mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-10 20:48:12 +00:00
1,485,070 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Linus Torvalds
|
a5ebb76233 |
- amd64_edac: Shorten the ErrorInformation field read from the MCA_SYND MSR to
only two bits. It is perfectly fine to do so because no system ever supported more than 2 bits of information (the Chip Selects used were only 4 maximum) and newer hardware will use only 2 bits anyway -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmrKvjAACgkQEsHwGGHe VUrXohAAkfpqZl6l2SOOyrDNEAX8VqhhuIlp/wV+xpWtP32AZWDb3xyjrUB+Vzxs aR68mt57xzEWDQY0ciwIDWrxPSydDIWBIG6xeHAJc6PcT9BhP406MZ19mmJGRS85 Yl5yYlqm2Ucr8UGCe2vlS+4/CU2nbnRsXC7OeOMbVEKm73E/0Auq0Za8N+45SwcN 5QoPt1ffZBL6MJMceX73uztwwvXoh68/jnVd4LjjF8w7JUoXuOa1m/tDosL3zDNR 4Oy+i5YOfXNQ96L4OS4nwLBuUdwH4psWcWOwAD3WN+10OBWtMxUIV5cJgwcB+oHm SL0J5TECPJtWRmzNBraqPnOW8hwMFLrT1KOxOaq/nO7D1T2K+2Hf8Wo1/btoQWqz jisRSfNbaGeDuiXAoZKsWf6AkVBMHb3eXPsNRCywXh13+oZ5BfMtojXBYD9BHQsy U9DGLNuecccCvVbMvqci3wj+nYNgWt5ZRkqT9HeIcnFSRc6kC7O3c40qNAtwl1Qj NbGKkfelAQRaJFaT7l1tPj4NlsanqL/J3sF+wV5HZShhiWkUmaT9Pr6NXXKzq7I+ eUO7ccDb7RaAdGTvK1V6Gl3oPaHa+o23qFvBSqKA6GGClwZpO3G8qwVSEoZHGtS1 L0wEC1bzN3I+C9Uq/SKyCuaefouvBQJGMGr0XhwZ8RRTFfISjnA= =F1H/ -----END PGP SIGNATURE----- Merge tag 'edac_urgent_for_v7.3_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC fix from Borislav Petkov: - amd64_edac: Shorten the ErrorInformation field read from the MCA_SYND MSR to only two bits. It is perfectly fine to do so because no system ever supported more than 2 bits of information (the Chip Selects used were only 4 maximum) and newer hardware will use only 2 bits anyway * tag 'edac_urgent_for_v7.3_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/amd64: Mask UMC chip select to the four implemented selects |
||
|
Linus Torvalds
|
bb934c29fd |
drm fixes for 7.3-rc7
fb: - defer setup when fbdev_probe() fails, not just on -EAGAIN bridge: - Fix unlocked list_del in drm_bridge_add() - Fix unlocked list access in drm_bridge_attach() - th1520-dw-hdmi: Fix error check on dw_hdmi_probe() return value - th1520-dw-hdmi: Fix remove() callback aspeed: - Balance the display clock enable on teardown i915: - Fix a GT park race that could trigger spurious RPM wakelock warnings - Fix execbuffer relocation cleanup to avoid out-of-bounds free xe: - i2c removal - system Controller Maibox header handling - two bo pin/unpin accounting bugs - not emitting a w/a twice - xe_mmio_wait32() to honor delay/sleep maximums amdgpu: - Fix direct scanout alpha on some DRM_FORMATs - UserQ fixes - Fix tearing flips with PSR - GPU reset vblank fix - Debugfs register interface fix - Fix display mode patching - Expand Mac reserved memory workaround amdkfd: - SDMA doorbell fix - Fix dma-buf reference leak in error path imagination: - fix reference and vm_bo handling in remap() - size page table preallocation by device address gud: - don't keep a connector without a CRTC as connector_state panthor: - validate userspace queue count against initialized firmware slot count nouveau: - fix null ptr regression - skip turing CE workaround for non-GR vmwgfx: - validate pitch value - add blend mode property vc4: - drain hangcheck timer on unbind - free BO cache on teardown - use kvmalloc_objs for bo cache size list - disable V3D interrupt across runtime suspend - fix binner slot allocation - fix fw refcount leak -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmrKj3sACgkQDHTzWXnE hr6e+A/+I1d+UvVkSnIsMv7NGLGiNvDClWvTnypF0ys2poiUGZ88UPzGuE7r8zfc BK9zZnQ/+LSYu/NLhmLnxDxYmx+Y2rKMjQEq22RsjUAzrPhn0/UsoWTt5jRMfim+ If9gW5p51rX4TBH90fgiTiwvAHxfSSzPjIlQIcjSAQKFxOIZ6mQtyKU4453H//XQ AO1fIDOvcUnZXyQCveoLtaU9ICKv5HNTwF4UBAnRfOmrJr/1ny2H51/tsFkh4Dwy h/OMyJDMNSfa/w9JZOGC/+fEipEQZ15Hk3QUy8i+UUEtD/JKFeG2nlNPuKqjjhrA slQa8E9M7anw+akPjJ0vWrOrqMXcxXE9huRWUUvv9MXkXpFjYmUeBTw1Q9Oc2No4 kdqmS9Skl6R/VJjeWeV2m/iNftL0k3CUWr2paCb9nGUOoaxdoMC72JVl7MprrSOT KG46ggDMfqhIygfkT+PBighZkMCJs/Fkw/UCM9Dldc3M3ds1VmQnH9I+1W+LUqjN OHT5FJfiabejImgnrPtPDtGJtZQub7K9ZUJc13GqxjCK3IXp1oqit8wVZS1qqmw7 3dpc+mWB0Re9CnlaOVb/WTzbip3WGlX8mdHrm+gKYHhigR5EjwiZSal7jP+fKYqK riXBBTU4CE44Y92lutvtJ4NjSqiShK/pzAkzPVVL8bCYoQAL4fk= =TKVJ -----END PGP SIGNATURE----- Merge tag 'drm-fixes-2026-10-11' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Ailie: "Live from Dublin Airport, it's Saturday Night drm fixes. This week has the missing misc fixes from last week which I tracked down and seemed to be a race/bug in my lei setup somehow, once I asked lei to ignore it's cache I got the missing email. But there are more misc fixes this week and amd and intel ones. The main ones in this are amdgpu and xe, with vc4, vmwgfx, nouveau and imagination in the middle, with a bunch of small single fixes. Bit busier than I'd like, but the missing misc might explain it, anyways time for me to fly home. fb: - defer setup when fbdev_probe() fails, not just on -EAGAIN bridge: - Fix unlocked list_del in drm_bridge_add() - Fix unlocked list access in drm_bridge_attach() - th1520-dw-hdmi: - Fix error check on dw_hdmi_probe() return value - Fix remove() callback aspeed: - Balance the display clock enable on teardown i915: - Fix a GT park race that could trigger spurious RPM wakelock warnings - Fix execbuffer relocation cleanup to avoid out-of-bounds free xe: - i2c removal - system Controller Maibox header handling - two bo pin/unpin accounting bugs - not emitting a w/a twice - xe_mmio_wait32() to honor delay/sleep maximums amdgpu: - Fix direct scanout alpha on some DRM_FORMATs - UserQ fixes - Fix tearing flips with PSR - GPU reset vblank fix - Debugfs register interface fix - Fix display mode patching - Expand Mac reserved memory workaround amdkfd: - SDMA doorbell fix - Fix dma-buf reference leak in error path imagination: - fix reference and vm_bo handling in remap() - size page table preallocation by device address gud: - don't keep a connector without a CRTC as connector_state panthor: - validate userspace queue count against initialized firmware slot count nouveau: - fix null ptr regression - skip turing CE workaround for non-GR vmwgfx: - validate pitch value - add blend mode property vc4: - drain hangcheck timer on unbind - free BO cache on teardown - use kvmalloc_objs for bo cache size list - disable V3D interrupt across runtime suspend - fix binner slot allocation - fix fw refcount leak" * tag 'drm-fixes-2026-10-11' of https://gitlab.freedesktop.org/drm/kernel: (39 commits) drm/nouveau: Skip the Turing CE workaround object for non-GR channels drm/vc4: Fix binner slot allocation failing on an idle GPU drm/vc4: Disable the V3D interrupt across runtime suspend drm/imagination: Size page table preallocation by device address drm/imagination: Fix reference and vm_bo handling in remap() drm/amdgpu: make Mac FB workaround generic drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info drm/amd/display: Don't replace a sink mode that shares the native totals drm/amdkfd: align SDMA doorbell base for shader doorbell writes drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks drm/amdgpu: serialize vblank counter reads against GPU reset drm/amd/display: disable self-refresh on tearing flips drm/amdgpu/userq: return the memdup_user() error for the user MQD drm/amdgpu/userq: only accept doorbell BOs as queue doorbell drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs drm/xe/i2c: cancel the client work on remove drm/xe/sysctrl: Fix mailbox header handling drm/i915/gt: Unmask interrupts only when ACTIVE is true drm/i915/gem: Prevent overstepping exec array boundary drm/gud: don't keep a connector without a CRTC as connector_state ... |
||
|
Linus Torvalds
|
b62f58bd71 |
i2c-fixes for v7.3-rc7
qcom-geni: fix runtime PM reference leak on xfer -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQScDfrjQa34uOld1VLaeAVmJtMtbgUCasoNSwAKCRDaeAVmJtMt bvJNAQDmm2Rj8dyCOMlm6pNRJv8Wh6CpydUbmTbko/GRMsBWiAEAsPiRtXC07Z+w GrOIQdIVrKCPiShnW0ajDufnMZjDpg4= =i2NX -----END PGP SIGNATURE----- Merge tag 'i2c-fixes-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux Pull i2c fix from Andi Shyti: "Just one qcom-geni fix for a runtime PM reference leak during transfer setup" * tag 'i2c-fixes-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux: i2c: qcom-geni: release runtime PM reference when set_rate fails |
||
Dave Airlie
|
c61e23ed14 |
A pointer assignment fix for gud, a reference fix and a preallocation
size fix for imagination, a suspend fix and an allocation fix when idle for vc4, and a hardware variant fix for nouveau. -----BEGIN PGP SIGNATURE----- iJUEABMJAB0WIQTkHFbLp4ejekA/qfgnX84Zoj2+dgUCasjkYwAKCRAnX84Zoj2+ dpu/AX0QwkYdn5r75S9Nsud12AGxs68MQYdf9O/JnsJYO5+Y5L078rTScygmDnvT civ/Y3ABgIhqXI1I/vXtyC7T+REXa47Gpll+ZVtw2FLj7c9czWjgr2iHIqXpn8pK 3A7y86s0kA== =YUdz -----END PGP SIGNATURE----- Merge tag 'drm-misc-fixes-2026-10-09' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes A pointer assignment fix for gud, a reference fix and a preallocation size fix for imagination, a suspend fix and an allocation fix when idle for vc4, and a hardware variant fix for nouveau. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maxime Ripard <self@mripard.dev> Link: https://patch.msgid.link/asjkbknTHg2t8JGy@houat |
||
|
Dave Airlie
|
492c4ded0f |
amd-drm-fixes-7.3-2026-10-08:
amdgpu: - Fix direct scanout alpha on some DRM_FORMATs - UserQ fixes - Fix tearing flips with PSR - GPU reset vblank fix - Debugfs register interface fix - Fix display mode patching - Expand Mac reserved memory workaround amdkfd: - SDMA doorbell fix - Fix dma-buf reference leak in error path -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQQgO5Idg2tXNTSZAr293/aFa7yZ2AUCasfVFQAKCRC93/aFa7yZ 2Nf6AP0T/qzbqO519Aih3Zr1Y8rETWjQ38fCoDbojom9/tzAoQD9HgNQkNvkO+fK R4uCeUzG91tnJK2Yuzv+WzWIbLQrdAA= =Ptpq -----END PGP SIGNATURE----- Merge tag 'amd-drm-fixes-7.3-2026-10-08' of https://gitlab.freedesktop.org/drm/amdgpu/kernel into drm-fixes amd-drm-fixes-7.3-2026-10-08: amdgpu: - Fix direct scanout alpha on some DRM_FORMATs - UserQ fixes - Fix tearing flips with PSR - GPU reset vblank fix - Debugfs register interface fix - Fix display mode patching - Expand Mac reserved memory workaround amdkfd: - SDMA doorbell fix - Fix dma-buf reference leak in error path Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20261008174658.2506431-1-alexander.deucher@amd.com |
||
|
Dave Airlie
|
a8013cbe8d |
Fixes on:
- i2c removal (Fan) - system Controller Maibox header handling (Mallesh) - two bo pin/unpin accounting bugs (Thomas) - not emitting a w/a twice (Tvrtko) - xe_mmio_wait32() to honor delay/sleep maximums (Al\ an) -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEbSBwaO7dZQkcLOKj+mJfZA7rE8oFAmrHxFUACgkQ+mJfZA7r E8py7Qf+ODo88JXxsL6C62wpd4nNbYxxBxLGW0TLrmtveBm/2uLvQQInOJpkE/Ni awXUrW92CbJWN1cAxvrvrGQBO1NedkypCMxHgmfsiUmSmEpT34/KXLExn8A5Kddo m+VzMxHWavk0k4ELsullJlFSZbnTC3hwOZlK7tJ0HaKatEpH8uM8EQk3qZqGEnOM OjuQDLLyEF3MwwvSv+Y81oZLfeNHaJ6esjmSX4mccd3sxjmRa0dFPAjRaRzLa+2P A+cw3ep+cRBZSutNBhElWPJZTrRzgNBKkBnB05+FeIctcRNbhvUf23IiWlf2kWvg G4DkiE/m/G/RKO+/t0DNsiDcnIloGA== =610A -----END PGP SIGNATURE----- Merge tag 'drm-xe-fixes-2026-10-08' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Fixes on: - i2c removal (Fan) - system Controller Maibox header handling (Mallesh) - two bo pin/unpin accounting bugs (Thomas) - not emitting a w/a twice (Tvrtko) - xe_mmio_wait32() to honor delay/sleep maximums (Alan) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/asfEfgbIjs0GJ-RF@intel.com |
||
|
Linus Torvalds
|
3857c2fe54 |
pci-v7.3-fixes-4
-----BEGIN PGP SIGNATURE-----
iQJIBAABCgAyFiEEgMe7l+5h9hnxdsnuWYigwDrT+vwFAmrJDcMUHGJoZWxnYWFz
QGdvb2dsZS5jb20ACgkQWYigwDrT+vy3yg/+N0HQJ+3TmmVgLHpZryZnicIvr4Rk
aak7isoP1g2fCHXmNaHptm5bOWyGOJ3sPl8t6Z2JtNNqEO/Fz4bF2KNQkTtCnvRP
dB/j9deI2omhpIWpmOAaL6Z5nN3rbKz8OFxyQGQpkG83qS7M0jF0rpSLLhi6wyp+
EBDMkw03OK6iubvwaECJdwmdk1mkhjHnv04ONLZfq8DNJm7jFQYAui2nQ2Fw8lti
BZb8yY+CGW/PUpGgSmJOa2UERxNBKH78sSK218nsQ5M7oXU4rLzgjmKnyfIz1F6X
1Xqs2R7UzO1kosHpjqR9wSBIay5331g9fdSVYSiMcVXGbroxZZ9yzvgBTQABeaT8
jLo6l6Z/j8CQ5B9oq4nk8lAeZj661IMIQKyJcssbIvwv4Nq+5JHECr1n8loo9sTG
85r4n6nSSBXxQlg4EY+SVXTO5Rpf0QYz6CI0eIYeUU2oxlAhctJ+B2khBmSTgSzY
lw1XiQDOMgD1WDH/GN0pr/alvi90RMhj1s6dnVlYEiCF9FyAXR1zb8EpFZ0SsBm5
I28N/+QmlUw1hrdeRiYn1c+5asvCCqAx2OR3xlllU55CS7rsjXdOVnPUFe6xtH93
0Yi3KmH0uVl6X+WgWjGnLCWYIBR3DAE9lF8LzNlKMVSP+V6TfPvrnfNahuZvdK7H
NbraXi5qBPycGyw=
=fagl
-----END PGP SIGNATURE-----
Merge tag 'pci-v7.3-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci
Pull PCI fix from Bjorn Helgaas:
"This fixes some GPU initialization regressions caused by
|
||
|
Linus Torvalds
|
b71ccf604f |
MMC host:
- cavium-octeon|thunderx: Destroy slot platform devices on remove
- mtk-sd: Cancel request timeout work on remove
- sdhci-sprd: Disable runtime PM on remove
MEMSTICK:
- Wait for request completion before freeing card
- rtsx_usb_ms: Complete requests after eject instead of dropping them
-----BEGIN PGP SIGNATURE-----
iQJEBAABCgAuFiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmrI78UQHHVsZmhAa2Vy
bmVsLm9yZwAKCRD+JoQlc1iMKcd6D/4sm/MrbdE0d8Q9ceIV9BAfiQfETj4mo53Q
3uH07n9PSaxVIJotLvvjni5TmAiISqXm+ZyNb0VMn8Xz4piVOhaOY4vKaiiLM71B
bMaim5lLd/oc5IopvzaYgEz7hOV6NSbqMjlC31fBQhkEtD9f182/A0324LFAuE0T
H+VtnhxbExzCXbeeSCWQhERaWTG93csh9gTSS8W9kZzcTngEVly+vpZELTeJwhZl
sVfzFTIf7Jv3omeDfMfwWUgfYRHlBVvgjI0ZtgZbZzhWyLj8SOQXvqH/PKmn+mxx
UdrmJsrTCI0MmbJRnmOkxgD5t9KGmVPD8oS36BUGZ/6qYRs+bzCRqAN3n+kXHmV4
cYF6/YOUNVBIkJ9qPZZapySYI3YBlu9GgD+dMriAAc+Jt2jBlbNBqdzQScouCSx3
kjx50GiPC7HSwtf77Up3inJuVig7Qwut2BnEznhYgtv1AatNqZAzMLzx+ZB8M/Dw
kOQDkQNGeg+Lpmd2oqjtnHezdiR5b+H2Zc5U+I8lSMRZPmHn1yhE5KKAxkLdcTaJ
SUQN1Nn2cFiyef55apb03K2JHQS+Wh7xzDvbR4/rZ4VursJgNuRE9G0YmU+jJlrg
IlsGKFXRvTuub0E+MvQ57xLxo4CjG40J9wgPgygTldLb1aU2OJKUX/JzwBTMDTD1
AcrnwZub/g==
=42Y1
-----END PGP SIGNATURE-----
Merge tag 'mmc-v7.3-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc
Pull MMC/MEMSTICK fixes from Ulf Hansson:
"MMC host:
- cavium-octeon|thunderx: Destroy slot platform devices on remove
- mtk-sd: Cancel request timeout work on remove
- sdhci-sprd: Disable runtime PM on remove
MEMSTICK:
- Wait for request completion before freeing card
- rtsx_usb_ms: Complete requests after eject instead of dropping
them"
* tag 'mmc-v7.3-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
memstick: rtsx_usb_ms: complete requests after eject instead of dropping them
memstick: core: wait for request completion before freeing card
mmc: cavium-thunderx: destroy slot platform devices on remove
mmc: cavium-octeon: destroy slot platform devices on remove
mmc: sdhci-sprd: disable runtime PM on remove
mmc: mtk-sd: Cancel request timeout work on remove
|
||
|
Linus Torvalds
|
f7bec60381 |
[GIT PULL for v7.3-rc7] media fixes
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE+QmuaPwR3wnBdVwACF8+vY7k4RUFAmrJCqQACgkQCF8+vY7k 4RWu/w/+LBwsMO9VA1C16lAKROP5HwuSdumeNnsjNinZX4Tonmz7Y5L+Ru+9Jzcz WDpbNtJTNhMa2f+i1YhCPVxNp22mwuGaqNUm8xfipt9fuvwShPaTTzoNsEh7l3iT TwMt2G5Np0G1u0fiDaBESR30sKw6YfYR8nxhM3lP4FfK4M3GhkuDnaAtwzCHa1Dm 1M1J76kS6eUGT+BOJMy6qARhAD00zQgjk9HZDV56FmCsz2XdDh1hnOC11IvbRV+K spdU3TffnoU4FMWQQnqJHxJR/Btq72O0CmiHVPopHQFM9DA6eEBd0eUcXTieIjbb aFp04/z0EWlYuwEGPKvnAdmwiJfRgoMLgGTnyViZMV0KtGbXVHmEr4KhUjRNMvVl Vjz/9ehYEweiKwQhUuV+upaQeWyQzI9VNbkAr9KSXX81piyFAkzur4dXljf8qR/x KQUIyhyshcvgQ0upoVFZ2q23hq1s7hKGOmFKT6DZhXs0OySkYRbj/iFzQ4YyhBpJ qTMmFF+Edlg0CtVhST3QxZcYv7b97RG2pue+R2jX71xB25yq2MbebMmjKB8Vp5id AhsvlRY0Dyp1sPqPtfukERSoCgJ6UHKI6D7DqpqzUcIeLgVyBEAjri4jUCZxhvXn 9fzYX56K1IuEFUl64LrPAhejo0iQTsdKx/gBprQulzwsDp4QrX8= =M/y8 -----END PGP SIGNATURE----- Merge tag 'media/v7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fix from Mauro Carvalho Chehab: "A fix for em28xx unregister code affecting devices with FM radio support" * tag 'media/v7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: em28xx: use video_unregister_device for radio_dev |
||
|
Linus Torvalds
|
5f6ee187fa |
sound fixes for 7.3-rc7
A dozen of small fixes. All device-specific quirks or fixes, and nothing exciting is expected. - USB-audio and HD-audio quirks - HD-audio TAS2781 codec fix - ctxfi driver memory leak fix - ASoC AMD quirks - ASoC cs35l56 and adau1372 codec fixes -----BEGIN PGP SIGNATURE----- iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmrI71gOHHRpd2FpQHN1 c2UuZGUACgkQLtJE4w1nLE/doA//VzIL0NcwVlEduCcwTcfWRwGjn7QPPA0isbjy Z+2SDryLxx+JgnCf6tI86CcBjP7o4hWHX9pHXb3smy7862aoWAUt5r5LR2MCZNa0 Q6wGiqDcL3jhNdy5gE5KUzShtD3DWAXo4Pqv/urHyOBHjcGqa6HNAurja7tmFne6 5DkozkvxyP/CIUsOHltO+YRPzmI7OIrLGjC5lbuyhNHIzCOEyUHgKaVFzyr6Fwcz ansQpgOQxc+0VN/FEVI0rXqxG483pSP+M0Ao8Y+aWpSTG534dgw2oGC10M2G59uW p4MyHkkhMcy41ARMLWWlYmzCEbsleiBBUUqIhKIwOAWJRHksRHwRtmHmTpcJbAHZ E7HkRGw6WOyxo9KKeD0fdyxBIF5VIvqrumjreWu2dX9XNJDzrfJZMtkzB+rStqmQ KR7uctZvGgfFKOJ76ENYmeEaEVNFREGK531aGRgiqCvOEJ/naY3PT/V3f6BIDjp+ OmG1YFqkI2vbC+Vw49+ydiAbvLz/ulhsFRvlNGzZl829Gpn/cwnw1sBRW+2QoCzX 4a6ICUZ76NlsneiqI3yHCm87VyDPmY8Mn3V8UAbEapt6G5xirDjDClV3qHAn928A fRZ5YB4poD/ek143mp306ljnxx14nQZiFDowLAIbi5ZCIjv6cXMMw79wOe4yzOax 0xYNFXo= =at5l -----END PGP SIGNATURE----- Merge tag 'sound-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A dozen of small fixes. All device-specific quirks or fixes, and nothing exciting is expected. - USB-audio and HD-audio quirks - HD-audio TAS2781 codec fix - ctxfi driver memory leak fix - ASoC AMD quirks - ASoC cs35l56 and adau1372 codec fixes" * tag 'sound-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ASoC: amd: acp: Add more ACP7.0 match entries for Cirrus Logic parts ASoC: amd: acp: Add DMI override for ASUS EXPERTBOOK AM7406CKA ASoC: sdw_utils: Switch CS35L56/57/62/63 to use OT25 DAI ASoC: cs35l56: Add DAI for SDCA OT25 stream ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM ASoC: adau1372: fix invalid default state of output ASRC and DAC muxes ASoC: adau1372: allow sleepy powerdown GPIOs ASoC: amd: yc: Add DMI quirk for Acer Aspire Go 15 (AG15-21P) ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg3xxx (103c:8bfd) ALSA: hda/tas2781: Accept V1 calibration data without CRC ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers ALSA: hda/realtek: Add quirk for ASRock NUC BOX-358H ALSA: usb-audio: Add native DSD support for Cambridge Audio streamers |
||
|
Linus Torvalds
|
9a06d4b7c5 |
pmdomain providers:
- imx: Serialize power on/off across sibling domains for imx8m-blk-ctrl - rockchip: Fix a couple of errors during probe -----BEGIN PGP SIGNATURE----- iQJEBAABCgAuFiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmrI1PoQHHVsZmhAa2Vy bmVsLm9yZwAKCRD+JoQlc1iMKU1tEACaVeu6L1ug6LeHc+MFu14aaaB3QXOxhNPA Ls3csZknwHf1cGVnhR+ZsQ3ScBT5wC5mJtSZr0eiqCMALBZXy6J8ZNzAK97qgFdE m94lc1Kkr/7miuv1pJe8hNh3kyOzLZqG/jMDLdmMjdfKSf/8oICQ2d9+ZLLhqBMT IKgSNQQGj7d5AwDYpFRocgadrByC+ampCCi7z8xEgU3H9QANQhQPjOTyPDJ1CFV+ 7QFXGjfP2OuHKoYgUy2eAWK2gloImUVcalPjBT7OxG3ApSOZdiNNPFL0jzk0xg79 XA94iQ9vgWSVdUDaezLey1xXBRvn3XSXkHmh6Fr1feUhfseFWXYsiiNiKxfUDXjb FCQzjJT3ARn1vKu8q4359Y3nX1IG0ZYfdSCKFkcxmL8I2klB+hEkZp9jTZzwzcfT 8KlDiCN0a48Ag4EwZcc+A3DLCk3/GIlnnKeFnqty+kaJsPMyuGtANowItV9Cwfgu dM/AEe1tdDNAks+K2Y5c9wfgh2pKiHnzd2v7FS2kqvV/kKfFHoU8l8NqKUVSjpx+ hiGpCUGERDfDxgsT+HINuSjSG44i/KG7D16z6UtlKtDnOcUHPtZC9Jcvz7jm5Nup fbzrkQ55ZU/E5TxLnf0fCkghh5WnjH8UmCDlGEwlH4LQo1ho8ay0HLT/ur5dtLDM UoOGg5uPNA== =Q0z1 -----END PGP SIGNATURE----- Merge tag 'pmdomain-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain provider fixes from Ulf Hansson: - imx: Serialize power on/off across sibling domains for imx8m-blk-ctrl - rockchip: Fix a couple of errors during probe * tag 'pmdomain-v7.3-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: pmdomain: rockchip: don't ignore clock lookup errors on attach pmdomain: rockchip: fix clock leak on domain probe failure pmdomain: rockchip: propagate subdomain add errors pmdomain: imx8m-blk-ctrl: Serialize power on/off across sibling domains |
||
|
Linus Torvalds
|
c8d4256f10 |
dma-mapping fixes for Linux 7.3
Two more fixes for the corner cases in the DMA-mapping SWIOTLB code (Peng Fan and Marek Szyprowski). -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQSrngzkoBtlA8uaaJ+Jp1EFxbsSRAUCasjDHAAKCRCJp1EFxbsS RDWxAPoC3zN3Xr76mPqfCYJWLBYu5Onrf250WwuZgVd4wO8MAAEA42uamlDYtLFa iopG6/88zhUzQ2aVg2rcbmc+307UlAA= =XP5b -----END PGP SIGNATURE----- Merge tag 'dma-mapping-7.3-2026-10-09' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux Pull dma-mapping fixes from Marek Szyprowski: "Two more fixes for the corner cases in the DMA-mapping SWIOTLB code (Peng Fan and Marek Szyprowski)" * tag 'dma-mapping-7.3-2026-10-09' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: swiotlb: fix default_swiotlb_limit() for non-growable default pool iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in iommu_dma_map_phys |
||
|
Linus Torvalds
|
fc1c25014f |
fsverity fix for v7.3-rc7
Fix a regression from commit |
||
|
Linus Torvalds
|
f99005fbed |
vfs-7.3-rc7.fixes
Please consider pulling these changes from the signed vfs-7.3-rc7.fixes tag.
Thanks!
Christian
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCasilxwAKCRCRxhvAZXjc
ooQTAQD6awSrQcUIG0ca5hbowpn7sLi8kWGnmzf2yydKSyp3bwEAnpSQEw3BXUKH
0O7JEyZFL0VcMTTceSPKkKCqGg5nugI=
=Wc48
-----END PGP SIGNATURE-----
Merge tag 'vfs-7.3-rc7.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull vfs fixes from Christian Brauner:
"This contains fixes for the current development cycle.
All of them came out of a review of the mount code that started with a
bug report. The review modeled the corner cases of mount propagation,
unmounting and mount reference counting and turned up a lot of bugs.
Most of them years old. Most fixes come with a selftest.
- Rework connected mounts.
A mount that is unmounted together with its parent can stay
attached to the parent to keep its mountpoint covered. That happens
when the mountpoint is removed with rmdir(), unlink() or rename(),
when a detached tree is dissolved, and for locked mounts in any
umount that isn't synchronous, including the teardown of their
mount namespace. The parent then owns the child and drops it on its
own final mntput(). So any reference from the child's superblock
back to one of its ancestors becomes a cycle that is never freed.
A loop device backed by an image on a tmpfs and mounted on that
same tmpfs is enough. Remove the directory the tmpfs is mounted on
from the host, let the container's mount namespace exit, and the
loop device, the tmpfs and the filesystem on the loop device are
leaked for good. The same works with autofs, zram, ecryptfs,
binfmt_misc, fuse passthrough, zloop, a mass storage gadget and md,
and the selftests have reproducers for them. This has been possible
since v4.1. It is also why "put_mnt_ns(): leave mounts connected"
was reverted in -rc5. Keeping every mount of a dying mount
namespace connected made these cycles trivial to create.
Every unmounted mount is now detached from its parent. Where the
mountpoint has to stay covered the mount leaves a cover on the
parent instead, allocated together with the mount. A lookup on the
unmounted parent that hits a cover finds an empty immutable
directory or file on the private nullfs instance. Nothing leads
from a cover to another mount, so no unmounted mount owns another
one and no cycle can form.
This is visible to userspace. A formerly connected mount can no
longer be reached through its unmounted parent and ".." inside it
leads nowhere, as for every other lazily unmounted mount.
With that the private nullfs instance becomes reachable from
userspace, so it now refuses mounts on top, is mounted read-only,
and refuses fsnotify marks and file locks. Its inodes are shared by
every holder and a watch or a lock would otherwise reach across
users. may_decode_fh() now also decides its subtree check under a
single mount_lock hold, as a racing umount could otherwise let it
decode into what a locked child covered.
- umount:
* Don't silently unmount busy mounts.
Since v4.13 propagate_umount() takes down propagated copies of
the victim with children as long as each child is an overmount or
another copy of the victim, but propagate_mount_busy() only ever
checked copies without children or with just an overmount. A
container that moved a tree beneath its copy of a host mount lost
that tree from under its open file descriptor to a plain umount()
on the host. propagate_mount_busy() now applies the same rules,
walking each chain of copies once.
* Don't let a migrating task hide its reference from umount().
mnt_get_count() sums the per-cpu counters under mount_lock but
the mntget() and mntput() fast paths don't take it. A task that
takes a reference on a cpu the sum has already passed and drops
it after migrating to one the sum hasn't reached yet hides the
reference it held to begin with, and umount() succeeds with the
file still open. Gets and puts now live in separate per-cpu
counters and all puts are summed before all gets with a full
barrier in between, the way srcu_readers_active_idx_check() does
it. mntget() is unchanged and mntput() gains an smp_wmb().
* Check each submount for references right before unmounting it.
shrink_submounts() and mark_mounts_for_expiry() checked all their
victims up front. Unmounting the first could move a busy
overmount to where the next victim's propagated copy is looked up
and it was then unmounted without a check.
* Never expire a locked mount.
A shrinkable mount moved beneath a locked mount with
MOVE_MOUNT_BENEATH takes over the lock, and umount() of an
unlocked ancestor expired it and revealed what it covered. That
umount() now fails with EBUSY as it does for any other locked
child. A lazy umount still takes the whole tree.
- Overmounts and locked mounts:
* Unhash a dentry before detaching the mounts on it.
unlink(), rmdir() and rename() detach the mounts on the victim
but only d_delete() it once its inode is unlocked, a window that
includes an expedited RCU grace period. In between, a lookup from
a mount namespace in which the dentry is a mountpoint found it
hashed, positive and uncovered. Drop the dentry first, as
d_invalidate() already does.
* Don't reveal overmounted entries in refwalk.
A refwalk that had grabbed the dentry before the unlink never
rechecked it the way rcuwalk does with d_seq and mount_lock.
Without any artificial widening three walkers read the covered
file 27 times in a minute. step_into() now fails an unhashed
dentry marked DCACHE_CANT_MOUNT with -ESTALE and the walk is
retried.
* Keep covered mounts covered in OPEN_TREE_NAMESPACE.
Creating such a mount namespace only takes a user namespace and
the copy followed bind mount rules: no children without
AT_RECURSIVE and no unbindable mounts with it. An unprivileged
user could see what mounts covered in the source, such as the
parts of /proc and /sys that container runtimes mask. If the
caller doesn't own the source mount namespace a non-recursive
copy of a mount with something mounted below the requested
directory is now refused and a recursive copy includes unbindable
mounts, the way unshare() copies.
* Keep the lock on a mount that a propagated copy is moved beneath.
MNT_LOCKED moved to any mount that ended up beneath a locked
mount, propagated copies included. A host mount and umount on a
directory covered by a locked mount in a less privileged mount
namespace left that cover unlocked for the namespace's owner to
remove. Only mounts the caller places beneath take over the lock
now.
* Handle mount locking for automounts correctly. Which copies to
lock was decided by the mount namespace of the task that
triggered the automount. A task in a user namespace that
triggered one on a host mount through a file descriptor got the
host's own automount locked while its own copy stayed unlocked
and could have nosuid, nodev and noexec cleared. Use the owner of
the mount namespace the mount lands in.
- Use-after-free and crashes:
* Refuse an automount below a mount that is in no namespace.
The private clones overlayfs uses for its layers have the
MNT_NS_INTERNAL error pointer as their namespace, which
finish_automount() let through and count_mounts() dereferenced. A
fanotify filesystem mark on an overlayfs lower layer hands out
file descriptors on such a clone. With debugfs as the lower layer
opening "tracing" oopses with namespace_sem held for writing and
every mount operation on the system blocks from then on.
* Reset the old parent's ->overmount in mnt_change_mountpoint().
When propagate_umount() moved an overmount off a mount that a
file descriptor kept alive, MOVE_MOUNT_BENEATH through that
descriptor later followed the stale pointer into the freed
overmount.
* statmount() with STATMOUNT_BY_FD and pivot_root() read the parent
of a mount that may be unmounted and only held by a file
descriptor, while the parent's final mntput() can free it.
statmount() now reads it under mount_lock and pivot_root() first
checks that both mounts are in the caller's mount namespace.
* Queue a mount only once for mount notifications. A mount
reparented by one umount_tree() and taken down by the next under
the same namespace_sem hold, as in shrink_submounts(), was queued
twice. That cut the mounts queued in between out of notify_list
while it still pointed at them, and once they were freed every
later mount operation walked freed memory.
* Don't let a pseudo dentry become the root of a mount. A bind
mount of a bpf token file did that with a DCACHE_NORCU dentry,
which is freed without an RCU grace period while lockless path
walks may still look at it. Refuse to clone such a mount.
* Don't inherit MNT_UMOUNT in clone_mnt(). A bind mount of a lazily
unmounted nsfs or pidfs mount through its file descriptor started
out flagged as unmounted. Among other things __detach_mounts()
then dropped the namespace's reference on it, the mount outlived
its namespace and mount_setattr() through the descriptor read the
freed namespace. A recursive bind mount of such a mount also
copied the unmounted stack still attached to it. That now fails
with EINVAL, copying the mount itself still works.
* Remove the fsnotify marks of a mount namespace in free_mnt_ns()
instead of the RCU callback that frees the namespace, where
taking the group mutexes meant sleeping in softirq context.
- Propagation and copies:
* Keep a copied mount unbindable. Since v6.17 clone_mnt() didn't
copy the unbindable flag, so every mount namespace created with
CLONE_NEWNS had bindable copies of all unbindable mounts. This
had been fixed once before.
* Refuse MOVE_MOUNT_SET_GROUP on an unbindable mount. It made the
mount an unbindable slave, a state nothing else can produce, or
silently dropped the unbindable flag. CRIU applies MS_UNBINDABLE
after restoring sharing and isn't affected.
* Check a recursive bind mount for mount namespace loops.
Recursively bind mounting a tree from another mount namespace
could put a mount of a namespace's file inside that same
namespace, which then pins itself and all its mounts. Repeating
it leaks without limit, the reproducer took Shmem from 380 kB to
65916 kB. The copy is now checked with check_for_nsfs_mounts()
before it is grafted, as move_mount() does.
* Look at the topmost mount for a mount namespace file.
attach_recursive_mnt() never looked at the topmost mount of the
source's chain of overmounts. If that was the chain's only mount
namespace file an existing mount at a propagated destination got
buried below the root of the nsfs file where no path walk reaches
it.
* Don't put a mountpoint on a dentry that's being removed.
attach_recursive_mnt() makes a mountpoint of the source's root
without its inode lock, so a racing rmdir() of that directory
could leave a mount on it that nothing ever detaches.
d_set_mounted() now checks cant_mount() as well.
- nullfs:
* Take no inode lock for readdir of an immutable directory.
The root of every empty mount namespace is the same nullfs
directory and iterate_dir() held its i_rwsem across
->iterate_shared(). A reader whose buffer faults on a FUSE mount
of its own holds it for as long as its server wants, and with an
exclusive locker queued behind it every lookup that misses the
dcache, every create and every mount in that directory waits. One
user of an empty mount namespace stalls all others. Directories
with the new FOP_IMMUTABLE flag skip the lock.
* Refuse to reconfigure internal superblocks through fspick(),
MS_REMOUNT or the read-only remount that a synchronous umount()
of the root does. For nullfs only root in the initial user
namespace could do it, but the superblock is shared by every
mount namespace and the flags showed up in statfs() for all of
them.
* Don't update the access time on nullfs and refuse F_SET_RW_HINT
on an immutable inode.
- unshare: Free an nsproxy that was never installed with
nsproxy_free() when set_cred_ucounts() fails. put_nsproxy() dropped
active references that were never taken, which triggered a warning
and hid the caller's own namespaces from listns().
- Smaller changes: mount_setattr() checks the target before it walks
the tree to allocate peer group ids, unshare() puts the old
fs_struct before the old namespaces, dissolve_on_fput() drops the
file's reference to the tree itself, disconnect_mount() is
simplified and the documentation of the propagated unmount rule is
brought up to date"
* tag 'vfs-7.3-rc7.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (58 commits)
namespace: simplify disconnect_mount()
selftests/filesystems: test covered mounts
namespace: rework connected mounts
nullfs: add an empty immutable regular file
selftests/filesystems: check that reading the root of an empty mount namespace stalls nobody
selftests/filesystems: add a helper that holds a readdir in a page fault
readdir: take no inode lock on an immutable directory
nullfs: refuse file locks
fsnotify: let a filesystem refuse marks on its objects
namespace: nothing is mounted on or written through knullfs
namespace: keep the private nullfs instance in knullfs
fhandle: decide the subtree check under mount_lock
selftests/filesystems: check that an automount below an overlay layer is refused
selftests/filesystems: check the atime of the empty mount namespace root
selftests/filesystems: check that a lock lands on the right mount and stays
namespace: keep the lock on a mount that a propagated copy is moved beneath
namespace: never expire a locked mount
nullfs: don't update the access time
namespace: handle mount locking for automounts correctly
namespace: refuse an automount below a mount that is in no namespace
...
|
||
|
Linus Torvalds
|
9515f634db |
arm64 fixes for -rc7
- Fix PMU EL2 trap configuration for CPUs with an IMPDEF PMU.
- Fix kcov boot selftest failure by excluding our early IRQ entry code.
-----BEGIN PGP SIGNATURE-----
iQFEBAABCgAuFiEEPxTL6PPUbjXGY88ct6xw3ITBYzQFAmrH1N8QHHdpbGxAa2Vy
bmVsLm9yZwAKCRC3rHDchMFjNHG0CACV2EKHHOdY/g1+PA6NmNeWzVlFT0nczOSh
m/iF+SHdZ+ZcFdipKFQd5cMVpDyVubOvJjuvlFQYreM1AkNrbTqavYfHwbF8mmdF
iqSZIjimjPUBmAJtxlobgP1UPUypI6Chnu0GTnLohufaznEhVqBj97aaE3xyMe3F
muX6d5yybK+wUi/iNt+gnsDNnGS9nDv0/Az7lUeqE1kSFWISz0UQa/pyEDtm4XT9
kzaWsRuRiRNb86nxalA5lvGaZd+RRXtMkUGp0OB3TCgN5WyfgFf3QiSufcYS3RlN
aozeM3nZFaSU4XMH8Ce1XbUkfr1HNA18MgwMSzorjLMBs56PAvax
=Xwu1
-----END PGP SIGNATURE-----
Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
Pull arm64 fixes from Will Deacon:
"It finally seems to have calmed down on the arm64 fixes front, so
please pull these two straightforward fixes for -rc7. One fixes the
EL2 trap configuration for implementation-defined CPU PMU hardware
during boot and the other fixes a kcov selftest failure by excluding
our softirq early entry code:
- Fix PMU EL2 trap configuration for CPUs with an IMPDEF PMU
- Fix kcov boot selftest failure by excluding our early IRQ entry
code"
* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
arm64: irq: exclude the softirq stack switch from KCOV
arm64/boot: Don't set PMUv3p9 FGT2 bits without PMUv3
|
||
|
Linus Torvalds
|
af32da41b0 |
Including fixes from wireless, wireguard, CAN and Bluetooth.
We have one known regression to wrap up in VLAN handling.
Current release - regressions:
- Bluetooth: RFCOMM: fix deadlock on rfcomm_mutex
Previous releases - regressions:
- can: fix regression in handling RPS after migrating metadata to skb_ext
- eth: iavf: fix regressions in reconfig impacting bonding
- eth: mana: fix packet forwarding performance regression
- eth: stmmac: remove buggy VLAN acceleration support
Previous releases - always broken:
- a few high prio fixes for tun, and af_packet
- amt: fix a UaF on tunnel teardown
- eth: bnxt: fix PCIe AER recovery and FLR handling issues
- eth: macb: don't modify Tx skbs before taking ownership
- eth: axienet: don't leak Tx skbs on interface stop
- wifi: nxpwifi: number of LLM-ish fixes
- wifi: assorted mt76 fixes
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE6jPA+I1ugmIBA4hXMUZtbf5SIrsFAmrH6sMACgkQMUZtbf5S
IrtsDg//UvqATFotE+zcXa9yD3Pdg35wSH3uGZJYWIr+ZzEFW3hQdbh9rZy5ulX3
XUhFKlFSeEIarV4UstlvEbkLXSEqbaaFMfYBw03L6os3mGVQqMwi+C+7gn3aoqd4
NE1ct2NChnryr8ORCRjZW3OXjAguGuQBXZ4BFRnDWatbY0Cfuf35ap/RdNKztcEd
hct5rsd3LCNgGspjKq19LvD3npEcURebD9Do7mpwoIlw/AECLdCqUW0QkIJW/F6L
qZic95CyZXy39guuhI88cmfnSiZfz2grm8az4nlF9cDoJS1CW7peor6KzzisbT6m
Iltkwwj6v0NcVKE3f86oSSE5RS8kOJx+YcftNe0S+flZmCLpxopbF6VGfTJUmlyJ
CsQ6+n7iQd+1MoZZDGaJjgx14se5pqnnkJ38dVVi1OhomS/jpFYuw2U1dw1GzrJN
hLjPxmeF+HIFIKEbVjMyMbTCQGb8CfCQnH0qQ7XJnezImln+oA9ub66b/Zgwbubl
k8elLxkiFKgjT9bnwm4/+ZtI5VW8QRgV6sxPxpxD4tyVIaKrs2b9sqv9do3YPjPa
HGzMcRL9YMtGcv87gS8gjJRlAdkOWWzVDzw3nf3gMvAiedHIqvtUBcjB22+ueXqg
mJ0dT46BBTNbzrl8gljVTU5zm6ZYHxKm2vTTgbMdGJTzASNKfmE=
=+sxU
-----END PGP SIGNATURE-----
Merge tag 'net-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Jakub Kicinski:
"Including fixes from wireless, wireguard, CAN and Bluetooth.
We have one known regression to wrap up in VLAN handling.
Current release - regressions:
- Bluetooth: RFCOMM: fix deadlock on rfcomm_mutex
Previous releases - regressions:
- can: fix regression in handling RPS after migrating metadata to skb_ext
- eth:
- iavf: fix regressions in reconfig impacting bonding
- mana: fix packet forwarding performance regression
- stmmac: remove buggy VLAN acceleration support
Previous releases - always broken:
- a few high prio fixes for tun, and af_packet
- amt: fix a UaF on tunnel teardown
- eth:
- bnxt: fix PCIe AER recovery and FLR handling issues
- macb: don't modify Tx skbs before taking ownership
- axienet: don't leak Tx skbs on interface stop
- wifi:
- nxpwifi: number of LLM-ish fixes
- assorted mt76 fixes"
* tag 'net-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (128 commits)
net: macb: copy shared skbs before appending the FCS
net: macb: check TX ring before modifying skb
vsock: Fix memory leak in vmci_transport_recv_dgram_cb()
wireguard: noise: reject response consumption after intermediate initiation
wireguard: queueing: preserve tstamp_type when encapsulating packet
net: openvswitch: validate transport header presence in set_ipv6_addr
net/smc: protect clcsock lifetime in smc_getname
ipv6: do not warn on route notification size race
ipv4: do not warn on route notification size race
ipv4: validate checksum_start before completing checksum
ptp: ocp: fix PCIe delay estimation calculation
xen/netfront: don't leak the skb when xennet_fill_frags() fails
net/packet: call packet_parse_headers after virtio_net_hdr_to_skb
xen/netfront: drop RX packets with a short Ethernet header
net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()
net: sparx5: free the matchall entry on destroy
selftests: mlxsw: Test port range occupancy on template create
mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()
net: dsa: microchip: fix KSZ8765 fiber detection
net/mlx5e: Order ICOSQ cc update after CQ doorbell
...
|
||
Mary Guillemard
|
6ccf996a0d |
drm/nouveau: Skip the Turing CE workaround object for non-GR channels
This workaround is here for the old Gallium driver and predate async CE and NVDEC. Instead of only skipping it for NVDEC, let's only apply it in case of GR channels. This should make async CE work properly on Turing by stopping the assign of a GRCE. (here CE0) Signed-off-by: Mary Guillemard <mary@mary.zone> Reviewed-by: Lyude Paul <lyude@redhat.com> Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com> Signed-off-by: Lyude Paul <lyude@redhat.com> Link: https://patch.msgid.link/20261007-turing-async-ce-fix-v1-1-12ee6ccd1a3c@mary.zone |
||
Lukas Wunner
|
79c168e2aa |
PCI/AER: Skip error recovery on false alarms
Alex is seeing a probe failure of the amdgpu driver after the Root Port above an AMD Navi10 GPU has been reset. The reset was performed to recover from a Firmware First reported Fatal Error. However all status registers in the Root Port's AER Extended Capability are blank, so apparently the platform firmware raised a false alarm. The issue is only occurring since commit |
||
Maíra Canal
|
cca01232d9 |
drm/vc4: Fix binner slot allocation failing on an idle GPU
A job's binner slots are returned to bin_alloc_used by vc4_complete_exec(),
which runs from the job_done workqueue, but the seqno
vc4_v3d_get_bin_slot() waits on is incremented earlier, in the function
vc4_irq_finish_render_job(). Therefore, a waiter can wake, retry, and still
find the pool full because the worker has not run. By then, the job might
have left the render_job_list, so no seqno remains to wait on and the
allocation fails returning -ENOMEM.
This scenario can be reproduced on a Raspberry Pi 3 by using a burst of
small jobs (e.g. Piglit's `quick_gl` suite), with userspace seeing a
rejected submit for a pool about to become free.
Note that the slots are held from validation until the render completes,
so the pool can also be exhausted by jobs still queued on bin_job_list,
leaving render_job_list empty and nothing to wait on.
Release the slots from the FRDONE handler and wait on the pool instead of
on one job's seqno. This bounds the wait to the actual resource. Also, by
claiming the slot inside the wait condition, another submit is unable to
take the slot between the wakeup and the retry. vc4_complete_exec() keeps
clearing the slots for jobs that never completed, and now wakes the
waiters too.
Note that the wait takes a deadline, since the two callers need different
ones. The submit path is a user task and can be interrupted, so it waits
without one. On the other hand, vc4_overflow_mem_work() runs on a worker
and never sees a signal, so it needs a deadline. During a reset,
vc4_irq_disable() masks V3D_DRIVER_IRQS before draining the worker, and
with those masked nothing can release a slot. This deadlocks: the worker
would wait for slots that only the reset can free, while the reset waits
in cancel_work_sync() for the worker.
Fixes:
|
||
|
Maíra Canal
|
6abc8e4dcf |
drm/vc4: Disable the V3D interrupt across runtime suspend
vc4_irq_disable() masks the V3D interrupt sources and then calls
synchronize_irq() before the V3D is powered down. However, by itself,
this is not enough to quiesce the interrupt handler.
synchronize_irq() waits for handlers that have already set
IRQD_IRQ_INPROGRESS, and for irqchips reporting IRQCHIP_STATE_ACTIVE.
A GIC interrupt chip is able to mark an interrupt active as soon as a
CPU acknowledges it, so there these checks cover the whole dispatch path.
On RPi 0-3, however, the interrupt controller is ARMCTRL, which has no
active state. A CPU that has read the hwirq out of the pending register
but has not yet reached handle_level_irq() stays invisible to
synchronize_irq().
During a power transition, vc4_irq() may therefore run after the power
domain is off, where every V3D register read will return 0xdeadbeef.
0xdeadbeef has FLDONE, FRDONE and OUTOMEM set. This problem doesn't
trigger NULL pointer dereference issues only because the functions
vc4_irq_finish_bin_job() and vc4_irq_finish_render_job() return early
when there is no job pointer, but OUTOMEM is still able to schedule
vc4_overflow_mem_work() after vc4_irq_disable() has already cancelled it.
Therefore, fix the spurious interrupts by disabling the interrupt line
across the PM transition. To preserve the enable/disable balance, move
vc4_irq_install() and request the IRQ line disabled before the first
runtime resume.
Fixes:
|
||
Jakub Kicinski
|
37f12441f5 |
Merge branch 'net-macb-fix-software-fcs-handling-of-shared-and-requeued-skbs'
Nicolai Buchwitz says: ==================== net: macb: fix software FCS handling of shared and requeued skbs While testing the genet MTU series I used a Raspberry Pi CM5 (RP1 GEM) as pktgen source for the CM4. With clone_skb the CM5 rebooted after a few seconds. Further investigation showed that macb_pad_and_fcs() appends the FCS in place, so the shared skb grows with every transmit until BQL completes more than was queued and dql_completed() hits its BUG_ON. The same code also modifies the skb before the TX ring check, so a NETDEV_TX_BUSY retry gets an skb that was already replaced or grown. Patch 1 checks the ring first, patch 2 copies shared skbs. Tested on Raspberry CM5 with pktgen at 60/20000 bytes, clone_skb 0/ 1000, burst 1/32. ==================== Link: https://patch.msgid.link/20261006-nb-macb-shared-skb-net-v1-0-a80641479041@tipi-net.de Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
Nicolai Buchwitz
|
9151d6c427 |
net: macb: copy shared skbs before appending the FCS
macb_pad_and_fcs() appends the FCS in place when the skb has tailroom.
A shared skb, as pktgen sends in clone_skb mode, grows by one FCS per
transmit. BQL then completes more bytes than were queued and
dql_completed() hits its BUG_ON.
On a Raspberry Pi CM5 (RP1 GEM) pktgen with clone_skb 1000 burst 32 at
60 bytes kills the box within seconds.
Copy shared skbs before appending the FCS. Clearing IFF_TX_SKB_SHARING
would also fix it but makes pktgen refuse clone_skb on macb.
Fixes:
|
||
|
Nicolai Buchwitz
|
6b48ed85ae |
net: macb: check TX ring before modifying skb
macb_pad_and_fcs() replaces or extends the skb before the ring space
check. On NETDEV_TX_BUSY the stack requeues an skb that is already freed
or grown.
Check the ring first, using the padded length for the descriptor count.
Nonlinear skbs always take the copy path so the count can assume a
linear skb.
Fixes:
|
||
Ilia Gavrilov
|
7c24a4e87e |
vsock: Fix memory leak in vmci_transport_recv_dgram_cb()
During the closure of a datagram socket, the vmci_transport_recv_dgram_cb()
function may be called, which will add the packets
to the socket's backlog; then, after the receive queue is cleared,
the __release_sock() function will move the packet back from the socket's
backlog to the receive queue, which will lead to a memory leak.
sock_close
__sock_release
__vsock_release
// take ownership by user-space
lock_sock_nested
sock_set_flag(sk, SOCK_DEAD)
vmci_transport_release
vmci_dispatch_dgs
vmci_datagram_invoke_guest_handler
vmci_transport_recv_dgram_cb
sk_receive_skb
if (!sock_owned_by_user(sk))
[...]
(!) else if sk_add_backlog()
[...]
(!) skb_queue_purge(&sk->sk_receive_queue)
release_sock
__release_sock
// move all packets from the backlog
// to the receive queue
(!) sk_backlog_rcv
vsock_queue_rcv_skb
[...]
__sock_queue_rcv_skb
if (!sock_flag(sk, SOCK_DEAD))
// Since the socket is "dead", the function will not
// be called
sk->sk_data_ready(sk)
sock_release_ownership(sk);
sock_put
Add a receive queue cleanup in the socket destructor to fix this.
syzkaller report:
unreferenced object 0xffff8880117bfb80 (size 240):
comm "irq/56-vmw_vmci", pid 205, jiffies 4295064448 (age 73.992s)
hex dump (first 32 bytes):
78 dc 26 1e 80 88 ff ff 78 dc 26 1e 80 88 ff ff x.&.....x.&.....
00 00 00 00 00 00 00 00 c0 da 26 1e 80 88 ff ff ..........&.....
backtrace:
[<ffffffff82be8d97>] __alloc_skb+0x287/0x330 net/core/skbuff.c:505
[<ffffffffa114bcbd>] vmci_transport_recv_dgram_cb+0xbd/0x210 [vmw_vsock_vmci_transport]
[<ffffffffa05072c6>] vmci_datagram_invoke_guest_handler+0x366/0x450 [vmw_vmci]
[<ffffffffa050ad75>] vmci_dispatch_dgs+0x235/0x490 [vmw_vmci]
[<ffffffffa050b025>] vmci_interrupt+0x55/0x290 [vmw_vmci]
[<ffffffff8137ad2b>] irq_thread_fn+0x8b/0x1a0 kernel/irq/manage.c:1205
[<ffffffff8137c7ae>] irq_thread+0x28e/0x530 kernel/irq/manage.c:1314
[<ffffffff81253dd6>] kthread+0x2e6/0x3a0 kernel/kthread.c:376
[<ffffffff81004392>] ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:295
Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with Syzkaller.
Fixes:
|
||
|
Jakub Kicinski
|
fe4167bf53 |
Merge branch 'wireguard-fixes-for-7-3-rc7'
Jason A. Donenfeld says: ==================== WireGuard fixes for 7.3-rc7 This series contains two important WireGuard fixes 1) Stop zeroing out skb->tstamp_type when encapsulating packets, so that fq behaves correctly, from Ramses de Norre. 2) Make sure handshake state isn't swapped out while locks are released, reported by Jérémy Jean. ==================== Link: https://patch.msgid.link/20261008130124.724119-1-Jason@zx2c4.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
Jason A. Donenfeld
|
d0305f8d90 |
wireguard: noise: reject response consumption after intermediate initiation
Two threads begin processing the identical response message, received
twice. The first thread, A, runs. While it's running, the second one,
B, gets partway through, and during that slow calculation, or even while
blocking on down_write(), A completes and then also a handshake
initiation that's already been queued up runs in thread C, which itself
takes that same down_write(). The handshake initiation creation
succeeds, and sets the state back to waiting-for-response, and calls
up_write(), at which point thread B resumes, because either its finished
its calculations or was finally allowed to acquire down_write(). Thread
B then copies the state back to the peer, and begins a new session,
using that state, which is the same session as the one made in thread A.
Thread A Thread B Thread C
down_read()
sA = handshake->state
memcpy(cA, handshake->crypto)
up_read()
if (sA != 1)
goto fail
slow_crypto(cA)
down_read()
sB = handshake->state
memcpy(cB, handshake->crypto)
up_read()
if (sB != 1)
goto fail
slow_crypto(cB)
down_write()
if (sA != handshake->state)
goto fail
memcpy(handshake->crypto, cA)
handshake->state = 2
up_write()
down_write()
if (handshake->state != 2)
goto fail
derive_session(handshake->crypto)
up_write()
down_write()
slow_crypto(handshake->crypto)
handshake->state = 1
up_write()
down_write()
if (sB != handshake->state)
goto fail
memcpy(handshake->crypto, cB)
handshake->state = 2
up_write()
down_write()
if (handshake->state != 2)
goto fail
derive_session(handshake->crypto)
up_write()
This seems basically impossible to hit in a meaningful way in practice,
but ensure that it absolutely cannot happen by comparing the ephemeral
private key that's on the stack with the latest one that the peer's
handshake state has.
Cc: stable@vger.kernel.org
Fixes:
|
||
Ramses de Norre
|
65ab9de4bd |
wireguard: queueing: preserve tstamp_type when encapsulating packet
Sending traffic through a wireguard tunnel on a host using the fq qdisc fills the log with: fq: likely mono tstamp with tstamp_type 0 An skb carries a timestamp in skb->tstamp and, separately, a skb->tstamp_type field recording which clock that timestamp came from. The two have to agree. When wireguard encapsulates a packet it calls wg_reset_packet(), which clears the fields that must not leak from the inner packet into the tunnel packet. It does so in two steps: skb_scrub_packet(skb, true); memset(&skb->headers, 0, sizeof(skb->headers)); skb_scrub_packet() deliberately keeps skb->tstamp when it holds a monotonic timestamp: that value is the time the packet is scheduled to be sent, and the qdisc still needs it. The memset then zeroes skb->tstamp_type, because that field sits inside the headers group while skb->tstamp does not. The packet therefore leaves wireguard carrying a monotonic timestamp labelled as a realtime one. Nothing noticed until commit |
||
Fernando Fernandez Mancera
|
3c6a4b1133 |
net: openvswitch: validate transport header presence in set_ipv6_addr
When executing IPv6 address rewrite actions on IPv6 fragments,
set_ipv6_addr() calls update_ipv6_checksum(). If parse_ipv6hdr()
processes a non-first IPv6 fragment, it sets key->ip.proto to
NEXTHDR_FRAGMENT and returns early without calling
skb_set_transport_header().
update_ipv6_checksum() unconditionally evaluates skb_transport_offset()
on entry before checking l4_proto. Because skb->transport_header is
uninitialized, this triggers a warning under CONFIG_DEBUG_NET=y although
it is completely harmless.
Fix this by returning early in update_ipv6_checksum() if l4_proto is
NEXTHDR_FRAGMENT. This avoids reading the uninitialized transport offset
for fragments while preserving the debug warning for any other protocol
where the transport header is unexpectedly missing.
See the syzbot trace:
!skb_transport_header_was_set(skb)
WARNING: ./include/linux/skbuff.h:3075 at skb_transport_header include/linux/skbuff.h:3075 [inline], CPU#1: syz-executor463/5635
WARNING: ./include/linux/skbuff.h:3075 at skb_transport_offset include/linux/skbuff.h:3250 [inline], CPU#1: syz-executor463/5635
WARNING: ./include/linux/skbuff.h:3075 at update_ipv6_checksum net/openvswitch/actions.c:361 [inline], CPU#1: syz-executor463/5635
WARNING: ./include/linux/skbuff.h:3075 at set_ipv6_addr+0x462/0x660 net/openvswitch/actions.c:399, CPU#1: syz-executor463/5635
[...]
RIP: 0010:skb_transport_header include/linux/skbuff.h:3075 [inline]
RIP: 0010:skb_transport_offset include/linux/skbuff.h:3250 [inline]
RIP: 0010:update_ipv6_checksum net/openvswitch/actions.c:361 [inline]
RIP: 0010:set_ipv6_addr+0x462/0x660 net/openvswitch/actions.c:399
[...]
Call Trace:
<TASK>
set_ipv6 net/openvswitch/actions.c:531 [inline]
do_execute_actions+0x557e/0x8600 net/openvswitch/actions.c:1366
ovs_execute_actions+0xde/0x520 net/openvswitch/actions.c:1592
ovs_packet_cmd_execute+0xb4f/0xf10 net/openvswitch/datapath.c:705
genl_family_rcv_msg_doit+0x233/0x340 net/netlink/genetlink.c:1114
genl_rcv_msg+0x614/0x7a0 net/netlink/genetlink.c:1209
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2572
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218
netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1361
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1916
sock_sendmsg_nosec+0x14e/0x190 net/socket.c:800
Reported-by: syzbot+4cc63fcfb3845e149969@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4cc63fcfb3845e149969
Fixes:
|
||
Chengfeng Ye
|
64a6b36b0e |
net/smc: protect clcsock lifetime in smc_getname
smc_getname() dereferences smc->clcsock without holding
clcsock_release_lock. Link-group termination can release the CLC socket
through smc_close_active_abort() while the SMC socket is still open,
for example after shutdown(SHUT_WR).
A getsockname() caller can load smc->clcsock, then the termination worker
can clear the pointer and call sock_release() before the caller accesses
clcsock->ops or invokes getname(). This causes a use-after-free; if the
worker clears the pointer before the load, it causes a NULL dereference.
The syscall's file reference keeps the SMC socket alive but does not
prevent asynchronous release of its CLC socket.
KASAN reported the following with test-only timing instrumentation:
BUG: KASAN: slab-use-after-free in smc_getname+0x19e/0x1b0
Read of size 8 at addr ffff888109abb4e0 by task poc/103
Call Trace:
smc_getname+0x19e/0x1b0
do_getsockname+0xe5/0x170
__sys_getsockname+0x8c/0x100
Allocated by task 95:
sock_alloc_inode+0x1e/0x280
sock_alloc+0x3d/0x240
__sock_create+0x7e/0x430
smc_create+0x121/0x240
Freed by task 0:
kmem_cache_free+0xcc/0x340
rcu_core+0x50a/0x1850
Last potentially related work creation:
evict+0x446/0x6c0
smc_clcsock_release+0xa8/0xd0
smc_close_active_abort+0x26a/0x3a0
__smc_lgr_terminate.part.0+0x137/0x2e0
Hold clcsock_release_lock across the pointer check and the getname()
callback to serialize with smc_clcsock_release(). Return -EBADF if the
CLC socket has already been released, preserving the existing peer
state check and the callback's return value otherwise.
Fixes:
|
||
|
Jakub Kicinski
|
d5788029c3 |
Merge branch 'ipv4-ipv6-do-not-warn-on-route-notification-size-races'
Daehyeon Ko says: ==================== ipv4/ipv6: do not warn on route notification size races A nexthop group can grow between route notification sizing and filling. Both IPv4 and IPv6 can then legitimately return -EMSGSIZE, so remove the stale warnings while preserving their existing error paths. Patch 1 is unchanged from v1. Patch 2 adds the IPv6 counterpart requested by Ido. No new build or runtime test was run; both changes only delete the stale comment and WARN_ON(). ==================== Link: https://patch.msgid.link/cover.1791423190.git.4ncienth@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
Daehyeon Ko
|
c97426ec64 |
ipv6: do not warn on route notification size race
fib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later
fills it with rt6_fill_node(). With nexthop compatibility mode enabled,
a concurrent replacement can grow the group between these independent
snapshots. rt6_fill_node() can then legitimately return -EMSGSIZE, so
the warning does not prove a sizing bug.
Remove the warning. The existing error path still frees the skb and
reports the error to listeners.
Fixes:
|
||
|
Daehyeon Ko
|
e02a5b6588 |
ipv4: do not warn on route notification size race
Commit |
||
Michael S. Tsirkin
|
6785011f8b |
ipv4: validate checksum_start before completing checksum
If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work. Cc: stable@vger.kernel.org Fixes: |
||
Vadim Fedorenko
|
f8c8bd159a |
ptp: ocp: fix PCIe delay estimation calculation
The commit in fixes introduced a high cap for delayas U64_MAX value
while ktime_t is actually s64. This is wrong cap as it becomes negative
value and any comparison to a real delay will fail to update delay
value. Use KTIME_MAX constant as correct max cap for PCIe delay.
The issue was hit in production (a negative value is observed):
# cat /sys/class/timecard/ocp0/ts_window_adjust
-3
Fixes:
|
||
Josef Bacik
|
93ccaf1c26 |
xen/netfront: don't leak the skb when xennet_fill_frags() fails
When a response chain has more slots than fit in the skb's frags,
xennet_fill_frags() returns an error and xennet_poll() jumps to its
error path. That path moves what's left on tmpq to errq to be freed,
but the skb being filled was already dequeued from tmpq, so it's never
freed. Each chain that overflows leaks the skb and the pages attached
to it as frags, and the backend decides how many slots it sends.
Put the skb back on tmpq before taking the error path, like the
xennet_set_skb_gso() failure just above it does.
Fixes:
|
||
Willem de Bruijn
|
513e23857a |
net/packet: call packet_parse_headers after virtio_net_hdr_to_skb
SOCK_RAW packet sockets incorrectly drop VLAN-tagged GSO packets without VIRTIO_NET_HDR_F_NEEDS_CSUM. packet_parse_headers() sets skb->protocol to VLAN but advances skb->network_header past the VLAN tags. virtio_net_hdr_to_skb() then flow dissects these packets, which parses the network header as a VLAN tag, and fails. Call packet_parse_headers() after virtio_net_hdr_to_skb() instead. This matches tun_get_user() and tap_get_user() and thus simplifies overall complexity. Commit |
||
|
Josef Bacik
|
089e58805c |
xen/netfront: drop RX packets with a short Ethernet header
handle_incoming_queue() pulls pull_to bytes into the head before
calling eth_type_trans(). pull_to is the length of the first RX slot,
capped at RX_COPY_THRESHOLD, and that length comes from the backend.
Nothing checks it against ETH_HLEN.
If the first slot is shorter than ETH_HLEN and more slots follow, the
head ends up shorter than an Ethernet header while skb->len is longer,
and eth_type_trans() BUG()s in __skb_pull(). If the whole packet is
shorter than ETH_HLEN, eth_type_trans() reads the header past the end
of the data instead.
Pull at least ETH_HLEN, and drop the packet if that fails, which also
drops packets too short to hold an Ethernet header. This also checks
the return value of the pull, which was ignored.
Fixes:
|
||
|
Josef Bacik
|
ab9414ed70 |
net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()
When skb_copy_and_csum_bits() reaches unreadable frags it returns 0
after copying only the linear part, and the rest of the caller's buffer
is left as it was. The callers copy into a buffer that is about to go
out on the wire: an ICMP error quoting the offending packet, or a
driver's TX bounce buffer in skb_copy_and_csum_dev(). Neither buffer
is zeroed beforehand, so whatever was in memory there gets sent.
Zero the part of the buffer we didn't fill. The checksum usually
won't match the data any more, so the receiver will usually drop the
packet, but either way it no longer carries anything it shouldn't.
Only zero for a positive @len, a negative one from a broken caller must
not turn into a huge memset().
Fixes:
|
||
Daniel Machon
|
2b82e16d60 |
net: sparx5: free the matchall entry on destroy
sparx5_tc_matchall_replace() allocates a struct sparx5_mall_entry for
every offloaded matchall filter and adds it to sparx5->mall_entries.
sparx5_tc_matchall_destroy() removes the entry from the list, but never
frees it, so the entry of every deleted mirror and goto matchall filter
is leaked.
Free the entry after unlinking it.
The leak was discovered by an AI code review agent, and reproduced with
kmemleak on a lan969x EV board (EV23X71A) by repeatedly adding and
deleting matchall mirror and goto filters. With the fix, kmemleak no
longer reports the leak.
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Jakub Kicinski
|
ff6f5157e0 |
Merge branch 'mlxsw-fix-port-range-register-leak'
Petr Machata says: ==================== mlxsw: Fix port range register leak When the mlxsw driver parses a port range template rule, it acquires the actual port range registers. The parsing is only done to determine the element usage, so the registers can be deallocated right away, but this is never done, and the registers are leaked. Plug this leak and add a selftest that would have caught it. ==================== Link: https://patch.msgid.link/cover.1791294384.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
Petr Machata
|
71198b59df |
selftests: mlxsw: Test port range occupancy on template create
Add a test that creates a tc chain template matching on both source and destination port ranges and verifies via devlink-resource occupancy that this does not leak port range registers, neither while the template exists nor after it is deleted. Reviewed-by: Ido Schimmel <idosch@nvidia.com> Signed-off-by: Petr Machata <petrm@nvidia.com> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Link: https://patch.msgid.link/e7b37b80adb7ac8b0ef20a22d7654a6656c1c545.1791294384.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Petr Machata
|
7ea07afb23 |
mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()
mlxsw_sp_flower_tmplt_create() parses a flow_cls_offload template
into a stack-local struct mlxsw_sp_acl_rule_info purely to compute
rulei.values.elusage. Parsing can acquire port range registers via
mlxsw_sp_flower_parse_ports_range(), but since this rulei never goes
through mlxsw_sp_acl_rulei_destroy(), those registers were never
released, including through chain template deletion.
Factor out of mlxsw_sp_acl_rulei_destroy() the code to actually
release the necessary resources and call from
mlxsw_sp_flower_tmplt_create() to plug the leak.
The issue was found during a review of Wentao Liang's patch referenced
below.
Fixes:
|
||
Sebastien Royen
|
fc13ba44da |
net: dsa: microchip: fix KSZ8765 fiber detection
The KSZ8765 is similar to the KSZ8795 but has two fiber ports.
KSZ8_PORT_STATUS_0 is used to detect fiber mode. It is currently
defined as 0x08, which is the Global Control 6 MIB Control register
and has bit 7 defined as Flush Counter.
Set KSZ8_PORT_STATUS_0 to 0x18, which is the Port 1 Status 0 register
where bit 7 is the Fiber Mode bit.
This issue was discovered when upgrading an embedded device from kernel
5.10 to 6.16. The device was using a KSZ8765 device tree configuration
and the corresponding hardware, but during boot the kernel incorrectly
detected it as a KSZ8795. The relevant boot messages were:
ksz-switch spi0.0: found switch: KSZ8795, rev 0
ksz-switch spi0.0: Device tree specifies chip KSZ8765 but found KSZ8795, please fix it!
Cc: stable@vger.kernel.org
Fixes:
|
||
Li RongQing
|
b056ca4d37 |
net/mlx5e: Order ICOSQ cc update after CQ doorbell
mlx5e_poll_ico_cq() requires sq->cc to be updated only after
mlx5_cqwq_update_db_record(), otherwise a CQ overrun may occur.
The current implementation updates sq->cc before the CQ doorbell
record, violating this ordering requirement.
Update the CQ doorbell record first and use dma_wmb() before updating
sq->cc. This ensures that the CQ space is released to the device
before the corresponding ICOSQ consumer index is updated by software.
Fixes:
|
||
|
Jakub Kicinski
|
726be6a0e8 |
Merge branch 'veth-fix-peer-netdev_xdp_act_ndo_xmit-after-gro-is-toggled-while-down'
Tianyi Gao says: ==================== veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down Toggling GRO on a veth device while it is down leaves its peer's NETDEV_XDP_ACT_NDO_XMIT flag stale once the device comes up. XDP redirects into the peer are then rejected with -EOPNOTSUPP, or, if GRO was turned off, accepted and then dropped with -ENXIO. Patch 1 refreshes the peer's flags in veth_open(). Patch 2 extends veth.sh to check the peer's flag after GRO is toggled while the device is down, in both directions. ==================== Link: https://patch.msgid.link/20261006173241.65945-1-tianyi@cloudflare.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
Tianyi Gao
|
c017800af5 |
selftests: net: veth: test peer ndo-xmit after GRO toggle while down
Test that toggling GRO on a veth device while it is down updates the peer's ndo-xmit XDP feature once the device comes up, for both GRO on and GRO off. xdp-features is only visible through netlink, so read it with the ynl CLI, as double_udp_encap.sh does. Skip the checks if the CLI is not found, as in an installed kselftest tree. Signed-off-by: Tianyi Gao <tianyi@cloudflare.com> Link: https://patch.msgid.link/20261006173241.65945-3-tianyi@cloudflare.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Tianyi Gao
|
3f09003999 |
veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down
A veth device advertises NETDEV_XDP_ACT_NDO_XMIT only if its peer has an XDP program attached or GRO enabled, that is, only if the peer will have NAPI to receive the frames. veth_set_features() updates the peer's flag when GRO is toggled, but returns early if the device is down, and veth_open() only refreshes the flags of the device being opened. Toggling GRO while the device is down therefore leaves the peer's flag stale after the device comes up. If GRO was enabled while down, the device comes up with NAPI but the peer does not advertise NDO_XMIT, and devmap rejects redirects to the peer with -EOPNOTSUPP. If GRO was disabled while down, the device comes up without NAPI but the peer still advertises NDO_XMIT, so redirects are accepted and then dropped in veth_xdp_xmit() with -ENXIO. Commit |
||
Hamza Mahfooz
|
259c4a5191 |
net: mana: reserve RX buffer headroom to fix forwarding performance
Commit |
||
|
Dave Airlie
|
5a768f5f76 |
Merge tag 'drm-intel-fixes-2026-10-08' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes
drm/i915 fixes for v7.3-rc7: - Fix a GT park race that could trigger spurious RPM wakelock warnings - Fix execbuffer relocation cleanup to avoid out-of-bounds free Signed-off-by: Dave Airlie <airlied@redhat.com> From: Jani Nikula <jani.nikula@intel.com> Link: https://patch.msgid.link/49ac4a9f496e1dadbf71740eb0d1f443598b2632@intel.com |
||
|
Linus Torvalds
|
6c377d19d4 |
Mark the ext4 data=journal feature as being deprecated and will be
removed in 2028. Also designate the primary branch that Sashiko and other tools use to find the primary development branch in the ext4 tree. -----BEGIN PGP SIGNATURE----- iQEzBAABCAAdFiEEK2m5VNv+CHkogTfJ8vlZVpUNgaMFAmrHtq4ACgkQ8vlZVpUN gaMFZAf/eACeBhy6Tm9s6MDAewS84BDeNd/WuUrIn+Jpt1jwpL83sNPY3rgleR7s spPpg7fJQJfFbRiyOj4YUNbwShCOJ61cOw/BrLBYD5HlkCNuexBNWEOEVB7HWAVv f+J7FLF8k/6lgzuXI4CNzC4NIpKiWLUi3zbGbjxZgtdsr1j7zThVn83WwuHqnJic dLlW5Twcwox0j2UDKRmERL1x8QBeghJPSX9u1xNEtx8/gEkAKGJ601MrbVmZPDDy FuXZUdOuyctLuiFMjvB20jVXMVCO0SMj5DiJ8vwGYV/OHVYcLxx7WP7KxJ/IKmK8 lk748C174vVDTLTSzBDIAnqctfkUxQ== =zILx -----END PGP SIGNATURE----- Merge tag 'ext4_for_linus-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 fixes from Ted Ts'o: "Mark the ext4 data=journal feature as being deprecated and will be removed in 2028. Also designate the primary branch that Sashiko and other tools use to find the primary development branch in the ext4 tree" * tag 'ext4_for_linus-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: ext4: mark data=journal as deprecated and will be removed in January 2028. MAINTAINERS: name the ext4 dev branch |