- Fix resctrl resource leak (Tony Luck)
- Fix resctrl umount race (Tony Luck)
- Fix resctrl double-free (Reinette Chatre)
- Fix x86 VGA display fallback logic during bootup on
certain multi-GPU systems (Mario Limonciello)
- Re-add a WBINVD call to the SNP bootstrap path to
fix an SNP regression (Tycho Andersen)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmpSKV8RHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1juPhAAsylTtlr70GPw/3gMyMJ/RGcKHxGBQe6W
ARBT/dzULzA37zPQ0UYqab5gwtb8M4mdTiH0756BUgeNpjO0HAyokAyblcnPsrIz
+nQEcnh6eMrr6nEm3evwEsPv7koi1KwdDhA8RAUhzhAc9YGpwXXBPRlsec0slfdR
y7b5rPT89wCCtuQK2va0BiErvWcWvaEOtBGVw4FpJ7oqqWte7Cp4vk93i9CZfhJ9
369+M2O46Za8Qj9AOgm7TQiV3d4EQ0sAxCnb2Q7c87EyJnBBftEN5cfVOtGvBZUz
2Wego8h9iFkZdo87WMTsFwCwn6qbetyKTn2zO15BmKEKPn2gIm5A8CVBnrTji96L
yR7LXZE+tufpRg6rCW2myjkT65QmLRi2D3ZpBpTkmmgnXZITx+YzfCDy+bqR6x7w
nJ/KJx2YYE9Rve/z8P1giVy5omgI5aMEhveas+NlUBxDuX+OvkI7yrxW0GYAloL6
pcGGlDGml5b5S0rADApaptnL0EqA2QwB/OWA4W7cb+3pm5GZJkyalDioKzm9VEmt
hfVDzYrDM/1YHp9tywGLZeshJ7kkRSd7CvL6mU4UQnBMbtBku/Nbr3KEWK0EOY3N
wnpsFNrnS/CWfT9gygQINbJAZKt6LcLhPwwo0ZzxiVAEA2dRkhDkJCS8Vl2STxht
N2wmpqTmMUw=
=3lBD
-----END PGP SIGNATURE-----
Merge tag 'x86-urgent-2026-07-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fixes from Ingo Molnar:
- Fix resctrl resource leak (Tony Luck)
- Fix resctrl umount race (Tony Luck)
- Fix resctrl double-free (Reinette Chatre)
- Fix x86 VGA display fallback logic during bootup on
certain multi-GPU systems (Mario Limonciello)
- Re-add a WBINVD call to the SNP bootstrap path to
fix an SNP regression (Tycho Andersen)
* tag 'x86-urgent-2026-07-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/virt/sev: Revert "Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN"
x86/video: Only fall back to vga_default_device() without screen info
fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list
fs/resctrl: Fix use-after-free during unmount
fs/resctrl: Free mon_data structures on rdt_get_tree() failure
unearthed other races in the area (Thomas Gleixner)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmpSJ0gRHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1hyKA//W5KqLrRgXjH9cS7tF6PLo9NhbZZn5FhH
jxThPvJosNyCj8UEVD+iCRjkqkNxiY9mzx3px2ZVlJg8K35ez2PeZ/zx0wvuSWlM
sD7k4S3JJQ7vAE4CkYvsf91TxCWqiOMw+NLyo7MgDhwsOdgPgUAAKlCdCyoFzRK7
rAV7FQWMQag24donwPiesk8bnU4pWrooq8BoY7XVCy6aHDwwPVxrs1yPyUEikIXq
AT2HiYFOu9ok6rSlJs+A2JQnmke6M6aIJ5dmUGR7gUDRAqlXesmM6jlwklzK0a4O
j6lpE05ouIhZpYzQVTDxvf8cytp0+rutTX8w0lPRlqxYkaeBVEpktxfBAoqFCsoe
GpK8hK0PM57W29zhnTygQib53QQAk9QBQetp0NwUjLSOu3ouhCAOC3wuoctJ4fKY
oNSKGPBhHwJN5932JuxlEll/xbo+bFyHfP87tqn1SA0bgKMSNet5q7+wYE+1gcTp
9LHQnoMpjyRBjuOupnvxqeOVbN3qlNdY6MINFwxBZuKG7UwmYpTH7l72fuUM/eNr
b4UHKgwv3vuQX/BfBoT1mLnzWQTltrfEywBCXHsEHUQ7KFhdRHEbnh3zVDZCT5S3
5N/RS8aFcryD/0/DhxWEhO2DBTgjDDvmOKplIPYFtikDI1dkjZ9dZ0BCI42u6wMH
by25mw2rF2s=
=2I60
-----END PGP SIGNATURE-----
Merge tag 'timers-urgent-2026-07-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull timer fix from Ingo Molnar:
- Fix a subtle posix-cpu-timers vs. exec() race, which
unearthed other races in the area (Thomas Gleixner)
* tag 'timers-urgent-2026-07-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
posix-cpu-timers: Prevent UAF caused by non-leader exec() race
-----BEGIN PGP SIGNATURE-----
iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmpRcgYQHGF4Ym9lQGtl
cm5lbC5kawAKCRD301j7KXHgplILD/4pSlngdLhIRuGnzHEXz507ySn8XSim6NEs
gNf89HClYgIwSbMjHOuzPLpp/6FHxKMnyEzxsrJ6Rj3PXSc0sSWbKHMGD5UUwg4X
gYUIwH5WfvzHxU9zJ6tGLgkepTow+vPhoTnJJqtK5qLO2C56I7dSV38fP5S2ucMU
flVzYFRMtO8svWekol9bA278/p3GxR0qXKLCKq/tadTLcLo9AyAz+gEGHAYCNTVE
9Kix7uiAVMg8CtwK5lJDFd6pLSZaYFCkzAI2/H/mxB25ydZRKcfLADmj/uDOboJH
8Q2FezpQSdM6bEWqsjSwA3qhfNaUzyVuCEoFZl2V4vuD/RvEe+y5hSGM9AGW0hwQ
57UwLKgohupTNb6149Mhq5AvmIcD2/FEmxMCyHB0DdSWFp1uHR/8jrHyh/ZQXBHl
VgCeErIIaG5Yruta80WsZp7lagBduU0zndG4a3OONOj76vLA5iilzxEo4K7yFVdu
22Uiw2oIJPzwm9OOmVvpaIozBDNqG8Ims9e2U/me6ODFP4kdcHjqyS6FOnDoRxz2
PiPxW0FHJt4ywjFuHTE05+8N3/eiJivANjaeAnj1mqIIH4UwxzCiCl/raVf4VCtH
HWoGFQQ5R2gg4Q1BGllmOvyG9ZPhV/TJgoRnatyVqGVHXJOBKc+5PQREy3HXZ54J
Z6xq2lobKQ==
=LIqA
-----END PGP SIGNATURE-----
Merge tag 'block-7.2-20260710' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull block fixes from Jens Axboe:
- Limit blk_hctx_poll() to one jiffy. Prevents buggy drivers from
spinning for too long, hence triggering a stalled RCU read section
warning
- Avoid a potential deadlock on zone revalidation failure, which could
otherwise trigger a lockdep circular locking splat during a SCSI disk
rescan
- Remove a redundant GD_NEED_PART_SCAN set in add_disk_final()
- Make writes to queue/wbt_lat_usec honor the WBT enable state
- ublk fix to snapshot the batch commands before preparing IO, so that
userspace can't change an already processed tag and trip the
WARN_ON_ONCE() in the rollback path
- xen-blkfront fix for a double completion of split requests on resume
- drbd fix to reject data replies with an out-of-range payload size
* tag 'block-7.2-20260710' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
block: remove redundant GD_NEED_PART_SCAN in add_disk_final()
drbd: reject data replies with an out-of-range payload size
xen-blkfront: fix double completion of split requests on resume
ublk: snapshot batch commands before preparing I/O
block: Make WBT latency writes honor enable state
block: avoid potential deadlock on zone revalidation failure
blk-mq: bound blk_hctx_poll() to one jiffy
qcom_ebi2_probe() enables the EBI2 clocks manually and populates child
devices manually. Several later failure paths can then return without
disabling the clocks or without relying on the driver core to undo child
population.
Use devm_clk_get_enabled() for both clocks and
devm_of_platform_populate() for children. This lets the driver core
unwind the resources automatically and removes the hand-written error
labels.
Fixes: 335a127548 ("bus: qcom: add EBI2 driver")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Link: https://lore.kernel.org/r/20260623015415.26975-1-pengpeng@iscas.ac.cn
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
rpmh_rsc_probe() registers CPU PM or genpd notifiers before populating
child devices. If child population fails, the CPU PM notifier path is not
unwound and the genpd path needs open-coded cleanup.
Use devm_pm_runtime_enable() for the genpd path and
devm_add_action_or_reset() for both notifier registrations. This makes
probe failure and driver detach use the same cleanup model while keeping
devm_of_platform_populate() responsible for child devices.
Fixes: 25092e6100 ("soc: qcom: rpmh-rsc: Attach RSC to cluster PM domain")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260623015501.31129-1-pengpeng@iscas.ac.cn
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Wire the five tracepoints defined in qcom_scm_trace.h into the SMC
execution path by including the header with CREATE_TRACE_POINTS.
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Yuvaraj Ranganathan <yuvaraj.ranganathan@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260522-scm-tracepoints-v2-2-e27cdbe0c585@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
The SCM SMC call path is opaque at runtime. Stalls caused by firmware
congestion, QCOM_SCM_WAITQ_SLEEP/RESUME cycles, and EBUSY retry loops
are invisible without recompiling the kernel with temporary printk
statements or attaching a hardware debugger.
Add five TRACE_EVENTs covering the complete lifecycle of an SCM call:
scm_smc_request
Emit before each arm_smccc_smc_quirk() invocation. Records the
SMC function ID, decoded service and command identifiers, argument
count, and up to six register arguments in hex and decimal. Because
the caller loops on QCOM_SCM_INTERRUPTED, this event fires once per
physical SMC instruction including inte
scm_smc_done
Emit after the outer __scm_smc_do() returns, pairing each
request with its final outcome. Records the SMC function ID, the
kernel error code returned to the caller, and the four firmware
result registers a0-a3.
scm_waitq_sleep
Emit when the firmware returns QCOM_SCM_WAITQ_SLEEP. Records
the wait-queue context and the SMC call context handles required
to issue the matching WAITQ_RESUME.
scm_waitq_resume
Emit just before constructing and sending the WAITQ_RESUME
follow-up call. Records the SMC call context handle being resumed.
scm_waitq_get_wq_ctx
Emit after a successful WAITQ_GET_WQ_CTX fast-call. Records
the returned wait-queue context, flags, and more_pending indicator.
These events let ftrace and perf reconstruct the full sequence of
firmware interactions, measure per-call and end-to-end latency, and
attribute waitqueue stalls to specific service/command pairs without
modifying driver source.
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Yuvaraj Ranganathan <yuvaraj.ranganathan@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260522-scm-tracepoints-v2-1-e27cdbe0c585@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmpRch8QHGF4Ym9lQGtl
cm5lbC5kawAKCRD301j7KXHgpqORD/9xYHpNwkeIXfG+6giRGCF03u0eGlreUsIl
uCGdqfNKjKZqWOw6q7uzNHll7/2SmwOniB32mdo6jpUgXeE3/RJ4U37kZ8ypIyO8
1iOSM5zz5ZNQQuHa/HZMqMRy9mqBa5WIJqRO4CpRk9uaqq6flU2CEq4/y3SdOc0S
9u+UxzVhmoYuL7iQhaLg6xQSrNxtwynVXqIru/bN1Ft01sCo3Yf3w0SmNnmsrr34
jG1tkn0J7QtwkaN81poX8WTqm0D7McFc5xcq8wWM+BDnpvllPxQ+J+J3+zMfvAbN
tbb3FiXkc5SeYTOrBu8FWwPMn8reNpUBgEGjrcZWyRIkHdzxrDhwvC9tyQs85l4w
j93PSsJnlprVPI4LWGfglCaNBZ85hFFKpm83rAFJgJjLuyzRFSF7+/EKrHFP58sK
v8oYq/iXpQunu1YLfBIAjW4OnVkqSYM95Xax4l5yFSgeCS+hNd/naRgvqzrM4puq
tspIH9zjZCyRftRuVebW4V/cxfceSp3kg5cPyW/PRonO9iGZ1Q2scK0bovNO0QKC
gDjax1qancwp/GlT65jgdLp9lAx1TIofPz2gP22lGlZe732bi3gvX5rGPo1bT98v
1NJXrEIqLHOuId308+pzpvl4j4YyJAC3llThVg4L2TZb6jy+S5qYnbBnRkQoNPVi
iMP+XrWPjw==
=vHWI
-----END PGP SIGNATURE-----
Merge tag 'io_uring-7.2-20260710' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull io_uring fixes from Jens Axboe:
- Restore full RCU read section in io_req_local_work_add(), which was
mistakenly dropped with the DEFER_TASKRUN rework in this merge
window. Revert the commit that grabbed the RCU read lock in
io_ctx_mark_taskrun(), as that's no longer required with the previous
fix.
- Fix a dangling iovec after a provided-buffer bundle grow failure,
also an issue introduced in this merge window.
- Reject IORING_CQE_F_32 flag pass-through in MSG_RING to rings that
weren't setup with CQE32 or CQE_MIXED.
- Return -EINVAL rather than -ENOMEM from get_unmapped_area() when mmap
validation fails, matching io_uring_mmap().
* tag 'io_uring-7.2-20260710' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
Revert "io_uring: grab RCU read lock marking task run"
io_uring: restore RCU read section in io_req_local_work_add()
io_uring: fix dangling iovec after provided-buffer bundle grow failure
io_uring/uring_cmd: fix uring_cmd.c comments
io_uring/msg_ring: reject CQE32 flag pass-through to normal rings
io_uring/memmap: return -EINVAL from get_unmapped_area() on bad mmap
Replace permanently bouncing email addresses (550 5.1.1 Recipient address
rejected) of Adam Skladowski, Chanho Park, Anusha Rao and Sireesh
Kodali. There are no new messages from them via other email addresses,
so drop them permanently. Add Alim Akhtar to Samsung ExynosAutov9 SoC
clocks, because he looks at other Samsung clock hardware and drivers.
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260623073050.36262-2-krzysztof.kozlowski@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Add device tree bindings for the camera clock controller on
Qualcomm Glymur SoC.
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
Signed-off-by: Jagadeesh Kona <jagadeesh.kona@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260624-glymur_camcc-v5-1-a321df74b1a1@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
QCOM_SCM and QCOM_SPM are user-selectable drivers, thus
ARM_QCOM_SPM_CPUIDLE should rather avoid selecting them but instead
depend to avoid any possible unmet dependencies.
ARM_QCOM_SPM_CPUIDLE does use symbols from SCM and SPM, and since it
cannot be built-in, the dependency must be as built-in.
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260711-qcom-soc-kconfig-v2-4-4a907e064281@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
The drivers for Qualcomm SoC components are covering a basic or
fundamental SoC blocks. Usually they are required for booting or to
achieve basic expected functionality when running Linux. These drivers
do not represent any sort of buses visible to the board
designers/configurators, thus they should be always enabled, regardless
how SoC is used in the final board.
Kernel configuration should not ask users choice of drivers when that
choice is obvious and known to the developers that answer should be
'yes' or 'module'.
Switch most of the Qualcomm SoC drivers to a default 'yes' or
'module' for ARCH_QCOM, to match existing defconfig usage.
This has no impact on arm64 defconfig, arm qcom_defconfig and arm
multi_v7_defconfig.
multi:
+#define CONFIG_QCOM_PDR_HELPERS_MODULE 1
+#define CONFIG_QCOM_PBS_MODULE 1
+#define CONFIG_QCOM_AOSS_QMP 1
+#define CONFIG_QCOM_APR_MODULE 1
+#define CONFIG_QCOM_LLCC_MODULE 1
qcom:
+#define CONFIG_QCOM_PDR_HELPERS_MODULE 1
+#define CONFIG_QCOM_PBS_MODULE 1
+#define CONFIG_QCOM_AOSS_QMP 1
+#define CONFIG_QCOM_APR_MODULE 1
+#define CONFIG_QCOM_SPM 1
+#define CONFIG_QCOM_LLCC_MODULE 1
The change will however enable by default all drivers for arm or arm64
COMPILE_TEST builds, whenever ARCH_QCOM is selected, which feels
logical: if one selects ARCH_QCOM then probably by default wants to
build test it entirely. Kernels with COMPILE_TEST are not supposed to
be used for booting.
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260711-qcom-soc-kconfig-v2-3-4a907e064281@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
There is no point to allow selecting core SoC drivers for Qualcomm ARMv7
SoCs when building ARM64 kernel, and vice versa.
This makes kernel configuration more difficult as many do not remember
the Qualcomm SoCs model names/numbers and their properties like
architecture. No features should be lost because:
1. There won't be a single image for ARMv7 and ARMv8/9 SoCs.
2. Newer ARMv8/9 SoCs won't be running in arm32 emulation mode.
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260711-qcom-soc-kconfig-v2-2-4a907e064281@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Switch from a simple menu to menuconfig, so all Qualcomm SoC drivers
will be under one selectable option, allowing to disable them all which
should make kernel configuration easier when preparing a non-Qualcomm
kernel.
This has few benefits (functional impact of this commit):
1. Allow compile testing of QCOM_OCMEM, which previously required
ARCH_QCOM.
2. Hide behind ARCH_QCOM or COMPILE_TEST drivers specific to Qualcomm
which should not be available to other kernel builds:
QCOM_PMIC_PDCHARGER_ULOG, QCOM_PMIC_GLINK, QCOM_SPM and QCOM_PBS.
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260711-qcom-soc-kconfig-v2-1-4a907e064281@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
__reserve_metadata_snap() increments THIN_SUPERBLOCK_LOCATION in the
metadata space map before shadowing it. When dm_tm_shadow_block()
fails, a reference is leaked in the metadata space map.
Fix by adding the missing dm_sm_dec_block().
Signed-off-by: Genjian Zhang <zhanggenjian@kylinos.cn>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Fixes: cc8394d86f ("dm thin: provide userspace access to pool metadata")
Cc: stable@vger.kernel.org
Starting with Rust 1.99.0 (expected 2026-10-01), under
`CONFIG_RUST_DEBUG_ASSERTIONS=y`, `objtool` may report:
rust/kernel.o: warning: objtool: _R..._6kernel12module_param9set_paramaEB4_()
falls through to next function _R..._6kernel12module_param9set_paramhEB4_()
(and many others) due to calls to the `noreturn` symbol [1]:
core::panicking::panic_null_reference_constructed
Thus add the mangled one to the list so that `objtool` knows it is
actually `noreturn`.
See commit 56d680dd23 ("objtool/rust: list `noreturn` Rust functions")
for more details.
Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs).
Cc: Josh Poimboeuf <jpoimboe@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Petr Pavlu <petr.pavlu@suse.com>
Link: https://github.com/rust-lang/rust/pull/158796 [1]
Reported-by: Alice Ryhl <aliceryhl@google.com>
Closes: https://lore.kernel.org/rust-for-linux/alEBInX9gD1M5NAr@google.com/
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Tested-by: Alice Ryhl <aliceryhl@google.com>
Link: https://patch.msgid.link/20260710173252.191781-1-ojeda@kernel.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Update our vendored copy of `zerocopy` (and `zerocopy-derive`) to v0.8.54.
It is a very small delta from v0.8.52, and most importantly it resolves
the unexpected lack of inlining [1] which triggered a modpost error
under `CONFIG_CC_OPTIMIZE_FOR_SIZE=y` reported by Alexandre using Gary's
suggestion [2]:
ERROR: modpost: "_RNvMNtCs5wX7wwEUCR9_8zerocopy6layoutNtB2_8SizeInfo24try_to_nonzero_elem_size" [drivers/gpu/nova-core.ko] undefined!
ERROR: modpost: "_RNvNtCs5wX7wwEUCR9_8zerocopy4util18padding_needed_for" [drivers/gpu/nova-core.ko] undefined!
It also resolves `most_traits` being unexpectedly documented [3] that I
reported and adds a missing SPDX license identifier [4] that I requested
to match the kernel version.
The following script may be used to check for the remaining differences:
for path in $(cd rust/zerocopy-derive/ && find . -type f ! -name README.md); do
curl --silent --show-error --location \
https://github.com/google/zerocopy/raw/v0.8.54/zerocopy/zerocopy-derive/src/$path |
git diff --no-index - rust/zerocopy-derive/$path &&
echo $path: OK
done
for path in $(cd rust/zerocopy/ && find . -type f ! -name README.md); do
curl --silent --show-error --location \
https://github.com/google/zerocopy/raw/v0.8.54/zerocopy/$path |
git diff --no-index - rust/zerocopy/$path &&
echo $path: OK
done
Cc: Joshua Liebow-Feeser <joshlf@google.com>
Cc: Jack Wrenn <jswrenn@google.com>
Reported-by: Alexandre Courbot <acourbot@nvidia.com>
Closes: https://lore.kernel.org/rust-for-linux/20260708-zerocopy-export-v1-1-2bfc355853c6@nvidia.com/ [1]
Suggested-by: Gary Guo <gary@garyguo.net>
Link: https://lore.kernel.org/rust-for-linux/DJT6235B3DOV.222XR5O6VHG4M@garyguo.net/ [2]
Link: https://github.com/google/zerocopy/issues/3466 [3]
Link: https://github.com/google/zerocopy/issues/3457 [4]
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Tested-by: Alexandre Courbot <acourbot@nvidia.com>
Reviewed-by: Gary Guo <gary@garyguo.net>
Link: https://patch.msgid.link/20260709211311.142544-1-ojeda@kernel.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Update our vendored copy of `zerocopy` (and `zerocopy-derive`) to v0.8.52.
Most SPDX identifiers have been added upstream at our request [1]
(without parentheses -- supporting them is an issue on the kernel side,
but it does already reduce our differences). The CSS one for `rustdoc`
was added too [2], but will be picked up in a later version.
For `zerocopy`, enable `--cfg no_fp_fmt_parse`, which was added at our
request to avoid our local workaround [3]. This means one less difference,
thus indicate so in our `README.md`.
For `zerocopy-derive`, enable `--cfg zerocopy_unstable_linux`. This
allows us to use `#[derive(zerocopy_derive::most_traits)]`, a new feature
upstream added for us [4]. We noticed a minor doc render bug [5], which
will be fixed for a future version too.
The following script may be used to check for the remaining differences:
for path in $(cd rust/zerocopy-derive/ && find . -type f ! -name README.md); do
curl --silent --show-error --location \
https://github.com/google/zerocopy/raw/v0.8.52/zerocopy/zerocopy-derive/src/$path |
git diff --no-index - rust/zerocopy-derive/$path &&
echo $path: OK
done
for path in $(cd rust/zerocopy/ && find . -type f ! -name README.md); do
curl --silent --show-error --location \
https://github.com/google/zerocopy/raw/v0.8.52/zerocopy/$path |
git diff --no-index - rust/zerocopy/$path &&
echo $path: OK
done
Cc: Joshua Liebow-Feeser <joshlf@google.com>
Cc: Jack Wrenn <jswrenn@google.com>
Link: https://github.com/google/zerocopy/issues/3428 [1]
Link: https://github.com/google/zerocopy/issues/3457 [2]
Link: https://github.com/google/zerocopy/issues/3426 [3]
Link: https://github.com/google/zerocopy/pull/3416 [4]
Link: https://github.com/google/zerocopy/issues/3466 [5]
Acked-by: Nicolas Schier <n.schier@fritz.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Link: https://patch.msgid.link/20260625231919.692444-1-ojeda@kernel.org
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
Open vSwitch stores generated flow actions as nlattrs, whose nla_len
field is u16. Commit a1e64addf3 ("net: openvswitch: remove
misbehaving actions length check") allowed the total sw_flow_actions
stream to grow beyond 64 KiB, which is valid, but also removed the last
guard preventing a generated nested action attribute from exceeding
U16_MAX.
An oversized generated container can thus be closed with a truncated
nla_len. A later dump or teardown then walks a structurally different
stream than the one that was validated. In particular, an oversized
nested CLONE/CT action may cause subsequent bytes in the generated
stream to be interpreted as independent actions.
Keep the larger total-action-stream behavior, but make nested action
close reject generated containers that do not fit in nla_len, and return
the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and
CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse
construction order before discarding failed wrappers, so resources copied
into the rejected tails are released before the wrappers are removed.
Most failed outer wrappers are discarded by truncating actions_len after
child resources have been released. CHECK_PKT_LEN also trims its parent
after branch resources are gone. SET/TUNNEL close failures unwind their
known tun_dst ownership directly, and SET_TO_MASKED has no external
ownership and truncates on close failure.
Fixes: a1e64addf3 ("net: openvswitch: remove misbehaving actions length check")
Cc: stable@vger.kernel.org
Assisted-by: avom-custom-harness:gpt-5.5-qwen3.6-mod-mix
Signed-off-by: Asim Viladi Oglu Manizada <manizada@pm.me>
Reviewed-by: Eelco Chaudron <echaudro@redhat.com>
Reviewed-by: Aaron Conole <aconole@redhat.com>
Reviewed-by: Ilya Maximets <i.maximets@ovn.org>
Link: https://patch.msgid.link/20260706094336.38639-1-manizada@pm.me
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
When a MACsec interface with IFF_PROMISC set is brought up on top of a
device that has hardware offload enabled, macsec_dev_open() first calls
dev_set_promiscuity(real_dev, 1) and then propagates the open to the
offload device. If that propagation fails, the error path jumps to the
clear_allmulti label, which only reverts allmulti and the unicast
address. The promiscuity taken on the lower device is never dropped, so
real_dev is left permanently stuck in promiscuous mode. Its promiscuity
count can no longer be balanced from software.
Add a clear_promisc label that drops the promiscuity reference and
route the two offload failure paths to it. The dev_set_promiscuity()
failure itself still jumps to clear_allmulti, since on that failure the
count was not incremented.
Fixes: 3cf3227a21 ("net: macsec: hardware offloading infrastructure")
Cc: stable@vger.kernel.org
Signed-off-by: James Raphael Tiovalen <jamestiotio@gmail.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Link: https://patch.msgid.link/20260705113629.187490-1-jamestiotio@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEH7ZpcWbFyOOp6OJbrB3Eaf9PW7cFAmpQtBkACgkQrB3Eaf9P
W7fEwQ//ZGlVHLizm9aK0bcoIGOuUBCASQOmtk19n5vYP97612LbMeaQD9jEBCd2
c/gLK2P9hn9dnH25lvOXPwrWG+gje7lpPypeTjvzvW/andg/2DWGMvmhSv1M8a5q
J6NUKRsCJ2jwwkpILw6ziD+xskEh9t2hxXSc1Xk6K0W5MHJlx07ieoMrL/r/HbvJ
lDiHfg87Hlcp8K6W/aecN8NcliXEuo3KTSYCsBZM48R+Oar3VpqMC2QiLxvYZDqQ
IEVshugVQ8FQCgSp37hDxQLqsGdAfzAcjE8SjAGPJk12IODO8MKLsSsDJWt3MX4a
sjbIiQjEr0nDxtnwtPOBYN5ko5cpeU/A0mvAIHCTcJ36SFucii32i5hBABRV/WKh
gKAppFmXb4TL63heupYff3jlSWRSZKvlXc4R4ybMcIHHXVslK/9DGheEAYvVxTgh
NlV6wmj89cx/Xvzk/ODS4TlsnypIjcE+TINA5lGscRSNwtWYAeqBOxCK8fkSabka
aau0PTkoGaLHQWp2HwjIiJFrat/ZMJfsHWUvISeaKQ5ZJFtq++rE0alkgMpnfVmp
EOtvMdxrxYMPmeDVewH2XQseYWLFgdGzAf3i7MG1dHxEunqaoFCxSqzSnrKuFZLA
tbkHCjm2m2/oW3A0FdqmIIKrMLIDoBYjsEG5PXVYNqOnKpx/PEw=
=k1zg
-----END PGP SIGNATURE-----
Merge tag 'ipsec-2026-07-10' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec
Steffen Klassert says:
====================
pull request (net): ipsec 2026-07-10
1) xfrm: propagate -EINPROGRESS from validate_xmit_xfrm()
Return -EINPROGRESS from xfrm_output_one when validate_xmit_xfrm
requeues the packet asynchronously, so the caller doesn't treat it
as a real error and free the skb.
2) xfrm: fix stale skb->prev after async crypto steals a GSO segment
Re-derive skb->prev from the fragment list after async crypto splits
a GSO skb, keeping the linked-list pointers validi.
3) xfrm: nat_keepalive: avoid double free on send error
Hold a state ref while the nat_keepalive timer is active and drop the
timer before freeing the state, preventing a re-entered free on send
error.
4) xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
Null the skb dst cache before freeing the policy so a later skb
destructor doesn't double-free it.
5) xfrm: cache the offload ifindex for netlink dumps
Cache the device ifindex at state-add time and use it for netlink
dumps instead of dereferencing dst->dev, which may have changed by
the time the dump runs.
6) xfrm: reject optional IPTFS templates in outbound policies
Reject outbound policies with an optional IPTFS template,
IPTFS must always be used if configured.
7) xfrm: clear mode callbacks after failed mode setup
Clear the mode->init_flags and init_state callbacks on the error path
after xfrm_init_mode fails, so a partially-initialised mode isn't
reused in xfrm_state_construct.
8) xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()
Propagate SKBFL_SHARED_FRAG from the original skb to fragments
allocated by iptfs_skb_add_frags, keeping shared-fragment accounting
correct after IPTFS reassembly.
9) xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()
Clear dst->dev on the error path of xfrm6_fill_dst() so the caller
doesn't release the netdev reference twice via dst_release.
10) xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert
Preallocate all inexact hash bins before existing entries are
reinserted during xfrm_hash_rebuild, so reinsertion always hits an
existing bin.
Please pull or let me know if there are problems.
ipsec-2026-07-10
* tag 'ipsec-2026-07-10' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec:
xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert
xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()
xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()
xfrm: clear mode callbacks after failed mode setup
xfrm: reject optional IPTFS templates in outbound policies
xfrm: cache the offload ifindex for netlink dumps
xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
xfrm: nat_keepalive: avoid double free on send error
xfrm: fix stale skb->prev after async crypto steals a GSO segment
xfrm: propagate -EINPROGRESS from validate_xmit_xfrm()
====================
Link: https://patch.msgid.link/20260710090349.343389-1-steffen.klassert@secunet.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
A user-only branch stack can contain branches that originate from
the kernel. As a result, kernel addresses are exposed to user space
even when PERF_SAMPLE_BRANCH_USER is requested. On AMD processors
supporting X86_FEATURE_BRS (Zen 3 only), perf can still report entries
such as SYSRET/interrupt returns for which the branch-from addresses
are in the kernel.
E.g.
$ perf record -j any,u -c 4000 -e branch-brs -o - -- \
perf bench syscall basic --loop 1000 | \
perf script -i - -F brstack|tr ' ' '\n'| \
grep -E '0x[89a-f][0-9a-f]{15}'
...
0xffffffff810001c4/0x72e2e32955eb/-/-/-/0//-
0xffffffff810001c4/0x72e2d94a9821/-/-/-/0//-
0xffffffff810001c4/0x72e2d94ffa1b/-/-/-/0//-
...
BRS provides no hardware branch filtering, so privilege level
filtering is performed entirely in software. However, amd_brs_match_plm()
only validates the branch-to address against the requested privilege
levels. For branches from the kernel to user space, the branch-from
address is left unchecked and is leaked. Extend the software filter to
also validate the branch-from address, so that any branch record whose
branch-from address is in the kernel is dropped when
PERF_SAMPLE_BRANCH_USER is requested.
Fixes: 8910075d61 ("perf/x86/amd: Enable branch sampling priv level filtering")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Sandipan Das <sandipan.das@amd.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: stable@vger.kernel.org
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Link: https://patch.msgid.link/f05931c4f89a146c364bd5dc6b8170b1ac611c65.1783701239.git.sandipan.das@amd.com
Closes: https://lore.kernel.org/all/20260710110235.F3FD81F000E9@smtp.kernel.org/
linux/gpio.h is going away, so remove that since the driver already
includes linux/gpio/consumer.h.
Acked-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://patch.msgid.link/20260710211954.1373336-10-arnd@kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
If the touchscreen controller reports a touch ID of 0, the driver
calculates the slot ID as touch->id - 1, which underflows to UINT_MAX.
This is passed to input_mt_slot() as -1.
Since the input core ignores negative slot values, the active slot remains
unchanged. The driver then reports the touch coordinates for the previously
active slot, corrupting its state.
Fix this by rejecting touch reports with ID 0.
Fixes: 07b8481d4a ("Input: add MELFAS mms114 touchscreen driver")
Cc: stable@vger.kernel.org
Reported-by: sashiko-bot@kernel.org
Assisted-by: Antigravity:gemini-3.5-flash
Link: https://patch.msgid.link/20260704060115.353049-1-dmitry.torokhov@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
A couple of straightforward fixes for device loading, plus a fix for the
core support for keeping multiple regulators with voltages close to each
other that was sadly introduced due to one of the more beautiful corners
of our API design.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmpRWw8ACgkQJNaLcl1U
h9DeWwf/V6Op0a4A0D3/I0/vbYnnXmVdewO9wB2syfJp/SjtmWZyd6spNRT0ai1J
QEbavn73gr/LcSj0YpoW9Oivp0y59B32nnBijCY4FmpjWhUH/NztzZbdHHkmpF4U
AnyHi9kc09CCkxjzhqTDZ7rGCSPTtHfuJmoFI1fufCAGbBfqp3dXxhUPRCF2dIWt
5/FCgHTDsxRtVZ4AraNC81P7TYxeOxeygVpq3U2YziWcobKITiY+28/tKmACOFzH
n2cbvB3tyPiUGzHyeXJmThlaUFUaoCnafyv51rLsnt55rmHKwX9aQVM/W69Sjhys
8MtQw6GrLhq0BI/GdVeECUS2STwugQ==
=QBSG
-----END PGP SIGNATURE-----
Merge tag 'regulator-fix-v7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator
Pull regulator fixes from Mark Brown:
"A couple of straightforward fixes for device loading, plus a fix for
the core support for keeping multiple regulators with voltages close
to each other that was sadly introduced due to one of the more
beautiful corners of our API design"
* tag 'regulator-fix-v7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK
regulator: mt6363: add missing MODULE_DEVICE_TABLE()
regulator: mt6316: add missing MODULE_DEVICE_TABLE()
-----BEGIN PGP SIGNATURE-----
iQJIBAABCgAyFiEES0KozwfymdVUl37v6iDy2pc3iXMFAmpRNpEUHHBhdWxAcGF1
bC1tb29yZS5jb20ACgkQ6iDy2pc3iXN5+Q/+N1wsGx07LPmidKbPTx3R+yej3JCW
hoLhnmPt7AXxVL671W29vkazKZ8hyQ5hzRy3wITyue9hsiXTNIwNffE1iBKkqMVA
mchh38ziazJJ3h9PVWdiXdW/PoqOIAicFCUe0KJw8bV21Tdzjl+tCqVylU4j57k8
xpkGUifsK8FpkvDMzMlOfD5e4qShOqkPhacVz1OJDrW8gHV5Dh1AuTXdKz58dA1F
Plu7IrtNd+CM1AQwS8ucawDB5PXnxHa708evS5bId/9fG/x5L5ZPJw6+jCPVA+Ea
qUkWWalAJzOEp4jWDhvCyymtqiGhj9rFAydxCy32IAsF7TLTDCV8E+6Iq78wGtjg
Oep+Tn9wOqV5QMILqlZ0zQxeDWnQWA0MzVRqIOFAvMrpurPLUbYZLFbUyNWouGBD
cfU6O+AhADTmfkFfxxTFLsm0RQCEdnF1XeZEreXgwFuuF/A7SybmB2WTWE5wcmbu
Riks3O9NHK620vCLf+wNpDc7+BkNmfBBhLUsyk0NDzEsIpViWS24stumBAP7+Fge
0KnWaB+vOD8IVub1YGgrxTNf3DfK6p8CLgwGYZMBjYFczJF8gCYXTfKlqmRVpXzw
20WaBbriMeMKgC5azD3aPqCg+/vgfBdCcEHSXAIS2KZivMQqYaodlFtTUowoDKng
sn2hwA3SKfZ4aGw=
=wY2k
-----END PGP SIGNATURE-----
Merge tag 'audit-pr-20260710' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit
Pull audit fixes from Paul Moore:
"Two relatively small audit patches to fix potential data races with
the main audit backlog queue as well as possible integer overflows
when logging data as hex strings"
* tag 'audit-pr-20260710' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:
audit: fix potential integer overflow in audit_log_n_hex()
audit: Fix data races of skb_queue_len() readers on audit_queue
-----BEGIN PGP SIGNATURE-----
iQJIBAABCgAyFiEES0KozwfymdVUl37v6iDy2pc3iXMFAmpRNjYUHHBhdWxAcGF1
bC1tb29yZS5jb20ACgkQ6iDy2pc3iXOuTg//bE+PiQbWeAQFK69l4/sl9vaxNw5P
YBGRIVxGLaGhkTl30jVbwXDY5W6bvYf3iq+S9lbu1OPtAgye7ijQtM5p62CL9V/Y
D9/oz8gR/CBySEs9+rCWKhijTDO2MlmDTH8ygG7Z7/eOgPXDMcZ61/xPrTJtO10k
rMpboPAQPyCYTDB0Qakju31N65b5+ZgOQizux64l1ANQEQSarL7VJn2wWleuQL7W
le0ggVJ16f9sUk50G97vN1mKnqy7p5/7La/P4KaNgzD/sb1Y6NLqItcOzs+9lT4x
Uu2Wob1nBD2WS7Occ5ruwkl9jToEk9aGx1Ez5buzbKA4YjhEwQJc6gD1LjZTLRvj
Gy8CP32PJNnKp+y1BVv0yNTWZKOqRQouvg1H/4JccoS9ZlRRQc6ctFWpJjNqHrN8
pzagkE3vFX1CTz1MxHY1VXVgj6ezlLAjJuUBvpJ+nhvwRIDkwZPTCYNCgt42zpQF
lQeuOdMtMU7dsYYScJd22fOG3ySm2auXyMaVitS43gNHVuV3zjWnWalHzwI31HrW
63L9sbt4jXhR/EqoNJNRvJfFlDy95z+rqLPHusT6SmS7cciasG7WjJV51Wnf5JK8
Rz3rXbuD7teCVh/bOkJmdxPUfSq7cVolBmvmPXVwhK45AifFmfmwkScao0/WZw8d
2AlNWfkfUA2tCOc=
=P3C9
-----END PGP SIGNATURE-----
Merge tag 'selinux-pr-20260710' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux
Pull selinux fixes from Paul Moore:
"Two small SELinux patches to fix a missing permission check for TCP
Fast Open operations and fix a socket lookup issue with SCTP ASCONF
operations"
* tag 'selinux-pr-20260710' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
selinux: avoid sk_socket dereference in selinux_sctp_bind_connect()
selinux: check connect-related permissions on TCP Fast Open
- fix stale runlist element dereferences in MFT writeback and fallocate
- fix mrec_lock ABBA deadlock in rename
- prevent userspace modification of NTFS system files
- avoid inode eviction/writeback self-deadlocks
- reject malformed resident attributes in non-resident runlist mapping
- avoid post_write_mst_fixup() on invalid index blocks
- fix a hole runlist leak in insert-range error handling
- sanitize directory lookup MFT references from disk
- fail attribute-list updates after SB_ACTIVE is cleared during teardown
-----BEGIN PGP SIGNATURE-----
iQJKBAABCgA0FiEE6NzKS6Uv/XAAGHgyZwv7A1FEIQgFAmpRiDMWHGxpbmtpbmpl
b25Aa2VybmVsLm9yZwAKCRBnC/sDUUQhCD43EADKiCMxaenYjS7BveKvxV1eCMUW
LY5OaS8pEAILxX1Et5XFH96eqkHYlrGvneOd9txZpO48j/Ieyep0/cqeZFK4hw31
JyIItrSM1VwbPUK75bMPSXCpJn/BbzCDf+PsQwp44SE6VQWwZfWQfmj3neSU1hIU
S8jI3GZaf6Ry5s5BQOiLP4gpfOcPKFhlTDLFycHg8Rn5Uqt3LwDoFTsfHh/Bs9ls
MMcoyEmEJ7twF4+PpEZtCw/Am6FY3t2rSFTtfw3GuNNEKCemKm1V1L8CdFCbu0xo
fC3cyq+aWBWiEFTueotszbLl4MHYODPZKfwtH/FgT+MUFPKQidsuAFsuRYHS+V28
lRPb+XTxfCeerLTlTlseX3Tes3Auw3XW9nojduvGKxK5w0Bsu/2c638fviOxd9Uk
RmZ7EOPB/ROwXFswQF+xk9YAFWLN2FwJtdnWyj4f5XLF6vxFDxzU5lvrc/BW6TQM
ePUCr+0ngKe93Nl+4xCcITTkSjNy5jM7iQCy26/8946+nYtYZ4Nd9tbcDpYpSoiT
gvyIK/MauqJ1Uuxs9VvmZZj4SMcWdJHMPjDSLNyalTgSSzS0LO6zEvgLJo0n4+Tj
wbhR0A8rqEWAT42Owj2SpMNzwd/wC7lTfgIPePAVF2uGI8n9tWC+xT9iUTf19MN1
w+YM/ZPQmD0eDPgU9w==
=TC/T
-----END PGP SIGNATURE-----
Merge tag 'ntfs-for-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs
Pull ntfs fixes from Namjae Jeon:
- fix stale runlist element dereferences in MFT writeback and fallocate
- fix mrec_lock ABBA deadlock in rename
- prevent userspace modification of NTFS system files
- avoid inode eviction/writeback self-deadlocks
- reject malformed resident attributes in non-resident runlist mapping
- avoid post_write_mst_fixup() on invalid index blocks
- fix a hole runlist leak in insert-range error handling
- sanitize directory lookup MFT references from disk
- fail attribute-list updates after SB_ACTIVE is cleared during
teardown
* tag 'ntfs-for-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs:
ntfs: fail attrlist updates when the superblock is inactive
ntfs: sanitize MFT references returned from ntfs_lookup_inode_by_name()
ntfs: fix hole runlist memory leak in insert range error path
ntfs: avoid calling post_write_mst_fixup() for invalid index_block
ntfs: fix WARN_ON for resident attribute in ntfs_map_runlist_nolock()
ntfs: avoid self-deadlock during inode eviction
ntfs: make system files immutable to prevent corruption
ntfs: fix mrec_lock ABBA deadlock in rename
ntfs: avoid stale runlist element dereference in fallocate
ntfs: avoid stale runlist element dereference in MFT writeback
Bugfixes:
* SUNRPC: Release lower rpc_clnt if killed waiting for XPRT_LOCKED
* SUNRPC: Pin upper rpc_clnt across the TLS connect_worker
* NFS: Include MAY_WRITE in open permission mask for O_TRUNC
* NFS: Charge unstable writes by request size, not folio size
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEnZ5MQTpR7cLU7KEp18tUv7ClQOsFAmpRWv0ACgkQ18tUv7Cl
QOtb+xAA6IzOT6tSlcCuFYV4pOk6OCCUtntcDxqQDuYupQbkE04AJBq6sVPLSfXy
69BOLCKlG9hNCkZvLAb3tSWJTD1NzRX8tYhVFb6GKTz8cf/s7QqqVaaNKZu5Rrn3
AfZWNpw8KiUBhkjSMHVQL42QkIzASdDZ83vnL+LahbT4YAx9TNkkQIZLPBM0CKGU
pYdtd43Ex87M8g5gteBT0qVGsSLzGxoV2qO8qxatDvvQDQFZmnl1w4x6HwuxEVcB
1EhzfSDcWJOujHLpYV4+tk7FIw03MQvjPOoz71H2EXPUBZGRfXQjVggBzmvM6a91
aNLIUfv8LTGmqewfDdEe0r1amJPoknXnIoIvYiZIcKPT1VlMiK2A1y8r8zS307Rj
q3Lax7p6WawTx/Ecg1HD2jLRvn6I7SI7gF/IUcw8mL1uWOiT2quBLHrOcOvwZHzs
IGJ5ox+lMn1Dwdn86SF3zVxscMNSQ6aUr/zUXIeIx8EHUDyWwZ7gGSgmuP7YPS0I
wu34tm4T3pjFKjfylUoVidU/tvKMipREQoETxEvlWByfoxVabD9yahni3GL+oKcT
6/kAeJGpZh6+y2Er8dzxUStijCuv27X4V+DfOXSAWACLO8Sixcj52gkVydLKiFCc
dXFbti9Sjjqjyijmd93GSMhouAiASslLIfHVpvcYHR/AfA2ReGg=
=FUd/
-----END PGP SIGNATURE-----
Merge tag 'nfs-for-7.2-2' of git://git.linux-nfs.org/projects/anna/linux-nfs
Pull NFS client fixes from Anna Schumaker:
- SUNRPC:
- Release lower rpc_clnt if killed waiting for XPRT_LOCKED
- Pin upper rpc_clnt across the TLS connect_worker
- NFS:
- Include MAY_WRITE in open permission mask for O_TRUNC
- Charge unstable writes by request size, not folio size
* tag 'nfs-for-7.2-2' of git://git.linux-nfs.org/projects/anna/linux-nfs:
NFS: Charge unstable writes by request size, not folio size
NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
SUNRPC: pin upper rpc_clnt across the TLS connect_worker
SUNRPC: release lower rpc_clnt if killed waiting for XPRT_LOCKED
-----BEGIN PGP SIGNATURE-----
iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmpRLz8ACgkQiiy9cAdy
T1GalgwAqtaIFVMj7T1CDZcV/S0RymYPaiI2RNaaEcdn1T59mpsjaf5UVHwXN04K
SZjQcAdGOgWvjZlPYvzah4pw0/T6EHRMYe7d2MRanV5epx6PJqfmBS3/gJ+I1NvN
jckWo3RPnrixYWpIH/f9S0aIksyr19UUsxkDpfUHhQPerWXwIZNXR0+k/VbiHUDn
OnyhpasP6/okrNqZBZ8GjkCx7p5PENckd1p5hD+NeIRzQybHuWPos7kGIExp1973
BvXXzK76OXvB4aOUS/ofP1MxbmCvMaXUeM3JecPSspjOiu02z2qmRCnJVsCXztPC
uHe63kKHWSlunSAVH1wJHTG3BsI0hTK9Kmkyi7jbExpqYydpXwjLSEeQeggnoCBj
bQuVNslAYRzPFddjhxGyTkIyry8Hh2drlCD7FF1cxnlIz4x9ADOxiyEKHS7m9Xv+
ZJiEIuhs5IUJnU7xGXqSx4Ve4AU8rW7aRXYvXRS1LrdWj8EZpbIW70leFyv6ocAI
hG/TeGmG
=RhsK
-----END PGP SIGNATURE-----
Merge tag 'v7.2-rc2-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6
Pull smb client fixes from Steve French:
- DFS cache allocation fix
- DFS referral bounds check fix
- Fix absolute symlinks when mounting with POSIX extensions
- Fixes for incorrect nlink returned by fstat
- Fix atime in read completion
- Fix busy dentry on umount
- ioctl_query_info buffer overflow fix
- Two fixes for creating special files with SFU
- Fix mode mask in parse_dacl
- SMB1 is_path_accessible wildcard fix and minor SMB1 cleanup
- smb2_check_message fix
- Debug message improvement
- Minor cleanup
* tag 'v7.2-rc2-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
cifs: Remove CIFSSMBSetPathInfoFB() fallback function
cifs: Fix and improve cifs_is_path_accessible() function
smb: client: mask server-provided mode to 07777 in modefromsid
cifs: Show reason why autodisabling serverino support
smb/client: fix incorrect nlink returned by fstat()
smb/client: zero-initialize stack-allocated cifs_open_info_data
smb/client: pass cifs_open_info_data to SMB2_open()
smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink()
smb: client: fix overflow in passthrough ioctl bounds check
smb: client: fix busy dentry warning on unmount after DIO
cifs: Fix support for creating SFU fifo
cifs: Fix support for creating SFU socket
smb: client: fix atime clamp check in read completion
cifs: validate DFS referral string offsets
smb: client: use GFP_KERNEL for DFS cache allocations
smb: client: restrict implied bcc[0] exemption to responses without data area
smb: client: preserve leading slash for POSIX absolute symlink targets
smb: client: refactor cifs_revalidate_mapping() to use clear_and_wake_up_bit()
The message of commit 504e2b4ab9 ("dma-buf/udmabuf: skip redundant cpu sync to
fix cacheline EEXIST warning") says:
> The CPU sync at map/unmap time is also redundant for udmabuf:
> begin_cpu_udmabuf() and end_cpu_udmabuf() already perform explicit
> cache synchronization via dma_sync_sgtable_for_cpu/device() when CPU
> access is requested through the dma-buf interface.
This, however, does not apply to the first time begin_cpu_udmabuf() is
called on an udmabuf, in which case the implementation previously relied on
get_sg_table() to perform the cache synchronisation.
Ensure to call dma_sync_sgtable_for_cpu() in that case as well.
Fixes: 504e2b4ab9 ("dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning")
Signed-off-by: Robert Mader <robert.mader@collabora.com>
Reviewed-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Link: https://patch.msgid.link/20260627105725.9083-1-robert.mader@collabora.com
Add the device tree node of SDHCI-0 controller which found on CoM260-IFX
board, it's currenty used for Micro SD card slot, and one GPIO pin is
configured as card insertion/removal detection pin, the slot use 4-bit
data bus, and up support to SDR104 speed mode.
Link: https://patch.msgid.link/20260610-07-k3-enable-sd-v1-1-196ae29bd091@kernel.org
Signed-off-by: Yixun Lan <dlan@kernel.org>
I2C_DESIGNWARE_PLATFORM is default=y via I2C_DESIGNWARE_CORE, which is
enabled. No impact on include/generated/autoconf.h.
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Vineet Gupta <vgupta@kernel.org>
arc_get_cpu_map() fetches the possible-cpus or present-cpus property
from the flat DT and immediately passes the raw pointer to
cpulist_parse(). That parser expects a NUL-terminated text buffer, but
this path does not prove that the DT property is terminated within its
declared bounds.
Reject unterminated CPU-map properties before handing them to
cpulist_parse().
Changes since v1:
- fold the NUL-termination check into the initial lookup test, as
suggested by Vineet Gupta
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Vineet Gupta <vgupta@kernel.org>
Only one machine remains supported and was kept in 2022 for the
Debian_on_Buffalo project that was still using this, with plans to
convert it to devicetree.
The conversion never happened, and Debian_on_Buffalo does not provide
kernels later than linux-6.1, so it is unlikely to still be useful
for a DT conversion in the future.
Mark the platform for deprecation after the next LTS kernel, which
should give any remaining users a few more years of bugfixes.
Acked-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Link: https://lore.kernel.org/all/20221019150410.3851944-6-arnd@kernel.org/
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
The Axxia platform was initially upstream by Anders Berg for LSI and
later Avago, but this included only support for I2C and reset drivers,
while most of the interesting bits (network, pci, rapidio, usb, ...) or
the arm64 platform support were never merged.
The downstream kernel was maintained by Intel up to linux-5.15 when
the product line was discontinued. Known users include Nokia and
Ericsson, but both of them use kernels derived from the out-of-tree
drivers rather than the upstream version, and will be able to continue
doing that even when the rudimentary mainline support is gone.
Mark it as deprecated for removal after the next LTS kernel.
Link: https://github.com/axxia/linux-yocto
Cc: Stefan Wiehler <stefan.wiehler@nokia.com>
Reviewed-by: Alexander Sverdlin <alexander.sverdlin@siemens.com>
Reviewed-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
The Cortex-M3/M4/M7 cores were designed as a replacement for the earlier
ARM7TDMI and ARM9TDMI microarchitectures used in older microcontrollers.
At the moment, Linux can run these cores either when they are integrated
into a larger SoC, or as standalone microcontrollers. While there was
a lot of development work going into Cortex-M support from 2011 to 2016,
this largely stopped when it became clear that Zephyr and other RTOS
had taken over that market. To date, the only Cortex-M based based
microcontroller boards supported upstream are reference implementations.
Schedule these for removal after the next LTS kernel, so if any users
remain that want to update their kernels, they can stay on that
version for a few years before having to maintain the platform support
out of tree.
Acked-by: Vladimir Zapolskiy <vz@mleia.com> # NXP LPC18xx/LPC43xx
Acked-by: Vladimir Murzin <vladimir.murzin@arm.com> # MPS2
Acked-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Acked-by: Frank Li <Frank.Li@nxp.com> # i.MX
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
No user currently relies on sparse CPU masks, but the descriptor logic already
supports them via linear fallback. Remove the arbitrary limitation.
Link: https://patch.msgid.link/20260709160017.1729517-4-vdonnefort@google.com
Fixes: 2e67fabd8b ("ring-buffer: Introduce ring-buffer remotes")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Pre-calculate desc->struct_len up-front in trace_remote_alloc_buffer()
with trace_buffer_desc_size() to fix double-counting.
While at it, use the accessor __first_ring_buffer_desc().
Link: https://patch.msgid.link/20260709160017.1729517-3-vdonnefort@google.com
Fixes: 96e43537af ("tracing: Introduce trace remotes")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
If page allocation fails in trace_remote_alloc_buffer(), desc->nr_cpus
is not yet incremented for the current CPU. As a consequence, on error,
half-allocated rb_desc will not be freed in trace_remote_free_buffer().
Increment desc->nr_cpus as soon as the first allocation for the current
CPU has succeeded.
Link: https://patch.msgid.link/20260709160017.1729517-2-vdonnefort@google.com
Fixes: 96e43537af ("tracing: Introduce trace remotes")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
intel_vsec_add_dev() may attach an ACPI discovery table copy to the
intel_vsec_device before passing ownership to intel_vsec_add_aux(). The
normal auxiliary-device release path frees that copy, but the earliest
intel_vsec_add_aux() failures free only the outer structure directly.
Route those direct frees through a common helper so acpi_disc is
released consistently on the parent, xarray, and ID allocation failure
paths.
Fixes: 22fa2ebc11 ("platform/x86/intel/vsec: Plumb ACPI PMT discovery tables through vsec")
Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
Reviewed-by: David E. Box <david.e.box@linux.intel.com>
Link: https://patch.msgid.link/CAMuQ4bUtJtYNTguKoiXngROJw0QQQcrvW3=3_B0-hpMQOFqvCQ@mail.gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
- Fix crash when using SMT hotplug on ACPI systems in conjunction with
maxcpus=.
- Fix 30% kswapd performance regression introduced by C1-Pro SME erratum
workaround.
- Fix TLB over-invalidation regression during memory hotplug.
- Fix incorrect encoding of FEAT_BWE2 value in ID_AA64DFR2_EL1.BWE.
- Typo fixes in the arm64 selftests.
-----BEGIN PGP SIGNATURE-----
iQFEBAABCgAuFiEEPxTL6PPUbjXGY88ct6xw3ITBYzQFAmpQ3FkQHHdpbGxAa2Vy
bmVsLm9yZwAKCRC3rHDchMFjNB5/B/9L6cQyMiFFdHiPdyZs1zzx2U5pTtKZQuLZ
KQsJNhEuk0x50zSHJry+Be2FPkbqJzGiEl+cIyMjWt5hbDnTuj1MylLPX1HgpblG
oXCsBOq3ahPBCmngLTq9jmQWGqBsc/9x9IscIhICY3hbjyc1esl7OAfRCxZeDjMW
+ybpv6pYsheMvNm8NAN3RmpSWgxgiiP50HBdOHkSNNsF8NfVr3SwW7fv2sdaLWEo
jdPvpP8k+misIZoXw/tdXhpUlTrseWnuhuV8R08mloJF4J6fMoYgwJNpkOttTphT
EomGhwYI7pCqh7otX1GPvcZtzL4OB2zVBCJwmRNmdlOegMnFoWtK
=J2Ug
-----END PGP SIGNATURE-----
Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
Pull arm64 fixes from Will Deacon:
- Fix crash when using SMT hotplug on ACPI systems in conjunction with
maxcpus=
- Fix 30% kswapd performance regression introduced by C1-Pro SME
erratum workaround
- Fix TLB over-invalidation regression during memory hotplug
- Fix incorrect encoding of FEAT_BWE2 value in ID_AA64DFR2_EL1.BWE
- Typo fixes in the arm64 selftests
* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
selftests/arm64: fix spelling errors in comments
arm64/sysreg: Fix BWE field encoding in ID_AA64DFR2_EL1
arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range()
arm64: Avoid eager DVMSync reclaim batches with C1-Pro SME erratum
cpu/hotplug: Fix NULL kobject warning in cpuhp_smt_enable()
arm64: smp: Fix hot-unplug tearing by forcing unregistration
Fixes
- amd/pmc:
- Use correct IP block table for AMD 1Ah M80H SoC
- Avoid logging "(null)" for missing DMI values
- asus-armoury: update power limits for G614PR
- bitland-mifs-wmi: Fix NULL pointer dereference during suspend/resume
The following is an automated shortlog grouped by driver:
amd/pmc:
- Avoid logging "(null)" for DMI values
amd-pmc:
- Use correct IP block table for AMD 1Ah M80H SoC
asus-armoury:
- update power limits for G614PR
bitland-mifs-wmi:
- Fix NULL pointer dereference during suspend/resume
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQSCSUwRdwTNL2MhaBlZrE9hU+XOMQUCalDWfQAKCRBZrE9hU+XO
MRg6AQClzm56cAKihLDveRd1iQxSK1SC5SR1ZlAsrUiH1iIClQEAr/e8V0Ax8On+
O7nhuR6Jh4nWuLijj+BuCfhg3D88yg0=
=CBFq
-----END PGP SIGNATURE-----
Merge tag 'platform-drivers-x86-v7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86
Pull x86 platform driver fixes from Ilpo Järvinen:
- amd/pmc:
- Use correct IP block table for AMD 1Ah M80H SoC
- Avoid logging "(null)" for missing DMI values
- asus-armoury: update power limits for G614PR
- bitland-mifs-wmi: Fix NULL pointer dereference during suspend/resume
* tag 'platform-drivers-x86-v7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86:
platform/x86: amd-pmc: Use correct IP block table for AMD 1Ah M80H SoC
platform/x86: asus-armoury: update power limits for G614PR
platform/x86: bitland-mifs-wmi: Fix NULL pointer dereference during suspend/resume
platform/x86/amd/pmc: Avoid logging "(null)" for DMI values
When switching a task's sched_class away from sched_ext, we get the
following sequence of events in __sched_setscheduler():
sched_change_begin()
switched_from_scx()
scx_disable_task(p)
ops.disable(p)
__setscheduler_params()
set_load_weight()
reweight_task_scx(p)
ops.set_weight(p)
p->sched_class = next_class;
sched_change_end()
...
Notably, ops.set_weight() is called _after_ ops.disable().
This violates the expected semantics of the callbacks, the expectation
being that ops.disable() can only be followed by ops.exit_task() or
ops.enable().
Skipping the weight adjustment for disabled tasks should be harmless
since the weight will be recalculated in scx_enable_task() if the task
ever rejoins SCX.
Fixes: 637b068282 ("sched: Fold sched_class::switch{ing,ed}_{to,from}() into the change pattern")
Cc: stable@vger.kernel.org # v6.19+
Signed-off-by: Kuba Piecuch <jpiecuch@google.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
There were wrong calculations in dm_jiffies_to_msec64 that produced
incorrect output when HZ was different from 1000. This commit fixes them.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Assisted-by: Claude:claude-opus-4-6
Fixes: fd2ed4d252 ("dm: add statistics support")
Cc: stable@vger.kernel.org
