NO_CONNECTOR
 2025-11-27 21:06:27 -08:00
Dave Airlie
6dbcb801e1 Driver Changes: 
- Fix resource leak in xe_guc_ct_init_noalloc()'s error path (Shuicheng Lin)
  - Fix stack_depot usage without STACKDEPOT_ALWAYS_INIT (Lucas)
  - Fix overflow in conversion from clock tics to msec (Harish Chegondi)
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE6rM8lpABPHM5FqyDm6KlpjDL6lMFAmko6kgACgkQm6KlpjDL
 6lO84A/6ArsDA9pMeWtk/GHQTL20ABV8LiSfrlC2VMum1agafXdIFZ2ookpyoKI8
 9nzNiFGQJT7V55psamWs25DI+LF//7vq4btNdYunzUk5p+LZOvYtx72MPhdCS4/F
 AfET4NXVtpcOTd+4Lro4zjfUZGB/qObMWRHQKAKXcr5vFhDUHpk1wQgnApKoL8uZ
 4G+GAVpDxW4bhagrNgQD0i6ZrwUWA1mJAyrTbwuYrQp1kZPCfZ7LIQEot+8rcNaB
 ZFKDjr2w2DIt/ue5yx3SLbVIuqZS8GOQMdVH7b6RVgpjEgqBcTQM3vKSt0KFC+71
 8wBs8D6SR+ZR5Guw2qvhobPfea/0pya7WP+8Nv678QnoIcAylMBG9bs5oyR9RoSB
 GNonR/WA69nhH20OEU6h5zjbvdsfo0ICFrBiUHH0njwpFDb9TdJ/LAzVCurvl29p
 gwUcc4v04YrG+Do/NSAH3esGDP2k5e//XD6bgkcZgGpO/Mx4AMHO1dmdtQav1PbY
 m8roRI2fo6TV+LHggLSp2zCP7CRq8t0h03g3Ufx1xDwg5oZ7PLz3ZHSz2LZCoavg
 i3AZtsHszJ3r/uXJePpvJK3qV1F3cv3QdwBl7M3rlrQgTymDsps0d4z8TrTeeI2w
 AUWd9pFunZvFvvQvKzbgfUr3Eq7/22jw4FQpyEpbi/vD1tU1b14=
 =ue6Q
 -----END PGP SIGNATURE-----

Merge tag 'drm-xe-fixes-2025-11-27' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes

Driver Changes:
 - Fix resource leak in xe_guc_ct_init_noalloc()'s error path (Shuicheng Lin)
 - Fix stack_depot usage without STACKDEPOT_ALWAYS_INIT (Lucas)
 - Fix overflow in conversion from clock tics to msec (Harish Chegondi)

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Lucas De Marchi <lucas.demarchi@intel.com>
Link: https://patch.msgid.link/7ejiqjgthpqybg5svmkind2pszk4fqadxuq7rngchaaw76iept@5pn6sngqj6lk
 2025-11-28 12:10:25 +10:00
Dave Airlie
26c7a181fd Short summary of fixes pull: 
bridge:
 - sil902x: Fix HDMI detection
 
 imagination:
 - Update documentation
 
 sti:
 - Fix leaks in probe
 
 vga_switcheroo:
 - Avoid race condition during fbcon initialization
 -----BEGIN PGP SIGNATURE-----
 
 iQFPBAABCgA5FiEEchf7rIzpz2NEoWjlaA3BHVMLeiMFAmkoBzEbFIAAAAAABAAO
 bWFudTIsMi41KzEuMTEsMiwyAAoJEGgNwR1TC3ojpPMIAKbDq6ttGcyskNpClupJ
 Owpq8wC8Qzy1fCKgrx2dj2bw2cfgtJTYZtbYo9/dFXnPrdQfo4LlLe3wI0inDe4V
 jvTkFm9SDARC4GGIpVnNgK/XYmp9DA+yJEzopojCnsToVJjvDrGKAsHnXBLK6gX2
 nL/fToNii8Lcae34HKmThg0Lq3o90Y1Aqfr2e3TyuxfctGYGcZ867NlpNOeUJEAe
 nJr+WXxlHL3497Y8d3rAlLrzOUYWT37Bq7y6p0SE3X7QCBtragKN+6AVSXUgfiCR
 tru+WuXdv2BMaBCO5rff1t2rYA7weVDNApcsMRlsFOkFBElogvaagRmOpZI2U2an
 YsE=
 =Jxlj
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-fixes-2025-11-27' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes

Short summary of fixes pull:

bridge:
- sil902x: Fix HDMI detection

imagination:
- Update documentation

sti:
- Fix leaks in probe

vga_switcheroo:
- Avoid race condition during fbcon initialization

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patch.msgid.link/20251127081007.GA13578@2a02-2454-fd5e-fd00-689d-32c0-780c-bb87.dyn6.pyur.net
 2025-11-28 12:04:20 +10:00
Dave Airlie
4fc3ad63dd amd-drm-fixes-6.18-2025-11-26: 
amdgpu:
 - Unified MES fix
 - HDMI fix
 - Cursor fix
 - Bightness fix
 - EDID reading improvement
 - UserQ fix
 - Cyan Skillfish IP discovery fix
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQgO5Idg2tXNTSZAr293/aFa7yZ2AUCaSdnEQAKCRC93/aFa7yZ
 2PbnAQCC2OddQOW3jcV0Y9a8qPZfJ+Wf9gWMs8D1x0KLfh0BmwD/e9X8CyVOABmH
 ymScHIJZhvAIKinOrnCcIF9Dij5/xgI=
 =pRN6
 -----END PGP SIGNATURE-----

Merge tag 'amd-drm-fixes-6.18-2025-11-26' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes

amd-drm-fixes-6.18-2025-11-26:

amdgpu:
- Unified MES fix
- HDMI fix
- Cursor fix
- Bightness fix
- EDID reading improvement
- UserQ fix
- Cyan Skillfish IP discovery fix

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Alex Deucher <alexander.deucher@amd.com>
Link: https://patch.msgid.link/20251126204925.3316684-1-alexander.deucher@amd.com
 2025-11-28 11:57:04 +10:00
Linus Torvalds
aa7243aaf1 dma-mapping fixes for Linux 6.18 
- two last minute fixes for the recently modified DMA API infrastructure:
 a proper handling of DMA_ATTR_MMIO in dma_iova_unlink() function (me) and
 a regression fix for the code refactoring related to P2PDMA (Pranjal
 Shrivastava)
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQSrngzkoBtlA8uaaJ+Jp1EFxbsSRAUCaSh6UAAKCRCJp1EFxbsS
 RCYGAP94GdoTEBmQL1dXLooASbHHAyB5xrd8Di1H/Aqd7maCvAEAgT2+BRPyEtf+
 wiz4mwKMG1RrF9Cj4XqPqJ2NDU1zdQ8=
 =ngH/
 -----END PGP SIGNATURE-----

Merge tag 'dma-mapping-6.18-2025-11-27' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux

Pull dma-mapping fixes from Marek Szyprowski:
 "Two last minute fixes for the recently modified DMA API infrastructure:

   - proper handling of DMA_ATTR_MMIO in dma_iova_unlink() function (me)

   - regression fix for the code refactoring related to P2PDMA (Pranjal
     Shrivastava)"

* tag 'dma-mapping-6.18-2025-11-27' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux:
  dma-direct: Fix missing sg_dma_len assignment in P2PDMA bus mappings
  iommu/dma: add missing support for DMA_ATTR_MMIO for dma_iova_unlink()
 2025-11-27 17:29:15 -08:00
Linus Torvalds
3fa77874b4 One more urgent ACPI support fix for 6.18 
There is one more commit that needs to be reverted after reverting
 problematic commit 7a8c994cbb ("ACPI: processor: idle: Optimize
 ACPI idle driver registration"), so revert it.
 -----BEGIN PGP SIGNATURE-----
 
 iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmkorhYSHHJqd0Byand5
 c29ja2kubmV0AAoJEO5fvZ0v1OO1HmQH/1mAIwpYlmtXtW8LmGuZsrvZx4PTl8OQ
 QyATMm/0+/gSWXYs79vLikwoRfT0rSEOdZcNk6AwdqeP2ciHLwCAzNnOE7vw80/s
 xo7yj1SswzEZDydEhbxqRFNsJ8hl5VCU7DdsScVtuDFb/vJ0GHkQEu1DsSFJQoSL
 CidC/2RCn0n5egOMdxL/GHemEbdUDGDXr2JilrcNLmcnnArN43+JqdiV8p102oSz
 i8ssS/LIMUMrIMZCuJA1298pZ6Ir1WWgaodyTOYDcmq3u25SSabF5WlS2u0KGgm/
 Ldgl6/lCuMxt+BBJ1r3uq9uHRAWeqY+DpHcZ7q1yFB+rOyRA9za5ERc=
 =X5FV
 -----END PGP SIGNATURE-----

Merge tag 'acpi-6.18-rc8-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull ACPI fix from Rafael Wysocki:
 "One more urgent ACPI support fix for 6.18

  There is one more commit that needs to be reverted after reverting
  problematic commit 7a8c994cbb ("ACPI: processor: idle: Optimize ACPI
  idle driver registration"), so revert it"

* tag 'acpi-6.18-rc8-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  Revert "ACPI: processor: Update cpuidle driver check in __acpi_processor_start()"
 2025-11-27 17:25:46 -08:00
Dave Airlie
b31e2e3bb7 - Reject async flips when PSR's selective fetch is enabled (Ville) 
-----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEbSBwaO7dZQkcLOKj+mJfZA7rE8oFAmknIDwACgkQ+mJfZA7r
 E8qZkQgAsLGliDOMLEw1hFrs+QSDy0uEXaKiIKSjnJ5xrJxFFtQB0a5MWPCEuzRb
 fgkCdIThW0JrCN8c00ayPS5lT9HbeTqcOMnh1PKchbfWrCSkVDns5A9rGQACgvpr
 r5IsgP7eRnyvkfykYXcCkAXk2EHrmn1N620MLsiOp88HnR5YPji3Fetho5Ba9Cx9
 KJfATrjJqn6hcRvhRydZJQ4dhdkMYjXtYMcHF3rkwiowRKReW7LpRgeONqIKfTeL
 40vYVvut1/XK5p82vELc8aZUxzdCQN+SEsezF7ycA5z5f/MJV5UPtw6Z+cB4bm0f
 dpQvqYpp2Lw+3NU633uPoN6IprDBgg==
 =j1e/
 -----END PGP SIGNATURE-----

Merge tag 'drm-intel-fixes-2025-11-26' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes

- Reject async flips when PSR's selective fetch is enabled (Ville)

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Rodrigo Vivi <rodrigo.vivi@intel.com>
Link: https://patch.msgid.link/aScgY8QMjmyJRBX2@intel.com
 2025-11-28 11:16:13 +10:00
Rafael J. Wysocki
fbf04215d9 Revert "ACPI: processor: Update cpuidle driver check in __acpi_processor_start()" 
Revert commit 8a1b5d412c ("ACPI: processor: Update cpuidle driver
check in __acpi_processor_start()") which depends on commit
7a8c994cbb ("ACPI: processor: idle: Optimize ACPI idle driver
registration") that got reverted.

Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
 2025-11-27 20:52:55 +01:00