mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-10 20:48:12 +00:00
1,464,522 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Kees Cook
|
079a028d63 |
string: Remove strncpy() from the kernel
strncpy() has been a persistent source of bugs due to its ambiguous intended usage and frequently counter-intuitive semantics: it may not NUL-terminate the destination, and it unconditionally zero-pads to the full length, which isn't always needed. All former callers have been migrated[1] to: - strscpy() for NUL-terminated destinations - strscpy_pad() for NUL-terminated destinations needing zero-padding - strtomem_pad() for non-NUL-terminated fixed-width fields - memcpy_and_pad() for bounded copies with explicit padding - memcpy() for known-length copies Remove the generic implementation, its declaration, the FORTIFY_SOURCE wrapper, and associated tests. Link: https://github.com/KSPP/linux/issues/90 [1] Signed-off-by: Kees Cook <kees@kernel.org> |
||
Linus Torvalds
|
5cd1731cc8 |
CXL changes for v7.2
Introduce devm_cxl_probe_mem(), in prep for type2 basic enabling: cxl: Add dummy function for cxl_memdev_attach_region for !CONFIG_CXL_REGION cxl/region: Introduce devm_cxl_probe_mem() cxl/memdev: Introduce cxl_class_memdev_type cxl/memdev: Pin parents for entire memdev lifetime cxl/region: Resolve region deletion races cxl/region: Block region delete during region creation CXL Misc: cxl/region: Fill first free targets[] slot during auto-discovery cxl/region: Fix out-of-bounds access in cxl_cancel_auto_attach() tools/testing/cxl: Resolve auto-region decoder targets like real HW cxl: Align interleave decode/encode helpers with their callers cxl/test: Add check after kzalloc() memory in alloc_mock_res() cxl/test: Unregister cxl_acpi in cxl_test_init() error path cxl/test: Zero out LSA backing memory to avoid leaking to user cxl/test: Fix integer overflow in mock LSA bounds checks cxl/test: Verify cmd->size_in before accessing payload cxl/port: update reference to removed CONFIG_PROVE_CXL_LOCKING cxl/region: Avoid variable shadowing in region attach paths cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size cxl/test: Fix __fortify_panic cxl/fwctl: Fix __fortify_panic MAINTAINERS: Add CXL reviewer cxl/test: Enforce PMD alignment for volatile mock regions cxl/region: Validate partition index before array access cxl/memdev: Hold memdev lock during memdev poison injection/clear CXL PCI fixes: cxl/pci: Convert PCIBIOS errors to errno on DVSEC config accesses cxl/pci: Fix the incorrect check of pci_read_config_word() return -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE5DAy15EJMCV1R6v9YGjFFmlTOEoFAmo0MqsACgkQYGjFFmlT OEp5qQ/+N//u4DqTq54P7ZV1jpVzMEchV411frsWF5wl/pvEz9cr/ruPNxpg6Gdz AtryU1hcXRrDu9hvmO3odDM7jdZsIcF8GbpAWy5blAZaRt37aU6A4+fsFb8apFst SoFQ9BV23clPAEM7TYKXgya+G4kFu+btf3uxIutc8R78e88aEHGDz/Si//cocLmo sZY5Qky5eGca7wtX5rEImJtwsKDcTrtTQKQYGcuV6swLtLuJsHgL86TEfrWAH36M Vugb83a9AhQnGaTtKhvViHZkbMTOjCfOZom9BS++YDl/hVSPU1kF184ZPAI9oi4y 0kKDyoKbTN+oEIhrmhC4SGi0UgIW2O4Y6zR7lgr2iYm08Ki9ehbOI5EX6+PTVMSH lzLVunyLY/AAU9wrQ4YENYuZgfdUXpOgUzseCVIhN4kVo0oWhnUPHVRj2m2fZ7oH JzQV1MP2YJEbfqtAFVndBBZhBjrMZMcJCHhdISvz0Axv9ezj02LYJPVgmnGDthX7 kKvPgK7u/3sShAk2qmh1csFlT3H+UH1lpPcGM6btOjpI9TNIsYnyH/VaoHt4CIVL LZpMwQEMbz7S+An1+Ckwehe7LZAXO4IMUVFSdx6pAIRILNBv+68QkFtg2Ok5v/4s 7p5WPOvS97tTf6z5G/dQkDkGQVg1rdCfrQNN/MrZK4bEvMoQ5DM= =CimP -----END PGP SIGNATURE----- Merge tag 'cxl-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull CXL updates from Dave Jiang: "A collection of CXL fixes and changes, including an update to MAINTAINERS to add Ming Li as a CXL subsystem reviewer. There's also a series to introduce devm_cxl_probe_mem() core API in order to pave the way for CXL type2 device drivers to setup and retrieve CXL region resource during probe" * tag 'cxl-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: (26 commits) cxl: Add dummy function for cxl_memdev_attach_region for !CONFIG_CXL_REGION cxl/region: Introduce devm_cxl_probe_mem() cxl/memdev: Introduce cxl_class_memdev_type cxl/memdev: Pin parents for entire memdev lifetime cxl/region: Resolve region deletion races cxl/region: Block region delete during region creation cxl/region: Fill first free targets[] slot during auto-discovery cxl/region: Fix out-of-bounds access in cxl_cancel_auto_attach() tools/testing/cxl: Resolve auto-region decoder targets like real HW cxl: Align interleave decode/encode helpers with their callers cxl/test: Add check after kzalloc() memory in alloc_mock_res() cxl/test: Unregister cxl_acpi in cxl_test_init() error path cxl/test: Zero out LSA backing memory to avoid leaking to user cxl/test: Fix integer overflow in mock LSA bounds checks cxl/test: Verify cmd->size_in before accessing payload cxl/port: update reference to removed CONFIG_PROVE_CXL_LOCKING cxl/region: Avoid variable shadowing in region attach paths cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size cxl/pci: Convert PCIBIOS errors to errno on DVSEC config accesses cxl/pci: Fix the incorrect check of pci_read_config_word() return ... |
||
|
Kees Cook
|
58c4ce8cd6 |
xtensa: Remove arch-specific strncpy() implementation
strncpy() has no remaining callers in the kernel[1]. Remove the xtensa-specific inline assembly implementation and __HAVE_ARCH_STRNCPY define, falling back to the generic version in lib/string.c. Link: https://github.com/KSPP/linux/issues/90 [1] Signed-off-by: Kees Cook <kees@kernel.org> |
||
|
Kees Cook
|
dfe05fcca8 |
x86: Remove arch-specific strncpy() implementation
strncpy() has no remaining callers in the kernel[1]. Remove the x86-32-specific inline assembly implementation and __HAVE_ARCH_STRNCPY define, falling back to the generic version in lib/string.c. Link: https://github.com/KSPP/linux/issues/90 [1] Signed-off-by: Kees Cook <kees@kernel.org> |
||
|
Kees Cook
|
7eda356658 |
powerpc: Remove arch-specific strncpy() implementation
strncpy() has no remaining callers in the kernel[1]. Remove the powerpc-specific assembly implementation from both the kernel (arch/powerpc/lib/string.S) and the boot wrapper (arch/powerpc/boot/string.S), along with the __HAVE_ARCH_STRNCPY define and declaration, falling back to the generic version in lib/string.c. The boot wrapper's strncpy had no callers in arch/powerpc/boot/. Link: https://github.com/KSPP/linux/issues/90 [1] Signed-off-by: Kees Cook <kees@kernel.org> |
||
|
Kees Cook
|
ad3242a9ac |
m68k: Remove arch-specific strncpy() implementation
strncpy() has no remaining callers in the kernel[1]. Remove the m68k-specific inline assembly implementation and __HAVE_ARCH_STRNCPY define, falling back to the generic version in lib/string.c. Link: https://github.com/KSPP/linux/issues/90 [1] Signed-off-by: Kees Cook <kees@kernel.org> |
||
|
Kees Cook
|
4cb5e246e6 |
alpha: Remove arch-specific strncpy() implementation
strncpy() has no remaining callers in the kernel[1]. Remove the alpha-specific assembly implementation and __HAVE_ARCH_STRNCPY define, falling back to the generic version in lib/string.c. The __stxncpy helper (stxncpy.S/ev6-stxncpy.S) is retained as it is still used by strncat. Link: https://github.com/KSPP/linux/issues/90 [1] Signed-off-by: Kees Cook <kees@kernel.org> |
||
|
Linus Torvalds
|
cfd96ad138 |
Updates for the 7.2 release
A race condition and a couple of static analysis issues are fixed in BTT Use sysfs_emit() in preparation for removal of cpumap_print_to_pagebuf() Escalate a dev_dbg to dev_err in a resource conflict message MAINTAINER file updates -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQR/ATNjDEocsE1wudD5tRoRP7nxxwUCajQaOQAKCRD5tRoRP7nx x3F9AP4iY4Z0ZJRbQuOtAjAd5t0tiwTubUT6IKHtAHxoWBOcXQD/TJV8HxIlnGTw K0mH1WSPgDpJFNT17+pNoRU1x/Gr4wg= =Bahm -----END PGP SIGNATURE----- Merge tag 'libnvdimm-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull nvdimm/dax updates from Alison Schofield: - Fix a race condition and a couple of static analysis issues in BTT - Use sysfs_emit() in preparation for removal of cpumap_print_to_pagebuf() - Escalate a dev_dbg to dev_err in a resource conflict message - MAINTAINER file updates * tag 'libnvdimm-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: MAINTAINERS: nvdimm: Include maintainer profile MAINTAINERS: Update address for Ira Weiny MAINTAINERS: Add maintainer info for libnvdimm and DAX nvdimm: Use sysfs_emit() for cpumask show callback dax/bus: Upgrade resource conflict message to dev_err() in alloc_dax_region() nvdimm/btt: Free arenas on btt_init() error paths nvdimm/btt: Free arena sub-allocations on discover_arenas() error path nvdimm/btt: Handle preemption in BTT lane acquisition |
||
|
Linus Torvalds
|
7849ce3871 |
pmdomain core:
- Add OF helpers for parsing the power-domains-child-ids property - Extend the power domain DT binding with power-domains-child-ids - Switch to use the dynamic root device pmdomain providers: - arm: Add support for domain hierarchies to SCMI power domains - qcom: Add power domains for the Shikra and Nord SoCs - sunxi: Fix GPU support on Radxa Cubie A7Z by keeping power domain on -----BEGIN PGP SIGNATURE----- iQJEBAABCgAuFiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmoyYiQQHHVsZmhAa2Vy bmVsLm9yZwAKCRD+JoQlc1iMKXSFEACMGPergitZamXsgMoIQGrT+jG/sZnLIaWV GBrCRhe837amMKQyq1oVu4cTjieQNLx67bJIsuMXZVuAdihyRnLLe/sKwsyOPaXu bSa8BR0GhvEXiD784EXFwEK56Zc7b8+qnw6vs67q2IGI/95rylI4gbWBgfa1JTmU /H9ayoeIoS/bgis6JPsEYXARWwZIJRJof8dxdEk/anTP6FJZIc9jYv2TPrelsyZk lu92ikdu2V4zsOu7pXd64SPSoNaFNg5T0qduOMm4vHB3ePaBr9z2wBF9moN154zB NgiIJGJiKZ+BnJnPnH0fX7YIBdr93I3pgaJebJVj9s8202oLd9gHDZ5qVjZED/uP OyhNXca5DjA1sCAL4CmxN6aVBQpT0ksnJ76BVqe+nIwNSbWvd/vlJxAswgZ1IhxR Hw9wrkYo8Ylq2UxUQ8Zs0EcDA7ANWL97DZJWIdi7ouWvlKH1OyKn75ntcTBYL1ns hCzApNg8nYgQliO2kp2siVxK0Ljunr4RRo6wdWwvRyIsRW1iZfHeqv5hzq/g7DaK QklZGZ3LT7/GVUKUWDE4XihIu+PF1+5JJk6hKYUp0T3/rjWeVuf8q1QZnVv6qnSS jDSmXzlNEcrKgYgWtgv5Je6NL3m2gQlVTgv6Lbw35/ag2L9NjhsCgocj5J5E4K0+ EYTpY3GfxA== =2hQV -----END PGP SIGNATURE----- Merge tag 'pmdomain-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain updates from Ulf Hansson: "pmdomain core: - Add OF helpers for parsing the power-domains-child-ids property - Extend the power domain DT binding with power-domains-child-ids - Switch to use the dynamic root device pmdomain providers: - arm: Add support for domain hierarchies to SCMI power domains - qcom: Add power domains for the Shikra and Nord SoCs - sunxi: Fix GPU support on Radxa Cubie A7Z by keeping power domain on" * tag 'pmdomain-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: pmdomain: core: fix unused variable warning with !PM_GENERIC_DOMAINS_OF pmdomain: core: fix early domain registration pmdomain: mediatek: mfg: move __packed after struct name to fix kernel-doc pmdomain: qcom: rpmpd: Add Shikra RPM Power Domains pmdomain: qcom: rpmhpd: Add power domains for Nord SoC dt-bindings: power: qcom,rpmpd: document the Shikra RPM Power Domains pmdomain: sunxi: support power domain flags for pck600 pmdomain: core: switch to dynamic root device pmdomain: qcom: Unify user-visible "Qualcomm" name dt-bindings: power: qcom,rpmhpd: Add RPMh power domain for Nord SoC dt-bindings: power: qcom,rpmhpd: Fix whitespace in RPMHPD defines pmdomain: arm_scmi: add support for domain hierarchies pmdomain: core: add support for power-domains-child-ids dt-bindings: power: Add power-domains-child-ids property |
||
Henrique Carvalho
|
9647492b5e |
smb: client: fix query directory replay double-free
A response-bearing attempt can return a replayable error and free its
response buffer. If SMB2_query_directory_init() fails before the next send,
cleanup retains the previous buffer type and frees that response again.
Reset response bookkeeping before each attempt to prevent the stale free.
Fixes:
|
||
|
Henrique Carvalho
|
145f820dcb |
smb: client: fix change notify replay double-free
A response-bearing attempt can return a replayable error and free its
response buffer. If SMB2_notify_init() fails before the next send, cleanup
retains the previous buffer type and frees that response again.
Reset response bookkeeping before each attempt to prevent the stale free.
Fixes:
|
||
|
Henrique Carvalho
|
2a88561d66 |
smb: client: fix query_info() replay double-free
A response-bearing attempt can return a replayable error and free its
response buffer. If SMB2_query_info_init() fails before the next send,
cleanup retains the previous buffer type and frees that response again.
Reset response bookkeeping before each attempt to prevent the stale free.
Fixes:
|
||
|
Henrique Carvalho
|
f96e1cdcb6 |
smb: client: fix double-free in SMB2_close() replay
A response-bearing attempt can return a replayable error and free its
response buffer. If SMB2_close_init() fails before the next send, cleanup
retains the previous buffer type and frees that response again.
Reset response bookkeeping before each attempt to prevent the stale free.
Fixes:
|
||
|
Henrique Carvalho
|
f9bbadb6c9 |
smb: client: fix double-free in SMB2_ioctl() replay
A response-bearing attempt can return a replayable error and free its
response buffer. If SMB2_ioctl_init() fails before the next send, cleanup
retains the previous buffer type and frees that response again.
Reset response bookkeeping before each attempt to prevent the stale free.
Fixes:
|
||
|
Henrique Carvalho
|
b55e182f23 |
smb: client: fix double-free in SMB2_open() replay
A response-bearing attempt can return a replayable error and free its
response buffer. If SMB2_open_init() fails before the next send, cleanup
retains the previous buffer type and frees that response again.
Reset response bookkeeping before each attempt to prevent the stale free.
Fixes:
|
||
Zhao Zhang
|
4be31c943a |
smb: client: fix double-free in SMB2_flush() replay
SMB2_flush() keeps its response buffer bookkeeping across replay
attempts. If a replayable flush response is received and the retry then
fails before cifs_send_recv() stores a replacement response, flush_exit
will free the stale response pointer a second time.
Reinitialize resp_buftype and rsp_iov at the top of the replay loop so
cleanup only acts on response state produced by the current attempt.
This fixes a double-free without changing replay handling for successful
requests.
Fixes:
|
||
Brett A C Sheffield
|
fbb7ad31ab |
docs: kselftest: remove link to obsolete wiki
Remove the reference to the obsolete kselftest wiki. The kselftest wiki is marked obsolete and is no longer updated. The last edit was in 2019, and the information is outdated, referring readers for support to IRC networks that have not been used for years, and to kernel versions that are no longer supported. If there is any relevant information left in the wiki it needs to be cleaned up and moved into the canonical kselftest documentation here. Link: https://lore.kernel.org/r/20260115172817.7120-1-bacs@librecast.net Signed-off-by: Brett A C Sheffield <bacs@librecast.net> Acked-by: Bagas Sanjaya <bagasdotme@gmail.com> Acked-by: SeongJae Park <sj@kernel.org> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org> |
||
|
Linus Torvalds
|
53c7db5c19 |
Pin control changes for the v7.2 kernel cycle:
Core changes:
- Add new generic callbacks to populate per-pin pin controllers creating
groups and functions from the device tree building out
pinctrl_generic_to_map() and move the Spacemit driver over to use this.
- Generic board-level pin control driver using the mux framework.
New drivers:
- Amlogic (meson) A9 SoC pin controller.
- Aspeed AST2700 SoC0 and SoC1 pin controllers.
- nVidia Tegra264 pin controller.
- nVidia Tegra238 pin controller.
- Qualcomm Nord TLMM pin controller.
- Qualcomm Shikra TLMM pin controller.
- Qualcomm SM6350 LPASS LPI pin controller.
- Qualcomm IPQ9650 TLMM pin controller.
- Renesas RZ/G3L SoC pin controller.
- UltraRISC DP1000 pin controller.
Improvements:
- Handle pull up/pull down properly in the Renesas RZG2L driver.
- Fix up nVidia Tegra 234 DT bindings.
- Fix up pin definitions in the Qualcomm Eliza driver.
- Qualcomm PM8010 GPIO support in the PM8010 pin controller.
- Qualcomm SM6115 EGPIO support in the SM6115 pin controller.
- Switch Qualcomm LPASS LPI drivers to use runtime PM for power management.
- Clean up the Qualcomm Kconfig business a bit to include the necessary
drivers for each subarch.
- Fix output glitch in the Amlogic (meson) A4 pin controller.
- Move the Airoha driver from the Mediatek directory to its own directory.
It is too different from other Mediatek hardware.
- A slew of fixes to the Airoha AN7581 and AN7583 drivers.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEElDRnuGcz/wPCXQWMQRCzN7AZXXMFAmoz6V8ACgkQQRCzN7AZ
XXNvUg/9ExEBVgJFo0yFKqQfwyr0sVHHjFwbAuWZnoBz7qPS0tRTfQ1GeJclqa9a
7hWkYM0wFWxZ0UpMI+DZI7rvhvg0mLDuU6Fjd8GOgPUISVgvejenqxCGsYTGLNHF
DsAzGMD42aj+Jt4eL3wBumrKrBS7J36sBfn5wUMcQgFtTjp+2SwDJxntPIfKRH8Q
l3arrJ+C3cStOwMKGa//S5c/qy2mijaTPKU+NzFrrmD/wZEYzzSLHcS1v4kBSVab
vVa32q6A5UZtKyPupFxVSICZEtz0/Lze381ppFef+h/txDaHlLwAKZvMLNcoJXt6
8AJu+q0DNP71mNNpr/51c8ZsAcV8kyc//CCjpV6vGwg2Pk2HnjBRWdOhzeY4H1z1
eESKEw9GJGdEeO3Ua6CV6FgXVxLGRnLigU9RC4zP0M8qwZuh/z3F3WxKKTWKZIpK
w0UF+Sl+KrW8qjQRyISsDXphT1fyglQGMrNntL4ihHq/T5JJGF9qjlJMKooZSkiH
oswB14JGVkNU4XGpG76I6IgbJJcaVe8CDGSdfRoVmTQ1sI3gHrO42eQdlWxbJ9x/
DgzL7bnO4os+vq5YJo6YdMsQYI0wpIqTWU7WRGfmCQYkyAVYPRVq+AE7KGlRZjbN
qoqQ9ychYaqKcO94F4vc5ZvhRJkcqIsxNRJel3dky0h8Brq2PZ8=
=5CSf
-----END PGP SIGNATURE-----
Merge tag 'pinctrl-v7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl
Pull pin control updates from Linus Walleij:
"Core changes:
- Add new generic callbacks to populate per-pin pin controllers
creating groups and functions from the device tree building out
pinctrl_generic_to_map() and move the Spacemit driver over to use
this
- Generic board-level pin control driver using the mux framework
New pin controller drivers:
- Amlogic (meson) A9 SoC
- Aspeed AST2700 SoC0 and SoC1
- nVidia Tegra264 and Tegra238
- Qualcomm Nord TLMM, Shikra TLMM, SM6350 LPASS LPI, and IPQ9650 TLMM
- Renesas RZ/G3L SoC
- UltraRISC DP1000
Improvements:
- Handle pull up/pull down properly in the Renesas RZG2L driver
- Fix up nVidia Tegra 234 DT bindings
- Fix up pin definitions in the Qualcomm Eliza driver
- Qualcomm PM8010 GPIO support in the PM8010
- Qualcomm SM6115 EGPIO support in the SM6115
- Switch Qualcomm LPASS LPI drivers to use runtime PM for power
management
- Clean up the Qualcomm Kconfig business a bit to include the
necessary drivers for each subarch
- Fix output glitch in the Amlogic (meson) A4 pin controller
- Move the Airoha driver from the Mediatek directory to its own
directory. It is too different from other Mediatek hardware
- A slew of fixes to the Airoha AN7581 and AN7583 drivers"
* tag 'pinctrl-v7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (151 commits)
pinctrl: Export pinctrl_get_group_selector()
pinctrl: Match DT helper types
pinctrl: qcom: Register functions before enabling pinctrl
pinctrl: meson: amlogic-a4: use nolock get range
pinctrl: ultrarisc: Add UltraRISC DP1000 pinctrl driver
dt-bindings: pinctrl: Add UltraRISC DP1000 pinctrl controller
pinctrl: qcom: Remove unused macro definitions
pinctrl: tegra: PINCTRL_TEGRA264 should depend on ARCH_TEGRA
pinctrl: tegra: PINCTRL_TEGRA238 should depend on ARCH_TEGRA
pinctrl: tegra238: add missing AON pin groups
dt-bindings: pinctrl: tegra238: add missing AON pin groups
pinctrl: airoha: an7583: remove undefined groups from pcm_spi pin function
pinctrl: airoha: an7583: fix phy1_led1 pin function
pinctrl: airoha: an7583: add missed gpio22 pin group
pinctrl: airoha: an7583: fix gpio21 pin group
pinctrl: airoha: fix pwm pin function for an7581 and an7583
pinctrl: airoha: an7583: fix incorrect led mapping in phy4_led1 pin function
pinctrl: airoha: an7581: fix incorrect led mapping in phy4_led1 pin function
pinctrl: airoha: an7583: fix misprint in gpio19 pinconf
pinctrl: airoha: an7581: fix misprint in gpio19 pinconf
...
|
||
|
Linus Torvalds
|
7c6742507c |
Backlight for v7.2
- New Support & Features
- Maxim MAX25014: Add support for the Maxim MAX25014 4-channel automotive grade
backlight driver IC
- Improvements & Fixes
- Maintainers: Add the Congatec Board Controller backlight driver to its corresponding
entry
- Congatec Board Controller: Remove redundant X86 dependency from the backlight driver
- Kinetic KTD2801: Enable BL_CORE_SUSPENDRESUME to ensure the chip is powered off
during suspend
- Cleanups & Refactoring
- Core: Use named initializers for i2c_device_id arrays to improve readability and
robustness
- Device Tree Binding Updates
- Maxim MAX25014: Add device tree bindings for the Maxim MAX25014 backlight controller
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEdrbJNaO+IJqU8IdIUa+KL4f8d2EFAmoylZoACgkQUa+KL4f8
d2GrtQ//dLUsFbhagbO2OqCef3jkugwIe+aQqiZQ+KjrYVVg+YzQsxbltH7dylXf
Tx8oLO6EZ5yD35Tf/STF17omMOqCAXGXefzm5jf0/z8yPDieBpML+StBnApm5JIg
C1SOHy8UtSBxnlC6bNLuj3GdvNza7XjB6mpopn/zFwV4F/1EdmWSVzj1lZmzc7qr
qjOrrW+hcF7F0toDGTRpL6kb4leVxAQHWn8C3qbebcpQ4PHue+eO2/6Nzn2gNgVE
hiQhz51W7bGEC9LJyRBkXYkSqQVJpBo3FEMY+//ONwvfduLZ9KzHE1jfJzkQHhxt
OshNBEggZVfP0Q2hx00w19I9Mn56MRpcJWC/QHW71MDu/PWVL8BKsglA9/FtLROg
qChu9igqipsLR26grj0rjaImh8P9jM2HKfTcTIfu9BUGkpsLAjxZMOhCJI+zWzq1
YhyCnYqP/vJxE72iXLXqyKCoTPHuhXp5mYNQdmglQtrdnRjuQGn3My/cY58uZHd5
8uV0bVL2SKp589f0DmfSIZQChqOPtuJTDpklijV9GRZ8GNhpEuHhpHSmoMGIkVJS
37m8ddZBlA8HgLBpSMI7CMRcEv7s8Jviwv84F0V4cGZ0AKpQ49/7xFHR2y4JkT26
SpYVPrMbZfbRB4twUfBu6+8qKxHVS5TU3C7ybLMeuz/aEpapRo8=
=6Es2
-----END PGP SIGNATURE-----
Merge tag 'backlight-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight
Pull backlight updates from Lee Jones:
"New Support & Features:
- Maxim MAX25014: Add support for the Maxim MAX25014 4-channel
automotive grade backlight driver IC
Improvements & Fixes:
- Maintainers: Add the Congatec Board Controller backlight driver to
its corresponding entry
- Congatec Board Controller: Remove redundant X86 dependency from the
backlight driver
- Kinetic KTD2801: Enable BL_CORE_SUSPENDRESUME to ensure the chip is
powered off during suspend
Cleanups & Refactoring:
- Core: Use named initializers for i2c_device_id arrays to improve
readability and robustness
Device Tree Binding Updates:
- Maxim MAX25014: Add device tree bindings for the Maxim MAX25014
backlight controller"
* tag 'backlight-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight:
backlight: Use named initializers for arrays of i2c_device_data
MAINTAINERS: Add cgbc backlight driver
backlight: cgbc: Remove redundant X86 dependency
backlight: Add max25014atg backlight
dt-bindings: backlight: Add max25014 support
backlight: ktd2801: Enable BL_CORE_SUSPENDRESUME
|
||
|
Linus Torvalds
|
6e717507bf |
LEDs for v7.2
- New Support & Features
- Samsung S2MU005: Add support for the Samsung S2MU005 PMIC which includes flash and
RGB LED controllers
- Texas Instruments LP5812: Add support for the TI LP5812 LED driver
- Texas Instruments LP5860: Add support for the Texas Instruments LP5860 LED matrix
driver via SPI
- Improvements & Fixes
- Core: Adjust the brightness sysfs node documentation to clarify that only decimal
values are accepted
- Core: Fix a race condition in the software blink logic when stopping blinking and
setting brightness simultaneously
- Core: Introduce the `multi_max_intensity` sysfs attribute for multicolor LEDs to
support hardware-based global brightness control
- Core: Replace OF-based device lookup with firmware node equivalents to support ACPI
and software nodes
- Core: Return `ENODATA` when reading brightness from hardware-controlled LEDs
- Core: Set the coherent DMA mask to zero for the Samsung PMIC device to suppress
unnecessary "DMA mask not set" messages
- ams OSRAM AS3668: Fix a Kconfig symbol name mismatch in the Makefile that prevented
the driver from being built
- BlinkM: Fix spelling and comment style issues in the driver
- DAC124S085: Declare the SPI command word as `__le16` to ensure correct endianness
and pass sparse checks
- GPIO Trigger: Use `GPIOD_FLAGS_BIT_NONEXCLUSIVE` to allow sharing GPIOs between the
LED trigger and other drivers
- NXP PCA9532: Fix an issue where the LED would stop blinking when changing brightness
to a non-zero value
- Qualcomm: Unify the user-visible company name to "Qualcomm" across flash LED config
options
- Qualcomm LPG: Optimize memory allocation by combining main structure and channels
into a single allocation using flexible array members
- Texas Instruments LP5860: Add missing `CONFIG_OF` dependency to prevent build
warnings
- TI TPS6131x: Increase the overvoltage protection threshold to 6V to avoid false
triggers with 5V input supplies
- Userspace LEDs (uLEDs): Fix a potential buffer overread by using `strnchr()` for
name string validation
- Userspace LEDs (uLEDs): Return `-EFAULT` on `copy_to_user()` failure to properly
handle read errors
- Cleanups & Refactoring
- Core: Convert various `i2c_device_id` arrays to use named initializers for improved
robustness and readability
- Multi-color Core: Fix incorrect `KernelVersion` and `Date` tags for the
`multi_max_intensity` ABI
- Broadcom BCM63138 / ChromeOS EC: Move `MODULE_DEVICE_TABLE` declarations next to the
ID tables for consistency
- LP5812: Fix a sysfs ABI reference in the documentation
- ST1202: Remove an unused legacy GPIO header include
- Device Tree Binding Updates
- Class: Document the keyboard backlight LED class naming conventions, including a new
scheme for zoned backlights
- Core: Dual-license the common LED bindings header under GPLv2 and BSD-2-Clause
- IR SPI LED: Add a new 30% duty-cycle value for the IR transmitter used in Xiaomi
Redmi Note 8
- Samsung S2M series: Document the flash LED device bindings for Samsung S2M series
PMICs
- Samsung S2M series: Document the pattern behavior for Samsung S2M series PMIC RGB
LEDs
- Samsung S2MU005: Add device tree bindings for the S2MU005 PMIC, including its flash
and RGB LED sub-devices
- TI LM3560: Document the TI LM3559 and LM3560 synchronous boost flash drivers
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEdrbJNaO+IJqU8IdIUa+KL4f8d2EFAmoylZ0ACgkQUa+KL4f8
d2GgaQ//QrL6Ap+Sp4JrG4m0FDvMB72QkqtTBtfMtUUpvliFrggGr5tAbPVOnITn
N5vFNJy++ffGA25xvi7XvMUDAi5dXY71razR7Rw+QAp7KytNnNNu5GxcYw4rGXGR
yndd9YQBhowlLF+jGjk866txj59vBKf/MpHXt+VrdJGK/se3nzeg4rOsCx/ZP1p5
nhBcyunGKereeVUHj041N22PVxicR8TsleDf9ho69UdiKTh3ZGiRmzdvn0sgA+wi
b8wZCQXNmnpnmWm2xtwoH7dCdTFMshbs1rmFl1GxctkRqwx5yRU5sREqJKxeW6g9
Q/24gwMI6UD350Yx5ir748aKgIeQxmGXAzKvqostqVNxt4uqKIcBat4Q3BHjzSgX
HzmpF1OZHZOcyPrN1mNgc5fpiv+5FyzQirddg+Au9P2FKe+leOH08u70b0eaZHX0
RgzSHayGq8DR2evAsUl1pIaJfSuh7W+YopSFaB2VnU83ShTEqLqE3DvdjwwQsjZ8
Fb1XkPfFqFShQr1gZ8SG3F60yDAbs77ZBzxH6vEC5kjMM7ewsg5rg06o4siR81S1
6rWyWTQyDXsywapra/vFyBUxum3aE/tj50YieSoovb7pKnwsoeiGU9Tzn2PRdlTX
u6LxZnnebsIvlKE2UWRWs82raKzDjTRa9u3HwQ42E8xiI0WYVDs=
=zlOu
-----END PGP SIGNATURE-----
Merge tag 'leds-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds
Pull LED updates from Lee Jones:
"New Support & Features:
- Samsung S2MU005: Add support for the Samsung S2MU005 PMIC which
includes flash and RGB LED controllers
- Texas Instruments:
- LP5812: Add support for the TI LP5812 LED driver
- LP5860: Add support for the Texas Instruments LP5860 LED matrix
driver via SPI
Improvements & Fixes:
- Core:
- Adjust the brightness sysfs node documentation to clarify that
only decimal values are accepted
- Fix a race condition in the software blink logic when stopping
blinking and setting brightness simultaneously
- Introduce the `multi_max_intensity` sysfs attribute for
multicolor LEDs to support hardware-based global brightness
control
- Replace OF-based device lookup with firmware node equivalents
to support ACPI and software nodes
- Return `ENODATA` when reading brightness from
hardware-controlled LEDs
- Set the coherent DMA mask to zero for the Samsung PMIC device
to suppress unnecessary "DMA mask not set" messages
- ams OSRAM AS3668: Fix a Kconfig symbol name mismatch in the
Makefile that prevented the driver from being built
- BlinkM: Fix spelling and comment style issues in the driver
- DAC124S085: Declare the SPI command word as `__le16` to ensure
correct endianness and pass sparse checks
- GPIO Trigger: Use `GPIOD_FLAGS_BIT_NONEXCLUSIVE` to allow sharing
GPIOs between the LED trigger and other drivers
- NXP PCA9532: Fix an issue where the LED would stop blinking when
changing brightness to a non-zero value
- Qualcomm: Unify the user-visible company name to "Qualcomm" across
flash LED config options
- Qualcomm LPG: Optimize memory allocation by combining main
structure and channels into a single allocation using flexible
array members
- Texas Instruments
- LP5860: Add missing `CONFIG_OF` dependency to prevent build
warnings
- TPS6131x: Increase the overvoltage protection threshold to 6V
to avoid false triggers with 5V input supplies
- Userspace LEDs (uLEDs):
- Fix a potential buffer overread by using `strnchr()` for name
string validation
- Return `-EFAULT` on `copy_to_user()` failure to properly handle
read errors
Cleanups & Refactoring:
- Core:
- Convert various `i2c_device_id` arrays to use named
initializers for improved robustness and readability
- Multi-color: Fix incorrect `KernelVersion` and `Date` tags for
the `multi_max_intensity` ABI
- Broadcom BCM63138 / ChromeOS EC: Move `MODULE_DEVICE_TABLE`
declarations next to the ID tables for consistency
- LP5812: Fix a sysfs ABI reference in the documentation
- ST1202: Remove an unused legacy GPIO header include
Device Tree Binding Updates:
- Class: Document the keyboard backlight LED class naming
conventions, including a new scheme for zoned backlights
- Core: Dual-license the common LED bindings header under GPLv2
and BSD-2-Clause
- IR SPI LED: Add a new 30% duty-cycle value for the IR transmitter
used in Xiaomi Redmi Note 8
- Samsung S2M series:
- Document the flash LED device bindings for Samsung S2M series
PMICs
- Document the pattern behavior for Samsung S2M series PMIC RGB
- S2MU005: Add device tree bindings for the S2MU005 PMIC,
including its flash and RGB LED sub-devices
- TI LM3560: Document the TI LM3559 and LM3560 synchronous boost
flash drivers"
* tag 'leds-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds: (30 commits)
leds: tps6131x: Increase overvoltage protection threshold to 6V
leds: Fix sysfs ABI date
leds: Fix CONFIG_OF dependency for LEDS_LP5860_CORE
leds: uleds: Fix potential buffer overread
leds: Use named initializers for arrays of i2c_device_data
leds: uleds: Return -EFAULT on copy_to_user() failure
leds: core: Report ENODATA for brightness of hardware controlled LED
leds: class: Use firmware nodes for device lookup
Documentation: leds: Document pattern behavior of Samsung S2M series PMIC RGB LEDs
leds: rgb: Add support for Samsung S2M series PMIC RGB LED device
leds: flash: Add support for Samsung S2M series PMIC flash LED device
dt-bindings: leds: Document Samsung S2M series PMIC flash LED device
leds: core: Fix race condition for software blink
leds: Adjust documentation of brightness sysfs node
leds: dac124s085: Declare SPI command word as __le16
leds: Introduce the multi_max_intensity sysfs attribute
dt-bindings: leds: Document TI LM3560 Synchronous Boost Flash Driver
leds: bcm63138/cros_ec: Move MODULE_DEVICE_TABLE next to the table itself
leds: Add support for TI LP5860 LED driver chip
Documentation: leds: leds-class: Document keyboard backlight LED class naming
...
|
||
|
Linus Torvalds
|
6beaec3aee |
MFD for v7.2
- New Support & Features
- Renesas RSMU: Add support for the IDT 8a34002 Clock Matrix
- Samsung S2MU005: Add support for the Samsung S2MU005 PMIC which includes charger,
MUIC, flash and RGB LED controllers
- SpacemiT P1: Add a reboot cell for the SpacemiT P1 chip
- Texas Instruments BQ25792: Add support for the TI BQ25792 charger manager
- Improvements & Fixes
- Core: Unify the user-visible company name to "Qualcomm" across various config
options
- ChromeOS EC: Delay `dev_set_drvdata()` until the probe process has successfully
completed to avoid use-after-free issues
- ChromeOS EC: Prevent adding `cros_ec_ucsi` as an MFD sub-device if it is already
defined in Device Tree or ACPI
- Cirrus Logic CS42L43: Add a sanity check for firmware size to prevent out-of-bounds
memory access during firmware loading
- Cirrus Logic CS5535: Associate the GPIO cell with a dedicated software node to
support board files requesting GPIOs
- Maxim MAX77620: Modernize poweroff handling by converting to the sys-off API
- Qualcomm RPM: Add the missing QDSS clock resource for the MSM8960 SoC
- Renesas RSMU: Fix page register setup for the 8A3400x family by correctly
calculating the page address
- Renesas RZ/MTU3: Make the reset line optional to support newer SoC variants (RZ/T2H,
RZ/N2H)
- Renesas RZ/MTU3: Modernize the driver by using device-managed APIs for reset control
and device addition
- Samsung Core: Set the coherent DMA mask to zero for the Samsung PMIC device to
suppress unnecessary "DMA mask not set" messages
- Silicon Motion SM501: Fix a reference leak on failed device registration by properly
dropping the platform device reference
- Texas Instruments TPS65219: Make poweroff handler registration conditional on the
"system-power-controller" Device Tree property
- Texas Instruments TPS6586x: Fix Device Tree node reference counting by manually
bumping the refcount for sub-devices
- Texas Instruments TPS65910: Add return value checking for the dummy I2C transfer
used to work around silicon erratum SWCZ010
- Texas Instruments TWL4030: Update board-specific checks to use Device Tree
compatibles instead of legacy machine IDs
- Cleanups & Refactoring
- Core: Consistently define `pci_device_id` arrays using named initializers across
various Intel and Silicon Motion drivers
- Maintainers: Shift maintenance of Samsung PMIC drivers to André Draszik
- Maxim MAX77759: Improve code style by reformatting the IRQ table and refining macro
comments
- MEN MENF21BMC / Texas Instruments TWL: Correctly treat `i2c_check_functionality()`
as returning a boolean status
- Rohm BD72720: Drop the non-existent BUCK11 ID to improve code clarity
- Silicon Labs Si476x: Fix various spelling mistakes in driver comments
- Spreadtrum SC27xx: Transition to `devm_mfd_add_devices()` and separate MFD cell
tables for each PMIC model
- Timberdale: Move GPIO pin definitions into the driver and transition to using a
software node for the GPIO cell
- Wolfson WM8994: Remove dead legacy-GPIO code and its associated `irq_gpio` member
- Device Tree Binding Updates
- Aspeed AST2x00: Document the AST2700 SCU0 and add support for its SoC0/SoC1 pin
controllers
- Hisilicon Hi655x: Convert the Hi655x PMIC binding from text format to YAML DT schema
- Khadas MCU: Add a new compatible and fan-supply property for the Khadas VIM4 MCU
- MediaTek MT6397: Add support for the MT6365 PMIC and document regulator supplies for
the MT6359 variant
- Qualcomm TCSR: Add compatibles for Nord and IPQ5210 TCSR blocks
- Renesas RZ/G3L: Revert the addition of the `renesas,r9a08g046-lvds-cmn` compatible
string due to documentation errors
- Samsung S2MU005: Document the S2MU005 PMIC and its sub-devices (charger, MUIC,
flash and RGB LEDs)
- Spreadtrum SC2731: Include regulator bindings for the SC2730 variant
- STMPE: Fix the schema by marking 'compatible' and '#pwm-cells' as required for the
PWM subnode
- Texas Instruments BQ257xx: Expand the BQ25703A binding to include the BQ25792
variant
- Removals
- Motorola EZX PCAP: Remove the unused and non-functional driver for Motorola EZX
phones
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEdrbJNaO+IJqU8IdIUa+KL4f8d2EFAmoylaAACgkQUa+KL4f8
d2HKlw/+LNN6+pdOuvpFd/I+SnMyYnpFH/DMCHBDu7KnOWtn1AVsCAhKy7jz2cmz
8NCtKvPaYcJWvsV+zYw+VPWilgUJ0lU3mRDJ4b8KIRjMv37JYA9xhFrz3pr/MS/Z
z//gGHbWzzKsH9E8BEpbxHOx4kwqI1RiTBS2yV8OuooHpqfp8kg9E5lKW+roP4YQ
VcWkHduywOOkT+PKUjKySFx8qJ7ySskx6RFEVH8Nywu6AmSuNiKOeGtDkKKIGGFe
YL2L19m/In0p0z4aqwqJWpj5sZQ3CSOAMT82k25/ApR7+Aot8lsbWuANbySfr5l/
Yv695XrN01qaXrEmCkk7cpKpzW18QFxVEnfdpCJrZcG1OkfwvfHCcGbZC8ihD/xN
fGkaOP7f9Jx3uoQQX+j1dgU3GJyMPAABxPdrzU2o59mE6UFGUZobepFGWBqYSPCJ
b7P530qhnt8qp0iXKDwpnzt1LhxiAIo0PnZJ2DFDRiZXzl/IOOK0ywgBENu1cebn
gkL3xpA4TMASeHcE8dPCNdYeI6PqRjV0LO80HWG2vGk9nmolW8BnuvtGp4kHroxh
Y37yg9BR67JbTrUfTwFU/U9utqkiY3cTZ8skElff/rsKdysKGBcGXdeCh4dTEQXo
3XNGKb1RRUgiCixjPqQkf+iLWZalr+QY8Z40OmqcDncXQe8t3+o=
=9Igx
-----END PGP SIGNATURE-----
Merge tag 'mfd-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd
Pull MFD updates from Lee Jones:
"New Support & Features:
- Renesas RSMU: Add support for the IDT 8a34002 Clock Matrix
- Samsung S2MU005: Add support for the Samsung S2MU005 PMIC which
includes charger, MUIC, flash and RGB LED controllers
- SpacemiT P1: Add a reboot cell for the SpacemiT P1 chip
- Texas Instruments BQ25792: Add support for the TI BQ25792 charger
manager
Improvements & Fixes:
- Core: Unify the user-visible company name to "Qualcomm" across
various config options
- ChromeOS EC:
- Delay `dev_set_drvdata()` until the probe process has
successfully completed to avoid use-after-free issues
- Prevent adding `cros_ec_ucsi` as an MFD sub-device if it is
already defined in Device Tree or ACPI
- Cirrus Logic CS42L43: Add a sanity check for firmware size to
prevent out-of-bounds memory access during firmware loading
- Cirrus Logic CS5535: Associate the GPIO cell with a dedicated
software node to support board files requesting GPIOs
- Maxim MAX77620: Modernize poweroff handling by converting to the
sys-off API
- Qualcomm RPM: Add the missing QDSS clock resource for the MSM8960
SoC
- Renesas RSMU: Fix page register setup for the 8A3400x family by
correctly calculating the page address
- Renesas RZ/MTU3:
- Make the reset line optional to support newer SoC variants
(RZ/T2H, RZ/N2H)
- Modernize the driver by using device-managed APIs for reset
control and device addition
- Samsung Core: Set the coherent DMA mask to zero for the Samsung
PMIC device to suppress unnecessary "DMA mask not set" messages
- Silicon Motion SM501: Fix a reference leak on failed device
registration by properly dropping the platform device reference
- Texas Instruments:
- TPS65219: Make poweroff handler registration conditional on the
"system-power-controller" Device Tree property
- TPS6586x: Fix Device Tree node reference counting by manually
bumping the refcount for sub-devices
- TPS65910: Add return value checking for the dummy I2C transfer
used to work around silicon erratum SWCZ010
- TWL4030: Update board-specific checks to use Device Tree
compatibles instead of legacy machine IDs
Cleanups & Refactoring:
- Core: Consistently define `pci_device_id` arrays using named
initializers across various Intel and Silicon Motion drivers
- Maintainers: Shift maintenance of Samsung PMIC drivers to André
Draszik
- Maxim MAX77759: Improve code style by reformatting the IRQ table
and refining macro comments
- MEN MENF21BMC / Texas Instruments TWL: Correctly treat
`i2c_check_functionality()` as returning a boolean status
- Rohm BD72720: Drop the non-existent BUCK11 ID to improve code
clarity
- Silicon Labs Si476x: Fix various spelling mistakes in driver
comments
- Spreadtrum SC27xx: Transition to `devm_mfd_add_devices()` and
separate MFD cell tables for each PMIC model
- Timberdale: Move GPIO pin definitions into the driver and
transition to using a software node for the GPIO cell
- Wolfson WM8994: Remove dead legacy-GPIO code and its associated
`irq_gpio` member
Device Tree Binding Updates:
- Aspeed AST2x00: Document the AST2700 SCU0 and add support for its
SoC0/SoC1 pin controllers
- Hisilicon Hi655x: Convert the Hi655x PMIC binding from text format
to YAML DT schema
- Khadas MCU: Add a new compatible and fan-supply property for the
Khadas VIM4 MCU
- MediaTek MT6397: Add support for the MT6365 PMIC and document
regulator supplies for the MT6359 variant
- Qualcomm TCSR: Add compatibles for Nord and IPQ5210 TCSR blocks
- Renesas RZ/G3L: Revert the addition of the
`renesas,r9a08g046-lvds-cmn` compatible string due to documentation
errors
- Samsung S2MU005: Document the S2MU005 PMIC and its sub-devices
(charger, MUIC, flash and RGB LEDs)
- Spreadtrum SC2731: Include regulator bindings for the SC2730
variant
- STMPE: Fix the schema by marking 'compatible' and '#pwm-cells' as
required for the PWM subnode
- Texas Instruments BQ257xx: Expand the BQ25703A binding to include
the BQ25792 variant
Removals:
- Motorola EZX PCAP: Remove the unused and non-functional driver for
Motorola EZX phones"
* tag 'mfd-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (47 commits)
dt-bindings: mfd: syscon: Revert renesas,r9a08g046-lvds-cmn
dt-bindings: mfd: st,stmpe: Add missing properties for PWM subnode
mfd: rz-mtu3: Make reset optional
mfd: rz-mtu3: Store &pdev->dev in local variable
mfd: rz-mtu3: Use local variable for reset
mfd: rz-mtu3: Use device-managed APIs
dt-bindings: mfd: aspeed,ast2x00-scu: Support AST2700 SoC1 pinctrl
mfd: tps6586x: Fix OF node refcount
dt-bindings: mfd: sprd,sc2731: Include SC2730 regulator bindings
mfd: twl4030-power: Update checks for specific boards to use the DT
dt-bindings: mfd: qcom,tcsr: Document the IPQ5210 TCSR block
mfd: qcom_rpm: Add msm8960 QDSS clock resource
mfd: si476x-i2c: Fix spelling mistakes in comments
mfd: max77620: Convert poweroff support to sys-off API
mfd: dt-bindings: mt6397: Add regulator supplies
dt-bindings: mfd: mediatek: mt6397: Add MT6365 PMIC support
dt-bindings: mfd: mediatek: mt6397: Add rtc for MT6359
mfd: cs42l43: Sanity check firmware size
mfd: qcom: Unify user-visible "Qualcomm" name
mfd: cros_ec: Delay dev_set_drvdata() until probe success
...
|
||
|
Linus Torvalds
|
b7556c8e71 |
hid-for-linus-2026061601
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEL65usyKPHcrRDEicpmLzj2vtYEkFAmoxq94ACgkQpmLzj2vt
YElr1A//RPXn3om4Sm5QeIcbIFHrdVx6Un8QcXVaNSqL8XUB7yMCbsH+zD7NmWSP
U4wX9bDZ0F8/1gkQh80HuGDEEErSmzAQk8+iE3mhUTXmLmyPn7bgHClMXVmKD1UO
74f6+57RV7Y0Uo/cgna9hLr3kuSCR5+y81f9esWoXSz8j6BNzml6KyCNcNbbnYlk
RmS6c5MJ15KxnY593HKr04jWqC1zs++pdcAOmZF3gnwTf7X+Pl3hgP53jCQeAJqH
AGbXc8N09Nc+JBEJ9zUIgwpU0DwnJRe+/LptIWNGebpSW2/jqfXWabrHjpaXekuX
6hf+/bnkeoIKDQGIAXSFuqEBsP0WofEbAvCix0+QVEz3MBDtsR6/3h3q+/hbNEgJ
KrAO7rEHTEEOKPvYiIwQ6cMPAlNRF178k4Havy2EZaaT8w0v9/eovYRIR1J2H/34
0D7pRb+pyxV0vzuHosa7EKRTTga+8LOwWxLB5lJnG5UhSBUYghihGM6T8pCjBCw5
BuhcVPpGRT6kreOAIR82sUxfOZHcq6g8rj64iHofPNiPlAr/qkehhHGJ2sBLzeMm
CPSmYrI0hwULldRunR9/JBMBC44fzfhoRhcQZE1QaJbRu7KYPMWhRPRR8nNR6oEc
xDnbllexgSya9yAjKZ8mJKb4ywIFUrqpC0xacQmJbZmaXkTX8mI=
=O/MI
-----END PGP SIGNATURE-----
Merge tag 'hid-for-linus-2026061601' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid
Pull HID updates from Jiri Kosina:
"Core:
- semantic cleanup fixes for 'hid_device_id::driver_data' (Pawel
Zalewski)
Multitouch:
- UX improvement fixes for Yoga Book 9 (Dave Carey)
Logitech:
- fix for high resolution scrolling for Logitech HID++ 2.0 devices
(Lauri Saurus)
CP2112:
- fix for cp2112 firmware-based speed configuration, if available
(Danny Kaehn)
Wacom:
- memory corruption and scheduling while atomic and error fixes and
error handling fixes (Jinmo Yang, Myeonghun Pak)
New device support:
- OneXPlayer (Derek J. Clark)
- HORI Wireless Switch Pad (Hector Zelaya)
- Rakk Dasig X (Karl Cayme)
And other assorted small fixes and device ID additions"
* tag 'hid-for-linus-2026061601' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (39 commits)
HID: hidpp: fix potential UAF in hidpp_connect_event()
HID: logitech-hidpp: sync wheel multiplier on wheel mode changes
HID: intel-thc-hid: intel-quickspi: reset touch IC on system resume
HID: uhid: convert to hid_safe_input_report()
HID: hid-goodix-spi: validate report size to prevent stack buffer overflow
HID: nintendo: add support for HORI Wireless Switch Pad
HID: multitouch: Honor ContactCount for Yoga Book 9 to suppress ghost contacts
HID: pidff: Use correct effect type in effect update
HID: wacom: stop hardware after post-start probe failures
HID: core: demote warning to debug level
HID: lenovo: Use KEY_PERFORMANCE capability for ThinkPad X12 Tab Gen 2
HID: lenovo: Add support for ThinkPad X13 Folio keyboard
HID: cp2112: Configure I2C bus speed from firmware
HID: cp2112: Add fwnode support
HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove()
HID: Input: Add battery list cleanup with devm action
HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter
HID: wacom: use cleanup.h for wacom_wac_queue_flush() buffer management
HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()
HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert
...
|
||
Pengpeng Hou
|
645323a7f4 |
kconfig: add optional warnings for changed input values
When reading .config input, Kconfig stores user-provided values first and then resolves the final value after applying dependencies, ranges, and other constraints. If the final value differs from the user input, Kconfig already tracks that state internally, but it does not provide a focused diagnostic to show which explicit inputs were adjusted. This is particularly confusing for requested values that get forced down by unmet dependencies or clamped by ranges. Add an opt-in diagnostic controlled by KCONFIG_WARN_CHANGED_INPUT. Emit the warnings from conf_write() and conf_write_defconfig() after value resolution. Print the diagnostic to stderr directly, not through the normal message callback, so it remains visible when conf is run with -s, such as from make -s. Keep the diagnostic out of the conf_message() formatting buffer so long warning lists are not truncated, and mark processed symbols as written before the SYMBOL_WRITE check so duplicate menu nodes cannot emit duplicate warnings. Document the new environment variable and add tests for olddefconfig, savedefconfig, and the silent-conf path. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Tested-by: Julian Braha <julianbraha@gmail.com> Link: https://patch.msgid.link/20260611060000.23858-1-pengpeng@iscas.ac.cn Signed-off-by: Nathan Chancellor <nathan@kernel.org> |
||
Rong Xu
|
9a289cc425 |
modpost: Ignore Clang LTO suffixes in symbol matching
When building the kernel with Clang ThinLTO enabled, the compiler can mangle static variable names by appending suffixes such as ".llvm.<hash>" to prevent naming collisions across translation units. This name mangling breaks the section mismatch whitelisting in modpost. modpost relies on glob patterns (e.g., "*_ops" or "*_probe") to identify safe references between permanent data and initialization code. Because the LTO suffix modifies the end of the symbol name, legitimately whitelisted structures fail the match, resulting in false positive warnings. For example, a static pernet_operations struct triggers the following: WARNING: modpost: vmlinux: section mismatch in reference: \ ping_v4_net_ops.llvm.5641696707737373282 (section: .data) -> \ ping_v4_proc_init_net (section: .init.text) Fix this by ignoring "*_ops.llvm.*" in "from" symbol names (the same as "*_ops"). Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202606111233.kM8oo8Df-lkp@intel.com/ Signed-off-by: Rong Xu <xur@google.com> Link: https://patch.msgid.link/20260617224623.1346309-1-xur@google.com Signed-off-by: Nathan Chancellor <nathan@kernel.org> |
||
Quang Nguyen
|
7b25dbafa2 |
spi: rpc-if: Use correct device for hardware reinitialization on resume
rpcif_spi_resume() currently passes the SPI controller device to
rpcif_hw_init(), but the function should be called with the RPC
interface device.
Retrieve the rpcif private data from the SPI controller and pass
rpc->dev instead. Also propagate the return value of rpcif_hw_init() so
that a failure during resume is properly reported rather than silently
ignored.
Fixes:
|
||
Ratheesh Kannoth
|
fda8749ba7 |
PCI: host-common: Request bus reassignment when not probe-only
pci_host_common_init() is used by several generic ECAM host drivers.
After PCI core changes around pci_flags and preserve_config, these hosts
no longer opted into full bus number reassignment the way they did
before, which broke enumeration of devices on a Marvell CN106XX board.
When PCI_PROBE_ONLY is not set, add PCI_REASSIGN_ALL_BUS so
pci_scan_bridge_extend() takes the reassignment path: bus numbers can be
assigned from firmware EA data (e.g. pci_ea_fixed_busnrs()). Skip the
flag in probe-only mode so existing assignments are not overridden.
Fixes:
|
||
Hans Zhang
|
0bd9611587 |
PCI: rockchip: Protect root bus removal with rescan lock
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead to use-after-free issues or system crashes. Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20260521161822.132996-8-18255117159@163.com |
||
|
Hans Zhang
|
4e4f9745f0 |
PCI: plda: Protect root bus removal with rescan lock
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead to use-after-free issues or system crashes. Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20260521161822.132996-10-18255117159@163.com |
||
|
Hans Zhang
|
a29812a55d |
PCI: mediatek: Protect root bus removal with rescan lock
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead to use-after-free issues or system crashes. Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20260521161822.132996-7-18255117159@163.com |
||
|
Hans Zhang
|
a6a64e150f |
PCI: iproc: Protect root bus removal with rescan lock
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead to use-after-free issues or system crashes. Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20260521161822.132996-6-18255117159@163.com |
||
|
Hans Zhang
|
2633569649 |
PCI: dwc: Protect root bus removal with rescan lock
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead to use-after-free issues or system crashes. Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20260521161822.132996-3-18255117159@163.com |
||
|
Hans Zhang
|
713331969c |
PCI: cadence: Protect root bus removal with rescan lock
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead to use-after-free issues or system crashes. Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20260521161822.132996-2-18255117159@163.com |
||
|
Hans Zhang
|
20b7aba83c |
PCI: brcmstb: Protect root bus removal with rescan lock
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead to use-after-free issues or system crashes. Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20260521161822.132996-5-18255117159@163.com |
||
|
Hans Zhang
|
a8759c8ac4 |
PCI: altera: Protect root bus removal with rescan lock
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead to use-after-free issues or system crashes. Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20260521161822.132996-4-18255117159@163.com |
||
|
Linus Torvalds
|
83f1454877 |
Various ext4 updates for 7.2-rc1:
* A major rework of the fast commit mechanism to avoid lock
contention and deadlocks. We also export snapshot statistics
in /proc/fs/ext4/*/fc_info.
* Performance optimization for directory hash computation by
processing input in 4-byte chunks and removing function pointers,
along with new KUnit tests for directory hash.
* Cleanups in JBD2 to remove special slabs and use kmalloc() instead.
* Various bug fixes, including:
- Early validation of donor superblock in EXT4_IOC_MOVE_EXT to avoid
cross-fs deadlock
- Fix for a kernel BUG in ext4_write_inline_data_end under
data=journal
- Fix for a NULL dereference in jbd2_journal_dirty_metadata when
handle is aborted
- Fix for an underflow in JBD2 fast commit block initialization check
- Fix for LOGFLUSH shutdown ordering to ensure ordered data writeback
- Miscellaneous fixes for error path return values and KUnit assertions.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCAAdFiEEK2m5VNv+CHkogTfJ8vlZVpUNgaMFAmoz6iIACgkQ8vlZVpUN
gaMSQwf+ICmzStB4tjmfWTbLo7/LXZVsuWYCcutQm1ToioZep+5javE4R5J+lW7H
h8g7dnkIfg5RSx6VtdAwff0RqB1kprvyoUD2Qkx3DOqzGqGPHyhgczggq/HOLGDv
Rylnv/jpK0UCyK5ilmsBDYeLvFHqXlR5bWfeJmXlVQZyFJiMkYao0uCGRJwZ7A/b
ErMPi/v6jK8Ofv+sQlHmA3wwsnoSSlmZOzfj6Rh5TvComaGg4Mtb0rj6Sh7U1k5L
7YY/OgQBlY6pocxagqY8HLs2NJbKeTFoAH557UdUIEHoWm4RWTLqahou7yyNmyIb
By8582Bjy7hs8sbavEh/3qx87qTMCw==
=AP6z
-----END PGP SIGNATURE-----
Merge tag 'ext4_for_linus-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4
Pull ext4 updates from Ted Ts'o:
- A major rework of the fast commit mechanism to avoid lock contention
and deadlocks. We also export snapshot statistics in
/proc/fs/ext4/*/fc_info
- Performance optimization for directory hash computation by processing
input in 4-byte chunks and removing function pointers, along with new
KUnit tests for directory hash
- Cleanups in JBD2 to remove special slabs and use kmalloc() instead
- Various bug fixes, including:
- Early validation of donor superblock in EXT4_IOC_MOVE_EXT to
avoid cross-fs deadlock
- Fix for a kernel BUG in ext4_write_inline_data_end under
data=journal
- Fix for a NULL dereference in jbd2_journal_dirty_metadata when
handle is aborted
- Fix for an underflow in JBD2 fast commit block initialization
check
- Fix for LOGFLUSH shutdown ordering to ensure ordered data
writeback
- Miscellaneous fixes for error path return values and KUnit
assertions
* tag 'ext4_for_linus-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT
ext4: fix kernel BUG in ext4_write_inline_data_end
ext4: fix ERR_PTR(0) in ext4_mkdir()
jbd2: remove special jbd2 slabs
ext4: remove mention of PageWriteback
ext4: improve str2hashbuf by processing 4-byte chunks and removing function pointers
ext4: add Kunit coverage for directory hash computation
ext4: fast commit: export snapshot stats in fc_info
ext4: fast commit: add lock_updates tracepoint
ext4: fast commit: avoid i_data_sem by dropping ext4_map_blocks() in snapshots
ext4: fast commit: avoid self-deadlock in inode snapshotting
ext4: fast commit: avoid waiting for FC_COMMITTING
ext4: lockdep: handle i_data_sem subclassing for special inodes
ext4: fast commit: snapshot inode state before writing log
jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit()
ext4: fix fast commit wait/wake bit mapping on 64-bit
jbd2: check for aborted handle in jbd2_journal_dirty_metadata()
ext4: Use %pe to print PTR_ERR()
ext4: fix LOGFLUSH shutdown ordering to allow ordered-mode data writeback
ext4: replace KUnit tests for memcmp() with KUNIT_ASSERT_MEMEQ()
|
||
|
Linus Torvalds
|
dac3b26eae |
31 ksmbd fixes
-----BEGIN PGP SIGNATURE----- iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmox4zkACgkQiiy9cAdy T1GiPAwAkMFnKHWoZ1+th9QyMb3ac3ClmhwHLvsEJJo+Q6281u+y9/fiFll9oq+G hxpxkFRlt0F0WS4X4bo72RjOj9msB1gXADcNAIPTE+ukm3Psi8gKlXqUSlRs5Dd3 Hc7O87UQOstyAtVZyBRlFvCIsOIkijQYdV6dONljKvuWPGGO+ICM/V9Qsqnrd3nM g11O3dZSfwZUANGYMumq1DuZ25FyV1ffbuFKmzIVvZI5/Qip4X/vND0zixOjiE2o W1fbNxZsNXdNDD5vSI26200b36lv0sqpecy7w/W4N5/vOkf5TUkkNVdHxcLKkP8/ Z0wBaF+Gcsb/c/WWEpF4eOB087W2lmmiunTOOwS94/kgABmhMedoKK52wZnvNYFG JjOoXv+KPKbLdlVAj1PlioxBeu7i/aV37FwJ+7m/ynSpDk2bk6GEz2wHAqyPyid4 y4KHc4dN+/nWLLB071tGqbPheecPxL7SwrtppW2rWEemZNqi4Y3vXIfx3pBrhE7W peFaxuDu =cmJl -----END PGP SIGNATURE----- Merge tag 'v7.2-rc-part1-ksmbd-fixes' of git://git.samba.org/ksmbd Pull smb server updates from Steve French: - Use after free fixes - Out of bounds read fix - Add SMB compression support both at rest and over the wire: support decompression of compressed SMB2 requests, initially allow compressed SMB2 READ responses, and implement get/set compression operations for per-file compression state. - Credentials fixes: for various FSCTLs, setinfo, delete on close and for alternate data streams - Fix access checks and permission checks in DUPLICAT_EXTENTS and SET_ZERO_DATA fsctls, find_file_posix_info, FILE_LINK_INFORMATION and smb2_set_info_sec - Reject non valid session in compound request - Serialize QUERY_DIRECTORY - Prevent path traversal bypass by restricting caseless retry - Path lookup fix - Two minor cleanup fixes * tag 'v7.2-rc-part1-ksmbd-fixes' of git://git.samba.org/ksmbd: (31 commits) ksmbd: fix path resolution in ksmbd_vfs_kern_path_create ksmbd: use opener credentials for FSCTL mutations ksmbd: use opener credentials for ADS I/O ksmbd: require source read access for duplicate extents ksmbd: run set info with opener credentials ksmbd: use opener credentials for delete-on-close ksmbd: serialize QUERY_DIRECTORY requests per file ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE ksmbd: enforce FILE_READ_ATTRIBUTES on SMB_FIND_FILE_POSIX_INFORMATION ksmbd: reject non-VALID session in compound request branch ksmbd: compress SMB2 READ responses ksmbd: negotiate and decode SMB2 compression cifs: negotiate chained SMB2 compression capabilities smb: add common SMB2 compression transform helpers smb: move LZ77 compression into common code ksmbd: add per-handle permission check to FILE_LINK_INFORMATION ksmbd: add a permission check for FSCTL_SET_ZERO_DATA ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL smb: server: remove code guarded by nonexistent config option ... |
||
|
Linus Torvalds
|
e753a63f2a |
14 smb3 client fixes
-----BEGIN PGP SIGNATURE----- iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmozDFkACgkQiiy9cAdy T1GXbAv+L1Uy4GflN9jfdC92lOugZ0IHUxSXoaEOIFNda47IBxPmtegpJ3/oUrQi E4ymHHXQXiEDQTA1MTXh23OPhiF4GXedMYoxqRI8f0edYe6KEXp2xTMMpojGSq3S P6Bnle07Afi33njUjH3X0Nv9Sdpuz3f36828B3hxojhwb46axveSGAQtO/iy6VWg CLEcCZeBF1s/mAplwawgY8lGPtPmChqoM7Diy0dtVKFZcHR8mjX258t05d6sYvys LBXLFbkmZL/n8PJhkU+/ZZST+1CZwaA1Ar77oMAFx7g5jtNJwdMC0Wm8I/57HDS+ h3Neb/TH5SLlMQkPlBcYz+o9TDkFS6m7Ch1w7stANP27Z8IiX1eVZJ67WQ0rMMtr sizGSqxRVJ2QrfV+8xHOF8mD8gGZpHAcjIJcMOW8oCxayis5PBdlDFaL6CGJjZNJ nzrsVdtVNLvkGDtkEIUzn0APUWpjN4HSMEnIqEi5DwF7j1QWimCR6q73C63d2DMq 5Yovh4Qd =QP62 -----END PGP SIGNATURE----- Merge tag 'v7.2-rc-part1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client updates from Steve French: - Three cleanup patches - Fix error return value in smb2_aead_req_alloc - Three compression fixes - Update i_blocks after write (fixes various xfstests) - Fix races in cifsd thread creation - Fix potential out of bounds read parsing security descriptors - Witness protocol fix - Fix umount bug - Mount fix - Fix cached directory entries on unlink/rmdir/rename * tag 'v7.2-rc-part1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb: client: Use more common code in SMB2_tcon() smb: client: Use more common error handling code in smb3_reconfigure() smb/client: Fix error code in smb2_aead_req_alloc() smb/client: clean up a type issue in cifs_xattr_get() smb/client: allow FS_IOC_SETFLAGS to clear compression smb/client: use writable handle for FS_IOC_SETFLAGS compression smb/client: always return a value for FS_IOC_GETFLAGS smb/client: update i_blocks after contiguous writes smb: client: fix races in cifsd thread creation cifs: validate full SID length in security descriptors smb: client: resolve SWN tcon from live registrations cifs: remove all cifs files before kill super smb: client: fix conflicting option validation for new mount API cifs: invalidate cfid on unlink/rename/rmdir |
||
|
Linus Torvalds
|
3dc7c00116 |
NFSD 7.2 Release Notes
Jeff Layton wired up netlink upcalls for the auth.unix.ip and auth.unix.gid caches in SunRPC and the svc_export and nfsd.fh caches in NFSD. The new kernel-user API is more extensible and lays the groundwork for retiring the old pipe interface. The default NFS r/w block size rises to 4MB on hosts with at least 16GB of RAM, reducing per-RPC overhead on fast networks. Smaller machines keep their previously computed default, and the value remains tunable through /proc/fs/nfsd/max_block_size. Chuck Lever converted the server's RPCSEC GSS Kerberos code to the kernel's shared crypto/krb5 library. The conversion retires and removes SunRPC's bespoke implementation of Kerberos v5, but keeps RPCSEC GSS-API. Continuing the xdrgen migration that converted the NLMv4 server XDR layer in v7.1, Chuck Lever converted the NLM version 3 server-side XDR layer from hand-written C to xdrgen-generated code. As with the NLMv4 conversion in v7.1, the goals are improved memory safety, lower maintenance burden, and groundwork for generation of Rust code for this layer instead of C. Chuck Lever fixed an issue where lingering NFSv4 state pins a mounted file system after it is unexported. A new netlink-based mechanism can now release NLM locks and NFSv4 state by client address, by filesystem, and by export. Now an administrator can quiesce an export cleanly before unmounting it. The remaining patches are bug fixes, clean-ups, and minor optimizations, including a batch of memory-leak and use-after-free fixes in the ACL, lockd, and TLS handshake paths, many of them reported by Chris Mason. Sincere thanks to all contributors, reviewers, testers, and bug reporters who participated in the v7.2 NFSD development cycle. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEKLLlsBKG3yQ88j7+M2qzM29mf5cFAmox5BcACgkQM2qzM29m f5eFJQ//QlyZCt0BlzeBrGHJB41yrMZkZGSJsPaZPfvNnjIQPwd6WH3d6i1vygvC HgC+KTF/8LLuFx14m17M6FBCujixNoknMLyp74vRPZOSCoXilP/jzlDoVWwgwv73 E0AkKXyij1QFToIh7NP/ClX+Zpc9yoCR3/RWri7ud400z1mlvFBk8NA7E6pb+AzT 89lKFgkubSQVnHFRdIAgb3G/AkZzt35O6hzPA6thtwkb8MS2knE27L9HNc2InQ/K 71QjQj09052tcXOJRHlg7Xj6AeCyPteCqxsA03qMo2mmqRiSBVV+5y6czawxdHk8 yt9cDloUu+ZynhH4qktv3i8lX7dPcYNfIcMora71LAswDE5Ud3c/EG6zleA5DnzX cgUaS8VkbfLyHAlvPRl9DroizsBgrr/qjuwUqewoY/wJCpyEBtCGRxLKI0MS2Ivo BvgdXE74uCyOGZ2EYOqaocGejMtXt1GGpf2Wj5/jyDDUABEhwTptoTIlbBcWQbf6 7ZRlxjwx7kaMMtmag0ZEhkh42ujoHF3NzNDDD4hY1M6twgF+0uofJPLb5eK4JZak FDKV38iiwqq2/bWOKGnaFQBV1Hn/0569rxFku2Z0O+wWNBXhiZ5wezw84GoYaCt/ AYSDFYnI4FOrHurdmgZUyr04W2toXWN6mV3IqbDIIx5eXyWEKvU= =xAeq -----END PGP SIGNATURE----- Merge tag 'nfsd-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd updates from Chuck Lever: "Jeff Layton wired up netlink upcalls for the auth.unix.ip and auth.unix.gid caches in SunRPC and the svc_export and nfsd.fh caches in NFSD. The new kernel-user API is more extensible and lays the groundwork for retiring the old pipe interface. The default NFS r/w block size rises to 4MB on hosts with at least 16GB of RAM, reducing per-RPC overhead on fast networks. Smaller machines keep their previously computed default, and the value remains tunable through /proc/fs/nfsd/max_block_size. Chuck Lever converted the server's RPCSEC GSS Kerberos code to the kernel's shared crypto/krb5 library. The conversion retires and removes SunRPC's bespoke implementation of Kerberos v5, but keeps RPCSEC GSS-API. Continuing the xdrgen migration that converted the NLMv4 server XDR layer in v7.1, Chuck Lever converted the NLM version 3 server-side XDR layer from hand-written C to xdrgen-generated code. As with the NLMv4 conversion in v7.1, the goals are improved memory safety, lower maintenance burden, and groundwork for generation of Rust code for this layer instead of C. Chuck Lever fixed an issue where lingering NFSv4 state pins a mounted file system after it is unexported. A new netlink-based mechanism can now release NLM locks and NFSv4 state by client address, by filesystem, and by export. Now an administrator can quiesce an export cleanly before unmounting it. The remaining patches are bug fixes, clean-ups, and minor optimizations, including a batch of memory-leak and use-after-free fixes in the ACL, lockd, and TLS handshake paths, many of them reported by Chris Mason. Sincere thanks to all contributors, reviewers, testers, and bug reporters who participated in the v7.2 NFSD development cycle" * tag 'nfsd-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: (106 commits) svcrdma: wake sq waiters when the transport closes nfsd: reset write verifier on deferred writeback errors nfsd: avoid leaking pre-allocated openowner on unconfirmed retry race sunrpc: wait for in-flight TLS handshake callback when cancel loses race sunrpc: pin svc_xprt across the asynchronous TLS handshake callback nfsd: fix posix_acl leak on SETACL decode failure nfsd: fix posix_acl leak and ignored error in nfsd4_create_file nfsd: check get_user() return when reading princhashlen nfsd: fix inverted cp_ttl check in async copy reaper nfsd: fix dead ACL conflict guard in nfsd4_create NFSD: Fix SECINFO_NO_NAME decode error cleanup sunrpc: harden rq_procinfo lifecycle to prevent double-free SUNRPC: Return an error from xdr_buf_to_bvec() on overflow SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing nfsd: release layout stid on setlease failure lockd: Avoid hashing uninitialized bytes in nlm4svc_lookup_file() lockd: Plug nlm_file refcount leak on cached nlm_do_fopen() failure lockd: Plug nlm_file leak when nlm_do_fopen() fails Revert "NFSD: Defer sub-object cleanup in export put callbacks" Revert "svcrdma: Use contiguous pages for RDMA Read sink buffers" ... |
||
|
Linus Torvalds
|
6edc20078a |
fuse update for 7.2
-----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQSQHSd0lITzzeNWNm3h3BK/laaZPAUCajE+HAAKCRDh3BK/laaZ POtqAQDLFg02uYFjQ2KTsgLi6fYvQw2w32d+MvNO4f//pO/dPQD9FfH66MSkOW25 TV/WLbQ9vzsfdPFfe8uXvm4EF01w9wU= =qUPT -----END PGP SIGNATURE----- Merge tag 'fuse-update-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse Pull fuse updates from Miklos Szeredi: - Fix lots of bugs, most from the late 6.x era, but some going back to 2.6.x - Add subsystems (io-uring, passthrough) and respective maintainers (Bernd, Joanne and Amir) - Separate transport and fs layers (Miklos) - Don't block on cat /dev/fuse (Joanne) - Perform some refactoring in fuse-uring (Joanne) - Don't use bounce-buffer for READDIR reply in virtio-fs (Matthew Ochs) - Clean up documentation (Randy) - Improve tracing (Amir) - Extend page cache invalidation after DIO (Cheng Ding) - Invalidate readdir cache on epoch change (Jun Wu) - Misc cleanups * tag 'fuse-update-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: (81 commits) fuse-uring: clear ent->fuse_req in commit_fetch error path fuse-uring: use named constants for io-uring iovec indices fuse-uring: refactor setting up copy state for payload copying fuse-uring: use enum types for header copying fuse-uring: refactor io-uring header copying from ring fuse-uring: refactor io-uring header copying to ring fuse-uring: separate next request fetching from sending logic fuse: invalidate readdir cache on epoch bump virtio-fs: avoid double-free on failed queue setup fuse: invalidate page cache after DIO and async DIO writes fuse: set ff->flock only on success fuse: clean up interrupt reading fuse: remove stray newline in fuse_dev_do_read() fuse: use READ_ONCE in fuse_chan_num_background() fuse: dax: Move long delayed work on system_dfl_long_wq fuse: add fuse_request_sent tracepoint fuse: Add SPDX ID lines to some files fuse: use QSTR() instead of QSTR_INIT() in fuse_get_dentry fuse: convert page array allocation to kcalloc() fuse: use current creds for backing files ... |
||
Markus Elfring
|
b59aff6276 |
ALSA: emu10k1: Use common error handling code in snd_emu10k1_playback_open()
Use an additional label so that a bit of exception handling can be better reused at the end of this function implementation. This issue was detected by using the Coccinelle software. Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Link: https://patch.msgid.link/d709474d-62b0-4f7e-9011-a0f716b35383@web.de Signed-off-by: Takashi Iwai <tiwai@suse.de> |
||
Jean-Louis Colaco
|
348f69320e |
ALSA: usb-audio: Add quirk for YAMAHA CDS3000
This quirk is identical to the one for the Yamaha Steinberg UR22, here applied to a CD player that also uses the Steinberg USB interface. This quirk is necessary to avoid sporadic "clic" noise when using the DAC of the player. Signed-off-by: Jean-Louis Colaco <jean-louis.colaco@orange.fr> Link: https://patch.msgid.link/20260618113202.8363-1-jean-louis.colaco@orange.fr Signed-off-by: Takashi Iwai <tiwai@suse.de> |
||
Mark Tomlinson
|
3c2e6cc6af |
PCI: iproc: Restore .map_irq() for the platform bus driver
Commit |
||
|
Linus Torvalds
|
9e7e663345 |
RDMA v7.2 merge window
Many AI driven bug fixes, and several big driver API cleanups
- Driver bug fixes and minor cleanups in mlx5, hns, rxe, efa, siw, rtrs,
mana, irdma, mlx4. Commonly error path flows, integer arithmetic
overflows on unsafe data, out of bounds access, and use after free
issues under races.
- Second half of the new udata API for drivers focusing on uAPI response
- bnxt_re supports more options for QP creation that will allow a dv
path in rdma-core
- Untangle the module dependencies so drivers don't link to ib_uverbs.ko
as was originall intended
- Provide a new way to handle umems with a consistent simplified uAPI and
update several drivers to use it. This brings dmabuf support to more
places and more drivers
- Support for mlx5 rate limit and packet pacing for UD and UC
- A batch of fixes for the new shared FRMR pools infrastructure
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRRRCHOFoQz/8F5bUaFwuHvBreFYQUCajLevAAKCRCFwuHvBreF
YVFuAP0X6gxaON+6cRGoaHp+KjxNj3zbuRj9VccTOy1OjerUdwD+LsbK/Pa9xrcO
ByA3LVvbw4BoQw9qcQpTu2klFuYV5g8=
=qnpN
-----END PGP SIGNATURE-----
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma
Pull rdma updates from Jason Gunthorpe:
"Many AI driven bug fixes, and several big driver API cleanups
- Driver bug fixes and minor cleanups in mlx5, hns, rxe, efa, siw,
rtrs, mana, irdma, mlx4. Commonly error path flows, integer
arithmetic overflows on unsafe data, out of bounds access, and use
after free issues under races.
- Second half of the new udata API for drivers focusing on uAPI
response
- bnxt_re supports more options for QP creation that will allow a dv
path in rdma-core
- Untangle the module dependencies so drivers don't link to
ib_uverbs.ko as was originall intended
- Provide a new way to handle umems with a consistent simplified uAPI
and update several drivers to use it. This brings dmabuf support to
more places and more drivers
- Support for mlx5 rate limit and packet pacing for UD and UC
- A batch of fixes for the new shared FRMR pools infrastructure"
* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (148 commits)
RDMA/irdma: Replace waitqueue and flag with completion
RDMA/hns: Fix memory leak of bonding resources
RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg
docs: infiniband: correct name of option to enable the ib_uverbs module
RDMA/bnxt_re: Reject GET_TOGGLE_MEM when toggle page was not allocated
RDMA/bnxt_re: Fail DBR related page allocation UAPIs if the feature is disabled
RDMA/bnxt_re: Avoid repeated requests to allocate WC pages
RDMA/bnxt_re: Proper rollback if the ioremap fails
RDMA/bnxt_re: Add a max slot check for SQ
RDMA/bnxt_re: Avoid displaying the kernel pointer
RDMA/bnxt_re: Free CQ toggle page after firmware teardown
RDMA/bnxt_re: Free SRQ toggle page after firmware teardown
RDMA/bnxt_re: Initialize dpi variable to zero
ABI: sysfs-class-infiniband: minor cleanup
RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one
RDMA/mlx5: Fix undefined shift of user RQ WQE size
RDMA/mlx5: Remove raw RSS QP restrack tracking
RDMA/mlx5: Remove DCT restrack tracking
RDMA/mlx5: Drop FRMR pool handle on UMR revoke failure
RDMA/core: Add ib_frmr_pool_drop for unrecoverable handles
...
|
||
Rosen Penev
|
7cb0335070 |
PCI: mvebu: Use fixed-width interrupt masks to avoid truncation in 64-bit builds
Use u32-typed BIT and GENMASK helpers for PCIe interrupt register
masks. This keeps inverted masks in the same width as the registers
and avoids truncation warnings on 64-bit compile-test builds.
Fixes below and similar warnings:
drivers/pci/controller/pci-mvebu.c:316:21: error: implicit conversion from 'unsigned long' to 'u32' (aka 'unsigned int') changes value from 18446744069414584320 to 0 [-Werror,-Wconstant-conversion]
mvebu_writel(port, ~PCIE_INT_ALL_MASK, PCIE_INT_UNMASK_OFF);
Assisted-by: Codex:GPT-5.5
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260526044016.1025613-1-rosenp@gmail.com
|
||
|
Linus Torvalds
|
00d07402df |
ata changes for 7.2-rc1
- Bump required Clang version to 23 (Marco)
NOTE: This commit was merged from an immutable branch from the tip
tree, and is carried both in the tip tree and the libata tree (with
the approval of tip maintainers) to avoid dependency problems.
- Add Clang context analysis annotations (Bart)
- Use the ahci_nr_ports() helper in libahci (me)
- Fail to probe the ahci driver if the BAR size is smaller than the
required size to support CAP.NP (Number of Ports) (liyouhong)
- Move EXPORT_SYMBOL_GPL(ahci_do_softreset) to be just below the
function definition (Bart)
- Make ata_scsi_scan_host() schedule hotplug work on the
system_dfl_long_wq workqueue so that it can benefit from scheduler
task placement (Marco)
- Make ata_scsi_port_error_handler() schedule hotplug work on the
system_dfl_long_wq workqueue, such that the work always uses the same
workqueue (me)
- Use devm_platform_get_and_ioremap_resource() in pata_arasan_cf driver
(Rosen)
- Fix ata_exec_internal() to only release and acquire the EH mutex if
the calling function is the one holding the EH mutex (Bart)
- Use hweight_long() to count the port_map bits (TanZheng)
- Add COMPILE_TEST support for pata_ep93xx driver (Rosen)
- Drop unused assignments from pata_isapnp driver (Uwe)
- Extend existing JMicron PMP quirk to include JMicron JMS562 (Xu)
- Drop unused assignments of pci_device_id driver data (Uwe)
- Use named initializers for pci_device_id arrays (Uwe)
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRN+ES/c4tHlMch3DzJZDGjmcZNcgUCajFdDAAKCRDJZDGjmcZN
cg83AP9gjkyIFg4o4ImG1jL46nQ9dHbk+/QQ3ahbn66Wf/UvwgD8CEee7lI3BiXg
pLzk9Hg982BMA5JAM4SZBJcQXCImmQ4=
=arvv
-----END PGP SIGNATURE-----
Merge tag 'ata-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux
Pull ata updates from Niklas Cassel:
- Bump required Clang version to 23 (Marco), and add Clang context
analysis annotations (Bart)
- Use the ahci_nr_ports() helper in libahci (me)
- Fail to probe the ahci driver if the BAR size is smaller than the
required size to support CAP.NP (Number of Ports) (liyouhong)
- Move EXPORT_SYMBOL_GPL(ahci_do_softreset) to be just below the
function definition (Bart)
- Make ata_scsi_scan_host() schedule hotplug work on the
system_dfl_long_wq workqueue so that it can benefit from scheduler
task placement (Marco)
- Make ata_scsi_port_error_handler() schedule hotplug work on the
system_dfl_long_wq workqueue, such that the work always uses the same
workqueue (me)
- Use devm_platform_get_and_ioremap_resource() in pata_arasan_cf driver
(Rosen)
- Fix ata_exec_internal() to only release and acquire the EH mutex if
the calling function is the one holding the EH mutex (Bart)
- Use hweight_long() to count the port_map bits (TanZheng)
- Add COMPILE_TEST support for pata_ep93xx driver (Rosen)
- Drop unused assignments from pata_isapnp driver (Uwe)
- Extend existing JMicron PMP quirk to include JMicron JMS562 (Xu)
- Drop unused assignments of pci_device_id driver data (Uwe)
- Use named initializers for pci_device_id arrays (Uwe)
* tag 'ata-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:
ata: Use named initializers for pci_device_id arrays
ata: Drop unused assignments of pci_device_id driver data
ata: libata-pmp: add JMicron JMS562 quirk
ata: pata_isapnp: Drop unused assignments from pnp_device_id array
ata: pata_ep93xx: add COMPILE_TEST support
ata: pata_ep93xx: use unsigned long for data
ata: pata_ep93xx: avoid asm on non ARM
ata: Annotate functions in the issuing path with __must_hold()
ata: libata: Pass ap parameter directly to functions in the issuing path
ata: libata: Document when host->eh_mutex should be held
ata: libata: Add an argument to ata_eh_reset()
ata: ahci: use hweight_long() to count port_map bits
ata: libata: Fix ata_exec_internal()
ata: pata_arasan_cf: simplify ioremap
ata: libata-eh: queue hotplug work on the system_dfl_long_wq workqueue
ata: libata-scsi: Move long delayed work on system_dfl_long_wq
ata: ahci: Move EXPORT_SYMBOL_GPL(ahci_do_softreset)
ata: ahci: fail probe if BAR too small for claimed ports
ata: libahci: use ahci_nr_ports() helper
|
||
|
Linus Torvalds
|
2f9f5887b4 |
for-7.2/io_uring-epoll-20260616
-----BEGIN PGP SIGNATURE----- iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmoxQDoQHGF4Ym9lQGtl cm5lbC5kawAKCRD301j7KXHgphm7EADQ7UmRhQGFQCbykRQ2joI0T4FGBgiRQaEa Rkpcob8xeqzkX16G00TzXeiM4K76QVaIHG6bDpXNwpHeL/2flsMLSpD0XuQONzAC g3OZQsaPyZqXwUZ+3mLKEgd830LgTeIC0iiVm6hnxNhTo29O1v1ueU/K0LgaE0AG 40q2NSpzxMbnFM/c3UVpepLsZ9XwGwE10xzZJTgnX5VhVxXwlNlT0scmEaHbfeJ3 hh9fn6KqW0LqnrK7Pq3UBKNxxoiVM5sruFDWPevXgw+LyEBykPiNR3+zzRoXFurx cIwavXR9tVnTFFdfSpZ/YWA11TuOlIyELxb50R3cN4ks8y7nVTNbv6vF7fVCJDIO iHylAsAHEvkLaCt8X4qZsZQwO/10ZeaUA4gNPnT15gs8jxvk5SWEQOX74tZHps4S eBPB9zyxfRXs6KZWRfONEHpYQnkfQH5/jIYGjycenWlyZ2jHqwZYcOWQcn9lqHzF UWWblfp8JfRegmp5i5vwJNUSRq3FUVDiifVSYkSrYpeVztIbSz8E36pes8GKVSZe gKKw1qgEcqio72dmprZFVAuG3YhAD6ebXAI5KWQ3XZcwJCKnaw16H4ObjBXrqOgH 69jzB4xlwvHlbyFnBQpYFdtfge0ziD0DbMVYT701TCUwsA7CItBEiOe5ZQ6N8u2/ QME4m1sg8A== =yyaO -----END PGP SIGNATURE----- Merge tag 'for-7.2/io_uring-epoll-20260616' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring epoll update from Jens Axboe: "As discussed a few months ago, this pull request gets rid of allowing nested epoll notification contexts via io_uring. Nested contexts have been a source of issues on the epoll side, and there should not be a need to support them from io_uring. The epoll io_uring side exists mainly to facilitate a gradual migration from a notification based epoll setup to an io_uring ditto" * tag 'for-7.2/io_uring-epoll-20260616' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/epoll: disallow adding an epoll file to an epoll context io_uring/epoll: switch to using do_epoll_ctl_file() interface |
||
Alvin Šipraga
|
e6fa716c9d |
ASoC: audio-graph-card2: Drop warning for manually selected DAI formats
Sometimes the DAI format must be specified in the audio-graph-card2 device tree, so emitting a warning can be misleading. Revert back to emitting no warning. A few examples where automatic format selection might not be applicable: - For DPCM, where the other side of the DAI link is not apparent, no proper selection can actually be made. This can lead to disagreeing formats. - Due to hardware peculiarities, some ostensibly supported formats might not work in practice. In either case, the only correct solution is for the sound card to set the format Link: https://lore.kernel.org/all/87ik7s36k2.wl-kuninori.morimoto.gx@renesas.com/ Signed-off-by: Alvin Šipraga <alvin.sipraga@analog.com> Acked-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/20260617145508.327213-1-alvin@pqrs.dk Signed-off-by: Mark Brown <broonie@kernel.org> |
||
Heiko Carstens
|
6938846872 |
s390/idle: Add missing EXPORT_SYMBOL_GPL()
Uwe Kleine-König reported this build breakage caused by a recent commit
which provides arch specific kcpustat_field_idle()/kcpustat_field_iowait()
functions:
ERROR: modpost: "arch_kcpustat_field_idle" [drivers/leds/trigger/ledtrig-activity.ko] undefined!
ERROR: modpost: "arch_kcpustat_field_iowait" [drivers/leds/trigger/ledtrig-activity.ko] undefined!
Fix this by adding the missing EXPORT_SYMBOL_GPL().
Fixes:
|
||
Michael Bommarito
|
3c7af07943 |
ALSA: usb-audio: qcom: clear opened when stream enable fails
On enable, subs->opened is set before the service_interval is validated;
an invalid interval jumps to the response label without clearing it, so
the substream is wedged at -EBUSY until a disable or disconnect.
Clear subs->opened on the enable error path.
Fixes:
|
||
|
Michael Bommarito
|
bdb640be82 |
ALSA: usb-audio: qcom: reject stream disable with no active interface
handle_uaudio_stream_req() resolves an interface index with
info_idx_from_ifnum(), which returns -EINVAL when no interface matches.
The enable branch and the response: cleanup label both guard against a
negative index, but the disable branch does not: it forms
info = &uadev[pcm_card_num].info[info_idx] and dereferences it.
uadev[].info is a pointer allocated only when a stream is first enabled,
so a negative info_idx on the disable path is unsafe in two ways:
- If the card was never enabled, .info is NULL and &info[-EINVAL] is a
wild pointer; reading info->data_ep_pipe faults (kernel oops).
- If the card was enabled at least once (.info allocated) and the
disable names an interface that does not match, &info[-EINVAL] points
before the allocation; info->data_ep_pipe / info->sync_ep_pipe are an
out-of-bounds slab read and, when non-zero, an out-of-bounds 4-byte
write (both pipe fields are cleared to 0). That is memory corruption,
not just a NULL dereference.
The request is reachable from unprivileged local userspace over
AF_QIPCRTR. Reject a disable request with no resolved interface, matching
the guard the enable path already has.
Fixes:
|