Commit graph

169,396 commits

Author SHA1 Message Date
Dmitry Torokhov
b2b6f3eda6 Immutable branch between MFD, Input, Power and Regulator due for the v6.19 merge window
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEdrbJNaO+IJqU8IdIUa+KL4f8d2EFAmj3wesACgkQUa+KL4f8
 d2HC/w/+O7GzFUWTgGiT4YeuMDd2dhwZ/k6ZNjmQhtGZwydo0lzNCTaRT4mE9AFA
 84+iXFQAwnr+Fe+H744ujqxVuK3yx/wLxfSR4alr2GitRYhwzhdMe2b5NMPEve1d
 zXY/086I1gUM4D6rHJfH6wdAtVxeKUQUPfH82J/3qXMuOyFabr4439Hr76DlJW/4
 8tPIgANkmSJpVlZCGGvjrtm5q14+XkpJOgI38Hdz88H8AE425tdrumTmrRCjTsyC
 6mo03vRq/TLGGR32jZM9zRztteE97GN+pCc7ktL5JoKGsQJ1D2m4bVYuiEpBRiPD
 pkrHbaimI5fycJpboMhBOsmPYmlYIpfwNWMync3YPYOidIUQXxcftcdpYF30/aoz
 uMVcbIscdAoCjAm6grbCeADQF/MqLTOOFnJ3ExQHDmHx8nXhqu8ivK/7x9uEdx1c
 oeArBW+plj1b+9tq35ff2LJGIIIPqz9B6r6tJ+uUEbh5FoyD0gwMb8IB/MITccNu
 yBKs9l+0L6/6cZQ58m3mtWB9iScQYrR25uU/iSS5Mtz0Ul/a5fmjQ1QSpz5HxAHf
 ityq3kLRBabyxQEd04cwd93voGZpwIxetWxg5VJkFGB0TeeShMwbjMQGAfnE+4SU
 CeR7IdAaEtyuYBHWeLdxGhg0Oqj5RbeTsLfz5IAnoFmo7kOF/hM=
 =7qjH
 -----END PGP SIGNATURE-----

Merge tag 'ib-mfd-input-power-regulator-v6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd into next

Pull in pf1550-onkey driver.
2025-12-13 01:20:17 -08:00
Linus Torvalds
6cf62f0174 Char/Misc/IIO fixes for 6.18-rc8
Here are some much-delayed char/misc/iio driver fixes for 6.18-rc8.
 
 Fixes in here include:
   - lots of iio driver bugfixes for reported issues.
   - counter driver bugfix
   - slimbus driver bugfix
   - mei tiny bugfix
   - nvmem layout uevent bugfix
 
 All of these have been in linux-next for a while, but due to travel on
 my side, I haven't had a chance to get them to you.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCaSnL1g8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ymUpACfaPn4EMLwg1fF60cmYoW0mr0RGg4An1xj6YB3
 evzxFzdPf6HwPPkxSOmx
 =3lRL
 -----END PGP SIGNATURE-----

Merge tag 'char-misc-6.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

Pull char / misc / IIO fixes from Greg KH:
 "Here are some much-delayed char/misc/iio driver fixes for 6.18-rc8.

  Fixes in here include:

   - lots of iio driver bugfixes for reported issues.

   - counter driver bugfix

   - slimbus driver bugfix

   - mei tiny bugfix

   - nvmem layout uevent bugfix

  All of these have been in linux-next for a while, but due to travel on
  my side, I haven't had a chance to get them to you"

* tag 'char-misc-6.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (23 commits)
  nvmem: layouts: fix nvmem_layout_bus_uevent
  iio: accel: bmc150: Fix irq assumption regression
  most: usb: fix double free on late probe failure
  slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves
  firmware: stratix10-svc: fix bug in saving controller data
  mei: fix error flow in probe
  iio: st_lsm6dsx: Fixed calibrated timestamp calculation
  iio: humditiy: hdc3020: fix units for thresholds and hysteresis
  iio: humditiy: hdc3020: fix units for temperature and humidity measurement
  iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields
  iio: accel: fix ADXL355 startup race condition
  iio: adc: ad7124: fix temperature channel
  iio:common:ssp_sensors: Fix an error handling path ssp_probe()
  iio: adc: ad7280a: fix ad7280_store_balance_timer()
  iio: buffer-dmaengine: enable .get_dma_dev()
  iio: buffer-dma: support getting the DMA channel
  iio: buffer: support getting dma channel from the buffer
  iio: pressure: bmp280: correct meas_time_us calculation
  iio: adc: stm32-dfsdm: fix st,adc-alt-channel property handling
  iio: adc: ad7380: fix SPI offload trigger rate
  ...
2025-11-28 09:44:48 -08:00
Linus Torvalds
5d324e5159 USB/Thunderbolt fixes for 6.18-rc8
Here are some last-minutes USB and Thunderbolt driver fixes and new
 device ids for 6.18-rc8.  Included in here are:
   - usb storage quirk fixup
   - xhci driver fixes for reported issues
   - usb gadget driver fixes
   - dwc3 driver fixes
   - UAS driver fixup
   - thunderbolt new device ids
   - usb-serial driver new ids
 
 All of these have been in linux-next with no reported issues, many for
 many weeks.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCaSnO0w8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ymqyACgvNvTnpfj8lx0L9aESj6Hra0UZ20AoKlYRFW1
 gAVcF4Wafnu7ehjAITXL
 =cH0/
 -----END PGP SIGNATURE-----

Merge tag 'usb-6.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB/Thunderbolt fixes from Greg KH:
 "Here are some last-minutes USB and Thunderbolt driver fixes and new
  device ids for 6.18-rc8. Included in here are:

   - usb storage quirk fixup

   - xhci driver fixes for reported issues

   - usb gadget driver fixes

   - dwc3 driver fixes

   - UAS driver fixup

   - thunderbolt new device ids

   - usb-serial driver new ids

  All of these have been in linux-next with no reported issues, many for
  many weeks"

* tag 'usb-6.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (21 commits)
  usb: gadget: renesas_usbf: Handle devm_pm_runtime_enable() errors
  USB: storage: Remove subclass and protocol overrides from Novatek quirk
  usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer
  usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths
  xhci: dbgtty: fix device unregister
  usb: storage: sddr55: Reject out-of-bound new_pba
  USB: serial: option: add support for Rolling RW101R-GL
  usb: typec: ucsi: psy: Set max current to zero when disconnected
  usb: gadget: f_eem: Fix memory leak in eem_unwrap
  usb: dwc3: pci: Sort out the Intel device IDs
  usb: dwc3: pci: add support for the Intel Nova Lake -S
  drivers/usb/dwc3: fix PCI parent check
  usb: storage: Fix memory leak in USB bulk transport
  xhci: sideband: Fix race condition in sideband unregister
  xhci: dbgtty: Fix data corruption when transmitting data form DbC to host
  xhci: fix stale flag preventig URBs after link state error is cleared
  USB: serial: ftdi_sio: add support for u-blox EVK-M101
  usb: cdns3: Fix double resource release in cdns3_pci_probe
  usb: gadget: udc: fix use-after-free in usb_gadget_state_work
  usb: renesas_usbhs: Fix synchronous external abort on unbind
  ...
2025-11-28 09:12:40 -08:00
Linus Torvalds
24a84ea4ee omap: check for pending msgs only when mbox is exclusive
mailbox-test: debugfs_create_dir error checking
 mtk: cmdq: fix DMA address handling
      gpueb: Add missing 'static' to mailbox ops struct
 pcc: don't zero error register
 th1520: fix clock imbalance on probe failure
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE6EwehDt/SOnwFyTyf9lkf8eYP5UFAmkpxWMACgkQf9lkf8eY
 P5UUdhAAmIWRSr8U16HdYYHZ32TCqsEn/cm38RRR9NyrYYTTTUIWwlh8S8ff0Ldh
 zuBWYzZuo4EocQOE1YVbKUM3hspgobcIJNg7hBVeMT8l6cD/Hmk0FKm4zDssyvWk
 XHC6AB3MLAVH8/n8c0NQn1mou0mOSEIFsOjnzikkkaDhKIJM14pnX5gIL8hG3kyV
 /B60QIkUCz7+3/OCQF42kQlG/l6D8m/FncK02rZcOyvPFbyiA3F/GhIrQ61dqKEm
 8iMP4+srLCek5UmL0LReFaiq69KJvKxqdaWD70o8mcC1a51MSnZAmwZSdSuFablf
 hOspEdBpxH2rBeMG/7bEvDZPpKRSvf6S9eI2d2oDK/9NusIjnmx4ryxanp+dknHS
 weEKI04VOEiFgByxBUbmB+xMman5q6AF98Mz+N/trp1yU/rxUFLvsUDO7jy2uQVn
 zXGNLPC+vW5SoLEYru6zdnJW+m0N/CWVEdz8+2ne+MHkRa+2IDHdfNDuTrFmd0J0
 /iWrAQXdMJ6BDkuYJNy16d4GLjkM2lp0K9w07ltezI7pHAQd3EPcMGXzB5BXAe+h
 CWh5oTicoAAaxKP0Ya8jYEI5c/vRbVLXdepOn/izcEy0+mE2ACqlQMrUbN4omgal
 t6c5L5/yJQsD8whS6Fio9cFLEj5esNFep38T7BuGrX9PSgVJFlc=
 =8o7Y
 -----END PGP SIGNATURE-----

Merge tag 'mailbox-fixes-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox

Pull mailbox fixes from Jassi Brar:

 - omap: check for pending msgs only when mbox is exclusive

 - mailbox-test: debugfs_create_dir error checking

 - mtk:
     - cmdq: fix DMA address handling
     - gpueb: Add missing 'static' to mailbox ops struct

 - pcc: don't zero error register

 - th1520: fix clock imbalance on probe failure

* tag 'mailbox-fixes-v6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox:
  mailbox: th1520: fix clock imbalance on probe failure
  mailbox: pcc: don't zero error register
  mailbox: mtk-gpueb: Add missing 'static' to mailbox ops struct
  mailbox: mtk-cmdq: Refine DMA address handling for the command buffer
  mailbox: mailbox-test: Fix debugfs_create_dir error checking
  mailbox: omap-mailbox: Check for pending msgs only when mbox is exclusive
2025-11-28 09:09:33 -08:00
Jason-JH Lin
a195c7ccfb mailbox: mtk-cmdq: Refine DMA address handling for the command buffer
GCE can only fetch the command buffer address from a 32-bit register.
Some SoCs support a 35-bit command buffer address for GCE, which
requires a right shift of 3 bits before setting the address into
the 32-bit register. A comment has been added to the header of
cmdq_get_shift_pa() to explain this requirement.

To prevent the GCE command buffer address from being DMA mapped beyond
its supported bit range, the DMA bit mask for the device is set during
initialization.

Additionally, to ensure the correct shift is applied when setting or
reading the register that stores the GCE command buffer address,
new APIs, cmdq_convert_gce_addr() and cmdq_revert_gce_addr(), have
been introduced for consistent operations on this register.

The variable type for the command buffer address has been standardized
to dma_addr_t to prevent handling issues caused by type mismatches.

Fixes: 0858fde496 ("mailbox: cmdq: variablize address shift in platform")
Signed-off-by: Jason-JH Lin <jason-jh.lin@mediatek.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
2025-11-28 09:31:53 -06:00
Linus Torvalds
e1afacb685 A patch to make sparse read handling work in msgr2 secure mode from
Slava and a couple of fixes from Ziming and myself to avoid operating
 on potentially invalid memory, all marked for stable.
 -----BEGIN PGP SIGNATURE-----
 
 iQFHBAABCAAxFiEEydHwtzie9C7TfviiSn/eOAIR84sFAmkomw8THGlkcnlvbW92
 QGdtYWlsLmNvbQAKCRBKf944AhHzi7inB/4kGwlnraCx43Lw4UG4K/Z6RKypQ8zD
 WxwFvszq9jHJL7uUvXLx97sZApeK+AG6Kql/jnpEUUkFlG1h3013OwKJgRINrOdn
 5wJaWwi73akCWt3FDgcpc+gnxQ3s7gbD3cPbNeEhoHTjUrHk59ZgT37zbnUIrFK3
 NqnSBO7+7EPZtWwmC7mtki+lRLr3z47TqeqLqLQhw6GoenRo/9ZrUynvneCWKXfT
 bZRZ5MDJGg/ZMR1agPmUojgHkkZAD5xc21fK5mmYeMr9JbNB4Vw9BO48XW+WCA3o
 TH5en6HZhJuoxkp21mG7BZjnkAVTPCpo3pMt2IqlAIWCkODtXlThWGQN
 =cZYx
 -----END PGP SIGNATURE-----

Merge tag 'ceph-for-6.18-rc8' of https://github.com/ceph/ceph-client

Pull ceph fixes from Ilya Dryomov:
 "A patch to make sparse read handling work in msgr2 secure mode from
  Slava and a couple of fixes from Ziming and myself to avoid operating
  on potentially invalid memory, all marked for stable"

* tag 'ceph-for-6.18-rc8' of https://github.com/ceph/ceph-client:
  libceph: prevent potential out-of-bounds writes in handle_auth_session_key()
  libceph: replace BUG_ON with bounds check for map->max_osd
  ceph: fix crash in process_v2_sparse_read() for encrypted directories
  libceph: drop started parameter of __ceph_open_session()
  libceph: fix potential use-after-free in have_mon_and_osd_map()
2025-11-27 11:11:03 -08:00
Linus Torvalds
1f5e808aa6 Including fixes from bluetooth and CAN. No known outstanding
regressions.
 
 Current release - regressions:
 
   - mptcp: initialize rcv_mss before calling tcp_send_active_reset()
 
   - eth: mlx5e: fix validation logic in rate limiting
 
 Previous releases - regressions:
 
   - xsk: avoid data corruption on cq descriptor number
 
   - bluetooth:
     - prevent race in socket write iter and sock bind
     - fix not generating mackey and ltk when repairing
 
   - can:
     - kvaser_usb: fix potential infinite loop in command parsers
     - rcar_canfd: fix CAN-FD mode as default
 
   - eth: veth: reduce XDP no_direct return section to fix race
 
   - eth: virtio-net: avoid unnecessary checksum calculation on guest RX
 
 Previous releases - always broken:
 
   - sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr()
 
   - bluetooth: mediatek: fix kernel crash when releasing iso interface
 
   - vhost: rewind next_avail_head while discarding descriptors
 
   - eth: r8169: fix RTL8127 hang on suspend/shutdown
 
   - eth: aquantia: add missing descriptor cache invalidation on ATL2
 
   - dsa: microchip: fix resource releases in error path
 
 Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCgAwFiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmkoYU0SHHBhYmVuaUBy
 ZWRoYXQuY29tAAoJECkkeY3MjxOkKXoQALd11FrsOuRQ9VH7pv5gtOkvPvdAq/q0
 ZSrqaK+/sIEAm8X4OtmuzZCMM0cjsbptZ7Lcs84SlqarHj86I7O0NgRzHrE5oy5u
 kK/aWcK8FNMt0h/EMPpm9sZbEjbCjT1T6k5+lpvJja5LD+aJXG2BnYxEPBFxyx/z
 Au1fq8PxJTmQIAEVVlgRbCW56zaoYsic45YdQJstIfVDLi34tjm76hz97m2bUEj5
 wnCrEN5Ghmn8tcuTsTv5OHEkIKXSBUpuctsviOqIgMTDquOrMa/4niSVp7N116tJ
 3oOTRer38MEoI7uMAuQFP4NmaMWQcAs/ky3gFdepX81iiIXEIP/PEHucXVWCTU6N
 m13TmCN7gFRNPOvFgVlWIPEMJDOkblnEvL8Mw7ux0sd235Cf8BzLiPU+XaeGo4JN
 wfRit/7tzTAtP5Ft9nqT/7Cl9gshD+9/jG6binKoY1JG2aMHovYC1LmdVPYvkp25
 hMGFaryZuCcGmVnWbHzwn00JWArdy5TZTEfGZvqUQsoHyPHkPrt5STpNpl3WWrzV
 yjp0RxVeVF7VThm/4m2Jq17Fo7RUimo/EIosbbaqWFYZTJBM7gU6VvYca9Q0kKdW
 SjzZ8Eq3G0eqWYhk1ZFvlEcZkkZNpCpb8YzWibscDCEj1Ugv6fiNXswlz5IZb+jF
 UuXeTpCOEgQY
 =0MuR
 -----END PGP SIGNATURE-----

Merge tag 'net-6.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Paolo Abeni:
 "Including fixes from bluetooth and CAN. No known outstanding
  regressions.

  Current release - regressions:

   - mptcp: initialize rcv_mss before calling tcp_send_active_reset()

   - eth: mlx5e: fix validation logic in rate limiting

  Previous releases - regressions:

   - xsk: avoid data corruption on cq descriptor number

   - bluetooth:
       - prevent race in socket write iter and sock bind
       - fix not generating mackey and ltk when repairing

   - can:
       - kvaser_usb: fix potential infinite loop in command parsers
       - rcar_canfd: fix CAN-FD mode as default

   - eth:
       - veth: reduce XDP no_direct return section to fix race
       - virtio-net: avoid unnecessary checksum calculation on guest RX

  Previous releases - always broken:

   - sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr()

   - bluetooth: mediatek: fix kernel crash when releasing iso interface

   - vhost: rewind next_avail_head while discarding descriptors

   - eth:
       - r8169: fix RTL8127 hang on suspend/shutdown
       - aquantia: add missing descriptor cache invalidation on ATL2

   - dsa: microchip: fix resource releases in error path"

* tag 'net-6.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (47 commits)
  mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose().
  net: fec: do not register PPS event for PEROUT
  net: fec: do not allow enabling PPS and PEROUT simultaneously
  net: fec: do not update PEROUT if it is enabled
  net: fec: cancel perout_timer when PEROUT is disabled
  net: mctp: unconditionally set skb->dev on dst output
  net: atlantic: fix fragment overflow handling in RX path
  MAINTAINERS: separate VIRTIO NET DRIVER and add netdev
  virtio-net: avoid unnecessary checksum calculation on guest RX
  eth: fbnic: Fix counter roll-over issue
  mptcp: clear scheduled subflows on retransmit
  net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic
  s390/net: list Aswin Karuvally as maintainer
  net: wwan: mhi: Keep modem name match with Foxconn T99W640
  vhost: rewind next_avail_head while discarding descriptors
  net/sched: em_canid: fix uninit-value in em_canid_match
  can: rcar_canfd: Fix CAN-FD mode as default
  xsk: avoid data corruption on cq descriptor number
  r8169: fix RTL8127 hang on suspend/shutdown
  net: sxgbe: fix potential NULL dereference in sxgbe_rx()
  ...
2025-11-27 09:18:40 -08:00
Jon Kohler
1cd1c47234 virtio-net: avoid unnecessary checksum calculation on guest RX
Commit a2fb4bc4e2 ("net: implement virtio helpers to handle UDP
GSO tunneling.") inadvertently altered checksum offload behavior
for guests not using UDP GSO tunneling.

Before, tun_put_user called tun_vnet_hdr_from_skb, which passed
has_data_valid = true to virtio_net_hdr_from_skb.

After, tun_put_user began calling tun_vnet_hdr_tnl_from_skb instead,
which passes has_data_valid = false into both call sites.

This caused virtio hdr flags to not include VIRTIO_NET_HDR_F_DATA_VALID
for SKBs where skb->ip_summed == CHECKSUM_UNNECESSARY. As a result,
guests are forced to recalculate checksums unnecessarily.

Restore the previous behavior by ensuring has_data_valid = true is
passed in the !tnl_gso_type case, but only from tun side, as
virtio_net_hdr_tnl_from_skb() is used also by the virtio_net driver,
which in turn must not use VIRTIO_NET_HDR_F_DATA_VALID on tx.

cc: stable@vger.kernel.org
Fixes: a2fb4bc4e2 ("net: implement virtio helpers to handle UDP GSO tunneling.")
Signed-off-by: Jon Kohler <jon@nutanix.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Link: https://patch.msgid.link/20251125222754.1737443-1-jon@nutanix.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-11-26 19:45:54 -08:00
Ilya Dryomov
85f5491d9c libceph: drop started parameter of __ceph_open_session()
With the previous commit revamping the timeout handling, started isn't
used anymore.  It could be taken into account by adjusting the initial
value of the timeout, but there is little point as both callers capture
the timestamp shortly before calling __ceph_open_session() -- the only
thing of note that happens in the interim is taking client->mount_mutex
and that isn't expected to take multiple seconds.

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
2025-11-26 23:29:11 +01:00
Rafael J. Wysocki
43ff36c4a5 Revert "ACPI: processor: idle: Optimize ACPI idle driver registration"
Revert commit 7a8c994cbb ("ACPI: processor: idle: Optimize ACPI idle
driver registration") because it is reported to introduce a cpuidle
regression leading to a kernel crash on a platform using the ACPI idle
driver.

Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reported-by: Borislav Petkov <bp@alien8.de>
Tested-by: Borislav Petkov (AMD) <bp@alien8.de>
Closes: https://lore.kernel.org/lkml/20251124200019.GIaSS5U9HhsWBotrQZ@fat_crate.local/
2025-11-25 16:08:06 +01:00
Rafael J. Wysocki
1a8b350182 Revert "ACPI: processor: Remove unused empty stubs of some functions"
Revert commit 5020d05b34 ("ACPI: processor: Remove unused empty stubs
of some functions") because it depends on a problematic one.

Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2025-11-25 15:05:01 +01:00
Rafael J. Wysocki
e6889323c2 Revert "ACPI: processor: idle: Rearrange declarations in header file"
Revert commit bdf780fbce ("ACPI: processor: idle: Rearrange declarations
in header file") because it depends on a problematic one.

Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2025-11-25 15:03:24 +01:00
Rafael J. Wysocki
66e600a26e Revert "ACPI: processor: idle: Redefine two functions as void"
Revert commit fbd401e95e ("ACPI: processor: idle: Redefine two
functions as void") because it depends on a problematic one.

Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2025-11-25 14:53:33 +01:00
Rafael J. Wysocki
34fa09c698 Revert "ACPI: processor: Do not expose global variable acpi_idle_driver"
Revert commit 559f2eacc8 ACPI: processor: Do not expose global variable
acpi_idle_driver" because it depends on a problematic one.

Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2025-11-25 14:50:25 +01:00
Eric Dumazet
4fe5a00ec7 net: sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr()
syzbot reported that tcf_get_base_ptr() can be called while transport
header is not set [1].

Instead of returning a dangling pointer, return NULL.

Fix tcf_get_base_ptr() callers to handle this NULL value.

[1]
 WARNING: CPU: 1 PID: 6019 at ./include/linux/skbuff.h:3071 skb_transport_header include/linux/skbuff.h:3071 [inline]
 WARNING: CPU: 1 PID: 6019 at ./include/linux/skbuff.h:3071 tcf_get_base_ptr include/net/pkt_cls.h:539 [inline]
 WARNING: CPU: 1 PID: 6019 at ./include/linux/skbuff.h:3071 em_nbyte_match+0x2d8/0x3f0 net/sched/em_nbyte.c:43
Modules linked in:
CPU: 1 UID: 0 PID: 6019 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Call Trace:
 <TASK>
  tcf_em_match net/sched/ematch.c:494 [inline]
  __tcf_em_tree_match+0x1ac/0x770 net/sched/ematch.c:520
  tcf_em_tree_match include/net/pkt_cls.h:512 [inline]
  basic_classify+0x115/0x2d0 net/sched/cls_basic.c:50
  tc_classify include/net/tc_wrapper.h:197 [inline]
  __tcf_classify net/sched/cls_api.c:1764 [inline]
  tcf_classify+0x4cf/0x1140 net/sched/cls_api.c:1860
  multiq_classify net/sched/sch_multiq.c:39 [inline]
  multiq_enqueue+0xfd/0x4c0 net/sched/sch_multiq.c:66
  dev_qdisc_enqueue+0x4e/0x260 net/core/dev.c:4118
  __dev_xmit_skb net/core/dev.c:4214 [inline]
  __dev_queue_xmit+0xe83/0x3b50 net/core/dev.c:4729
  packet_snd net/packet/af_packet.c:3076 [inline]
  packet_sendmsg+0x3e33/0x5080 net/packet/af_packet.c:3108
  sock_sendmsg_nosec net/socket.c:727 [inline]
  __sock_sendmsg+0x21c/0x270 net/socket.c:742
  ____sys_sendmsg+0x505/0x830 net/socket.c:2630

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-by: syzbot+f3a497f02c389d86ef16@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6920855a.a70a0220.2ea503.0058.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20251121154100.1616228-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-11-24 18:53:14 -08:00
Linus Torvalds
ebd975458d Input updates for v6.18-rc6
- INPUT_PROP_HAPTIC_TOUCHPAD definition added early in 6.18 cycle has
   been renamed to INPUT_PROP_PRESSUREPAD to better reflect the kind of
   devices it is supposed to be set for
 
 - a new ID for a touchscreen found in Ayaneo Flip DS in Goodix driver
 
 - Goodix driver no longer tries to set reset pin as "input" as it causes
   issues when there is no pull up resistor installed on the board
 
 - fixes for cros_ec_keyb, imx_sc_key, and pegasus-notetaker drivers to
   deal with potential out-of-bounds access and memory corruption issues
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCaSFbUAAKCRBAj56VGEWX
 nC+zAQCmxIsTcA4GEPgelW0dRaaKCcCnr++0RQVW5hFJ+0VgTgD6AlzkMtdy5O30
 91gz5ooMKSz5SMsgb97N2GlayGKezA0=
 =dMey
 -----END PGP SIGNATURE-----

Merge tag 'input-for-v6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

Pull input fixes from Dmitry Torokhov:

 - INPUT_PROP_HAPTIC_TOUCHPAD definition added early in 6.18 cycle has
   been renamed to INPUT_PROP_PRESSUREPAD to better reflect the kind of
   devices it is supposed to be set for

 - a new ID for a touchscreen found in Ayaneo Flip DS in Goodix driver

 - Goodix driver no longer tries to set reset pin as "input" as it
   causes issues when there is no pull up resistor installed on the
   board

 - fixes for cros_ec_keyb, imx_sc_key, and pegasus-notetaker drivers to
   deal with potential out-of-bounds access and memory corruption issues

* tag 'input-for-v6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: rename INPUT_PROP_HAPTIC_TOUCHPAD to INPUT_PROP_PRESSUREPAD
  Input: cros_ec_keyb - fix an invalid memory access
  Input: imx_sc_key - fix memory corruption on unload
  Input: pegasus-notetaker - fix potential out-of-bounds access
  Input: goodix - remove setting of RST pin to input
  Input: goodix - add support for ACPI ID GDIX1003
2025-11-22 09:58:41 -08:00
Linus Torvalds
317c4d8a2a ata fixes for 6.18-rc7
- Add a missing refcount decrement in ata_scsi_dev_rescan() when
    the device or its queue is not running. In the case where the
    device is running, the recount is already decremented properly
    (Yihang Li)
 
  - Generate the proper sense code for a Security locked device.
    There was a regression caused by a recent change of how sense
    data is generated for commands that did not provide any sense
    data. This broke system suspend for Security locked devices.
    Generate the sense data that the SCSI disk driver expects for
    a Security locked device so that system supend works again
    (me)
 
  - Set capacity to zero for a Security locked device.
    All I/O commands will be aborted by a Security locked device.
    Thus, the block layer disk partition scanning will result in
    a bunch of, for the user, confusing I/O errors in dmesg during
    boot. Since a Security locked device is unusable anyway, set
    the capacity to zero, to avoid the disk partition scanning
    during boot. We still create the block device in /dev such
    that the user may unlock the device using e.g. hdparm (me)
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRN+ES/c4tHlMch3DzJZDGjmcZNcgUCaSB/+AAKCRDJZDGjmcZN
 cswtAP4l1Ui8d6PwHnxVvOlv1cWO/K+7XboiGZNFphf7QDZhPQD+J41BG/YNyNcB
 Ma716tdF1UVayUB2OItsX0gSmmz9KgI=
 =0b5E
 -----END PGP SIGNATURE-----

Merge tag 'ata-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux

Pull ata fixes from Niklas Cassel:

 - Add a missing refcount decrement in ata_scsi_dev_rescan() when
   the device or its queue is not running.

   In the case where the device is running, the recount is already
   decremented properly (Yihang Li)

 - Generate the proper sense code for a Security locked device.

   There was a regression caused by a recent change of how sense
   data is generated for commands that did not provide any sense
   data. This broke system suspend for Security locked devices.

   Generate the sense data that the SCSI disk driver expects for a
   Security locked device so that system suspend works again (me)

 - Set capacity to zero for a Security locked device.

   All I/O commands will be aborted by a Security locked device.
   Thus, the block layer disk partition scanning will result in
   a bunch of, for the user, confusing I/O errors in dmesg during
   boot.

   Since a Security locked device is unusable anyway, set the capacity
   to zero, to avoid the disk partition scanning during boot. We still
   create the block device in /dev such that the user may unlock the
   device using e.g. hdparm (me)

* tag 'ata-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:
  ata: libata-core: Set capacity to zero for a security locked drive
  ata: libata-scsi: Fix system suspend for a security locked drive
  ata: libata-scsi: Add missing scsi_device_put() in ata_scsi_dev_rescan()
2025-11-21 10:53:23 -08:00
Linus Torvalds
c6d732c3bd drm fixes for 6.18-rc7
atomic:
 - Return error codes on failed blob creation for planes
 
 nouveau:
 - Fix memory leak
 
 tegra:
 - Fix device ref counting
 - Fix pid ref counting
 - Revert booting on Pixel C
 
 xe:
 - Fix out-of-bounds access with BIT()
 - Fix kunit test checking wrong condition
 - Drop duplicate kconfig select
 - Fix guc2host irq handler with MSI-X
 
 i915:
 - Wildcat Lake and Panther Lake detangled for display fixes
 
 amdgpu:
 - DTBCLK gating fix
 - EDID fetching retry improvements
 - HDMI HPD debounce filtering
 - DCN 2.0 cursor fix
 - DP MST PBN fix
 - VPE fix
 - GC 11 fix
 - PRT fix
 - MMIO remap page fix
 - SR-IOV fix
 
 radeon:
 - Fence deadlock fix
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmkgKwsACgkQDHTzWXnE
 hr5I7w//ZJ/IZjVOvkj53Z0+Nt/HO0Jg+tM+5Q0fldhMlvnh+c7WpcyWRivi5hLV
 JgOJJagu6CrXNKGwdghDRbV4fOW+LsqHTFim2JnxA2k/6est3ZaWfiwo6e0kza2W
 whRLUcC0G0zoIYESAgzEr2Th52vYRR6SHj/HGLs00EUx8zdIUnbzQd1LqQb9RjCo
 zHdbuig9ZInCDpp4bRSgrlOrIgBC1ysWWHLYK5cF1K54/7a/PqqHHZBl29dXizCt
 +n4hQfkpHPPGDcy1Bm1cI3RclfQ0j+XxiWaMNw8z7eSZbUVhnkqm3xVJbhvr6eg7
 FiJMYvo4JMSMFBkcjwu8UPpVy1Bkpeebq61RvFlX7tDdMPJI5WO7wNN9iCyKZRIo
 YhCa+JVZ8quLcDHlxWVjhsdnN3r0/YpsNF3FbGzfPbSdZ97+dh33oSa+p035hhgD
 JxRBGA7yNtg9t9SJ2/1L66WbxSRP3tNVSOQlifKoJ51wwtF5OReZ/+wecCXsoWRo
 ic8LDEx3/KwmgsIALyTRRlw/dj9slqvtQhlZtEp9SAYm+0DsD7+dR61mrRsNcoTg
 d7j/S/zyWGZf4qMlktMfSuHPqqLQkVy4ExW+oMygk7g2P5jx2IiHOgrdg7HcVPWA
 KPrj+UCdUbTFm7pb9D+huIAwgmThkL9K+e0etm3c72rDR6j8JDk=
 =HgqB
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2025-11-21' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "A range of small fixes across the board, the i915 display
  disambiguation is probably the biggest otherwise amdgpu and xe as
  usual with tegra, nouveau, radeon and a core atomic fix.

  Looks mostly normal.

  atomic:
   - Return error codes on failed blob creation for planes

  nouveau:
   - Fix memory leak

  tegra:
   - Fix device ref counting
   - Fix pid ref counting
   - Revert booting on Pixel C

  xe:
   - Fix out-of-bounds access with BIT()
   - Fix kunit test checking wrong condition
   - Drop duplicate kconfig select
   - Fix guc2host irq handler with MSI-X

  i915:
   - Wildcat Lake and Panther Lake detangled for display fixes

  amdgpu:
   - DTBCLK gating fix
   - EDID fetching retry improvements
   - HDMI HPD debounce filtering
   - DCN 2.0 cursor fix
   - DP MST PBN fix
   - VPE fix
   - GC 11 fix
   - PRT fix
   - MMIO remap page fix
   - SR-IOV fix

  radeon:
   - Fence deadlock fix"

* tag 'drm-fixes-2025-11-21' of https://gitlab.freedesktop.org/drm/kernel: (25 commits)
  drm/amdgpu: Add sriov vf check for VCN per queue reset support.
  drm/amdgpu/ttm: Fix crash when handling MMIO_REMAP in PDE flags
  drm/amdgpu/vm: Check PRT uAPI flag instead of PTE flag
  drm/amdgpu: Skip emit de meta data on gfx11 with rs64 enabled
  drm/amd: Skip power ungate during suspend for VPE
  drm/plane: Fix create_in_format_blob() return value
  drm/xe/irq: Handle msix vector0 interrupt
  drm/xe: Remove duplicate DRM_EXEC selection from Kconfig
  drm/xe/kunit: Fix forcewake assertion in mocs test
  drm/xe: Prevent BIT() overflow when handling invalid prefetch region
  drm/radeon: delete radeon_fence_process in is_signaled, no deadlock
  drm/amd/display: Fix pbn to kbps Conversion
  drm/amd/display: Clear the CUR_ENABLE register on DCN20 on DPP5
  drm/amd/display: Add an HPD filter for HDMI
  drm/amd/display: Increase DPCD read retries
  drm/amd/display: Move sleep into each retry for retrieve_link_cap()
  drm/amd/display: Prevent Gating DTBCLK before It Is Properly Latched
  drm/i915/xe3: Restrict PTL intel_encoder_is_c10phy() to only PHY A
  drm/i915/display: Add definition for wcl as subplatform
  drm/pcids: Split PTL pciids group to make wcl subplatform
  ...
2025-11-21 09:55:55 -08:00
Pauli Virtanen
79a2d4678b Bluetooth: hci_core: lookup hci_conn on RX path on protocol side
The hdev lock/lookup/unlock/use pattern in the packet RX path doesn't
ensure hci_conn* is not concurrently modified/deleted. This locking
appears to be leftover from before conn_hash started using RCU
commit bf4c632524 ("Bluetooth: convert conn hash to RCU")
and not clear if it had purpose since then.

Currently, there are code paths that delete hci_conn* from elsewhere
than the ordered hdev->workqueue where the RX work runs in. E.g.
commit 5af1f84ed1 ("Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync")
introduced some of these, and there probably were a few others before
it.  It's better to do the locking so that even if these run
concurrently no UAF is possible.

Move the lookup of hci_conn and associated socket-specific conn to
protocol recv handlers, and do them within a single critical section
to cover hci_conn* usage and lookup.

syzkaller has reported a crash that appears to be this issue:

    [Task hdev->workqueue]          [Task 2]
                                    hci_disconnect_all_sync
    l2cap_recv_acldata(hcon)
                                      hci_conn_get(hcon)
                                      hci_abort_conn_sync(hcon)
                                        hci_dev_lock
      hci_dev_lock
                                        hci_conn_del(hcon)
      v-------------------------------- hci_dev_unlock
                                      hci_conn_put(hcon)
      conn = hcon->l2cap_data (UAF)

Fixes: 5af1f84ed1 ("Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync")
Reported-by: syzbot+d32d77220b92eddd89ad@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d32d77220b92eddd89ad
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2025-11-20 17:01:09 -05:00
Chris Lu
4015b97976 Bluetooth: btusb: mediatek: Fix kernel crash when releasing mtk iso interface
When performing reset tests and encountering abnormal card drop issues
that lead to a kernel crash, it is necessary to perform a null check
before releasing resources to avoid attempting to release a null pointer.

<4>[   29.158070] Hardware name: Google Quigon sku196612/196613 board (DT)
<4>[   29.158076] Workqueue: hci0 hci_cmd_sync_work [bluetooth]
<4>[   29.158154] pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
<4>[   29.158162] pc : klist_remove+0x90/0x158
<4>[   29.158174] lr : klist_remove+0x88/0x158
<4>[   29.158180] sp : ffffffc0846b3c00
<4>[   29.158185] pmr_save: 000000e0
<4>[   29.158188] x29: ffffffc0846b3c30 x28: ffffff80cd31f880 x27: ffffff80c1bdc058
<4>[   29.158199] x26: dead000000000100 x25: ffffffdbdc624ea3 x24: ffffff80c1bdc4c0
<4>[   29.158209] x23: ffffffdbdc62a3e6 x22: ffffff80c6c07000 x21: ffffffdbdc829290
<4>[   29.158219] x20: 0000000000000000 x19: ffffff80cd3e0648 x18: 000000031ec97781
<4>[   29.158229] x17: ffffff80c1bdc4a8 x16: ffffffdc10576548 x15: ffffff80c1180428
<4>[   29.158238] x14: 0000000000000000 x13: 000000000000e380 x12: 0000000000000018
<4>[   29.158248] x11: ffffff80c2a7fd10 x10: 0000000000000000 x9 : 0000000100000000
<4>[   29.158257] x8 : 0000000000000000 x7 : 7f7f7f7f7f7f7f7f x6 : 2d7223ff6364626d
<4>[   29.158266] x5 : 0000008000000000 x4 : 0000000000000020 x3 : 2e7325006465636e
<4>[   29.158275] x2 : ffffffdc11afeff8 x1 : 0000000000000000 x0 : ffffffdc11be4d0c
<4>[   29.158285] Call trace:
<4>[   29.158290]  klist_remove+0x90/0x158
<4>[   29.158298]  device_release_driver_internal+0x20c/0x268
<4>[   29.158308]  device_release_driver+0x1c/0x30
<4>[   29.158316]  usb_driver_release_interface+0x70/0x88
<4>[   29.158325]  btusb_mtk_release_iso_intf+0x68/0xd8 [btusb (HASH:e8b6 5)]
<4>[   29.158347]  btusb_mtk_reset+0x5c/0x480 [btusb (HASH:e8b6 5)]
<4>[   29.158361]  hci_cmd_sync_work+0x10c/0x188 [bluetooth (HASH:a4fa 6)]
<4>[   29.158430]  process_scheduled_works+0x258/0x4e8
<4>[   29.158441]  worker_thread+0x300/0x428
<4>[   29.158448]  kthread+0x108/0x1d0
<4>[   29.158455]  ret_from_fork+0x10/0x20
<0>[   29.158467] Code: 91343000 940139d1 f9400268 927ff914 (f9401297)
<4>[   29.158474] ---[ end trace 0000000000000000 ]---
<0>[   29.167129] Kernel panic - not syncing: Oops: Fatal exception
<2>[   29.167144] SMP: stopping secondary CPUs
<4>[   29.167158] ------------[ cut here ]------------

Fixes: ceac1cb025 ("Bluetooth: btusb: mediatek: add ISO data transmission functions")
Signed-off-by: Chris Lu <chris.lu@mediatek.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2025-11-20 16:51:14 -05:00
Linus Torvalds
6ba3bb3348 platform-drivers-x86 for v6.18-4
Fixes
 
 - acer-wmi: Ignore backlight event
 
 - alienware-wmi-wmax: Fix quirk match table order & drop redundant entries
 
 - amd/pmc:
   - Add Xbox Ally to spurious 8042 quirk list
   - Quirk list Lenovo Legion Go 2 NVMe resume
 
 - msi-wmi-platform:
   - Correct GUID to uppercase
   - GUID is uncleverly copy-pasted from an example so add a DMI whitelist
 
 - intel/speed_select_if: PCIBIOS_* return code conversion
 
 - intel-uncore-freq & ISST: Fix kernel doc warnings
 
 New HW support
 
 - alienware-wmi-wmax:
   - Alienware 16 Aurora support
   - Alienware M support
   - Alienware X support
   - Dell G support
 
 - amd/pmc:
   - ROG Xbox Ally (non-X) support
 
 - huaway-wmi: HONOR MagicBoox X16/X14 PrintScreen & YOYO keys
 
 - hp-wmi:
   - Omen 16-wf1xxx fan support
   - Omen MAX 16-ah0xx fan + thermal profile support
   - Victus 16-r0 and 16-s0 fan + thermal profile support
 
 - intel/hid: Intel Nova Lake support
 
 - intel-uncore-freq:
   - Intel Panther Lake support
   - Intel Wildcat Lake support
   - Intel Nova Lake support
 
 The following is an automated shortlog grouped by driver:
 
 acer-wmi:
  -  Ignore backlight event
 
 alienware-wmi-wmax:
  -  Add AWCC support to Alienware 16 Aurora
  -  Add support for the whole "G" family
  -  Add support for the whole "M" family
  -  Add support for the whole "X" family
  -  Drop redundant DMI entries
  -  Fix "Alienware m16 R1 AMD" quirk order
 
 amd: pmc:
  -  Add Lenovo Legion Go 2 to pmc quirk list
 
 amd/pmc:
  -  Add spurious_8042 to Xbox Ally
  -  Add support for Van Gogh SoC
 
 hp-wmi:
  -  Add Omen 16-wf1xxx fan support
  -  Add Omen MAX 16-ah0xx fan support and thermal profile
  -  mark Victus 16-r0 and 16-s0 for victus_s fan and thermal profile support
 
 huawei-wmi:
  -  add keys for HONOR models
 
 intel/hid:
  -  Add Nova Lake support
 
 intel/speed_select_if:
  -  Convert PCIBIOS_* return codes to errnos
 
 intel-uncore-freq:
  -  Add additional client processors
  -  fix all header kernel-doc warnings
 
 ISST: isst_if.h:
  -  fix all kernel-doc warnings
 
 msi-wmi-platform:
  -  Fix typo in WMI GUID
  -  Only load on MSI devices
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQSCSUwRdwTNL2MhaBlZrE9hU+XOMQUCaR9GsgAKCRBZrE9hU+XO
 MU2qAQD8C75ebO/ltd9LZ4oTzfe0P6kmV+28z0D97tFsFmt0hwEA/fZHU/bV1+3c
 +gRnoLCl4yPh214OgWnmsciPhW3iyAM=
 =AtKC
 -----END PGP SIGNATURE-----

Merge tag 'platform-drivers-x86-v6.18-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86

Pull x86 platform driver fixes from Ilpo Järvinen:
 "This one has lots of new HW entries which adds to the size in diffstat
  but the individual changes are simple.

  Fixes

   - acer-wmi: Ignore backlight event

   - alienware-wmi-wmax: Fix quirk match table order & drop redundant
     entries

   - amd/pmc:
      - Add Xbox Ally to spurious 8042 quirk list
      - Quirk list Lenovo Legion Go 2 NVMe resume

   - msi-wmi-platform:
      - Correct GUID to uppercase
      - GUID is uncleverly copy-pasted from an example so add a DMI
        whitelist

   - intel/speed_select_if: PCIBIOS_* return code conversion

   - intel-uncore-freq & ISST: Fix kernel doc warnings

  New HW support

   - alienware-wmi-wmax:
      - Alienware 16 Aurora support
      - Alienware M support
      - Alienware X support
      - Dell G support

   - amd/pmc:
      - ROG Xbox Ally (non-X) support

   - huaway-wmi: HONOR MagicBoox X16/X14 PrintScreen & YOYO keys

   - hp-wmi:
      - Omen 16-wf1xxx fan support
      - Omen MAX 16-ah0xx fan + thermal profile support
      - Victus 16-r0 and 16-s0 fan + thermal profile support

   - intel/hid: Intel Nova Lake support

   - intel-uncore-freq:
      - Intel Panther Lake support
      - Intel Wildcat Lake support
      - Intel Nova Lake support"

* tag 'platform-drivers-x86-v6.18-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (21 commits)
  platform/x86: intel-uncore-freq: fix all header kernel-doc warnings
  platform/x86: acer-wmi: Ignore backlight event
  platform/x86/intel/speed_select_if: Convert PCIBIOS_* return codes to errnos
  platform/x86/intel/hid: Add Nova Lake support
  platform/x86: alienware-wmi-wmax: Add AWCC support to Alienware 16 Aurora
  platform/x86: hp-wmi: Add Omen MAX 16-ah0xx fan support and thermal profile
  platform/x86: msi-wmi-platform: Fix typo in WMI GUID
  platform/x86: msi-wmi-platform: Only load on MSI devices
  platform/x86/amd: pmc: Add Lenovo Legion Go 2 to pmc quirk list
  platform/x86/amd/pmc: Add spurious_8042 to Xbox Ally
  platform/x86/amd/pmc: Add support for Van Gogh SoC
  platform/x86: alienware-wmi-wmax: Add support for the whole "G" family
  platform/x86: alienware-wmi-wmax: Add support for the whole "X" family
  platform/x86: alienware-wmi-wmax: Add support for the whole "M" family
  platform/x86: alienware-wmi-wmax: Drop redundant DMI entries
  platform/x86: alienware-wmi-wmax: Fix "Alienware m16 R1 AMD" quirk order
  platform/x86: ISST: isst_if.h: fix all kernel-doc warnings
  platform/x86: intel-uncore-freq: Add additional client processors
  platform/x86: hp-wmi: Add Omen 16-wf1xxx fan support
  platform/x86: huawei-wmi: add keys for HONOR models
  ...
2025-11-20 09:39:34 -08:00
Linus Torvalds
8e621c9a33 Including fixes from IPsec and wireless.
Previous releases - regressions:
 
  - prevent NULL deref in generic_hwtstamp_ioctl_lower(),
    newer APIs don't populate all the pointers in the request
 
  - phylink: add missing supported link modes for the fixed-link
 
  - mptcp: fix false positive warning in mptcp_pm_nl_rm_addr
 
 Previous releases - always broken:
 
  - openvswitch: remove never-working support for setting NSH fields
 
  - xfrm: number of fixes for error paths of xfrm_state creation/
    modification/deletion
 
  - xfrm: fixes for offload
    - fix the determination of the protocol of the inner packet
    - don't push locally generated packets directly to L2 tunnel
      mode offloading, they still need processing from the standard
      xfrm path
 
  - mptcp: fix a couple of corner cases in fallback and fastclose
    handling
 
  - wifi: rtw89: hw_scan: prevent connections from getting stuck,
    work around apparent bug in FW by tweaking messages we send
 
  - af_unix: fix duplicate data if PEEK w/ peek_offset needs to wait
 
  - veth: more robust handing of race to avoid txq getting stuck
 
  - eth: ps3_gelic_net: handle skb allocation failures
 
 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE6jPA+I1ugmIBA4hXMUZtbf5SIrsFAmkfQv8ACgkQMUZtbf5S
 IruptQ//aa3wFISt/xfCxaygNnQAL1gxWbKg15cLnv88S5r5wrh+Mf/r+qHkT0IG
 qaxPToztcTKNGzRqMI/7x/OEXjCdfEmJtNcb5JfYRxGkYVcje81bhHrxZN+nLLcj
 jx1xD7rXCjfFNDVFSl+OzQkoTZtfGphX+JgCTKLPZ8t4qR/UhU1IwYgpoaiK0uCT
 gitXJPHrDGJLHud0ilaXbn+q0ZH9ZU08QSRhsaAq7C6YPafUseEr2fuQYgFr1kkp
 mtzFm84bEnRSneQ5+noVzoc5llbu3vf3Wd9Y5tr5sBaBjh5OpH/kK0kuPy6Lzhvd
 8y05jl8kyASMtRBoTvmpYOdi3xUNbge5AwJN3FIo4KPCmyr1bQoNoQVIivUpoiGz
 Zvv7QcceP7E5057CRuhi06krld/QaScHkmhUododbqJKmL8NWaSoXLRO7oYjB4kU
 1MuAwOJWVpsqnTUEbMw7dHJPZFTqRkLYv6oAmIqb/AWzTcqg9OXjLEc+OzUqWEl6
 mHv/SonSjAM81m3GxCxtNtH2ErKwdMIgI/ado39+KvksKTH1bhN9ZpmuyyktzpCj
 PBn9FVdd7zyct92u5xXtsKVkDWKGyD419Z2lFHC0FaAsNQmPrSqzi+U50pAtie5M
 JWABm8hsSdia4dTDrdldMgM50dzuBd5nSceY7XCqPA8nZ5+Af/8=
 =89Xl
 -----END PGP SIGNATURE-----

Merge tag 'net-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Jakub Kicinski:
 "Including fixes from IPsec and wireless.

  Previous releases - regressions:

   - prevent NULL deref in generic_hwtstamp_ioctl_lower(),
     newer APIs don't populate all the pointers in the request

   - phylink: add missing supported link modes for the fixed-link

   - mptcp: fix false positive warning in mptcp_pm_nl_rm_addr

  Previous releases - always broken:

   - openvswitch: remove never-working support for setting NSH fields

   - xfrm: number of fixes for error paths of xfrm_state creation/
     modification/deletion

   - xfrm: fixes for offload
      - fix the determination of the protocol of the inner packet
      - don't push locally generated packets directly to L2 tunnel
        mode offloading, they still need processing from the standard
        xfrm path

   - mptcp: fix a couple of corner cases in fallback and fastclose
     handling

   - wifi: rtw89: hw_scan: prevent connections from getting stuck,
     work around apparent bug in FW by tweaking messages we send

   - af_unix: fix duplicate data if PEEK w/ peek_offset needs to wait

   - veth: more robust handing of race to avoid txq getting stuck

   - eth: ps3_gelic_net: handle skb allocation failures"

* tag 'net-6.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (47 commits)
  vsock: Ignore signal/timeout on connect() if already established
  be2net: pass wrb_params in case of OS2BMC
  l2tp: reset skb control buffer on xmit
  net: dsa: microchip: lan937x: Fix RGMII delay tuning
  selftests: mptcp: add a check for 'add_addr_accepted'
  mptcp: fix address removal logic in mptcp_pm_nl_rm_addr
  selftests: mptcp: join: userspace: longer timeout
  selftests: mptcp: join: endpoints: longer timeout
  selftests: mptcp: join: fastclose: remove flaky marks
  mptcp: fix duplicate reset on fastclose
  mptcp: decouple mptcp fastclose from tcp close
  mptcp: do not fallback when OoO is present
  mptcp: fix premature close in case of fallback
  mptcp: avoid unneeded subflow-level drops
  mptcp: fix ack generation for fallback msk
  wifi: rtw89: hw_scan: Don't let the operating channel be last
  net: phylink: add missing supported link modes for the fixed-link
  selftest: af_unix: Add test for SO_PEEK_OFF.
  af_unix: Read sk_peek_offset() again after sleeping in unix_stream_read_generic().
  net/mlx5: Clean up only new IRQ glue on request_irq() failure
  ...
2025-11-20 08:52:07 -08:00
Niklas Cassel
b118906833 ata: libata-scsi: Fix system suspend for a security locked drive
Commit cf3fc03762 ("ata: libata-scsi: Fix ata_to_sense_error() status
handling") fixed ata_to_sense_error() to properly generate sense key
ABORTED COMMAND (without any additional sense code), instead of the
previous bogus sense key ILLEGAL REQUEST with the additional sense code
UNALIGNED WRITE COMMAND, for a failed command.

However, this broke suspend for Security locked drives (drives that have
Security enabled, and have not been Security unlocked by boot firmware).

The reason for this is that the SCSI disk driver, for the Synchronize
Cache command only, treats any sense data with sense key ILLEGAL REQUEST
as a successful command (regardless of ASC / ASCQ).

After commit cf3fc03762 ("ata: libata-scsi: Fix ata_to_sense_error()
status handling") the code that treats any sense data with sense key
ILLEGAL REQUEST as a successful command is no longer applicable, so the
command fails, which causes the system suspend to be aborted:

  sd 1:0:0:0: PM: dpm_run_callback(): scsi_bus_suspend returns -5
  sd 1:0:0:0: PM: failed to suspend async: error -5
  PM: Some devices failed to suspend, or early wake event detected

To make suspend work once again, for a Security locked device only,
return sense data LOGICAL UNIT ACCESS NOT AUTHORIZED, the actual sense
data which a real SCSI device would have returned if locked.
The SCSI disk driver treats this sense data as a successful command.

Cc: stable@vger.kernel.org
Reported-by: Ilia Baryshnikov <qwelias@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220704
Fixes: cf3fc03762 ("ata: libata-scsi: Fix ata_to_sense_error() status handling")
Reviewed-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Niklas Cassel <cassel@kernel.org>
2025-11-20 13:37:17 +01:00
Linus Torvalds
23cb64fb76 soc: fixes for 6.18, part 3
These are mainly devicetree fixes for the arm platforms from Rockchips
 NXP, ASpeed and Broadcom, addressing issues with accidental overclocking,
 pinctrl, network and dtc warnings.
 
 There are additional fixes for regressions with the i.MX reset and memory
 controller drivers as well as the Tegra memory controller driver
 
 Minor updates to the MAINTAINERS file, tee documentation and defconfigs
 bring those up to date with recent changes elsewhere.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmkd2xgACgkQmmx57+YA
 GNki7g//aJ2V6J9T4qpg7puhACrmbv4WWBynSiC/hImUcsN7rf93GaYDL9NzKm1q
 6OWdOnvJIlinyyCFob0PxBrtNZprzVzCSL2bRlQx+q5FKrzJoW1aHpOcyuSANMan
 2UXAjbL2YobMj4uZ9SrnkzxO+Cd4gIuJJSH1HPLuGOwR3VSeiXUMhsrVxMB2g1Ch
 r8a1WhuRhnPy1qEKGbUp11CO1gnzG+wSmQOYUf+4mIIioax2OIr39eQlkY6NdOfl
 4OAWfrcbE0C7DaiURTB0xVgHGQKVw7Z1KemIl+uN9uF2YJUHbdZs0wnX/K+o8afm
 wxnSsmcFfXDgthXlvpt4LkU3j94CtYbAIDYL/Xp6O9nuYekDtpPjRmQHpbrt6b0V
 HRNf70ePm2nMX7QwWnC/L/I7AW6OY2m74WPjmlKJ19jKLNHcVa3G9K7uafc2lZbB
 w7/UdMriXaJ2rcZsg2RG/Qo+SRMuB3+uFMQjvM6JwRKV2gaJi4v2JqD7/te9tbGl
 FjbBc5aGVJmRiFuDhjO+Z6NTRlKWQpTljLoYzY1rmyXejAbMfrBnvOYO4avJ/ojE
 xL6UjuTZeyQ5EwkmMUzrI5vzSx0AL29QwSz4Sf7B5pkQYu8YddbMneKWjmAYleWs
 VQ5OsU2x84OIQgt2ORCZJd3p/FIOGnckT1Tl3xkZZ1ttdEvJOwQ=
 =5SRf
 -----END PGP SIGNATURE-----

Merge tag 'soc-fixes-6.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc

Pull SoC fixes from Arnd Bergmann:
 "These are mainly devicetree fixes for the arm platforms from Rockchips
  NXP, ASpeed and Broadcom, addressing issues with accidental
  overclocking, pinctrl, network and dtc warnings.

  There are additional fixes for regressions with the i.MX reset and
  memory controller drivers as well as the Tegra memory controller
  driver.

  Minor updates to the MAINTAINERS file, tee documentation and
  defconfigs bring those up to date with recent changes elsewhere"

* tag 'soc-fixes-6.18-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (29 commits)
  MAINTAINERS: sync omap devicetree maintainers with omap platform
  MAINTAINERS: Update Krzysztof Kozlowski's email
  arm64: dts: rockchip: fix PCIe 3.3V regulator voltage on orangepi-5
  arm64: dts: rockchip: disable HS400 on RK3588 Tiger
  arm64: dts: rockchip: drop reset from rk3576 i2c9 node
  tee: <uapi/linux/tee.h: fix all kernel-doc issues
  arm64: dts: rockchip: Fix USB power enable pin for BTT CB2 and Pi2
  arm64: dts: broadcom: bcm2712: rpi-5: Add ethernet0 alias
  arm64: dts: broadcom: Assign clock rates in eth node for RPi5
  reset: imx8mp-audiomix: Fix bad mask values
  ARM: dts: BCM53573: Fix address of Luxul XAP-1440's Ethernet PHY
  arm64: defconfig: Fix V3D deferred probe timeout
  arm64: dts: rockchip: Fix vccio4-supply on rk3566-pinetab2
  arm64: dts: rockchip: include rk3399-base instead of rk3399 in rk3399-op1
  arm64: dts: imx8mp-kontron: Fix USB OTG role switching
  arm64: dts: imx95: Fix MSI mapping for PCIe endpoint nodes
  arm64: dts: imx8-ss-img: Avoid gpio0_mipi_csi GPIOs being deferred
  arm: imx_v6_v7_defconfig: enable ext4 directly
  memory: tegra210: Fix incorrect client ids
  arm64: dts: rockchip: Fix indentation on rk3399 haikou demo dtso
  ...
2025-11-19 09:36:04 -08:00
Jakub Kicinski
c3995fc1a8 ipsec-2025-11-18
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEH7ZpcWbFyOOp6OJbrB3Eaf9PW7cFAmkcEO8ACgkQrB3Eaf9P
 W7eXjA//ReWvgmIwM87WjEwI0E8y/ChS3GwWOMKo2XVwntkuctW+gvTfKn7WDMcs
 AuqbhCpoRdA1a3rEUWNBKoMT1PYmWHt4oElC2vEodIKcvrtVpOukyHQg5zaOTRni
 TCiXUD5kojyCC3YX8J2VXnIsvmHl/0Wo2iEd9MBivOkKXh7UGy/azOqPMhwmQBHx
 Ds37Mj86tRPylEaVtW9Js7BWTBWBCg5TpUJbJY8DvaYP1TBFduao2ExMo2dFPeYC
 495N856k+Pa1OVqW6Ss40I59UXmXbs5WcUd8mOhleqxUaAQoaUqSfQwdw0UErS+2
 lttuMH1pnNgpkWMgusXWgs8lxXiwbH74eIthtR6/9k/B80eKaQ5Rwp8sAZ0DV+8M
 FoL7PBHWQzWvc+/L+8zJ0g78mv5+ymvSdkl2ZQXPJiJF1hdZ31RGQAwlPDYqrq63
 WNu19dKwXzASWR/YBXO9vw7pdjljs8BXZcTMNDZcS3FgWonI47nTIpy0vjx9vinm
 4KzaIpg+cjEt1SNrO45sPoBmoMj642aEHtkAEhR47U8FHQTBW2/9l/WdpIJhYhjb
 IrVdVw32Fo55HJby14YlwODPpUJ0t/UcI32KdTXd5kI+UqqyeiIxdtLfaXiNTDGJ
 RQ80mTeG9AKxfcD7LGK73ndWJxBb+2C+6MPQN7+AF3rh1bFcGQ8=
 =h/E5
 -----END PGP SIGNATURE-----

Merge tag 'ipsec-2025-11-18' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec

Steffen Klassert says:

====================
pull request (net): ipsec 2025-11-18

1) Misc fixes for xfrm_state creation/modification/deletion.
   Patchset from Sabrina Dubroca.

2) Fix inner packet family determination for xfrm offloads.
   From Jianbo Liu.

3) Don't push locally generated packets directly to L2 tunnel
   mode offloading, they still need processing from the standard
   xfrm path. From Jianbo Liu.

4) Fix memory leaks in xfrm_add_acquire for policy offloads and policy
   security contexts. From Zilin Guan.

* tag 'ipsec-2025-11-18' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec:
  xfrm: fix memory leak in xfrm_add_acquire()
  xfrm: Prevent locally generated packets from direct output in tunnel mode
  xfrm: Determine inner GSO type from packet inner protocol
  xfrm: Check inner packet family directly from skb_dst
  xfrm: check all hash buckets for leftover states during netns deletion
  xfrm: set err and extack on failure to create pcpu SA
  xfrm: call xfrm_dev_state_delete when xfrm_state_migrate fails to add the state
  xfrm: make state as DEAD before final put when migrate fails
  xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added
  xfrm: drop SA reference in xfrm_state_update if dir doesn't match
====================

Link: https://patch.msgid.link/20251118085344.2199815-1-steffen.klassert@secunet.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-11-18 17:58:44 -08:00
Linus Torvalds
5bebe8de19 mm/huge_memory: Fix initialization of huge zero folio
The recent fix to properly initialize the tags of the huge zero folio
had an unfortunate not-so-subtle side effect: it caused the actual
*contents* of the huge zero folio to not be initialized at all when the
hardware didn't support the memory tagging.

The reason was the unfortunate semantics of tag_clear_highpage(): on
hardware that didn't do the tagging, it would silently just not do
anything at all.  And since this is done only on arm64 with MTE support,
that basically meant most hardware.

It wasn't necessarily immediately obvious since the huge zero page isn't
necessarily very heavily used - or because it might already be zero
because all-zeroes is the most common pattern.  But it ends up causing
random odd user space failures when you do hit it.

The unfortunate semantics have been around for a while, but became a
real bug only when we started actively using __GFP_ZEROTAGS in the
generic get_huge_zero_folio() function - before that, it had only ever
been used in code that checked that the hardware supported it.

Fix this by simply changing the semantics of tag_clear_highpage() to
return whether it actually successfully did something or not.  While at
it, also make it initialize multiple pages in one go, since that's
actually what the only caller wants it to do and it simplifies the whole
logic.

Fixes: adfb6609c6 ("mm/huge_memory: initialise the tags of the huge zero folio")
Link: https://lore.kernel.org/all/20251117082023.90176-1-00107082@163.com/
Reviewed-by: David Hildenbrand (Red Hat) <david@kernel.org>
Reported-and-tested-by: David Wang <00107082@163.com>
Reported-and-tested-by: Carlos Llamas <cmllamas@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2025-11-18 08:21:27 -08:00
Dnyaneshwar Bhadane
6eb2e056b0
drm/pcids: Split PTL pciids group to make wcl subplatform
To form the WCL platform as a subplatform of PTL in definition,
WCL pci ids are splited into saparate group from PTL.
So update the pciidlist struct to cover all the pci ids.

v2:
- Squash wcl description in single patch for display and xe.(jani,gustavo)

Fixes: 3c0f211bc8 ("drm/xe: Add Wildcat Lake device IDs to PTL list")
Signed-off-by: Dnyaneshwar Bhadane <dnyaneshwar.bhadane@intel.com>
Reviewed-by: Gustavo Sousa <gustavo.sousa@intel.com>
Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com>
Link: https://lore.kernel.org/r/20250922150317.2334680-2-dnyaneshwar.bhadane@intel.com
(cherry picked from commit 32620e1764)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
[Rodrigo added the Fixes tag when porting it to fixes]
2025-11-18 08:47:58 -05:00
Peter Hutterer
ae8966b7b5 Input: rename INPUT_PROP_HAPTIC_TOUCHPAD to INPUT_PROP_PRESSUREPAD
And expand it to encompass all pressure pads.

Definition: "pressure pad" as used here as includes all touchpads that
use physical pressure to convert to click, without physical hinges. Also
called haptic touchpads in general parlance, Synaptics calls them
ForcePads.

Most (all?) pressure pads are currently advertised as
INPUT_PROP_BUTTONPAD. The suggestion to identify them as pressure pads
by defining the resolution on ABS_MT_PRESSURE has been in the docs since
commit 20ccc8dd38 ("Documentation: input: define
ABS_PRESSURE/ABS_MT_PRESSURE resolution as grams") but few devices
provide this information.

In userspace it's thus impossible to determine whether a device is a
true pressure pad (pressure equals pressure) or a normal clickpad with
(pressure equals finger size).

Commit 7075ae4ac9 ("Input: add INPUT_PROP_HAPTIC_TOUCHPAD") introduces
INPUT_PROP_HAPTIC_TOUCHPAD but restricted it to those touchpads that
have support for userspace-controlled effects. Let's expand and rename
that definition to include all pressure pad touchpads since those that
do support FF effects can be identified by the presence of the
FF_HAPTIC bit.

This means:
- clickpad: INPUT_PROP_BUTTONPAD
- pressurepad: INPUT_PROP_BUTTONPAD + INPUT_PROP_PRESSUREPAD
- pressurepad with configurable haptics:
  INPUT_PROP_BUTTONPAD + INPUT_PROP_PRESSUREPAD + FF_HAPTIC

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>
Acked-by: Benjamin Tissoires <bentiss@kernel.org>
Link: https://patch.msgid.link/20251106114534.GA405512@tassie
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2025-11-17 23:18:32 -08:00
Linus Torvalds
e7c375b181 vfs-6.18-rc7.fixes
-----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCaRtBJwAKCRCRxhvAZXjc
 ou5CAQCJb5y2ULKklblICU1wR7Nr15WvTW7VVOcv44RJ22S3NgEAy4DLDBFBw8zC
 8e7Hp8gxbjsq8ZJmU088aobFcqbZOwk=
 =TAnu
 -----END PGP SIGNATURE-----

Merge tag 'vfs-6.18-rc7.fixes' of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs

Pull vfs fixes from Christian Brauner:

 - Fix unitialized variable in statmount_string()

 - Fix hostfs mounting when passing host root during boot

 - Fix dynamic lookup to fail on cell lookup failure

 - Fix missing file type when reading bfs inodes from disk

 - Enforce checking of sb_min_blocksize() calls and update all callers
   accordingly

 - Restore write access before closing files opened by open_exec() in
   binfmt_misc

 - Always freeze efivarfs during suspend/hibernate cycles

 - Fix statmount()'s and listmount()'s grab_requested_mnt_ns() helper to
   actually allow mount namespace file descriptor in addition to mount
   namespace ids

 - Fix tmpfs remount when noswap is specified

 - Switch Landlock to iput_not_last() to remove false-positives from
   might_sleep() annotations in iput()

 - Remove dead node_to_mnt_ns() code

 - Ensure that per-queue kobjects are successfully created

* tag 'vfs-6.18-rc7.fixes' of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs:
  landlock: fix splats from iput() after it started calling might_sleep()
  fs: add iput_not_last()
  shmem: fix tmpfs reconfiguration (remount) when noswap is set
  fs/namespace: correctly handle errors returned by grab_requested_mnt_ns
  power: always freeze efivarfs
  binfmt_misc: restore write access before closing files opened by open_exec()
  block: add __must_check attribute to sb_min_blocksize()
  virtio-fs: fix incorrect check for fsvq->kobj
  xfs: check the return value of sb_min_blocksize() in xfs_fs_fill_super
  isofs: check the return value of sb_min_blocksize() in isofs_fill_super
  exfat: check return value of sb_min_blocksize in exfat_read_boot_sector
  vfat: fix missing sb_min_blocksize() return value checks
  mnt: Remove dead code which might prevent from building
  bfs: Reconstruct file type when loading from disk
  afs: Fix dynamic lookup to fail on cell lookup failure
  hostfs: Fix only passing host root in boot stage with new mount
  fs: Fix uninitialized 'offp' in statmount_string()
2025-11-17 09:11:27 -08:00
Linus Torvalds
7ba45f1504 7 hotfixes. 5 are cc:stable, 4 are against mm/.
All are singletons - please see the respective changelogs for details.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCaRoauQAKCRDdBJ7gKXxA
 jtNFAQDEMH0+zRGz/Larkf9cgmdKcDgij1DP2gP/3i8PWAoaGQD8C9evZxu1h9wC
 rFbaSkPDeSdDafo3RZfpo1gqE0LdEA4=
 =oew8
 -----END PGP SIGNATURE-----

Merge tag 'mm-hotfixes-stable-2025-11-16-10-40' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull misc fixes from Andrew Morton:
 "7 hotfixes.  5 are cc:stable, 4 are against mm/

  All are singletons - please see the respective changelogs for details"

* tag 'mm-hotfixes-stable-2025-11-16-10-40' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:
  mm, swap: fix potential UAF issue for VMA readahead
  selftests/user_events: fix type cast for write_index packed member in perf_test
  lib/test_kho: check if KHO is enabled
  mm/huge_memory: fix folio split check for anon folios in swapcache
  MAINTAINERS: update David Hildenbrand's email address
  crash: fix crashkernel resource shrink
  mm: fix MAX_FOLIO_ORDER on powerpc configs with hugetlb
2025-11-16 13:31:14 -08:00
David Hildenbrand (Red Hat)
39231e8d6b mm: fix MAX_FOLIO_ORDER on powerpc configs with hugetlb
In the past, CONFIG_ARCH_HAS_GIGANTIC_PAGE indicated that we support
runtime allocation of gigantic hugetlb folios.  In the meantime it evolved
into a generic way for the architecture to state that it supports gigantic
hugetlb folios.

In commit fae7d834c4 ("mm: add __dump_folio()") we started using
CONFIG_ARCH_HAS_GIGANTIC_PAGE to decide MAX_FOLIO_ORDER: whether we could
have folios larger than what the buddy can handle.  In the context of that
commit, we started using MAX_FOLIO_ORDER to detect page corruptions when
dumping tail pages of folios.  Before that commit, we assumed that we
cannot have folios larger than the highest buddy order, which was
obviously wrong.

In commit 7b4f21f5e0 ("mm/hugetlb: check for unreasonable folio sizes
when registering hstate"), we used MAX_FOLIO_ORDER to detect
inconsistencies, and in fact, we found some now.

Powerpc allows for configs that can allocate gigantic folio during boot
(not at runtime), that do not set CONFIG_ARCH_HAS_GIGANTIC_PAGE and can
exceed PUD_ORDER.

To fix it, let's make powerpc select CONFIG_ARCH_HAS_GIGANTIC_PAGE with
hugetlb on powerpc, and increase the maximum folio size with hugetlb to 16
GiB on 64bit (possible on arm64 and powerpc) and 1 GiB on 32 bit
(powerpc).  Note that on some powerpc configurations, whether we actually
have gigantic pages depends on the setting of CONFIG_ARCH_FORCE_MAX_ORDER,
but there is nothing really problematic about setting it unconditionally:
we just try to keep the value small so we can better detect problems in
__dump_folio() and inconsistencies around the expected largest folio in
the system.

Ideally, we'd have a better way to obtain the maximum hugetlb folio size
and detect ourselves whether we really end up with gigantic folios.  Let's
defer bigger changes and fix the warnings first.

While at it, handle gigantic DAX folios more clearly: DAX can only end up
creating gigantic folios with HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD.

Add a new Kconfig option HAVE_GIGANTIC_FOLIOS to make both cases clearer. 
In particular, worry about ARCH_HAS_GIGANTIC_PAGE only with HUGETLB_PAGE.

Note: with enabling CONFIG_ARCH_HAS_GIGANTIC_PAGE on powerpc, we will now
also allow for runtime allocations of folios in some more powerpc configs.
I don't think this is a problem, but if it is we could handle it through
__HAVE_ARCH_GIGANTIC_PAGE_RUNTIME_SUPPORTED.

While __dump_page()/__dump_folio was also problematic (not handling
dumping of tail pages of such gigantic folios correctly), it doesn't seem
critical enough to mark it as a fix.

Link: https://lkml.kernel.org/r/20251114214920.2550676-1-david@kernel.org
Fixes: 7b4f21f5e0 ("mm/hugetlb: check for unreasonable folio sizes when registering hstate")
Reported-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Closes: https://lore.kernel.org/r/3e043453-3f27-48ad-b987-cc39f523060a@csgroup.eu/
Reported-by: Sourabh Jain <sourabhjain@linux.ibm.com>
Closes: https://lore.kernel.org/r/94377f5c-d4f0-4c0f-b0f6-5bf1cd7305b1@linux.ibm.com/
Signed-off-by: David Hildenbrand (Red Hat) <david@kernel.org>
Cc: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
Cc: Donet Tom <donettom@linux.ibm.com>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Christophe Leroy <christophe.leroy@csgroup.eu>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: "Liam R. Howlett" <Liam.Howlett@oracle.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-11-15 10:52:00 -08:00
Linus Torvalds
e256f7b4e5 Fix a broken #ifndef in the <linux/entry-virt.h> header, which
hasn't caused problems upstream yet because no arch overrides
 arch_xfer_to_guest_mode_handle_work() at this moment.
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmkYQbERHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1jEUQ/8CUp5lWXbahK69XGn4ZPMRvdgxE4qnci+
 YTCvoQYsQUheBhDZ08QWujj5DgSErJi+3KD6oRbvYBDStS5u711LdvSOg+Kr6ql7
 1ATSegZnEz6M/ntAlcYmcLkQtAKbl3nrODfRfU9ZBDQFHwd+BYgMUzOJ8W73O3tA
 AiqXxlOTzykk9pDG/fxH6PMHQlKAf3uOBR8rG+NzLhsEF+WZFXoloQ+HGEgSvrnq
 oRPiSdNLeb007vDr+qprnXapmuTziTbcE+BUZ1FD1ze7rFLmH2pFiyuqKTlL1gDH
 nfRIIrVG8uLEzTTtu+U5oM/J9a0sHA0QaI8XJa2gOGhb2nOKcv2CfhxJ9HHRqrZv
 IfolXsRIdVXmVmPX4ksXg2q1H7fSuqpz4220WhQqe3CKoimOsTQ7t6F7gt7B8pnU
 6BKjlAA9aPBpRSQh/WWmkRsQsaaCy9ni3xFwNaUDoPOqbIxlZL1u0dLjTwHYcIvB
 +BSyvYx/70qNPgF4ounp7/jWQ/hG+U4JbogXLKWAD9pqUsR9n97S1/Z00gUEl8Ka
 oyLrOrq/NlS/ytBc/GgjMk/qq2hdGaQ1ztJc9lQGCfZvLtRGUh0pAhoopanTg56q
 zs3/lTADRANLsD+0f9pWY66zOFKt8fF8h0fO8lXVMp3aQ/PVeDwxpcYwbN7vh4Q8
 23Vfh+aOsTA=
 =7by8
 -----END PGP SIGNATURE-----

Merge tag 'core-urgent-2025-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull core fix from Ingo Molnar:
 "Fix a broken #ifndef in the <linux/entry-virt.h> header.

  It hasn't caused problems upstream yet because no arch overrides
  arch_xfer_to_guest_mode_handle_work() at this moment"

* tag 'core-urgent-2025-11-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  entry: Fix ifndef around arch_xfer_to_guest_mode_handle_work() stub
2025-11-15 08:46:18 -08:00
Linus Torvalds
7a0892d283 pci-v6.18-fixes-5
-----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCgAyFiEEgMe7l+5h9hnxdsnuWYigwDrT+vwFAmkXokcUHGJoZWxnYWFz
 QGdvb2dsZS5jb20ACgkQWYigwDrT+vyejw/8CN4kM8PROTw3p6QBJQF6am5uPCA4
 nQans+groD/XJXJd7T4aqwuvLXvIrrEd3K+PegBLiGgk3Wgw9fq5pEWDafUH8IAv
 LG5g462aHyrHPMV8XI6lIrDLD7PCltmpoIu22Xkri4l4gkca7Ros/4Q5gU+AgtCz
 LtsO9UmcK0PaR95NCdYFf2VZ1PsdZu/ezTb90S1xT5gty9uwpxCmHje5gg07MXXO
 12i/SNczU9gFYo8P6XMeD7q0Ixwt7JLC+xa1iBlBEODvcPkyf8Al2dIkxWlnrwGn
 kxi4K/PKM4f7ZhtyTHh/G8EiFYh/QwbHGvnCBj5XQAKOLWkjZCn8l5MxqGAKKvnz
 Dem3/MFwJQ79+y/vrseg5beBiLPahd5fsAITOFIxmQZsEjvL+B8fhU52QBkLVFUw
 iJg7PJXHJ9Jy/NRGT/rinu9mi2K+z1baZHZm11QK5khTTbYAs+qsvwWck9Jcr004
 OEsQGngomUv09WjHv0/26dJzVI5wpnn+C+DFAximlIMZnTaQguN/WNplYYyXBRzB
 T09qK1ZzpJM6QEU5i2ZForGpFtKSbGHwJrC6DYjLiVV3P4EzpHWSmTy2dqM7GUNa
 Wrvaxy3j/MT2kudfyIs10Qwu1EJ+rHYb/QfS3pqlggSDic9WFg9P4uUlFR1YUKPb
 h+Peip6NV/tQNHI=
 =2eqF
 -----END PGP SIGNATURE-----

Merge tag 'pci-v6.18-fixes-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci

Pull pci fixes from Bjorn Helgaas:

 - Cache the ASPM L0s/L1 Supported bits early so quirks can override
   them if necessary (Bjorn Helgaas)

 - Add quirks for PA Semi and Freescale Root Ports and a HiSilicon Wi-Fi
   device that are reported to have broken L0s and L1 (Shawn Lin, Bjorn
   Helgaas)

* tag 'pci-v6.18-fixes-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci:
  PCI/ASPM: Avoid L0s and L1 on Hi1105 [19e5:1105] Wi-Fi
  PCI/ASPM: Avoid L0s and L1 on PA Semi [1959:a002] Root Ports
  PCI/ASPM: Avoid L0s and L1 on Freescale [1957:0451] Root Ports
  PCI/ASPM: Convert quirks to override advertised link states
  PCI/ASPM: Add pcie_aspm_remove_cap() to override advertised link states
  PCI/ASPM: Cache L0s/L1 Supported so advertised link states can be overridden
2025-11-14 15:45:31 -08:00
Linus Torvalds
cbba5d1b53 bpf-fixes
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE+soXsSLHKoYyzcli6rmadz2vbToFAmkXpZUACgkQ6rmadz2v
 bTrGCw//UCx+KBXbzvv7m0A1QGOUL3oHL/Qd+OJA3RW3B+saVbYYzn9jjl0SRgFP
 X0q/DwbDOjFtOSORV9oFgJkrucn7+BM/yxPaC4sE1SQZJAjDFA/CSaF0r8duuGsM
 Mvat9TTiwwetOMAkNB9WZ1e6AKGovBLguLFGAWZc6vLeQZopcER5+pFwS44a9RrK
 dq0Th8O/oY3VmUDgSKJ2KyY51KxpJU7k2ipifiIbu1M1MWZ7s2vERkMEkzJ/lB8/
 nldMsTZUdknGFzVH/W6Rc9ScFYlH+h/x1gkOHwTibMsqDBm92mWVo6O7hvuUbsEO
 NlPDgMtkhBp7PDSx9SA0UBcriMs1M6ovNBOpj/cI4AL1k8WNubf/FHZtrBwoy8C9
 3HaM+8lkA2uiHVPUvT5dImzWqshweN0GXoXAoa9xPSQPchJ38UdzCHqYRAg/kWFZ
 5jUK2j4e5+yyII44pD7Xti0PrfoP81giliqmTbGFV8+Y89dQnk+WK12vnbv34ER7
 unLwId8HLtq0ZN7FVG4F6s/4qNdEMKqXbAkve0WWFXn4vKZMCju4ol6NYVGisRAg
 zcn7Yk+weSuY3UOzC+/4SxhfTEAD0Kg6fUoG/1JdflgNsm8XhLBja0DZaAlIVO0p
 xz5UaljwcNvjAKGGMYbCGrf3XN2tOmGpVyJkMj17Vcq88y3bJBU=
 =JJui
 -----END PGP SIGNATURE-----

Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Pull bpf fixes from Alexei Starovoitov:

 - Fix interaction between livepatch and BPF fexit programs (Song Liu)
   With Steven and Masami acks.

 - Fix stack ORC unwind from BPF kprobe_multi (Jiri Olsa)
   With Steven and Masami acks.

 - Fix out of bounds access in widen_imprecise_scalars() in the verifier
   (Eduard Zingerman)

 - Fix conflicts between MPTCP and BPF sockmap (Jiayuan Chen)

 - Fix net_sched storage collision with BPF data_meta/data_end (Eric
   Dumazet)

 - Add _impl suffix to BPF kfuncs with implicit args to avoid breaking
   them in bpf-next when KF_IMPLICIT_ARGS is added (Mykyta Yatsenko)

* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
  selftests/bpf: Test widen_imprecise_scalars() with different stack depth
  bpf: account for current allocated stack depth in widen_imprecise_scalars()
  bpf: Add bpf_prog_run_data_pointers()
  selftests/bpf: Add mptcp test with sockmap
  mptcp: Fix proto fallback detection with BPF
  mptcp: Disallow MPTCP subflows from sockmap
  selftests/bpf: Add stacktrace ips test for raw_tp
  selftests/bpf: Add stacktrace ips test for kprobe_multi/kretprobe_multi
  x86/fgraph,bpf: Fix stack ORC unwind from kprobe_multi return probe
  Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()"
  bpf: add _impl suffix for bpf_stream_vprintk() kfunc
  bpf:add _impl suffix for bpf_task_work_schedule* kfuncs
  selftests/bpf: Add tests for livepatch + bpf trampoline
  ftrace: bpf: Fix IPMODIFY + DIRECT in modify_ftrace_direct()
  ftrace: Fix BPF fexit with livepatch
2025-11-14 15:39:39 -08:00
Arnd Bergmann
124c98b100 TEE kernel-doc fixes for v6.18
-----BEGIN PGP SIGNATURE-----
 
 iQJOBAABCgA4FiEE0qerISgy2SKkqO79Wr/6JGat8H4FAmkW2ocaHGplbnMud2lr
 bGFuZGVyQGxpbmFyby5vcmcACgkQWr/6JGat8H4eYhAAneMo7XeOE2939WbTrFUJ
 yF34fhCiKpxZ/IHqDJzCa1gVdEFW7oyedwOH+Q4k61ch7KmbvL3syilrrhch/Gai
 3K+B5500new57tl8DoKGuO0w2e6Oxw1ZrNzw+aJSflckgyHYXqRtKD7B5PHYyWjN
 tDm6F2CNpgkcuV7V8EBHCPWiRZPqx3BcH9ghtLPlK7B75i6+o8oWWjqqxhB0OxB2
 WhFM7ny73JaN6kCUeAz+Hx7OHE7Y3qHqg5bdC2q3rHOnWWjEt8YILUYZBPw8Z0W2
 lYUmOgbCxaTTM0CbV3Ye4m2YL6jffqUv9JaHxDzoeffhuKiQd/6PfzB3N7n849c6
 6SO72nMzYijZg2aXpJYrlgW2/6/WuThH2qUYvex21N61+yXPeKYoFDh2HBs9uMPj
 46MZ7ExKkZiRi53LkGUjH0KxOABlmPO510wiPlk/uvOm+hlGEgku070jKahGDunW
 pGVAqri8sowqkjNo9EPkv2in9PBjZsf3Q4lH0uQ2a9plD3ZP94Hp3j9qvtb4Gepv
 5kd/OBDzbY8OkXDgEJj+VJIfHc8zxeQ8PUe28icsX3inoddgdJYXg3dPjx69tfv9
 g1AAxGIAmtx2CTv6UNep9sNBpx1blzV4ThFURKobvzzXTZ+HK2HrzKrsjRfKe4bv
 PHVCUDd7RkujkcU4gOvCFIg=
 =xhar
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmkXnXkACgkQmmx57+YA
 GNnZDw//d+5ko5rX/5QPpnh0BrHEFdsUYDDcbjPOJ+z0YJcXM9MnXozX0ubTK1HT
 B80yTG0mS50kBuRf9ZdIt3WFHsXgJfr8b1LLhLOrPBVgns7RTRLlFvr7CjLmSooM
 IEcHj7TrUTXS30XE2gHON2rhwlCwNxwht/kQlomyEf/6zHMSHqi1xXDsXeySHEkB
 QA6VkSLZOLMsgcqvwFUozv9DV/a+PVMv1LJvvAgFuvnpCacydyhBGJWzPFdUkFgk
 qfbO/OezPbXwt/XJTDIxbp6u5w1q0RhCXFCrg+WWcwPCBjS1yBa6o1apz00kjl0M
 RnZyR4F5Lg0vmDKTYePBA+ELdjWNrcAuCn9/kmm9E/taN59uqf7uF9X9oXXUlTQu
 eFGmDs9yWonX6KqjBTRKVCfYCagimpNQQ2xao1VDq58BxrpfjWfAJltgYxiTokdU
 BDuWsc9084xlH/fO9L+2WxW8weLYOaV+NE68zD6y8PyoPle7mA5XlSnFTuHi8gm5
 LXCj7+PZ5sT2X0VS++U+Sx1TtEOwD5bYkiEwhrTe6+dumzAKl9/vIKriGgCAv97x
 Leahlh3nN7v7JIpGs0BZZ61XcvUOBARK7ceLvIRSaNrDzXmnbixeVRAIrenqCPXE
 aa0/vch4MyctXPHtN/TyhQI1hmD3bggx9UqtN0XnCT4PuwnZDT8=
 =nT6/
 -----END PGP SIGNATURE-----

Merge tag 'tee-fix-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into arm/fixes

TEE kernel-doc fixes for v6.18

* tag 'tee-fix-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee:
  tee: <uapi/linux/tee.h: fix all kernel-doc issues

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2025-11-14 22:22:00 +01:00
Linus Torvalds
ac9f4f306d io_uring-6.18-20251113
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmkWeqcQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgplM6D/4jSqj7PedcnEDHNKHJR/0v5wSQWMugD0hg
 Xn1EFnmPJMLBacZrkobL3v6aCvA4WYQManc1VPdC94b9ofdbjDMVtcIDoljBXuAD
 A94kk4TiIsHzKn8Un5bprC20Xc/v1pQ3uFERtK7mnonGb6n+/RITIQuWqn/Fey3N
 58K7njnInQXDS2U6rx4QTdyuyrg6EHHIoNh1GmKdQgSY1kcJnQz4C+Yrh3qIBlTV
 AEWkoIwSp15hXvmn8J4nvbbFEZypg0qTaBREdc7KXt8kPMNCLqQ1Z4FOXYDt0qo1
 zm88Z/08mwXbxFLtfse8JJ7XHPgy1+G0rXmdwv4F6CEtCyklnChLynrTpqUK5FCH
 pvuzOfA3tPcyg6dgc7X2z40u3g+vISydjprs9m5eL6hgovDhH+EfDGzpWxUzuuNe
 AXNXb3N9ZrxZePGfAweW2BxZ+D2OwYdQjKWSrL+438Tb3Q8QiiYCwM7eLyl0kXKH
 QpjJJsbIEJgLXYRVHE5tu0XdMdYsZYZYUv0wVACQ0hw+EtgaNi2yjySBvRJUJPzZ
 sL6Lnu5UzbEqSf1y8YGcdCCvOgHc6CHFAdKMgz0CXUcRC+ftmGz4iEXhGJJdMemQ
 6WRLvsRykF1FO93dpfaIjWv9k/d40cGt5LrjiINfb36NDlqBth+EY+HbSJHBDI54
 p2wDeoP3Kw==
 =sd1e
 -----END PGP SIGNATURE-----

Merge tag 'io_uring-6.18-20251113' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull io_uring fixes from Jens Axboe:

 - Use the actual segments in a request when for bvec based buffers

 - Fix an odd case where the iovec might get leaked for a read/write
   request, if it was newly allocated, overflowed the alloc cache, and
   hit an early error

 - Minor tweak to the query API added in this release, returning the
   number of available entries

* tag 'io_uring-6.18-20251113' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring/rsrc: don't use blk_rq_nr_phys_segments() as number of bvecs
  io_uring/query: return number of available queries
  io_uring/rw: ensure allocated iovec gets cleared for early failure
2025-11-14 09:57:30 -08:00
Eric Dumazet
4ef9274362 bpf: Add bpf_prog_run_data_pointers()
syzbot found that cls_bpf_classify() is able to change
tc_skb_cb(skb)->drop_reason triggering a warning in sk_skb_reason_drop().

WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 __sk_skb_reason_drop net/core/skbuff.c:1189 [inline]
WARNING: CPU: 0 PID: 5965 at net/core/skbuff.c:1192 sk_skb_reason_drop+0x76/0x170 net/core/skbuff.c:1214

struct tc_skb_cb has been added in commit ec624fe740 ("net/sched:
Extend qdisc control block with tc control block"), which added a wrong
interaction with db58ba4592 ("bpf: wire in data and data_end for
cls_act_bpf").

drop_reason was added later.

Add bpf_prog_run_data_pointers() helper to save/restore the net_sched
storage colliding with BPF data_meta/data_end.

Fixes: ec624fe740 ("net/sched: Extend qdisc control block with tc control block")
Reported-by: syzbot <syzkaller@googlegroups.com>
Closes: https://lore.kernel.org/netdev/6913437c.a70a0220.22f260.013b.GAE@google.com/
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Reviewed-by: Victor Nogueira <victor@mojatatu.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20251112125516.1563021-1-edumazet@google.com
2025-11-14 08:56:49 -08:00
Greg Kroah-Hartman
d6b9ce75e8 firmware: stratix10-svc: fix saving contoller data for v6.18
- Fix the incorrect use of platform_set_drvdata and dev_set_drvdata
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEoHhMeiyk5VmwVMwNGZQEC4GjKPQFAmkIn88ACgkQGZQEC4Gj
 KPSt/RAAt/nx7Al5izyQcYegxZsynm95qSzyOnIsVP6xLhLRIGwosbgJLaLiAz2E
 fdtdMzYsU9kF7Y4Tf4FfjPI/0xG3bZiZqPhnEtYvxNIJQQcEROTqAnb/wTQORxSo
 8iwWcEBOsAy/plB5UGOJ0VKLvXpKn17NfVhqMkPjoEWfRhHasNvaNNNnPEIXu6V0
 ToLZsa+vi9dxtkruOpQ9qnDXfCXvMgdT604GgUmgrLlfc/K7XcA5XbMLSDp+8x+m
 i9XDbDk8NHgSjMFfUbuaPxyC6oKN9cZpq2+8kvam6CWs5UnvgOdwG8GBlccys/Pf
 uIsgOHjNSJ6g52RLjSPljH/3kMb2qR4MIhH2RjKV0Y3I2KBoI9TWrID5clbuq+2Z
 1n47LY9BU+Uq/H+5DIwqqJJRm2vZC2lu1wyy/g0CK5vi9N5UyH6GQ+CFNVuBLTpk
 IrprazsUZBq6QtauhwV++a6VxcvRUOufxMYb4WrnekoPfF+P3QUT7l0cVeNJYkuV
 aEaCA1j/nmPSIxk2LCOPCth6cQYwyRMJmbWjtN9ZZAmOWR+LyMmpMid4LBo4ulJI
 nB6zmaQBDRqed9nMT+XdgUgjBzc4Y1mtXILPNA3aGfxfbFhd1JK44/rck9I1fWsg
 5NXK8Bo5EGrskHfXfHwunGP66RG+KlZpNZRDPC7XgIx82NqemyA=
 =rh/O
 -----END PGP SIGNATURE-----

Merge tag 'stratix10_svc_fix_v6.18' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into char-misc-linus

Dinh writes:

firmware: stratix10-svc: fix saving contoller data for v6.18
- Fix the incorrect use of platform_set_drvdata and dev_set_drvdata

* tag 'stratix10_svc_fix_v6.18' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: (237 commits)
  firmware: stratix10-svc: fix bug in saving controller data
  Linux 6.18-rc4
  objtool: Fix skip_alt_group() for non-alternative STAC/CLAC
  kconfig/nconf: Initialize the default locale at startup
  kconfig/mconf: Initialize the default locale at startup
  x86/mm: Ensure clear_page() variants always have __kcfi_typeid_ symbols
  PCI: Do not size non-existing prefetchable window
  Revert "PCI: qcom: Remove custom ASPM enablement code"
  bpf/arm64: Fix BPF_ST into arena memory
  bpf: Make migrate_disable always inline to avoid partial inlining
  null_blk: set dma alignment to logical block size
  xfs: document another racy GC case in xfs_zoned_map_extent
  xfs: prevent gc from picking the same zone twice
  drm/ast: Clear preserved bits from register output value
  s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP
  drm/imx: parallel-display: add the bridge before attaching it
  drm/imx: parallel-display: convert to devm_drm_bridge_alloc() API
  blk-crypto: use BLK_STS_INVAL for alignment errors
  regulator: bd718x7: Fix voltages scaled by resistor divider
  x86/cpu: Add/fix core comments for {Panther,Nova} Lake
  ...
2025-11-13 17:36:35 -05:00
Greg Kroah-Hartman
8d422b8beb IIO: Fixes for 6.18 (set 1)
The usual mixed back of brand new and ancient bugs.
 
 dmaengine buffer / core
 - Add new callback to allow fetching the providing device for a DMA
   channel. Use this to get the right device for the dmaengine buffer
   implementation.
 adi,ad4030
 - Fix incorrect _scale value for common-mode channels.
 adi,ad7124
 - Fix gain and offset for temperature channel.
 adi,ad7280a
 - Fix a factor of 10 error when setting the balance timer.
 adi,ad7380
 - Fix sampling frequency to account for need to trigger twice per scan
   for some supported chips.
 adi,adxl355
 - Ensure a long enough wait after SW reset.
 bosch,bmc150
 - Fix wrong assumption that interrupts are always available.
 bosch,bmp280
 - Fix the measurement time calculation.
 richtek,rtq6056
 - Fix wrong sign bit when sign extending.
 samsung,ssp
 - Fix cleanup of registered mfd devices on error.
 st,lsm6dsx
 - Fix wrong sized array for register information.
 - Fix a wrong time stamp calculation for some devices.
 st,stm32-dfsdm
 - Update handling of st,adc-alt-channel to reflect binding change as
   part of moving to iio-backend framework.
 ti,hdc3020
 - Fix wrong units for temperature and humidity. Also the thresholds
   and hysteresis.
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEbilms4eEBlKRJoGxVIU0mcT0FogFAmkTnrARHGppYzIzQGtl
 cm5lbC5vcmcACgkQVIU0mcT0FoiKAhAAhtrSA4V/YwUblqNE5rRjzJoYtoxypXeH
 pbMg2k8+yZT0PuvNQE9JILIiUdEt1ijyEFgruHzGiVhmptvOADTdex+T6j8nVDIx
 wM0bHyNUWikuMDu6w4FvnFy87NxmuWUNHq79PjVXDuaQLAtUo+6041C5VyfIUPMt
 wvLjjI8pFHYTTidFBcqvnZZzSc+w/DzA26UZk3Mj81JqABW+mGNsBHdrCOq026zx
 jOAHI3O80YE3P2rK3vPUfDwGIwiA8JTI+hmsZMTGoJa6B8VfWMMePtLViq/lLREg
 3Dxp0P7UG6UASy0yXVz3NMPDTiQaiK8l36f9IrAQH2rusa/3pU7SvksFWPfkEMol
 RrjTme/+tO0S9ZjQsXQ6yYeOapnXG0scrwobIGdMsG20Y+NxtrJDL3PaTC8Tm39I
 f4g5S34s7kHdFGoFwVcW7xsf4faLSzyFA74AfF0BUIZo+CaDAcgTefGix86dBcYj
 VBCM3Fo0sIrvTeWXJ4sXTy7BevO/wfSjlfQvE9S3lYP1y0OUgH41M9JAiEiZqBPC
 H/gJGQrQQQ+NuplvB+0VMadbIc2zBjBSA2cSWIoZqvQP3ix8a05zgta+1EhYo7M6
 cYMKZzjK84HVXyXi1L9HZMpQWjMaOkK9b7F3DqZJHneMdk3Vem9veWTkye8BSH58
 NfwK2MA1x8Y=
 =My7D
 -----END PGP SIGNATURE-----

Merge tag 'iio-fixes-for-6.18a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-linus

Jonathan writes:

IIO: Fixes for 6.18 (set 1)

The usual mixed back of brand new and ancient bugs.

dmaengine buffer / core
- Add new callback to allow fetching the providing device for a DMA
  channel. Use this to get the right device for the dmaengine buffer
  implementation.
adi,ad4030
- Fix incorrect _scale value for common-mode channels.
adi,ad7124
- Fix gain and offset for temperature channel.
adi,ad7280a
- Fix a factor of 10 error when setting the balance timer.
adi,ad7380
- Fix sampling frequency to account for need to trigger twice per scan
  for some supported chips.
adi,adxl355
- Ensure a long enough wait after SW reset.
bosch,bmc150
- Fix wrong assumption that interrupts are always available.
bosch,bmp280
- Fix the measurement time calculation.
richtek,rtq6056
- Fix wrong sign bit when sign extending.
samsung,ssp
- Fix cleanup of registered mfd devices on error.
st,lsm6dsx
- Fix wrong sized array for register information.
- Fix a wrong time stamp calculation for some devices.
st,stm32-dfsdm
- Update handling of st,adc-alt-channel to reflect binding change as
  part of moving to iio-backend framework.
ti,hdc3020
- Fix wrong units for temperature and humidity. Also the thresholds
  and hysteresis.

* tag 'iio-fixes-for-6.18a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio:
  iio: accel: bmc150: Fix irq assumption regression
  iio: st_lsm6dsx: Fixed calibrated timestamp calculation
  iio: humditiy: hdc3020: fix units for thresholds and hysteresis
  iio: humditiy: hdc3020: fix units for temperature and humidity measurement
  iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields
  iio: accel: fix ADXL355 startup race condition
  iio: adc: ad7124: fix temperature channel
  iio:common:ssp_sensors: Fix an error handling path ssp_probe()
  iio: adc: ad7280a: fix ad7280_store_balance_timer()
  iio: buffer-dmaengine: enable .get_dma_dev()
  iio: buffer-dma: support getting the DMA channel
  iio: buffer: support getting dma channel from the buffer
  iio: pressure: bmp280: correct meas_time_us calculation
  iio: adc: stm32-dfsdm: fix st,adc-alt-channel property handling
  iio: adc: ad7380: fix SPI offload trigger rate
  iio: adc: rtq6056: Correct the sign bit index
  iio: adc: ad4030: Fix _scale value for common-mode channels
2025-11-13 17:34:22 -05:00
Linus Torvalds
d0309c0543 Including fixes from Bluetooth and Wireless. No known outstanding
regressions.
 
 Current release - regressions:
 
   - eth: bonding: fix mii_status when slave is down
 
   - eth: mlx5e: fix missing error assignment in mlx5e_xfrm_add_state()
 
 Previous releases - regressions:
 
   - sched: limit try_bulk_dequeue_skb() batches
 
   - ipv4: route: prevent rt_bind_exception() from rebinding stale fnhe
 
   - af_unix: initialise scc_index in unix_add_edge()
 
   - netpoll: fix incorrect refcount handling causing incorrect cleanup
 
   - bluetooth: don't hold spin lock over sleeping functions
 
   - hsr: Fix supervision frame sending on HSRv0
 
   - sctp: prevent possible shift out-of-bounds
 
   - tipc: fix use-after-free in tipc_mon_reinit_self().
 
   - dsa: tag_brcm: do not mark link local traffic as offloaded
 
   - eth: virtio-net: fix incorrect flags recording in big mode
 
 Previous releases - always broken:
 
   - sched: initialize struct tc_ife to fix kernel-infoleak
 
   - wifi:
     - mac80211: reject address change while connecting
     - iwlwifi: avoid toggling links due to wrong element use
 
   - bluetooth: cancel mesh send timer when hdev removed
 
   - strparser: fix signed/unsigned mismatch bug
 
   - handshake: fix memory leak in tls_handshake_accept()
 
 Misc:
 
   - selftests: mptcp: fix some flaky tests
 
 Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCgAwFiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmkV/O8SHHBhYmVuaUBy
 ZWRoYXQuY29tAAoJECkkeY3MjxOkeBQQALgJv+sfJ/8H+BA3US7BU9kwydXtJneo
 mHKnse3NCiV3kXyJu7p+CIBU4xP8LMMmpVFZQ0dPKnbFyfGWjCX+UOEMU4NBnhG7
 dfSGWAxR8iS0gUi/5K4dT55LZjeQ392Zu2OqrBRjAAYG0s5vXbAcCx0jUhfmG+ZD
 rJupFYuRuF7W3UvWC/TQviY4oJ0goaZnrm6Y5ADX9rblPlzD5xgOTqZzSuUpLxQM
 Q37IGjW3F12FrNmqabC3MBQcNfWNpqUgkDfFxMJbxGPDe9CjvSAAmMVNmDDkr+EH
 eL5+M1cdH+L9RRBNSQ4SX9dsNwhyyU04wrEADGf39jcgw/ACXI+t0laj/Hm0O1xg
 vMOtqiQYSe8lVVdCswmi6BdYxBsNU6l2gx0evq/qGztFbDW9s5rn26uXy5CIqlJa
 04k1lmT5EeMpE9opwxPJpw+5LyjjtCsD6AGOlLb8DU6cbXKVUhxCZVHdDNnfxt4J
 ZfQo8aUx6X3vnDGMzPWEZbYMqd4va6hVPTJdUuqk1enuE6KfhKMhWbP5D9a/qiqM
 lhinWYdmBP6bKJlxdfsH7kgwhfuoi/jT54VYu33l5LmrOk7+tO7gLJcRhNZW9jsl
 KkJ+Wk1JQ7/oiQI8tcUCc+LEwwY54F+34HAHjFLNELW+bp/vvoMEVeZKku2YM3Gy
 xW+7WYdrx2RK
 =JAyr
 -----END PGP SIGNATURE-----

Merge tag 'net-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Paolo Abeni:
 "Including fixes from Bluetooth and Wireless. No known outstanding
  regressions.

  Current release - regressions:

   - eth:
      - bonding: fix mii_status when slave is down
      - mlx5e: fix missing error assignment in mlx5e_xfrm_add_state()

  Previous releases - regressions:

   - sched: limit try_bulk_dequeue_skb() batches

   - ipv4: route: prevent rt_bind_exception() from rebinding stale fnhe

   - af_unix: initialise scc_index in unix_add_edge()

   - netpoll: fix incorrect refcount handling causing incorrect cleanup

   - bluetooth: don't hold spin lock over sleeping functions

   - hsr: Fix supervision frame sending on HSRv0

   - sctp: prevent possible shift out-of-bounds

   - tipc: fix use-after-free in tipc_mon_reinit_self().

   - dsa: tag_brcm: do not mark link local traffic as offloaded

   - eth: virtio-net: fix incorrect flags recording in big mode

  Previous releases - always broken:

   - sched: initialize struct tc_ife to fix kernel-infoleak

   - wifi:
      - mac80211: reject address change while connecting
      - iwlwifi: avoid toggling links due to wrong element use

   - bluetooth: cancel mesh send timer when hdev removed

   - strparser: fix signed/unsigned mismatch bug

   - handshake: fix memory leak in tls_handshake_accept()

  Misc:

   - selftests: mptcp: fix some flaky tests"

* tag 'net-6.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (60 commits)
  hsr: Follow standard for HSRv0 supervision frames
  hsr: Fix supervision frame sending on HSRv0
  virtio-net: fix incorrect flags recording in big mode
  ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
  wifi: iwlwifi: mld: always take beacon ies in link grading
  wifi: iwlwifi: mvm: fix beacon template/fixed rate
  wifi: iwlwifi: fix aux ROC time event iterator usage
  net_sched: limit try_bulk_dequeue_skb() batches
  selftests: mptcp: join: properly kill background tasks
  selftests: mptcp: connect: trunc: read all recv data
  selftests: mptcp: join: userspace: longer transfer
  selftests: mptcp: join: endpoints: longer transfer
  selftests: mptcp: join: rm: set backup flag
  selftests: mptcp: connect: fix fallback note due to OoO
  ethtool: fix incorrect kernel-doc style comment in ethtool.h
  mlx5: Fix default values in create CQ
  Bluetooth: btrtl: Avoid loading the config file on security chips
  net/mlx5e: Fix potentially misleading debug message
  net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps
  net/mlx5e: Fix maxrate wraparound in threshold between units
  ...
2025-11-13 11:20:25 -08:00
Andrew Donnellan
ebd4469e7a entry: Fix ifndef around arch_xfer_to_guest_mode_handle_work() stub
The stub implementation of arch_xfer_to_guest_mode_handle_work() is
guarded by an #ifndef that incorrectly checks for the name
arch_xfer_to_guest_mode_work instead. It seems the function was renamed
to add "_handle" as a late change to the original patch, and the #ifndef
wasn't updated to go with it.

Change the #ifndef to match the name of the function. No users right now,
so no need to update any architecture code.

Fixes: 935ace2fb5 ("entry: Provide infrastructure for work before transitioning to guest mode")
Signed-off-by: Andrew Donnellan <ajd@linux.ibm.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://patch.msgid.link/20251105-entry-fix-ifndef-v1-1-d8d28045b627@linux.ibm.com
2025-11-13 16:27:56 +01:00
Linus Torvalds
92385a075a dma-mapping fixes for Linux 6.18
- two minor fixes for DMA API infrastructure: restoring proper structure
 padding used in benchmark tests (Qinxin Xia) and global DMA_BIT_MASK
 macro rework to make it a bit more clang friendly (James Clark)
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQSrngzkoBtlA8uaaJ+Jp1EFxbsSRAUCaRRZHwAKCRCJp1EFxbsS
 RPP5AP4ywlRd8X9A6n3BGSWenWv+TIrTVcGwnjL67Gn18QcctgEAk7UrN7QY6POK
 F0E2E1JLDYqju2X1I+57YM1hFqFghg8=
 =tMdy
 -----END PGP SIGNATURE-----

Merge tag 'dma-mapping-6.18-2025-11-12' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux

Pull dma-mapping fixes from Marek Szyprowski:

 - two minor fixes for DMA API infrastructure: restoring proper
   structure padding used in benchmark tests (Qinxin Xia) and global
   DMA_BIT_MASK macro rework to make it a bit more clang friendly (James
   Clark)

* tag 'dma-mapping-6.18-2025-11-12' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux:
  dma-mapping: Allow use of DMA_BIT_MASK(64) in global scope
  dma-mapping: benchmark: Restore padding to ensure uABI remained consistent
2025-11-12 18:31:22 -08:00
Bjorn Helgaas
4495bffd86 PCI/ASPM: Cache L0s/L1 Supported so advertised link states can be overridden
Defective devices sometimes advertise support for ASPM L0s or L1 states
even if they don't work correctly.

Cache the L0s Supported and L1 Supported bits early in enumeration so
HEADER quirks can override the ASPM states advertised in Link Capabilities
before pcie_aspm_cap_init() enables ASPM.

Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Shawn Lin <shawn.lin@rock-chips.com>
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Link: https://patch.msgid.link/20251110222929.2140564-2-helgaas@kernel.org
2025-11-12 18:47:16 -06:00
Mateusz Guzik
1274162464
fs: add iput_not_last()
Signed-off-by: Mateusz Guzik <mjguzik@gmail.com>
Link: https://patch.msgid.link/20251105212025.807549-1-mjguzik@gmail.com
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-11-12 10:47:42 +01:00
Andrei Vagin
78f0e33cd6
fs/namespace: correctly handle errors returned by grab_requested_mnt_ns
grab_requested_mnt_ns was changed to return error codes on failure, but
its callers were not updated to check for error pointers, still checking
only for a NULL return value.

This commit updates the callers to use IS_ERR() or IS_ERR_OR_NULL() and
PTR_ERR() to correctly check for and propagate errors.

This also makes sure that the logic actually works and mount namespace
file descriptors can be used to refere to mounts.

Christian Brauner <brauner@kernel.org> says:

Rework the patch to be more ergonomic and in line with our overall error
handling patterns.

Fixes: 7b9d14af87 ("fs: allow mount namespace fd")
Cc: Christian Brauner <brauner@kernel.org>
Signed-off-by: Andrei Vagin <avagin@google.com>
Link: https://patch.msgid.link/20251111062815.2546189-1-avagin@google.com
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-11-12 10:42:49 +01:00
Christian Brauner
a3f8f86627
power: always freeze efivarfs
The efivarfs filesystems must always be frozen and thawed to resync
variable state. Make it so.

Link: https://patch.msgid.link/20251105-vorbild-zutreffen-fe00d1dd98db@brauner
Signed-off-by: Christian Brauner <brauner@kernel.org>
2025-11-12 10:12:39 +01:00
Jakub Kicinski
27bcc05b88 bluetooth pull request for net:
- hci_conn: Fix not cleaning up PA_LINK connections
  - hci_event: Fix not handling PA Sync Lost event
  - MGMT: cancel mesh send timer when hdev removed
  - 6lowpan: reset link-local header on ipv6 recv path
  - 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion
  - L2CAP: export l2cap_chan_hold for modules
  - 6lowpan: Don't hold spin lock over sleeping functions
  - 6lowpan: add missing l2cap_chan_lock()
  - btusb: reorder cleanup in btusb_disconnect to avoid UAF
  - btrtl: Avoid loading the config file on security chips
 -----BEGIN PGP SIGNATURE-----
 
 iQJNBAABCgA3FiEE7E6oRXp8w05ovYr/9JCA4xAyCykFAmkTQ4EZHGx1aXoudm9u
 LmRlbnR6QGludGVsLmNvbQAKCRD0kIDjEDILKZXAD/9dkWzRXqvD7K8hq7IzjtmP
 ni7cjW72tAI5bCDcYgarB4+AX2eOpdQZSM3EYWxsryzmVhifHaKbRlUesgQHSc2t
 8n9qqCJmu9odqWnueCWDWBoOuNGqzlvIhLCoQtym9+txJ/aBuOvg2LwOEetM7Bon
 VMY62FBWGbnUzQRue81uYAzR1ae4c63caaycfJgOywDHKxDhlKCdfZrBuuaLK5oO
 Cgq8LRk2ByWfK5kZ3eDOiJoy3avu74bstcxoWaeJMo5yI7UfGEaLpFpmeP9xmhZt
 Q4JZk8RRFA2uIQWLK5R8pBH49wshgFTc9NNaLxi65E5SUhpTCo7/c4qPQoPNSQup
 DRIErDaR8l138RKvxO/hDID/3RO/U6VRZERybplMcFtwpLdfcVvfUH1CcOWz6v1i
 dm3jjqZ+t3J+Zg7d976UYbpITsuNdxrFNQVa5XF9m7FIcheTzkESgNFbajCaVi4s
 sbXug5QbTb9lLvhL6RX42fS1WHenZvlB52cGiGIjhRJS0PRR1Ob7q0WA/ZbGy2f8
 T+esUVxDba5CyAhaxX6Ea8OtkwKvd+XKaWWA93/VugPBZCLQnEelcwGgTmny+Gem
 9ie4yBIg6CArWDonCISrPJ4A/hmyx+Nx8f+5JENHdxyM6nBxIBpuVmXx1yK+YIJN
 HnbR59xACO64A9DASgVaxg==
 =7k5A
 -----END PGP SIGNATURE-----

Merge tag 'for-net-2025-11-11' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth

Luiz Augusto von Dentz says:

====================
bluetooth pull request for net:

 - hci_conn: Fix not cleaning up PA_LINK connections
 - hci_event: Fix not handling PA Sync Lost event
 - MGMT: cancel mesh send timer when hdev removed
 - 6lowpan: reset link-local header on ipv6 recv path
 - 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion
 - L2CAP: export l2cap_chan_hold for modules
 - 6lowpan: Don't hold spin lock over sleeping functions
 - 6lowpan: add missing l2cap_chan_lock()
 - btusb: reorder cleanup in btusb_disconnect to avoid UAF
 - btrtl: Avoid loading the config file on security chips

* tag 'for-net-2025-11-11' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:
  Bluetooth: btrtl: Avoid loading the config file on security chips
  Bluetooth: hci_event: Fix not handling PA Sync Lost event
  Bluetooth: hci_conn: Fix not cleaning up PA_LINK connections
  Bluetooth: 6lowpan: add missing l2cap_chan_lock()
  Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions
  Bluetooth: L2CAP: export l2cap_chan_hold for modules
  Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion
  Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
  Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
  Bluetooth: MGMT: cancel mesh send timer when hdev removed
====================

Link: https://patch.msgid.link/20251111141357.1983153-1-luiz.dentz@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-11-11 17:43:32 -08:00
Kriish Sharma
bb8336a516 ethtool: fix incorrect kernel-doc style comment in ethtool.h
Building documentation produced the following warning:

  WARNING: ./include/linux/ethtool.h:495 This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst
 * IEEE 802.3ck/df defines 16 bins for FEC histogram plus one more for

This comment was not intended to be parsed as kernel-doc, so replace
the '/**' with '/*' to silence the warning and align with normal
comment style in header files.

No functional changes.

Signed-off-by: Kriish Sharma <kriish.sharma2006@gmail.com>
Link: https://patch.msgid.link/20251110182545.2112596-1-kriish.sharma2006@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-11-11 17:38:48 -08:00
Akiva Goldberger
e5eba42f01 mlx5: Fix default values in create CQ
Currently, CQs without a completion function are assigned the
mlx5_add_cq_to_tasklet function by default. This is problematic since
only user CQs created through the mlx5_ib driver are intended to use
this function.

Additionally, all CQs that will use doorbells instead of polling for
completions must call mlx5_cq_arm. However, the default CQ creation flow
leaves a valid value in the CQ's arm_db field, allowing FW to send
interrupts to polling-only CQs in certain corner cases.

These two factors would allow a polling-only kernel CQ to be triggered
by an EQ interrupt and call a completion function intended only for user
CQs, causing a null pointer exception.

Some areas in the driver have prevented this issue with one-off fixes
but did not address the root cause.

This patch fixes the described issue by adding defaults to the create CQ
flow. It adds a default dummy completion function to protect against
null pointer exceptions, and it sets an invalid command sequence number
by default in kernel CQs to prevent the FW from sending an interrupt to
the CQ until it is armed. User CQs are responsible for their own
initialization values.

Callers of mlx5_core_create_cq are responsible for changing the
completion function and arming the CQ per their needs.

Fixes: cdd04f4d4d ("net/mlx5: Add support to create SQ and CQ for ASO")
Signed-off-by: Akiva Goldberger <agoldberger@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Acked-by: Leon Romanovsky <leon@kernel.org>
Link: https://patch.msgid.link/1762681743-1084694-1-git-send-email-tariqt@nvidia.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-11-11 15:12:18 +01:00
Luiz Augusto von Dentz
485e0626e5 Bluetooth: hci_event: Fix not handling PA Sync Lost event
This handles PA Sync Lost event which previously was assumed to be
handled with BIG Sync Lost but their lifetime are not the same thus why
there are 2 different events to inform when each sync is lost.

Fixes: b2a5f2e1c1 ("Bluetooth: hci_event: Add support for handling LE BIG Sync Lost event")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2025-11-11 08:55:18 -05:00