Commit graph

1,461,726 commits

Author SHA1 Message Date
Ethan Nelson-Moore
910394c74c net: arcnet: remove ISA and PCMCIA support; modernize documentation
While ARCnet is still used in industrial environments, and cards are
still manufactured, it is unlikely anyone is still using it with ISA
and PCMCIA cards. Reduce future maintenance burden by removing all ISA
and PCMCIA ARCnet drivers and documentation related to them. Update
instructions for loading modules and passing parameters to work on
modern kernels and with the com20020_pci driver. Also take the
opportunity to document the rest of the module parameters, correct a
file path in Documentation/networking/arcnet.rst, and change a
reference to /etc/rc.inet1, which no longer exists, to refer to
ifconfig.

Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Link: https://patch.msgid.link/20260521001631.45434-4-enelsonmoore@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-22 17:20:56 -07:00
Ethan Nelson-Moore
5bc0c090bc net: arcnet: fix typos in comments
The ARCnet code contains quite a few typos in comments. Fix them.
Initially noticed by inspection, then augmented using codespell.

Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Link: https://patch.msgid.link/20260521001631.45434-3-enelsonmoore@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-22 17:20:56 -07:00
Ethan Nelson-Moore
ced9c8cf57 net: arcnet: com20020: remove misleading references to multicast
ARCnet does not support multicast, only unicast and broadcast. In spite
of this, the com20020 driver contains several references to multicast
in a comment and a function name, including a FIXME that it should be
implemented. Adjust the comment to make the lack of multicast support
clear and rename com20020_set_mc_list to com20020_set_rx_mode.

Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Link: https://patch.msgid.link/20260521001631.45434-2-enelsonmoore@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-22 17:20:56 -07:00
Jakub Kicinski
f54ea9ba95 Merge branch 'netlink-fixes-for-cross-namespace-nsid-reporting'
Ilya Maximets says:

====================
netlink: fixes for cross-namespace nsid reporting

While working on some new features for OVS and OVN we discovered that
self-referential NSIDs get unintentionally allocated in the system as
well as unexpectedly reported for local events on all-nsid listeners.

More details in the patches. They change user-visible behavior, but
the current behavior is arguably a bug, as it makes it hard to use
all-nsid sockets without a decent amount of extra unrelated work of
tracking when new NSIDs are allocated for your local namespace.

Tests are added to check the expected behavior and YNL is extended
to support all-nsid sockets in the tests.
====================

Link: https://patch.msgid.link/20260520172317.175168-1-i.maximets@ovn.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-22 17:11:11 -07:00
Ilya Maximets
2e43b64248 selftests: net: add a test case for nsid in all nsid notifications
The test subscribes to link events from all namespaces and makes
sure that local events do not carry NSID in their ancillary data
(even if there is a self-referential NSID allocated for the local
namespace), and remote events do.

Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Link: https://patch.msgid.link/20260520172317.175168-5-i.maximets@ovn.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-22 17:11:09 -07:00
Ilya Maximets
88b126b39f net: netlink: don't set nsid on local notifications
In most cases, notifications on sockets with NETLINK_LISTEN_ALL_NSID
do not contain NSID in their ancillary data in case the event is local
to the listener.

However, when a self-referential NSID is allocated for a namespace,
every local notification starts sending this ID to the user space.

This is problematic, because the listener cannot tell if those
notifications are local or not anymore without making extra requests
to figure out if the provided NSID is local or not.  The listener
can also not figure out the local NSID beforehand as it can be
allocated at any point in time by other processes, changing the
structure of the future notifications for everyone.

The value is practically not useful, since it's the namespace's own
ID that the application has to obtain from other sources in order to
figure out if it's the same or not.  So, for the application it's
just an extra busy work with no benefits.  Moreover, applications
that do not know about this quirk may be mishandling notifications
with NSID set as notifications from remote namespaces.  This is the
case for ovs-vswitchd and the iproute2's 'ip monitor' that stops
printing 'current' and starts printing the nsid number mid-session.

Lack of clear documentation for this behavior is also not helping.

A search though open-source projects doesn't reveal any projects
that use NETNSA_NSID_NOT_ASSIGNED and rely on metadata to contain
self-referential NSIDs (expected, since the value is not useful).
Quite the opposite, as already mentioned, there are few applications
that rely on NSID to not be present in local events.

Since the value is not useful and actively harmful in some cases,
let's not report it for local events, making the notifications more
consistent.

Also adding some blank lines for readability.

Fixes: 59324cf35a ("netlink: allow to listen "all" netns")
Reported-by: Matteo Perin <matteo.perin@canonical.com>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Link: https://patch.msgid.link/20260520172317.175168-3-i.maximets@ovn.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-22 17:11:09 -07:00
Ilya Maximets
70f8592ee9 net: netlink: fix sending unassigned nsid after assigned one
If the current skb is not shared, it is re-used directly for all the
sockets subscribed to the notification.  If we have remote all-nsid
socket receiving a message first, then the 'nsid_is_set' will be
set to 'true'.  If the nsid is NOT_ASSIGNED for the next socket in
the list, the 'nsid_is_set' will remain 'true' and the negative value
is be delivered to the user space.  All subsequent nsid values will be
delivered as well, since there is no code path that sets the flag
back to 'false'.

Fix that by always dropping the flag to 'false' first.

Fixes: 7212462fa6 ("netlink: don't send unknown nsid")
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Link: https://patch.msgid.link/20260520172317.175168-2-i.maximets@ovn.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-22 17:11:09 -07:00
Ian Rogers
e898c505b0 perf kwork: Fix memory management of kwork_work
This commit addresses several memory management issues in builtin-kwork.c:

1. Implements a global cleanup function perf_kwork__exit to free all
   kwork_work and kwork_atom_page objects at the end of the command.

2. Ensures all 'name' fields in struct kwork_work are malloc-ed (or NULL)
   and properly freed by using strdup and zfree.

3. Fixes memory leaks in top_merge_tasks where kwork_work objects were
   dropped without being freed.

4. Adds robustness with NULL checks for name fields.

5. Fixes workqueue_work_init to correctly resolve and strdup kernel
   function names, preventing bad-free errors.

Signed-off-by: Ian Rogers <irogers@google.com>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-05-22 20:51:59 -03:00
Ian Rogers
ca426c0f6e perf kwork: Fix address sanitizer issues
There is a double free in the record array due to how parse_options
will mutate the array. Fix by keeping an array that isn't
mutated. Ensure kwork_usage is freed on all paths.

Signed-off-by: Ian Rogers <irogers@google.com>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-05-22 20:51:01 -03:00
Ian Rogers
fdec0a81ca perf build: Unconditionally set up libunwind feature build flags
A "make feature-dump" build does not specify LIBUNWIND=1 because it is
run with the default configuration to detect system-wide capabilities.
This sets NO_LIBUNWIND := 1, causing Makefile.config to skip setting
LIBUNWIND_LIBS and FEATURE_CHECK_LDFLAGS-libunwind.

Consequently, when Makefile.feature is included and attempts to run
all feature checks (via FEATURE_TESTS := all), the local feature test
test-libunwind.bin compiles without the required architecture-specific
library flags (-lunwind-x86_64) and fails to link on x86_64. This
results in a corrupted cached BUILD_TEST_FEATURE_DUMP showing
feature-libunwind=0 even when the host supports it.

Subsequent test builds (like make_libunwind_O in the build-test suite)
which reuse the feature dump and specify LIBUNWIND=1 will fail to
compile due to a mismatch where CONFIG_LIBUNWIND is set (via remote
architecture checks which are self-contained) but HAVE_LIBUNWIND_SUPPORT
is disabled, causing compiler errors due to missing maps__e_machine
definitions in maps.h.

Fix this by unconditionally setting up the libunwind library lists
and feature check LDFLAGS in Makefile.config so they are always
populated and available to the feature detection engine regardless
of whether LIBUNWIND=1 is opted-in for the current run.

Fixes: 444508cd7c ("perf build: Be more programmatic when setting up libunwind variables")
Signed-off-by: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-05-22 20:50:18 -03:00
Linus Torvalds
79bd2dded1 sched_ext: Fixes for v7.1-rc4
- Spurious WARN in ops_dequeue() racing with concurrent dispatch.
 
 - Self-deadlock between scheduler disable and a concurrent sub-sched
   enable.
 -----BEGIN PGP SIGNATURE-----
 
 iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCahCHGQ4cdGpAa2VybmVs
 Lm9yZwAKCRCxYfJx3gVYGdKOAP9C6xYbZSXuPJSugQg7Ogq7GTcMf0EtK7CGVb9x
 0pVJigEA1E17Vqf1WTWTp2DOsoPV1adS51wcoTGvklJc0eFRrw0=
 =i40E
 -----END PGP SIGNATURE-----

Merge tag 'sched_ext-for-7.1-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext

Pull sched_ext fixes from Tejun Heo:

 - Spurious WARN in ops_dequeue() racing with concurrent dispatch

 - Self-deadlock between scheduler disable and a concurrent sub-sched
   enable

* tag 'sched_ext-for-7.1-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext:
  sched_ext: Fix spurious WARN on stale ops_state in ops_dequeue()
  sched_ext: Fix deadlock between scx_root_disable() and concurrent forks
2026-05-22 16:43:33 -07:00
Sean Christopherson
8c63179d97 KVM: SVM: Only disable x2AVIC WRMSR interception for MSRs that are accelerated
When x2AVIC is enabled, disable WRMSR interception only for MSRs that are
actually accelerated by hardware.  Disabling interception for MSRs that
aren't accelerated is functionally "fine", and in some cases a weird "win"
for performance, but only for cases that should never be triggered by a
well-behaved VM (writes to read-only registers; the #GP will typically
occur in the guest without taking a #VMEXIT, even for fault-like exits).

But overall, disabling interception for MSRs that aren't accelerated is at
best confusing and unintuitive, and at worst introduces avoidable risk, as
the APM's documentation is imperfect and contradictory.  The table in
"15.29.3.1 Virtual APIC Register Accesses" of simply states that such
writes generate exits, where as "Section 15.29.10 x2AVIC" says:

  x2APIC MSR intercept checks and access checks have higher priority than
  AVIC access permission checks.

CPU behavior follows the latter (which makes perfect sense), but all in
all there's simply no reason to disable interception just to make a #GP
faster.

Note, the set of MSRs that are passed through for write is identical to
VMX's set when IPI virtualization is enabled.  This is not a coincidence,
and is another motiviating factor for cleaning up the intercepts, as x2AVIC
is functionally equivalent to APICv+IPIv.

Fixes: 4d1d7942e3 ("KVM: SVM: Introduce logic to (de)activate x2AVIC mode")
Cc: stable@vger.kernel.org
Reviewed-by: Naveen N Rao (AMD) <naveen@kernel.org>
Link: https://patch.msgid.link/20260514213115.1637082-4-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-05-22 16:29:08 -07:00
Linus Torvalds
de37e502a3 cgroup: Fixes for v7.1-rc4
Two rstat fixes:
 
 - Out-of-bounds access in the css_rstat_updated() BPF kfunc when called
   with an unchecked user-supplied cpu.
 
 - Over-strict NMI guard after the recent switch to try_cmpxchg left
   sparc and ppc64 unable to queue rstat updates from NMI.
 -----BEGIN PGP SIGNATURE-----
 
 iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCahCHDA4cdGpAa2VybmVs
 Lm9yZwAKCRCxYfJx3gVYGTk2AP9Me+BV0h17oEuaqAii7uzMom6zCYUO6KY6ADAe
 zr+zcgEA0B72FxH+GyPwe7lhropwg9WR6jagsCFN/tlMPHwQrwc=
 =Sos7
 -----END PGP SIGNATURE-----

Merge tag 'cgroup-for-7.1-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup

Pull cgroup fixes from Tejun Heo:
 "Two rstat fixes:

   - Out-of-bounds access in the css_rstat_updated() BPF kfunc when
     called with an unchecked user-supplied cpu

   - Over-strict NMI guard after the recent switch to try_cmpxchg left
     sparc and ppc64 unable to queue rstat updates from NMI"

* tag 'cgroup-for-7.1-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
  cgroup: rstat: relax NMI guard after switch to try_cmpxchg
  cgroup/rstat: validate cpu before css_rstat_cpu() access
2026-05-22 16:28:47 -07:00
Sean Christopherson
7f4b7092d9 KVM: SVM: Disable x2AVIC RDMSR interception for MSRs KVM actually supports
When toggling x2AVIC on/off, use KVM's curated mask of x2APIC MSRs that
can/should be passed through to the guest (or not) when 2AVIC is enabled.
Using the effective list provided by the local APIC emulation fixes
multiple (classes of) bugs, as the existing hand-coded list of MSRs is
wrong on multiple fronts:

 - ARBPRI isn't supported by KVM, isn't accelerated by AVIC (for read or
   write), and its #VMEXIT is fault-like, i.e. requires decoding the
   instruction.  Disabling interception is nonsensical and suboptimal.

 - DFR and ICR2 aren't supported by x2APIC and so don't need their
   intercepts disabled for performance reasons.  While the #GP due to
   x2APIC being abled has higher priority than the trap-like #VMEXIT,
   disabling interception of unsupported MSRs is confusing and unnecessary.

 - RRR is completely unsupported.

 - AVIC currently fails to pass through the "range of vectors" registers,
   IRR, ISR, and TMR, as e.g. X2APIC_MSR(APIC_IRR) only affects IRR0, and
   thus only disables intercept for vectors 31:0 (which are the *least*
   interesting registers).

 - TMCCT (the current APIC timer count) isn't accelerated by hardware, and
   generates a fault-like AVIC_UNACCELERATED_ACCESS #VMEXIT, i.e. requires
   KVM to decode the instruction to figure out what the guest was trying to
   access.  Note, the only reason this isn't a fatal bug is that the AVIC
   architecture had the foresight to guard against buggy hypervisors.  E.g.
   if hardware simply read from the virtual APIC page, the guest would get
   garbage (because the timer is emulated in software).

Fixes: 4d1d7942e3 ("KVM: SVM: Introduce logic to (de)activate x2AVIC mode")
Cc: stable@vger.kernel.org
Reviewed-by: Naveen N Rao (AMD) <naveen@kernel.org>
Link: https://patch.msgid.link/20260514213115.1637082-3-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-05-22 16:28:30 -07:00
Sean Christopherson
8ba621f335 KVM: x86: Add dedicated API for getting mask of accelerated x2APIC MSRs
Add a dedicated local APIC API, kvm_x2apic_disable_intercept_reg_mask(),
to provide the mask of x2APIC registers whose MSRs can and should be passed
through to the guest when x2APIC virtualization is enable, and use it in
lieu of the open-coded equivalent VMX logic.  Providing a common helper
will allow sharing the logic with SVM (x2AVIC), and as a bonus eliminates
the somewhat confusing code where KVM enables interception for MSR_TYPE_RW,
even though only the READ case actually needs to be updated.

No functional change intended.

Cc: stable@vger.kernel.org
Reviewed-by: Naveen N Rao (AMD) <naveen@kernel.org>
Link: https://patch.msgid.link/20260514213115.1637082-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-05-22 16:27:39 -07:00
Linus Torvalds
4a5860ea60 drm fixes for 7.1-rc5
gem:
 - clean up LRU locking
 
 msm:
 - Core:
  - Fixed bindings for SM8650, SM8750 and Eliza
  - Don't use UTS_RELEASE directly
  - Fix typo in clock-names property
 - DPU:
   - Fixed CWB description on Kaanapali
   - Fixed scanline strides for YUV UBWC formats
   - Stopped DSI register dumping to access past the end of region
 - DSI:
   - Fix dumping unaligned regions
 - GPU:
   - Fix GMEM_BASE for a6xx gen3
   - Fix userspace reachable crash on a2xx-a4xx
   - Fix sysprof_active for counter collection with IFPC enabled GPUs
   - Fix shrinker lockdep
 
 amdgpu:
 - Userq fixes
 - VPE fix
 - SMU 15 fix
 - Misc fixes
 - VCE fixes
 - DC bios parsing fixes
 - DC aux fix
 - Mode1 reset fix
 - RAS fixes
 
 amdkfd:
 - Misc fixes
 
 radeon:
 - CS parser fix
 
 xe:
 - SRIOV related fixes
 - Fix leak and double-free
 - Multi-cast register fixes
 - Multi-queue fix
 
 i915:
 - Fix joiner color pipeline selection [display]
 - Fix readback for target_rr in Adaptive Sync SDP [dp]
 - Apply Intel DPCD workaround when SDP on prior line used [psr]
 
 amdxdna:
 - remove mmap and export for ubuf
 
 bridge:
 - chipone-icn6211: managed bridge cleanup
 - lt66121: acquire reset GPIO
 - megachips: fix clean up on failed IRQ requests
 
 v3d:
 - fix UAF in error code paths
 - release GEM-object ref on free'd jobs
 
 virtio:
 - use uninterruptible resv locking in plane updates
 
 mediatek:
 - fix sparse warnings
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmoQ1MQACgkQDHTzWXnE
 hr6iOQ/9FmcbV1C3rSE3UxrWrxpUnP++f4kxUu8Ol6KX3SJLgeCqlUsoX7XC1hyH
 tPsbRyfNhHOUL3j2QGEkXko/Ip4BodykzIqU9rnA+mdFMwD7DvKOC6irUz8SrDg3
 re7b8OZVkI5EfK6GK0wpjuzWOVnfVXHn4mtPhTrnS4EqoznM4g12bReW0qx0j0m3
 m877elDJZf8YHbU69qa7ulXJYUCSVz6wbLBpKE1lLv+GrJ0ijLAX1F5xNEIcezeA
 bGwj/tY+mfYc8SdvTC3y2fB4mssFErmtQ/TOx0PYpU38mdFhNdJkUm1QOHjI6ty1
 7CiyZqJmVAPBxvj/omRROeR7DFkytnweYOaFhGXPIdXYGvm5Kf5QunqmhU880Do7
 FXAZUaKJdLY5VrJ1tuqSqH8uw/ZX7TZo6sPgamsXxDf8cxHkPNbHfEoA1vRMO7Iy
 tqgfFl1sYXFvVBB0AZd0CKBefElZXw2Nwzs7Um4dPL/nMvk5wC2n/mQYaM9a9BCi
 jLwVQT5FXUU2YY47AwUz+1Sxg4EwBAdflncKGS7xyHvmhJrVrOdUrZ1wIg2+19ug
 gjV4DO2J6iYMI9ZaSe1I/KSxtHJYGM0U59bcNH7ycUuSQwn6M9918KQKNNPXu50h
 vt0rvbUM09Bvq3GWtk6f+Fx20s9Aj+2F/h/nLjnam2DULUoCwB4=
 =E/kQ
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2026-05-23' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "Regular fixes pull, amdgpu/xe being the usual, with bonus msm content
  to bulk things out, otherwise it has the usual scattered changes, with
  amdxdna dropping a badly thought out userspace api.

  gem:
   - clean up LRU locking

  msm:
   - Core:
     - Fixed bindings for SM8650, SM8750 and Eliza
     - Don't use UTS_RELEASE directly
     - Fix typo in clock-names property
   - DPU:
      - Fixed CWB description on Kaanapali
      - Fixed scanline strides for YUV UBWC formats
      - Stopped DSI register dumping to access past the end of region
   - DSI:
      - Fix dumping unaligned regions
   - GPU:
      - Fix GMEM_BASE for a6xx gen3
      - Fix userspace reachable crash on a2xx-a4xx
      - Fix sysprof_active for counter collection with IFPC enabled GPUs
      - Fix shrinker lockdep

  amdgpu:
   - Userq fixes
   - VPE fix
   - SMU 15 fix
   - Misc fixes
   - VCE fixes
   - DC bios parsing fixes
   - DC aux fix
   - Mode1 reset fix
   - RAS fixes

  amdkfd:
   - Misc fixes

  radeon:
   - CS parser fix

  xe:
   - SRIOV related fixes
   - Fix leak and double-free
   - Multi-cast register fixes
   - Multi-queue fix

  i915:
   - Fix joiner color pipeline selection [display]
   - Fix readback for target_rr in Adaptive Sync SDP [dp]
   - Apply Intel DPCD workaround when SDP on prior line used [psr]

  amdxdna:
   - remove mmap and export for ubuf

  bridge:
   - chipone-icn6211: managed bridge cleanup
   - lt66121: acquire reset GPIO
   - megachips: fix clean up on failed IRQ requests

  v3d:
   - fix UAF in error code paths
   - release GEM-object ref on free'd jobs

  virtio:
   - use uninterruptible resv locking in plane updates

  mediatek:
   - fix sparse warnings"

* tag 'drm-fixes-2026-05-23' of https://gitlab.freedesktop.org/drm/kernel: (78 commits)
  drm/xe/oa: Fix exec_queue leak on width check in stream open
  drm/virtio: use uninterruptible resv lock for plane updates
  drm/amdgpu: fix handling in amdgpu_userq_create
  drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check
  drm/amdgpu: userq_va_mapped should remain true once done
  drm/amdgpu: avoid integer overflow in VA range check
  drm/amd/ras: Fix UMC error address allocation leak
  drm/amdgpu: unmap all user mappings of framebuffer and doorbell before mode1 reset
  drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async
  drm/amd/display: Validate GPIO pin LUT table size before iterating
  drm/amd/display: Fix integer overflow in bios_get_image()
  drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id
  drm/amdgpu: use atomic operation to achieve lockless serialization
  drm/amdkfd: Check bounds on allocate_doorbell
  drm/amdgpu/vce3: Fix VCE 3 firmware size and offsets
  drm/amdgpu/vce2: Fix VCE 2 firmware size and offsets
  drm/amdgpu/vce1: Stop using amdgpu_vce_resume
  drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets
  drm/amdgpu/vce1: Don't repeat GTT MGR node allocation
  drm/amdgpu/vce1: Check if VRAM address is lower than GART.
  ...
2026-05-22 16:15:32 -07:00
Linus Torvalds
0e6582a516 SCSI fixes on 20260522
Small fixes, two in drivers and the remaining a sign conversion probem in sd
 with no user visible consequences (non-zero is error).
 
 Signed-off-by: James E.J. Bottomley <James.Bottomley@HansenPartnership.com>
 -----BEGIN PGP SIGNATURE-----
 
 iLgEABMIAGAWIQTnYEDbdso9F2cI+arnQslM7pishQUCahCGHxsUgAAAAAAEAA5t
 YW51MiwyLjUrMS4xMiwyLDImHGphbWVzLmJvdHRvbWxleUBoYW5zZW5wYXJ0bmVy
 c2hpcC5jb20ACgkQ50LJTO6YrIX6/wD8DDul4OL9k/6NvnhX93V4yt5yEVUKwyLi
 71sI1y8Y9UIA/R+0OPRjl6z4KOZaMPZqLIQFLOAweVsHpXAQ20IrPcuU
 =7Y5a
 -----END PGP SIGNATURE-----

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
 "Small fixes, two in drivers and the remaining a sign conversion probem
  in sd with no user visible consequences (non-zero is error)"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: target: tcm_loop: Fix NULL ptr dereference
  scsi: isci: Fix use-after-free in device removal path
  scsi: sd: Fix return code handling in sd_spinup_disk()
2026-05-22 16:08:06 -07:00
Linus Torvalds
59825bc9ce platform-drivers-x86 for v7.1-4
Fixes and New HW Support
 
 - Add ACPI_HANDLE()/ACPI_COMPANION() NULL checks (many drivers) to
   handle match overrides gracefully
 
 - asus-armoury:
 
   - Fix mini-LED mode get/set
 
   - Add support for FA401EA, FX607VU, G614FR, and GU605CP
 
 - bitland-mifs-wmi: Add CONFIG_LEDS_CLASS dependency
 
 - hp-wmi: Add thermal support for Omen 16-c0xxx (board 8902)
 
 - intel/vsec: Fix enable_cnt imbalance due to PCIe error recovery
 
 - surface/aggregator_registry: Remove battery & AC nodes on Surface
 			       Laptop 7 to avoid duplicated devices
 
 - uniwill-laptop:
 
   - Handle uninitialized and invalid charging threshold values
 
   - Accept charging threshold of 0 through power supply sysfs ABI and
     clamp it to 1
 
   - Make 'force' parameter to work also when device descriptor is found
 
   - Do not enable charging limit despite the 'force' parameter to avoid
     permanent damage to battery
 
 The following is an automated shortlog grouped by driver:
 
 acer-wireless:
  -  Check ACPI_COMPANION() against NULL
 
 adv_swbutton:
  -  Check ACPI_HANDLE() against NULL
 
 asus-armoury:
  -  add support for FA401EA
  -  add support for FX607VU
  -  add support for G614FR
  -  add support for GU605CP
  -  fix mini-LED mode get/set on MODE2 devices
 
 asus-laptop:
  -  Check ACPI_COMPANION() against NULL
 
 bitland-mifs-wmi:
  -  add CONFIG_LEDS_CLASS dependency
 
 dell/dell-rbtn:
  -  Check ACPI_COMPANION() against NULL
 
 eeepc-laptop:
  -  Check ACPI_COMPANION() against NULL
 
 fujitsu:
  -  Check ACPI_COMPANION() against NULL
 
 fujitsu-tablet:
  -  Check ACPI_COMPANION() against NULL
 
 hp_accel:
  -  Check ACPI_COMPANION() against NULL
 
 hp-wmi:
  -  fix support for thermal profile Omen 16-с0xxx laptops
 
 intel-hid:
  -  Check ACPI_HANDLE() against NULL
 
 intel/rst:
  -  Check ACPI_COMPANION() against NULL
 
 intel_sar:
  -  Check ACPI_HANDLE() against NULL
 
 intel/smartconnect:
  -  Check ACPI_HANDLE() against NULL
 
 intel-vbtn:
  -  Check ACPI_HANDLE() against NULL
 
 intel/vsec:
  -  Fix enable_cnt imbalance on PCIe error recovery
 
 lg-laptop:
  -  Check ACPI_COMPANION() against NULL
 
 panasonic-laptop:
  -  Check ACPI_COMPANION() against NULL
 
 sony-laptop:
  -  Check ACPI_COMPANION() against NULL
 
 surface: aggregator_registry:
  -  omit battery & AC nodes on Surface Laptop 7
 
 surface: surfacepro3_button:
  -  Check ACPI_COMPANION()
 
 system76:
  -  Check ACPI_COMPANION() against NULL
 
 toshiba_acpi:
  -  Check ACPI_COMPANION() against NULL
 
 toshiba_bluetooth:
  -  Check ACPI_COMPANION() against NULL
 
 toshiba_haps:
  -  Check ACPI_COMPANION() against NULL
 
 uniwill-laptop:
  -  Accept charging threshold of 0
  -  Do not enable the charging limit even when forced
  -  Fix behavior of "force" module param
  -  Properly initialize charging threshold
 
 wireless-hotkey:
  -  Check ACPI_COMPANION() against NULL
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQSCSUwRdwTNL2MhaBlZrE9hU+XOMQUCahBSaQAKCRBZrE9hU+XO
 MXuOAQDhdhmEHMF6DLGsS1oYVgRmLe+JTH7sC+j4GX7EXzdKYQEAtBWYBsVl6FXF
 2ICXDIIg1nUX4L8Ilr5pqnC4qYYLQAM=
 =rdI2
 -----END PGP SIGNATURE-----

Merge tag 'platform-drivers-x86-v7.1-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86

Pull x86 platform driver fixes from

 - Add ACPI_HANDLE()/ACPI_COMPANION() NULL checks (many drivers) to
   handle match overrides gracefully

 - asus-armoury:
    - Fix mini-LED mode get/set
    - Add support for FA401EA, FX607VU, G614FR, and GU605CP

 - bitland-mifs-wmi:
    - Add CONFIG_LEDS_CLASS dependency

 - hp-wmi:
    - Add thermal support for Omen 16-c0xxx (board 8902)

 - intel/vsec:
    - Fix enable_cnt imbalance due to PCIe error recovery

 - surface/aggregator_registry:
    - Remove battery & AC nodes on Surface Laptop 7 to avoid duplicated
      devices

 - uniwill-laptop:
    - Handle uninitialized and invalid charging threshold values
    - Accept charging threshold of 0 through power supply sysfs ABI and
      clamp it to 1
    - Make 'force' parameter to work also when device descriptor is
      found
    - Do not enable charging limit despite the 'force' parameter to
      avoid permanent damage to battery

* tag 'platform-drivers-x86-v7.1-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (35 commits)
  platform/x86: bitland-mifs-wmi: add CONFIG_LEDS_CLASS dependency
  platform/x86: wireless-hotkey: Check ACPI_COMPANION() against NULL
  platform/x86: toshiba_haps: Check ACPI_COMPANION() against NULL
  platform/x86: toshiba_bluetooth: Check ACPI_COMPANION() against NULL
  platform/x86: toshiba_acpi: Check ACPI_COMPANION() against NULL
  platform/x86: system76: Check ACPI_COMPANION() against NULL
  platform/x86: sony-laptop: Check ACPI_COMPANION() against NULL
  platform/x86: panasonic-laptop: Check ACPI_COMPANION() against NULL
  platform/x86: lg-laptop: Check ACPI_COMPANION() against NULL
  platform/x86: intel/smartconnect: Check ACPI_HANDLE() against NULL
  platform/x86: intel/rst: Check ACPI_COMPANION() against NULL
  platform/x86: fujitsu-tablet: Check ACPI_COMPANION() against NULL
  platform/x86: fujitsu: Check ACPI_COMPANION() against NULL
  platform/x86: eeepc-laptop: Check ACPI_COMPANION() against NULL
  platform/x86: dell/dell-rbtn: Check ACPI_COMPANION() against NULL
  platform/x86: asus-laptop: Check ACPI_COMPANION() against NULL
  platform/x86: acer-wireless: Check ACPI_COMPANION() against NULL
  platform/x86: asus-armoury: add support for GU605CP
  platform/x86: asus-armoury: add support for FA401EA
  platform/x86: asus-armoury: add support for G614FR
  ...
2026-05-22 15:45:26 -07:00
Geliang Tang
6ec863c184 selftests: tls: use ASSERT_GE in test_mutliproc
In test_mutliproc(), when send() or recv() returns an error (e.g.,
-1), the test continues to execute the remaining code and fails
repeatedly due to using EXPECT_GE.

For example, if a TLS connection is broken and recv() returns -1,
EXPECT_GE(res, 0) records a failure but does not stop the test.
The test then proceeds with left -= res (where res = -1), causing
left to increase unexpectedly, and the loop continues indefinitely.

This results in a massive number of identical failure messages:

 # tls.c:1686:mutliproc_sendpage_writers:Expected res (-1) >= 0 (0)
 # tls.c:1686:mutliproc_sendpage_writers:Expected res (-1) >= 0 (0)
 ... (hundreds of identical failures)

Fix this by replacing EXPECT_GE with ASSERT_GE. When send() or recv()
fails, ASSERT_GE immediately aborts the current test, preventing
the subsequent undefined behavior and endless failure messages.

Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Link: https://patch.msgid.link/0ee9f412b6bd1a260a547d19f979f73b396746ac.1779354585.git.tanggeliang@kylinos.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-22 15:36:51 -07:00
Dave Airlie
84335a9985 - SRIOV related fixes (Wajdeczko, Mohanram)
- Fix leak and double-free (Lin)
 - Multi-cast register fixes (Gustavo)
 - Multi-queue fix (Niranjana)
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEbSBwaO7dZQkcLOKj+mJfZA7rE8oFAmoPazEACgkQ+mJfZA7r
 E8r5gwf/TypGltHME1VraMkYmNkykoR2B/cFkrLo5HjMrNVnAQm9ZXSIi4EJKeuP
 77w/gBu0H/FvB9nDrXM9arefHVWsNMeRM+eQAoXOKkhPBrmeqKaj05qDvFmkjv2e
 ZJFKzSU0k7+/AaIwpSKb4IktEZf8N8fonAszX8MGZ7yYkyP8TSKwqVYBYhto2m9r
 OLLWTO/tzhSz+l4Xmy3OkvVYBSj23QgZjv+jFzUmM1Xq4dEaxCuqqCQEyDQ0/Wbv
 E2rqdRS5GRHpnhhh/D4bDYejcYyVgcfXVGxXUP0CHUmBCB8Yu4H+fLdT4h6kqu2j
 jkryh/W8pHvNYVIFsLDsrPdHOoiTug==
 =RL0p
 -----END PGP SIGNATURE-----

Merge tag 'drm-xe-fixes-2026-05-21' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes

- SRIOV related fixes (Wajdeczko, Mohanram)
- Fix leak and double-free (Lin)
- Multi-cast register fixes (Gustavo)
- Multi-queue fix (Niranjana)

Signed-off-by: Dave Airlie <airlied@redhat.com>

From: Rodrigo Vivi <rodrigo.vivi@intel.com>
Link: https://patch.msgid.link/ag9rR5VwCdkA0lzI@intel.com
2026-05-23 07:57:08 +10:00
Andi Kleen
7a978c2ac7 perf stat: Make metric only column line up with header
Since some time the metric-only output columns are messed up and do not
line up with the header, which makes it hard to read. I haven't bisected
it, but presumably it was broken for some time.

There were multiple problems:
- The dummy pm invocation at the beginning did print a bogus field
- The column computation in pm did not agree with the header length
- The color escape strings from highlighting confuse printf's field
  length computation

Fix all those. I simplified the column width computation significantly,
ignoring EVNAME_LEN, MGROUP_LEN, config->unit_width which don't
seem to be useful in the metric only context. It now only uses
the actual unit width as well as config->metric_only_len. The result
is more code removed than added.

Before:

% perf stat --topdown -a -I 1000
+           time %  tma_backend_bound %  tma_frontend_bound %  tma_bad_speculation      %  tma_retiring
     1.000190386                                         45.5                   40.0                     5.3                     9.2
     2.005185654                                         45.3                   40.1                     5.6                     9.0
     3.009193207                                         45.4                   39.9                     5.6                     9.1

After:

% perf stat --topdown -a -I 1000
+          time %  tma_backend_bound %  tma_frontend_bound %  tma_bad_speculation      %  tma_retiring
     1.000810024                 46.3                 39.7                   5.3                 8.7
     2.004800656                 45.8                 39.8                   5.4                 8.9
     3.008804783                 46.0                 39.6                   5.4                 9.0

Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Andi Kleen <ak@linux.intel.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-05-22 17:25:02 -03:00
Linus Torvalds
cca95436be phy fixes for 7.1
Couple of driver fixes
  - Big pile of Qualcomm DP/eDP config fixes and kaanapali PHY PLL
    lock failure fix
  - Apple typec switch/mux leak fix
  - Marvell incoorect register fix for mvebu utmi phy
  - Tegra per-pad calibration fix
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAmoQjSAACgkQfBQHDyUj
 g0e5NA//dOb7/jrQf2jFlzlK3MprA4DWxpB8o3cFzWWxTix20+jSyBqyVtC/g0EM
 zf0hGPbh3dhmA6hN6wAaYLj+ly9k5TEibqMbziEaZNNYlvO/ugkeOGrFHBLwNkS1
 gpT4n4Zojdarr3OtqkEsFCuaaWtjRl6f5Qz0mT8Q1D1qgb1wHuiQDeHKG/o4yWyZ
 ROyawyCmKebV/T35XUxn+MtGrhVC8CUGhFebn2Cn4JEog915f9uuacFZtRV+SO3C
 wc8s2kEwnCkCiOQjE/f/8Jgx4NtP0FpHu09dJJ81IciOlhPOWIBGmVE1wWwFNdGs
 orJMYwIBcdixfWoFUaxcJaGp/VtDx5cyVqL8ZUyVCj9cN5Az/C917ELkpflPitqv
 jFsclq/fZoYWjvaGGILe+pW6qRG4XPFL3PzqClGKPi4bJpip4mvi6EEKUFpZzg4B
 SlpCal8N6UN1l6Vl8YSTW0WNyeafUpeANRddrVKoignVGbvVS/C7Hs2b4WRE3Ahh
 R8tt8w6Toe69g/syu1X46qAUe9M9/S5zIsKSgELp5zI4TzKtZJ70lLRCm49oNUgO
 AHDCxeIAE9jeokroiEitzO5tvfGhCXLy+1RIx2uLMphlzhSnP4r8RXN+r81/lBtq
 KDwqw2NcZ7V/TQmhOz9rr7Lmy1ltpti76b0isb3MOHVPytWpHpo=
 =SxJy
 -----END PGP SIGNATURE-----

Merge tag 'phy-fixes-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy

Pull phy fixes from Vinod Koul:

 - Big pile of Qualcomm DP/eDP config fixes and kaanapali PHY PLL
   lock failure fix

 - Apple typec switch/mux leak fix

 - Marvell incoorect register fix for mvebu utmi phy

 - Tegra per-pad calibration fix

* tag 'phy-fixes-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy:
  phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config
  phy: apple: atc: Fix typec switch/mux leak on unbind
  phy: spacemit: Remove incorrect clk_disable() in spacemit_usb2phy_init()
  phy: eswin: Fix incorrect error check in probe()
  phy: qcom-qmp-ufs: Fix kaanapali PHY PLL lock failure after SM8650 G4 fix
  phy: exynos5-usbdrd: fix USB 2.0 HS PHY tuning values for Exynos7870
  phy: tegra: xusb: Fix per-pad high-speed termination calibration
  phy: marvell: mvebu-a3700-utmi: fix incorrect USB2_PHY_CTRL register access
  phy: qcom: edp: Add PHY-specific LDO config for eDP low vdiff
  phy: qcom: edp: Fix AUX_CFG8 programming for DP mode
  phy: qcom: edp: Add SC7280/SC8180X swing/pre-emphasis tables
  phy: qcom: edp: Add eDP/DP mode switch support
  phy: qcom: edp: Unify generic DP/eDP swing and pre-emphasis tables
2026-05-22 13:23:21 -07:00
Linus Torvalds
e216d85eaf spi: Fixes for v7.1
Another batch of driver fixes from Johan fixing error handling paths,
 plus another from Felix.  We also have a new device ID added in the DT
 bindings for SpacemiT K3.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmoQOJYACgkQJNaLcl1U
 h9Cv9AgAg9YV8hoCA8qMNcIurXXnaaJ8+SU2zqOdN9fuHMuxFCnxY+J4xjp1V5b6
 waIJxCFX6qqPMEAzmJrqWkGyJtcE2B3sGioJ++mmNWVAJOwbc8/4QWbQyZHdyvuS
 Zk/NjdAV7BOC30CAO6DfVGi4rXCZEA3ul8I+qCQYl9KOnu8j5tQTVbhZijC9MHBG
 YG+e7stFnx44Psl/IiGvlbVvG6AUi3whlMkX7ep0aeGnz6/g1IVyGty0cMaWlW8K
 8DXOlzmDoCTKLdlqAHO5sN063nA/3utjkFzoTZ98THvsL2vaQnNWxZI1bxyfhG45
 xZAPcx4Q9DTm/REyZnja19E1x6+wsQ==
 =qdyL
 -----END PGP SIGNATURE-----

Merge tag 'spi-fix-v7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi

Pull spi fixes from Mark Brown:
 "Another batch of driver fixes from Johan fixing error handling paths,
  plus another from Felix. We also have a new device ID added in the DT
  bindings for SpacemiT K3"

* tag 'spi-fix-v7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: dt-bindings: fsl-qspi: support SpacemiT K3
  spi: ti-qspi: fix use-after-free after DMA setup failure
  spi: sprd: fix error pointer deref after DMA setup failure
  spi: qup: fix error pointer deref after DMA setup failure
  spi: mtk-snfi: Fix resource leak in mtk_snand_read_page_cache()
  spi: ep93xx: fix error pointer deref after DMA setup failure
2026-05-22 13:19:41 -07:00
Linus Torvalds
ddae1043d8 regulator: Fixes for v7.1
A couple of fixes here, one very minor Kconfig fix and a fix for a nasty
 issue with error reporting in the tps65219 driver.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmoQOVsACgkQJNaLcl1U
 h9BsEgf+NbodkfOh8KPtRrAto3B89pXrwXpT6Q7d+J0w1cPJa6+VC8yMtDx4IJ2C
 FfDU3V0H9W5Dfgeq4942r7v4E9ZOXcI5MLSwg1GPo5c9ynvbK+mhVbrtd+83IeKE
 KtQmXmhnlAPhx6yuFnjb0FDKaAq+DJemXKQfA/Qf+meQIo8Eg4HMjrO+sKLvwDOB
 o48KdpxdLig/v5K3kfab7QfqB3pDMpA8ryCYCgrrNWyqi3dD0/uC0eyKZjTOOmtG
 Rj1iHFzxCyOBgEIo7LmUTPUQIqzOWK3SOE9hGPcwvEuq6BhF7heMzffJYpwbWokM
 wguAsloFxce18XG3n+bBiHWFRoW/4Q==
 =e7Zg
 -----END PGP SIGNATURE-----

Merge tag 'regulator-fix-v7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator

Pull regulator fixes from Mark Brown:
 "A couple of fixes here, one very minor Kconfig fix and a fix for a
  nasty issue with error reporting in the tps65219 driver"

* tag 'regulator-fix-v7.1-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
  regulator: tps65219: fix irq_data.rdev not being assigned
  regulator: Kconfig: fix a typo in help
2026-05-22 13:17:29 -07:00
Linus Torvalds
003759d49a Pin control fixes for the v7.1 kernel:
- Implement the GPIO .get_direction() callback in the Mediatek
   driver to rid dmesg warnings.
 
 - Mark the Qualcomm IPQ4019 pins used as GPIO as using the
   GPIO pin function, so there is no conflict with orthogonal
   muxing.
 
 - Fix incorrect settings of the "PUPD" (pull-up-pull-down)
   register during suspend/resume in the Renesas RZG2L.
 
 - Fix the SMT register cache to be per-bank in the Renesas
   RZG2L.
 
 - Fix the QDSS track clock and control pin group names in the
   Qualcomm Eliza driver.
 
 - Fix a deadlock in the Amlogic driver, caused by playing
   around in sysfs.
 
 - Fix some GPIO wakeup interrupt handling in Qualcomm QCS615.
   and a similar fix for the Qualcomm SM8150.
 
 - Allow parsing DTs without explicit function nodes in the
   Freescale i.MX1 driver.
 
 - Enable the IRQ for the WACF2200 touchscreen using a DMI
   quirk.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEElDRnuGcz/wPCXQWMQRCzN7AZXXMFAmoQdtwACgkQQRCzN7AZ
 XXMAIQ/+KsiMLrdx7/5hapLHAPj2p4ZznO9Tvw0q2JQD4S93AqLosg5njUsyDlCn
 D8mfPx3td7lQX6GbypfnFkppJU7I/wr5UjYn8iouRDVKJSN1zdUXRRylOU9DYpnq
 a7DNR+ScVfxTtNeLFB9XhB5RzxVmkERjVNzan+T+BmHa1M4eUoIBkrwWGV4U9b4d
 2296ESnzKH2mtfbkeh9L1x70705kzWR15hhn2xwHsNwtg/8z7oGxCeZTnbEseuam
 QBzD2sfKVf7+uj4QItIuzyr//RfIVcOsWuxB/jZhgh3ob2plp5T362pV0QOA1706
 TvGYSGyMhz/BobIDKtg7g3q0i5XJpHalA8RRjhY8jWduUymYPti7SUDuhetN/MMK
 z7qiAqzUwvXY5KadVza2P6lu+PKliusdqFSoF5AooC7JwFXGJrCSxno+oR/AzByg
 SuwQt3wBFM/Ik1qtmdt0EL0J3euxCoivPrzTAWyBsY4YoTsGnUXEUn/vAIA7CfIQ
 SjD2XvNJ2okZfWQKfl6pNdpyM/Y9UTNA3wN7qoAfvo0f4Zxyy5eqYfim9FWpgwQ+
 Bchx+CcXc9iEuc9Ja3zzikkR2IVE5AcLlFtPmiKK3nkqhO6MiU+1kzsDk8jT2Bt1
 PYNkIWZjMRZq3Ya56JCOHlxTPAWBG5mXLP1YEz3MwUVVSe+wGwI=
 =bMLM
 -----END PGP SIGNATURE-----

Merge tag 'pinctrl-v7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl

Pull pin control fixes from Linus Walleij:

 - Implement the GPIO .get_direction() callback in the Mediatek driver
   to rid dmesg warnings

 - Mark the Qualcomm IPQ4019 pins used as GPIO as using the GPIO pin
   function, so there is no conflict with orthogonal muxing

 - Fix incorrect settings of the "PUPD" (pull-up-pull-down) register
   during suspend/resume in the Renesas RZG2L

 - Fix the SMT register cache to be per-bank in the Renesas RZG2L

 - Fix the QDSS track clock and control pin group names in the Qualcomm
   Eliza driver

 - Fix a deadlock in the Amlogic driver, caused by playing around in
   sysfs

 - Fix some GPIO wakeup interrupt handling in Qualcomm QCS615. and a
   similar fix for the Qualcomm SM8150

 - Allow parsing DTs without explicit function nodes in the Freescale
   i.MX1 driver

 - Enable the IRQ for the WACF2200 touchscreen using a DMI quirk

* tag 'pinctrl-v7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
  pinctrl-amd: enable IRQ for WACF2200 touchscreen on Lenovo Yoga 7 14AGP11
  pinctrl: imx1: Allow parsing DT without function nodes
  pinctrl: qcom: Fix wakeirq map by removing disconnected irqs for sm8150
  pinctrl: qcom: Fix GPIO to PDC wake irq map for qcs615
  pinctrl: meson: amlogic-a4: fix deadlock issue
  pinctrl: qcom: eliza: Fix QDSS trace clock/control pingroup names
  pinctrl: renesas: rzg2l: Fix SMT register cache handling
  pinctrl: renesas: rzg2l: Fix incorrect PUPD register offset for high pins during suspend/resume
  pinctrl: qcom: ipq4019: mark gpio as a GPIO pin function
  pinctrl: mediatek: moore: implement gpio_chip::get_direction()
2026-05-22 12:33:28 -07:00
Linus Torvalds
99e08debac gpio fixes for v7.1-rc5
- propagate the error code from regulator_enable() in resume path in
   gpio-pca953x
 - take the device lock when calling device_is_bound() in virtual GPIO
   drivers
 - fix software node leak in remove path in gpio-aggregator
 - fix a potential use-after-free in gpio-aggregator
 - harden the GPIO character device uAPI: check that line config
   attributes are correctly zeroed
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEkeUTLeW1Rh17omX8BZ0uy/82hMMFAmoQIysACgkQBZ0uy/82
 hMO9PRAAkaQ58li/hZYklF0O9jDsnhmK/XdPbCQvGnfRyW+838+iIyreP7NrfCN1
 XmicF7Tvt5Spq0qadSvfddMzlWcR7W15XKKVs4QgulPTZubyIyTty5SjNZZcRBxc
 pqq5Png7agZ0b7L3rFqp2sEU3044oI9+2nkWHhmxRVgoXKQVdD0AqddAJ/xiZg/b
 K1M4mjo4k12nUwo9acPMmAvOftwCiGX56p9qdXl4iobBo9Cn8qfnZgC4Oq8uOHPP
 jeEqINv6aXzw3YZOA+XFeNfqbUwyUSWp0e4KzONgrupFZxV7aqFBIlDYPFnsBMku
 yh0jYQwJZmStIzMoLfElPyudtNNZlssj9egby3b5J4n5npDg2ZZGjfbBmmhFXY4I
 madjzj22EJ/6RyVuieskKG+1P8cUlRJcvHNGAgNmhwKZxz19J5jPceQe0mit1Ofq
 lxAkbsT6XsHoqpcwmYCnsNlO9g3yiUTDjk769wK0mLe28I95Qz/t8KMVQK+PO+ij
 gCWgu/PvsnodIMBJTpiNAJNRHc3YKpevqdTdFY9o2VyZJV+mkdQVjRlYSWxtm4s0
 Liz0f5vP3SVavwqAh9iSs8SUgUSrH5hvLltyj7LBaOF/eGaVqGL8nVj0oWloL1WX
 F7sjO1HSYSWRlJRQoi0/NBE8163JfLpHJih3gZfkRKv1+vqcdvw=
 =4Qne
 -----END PGP SIGNATURE-----

Merge tag 'gpio-fixes-for-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux

Pull gpio fixes from Bartosz Golaszewski:

 - propagate the error code from regulator_enable() in resume path in
   gpio-pca953x

 - take the device lock when calling device_is_bound() in virtual GPIO
   drivers

 - fix software node leak in remove path in gpio-aggregator

 - fix a potential use-after-free in gpio-aggregator

 - harden the GPIO character device uAPI: check that line config
   attributes are correctly zeroed

* tag 'gpio-fixes-for-v7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
  gpio: virtuser: lock device when calling device_is_bound()
  gpio: aggregator: lock device when calling device_is_bound()
  gpio: sim: lock device when calling device_is_bound()
  gpio: aggregator: remove the software node when deactivating the aggregator
  gpio: aggregator: fix a potential use-after-free
  gpio: cdev: check if uAPI v2 config attributes are correctly zeroed
  gpio: pca953x: propagate regulator_enable() error from resume
2026-05-22 12:28:47 -07:00
Linus Torvalds
c22407252a sound fixes for 7.1-rc5
As expected, we still continue receiving lots of small fixes.
 One major change is about HD-audio pending IRQ handling, but this
 would influence only on odd machines or slow VMs.  There are a few
 other fixes for the core part, but most of them are not-too-serious
 UAF fixes, while the rest are mostly device-specific fixes and quirks.
 
 ALSA Core:
 - Fix for PCM silencing with bogus iov_iter
 - Fixes for past-the-end iterators in timer and seq
 - Serialization of UMP output teardown
 - Rate-limit ELD parsing errors
 
 HD-audio:
 - Fixes for IRQ work handling and SSID matching
 - Various Realtek quirks for HP and ASUS laptops, including LED fixes
 
 ASoC:
 - Intel: ACPI match table updates for PTL, NVL, and ARL platforms
 - Cirrus Logic: Fixes for cs-amp-lib and cs35l56 codecs
 - Various platform fixes for AMD, FSL SAI, TI OMAP, and Qualcomm
 - DT-binding fix for MediaTek
 
 Others:
 - USB ua101: Reject too-short USB descriptors
 - Scarlett2: Fix for flash writes
 - ASIHPI: Fix for potential OOB access
 - AMD SPI: Fix for bus number in ACPI probe
 
 MAINTAINERS:
 - Updates for SOF and TI maintainers
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmoQGYEOHHRpd2FpQHN1
 c2UuZGUACgkQLtJE4w1nLE++khAAxtTrTwq5GZMAA0C1OMBI9SxclGABBTaMMkYD
 lXjX7z/59Iw5YMkIuKEPZUn9Q9huoTd9vgfWUgCANP5zRGO63Tm+jottFco8w+YU
 KrOvBjy8kQ9GOjrN5Hoy8DKz1tJBz8SXQW08/GEL1gUqHdgxJjunAiYXcTJ+A3jo
 yL5GASW+C/G1sErpC+ixAlnRRnjt8PP4xtX05BtSQMw4hsEtlalBR20VqCKwUNpi
 9T2wxxB8+GwybeFE+3KTl2T3IsFPtUiqDfph54MW+9GaYGVcmxKR98Cs0EAx+ABZ
 XgnwofwTOSMOfpmjSBG4oCVyWL7RPd8thjcT52qrYECPLWiPwguvO0tc2dnWIiFN
 m1qsZh7lCEiROZ6ZRefQTLWTHzs/yo2oW41I+owJCERyw23IzuCJm2+JvCyepz4h
 wBxdnr6lC8DimwAOaqHM0eSmPLBGz//YW+lHwkVIsMMjEhCexm0BVDSjhh1beC0N
 NijeMeIDVj666hs41AcejWqOutSm37amWaCSpfiWNWqE6tJljPny+p9qwgzunb4d
 /NLxNSPIQaohQJ12axSR3fMU7FgMK56hzbb3x4t/da++JfJOviOA01zJq3oaHMOK
 XIpqt5W5c/mNRJWvnOKFXNbOGpLmfsI8ox7mbqZdHFpvqzpK2VDw6jQRMbagPZFL
 nOjwHWE=
 =7KbQ
 -----END PGP SIGNATURE-----

Merge tag 'sound-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "As expected, we still continue receiving lots of small fixes.

  One major change is about HD-audio pending IRQ handling, but this
  would influence only on odd machines or slow VMs. There are a few
  other fixes for the core part, but most of them are not-too-serious
  UAF fixes, while the rest are mostly device-specific fixes and quirks.

  ALSA Core:
   - Fix for PCM silencing with bogus iov_iter
   - Fixes for past-the-end iterators in timer and seq
   - Serialization of UMP output teardown
   - Rate-limit ELD parsing errors

  HD-audio:
   - Fixes for IRQ work handling and SSID matching
   - Various Realtek quirks for HP and ASUS laptops, including LED fixes

  ASoC:
   - Intel: ACPI match table updates for PTL, NVL, and ARL platforms
   - Cirrus Logic: Fixes for cs-amp-lib and cs35l56 codecs
   - Various platform fixes for AMD, FSL SAI, TI OMAP, and Qualcomm
   - DT-binding fix for MediaTek

  Others:
   - USB ua101: Reject too-short USB descriptors
   - Scarlett2: Fix for flash writes
   - ASIHPI: Fix for potential OOB access
   - AMD SPI: Fix for bus number in ACPI probe

  MAINTAINERS:
   - Updates for SOF and TI maintainers"

* tag 'sound-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (47 commits)
  ASoC: codecs: pcm512x: fix null-ptr dereference in pcm512x_overclock_xxx_put()
  ASoC: Intel: soc-acpi-intel-ptl-match: Remove unnecessary cs42l43 match
  ASoC: soc-acpi-intel-ptl-match: Make Chrome matches conditional
  ASoC: Intel: soc-acpi: Add entry for sof_es8336 in NVL match table.
  ASoC: Intel: sof_sdw: Add support for nvlrvp in NVL platform
  ASoC: cs-amp-lib: Fix typo in error message: write -> read
  ASoC: cs-amp-lib: Fix missing dput() after debugfs_lookup()
  ASoC: cs-amp-lib: Fix wrong sizeof() in _cs_amp_set_efi_calibration_data()
  ASoC: cs35l56: Fix flushing of IRQ work in cs35l56_sdw_remove()
  MAINTAINERS: ASoC: Intel/SOF: Remove Ranjani Sridharan as maintainer
  ALSA: seq: Serialize UMP output teardown with event_input
  ALSA: scarlett2: Allow flash writes ending at segment boundary
  ALSA: hda/realtek: Add LED quirk for HP ProBook 430 G6
  ALSA: hda/intel: Make sure to cancel irq-pending work at closing PCM stream
  ALSA: hda: Move irq pending work into hda-intel stream
  ASoC: soc-utils: Add missing va_end in snd_soc_ret()
  ALSA: ua101: Reject too-short USB descriptors
  ALSA: hda/realtek: Fix mute and mic-mute LEDs for HP 16 Piston OmniBook X
  ALSA: seq: avoid past-the-end iterator in snd_seq_create_port()
  ALSA: timer: avoid past-the-end iterator in snd_timer_dev_register()
  ...
2026-05-22 12:22:22 -07:00
Linus Torvalds
3997e3bb1d block-7.1-20260522
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmoQeggQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgpiGkEADRKgJ6YGn1GcKzJjMjogNRiakpD6Wp/d7R
 AvCO+COP47CAF22fFfOgFMZAIDSNIHg1fXZSo5CZv796n1JUHDVPtCczvGuWYz0K
 R9f+C5pvjwHXu2Awolhk7Kg5UOOorz9rc4ok+Zf8pWSP+QtR8vIdjDEyDGbDl76c
 COQUCtc3pjjXwipTogHmqXJCtd1pXn/PypNzq/ngkmPVjP5fZkceniuTBQdraKfn
 3j1OVtRLJwvSfa/rCuTq0DKoCi8AVL0jqdcoLOezhj0FiTYYOEKSXjQy6PrUePy5
 qDHjeguknWvlDXHYsIq9Kx34/du8PkmpS+qfVjRY/D5L6d27cniuudxV6+RnvdaR
 bYnI3wHEDC6C99/WNDDOexbdKCemGlEeorkFlbM7ndCTZpP5WmuhaGXvapLolvAf
 ItHZhEaYye/xHiDIaqBDkbF13aryw7PDFI5ziqT/YuHADIPqUSrg2NPugx7G8wUu
 4PBwYJsk+L2QBq0piyfvKnUUqCPP2e65TICQPDziMeZylKL3OiJELPy9dCa3j5xz
 /WTIJIzvo/njBz7MQsM4+Y3phg4C2DtZKEGkPvZ3hjWXw/oD+aNny5UpuqkBu6Cp
 abieJq8l24E8zfdWkm1KBbi72EyrCCJUGZKRXUoqceSuj61601odOiwLOpPBtf2U
 bKNmHWa7hA==
 =W6/M
 -----END PGP SIGNATURE-----

Merge tag 'block-7.1-20260522' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull block fixes from Jens Axboe:

 - NVMe pull request via Keith:
      - Fix memory leak for peer-to-peer addresses
      - Fix dma map leaks on resource errors

 - Another bio integrity fix, fixing a recent regression

 - Fix for an issue with the request pre-allocation and caching when IO
   is queued, where if a bio split occurred and ended up blocking, the
   list could be corrupted

* tag 'block-7.1-20260522' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  block: avoid use-after-free in disk_free_zone_resources()
  blk-mq: pop cached request if it is usable
  nvme-pci: fix dma mapping leak on data setup error
  nvme-pci: fix dma_vecs leak on p2p memory
  bio-integrity-fs: pass data iter to bio_integrity_verify()
2026-05-22 12:06:23 -07:00
Linus Torvalds
dbae42cfa6 io_uring-7.1-20260522
-----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmoQefMQHGF4Ym9lQGtl
 cm5lbC5kawAKCRD301j7KXHgppAuD/9zWiRNad+8O/tr5C2RuS0JFTKdnRV1tnnZ
 IxsYqi2CM68ETERx9Rs7Orp0a8HjOav9F9Z88gNDXQpX+XdzmL4gvTix/DwbaM8f
 01UgNpDDIZSdFDmFG2U/gN0430j10wXnPaWglFsKVydSGEoE42RAQ4OEdcwOmqDJ
 Xt46mHOnAHN1BRi3g38JnWhFCQfTv0CxYVF1sAbOZFQH2xJG1NdkdVoaVM4kg1a4
 s1Wc+CSYQsyuQq2+LbAeY33ZsdukDvow8EAYIW+zpSivxIqgF6iD4uYTwHp4hTEr
 Yq3nPAoZax8VhuE+WODrpCdP1NUzdgjlrb3wu/Lqc/KaoP8iX/TrmPdFmirGD5Lo
 2PYKdMu+aXxJUpGAPtwHGLgNP9ZV1P+BLph6oHol+I8BwCl35XfcGVDOjKEnVJjk
 6FISG9WLUSWQHLFY9+FX7smX0zbhPJJCK4LH1mScZxkOf8D+MrwwU//gTJrcCMK+
 56f0IjHJhR2goic3dDzu2MQxCl2xSKI3y+yHiH9Qy21WigZcZBmDfh0XoLC51m/a
 ewlL/xCNK0MvX3iAm5dv+fUGqdRVAwxO7cRd2FXkD1lL6fJYzLn8+pGA4iRTux2Z
 3MyO/yEORHShwf89phKSmGlVPY/i5aUAb8O6CXVicNpV2YMGrUw1u5XOT+u6R834
 qccogH2jYQ==
 =RUiY
 -----END PGP SIGNATURE-----

Merge tag 'io_uring-7.1-20260522' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux

Pull io_uring fixes from Jens Axboe:

 - Fix for an issue with IORING_OP_NOP and using injection results

 - Fix for an issue in IORING_OP_WAITID, where the info state was
   assumed cleared by the lower level syscall handler, but for some
   cases it is not. Just clear the data upfront, so that non-initialized
   data isn't copied back to userspace

 - Fix for a lockdep reported issue, where IORING_OP_BIND enters file
   create and hence hits mnt_want_write(), which creates a three part
   lockdep cycle between the super lock, io_uring's uring_lock, and the
   cred mutex

 - Fix a regression introduced in this cycle with how linked timeouts
   are deleted

 - Ensure that the ->opcode nospec indexing on the opcode issue side
   covers all the cases

* tag 'io_uring-7.1-20260522' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  io_uring/nop: pass all errors to userspace
  io_uring/timeout: splice timed out link in timeout handler
  io_uring: propagate array_index_nospec opcode into req->opcode
  io_uring/waitid: clear waitid info before copying it to userspace
  io_uring/net: punt IORING_OP_BIND async if it needs file create
2026-05-22 11:53:28 -07:00
Ziyu Zhang
aae9d8a552 vsock: keep poll shutdown state consistent
vsock_poll() reads vsk->peer_shutdown before taking the socket lock
to set EPOLLHUP and EPOLLRDHUP, then reads it again after taking
the lock to report EOF readability. A shutdown packet can update
peer_shutdown while poll is waiting for the lock, so one poll invocation
can report EOF readability without the corresponding HUP/RDHUP bits.

For connectible sockets, take one peer_shutdown snapshot after
lock_sock() and use it for all peer-shutdown-derived poll bits. For
datagram sockets, which do not take lock_sock() in poll(), take one
lockless READ_ONCE() snapshot and pair it with WRITE_ONCE() on the
writer side.

This keeps the peer-shutdown-derived bits internally consistent for each
poll pass.

Fixes: d021c34405 ("VSOCK: Introduce VM Sockets")
Signed-off-by: Ziyu Zhang <ziyuzhang201@gmail.com>
Link: https://patch.msgid.link/20260519165636.62542-1-ziyuzhang201@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-22 11:27:57 -07:00
Jakub Kicinski
95fab46aea Merge branch 'net-convert-atm-xdp-af_iucv-l2tp_ppp-rxrpc-tipc-to-getsockopt_iter'
Breno Leitao says:

====================
net: convert atm/xdp/af_iucv/l2tp_ppp/rxrpc/tipc to getsockopt_iter

This series continues the conversion of the remaining proto_ops getsockopt
callbacks to the new getsockopt_iter callback introduced in commit 67fab22a7a
("net: add getsockopt_iter callback to proto_ops").

The new callback takes a sockopt_t — a type-safe wrapper around iov_iter
plus an optlen field — instead of raw __user pointers. This:

    - Replaces (char __user *optval, int __user *optlen) with sockopt_t *opt
    - Reads the input buffer size from opt->optlen instead of get_user()
    - Writes the option value via copy_to_iter() instead of copy_to_user()
    - Reports the returned length via opt->optlen instead of put_user(),
      independently of the bytes copied through the iter

Each conversion is a behaviour-preserving and code-style-preserving refactor;
no big changes being introduced, even when the code looks weird.
====================

Link: https://patch.msgid.link/20260520-getsock_four-v3-0-b8c0b16b7780@debian.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-22 11:11:12 -07:00
Breno Leitao
c56dbb469f tipc: convert to getsockopt_iter
Convert TIPC sockets (msg, packet, stream proto_ops) to use the new
getsockopt_iter callback with sockopt_t.

Key changes:
- Replace (char __user *optval, int __user *optlen) with sockopt_t *sopt
- Use sopt->optlen for buffer length (input) and returned size (output)
- Use copy_to_iter() instead of put_user()/copy_to_user()

The sockopt_t parameter is named sopt to avoid collision with the
existing optname parameter named opt.

Note: Dropped the unnecessary parentheses to make checkpatch happier.
Also dropped two now-stale comments that referred to the old "res"
variable handling.

Acked-by: Stanislav Fomichev <sdf@fomichev.me>
Signed-off-by: Breno Leitao <leitao@debian.org>
Link: https://patch.msgid.link/20260520-getsock_four-v3-6-b8c0b16b7780@debian.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-22 11:11:10 -07:00
Breno Leitao
4b94edae0b rxrpc: convert to getsockopt_iter
Convert RxRPC socket's getsockopt implementation to use the new
getsockopt_iter callback with sockopt_t.

Key changes:
- Replace (char __user *optval, int __user *optlen) with sockopt_t *opt
- Use opt->optlen for buffer length (input) and returned size (output)
- Use copy_to_iter() instead of put_user()/copy_to_user()

Acked-by: Stanislav Fomichev <sdf@fomichev.me>
Signed-off-by: Breno Leitao <leitao@debian.org>
Link: https://patch.msgid.link/20260520-getsock_four-v3-5-b8c0b16b7780@debian.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-22 11:11:10 -07:00
Breno Leitao
f83e9cd645 l2tp: ppp: convert to getsockopt_iter
Convert PPPoL2TP socket's getsockopt implementation to use the new
getsockopt_iter callback with sockopt_t.

Key changes:
- Replace (char __user *optval, int __user *optlen) with sockopt_t *opt
- Use opt->optlen for buffer length (input) and returned size (output)
- Use copy_to_iter() instead of put_user()/copy_to_user()

Acked-by: Stanislav Fomichev <sdf@fomichev.me>
Signed-off-by: Breno Leitao <leitao@debian.org>
Link: https://patch.msgid.link/20260520-getsock_four-v3-4-b8c0b16b7780@debian.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-22 11:11:09 -07:00
Breno Leitao
3c6776b5b9 xdp: convert to getsockopt_iter
Convert XDP socket's getsockopt implementation to use the new
getsockopt_iter callback with sockopt_t.

Key changes:
- Replace (char __user *optval, int __user *optlen) with sockopt_t *opt
- Use opt->optlen for buffer length (input) and returned size (output)
- Use copy_to_iter() instead of put_user()/copy_to_user()

Acked-by: Stanislav Fomichev <sdf@fomichev.me>
Signed-off-by: Breno Leitao <leitao@debian.org>
Link: https://patch.msgid.link/20260520-getsock_four-v3-3-b8c0b16b7780@debian.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-22 11:11:09 -07:00
Breno Leitao
4177767daf atm: convert to getsockopt_iter
Convert the ATM SVC and PVC sockets, along with the shared
vcc_getsockopt() helper, to use the new getsockopt_iter callback with
sockopt_t.

Key changes:
- Replace (char __user *optval, int __user *optlen) with sockopt_t *opt
- Use opt->optlen for buffer length (input)
- Use copy_to_iter() instead of put_user()/copy_to_user()

Acked-by: Stanislav Fomichev <sdf@fomichev.me>
Signed-off-by: Breno Leitao <leitao@debian.org>
Link: https://patch.msgid.link/20260520-getsock_four-v3-2-b8c0b16b7780@debian.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-22 11:11:09 -07:00
Breno Leitao
347fdd4df8 af_iucv: convert to getsockopt_iter
Convert IUCV socket's getsockopt implementation to use the new
getsockopt_iter callback with sockopt_t.

Key changes:
- Replace (char __user *optval, int __user *optlen) with sockopt_t *opt
- Use opt->optlen for buffer length (input) and returned size (output)
- Use copy_to_iter() instead of put_user()/copy_to_user()

Acked-by: Stanislav Fomichev <sdf@fomichev.me>
Acked-by: Alexandra Winter <wintera@linux.ibm.com>
Signed-off-by: Breno Leitao <leitao@debian.org>
Link: https://patch.msgid.link/20260520-getsock_four-v3-1-b8c0b16b7780@debian.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-22 11:11:09 -07:00
Erni Sri Satya Vennela
c227f8aaf2 net: mana: Expose hardware diagnostic info via debugfs
Add debugfs entries to expose hardware configuration and diagnostic
information that aids in debugging driver initialization and runtime
operations without adding noise to dmesg.

The debugfs directory for each PCI device is named using pci_name()
(the unique BDF address), and its creation and removal is integrated
into mana_gd_setup() and mana_gd_cleanup_device() respectively, so
that all callers (probe, remove, suspend, resume, shutdown) share a
single code path.

Device-level entries (under /sys/kernel/debug/mana/<BDF>/):
  - num_msix_usable, max_num_queues: Max resources from hardware
  - gdma_protocol_ver, pf_cap_flags1: VF version negotiation results
  - num_vports, bm_hostmode: Device configuration

Per-vPort entries (under /sys/kernel/debug/mana/<BDF>/vportN/):
  - port_handle: Hardware vPort handle
  - max_sq, max_rq: Max queues from vPort config
  - indir_table_sz: Indirection table size
  - steer_rx, steer_rss, steer_update_tab, steer_cqe_coalescing:
    Last applied steering configuration parameters

Signed-off-by: Erni Sri Satya Vennela <ernis@linux.microsoft.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260519064621.772154-1-ernis@linux.microsoft.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-22 11:08:54 -07:00
Linus Torvalds
558c3eca71 seven client fixes
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEE6fsu8pdIjtWE/DpLiiy9cAdyT1EFAmoQd3sACgkQiiy9cAdy
 T1ELLwv9E8J16srSXUXrMtxbvZj6oMntsG7a6vvTTkbkUQ9odODTHEStVCKwOoX1
 jVXXkuHaU9HgX21HB2Z10ykp3y65WPgZ/DGvCtM+bWHGbMLTmp2U+1p+kDjqlRel
 PQaD+kaLUCTm1yDnWqKscFUUxj4SLmHpnAfpbyWPIY+ogpAAhnlVbwvUKwmrTKsw
 gJH5rHdq3Uc6pZ7hnfzWm1JMjty9lmuMyTy+hRy9g4CvOhpvBbuNyDqsot4IWVL/
 AyAwUqnaCFYLTETp+ThLieTL/e10UxpXSLn+UBCgXLlNjcDNG2RA6YphNAWF+Gte
 9fsruwi6oTBTV4YGOiB59qKG2dc9uDzyZWRoXQ2LLo+cu1LmJPAVJSZopjgO+ghq
 v3dKjzUMg4qP7EBkmweVRBQWE3G2Qbp5MTjxNFYWfJqam5dRD1Qp5rBcepnAqhiz
 4v+8xjp3rCNde+0XpEc+rwh0bye8HdU6y+IIpP3qybehXawh5n0AzNcx1D+c4EaH
 RvbrKOJl
 =3O3z
 -----END PGP SIGNATURE-----

Merge tag 'v7.1-rc5-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6

Pull smb client fixes from Steve French:
 - Fix missing lock
 - Fix dentry in use after unmounting
 - cifs.upcall security fix
 - require CAP_NET_ADMIN for swn netlink
 - change allocation in DUP_CTX_STR to GFP_KERNEL
 - minor smbdirect debug fix
 - handle_read_data() folio fix

* tag 'v7.1-rc5-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
  smb: client: change allocation requirements in DUP_CTX_STR macro
  smb: client: require net admin for CIFS SWN netlink
  smb: smbdirect: divide, not multiply, milliseconds by 1000
  cifs: Fix busy dentry used after unmounting
  smb: client: use data_len for SMB2 READ encrypted folioq copy
  smb: client: reject userspace cifs.spnego descriptions
  smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()
2026-05-22 10:52:26 -07:00
Linus Torvalds
632360e8f5 zonefs fixes for 7.1-rc5
- Avoid potential overflow when converting a zonefs file number string
    to an inode number (from Johannes)
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQSRPv8tYSvhwAzJdzjdoc3SxdoYdgUCahAOdQAKCRDdoc3SxdoY
 dnxHAPwMJClZOV6J0RtQqK2zxoDMLGIcE+z0MHq3stFbJBcjWgEA9fjB0rklUwaW
 saPUjQUTj/mZJJYmce1MrXI0qYjXxAs=
 =J44t
 -----END PGP SIGNATURE-----

Merge tag 'zonefs-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs

Pull zonefs fix from Damien Le Moal:

 - Avoid potential overflow when converting a zonefs file number string
   to an inode number (from Johannes)

* tag 'zonefs-7.1-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs:
  zonefs: handle integer overflow in zonefs_fname_to_fno
2026-05-22 10:44:18 -07:00
Weiming Shi
aa8963fdce tun: free page on build_skb failure in tun_xdp_one()
When build_skb() fails in tun_xdp_one(), the function sets ret to
-ENOMEM and jumps to the out label, which returns without freeing the
page that vhost_net_build_xdp() allocated for the frame. As with the
short-frame rejection path, tun_sendmsg() discards the per-buffer error
and still returns total_len, so vhost_tx_batch() takes the success path
and never frees the page. Each build_skb() failure in a batch leaks one
page-frag chunk.

Free the page before taking the error path, matching the put_page() the
other error exits of tun_xdp_one() already perform.

Fixes: 043d222f93 ("tuntap: accept an array of XDP buffs through sendmsg()")
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Reviewed-by: Dongli Zhang <dongli.zhang@oracle.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20260521163312.1479805-2-bestswngs@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-22 10:10:07 -07:00
Weiming Shi
3bcf7aec6a tap: free page on error paths in tap_get_user_xdp()
tap_get_user_xdp() rejects a frame shorter than ETH_HLEN with -EINVAL,
and returns -ENOMEM when build_skb() fails. Both paths jump to the err
label without freeing the page that vhost_net_build_xdp() allocated for
the frame. tap_sendmsg() discards the per-buffer return value and always
returns 0, so vhost_tx_batch() takes the success path and never frees
the page; each rejected frame in a batch leaks one page-frag chunk.

Free the page on both error paths, before the skb is built. This is the
tap counterpart of the same leak in tun_xdp_one().

Fixes: 0efac27791 ("tap: accept an array of XDP buffs through sendmsg()")
Fixes: ed7f2afdd0 ("tap: add missing verification for short frame")
Reported-by: Xiang Mei <xmei5@asu.edu>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Reviewed-by: Dongli Zhang <dongli.zhang@oracle.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20260521163230.1478627-2-bestswngs@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-22 10:08:59 -07:00
Victor Nogueira
bde2a04d9b selftests/tc-testing: Adapt idempotent qdisc notify callback tests to recent fq_codel changes
Commit 150061a206 ("net/sched: fq_codel: local packets no longer count against memory limit")
made fq_codel not account for local packets in the
memory limit. Since tests a4bb, a4be, a4bf, a4c0, a4c1 were relying on
these packets being accounted so that parent's qlen notify callback was
executed, they broke.

Fix the tests by adding the qdiscs to ifb instead and making it see
mirred packets that came from scapy. That way the packets are accounted
in the memory limit and the parent's qlen notify callback is still
executed.

Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Victor Nogueira <victor@mojatatu.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260521150811.1896373-2-victor@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-22 10:08:29 -07:00
Victor Nogueira
4177fd4469 selftests/tc-testing: Add support for ifb devices
Add support for ifb devices in tdc so that tests with the nsPlugin are
able to use it when necessary.

Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: Victor Nogueira <victor@mojatatu.com>
Link: https://patch.msgid.link/20260521150811.1896373-1-victor@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-05-22 10:08:29 -07:00
Thomas Fourier
dab48a7e74 Input: ims-pcu - fix usb_free_coherent() size in ims_pcu_buffers_free()
The input buffer size is pcu->max_in_size, but pcu->max_out_size is
passed to usb_free_coherent().

Change size to match the allocation size.

Fixes: 628329d524 ("Input: add IMS Passenger Control Unit driver")
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
Link: https://patch.msgid.link/20260522085412.45430-2-fourier.thomas@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-05-22 10:01:52 -07:00
Mayur Kumar
21c315342b thermal: sysfs: remove space before tab in macro
Adjust white space in thermal_trip_of_attr().

Signed-off-by: Mayur Kumar <kmayur809@gmail.com>
[ rjw: Added changelog, added tabs before backslash ]
Link: https://patch.msgid.link/20260511175246.217788-1-kmayur809@gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-05-22 18:55:08 +02:00
Marco Crivellari
e21c3e4c88 thermal: core: Add WQ_UNBOUND to alloc_workqueue() users
This continues the effort to refactor workqueue APIs, which began with
the introduction of new workqueues and a new alloc_workqueue flag in:

   commit 128ea9f6cc ("workqueue: Add system_percpu_wq and system_dfl_wq")
   commit 930c2ea566 ("workqueue: Add new WQ_PERCPU flag")

The refactoring is going to alter the default behavior of
alloc_workqueue() to be unbound by default.

With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND),
any alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND
must now use WQ_PERCPU. For more details see the Link tag below.

This workqueue has no benefits being per-CPU, so make it unbound adding
WQ_UNBOUND, removing also the WQ_POWER_EFFICIENT flag.

Link: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/
Suggested-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Marco Crivellari <marco.crivellari@suse.com>
[ rjw: Subject tweak ]
Link: https://patch.msgid.link/20260515084920.70544-1-marco.crivellari@suse.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-05-22 18:48:52 +02:00
Yohei Kojima
08a859927e cpufreq: intel_pstate: Improve warning message on HWP-disabled hybrid CPUs
Improve warning message on HWP-disabled hybrid processors to state that
intel_pstate requires HWP to be enabled on such processors [1].

Previously it warned that "intel_pstate: CPU model not supported", but
it was misleading.

Link: https://docs.kernel.org/admin-guide/pm/intel_pstate.html [1]
Signed-off-by: Yohei Kojima <yohei.kojima@sony.com>
[ rjw: Changelog tweaks ]
Link: https://patch.msgid.link/87f69971a9bf89fb4b51f128e8ae519cbaf5894e.1779406085.git.yohei.kojima@sony.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-05-22 18:45:32 +02:00
Sean Young
6fb302d210 cpufreq: elanfreq: Drop support for AMD Elan SC4*
Since commit 8b793a92d8 ("x86/cpu: Remove M486/M486SX/ELAN support"),
the AMD Elan SC4* is no longer supported, so the CPU frequency driver
is no longer needed.

Signed-off-by: Sean Young <sean@mess.org>
Reviewed-by: Zhongqiu Han <zhongqiu.han@oss.qualcomm.com>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
[ rjw: Changelog tweaks ]
Link: https://patch.msgid.link/20260507090107.10113-1-sean@mess.org
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-05-22 18:42:19 +02:00
Julian Braha
7dd383dc66 cpufreq: clean up dead dependencies on X86 in Kconfig
The Kconfig in the parent directory already has an 'if X86' condition
wrapping the inclusion of this file, meaning that each of the individual
'depends on' statements in this file is a duplicate dependency (dead
code).

Leave the outer 'if X86...endif' and remove the individual 'depends on
X86' statement from each option.

This dead code was found by kconfirm, a static analysis tool for Kconfig.

Signed-off-by: Julian Braha <julianbraha@gmail.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
[ rjw: Changelog edits ]
Link: https://patch.msgid.link/20260417230652.305414-1-julianbraha@gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-05-22 18:42:19 +02:00