Commit graph

1,398,251 commits

Author SHA1 Message Date
Hans Verkuil
0b6cb34482 media: v4l2-core: v4l2-dv-timings: support DRM IFs
Add support for DRM (Dynamic Range and Mastering) InfoFrames.

Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
2025-09-07 10:29:19 +02:00
Miaoqian Lin
ff46e2e703 wifi: iwlwifi: Fix dentry reference leak in iwl_mld_add_link_debugfs
The debugfs_lookup() function increases the dentry reference count.
Add missing dput() call to release the reference when the "iwlmld"
directory already exists.

Fixes: d1e879ec60 ("wifi: iwlwifi: add iwlmld sub-driver")
Cc: stable@vger.kernel.org
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Link: https://patch.msgid.link/20250902040955.2362472-1-linmq006@gmail.com
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2025-09-07 09:41:35 +03:00
Gustavo A. R. Silva
0d2ab5f922 wifi: iwlwifi: mei: Remove unused flexible-array member in struct iwl_sap_hdr
Remove unused fexible-array member and avoid 14 of the following type of
warnings:

drivers/net/wireless/intel/iwlwifi/mei/sap.h:318:28: warning: structure containing a flexible array member is not at the end of another structure
[-Wflex-array-member-not-at-end]

Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Link: https://patch.msgid.link/aK6-usANI1UPtFVo@kspp
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2025-09-07 09:18:36 +03:00
Liao Yuanhong
b4b34ba664 wifi: iwlwifi: Remove redundant header files
The header file "fw/img.h" is already included on line 9. Remove the
redundant include.

Fixes: 2594e4d9e1 ("wifi: iwlwifi: prepare for reading SAR tables from UEFI")
Signed-off-by: Liao Yuanhong <liaoyuanhong@vivo.com>
Link: https://patch.msgid.link/20250819121201.608770-2-liaoyuanhong@vivo.com
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2025-09-07 09:07:33 +03:00
Yang Li
c67a247092 wifi: iwlwifi: Remove duplicated include in trans.c
The header files fw/api/tx.h is included twice in gen1_2/trans.c,
so one inclusion of each can be removed.

Reported-by: Abaci Robot <abaci@linux.alibaba.com>
Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=22932
Signed-off-by: Yang Li <yang.lee@linux.alibaba.com>
Link: https://patch.msgid.link/20250723070522.2195817-1-yang.lee@linux.alibaba.com
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
2025-09-07 09:05:11 +03:00
Eric Biggers
cb2d6b132a lib/crypto: tests: Enable Curve25519 test when CRYPTO_SELFTESTS
Now that the Curve25519 library has been disentangled from CRYPTO,
adding CRYPTO_SELFTESTS as a default value of
CRYPTO_LIB_CURVE25519_KUNIT_TEST no longer causes a recursive kconfig
dependency.  Do this, which makes this option consistent with the other
crypto KUnit test options in the same file.

Link: https://lore.kernel.org/r/20250906213523.84915-12-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2025-09-06 16:32:43 -07:00
Eric Biggers
68546e5632 lib/crypto: curve25519: Consolidate into single module
Reorganize the Curve25519 library code:

- Build a single libcurve25519 module, instead of up to three modules:
  libcurve25519, libcurve25519-generic, and an arch-specific module.

- Move the arch-specific Curve25519 code from arch/$(SRCARCH)/crypto/ to
  lib/crypto/$(SRCARCH)/.  Centralize the build rules into
  lib/crypto/Makefile and lib/crypto/Kconfig.

- Include the arch-specific code directly in lib/crypto/curve25519.c via
  a header, rather than using a separate .c file.

- Eliminate the entanglement with CRYPTO.  CRYPTO_LIB_CURVE25519 no
  longer selects CRYPTO, and the arch-specific Curve25519 code no longer
  depends on CRYPTO.

This brings Curve25519 in line with the latest conventions for
lib/crypto/, used by other algorithms.  The exception is that I kept the
generic code in separate translation units for now.  (Some of the
function names collide between the x86 and generic Curve25519 code.  And
the Curve25519 functions are very long anyway, so inlining doesn't
matter as much for Curve25519 as it does for some other algorithms.)

Link: https://lore.kernel.org/r/20250906213523.84915-11-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2025-09-06 16:32:43 -07:00
Eric Biggers
8c06b330e8 lib/crypto: curve25519: Move a couple functions out-of-line
Move curve25519() and curve25519_generate_public() from curve25519.h to
curve25519.c.  There's no good reason for them to be inline.

Link: https://lore.kernel.org/r/20250906213523.84915-10-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2025-09-06 16:32:43 -07:00
Eric Biggers
643d79e531 lib/crypto: tests: Add Curve25519 benchmark
Add a benchmark to curve25519_kunit.  This brings it in line with the
other crypto KUnit tests and provides an easy way to measure
performance.

Link: https://lore.kernel.org/r/20250906213523.84915-9-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2025-09-06 16:32:42 -07:00
Eric Biggers
afc4e4a5f1 lib/crypto: tests: Migrate Curve25519 self-test to KUnit
Move the Curve25519 test from an ad-hoc self-test to a KUnit test.

Generally keep the same test logic for now, just translated to KUnit.
There's one exception, which is that I dropped the incomplete test of
curve25519_generic().  The approach I'm taking to cover the different
implementations with the KUnit tests is to just rely on booting kernels
in QEMU with different '-cpu' options, rather than try to make the tests
(incompletely) test multiple implementations on one CPU.  This way, both
the test and the library API are simpler.

This commit makes the file lib/crypto/curve25519.c no longer needed, as
its only purpose was to call the self-test.  However, keep it for now,
since a later commit will add code to it again.

Temporarily omit the default value of CRYPTO_SELFTESTS that the other
lib/crypto/ KUnit tests have.  It would cause a recursive kconfig
dependency, since the Curve25519 code is still entangled with CRYPTO.  A
later commit will fix that.

Link: https://lore.kernel.org/r/20250906213523.84915-8-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2025-09-06 16:32:19 -07:00
Andy Yan
def5612170 power: supply: cw2015: Fix a alignment coding style issue
Fix the checkpatch warning:
CHECK: Alignment should match open parenthesis

Fixes: 0cb172a491 ("power: supply: cw2015: Use device managed API to simplify the code")
Signed-off-by: Andy Yan <andyshrk@163.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-09-06 23:50:19 +02:00
Xichao Zhao
c3a4951522 power: supply: Remove the use of dev_err_probe()
The dev_err_probe() doesn't do anything when error is '-ENOMEM'.
Therefore, remove the useless call to dev_err_probe(), and just
return the value instead.

Signed-off-by: Xichao Zhao <zhao.xichao@vivo.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-09-06 23:49:06 +02:00
Eric Biggers
09e7652ddb crypto: curve25519 - Remove unused kpp support
Curve25519 has both a library API and a crypto_kpp API.  However, the
crypto_kpp API for Curve25519 had no users outside crypto/testmgr.c.
I.e., no non-test code ever passed "curve25519" to crypto_alloc_kpp().

Remove this unused code.  We'll instead focus on the Curve25519 library
API (<crypto/curve25519.h>), which is a simpler and easier-to-use API
and is the API that is actually being used.

Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> # m68k
Link: https://lore.kernel.org/r/20250906213523.84915-7-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2025-09-06 14:45:49 -07:00
Eric Biggers
77611cd221 crypto: testmgr - Remove curve25519 kpp tests
Curve25519 is used only via the library API, not the crypto_kpp API.  In
preparation for removing the unused crypto_kpp API for Curve25519,
remove the tests for the "curve25519" kpp from crypto/testmgr.c.

Note that these tests just duplicated lib/crypto/curve25519-selftest.c,
which uses the same list of test vectors.  So they didn't really provide
any additional value.

Link: https://lore.kernel.org/r/20250906213523.84915-6-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2025-09-06 14:45:49 -07:00
Eric Biggers
de3ea8e1c5 crypto: x86/curve25519 - Remove unused kpp support
Curve25519 is used only via the library API, not the crypto_kpp API.  In
preparation for removing the unused crypto_kpp API for Curve25519,
remove the unused "curve25519-x86" kpp algorithm.

Note that the underlying x86_64 optimized Curve25519 code remains fully
supported and accessible via the library API.

It's also worth noting that even if the kpp support for Curve25519 comes
back later, there is no need for arch-specific kpp glue code like this,
as a single kpp algorithm that wraps the library API is sufficient.

Link: https://lore.kernel.org/r/20250906213523.84915-5-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2025-09-06 14:45:49 -07:00
Eric Biggers
8c44847e2e crypto: powerpc/curve25519 - Remove unused kpp support
Curve25519 is used only via the library API, not the crypto_kpp API.  In
preparation for removing the unused crypto_kpp API for Curve25519,
remove the unused "curve25519-ppc64le" kpp algorithm.

Note that the underlying PowerPC optimized Curve25519 code remains fully
supported and accessible via the library API.

It's also worth noting that even if the kpp support for Curve25519 comes
back later, there is no need for arch-specific kpp glue code like this,
as a single kpp algorithm that wraps the library API is sufficient.

Link: https://lore.kernel.org/r/20250906213523.84915-4-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2025-09-06 14:45:49 -07:00
Eric Biggers
11efae1026 crypto: arm/curve25519 - Remove unused kpp support
Curve25519 is used only via the library API, not the crypto_kpp API.  In
preparation for removing the unused crypto_kpp API for Curve25519,
remove the unused "curve25519-neon" kpp algorithm.

Note that the underlying NEON optimized Curve25519 code remains fully
supported and accessible via the library API.

It's also worth noting that even if the kpp support for Curve25519 comes
back later, there is no need for arch-specific kpp glue code like this,
as a single kpp algorithm that wraps the library API is sufficient.

Link: https://lore.kernel.org/r/20250906213523.84915-3-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2025-09-06 14:45:49 -07:00
Eric Biggers
ee289d3abe crypto: hisilicon/hpre - Remove unused curve25519 kpp support
Curve25519 is used only via the library API, not the crypto_kpp API.  In
preparation for removing the unused crypto_kpp API for Curve25519,
remove the unused "hpre-curve25519" kpp algorithm.

Cc: Longfang Liu <liulongfang@huawei.com>
Cc: Zhiqi Song <songzhiqi1@huawei.com>
Link: https://lore.kernel.org/r/20250906213523.84915-2-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2025-09-06 14:45:49 -07:00
Qianfeng Rong
d48d4e4f14 power: supply: use max() to improve code
Use max() to reduce the code in cw_battery_get_property() and improve
its readability.

Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-09-06 23:32:11 +02:00
ChiYuan Huang
15a84d15a6 power: supply: rt9467: Add properties for VBUS and IBUS reading
Since there's the existing ADC function, add properties 'VOLTAGE_NOW'
and 'CURRENT_NOW' to report the current VBUS and IBUS value, respectively.

Signed-off-by: ChiYuan Huang <cy_huang@richtek.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-09-06 23:28:57 +02:00
Christopher Ruehl
fee0904441 power: supply: qcom_battmgr: add OOI chemistry
The ASUS S15 xElite model report the Li-ion battery with an OOI, hence this
update the detection and return the appropriate type.

Signed-off-by: Christopher Ruehl <chris.ruehl@gtsys.com.hk>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-09-06 23:25:31 +02:00
Colin Ian King
cb03556acf power: supply: 88pm860x: make fsm_state array static const, simplify usage
Don't populate the read-only array fsm_state on the stack at run time,
instead make it static const, this reduces the object code size as
the data is placed on the data segment and this removes the need to
have code to set the array up on each call.

Note that making the size of the strings to a more optimal 11 bytes long
does not seem to reduce the overall size. Making the array an array of
pointers to the strings increases the code size due to the dereferencing
overhead.

Simplify the array access with &fsm_state[info->state][0] with the simpler
expression fsm_state[info->state] to clean up the code.

Original:
   text    data     bss     dec     hex filename
  22884    8272      64   31220    79f4 drivers/power/supply/88pm860x_charger.o

Patched:
   text	   data	    bss	    dec	    hex	filename
  22695	   8368	     64	  31127	   7997	drivers/power/supply/88pm860x_charger.o

Difference:
   text	   data	    bss	    dec
  -189     +96        0     -93

Reduction of 93 bytes total.

gcc version 14.2.0 (x86-64)

Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-09-06 23:24:23 +02:00
Waqar Hameed
32f350d585 power: supply: Remove error prints for devm_add_action_or_reset()
When `devm_add_action_or_reset()` fails, it is due to a failed memory
allocation and will thus return `-ENOMEM`. `dev_err_probe()` doesn't do
anything when error is `-ENOMEM`. Therefore, remove the useless call to
`dev_err_probe()` when `devm_add_action_or_reset()` fails, and just
return the value instead.

Signed-off-by: Waqar Hameed <waqar.hameed@axis.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-09-06 23:22:45 +02:00
Miguel García
5afce048a9 power: supply: bq2415x: replace deprecated strcpy() with strscpy()
strcpy() is deprecated for NUL-terminated strings. Replace it with
strscpy() for revstr (local fixed-size buffer).

Signed-off-by: Miguel García <miguelgarciaroman8@gmail.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-09-06 22:51:57 +02:00
Justin Worrell
9559d2fffd SUNRPC: call xs_sock_process_cmsg for all cmsg
xs_sock_recv_cmsg was failing to call xs_sock_process_cmsg for any cmsg
type other than TLS_RECORD_TYPE_ALERT (TLS_RECORD_TYPE_DATA, and other
values not handled.) Based on my reading of the previous commit
(cc5d5908: sunrpc: fix client side handling of tls alerts), it looks
like only iov_iter_revert should be conditional on TLS_RECORD_TYPE_ALERT
(but that other cmsg types should still call xs_sock_process_cmsg). On
my machine, I was unable to connect (over mtls) to an NFS share hosted
on FreeBSD. With this patch applied, I am able to mount the share again.

Fixes: cc5d59081f ("sunrpc: fix client side handling of tls alerts")
Signed-off-by: Justin Worrell <jworrell@gmail.com>
Reviewed-and-tested-by: Scott Mayhew <smayhew@redhat.com>
Link: https://lore.kernel.org/r/20250904211038.12874-3-jworrell@gmail.com
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2025-09-06 16:51:26 -04:00
Trond Myklebust
199cd9e8d1 Revert "SUNRPC: Don't allow waiting for exiting tasks"
This reverts commit 14e41b16e8.

This patch breaks the LTP acct02 test, so let's revert and look for a
better solution.

Reported-by: Mark Brown <broonie@kernel.org>
Reported-by: Harshvardhan Jha <harshvardhan.j.jha@oracle.com>
Link: https://lore.kernel.org/linux-nfs/7d4d57b0-39a3-49f1-8ada-60364743e3b4@sirena.org.uk/
Cc: stable@vger.kernel.org # 6.15.x
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2025-09-06 16:51:26 -04:00
Trond Myklebust
c12b6a7b12 NFS: Fix the marking of the folio as up to date
Since all callers of nfs_page_group_covers_page() have already ensured
that there is only one group member, all that is required is to check
that the entire folio contains dirty data.

Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2025-09-06 16:51:26 -04:00
Trond Myklebust
b7b8574225 NFS: nfs_invalidate_folio() must observe the offset and size arguments
If we're truncating part of the folio, then we need to write out the
data on the part that is not covered by the cancellation.

Fixes: d47992f86b ("mm: change invalidatepage prototype to accept length")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2025-09-06 16:51:26 -04:00
Trond Myklebust
ca247c8990 NFSv4.2: Serialise O_DIRECT i/o and copy range
Ensure that all O_DIRECT reads and writes complete before copying a file
range, so that the destination is up to date.

Fixes: a5864c999d ("NFS: Do not serialise O_DIRECT reads and writes")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2025-09-06 16:51:25 -04:00
Trond Myklebust
c80ebeba11 NFSv4.2: Serialise O_DIRECT i/o and clone range
Ensure that all O_DIRECT reads and writes complete before cloning a file
range, so that both the source and destination are up to date.

Fixes: a5864c999d ("NFS: Do not serialise O_DIRECT reads and writes")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2025-09-06 16:51:25 -04:00
Trond Myklebust
b93128f297 NFSv4.2: Serialise O_DIRECT i/o and fallocate()
Ensure that all O_DIRECT reads and writes complete before calling
fallocate so that we don't race w.r.t. attribute updates.

Fixes: 99f2378322 ("NFSv4.2: Always flush out writes in nfs42_proc_fallocate()")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2025-09-06 16:51:25 -04:00
Trond Myklebust
9eb90f4354 NFS: Serialise O_DIRECT i/o and truncate()
Ensure that all O_DIRECT reads and writes are complete, and prevent the
initiation of new i/o until the setattr operation that will truncate the
file is complete.

Fixes: a5864c999d ("NFS: Do not serialise O_DIRECT reads and writes")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2025-09-06 16:51:25 -04:00
Trond Myklebust
b2036bb651 NFSv4.2: Protect copy offload and clone against 'eof page pollution'
The NFSv4.2 copy offload and clone functions can also end up extending
the size of the destination file, so they too need to call
nfs_truncate_last_folio().

Reported-by: Olga Kornievskaia <okorniev@redhat.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2025-09-06 16:51:25 -04:00
Trond Myklebust
b1817b18ff NFS: Protect against 'eof page pollution'
This commit fixes the failing xfstest 'generic/363'.

When the user mmaps() an area that extends beyond the end of file, and
proceeds to write data into the folio that straddles that eof, we're
required to discard that folio data if the user calls some function that
extends the file length.

Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2025-09-06 16:51:25 -04:00
Tigran Mkrtchyan
5a46d2339a flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read
Recent commit f06bedfa62 ("pNFS/flexfiles: don't attempt pnfs on fatal DS
errors") has changed the error return type of ff_layout_choose_ds_for_read() from
NULL to an error pointer. However, not all code paths have been updated
to match the change. Thus, some non-NULL checks will accept error pointers
as a valid return value.

Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Suggested-by: Dan Carpenter <dan.carpenter@linaro.org>
Fixes: f06bedfa62 ("pNFS/flexfiles: don't attempt pnfs on fatal DS errors")
Signed-off-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2025-09-06 16:51:25 -04:00
Mike Snitzer
d3684397ea nfs/localio: avoid bouncing LOCALIO if nfs_client_is_local()
Previously nfs_local_probe() was made to disable and then attempt to
re-enable LOCALIO (via LOCALIO protocol handshake) if/when it was
called and LOCALIO already enabled.

Vague memory for _why_ this was the case is that this was useful
if/when a local NFS server were to be restarted with a local NFS
client connected to it.

But as it happens this causes an absurd amount of LOCALIO flapping
which has a side-effect of too much IO being needlessly sent to NFSD
(using RPC over the loopback network interface).  This is the
definition of "serious performance loss" (that negates the point of
having LOCALIO).

So remove this mis-optimization for re-enabling LOCALIO if/when an NFS
server is restarted (which is an extremely rare thing to do).  Will
revisit testing that scenario again but in the meantime this patch
restores the full benefit of LOCALIO.

Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: NeilBrown <neil@brown.name>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
2025-09-06 16:51:21 -04:00
Darshan R.
980927603c power: supply: gpio-charger: Clean up spacing for better readability
Fixed some minor style issues reported by checkpatch.pl. Mainly adjusted the
spacing around operators and type casts to match the kernel coding
conventions. For example:

- Changed `gpios[ndescs-i-1]` to `gpios[ndescs - i - 1]`
- Added space in `(u32*)` to make it `(u32 *)`
- Cleaned up spacing in a `for` loop

No functional changes — just making the code easier to read and consistent
with the rest of the kernel.

Signed-off-by: Darshan R. <rathod.darshan.0896@gmail.com>
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2025-09-06 22:49:07 +02:00
Frank Li
714380b03d bindings: siox: convert eckelmann,siox-gpio.txt to yaml format
Convert eckelmann,siox-gpio.txt to yaml format.

Signed-off-by: Frank Li <Frank.Li@nxp.com>
Link: https://lore.kernel.org/r/20250905164200.599448-1-Frank.Li@nxp.com
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-09-06 14:35:25 -05:00
Krzysztof Kozlowski
c2cf362210 dt-bindings: display: bridge: Reference DAI common schema
Several display bridges (e.g. LVDS to HDMI converters) are used as sound
Digital Audio Interface (DAI) and have '#sound-dai-cells', thus they
should reference dai-common.yaml schema to allow common properties, like
DAI name.

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20250904083816.48076-2-krzysztof.kozlowski@linaro.org
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
2025-09-06 14:35:25 -05:00
Linus Torvalds
b236920731 Rust fixes for v6.17 (2nd)
Toolchain and infrastructure:
 
  - Two changes to prepare for the future Rust 1.91.0 release (expected
    2025-10-30, currently in nightly): a target specification format
    change and a renamed, soon-to-be-stabilized 'core' function.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEPjU5OPd5QIZ9jqqOGXyLc2htIW0FAmi8ciYACgkQGXyLc2ht
 IW3Bdg/9G07hHjmW0TR+V7AExNTqaZKdCxY//1lFeIuiIIew/tasqqbMCzv6KPi0
 UL/yk4f4bBp5oklRGxzvu5DKG31XCe5i1izML3zQ2Y04Klkj3lcfAG3u05OEhPZm
 woelfv/s3Umy1Gl5xV2QfiVrocRfWlZvsTP/K+ho05FKhM476XjErn8p8U1U3tjA
 KbB+EBKV5reZ14gMDwjCN5BnMpddMQleifaEX/4oRwNfw3zzKDcqB34ojOXjVcrS
 0GfapPCx64FNHxSeHADQ2O9mzOSxT5cTEzcH9JBFU+p8owmjOImvvcPoYKFOn4My
 btQeVzoCxeDwmLBrV8peR3nQHEwjxFuWvyhBg0SQy+51DIzhPJZdy/Z8RsrSywnH
 qoirudXd/rchvUTk/dNxQC6NORuY1IGGi2uJAs4ZRrmC6UqbxjUdB08cyVY4gFj0
 H3VMVaWlVWIGsPATrA2Oh0D1wsJBDYynf1oyG8R1NyYu4vCpYKMBAyJlVGlrGgq6
 H+fU8BqV+LmXH9ogtk0vhT7sK2dHGSA64JR3q1ralOlQip1CsXVeaN9/B+wfjo+i
 dL1qwJXkii0yxyVElHTbnugxI60hR2cgkXRnDMgJu5fBPGDdebOGtB1xxDwLnCjH
 3yNiU1Eyyer/NbsqxO9ylYPvHeg4RXETHoK0gk+/jyyR0ryfbtE=
 =j/MW
 -----END PGP SIGNATURE-----

Merge tag 'rust-fixes-6.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux

Pull rust fixes from Miguel Ojeda:

 - Two changes to prepare for the future Rust 1.91.0 release (expected
   2025-10-30, currently in nightly): a target specification format
   change and a renamed, soon-to-be-stabilized 'core' function.

* tag 'rust-fixes-6.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:
  rust: support Rust >= 1.91.0 target spec
  rust: use the new name Location::file_as_c_str() in Rust >= 1.91.0
2025-09-06 12:33:09 -07:00
Zijun Hu
4c48aed6df driver core: auxiliary bus: Optimize logic of auxiliary_match_id()
auxiliary_match_id() repeatedly calculates variable @match_size in the
for loop, however, the variable is fixed actually, so it is enough to
only calculate the variable once.

Besides, the function should return directly if name of the @auxdev
does not include '.', but it still iterates over the ID table.

Additionally, statement 'dev_name(&auxdev->dev)' is fixed, but may be
evaluated more than 3 times.

Optimize logic of the function by:
- Move the logic calculating the variable out of the for loop
- Return NULL directly if @p == NULL
- Give the statement an dedicated local variable @auxdev_name

Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250903-fix_auxbus-v2-1-3eae8374fd65@oss.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06 20:12:36 +02:00
Chen Ridong
3c9ba2777d kernfs: Fix UAF in polling when open file is released
A use-after-free (UAF) vulnerability was identified in the PSI (Pressure
Stall Information) monitoring mechanism:

BUG: KASAN: slab-use-after-free in psi_trigger_poll+0x3c/0x140
Read of size 8 at addr ffff3de3d50bd308 by task systemd/1

psi_trigger_poll+0x3c/0x140
cgroup_pressure_poll+0x70/0xa0
cgroup_file_poll+0x8c/0x100
kernfs_fop_poll+0x11c/0x1c0
ep_item_poll.isra.0+0x188/0x2c0

Allocated by task 1:
cgroup_file_open+0x88/0x388
kernfs_fop_open+0x73c/0xaf0
do_dentry_open+0x5fc/0x1200
vfs_open+0xa0/0x3f0
do_open+0x7e8/0xd08
path_openat+0x2fc/0x6b0
do_filp_open+0x174/0x368

Freed by task 8462:
cgroup_file_release+0x130/0x1f8
kernfs_drain_open_files+0x17c/0x440
kernfs_drain+0x2dc/0x360
kernfs_show+0x1b8/0x288
cgroup_file_show+0x150/0x268
cgroup_pressure_write+0x1dc/0x340
cgroup_file_write+0x274/0x548

Reproduction Steps:
1. Open test/cpu.pressure and establish epoll monitoring
2. Disable monitoring: echo 0 > test/cgroup.pressure
3. Re-enable monitoring: echo 1 > test/cgroup.pressure

The race condition occurs because:
1. When cgroup.pressure is disabled (echo 0 > cgroup.pressure), it:
   - Releases PSI triggers via cgroup_file_release()
   - Frees of->priv through kernfs_drain_open_files()
2. While epoll still holds reference to the file and continues polling
3. Re-enabling (echo 1 > cgroup.pressure) accesses freed of->priv

epolling			disable/enable cgroup.pressure
fd=open(cpu.pressure)
while(1)
...
epoll_wait
kernfs_fop_poll
kernfs_get_active = true	echo 0 > cgroup.pressure
...				cgroup_file_show
				kernfs_show
				// inactive kn
				kernfs_drain_open_files
				cft->release(of);
				kfree(ctx);
				...
kernfs_get_active = false
				echo 1 > cgroup.pressure
				kernfs_show
				kernfs_activate_one(kn);
kernfs_fop_poll
kernfs_get_active = true
cgroup_file_poll
psi_trigger_poll
// UAF
...
end: close(fd)

To address this issue, introduce kernfs_get_active_of() for kernfs open
files to obtain active references. This function will fail if the open file
has been released. Replace kernfs_get_active() with kernfs_get_active_of()
to prevent further operations on released file descriptors.

Fixes: 34f26a1561 ("sched/psi: Per-cgroup PSI accounting disable/re-enable interface")
Cc: stable <stable@kernel.org>
Reported-by: Zhang Zhaotian <zhangzhaotian@huawei.com>
Signed-off-by: Chen Ridong <chenridong@huawei.com>
Acked-by: Tejun Heo <tj@kernel.org>
Link: https://lore.kernel.org/r/20250822070715.1565236-2-chenridong@huaweicloud.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06 20:11:27 +02:00
Drew Fustini
dfa743da83 MAINTAINERS: Add RISC-V T-HEAD SoC patchwork
Add patchwork entry for RISC-V T-HEAD SoC support.

Signed-off-by: Drew Fustini <fustini@kernel.org>
2025-09-06 11:05:03 -07:00
Geoffrey D. Bennett
cbd676874e ALSA: scarlett2: Add Vocaster speaker/headphone mute controls
Add support for the speaker and headphone mute controls on Focusrite
Vocaster interfaces. Unlike other Focusrite interfaces, these mute
controls are per-output, not per-channel.

Signed-off-by: Geoffrey D. Bennett <g@b4.vu>
Link: https://patch.msgid.link/aLm2Dy6+O/eLTGVn@m.b4.vu
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2025-09-06 20:02:52 +02:00
Chandra Mohan Sundar
400f60b274 ALSA: cs4281: Send the PCM period elapsed notification properly
As part of spin lock code cleanup using guard(), a new
variable (period_elapsed) was introduced. However this variable
is never set, causing period elapsed notification to be not sent.

Set the value of period_elapsed appropiately.

This issue was reported by static coverity analyzer.

Fixes: 7a5127c2c8 ("ALSA: cs4281: Use guard() for spin locks")
Signed-off-by: Chandra Mohan Sundar <chandramohan.explore@gmail.com>
Link: https://patch.msgid.link/20250906162158.564899-1-chandramohan.explore@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
2025-09-06 19:55:10 +02:00
Claudiu Beznea
eca7103869 driver core: auxiliary bus: Drop dev_pm_domain_detach() call
Starting with commit f99508074e ("PM: domains: Detach on
device_unbind_cleanup()"), there is no longer a need to call
dev_pm_domain_detach() in the bus remove function. The
device_unbind_cleanup() function now handles this to avoid
invoking devres cleanup handlers while the PM domain is
powered off, which could otherwise lead to failures as
described in the above-mentioned commit.

Drop the explicit dev_pm_domain_detach() call and rely instead
on the flags passed to dev_pm_domain_attach() to power off the
domain.

Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Reviewed-by: Ulf Hansson <ulf.hansson@linaro.org>
Link: https://lore.kernel.org/r/20250827100541.926350-1-claudiu.beznea.uj@bp.renesas.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06 19:52:33 +02:00
Gil Fine
716cec5fc9 driver core: Fix order of the kernel-doc parameters
Fix the order of the kernel-doc parameters in device_find_child() and
device_for_each_child*() functions to match the actual functions signature.

No functional changes.

Signed-off-by: Gil Fine <gil.fine@linux.intel.com>
Link: https://lore.kernel.org/r/20250831194930.2063390-1-gil.fine@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06 19:52:25 +02:00
Danilo Krummrich
a86537ad21 driver core: get_dev_from_fwnode(): document potential race
Commit 9a4681a485 ("driver core: Export get_dev_from_fwnode()") made
get_dev_from_fwnode() publicly available, but didn't document the
guarantees a caller must uphold:

get_dev_from_fwnode() obtains a reference count from the device pointer
stored in a struct fwnode_handle. While having its own reference count,
struct fwnode_handle does not keep a reference count of the device it
has a pointer to.

Consequently, a caller must guarantee that it is impossible that the
last device reference is dropped and the device is released concurrently
while calling get_dev_from_fwnode(), otherwise this is a potential UAF
and hence a bug.

Thus, document this potential race condition for get_dev_from_fwnode().

Cc: Ulf Hansson <ulf.hansson@linaro.org>
Cc: Saravana Kannan <saravanak@google.com>
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Link: https://lore.kernel.org/r/20250829205911.33142-1-dakr@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06 19:52:21 +02:00
Xichao Zhao
2b2d4c744e drivers: base: fix "publically"->"publicly"
Trivial fix to spelling mistake in comment text.

Signed-off-by: Xichao Zhao <zhao.xichao@vivo.com>
Link: https://lore.kernel.org/r/20250827114021.476668-1-zhao.xichao@vivo.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06 19:52:17 +02:00
Alexander Usyskin
7704e6be4e mei: hook mei_device on class device
mei_device lifetime was managed by devm procedure of parent device.
But such memory is freed on device_del.
Mei_device object is used by client object that may be alive after
parent device is removed.
It may lead to use-after-free if discrete graphics driver unloads
mei_gsc auxiliary device while user-space holds open handle to mei
character device.

Connect mei_device structure lifteme to mei class device lifetime
by adding mei_device free to class device remove callback.

Move exising parent device pointer to separate field in mei_device
to avoid misuse.

Allocate character device dynamically and allow to control its own
lifetime as it may outlive mei_device structure while character
device closes after parent device is removed from the system.

Leave power management on parent device as we overwrite pci runtime
pm procedure and user-space is expecting it there.

Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14201
Signed-off-by: Alexander Usyskin <alexander.usyskin@intel.com>
Link: https://lore.kernel.org/r/20250826125617.1166546-1-alexander.usyskin@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-09-06 19:50:54 +02:00