tbnet_poll() assembles a multi-frame ThunderboltIP packet into one skb. The
first frame goes into the skb linear area and every further frame is added as
a page fragment.
skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
page, hdr_size, frame_size,
TBNET_RX_PAGE_SIZE - hdr_size);
A packet of frame_count frames therefore ends up with frame_count - 1
fragments. tbnet_check_frame() only bounds the peer supplied frame_count to
TBNET_RING_SIZE / 4 (64), which is far above MAX_SKB_FRAGS (17 by default). A
peer that sends a packet of 19 or more small frames pushes nr_frags past
MAX_SKB_FRAGS, so skb_add_rx_frag() writes past skb_shinfo()->frags[] and
corrupts memory after the shared info.
Tighten the start of packet bound to MAX_SKB_FRAGS + 1 so a packet can never
produce more fragments than frags[] can hold. This matches the recent skb
frags overflow fixes in other receive paths, for example f0813bcd2d ("net:
wwan: t7xx: fix potential skb->frags overflow in RX path") and 600dc40554
("net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete()").
Fixes: e69b6c02b4 ("net: Add support for networking over Thunderbolt cable")
Cc: stable@vger.kernel.org
Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com>
Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Link: https://patch.msgid.link/178163152194.2486768.14724194232649760778@maoyixie.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
nt->buf is exactly MAX_PRINT_CHUNK bytes, but scnprintf() reserves one
byte for its NUL terminator, so a non-fragmented payload of exactly
MAX_PRINT_CHUNK loses its last byte (emitted as a stray NUL in the
release path). Grow nt->buf to MAX_PRINT_CHUNK + 1 and bound the
scnprintf() calls with sizeof(nt->buf); the transmitted length stays
capped at MAX_PRINT_CHUNK.
Alternatively, nt->buf could be left at MAX_PRINT_CHUNK and the NUL byte
reserved by routing exactly-MAX_PRINT_CHUNK payloads to fragmentation
('len < MAX_PRINT_CHUNK'), at the cost of fragmenting those messages.
But it would look less sane, thus the current approach.
Fixes: c62c0a17f9 ("netconsole: Append kernel version to message")
Signed-off-by: Breno Leitao <leitao@debian.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260616-max_print_chunk-v1-1-8dc125d67083@debian.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
__skb_flow_dissect() unconditionally reads 12 bytes from eth_hdr(skb)
when FLOW_DISSECTOR_KEY_ETH_ADDRS is requested. This assumes the skb
has a valid Ethernet header at mac_header, which is not always the case.
The problem can be triggered by:
1. Creating a TUN device in L3 mode (IFF_TUN, hard_header_len=0)
2. Attaching a multiq qdisc with a flower filter matching on eth_src
3. Sending a packet through AF_PACKET
Since TUN in L3 mode has no link-layer header, mac_header points to
the L3 data area. The flow dissector reads 12 bytes of uninitialized
skb memory, which then propagates through fl_set_masked_key() and is
used as a rhashtable lookup key in __fl_lookup(), as reported by KMSAN.
Rejecting the filter in the control path (at tc filter add time) is
not feasible because TC filter blocks can be shared between arbitrary
devices -- a filter installed on an Ethernet device may later classify
packets on a headerless device through a shared block. The device
association is not fixed at filter creation time.
Fix this by gating the memcpy on dev->type == ARPHRD_ETHER, which
ensures only true Ethernet-framed packets have their addresses read.
This is more precise than the previous hard_header_len >= 12 check,
which would incorrectly pass for non-Ethernet link types like IPoIB
(ARPHRD_INFINIBAND, hard_header_len=24) and FDDI (hard_header_len=21)
whose L2 headers are not in Ethernet format. Additionally check
skb_mac_header_was_set() to guard against the pathological case where
mac_header is the unset sentinel (~0U), which would cause eth_hdr() to
return a wild pointer.
For the act_mirred redirect case (Ethernet packet redirected to a
non-Ethernet device sharing a TC block), zeroing the key is the correct
behavior: the packet is now being classified on the target device, where
Ethernet address matching is not semantically meaningful.
Note: on non-Ethernet devices, the zeroed key will match a filter
configured with all-zero MAC addresses. This is an improvement over the
previous behavior where uninitialized memory could randomly match any
filter.
Reported-by: syzbot+fa2f5b1fb06147be5e16@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=fa2f5b1fb06147be5e16
Fixes: 67a900cc04 ("flow_dissector: introduce support for Ethernet addresses")
Signed-off-by: Yun Zhou <yun.zhou@windriver.com>
Link: https://patch.msgid.link/20260616123057.482154-1-yun.zhou@windriver.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
The MACB found in the Raspberry Pi RP1 suffers from sporadic stalls on
the TX queue.
While the exact root cause is not yet fully understood, it is likely
related to a hardware issue where a TSTART write to the NCR register
is missed, preventing the transmission from being kicked off.
Implement a timeout callback to handle TX queue stalls, triggering the
existing restart mechanism to recover.
Link: https://lore.kernel.org/all/20260514215459.36109-1-lukasz@raczylo.com/
Fixes: dc110d1b23 ("net: cadence: macb: Add support for Raspberry Pi RP1 ethernet controller")
Signed-off-by: Lukasz Raczylo <lukasz@raczylo.com>
Co-developed-by: Steffen Jaeckel <sjaeckel@suse.de>
Signed-off-by: Steffen Jaeckel <sjaeckel@suse.de>
Co-developed-by: Andrea della Porta <andrea.porta@suse.com>
Signed-off-by: Andrea della Porta <andrea.porta@suse.com>
Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de>
Reviewed-by: Théo Lebrun <theo.lebrun@bootlin.com>
Link: https://patch.msgid.link/468f480454a314303bac6a54780b153f689f2267.1781598350.git.andrea.porta@suse.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
foe_check_time is declared as u16 pointer but was allocated with
only ppe_num_entries bytes instead of ppe_num_entries * sizeof(u16).
When airoha_ppe_foe_verify_entry() is called with hash >= ppe_num_entries/2,
it writes beyond the allocated buffer, causing heap buffer overflow and
potential kernel crash.
Fixes: 6d5b601d52 ("net: airoha: ppe: Dynamically allocate foe_check_time array in airoha_ppe struct")
Signed-off-by: Wayen Yan <win847@gmail.com>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://patch.msgid.link/178161119471.2163752.14373384830691569758@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
When a node is created via rate-new with tc-bw and a parent node,
devlink_nl_rate_set() executes the sequence of ops. It bails out on the
first failure and doesn't rollback anything. For most things that is
fine (setting some numbers), but the parent set can leak if there's
another failure after that.
That is precisely what happens when parent setting isn't the last block
in the function. After the referenced "Fixes" commit, when tc-bw fails
to be set the function bails out after having set the parent and
incremented its refcount.
There are two callers:
- devlink_nl_rate_set_doit() is fine, it just reports the error.
- but devlink_nl_rate_new_doit() frees the newly created node and leaks
the parent refcnt.
Fix that by reordering the blocks so parent setting is last and adding a
comment explaining this so future modification preserve the ordering
(hopefully).
Fixes: 566e8f108f ("devlink: Extend devlink rate API with traffic classes bandwidth management")
Signed-off-by: Cosmin Ratiu <cratiu@nvidia.com>
Reviewed-by: Carolina Jubran <cjubran@nvidia.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260616110633.1449432-3-cratiu@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
In the original commit the function bails out on kstrdup failure,
forgetting to decrement the refcnt of the parent.
Fix that by moving the parent refcnt setting after kstrdup.
Fixes: caba177d7f ("devlink: Enable creation of the devlink-rate nodes from the driver")
Signed-off-by: Cosmin Ratiu <cratiu@nvidia.com>
Reviewed-by: Carolina Jubran <cjubran@nvidia.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260616110633.1449432-2-cratiu@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
rvu_mbox_handler_lmtst_tbl_setup() uses req->base_pcifunc as a direct
index into the LMT map table to read another function's LMTLINE
physical base address and copy it into the caller's own LMT map table
entry. The mailbox dispatcher authenticates req->hdr.pcifunc from the
IRQ source, but req->base_pcifunc is a separate payload field and is
not sanitized.
Reject the request with -EPERM when a VF caller's base_pcifunc is not a
valid function under its own PF. is_pf_func_valid() bounds the FUNC field
to the PF's configured VF count, keeping the computed index inside the
caller's own slot block.
Fixes: 893ae97214 ("octeontx2-af: cn10k: Support configurable LMTST regions")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Link: https://patch.msgid.link/SYBPR01MB78811656934E713B77DA6CEDAFE62@SYBPR01MB7881.ausprd01.prod.outlook.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
pch_gbe_alloc_tx_buffers() allocates an skb for each TX descriptor and
then passes the returned pointer to skb_reserve(). If netdev_alloc_skb()
fails, skb_reserve() dereferences NULL.
Make pch_gbe_alloc_tx_buffers() return an error when an skb allocation
fails. On failure, let pch_gbe_alloc_tx_buffers() clean the partially
allocated TX ring before returning the error. While bringing the device
up, release the RX buffer pool through a shared cleanup helper before
unwinding the IRQ setup.
Cc: stable+noautosel@kernel.org # untested fix to unlikely error path
Fixes: 77555ee722 ("net: Add Gigabit Ethernet driver of Topcliff PCH")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260615125043.3537046-1-ruoyuw560@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Make @empty have static storage duration (like net/sysctl_net.c does)
to avoid storing a bad pointer, and keep consistent with
__register_sysctl_table @table 'should not be free'd after registration'.
Note that this is _not_ a bug, since size is 0 the pointer will
never get deferenced.
Signed-off-by: Wentao Guan <guanwentao@uniontech.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260616064053.690154-1-guanwentao@uniontech.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
The blamed commit refactored the prechangeupper event handling but
failed to actually return an error in case
dpaa2_switch_prevent_bridging_with_8021q_upper() detected a 802.1q upper
on a port which tries to join a bridge. Fix this by returning err
instead of 0.
Fixes: 45035febc4 ("net: dpaa2-switch: refactor prechangeupper sanity checks")
Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Link: https://patch.msgid.link/20260616105430.3725910-1-ioana.ciornei@nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
receive_big() bounds the device-announced length by
(big_packets_num_skbfrags + 1) * PAGE_SIZE. That is still too loose:
add_recvbuf_big() sets sg[1] to start at offset
sizeof(struct padded_vnet_hdr) into the first page, so the chain
actually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) +
big_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the
check allows for the common hdr_len == 12 case.
A malicious virtio backend can announce a len in that gap. page_to_skb()
then walks one frag past the page chain, storing a NULL page->private
into skb_shinfo()->frags[MAX_SKB_FRAGS], which is both an out-of-bounds
write past the static frag array and a NULL frag handed up the rx path.
Bound len by the size add_recvbuf_big() actually advertised.
Fixes: 0c71670396 ("virtio-net: fix received length check in big packets")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Reviewed-by: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Bui Quang Minh <minhquangbui99@gmail.com>
Link: https://patch.msgid.link/20260616042837.2249468-1-xmei5@asu.edu
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Add a tc-testing case that sends IPv4 fragments through act_ct on clsact
egress while a root prio qdisc is present on the transmit path.
The test verifies that packet processing and qdisc accounting continue
to work after conntrack defragmentation, covering tc_skb_cb preservation
across defragmentation.
Signed-off-by: Zihan Xi <xizh2024@lzu.edu.cn>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Link: https://patch.msgid.link/53493549fdbcb2de25788b7894c56baadbc5fede.1781358692.git.xizh2024@lzu.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
tcf_ct_handle_fragments() calls nf_ct_handle_fragments() without saving
and restoring skb->cb. The defrag helper clears IPCB/IP6CB, which aliases
the tc_skb_cb/qdisc_skb_cb control buffer. Fragmented traffic through
act_ct therefore loses qdisc metadata such as pkt_segs and can trigger
WARN_ON_ONCE() in qdisc_pkt_segs() when panic_on_warn is enabled.
Save and restore the full tc_skb_cb around nf_ct_handle_fragments(),
matching the pattern used by ovs_ct_handle_fragments().
Fixes: ec624fe740 ("net/sched: Extend qdisc control block with tc control block")
Cc: stable@vger.kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Signed-off-by: Zihan Xi <xizh2024@lzu.edu.cn>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Link: https://patch.msgid.link/510c51217fd7aaf29c6dc298bab8d643fe229b1c.1781358692.git.xizh2024@lzu.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
strncpy() has been a persistent source of bugs due to its ambiguous
intended usage and frequently counter-intuitive semantics: it may not
NUL-terminate the destination, and it unconditionally zero-pads to the
full length, which isn't always needed. All former callers have been
migrated[1] to:
- strscpy() for NUL-terminated destinations
- strscpy_pad() for NUL-terminated destinations needing zero-padding
- strtomem_pad() for non-NUL-terminated fixed-width fields
- memcpy_and_pad() for bounded copies with explicit padding
- memcpy() for known-length copies
Remove the generic implementation, its declaration, the FORTIFY_SOURCE
wrapper, and associated tests.
Link: https://github.com/KSPP/linux/issues/90 [1]
Signed-off-by: Kees Cook <kees@kernel.org>
Introduce devm_cxl_probe_mem(), in prep for type2 basic enabling:
cxl: Add dummy function for cxl_memdev_attach_region for !CONFIG_CXL_REGION
cxl/region: Introduce devm_cxl_probe_mem()
cxl/memdev: Introduce cxl_class_memdev_type
cxl/memdev: Pin parents for entire memdev lifetime
cxl/region: Resolve region deletion races
cxl/region: Block region delete during region creation
CXL Misc:
cxl/region: Fill first free targets[] slot during auto-discovery
cxl/region: Fix out-of-bounds access in cxl_cancel_auto_attach()
tools/testing/cxl: Resolve auto-region decoder targets like real HW
cxl: Align interleave decode/encode helpers with their callers
cxl/test: Add check after kzalloc() memory in alloc_mock_res()
cxl/test: Unregister cxl_acpi in cxl_test_init() error path
cxl/test: Zero out LSA backing memory to avoid leaking to user
cxl/test: Fix integer overflow in mock LSA bounds checks
cxl/test: Verify cmd->size_in before accessing payload
cxl/port: update reference to removed CONFIG_PROVE_CXL_LOCKING
cxl/region: Avoid variable shadowing in region attach paths
cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size
cxl/test: Fix __fortify_panic
cxl/fwctl: Fix __fortify_panic
MAINTAINERS: Add CXL reviewer
cxl/test: Enforce PMD alignment for volatile mock regions
cxl/region: Validate partition index before array access
cxl/memdev: Hold memdev lock during memdev poison injection/clear
CXL PCI fixes:
cxl/pci: Convert PCIBIOS errors to errno on DVSEC config accesses
cxl/pci: Fix the incorrect check of pci_read_config_word() return
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE5DAy15EJMCV1R6v9YGjFFmlTOEoFAmo0MqsACgkQYGjFFmlT
OEp5qQ/+N//u4DqTq54P7ZV1jpVzMEchV411frsWF5wl/pvEz9cr/ruPNxpg6Gdz
AtryU1hcXRrDu9hvmO3odDM7jdZsIcF8GbpAWy5blAZaRt37aU6A4+fsFb8apFst
SoFQ9BV23clPAEM7TYKXgya+G4kFu+btf3uxIutc8R78e88aEHGDz/Si//cocLmo
sZY5Qky5eGca7wtX5rEImJtwsKDcTrtTQKQYGcuV6swLtLuJsHgL86TEfrWAH36M
Vugb83a9AhQnGaTtKhvViHZkbMTOjCfOZom9BS++YDl/hVSPU1kF184ZPAI9oi4y
0kKDyoKbTN+oEIhrmhC4SGi0UgIW2O4Y6zR7lgr2iYm08Ki9ehbOI5EX6+PTVMSH
lzLVunyLY/AAU9wrQ4YENYuZgfdUXpOgUzseCVIhN4kVo0oWhnUPHVRj2m2fZ7oH
JzQV1MP2YJEbfqtAFVndBBZhBjrMZMcJCHhdISvz0Axv9ezj02LYJPVgmnGDthX7
kKvPgK7u/3sShAk2qmh1csFlT3H+UH1lpPcGM6btOjpI9TNIsYnyH/VaoHt4CIVL
LZpMwQEMbz7S+An1+Ckwehe7LZAXO4IMUVFSdx6pAIRILNBv+68QkFtg2Ok5v/4s
7p5WPOvS97tTf6z5G/dQkDkGQVg1rdCfrQNN/MrZK4bEvMoQ5DM=
=CimP
-----END PGP SIGNATURE-----
Merge tag 'cxl-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl
Pull CXL updates from Dave Jiang:
"A collection of CXL fixes and changes, including an update to
MAINTAINERS to add Ming Li as a CXL subsystem reviewer.
There's also a series to introduce devm_cxl_probe_mem() core API in
order to pave the way for CXL type2 device drivers to setup and
retrieve CXL region resource during probe"
* tag 'cxl-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: (26 commits)
cxl: Add dummy function for cxl_memdev_attach_region for !CONFIG_CXL_REGION
cxl/region: Introduce devm_cxl_probe_mem()
cxl/memdev: Introduce cxl_class_memdev_type
cxl/memdev: Pin parents for entire memdev lifetime
cxl/region: Resolve region deletion races
cxl/region: Block region delete during region creation
cxl/region: Fill first free targets[] slot during auto-discovery
cxl/region: Fix out-of-bounds access in cxl_cancel_auto_attach()
tools/testing/cxl: Resolve auto-region decoder targets like real HW
cxl: Align interleave decode/encode helpers with their callers
cxl/test: Add check after kzalloc() memory in alloc_mock_res()
cxl/test: Unregister cxl_acpi in cxl_test_init() error path
cxl/test: Zero out LSA backing memory to avoid leaking to user
cxl/test: Fix integer overflow in mock LSA bounds checks
cxl/test: Verify cmd->size_in before accessing payload
cxl/port: update reference to removed CONFIG_PROVE_CXL_LOCKING
cxl/region: Avoid variable shadowing in region attach paths
cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size
cxl/pci: Convert PCIBIOS errors to errno on DVSEC config accesses
cxl/pci: Fix the incorrect check of pci_read_config_word() return
...
strncpy() has no remaining callers in the kernel[1]. Remove the
xtensa-specific inline assembly implementation and __HAVE_ARCH_STRNCPY
define, falling back to the generic version in lib/string.c.
Link: https://github.com/KSPP/linux/issues/90 [1]
Signed-off-by: Kees Cook <kees@kernel.org>
strncpy() has no remaining callers in the kernel[1]. Remove the
x86-32-specific inline assembly implementation and __HAVE_ARCH_STRNCPY
define, falling back to the generic version in lib/string.c.
Link: https://github.com/KSPP/linux/issues/90 [1]
Signed-off-by: Kees Cook <kees@kernel.org>
strncpy() has no remaining callers in the kernel[1]. Remove the
powerpc-specific assembly implementation from both the kernel
(arch/powerpc/lib/string.S) and the boot wrapper
(arch/powerpc/boot/string.S), along with the __HAVE_ARCH_STRNCPY
define and declaration, falling back to the generic version in
lib/string.c.
The boot wrapper's strncpy had no callers in arch/powerpc/boot/.
Link: https://github.com/KSPP/linux/issues/90 [1]
Signed-off-by: Kees Cook <kees@kernel.org>
strncpy() has no remaining callers in the kernel[1]. Remove the
m68k-specific inline assembly implementation and __HAVE_ARCH_STRNCPY
define, falling back to the generic version in lib/string.c.
Link: https://github.com/KSPP/linux/issues/90 [1]
Signed-off-by: Kees Cook <kees@kernel.org>
strncpy() has no remaining callers in the kernel[1]. Remove the
alpha-specific assembly implementation and __HAVE_ARCH_STRNCPY define,
falling back to the generic version in lib/string.c.
The __stxncpy helper (stxncpy.S/ev6-stxncpy.S) is retained as it is
still used by strncat.
Link: https://github.com/KSPP/linux/issues/90 [1]
Signed-off-by: Kees Cook <kees@kernel.org>
A race condition and a couple of static analysis issues are fixed in BTT
Use sysfs_emit() in preparation for removal of cpumap_print_to_pagebuf()
Escalate a dev_dbg to dev_err in a resource conflict message
MAINTAINER file updates
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQR/ATNjDEocsE1wudD5tRoRP7nxxwUCajQaOQAKCRD5tRoRP7nx
x3F9AP4iY4Z0ZJRbQuOtAjAd5t0tiwTubUT6IKHtAHxoWBOcXQD/TJV8HxIlnGTw
K0mH1WSPgDpJFNT17+pNoRU1x/Gr4wg=
=Bahm
-----END PGP SIGNATURE-----
Merge tag 'libnvdimm-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm
Pull nvdimm/dax updates from Alison Schofield:
- Fix a race condition and a couple of static analysis issues in BTT
- Use sysfs_emit() in preparation for removal of cpumap_print_to_pagebuf()
- Escalate a dev_dbg to dev_err in a resource conflict message
- MAINTAINER file updates
* tag 'libnvdimm-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm:
MAINTAINERS: nvdimm: Include maintainer profile
MAINTAINERS: Update address for Ira Weiny
MAINTAINERS: Add maintainer info for libnvdimm and DAX
nvdimm: Use sysfs_emit() for cpumask show callback
dax/bus: Upgrade resource conflict message to dev_err() in alloc_dax_region()
nvdimm/btt: Free arenas on btt_init() error paths
nvdimm/btt: Free arena sub-allocations on discover_arenas() error path
nvdimm/btt: Handle preemption in BTT lane acquisition
- Add OF helpers for parsing the power-domains-child-ids property
- Extend the power domain DT binding with power-domains-child-ids
- Switch to use the dynamic root device
pmdomain providers:
- arm: Add support for domain hierarchies to SCMI power domains
- qcom: Add power domains for the Shikra and Nord SoCs
- sunxi: Fix GPU support on Radxa Cubie A7Z by keeping power domain on
-----BEGIN PGP SIGNATURE-----
iQJEBAABCgAuFiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmoyYiQQHHVsZmhAa2Vy
bmVsLm9yZwAKCRD+JoQlc1iMKXSFEACMGPergitZamXsgMoIQGrT+jG/sZnLIaWV
GBrCRhe837amMKQyq1oVu4cTjieQNLx67bJIsuMXZVuAdihyRnLLe/sKwsyOPaXu
bSa8BR0GhvEXiD784EXFwEK56Zc7b8+qnw6vs67q2IGI/95rylI4gbWBgfa1JTmU
/H9ayoeIoS/bgis6JPsEYXARWwZIJRJof8dxdEk/anTP6FJZIc9jYv2TPrelsyZk
lu92ikdu2V4zsOu7pXd64SPSoNaFNg5T0qduOMm4vHB3ePaBr9z2wBF9moN154zB
NgiIJGJiKZ+BnJnPnH0fX7YIBdr93I3pgaJebJVj9s8202oLd9gHDZ5qVjZED/uP
OyhNXca5DjA1sCAL4CmxN6aVBQpT0ksnJ76BVqe+nIwNSbWvd/vlJxAswgZ1IhxR
Hw9wrkYo8Ylq2UxUQ8Zs0EcDA7ANWL97DZJWIdi7ouWvlKH1OyKn75ntcTBYL1ns
hCzApNg8nYgQliO2kp2siVxK0Ljunr4RRo6wdWwvRyIsRW1iZfHeqv5hzq/g7DaK
QklZGZ3LT7/GVUKUWDE4XihIu+PF1+5JJk6hKYUp0T3/rjWeVuf8q1QZnVv6qnSS
jDSmXzlNEcrKgYgWtgv5Je6NL3m2gQlVTgv6Lbw35/ag2L9NjhsCgocj5J5E4K0+
EYTpY3GfxA==
=2hQV
-----END PGP SIGNATURE-----
Merge tag 'pmdomain-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm
Pull pmdomain updates from Ulf Hansson:
"pmdomain core:
- Add OF helpers for parsing the power-domains-child-ids property
- Extend the power domain DT binding with power-domains-child-ids
- Switch to use the dynamic root device
pmdomain providers:
- arm: Add support for domain hierarchies to SCMI power domains
- qcom: Add power domains for the Shikra and Nord SoCs
- sunxi: Fix GPU support on Radxa Cubie A7Z by keeping power domain on"
* tag 'pmdomain-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm:
pmdomain: core: fix unused variable warning with !PM_GENERIC_DOMAINS_OF
pmdomain: core: fix early domain registration
pmdomain: mediatek: mfg: move __packed after struct name to fix kernel-doc
pmdomain: qcom: rpmpd: Add Shikra RPM Power Domains
pmdomain: qcom: rpmhpd: Add power domains for Nord SoC
dt-bindings: power: qcom,rpmpd: document the Shikra RPM Power Domains
pmdomain: sunxi: support power domain flags for pck600
pmdomain: core: switch to dynamic root device
pmdomain: qcom: Unify user-visible "Qualcomm" name
dt-bindings: power: qcom,rpmhpd: Add RPMh power domain for Nord SoC
dt-bindings: power: qcom,rpmhpd: Fix whitespace in RPMHPD defines
pmdomain: arm_scmi: add support for domain hierarchies
pmdomain: core: add support for power-domains-child-ids
dt-bindings: power: Add power-domains-child-ids property
A response-bearing attempt can return a replayable error and free its
response buffer. If SMB2_query_directory_init() fails before the next send,
cleanup retains the previous buffer type and frees that response again.
Reset response bookkeeping before each attempt to prevent the stale free.
Fixes: 4f1fffa237 ("cifs: commands that are retried should have replay flag set")
Cc: stable@vger.kernel.org
Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
A response-bearing attempt can return a replayable error and free its
response buffer. If SMB2_notify_init() fails before the next send, cleanup
retains the previous buffer type and frees that response again.
Reset response bookkeeping before each attempt to prevent the stale free.
Fixes: 4f1fffa237 ("cifs: commands that are retried should have replay flag set")
Cc: stable@vger.kernel.org
Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
A response-bearing attempt can return a replayable error and free its
response buffer. If SMB2_query_info_init() fails before the next send,
cleanup retains the previous buffer type and frees that response again.
Reset response bookkeeping before each attempt to prevent the stale free.
Fixes: 4f1fffa237 ("cifs: commands that are retried should have replay flag set")
Cc: stable@vger.kernel.org
Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
A response-bearing attempt can return a replayable error and free its
response buffer. If SMB2_close_init() fails before the next send, cleanup
retains the previous buffer type and frees that response again.
Reset response bookkeeping before each attempt to prevent the stale free.
Fixes: 4f1fffa237 ("cifs: commands that are retried should have replay flag set")
Cc: stable@vger.kernel.org
Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
A response-bearing attempt can return a replayable error and free its
response buffer. If SMB2_ioctl_init() fails before the next send, cleanup
retains the previous buffer type and frees that response again.
Reset response bookkeeping before each attempt to prevent the stale free.
Fixes: 4f1fffa237 ("cifs: commands that are retried should have replay flag set")
Cc: stable@vger.kernel.org
Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
A response-bearing attempt can return a replayable error and free its
response buffer. If SMB2_open_init() fails before the next send, cleanup
retains the previous buffer type and frees that response again.
Reset response bookkeeping before each attempt to prevent the stale free.
Fixes: 4f1fffa237 ("cifs: commands that are retried should have replay flag set")
Cc: stable@vger.kernel.org
Signed-off-by: Henrique Carvalho <henrique.carvalho@suse.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
SMB2_flush() keeps its response buffer bookkeeping across replay
attempts. If a replayable flush response is received and the retry then
fails before cifs_send_recv() stores a replacement response, flush_exit
will free the stale response pointer a second time.
Reinitialize resp_buftype and rsp_iov at the top of the replay loop so
cleanup only acts on response state produced by the current attempt.
This fixes a double-free without changing replay handling for successful
requests.
Fixes: 4f1fffa237 ("cifs: commands that are retried should have replay flag set")
Cc: stable@vger.kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Zhengchuan Liang <zcliangcn@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Assisted-by: Codex:GPT-5.4
Acked-by: Henrique Carvalho <henrique.carvalho@suse.com>
Signed-off-by: Zhao Zhang <zzhan461@ucr.edu>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: Steve French <stfrench@microsoft.com>
Remove the reference to the obsolete kselftest wiki.
The kselftest wiki is marked obsolete and is no longer updated. The last
edit was in 2019, and the information is outdated, referring readers for
support to IRC networks that have not been used for years, and to kernel
versions that are no longer supported.
If there is any relevant information left in the wiki it needs to be
cleaned up and moved into the canonical kselftest documentation here.
Link: https://lore.kernel.org/r/20260115172817.7120-1-bacs@librecast.net
Signed-off-by: Brett A C Sheffield <bacs@librecast.net>
Acked-by: Bagas Sanjaya <bagasdotme@gmail.com>
Acked-by: SeongJae Park <sj@kernel.org>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Core changes:
- Add new generic callbacks to populate per-pin pin controllers creating
groups and functions from the device tree building out
pinctrl_generic_to_map() and move the Spacemit driver over to use this.
- Generic board-level pin control driver using the mux framework.
New drivers:
- Amlogic (meson) A9 SoC pin controller.
- Aspeed AST2700 SoC0 and SoC1 pin controllers.
- nVidia Tegra264 pin controller.
- nVidia Tegra238 pin controller.
- Qualcomm Nord TLMM pin controller.
- Qualcomm Shikra TLMM pin controller.
- Qualcomm SM6350 LPASS LPI pin controller.
- Qualcomm IPQ9650 TLMM pin controller.
- Renesas RZ/G3L SoC pin controller.
- UltraRISC DP1000 pin controller.
Improvements:
- Handle pull up/pull down properly in the Renesas RZG2L driver.
- Fix up nVidia Tegra 234 DT bindings.
- Fix up pin definitions in the Qualcomm Eliza driver.
- Qualcomm PM8010 GPIO support in the PM8010 pin controller.
- Qualcomm SM6115 EGPIO support in the SM6115 pin controller.
- Switch Qualcomm LPASS LPI drivers to use runtime PM for power management.
- Clean up the Qualcomm Kconfig business a bit to include the necessary
drivers for each subarch.
- Fix output glitch in the Amlogic (meson) A4 pin controller.
- Move the Airoha driver from the Mediatek directory to its own directory.
It is too different from other Mediatek hardware.
- A slew of fixes to the Airoha AN7581 and AN7583 drivers.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEElDRnuGcz/wPCXQWMQRCzN7AZXXMFAmoz6V8ACgkQQRCzN7AZ
XXNvUg/9ExEBVgJFo0yFKqQfwyr0sVHHjFwbAuWZnoBz7qPS0tRTfQ1GeJclqa9a
7hWkYM0wFWxZ0UpMI+DZI7rvhvg0mLDuU6Fjd8GOgPUISVgvejenqxCGsYTGLNHF
DsAzGMD42aj+Jt4eL3wBumrKrBS7J36sBfn5wUMcQgFtTjp+2SwDJxntPIfKRH8Q
l3arrJ+C3cStOwMKGa//S5c/qy2mijaTPKU+NzFrrmD/wZEYzzSLHcS1v4kBSVab
vVa32q6A5UZtKyPupFxVSICZEtz0/Lze381ppFef+h/txDaHlLwAKZvMLNcoJXt6
8AJu+q0DNP71mNNpr/51c8ZsAcV8kyc//CCjpV6vGwg2Pk2HnjBRWdOhzeY4H1z1
eESKEw9GJGdEeO3Ua6CV6FgXVxLGRnLigU9RC4zP0M8qwZuh/z3F3WxKKTWKZIpK
w0UF+Sl+KrW8qjQRyISsDXphT1fyglQGMrNntL4ihHq/T5JJGF9qjlJMKooZSkiH
oswB14JGVkNU4XGpG76I6IgbJJcaVe8CDGSdfRoVmTQ1sI3gHrO42eQdlWxbJ9x/
DgzL7bnO4os+vq5YJo6YdMsQYI0wpIqTWU7WRGfmCQYkyAVYPRVq+AE7KGlRZjbN
qoqQ9ychYaqKcO94F4vc5ZvhRJkcqIsxNRJel3dky0h8Brq2PZ8=
=5CSf
-----END PGP SIGNATURE-----
Merge tag 'pinctrl-v7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl
Pull pin control updates from Linus Walleij:
"Core changes:
- Add new generic callbacks to populate per-pin pin controllers
creating groups and functions from the device tree building out
pinctrl_generic_to_map() and move the Spacemit driver over to use
this
- Generic board-level pin control driver using the mux framework
New pin controller drivers:
- Amlogic (meson) A9 SoC
- Aspeed AST2700 SoC0 and SoC1
- nVidia Tegra264 and Tegra238
- Qualcomm Nord TLMM, Shikra TLMM, SM6350 LPASS LPI, and IPQ9650 TLMM
- Renesas RZ/G3L SoC
- UltraRISC DP1000
Improvements:
- Handle pull up/pull down properly in the Renesas RZG2L driver
- Fix up nVidia Tegra 234 DT bindings
- Fix up pin definitions in the Qualcomm Eliza driver
- Qualcomm PM8010 GPIO support in the PM8010
- Qualcomm SM6115 EGPIO support in the SM6115
- Switch Qualcomm LPASS LPI drivers to use runtime PM for power
management
- Clean up the Qualcomm Kconfig business a bit to include the
necessary drivers for each subarch
- Fix output glitch in the Amlogic (meson) A4 pin controller
- Move the Airoha driver from the Mediatek directory to its own
directory. It is too different from other Mediatek hardware
- A slew of fixes to the Airoha AN7581 and AN7583 drivers"
* tag 'pinctrl-v7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (151 commits)
pinctrl: Export pinctrl_get_group_selector()
pinctrl: Match DT helper types
pinctrl: qcom: Register functions before enabling pinctrl
pinctrl: meson: amlogic-a4: use nolock get range
pinctrl: ultrarisc: Add UltraRISC DP1000 pinctrl driver
dt-bindings: pinctrl: Add UltraRISC DP1000 pinctrl controller
pinctrl: qcom: Remove unused macro definitions
pinctrl: tegra: PINCTRL_TEGRA264 should depend on ARCH_TEGRA
pinctrl: tegra: PINCTRL_TEGRA238 should depend on ARCH_TEGRA
pinctrl: tegra238: add missing AON pin groups
dt-bindings: pinctrl: tegra238: add missing AON pin groups
pinctrl: airoha: an7583: remove undefined groups from pcm_spi pin function
pinctrl: airoha: an7583: fix phy1_led1 pin function
pinctrl: airoha: an7583: add missed gpio22 pin group
pinctrl: airoha: an7583: fix gpio21 pin group
pinctrl: airoha: fix pwm pin function for an7581 and an7583
pinctrl: airoha: an7583: fix incorrect led mapping in phy4_led1 pin function
pinctrl: airoha: an7581: fix incorrect led mapping in phy4_led1 pin function
pinctrl: airoha: an7583: fix misprint in gpio19 pinconf
pinctrl: airoha: an7581: fix misprint in gpio19 pinconf
...
- New Support & Features
- Maxim MAX25014: Add support for the Maxim MAX25014 4-channel automotive grade
backlight driver IC
- Improvements & Fixes
- Maintainers: Add the Congatec Board Controller backlight driver to its corresponding
entry
- Congatec Board Controller: Remove redundant X86 dependency from the backlight driver
- Kinetic KTD2801: Enable BL_CORE_SUSPENDRESUME to ensure the chip is powered off
during suspend
- Cleanups & Refactoring
- Core: Use named initializers for i2c_device_id arrays to improve readability and
robustness
- Device Tree Binding Updates
- Maxim MAX25014: Add device tree bindings for the Maxim MAX25014 backlight controller
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEdrbJNaO+IJqU8IdIUa+KL4f8d2EFAmoylZoACgkQUa+KL4f8
d2GrtQ//dLUsFbhagbO2OqCef3jkugwIe+aQqiZQ+KjrYVVg+YzQsxbltH7dylXf
Tx8oLO6EZ5yD35Tf/STF17omMOqCAXGXefzm5jf0/z8yPDieBpML+StBnApm5JIg
C1SOHy8UtSBxnlC6bNLuj3GdvNza7XjB6mpopn/zFwV4F/1EdmWSVzj1lZmzc7qr
qjOrrW+hcF7F0toDGTRpL6kb4leVxAQHWn8C3qbebcpQ4PHue+eO2/6Nzn2gNgVE
hiQhz51W7bGEC9LJyRBkXYkSqQVJpBo3FEMY+//ONwvfduLZ9KzHE1jfJzkQHhxt
OshNBEggZVfP0Q2hx00w19I9Mn56MRpcJWC/QHW71MDu/PWVL8BKsglA9/FtLROg
qChu9igqipsLR26grj0rjaImh8P9jM2HKfTcTIfu9BUGkpsLAjxZMOhCJI+zWzq1
YhyCnYqP/vJxE72iXLXqyKCoTPHuhXp5mYNQdmglQtrdnRjuQGn3My/cY58uZHd5
8uV0bVL2SKp589f0DmfSIZQChqOPtuJTDpklijV9GRZ8GNhpEuHhpHSmoMGIkVJS
37m8ddZBlA8HgLBpSMI7CMRcEv7s8Jviwv84F0V4cGZ0AKpQ49/7xFHR2y4JkT26
SpYVPrMbZfbRB4twUfBu6+8qKxHVS5TU3C7ybLMeuz/aEpapRo8=
=6Es2
-----END PGP SIGNATURE-----
Merge tag 'backlight-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight
Pull backlight updates from Lee Jones:
"New Support & Features:
- Maxim MAX25014: Add support for the Maxim MAX25014 4-channel
automotive grade backlight driver IC
Improvements & Fixes:
- Maintainers: Add the Congatec Board Controller backlight driver to
its corresponding entry
- Congatec Board Controller: Remove redundant X86 dependency from the
backlight driver
- Kinetic KTD2801: Enable BL_CORE_SUSPENDRESUME to ensure the chip is
powered off during suspend
Cleanups & Refactoring:
- Core: Use named initializers for i2c_device_id arrays to improve
readability and robustness
Device Tree Binding Updates:
- Maxim MAX25014: Add device tree bindings for the Maxim MAX25014
backlight controller"
* tag 'backlight-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight:
backlight: Use named initializers for arrays of i2c_device_data
MAINTAINERS: Add cgbc backlight driver
backlight: cgbc: Remove redundant X86 dependency
backlight: Add max25014atg backlight
dt-bindings: backlight: Add max25014 support
backlight: ktd2801: Enable BL_CORE_SUSPENDRESUME
- New Support & Features
- Samsung S2MU005: Add support for the Samsung S2MU005 PMIC which includes flash and
RGB LED controllers
- Texas Instruments LP5812: Add support for the TI LP5812 LED driver
- Texas Instruments LP5860: Add support for the Texas Instruments LP5860 LED matrix
driver via SPI
- Improvements & Fixes
- Core: Adjust the brightness sysfs node documentation to clarify that only decimal
values are accepted
- Core: Fix a race condition in the software blink logic when stopping blinking and
setting brightness simultaneously
- Core: Introduce the `multi_max_intensity` sysfs attribute for multicolor LEDs to
support hardware-based global brightness control
- Core: Replace OF-based device lookup with firmware node equivalents to support ACPI
and software nodes
- Core: Return `ENODATA` when reading brightness from hardware-controlled LEDs
- Core: Set the coherent DMA mask to zero for the Samsung PMIC device to suppress
unnecessary "DMA mask not set" messages
- ams OSRAM AS3668: Fix a Kconfig symbol name mismatch in the Makefile that prevented
the driver from being built
- BlinkM: Fix spelling and comment style issues in the driver
- DAC124S085: Declare the SPI command word as `__le16` to ensure correct endianness
and pass sparse checks
- GPIO Trigger: Use `GPIOD_FLAGS_BIT_NONEXCLUSIVE` to allow sharing GPIOs between the
LED trigger and other drivers
- NXP PCA9532: Fix an issue where the LED would stop blinking when changing brightness
to a non-zero value
- Qualcomm: Unify the user-visible company name to "Qualcomm" across flash LED config
options
- Qualcomm LPG: Optimize memory allocation by combining main structure and channels
into a single allocation using flexible array members
- Texas Instruments LP5860: Add missing `CONFIG_OF` dependency to prevent build
warnings
- TI TPS6131x: Increase the overvoltage protection threshold to 6V to avoid false
triggers with 5V input supplies
- Userspace LEDs (uLEDs): Fix a potential buffer overread by using `strnchr()` for
name string validation
- Userspace LEDs (uLEDs): Return `-EFAULT` on `copy_to_user()` failure to properly
handle read errors
- Cleanups & Refactoring
- Core: Convert various `i2c_device_id` arrays to use named initializers for improved
robustness and readability
- Multi-color Core: Fix incorrect `KernelVersion` and `Date` tags for the
`multi_max_intensity` ABI
- Broadcom BCM63138 / ChromeOS EC: Move `MODULE_DEVICE_TABLE` declarations next to the
ID tables for consistency
- LP5812: Fix a sysfs ABI reference in the documentation
- ST1202: Remove an unused legacy GPIO header include
- Device Tree Binding Updates
- Class: Document the keyboard backlight LED class naming conventions, including a new
scheme for zoned backlights
- Core: Dual-license the common LED bindings header under GPLv2 and BSD-2-Clause
- IR SPI LED: Add a new 30% duty-cycle value for the IR transmitter used in Xiaomi
Redmi Note 8
- Samsung S2M series: Document the flash LED device bindings for Samsung S2M series
PMICs
- Samsung S2M series: Document the pattern behavior for Samsung S2M series PMIC RGB
LEDs
- Samsung S2MU005: Add device tree bindings for the S2MU005 PMIC, including its flash
and RGB LED sub-devices
- TI LM3560: Document the TI LM3559 and LM3560 synchronous boost flash drivers
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEdrbJNaO+IJqU8IdIUa+KL4f8d2EFAmoylZ0ACgkQUa+KL4f8
d2GgaQ//QrL6Ap+Sp4JrG4m0FDvMB72QkqtTBtfMtUUpvliFrggGr5tAbPVOnITn
N5vFNJy++ffGA25xvi7XvMUDAi5dXY71razR7Rw+QAp7KytNnNNu5GxcYw4rGXGR
yndd9YQBhowlLF+jGjk866txj59vBKf/MpHXt+VrdJGK/se3nzeg4rOsCx/ZP1p5
nhBcyunGKereeVUHj041N22PVxicR8TsleDf9ho69UdiKTh3ZGiRmzdvn0sgA+wi
b8wZCQXNmnpnmWm2xtwoH7dCdTFMshbs1rmFl1GxctkRqwx5yRU5sREqJKxeW6g9
Q/24gwMI6UD350Yx5ir748aKgIeQxmGXAzKvqostqVNxt4uqKIcBat4Q3BHjzSgX
HzmpF1OZHZOcyPrN1mNgc5fpiv+5FyzQirddg+Au9P2FKe+leOH08u70b0eaZHX0
RgzSHayGq8DR2evAsUl1pIaJfSuh7W+YopSFaB2VnU83ShTEqLqE3DvdjwwQsjZ8
Fb1XkPfFqFShQr1gZ8SG3F60yDAbs77ZBzxH6vEC5kjMM7ewsg5rg06o4siR81S1
6rWyWTQyDXsywapra/vFyBUxum3aE/tj50YieSoovb7pKnwsoeiGU9Tzn2PRdlTX
u6LxZnnebsIvlKE2UWRWs82raKzDjTRa9u3HwQ42E8xiI0WYVDs=
=zlOu
-----END PGP SIGNATURE-----
Merge tag 'leds-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds
Pull LED updates from Lee Jones:
"New Support & Features:
- Samsung S2MU005: Add support for the Samsung S2MU005 PMIC which
includes flash and RGB LED controllers
- Texas Instruments:
- LP5812: Add support for the TI LP5812 LED driver
- LP5860: Add support for the Texas Instruments LP5860 LED matrix
driver via SPI
Improvements & Fixes:
- Core:
- Adjust the brightness sysfs node documentation to clarify that
only decimal values are accepted
- Fix a race condition in the software blink logic when stopping
blinking and setting brightness simultaneously
- Introduce the `multi_max_intensity` sysfs attribute for
multicolor LEDs to support hardware-based global brightness
control
- Replace OF-based device lookup with firmware node equivalents
to support ACPI and software nodes
- Return `ENODATA` when reading brightness from
hardware-controlled LEDs
- Set the coherent DMA mask to zero for the Samsung PMIC device
to suppress unnecessary "DMA mask not set" messages
- ams OSRAM AS3668: Fix a Kconfig symbol name mismatch in the
Makefile that prevented the driver from being built
- BlinkM: Fix spelling and comment style issues in the driver
- DAC124S085: Declare the SPI command word as `__le16` to ensure
correct endianness and pass sparse checks
- GPIO Trigger: Use `GPIOD_FLAGS_BIT_NONEXCLUSIVE` to allow sharing
GPIOs between the LED trigger and other drivers
- NXP PCA9532: Fix an issue where the LED would stop blinking when
changing brightness to a non-zero value
- Qualcomm: Unify the user-visible company name to "Qualcomm" across
flash LED config options
- Qualcomm LPG: Optimize memory allocation by combining main
structure and channels into a single allocation using flexible
array members
- Texas Instruments
- LP5860: Add missing `CONFIG_OF` dependency to prevent build
warnings
- TPS6131x: Increase the overvoltage protection threshold to 6V
to avoid false triggers with 5V input supplies
- Userspace LEDs (uLEDs):
- Fix a potential buffer overread by using `strnchr()` for name
string validation
- Return `-EFAULT` on `copy_to_user()` failure to properly handle
read errors
Cleanups & Refactoring:
- Core:
- Convert various `i2c_device_id` arrays to use named
initializers for improved robustness and readability
- Multi-color: Fix incorrect `KernelVersion` and `Date` tags for
the `multi_max_intensity` ABI
- Broadcom BCM63138 / ChromeOS EC: Move `MODULE_DEVICE_TABLE`
declarations next to the ID tables for consistency
- LP5812: Fix a sysfs ABI reference in the documentation
- ST1202: Remove an unused legacy GPIO header include
Device Tree Binding Updates:
- Class: Document the keyboard backlight LED class naming
conventions, including a new scheme for zoned backlights
- Core: Dual-license the common LED bindings header under GPLv2
and BSD-2-Clause
- IR SPI LED: Add a new 30% duty-cycle value for the IR transmitter
used in Xiaomi Redmi Note 8
- Samsung S2M series:
- Document the flash LED device bindings for Samsung S2M series
PMICs
- Document the pattern behavior for Samsung S2M series PMIC RGB
- S2MU005: Add device tree bindings for the S2MU005 PMIC,
including its flash and RGB LED sub-devices
- TI LM3560: Document the TI LM3559 and LM3560 synchronous boost
flash drivers"
* tag 'leds-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds: (30 commits)
leds: tps6131x: Increase overvoltage protection threshold to 6V
leds: Fix sysfs ABI date
leds: Fix CONFIG_OF dependency for LEDS_LP5860_CORE
leds: uleds: Fix potential buffer overread
leds: Use named initializers for arrays of i2c_device_data
leds: uleds: Return -EFAULT on copy_to_user() failure
leds: core: Report ENODATA for brightness of hardware controlled LED
leds: class: Use firmware nodes for device lookup
Documentation: leds: Document pattern behavior of Samsung S2M series PMIC RGB LEDs
leds: rgb: Add support for Samsung S2M series PMIC RGB LED device
leds: flash: Add support for Samsung S2M series PMIC flash LED device
dt-bindings: leds: Document Samsung S2M series PMIC flash LED device
leds: core: Fix race condition for software blink
leds: Adjust documentation of brightness sysfs node
leds: dac124s085: Declare SPI command word as __le16
leds: Introduce the multi_max_intensity sysfs attribute
dt-bindings: leds: Document TI LM3560 Synchronous Boost Flash Driver
leds: bcm63138/cros_ec: Move MODULE_DEVICE_TABLE next to the table itself
leds: Add support for TI LP5860 LED driver chip
Documentation: leds: leds-class: Document keyboard backlight LED class naming
...
- New Support & Features
- Renesas RSMU: Add support for the IDT 8a34002 Clock Matrix
- Samsung S2MU005: Add support for the Samsung S2MU005 PMIC which includes charger,
MUIC, flash and RGB LED controllers
- SpacemiT P1: Add a reboot cell for the SpacemiT P1 chip
- Texas Instruments BQ25792: Add support for the TI BQ25792 charger manager
- Improvements & Fixes
- Core: Unify the user-visible company name to "Qualcomm" across various config
options
- ChromeOS EC: Delay `dev_set_drvdata()` until the probe process has successfully
completed to avoid use-after-free issues
- ChromeOS EC: Prevent adding `cros_ec_ucsi` as an MFD sub-device if it is already
defined in Device Tree or ACPI
- Cirrus Logic CS42L43: Add a sanity check for firmware size to prevent out-of-bounds
memory access during firmware loading
- Cirrus Logic CS5535: Associate the GPIO cell with a dedicated software node to
support board files requesting GPIOs
- Maxim MAX77620: Modernize poweroff handling by converting to the sys-off API
- Qualcomm RPM: Add the missing QDSS clock resource for the MSM8960 SoC
- Renesas RSMU: Fix page register setup for the 8A3400x family by correctly
calculating the page address
- Renesas RZ/MTU3: Make the reset line optional to support newer SoC variants (RZ/T2H,
RZ/N2H)
- Renesas RZ/MTU3: Modernize the driver by using device-managed APIs for reset control
and device addition
- Samsung Core: Set the coherent DMA mask to zero for the Samsung PMIC device to
suppress unnecessary "DMA mask not set" messages
- Silicon Motion SM501: Fix a reference leak on failed device registration by properly
dropping the platform device reference
- Texas Instruments TPS65219: Make poweroff handler registration conditional on the
"system-power-controller" Device Tree property
- Texas Instruments TPS6586x: Fix Device Tree node reference counting by manually
bumping the refcount for sub-devices
- Texas Instruments TPS65910: Add return value checking for the dummy I2C transfer
used to work around silicon erratum SWCZ010
- Texas Instruments TWL4030: Update board-specific checks to use Device Tree
compatibles instead of legacy machine IDs
- Cleanups & Refactoring
- Core: Consistently define `pci_device_id` arrays using named initializers across
various Intel and Silicon Motion drivers
- Maintainers: Shift maintenance of Samsung PMIC drivers to André Draszik
- Maxim MAX77759: Improve code style by reformatting the IRQ table and refining macro
comments
- MEN MENF21BMC / Texas Instruments TWL: Correctly treat `i2c_check_functionality()`
as returning a boolean status
- Rohm BD72720: Drop the non-existent BUCK11 ID to improve code clarity
- Silicon Labs Si476x: Fix various spelling mistakes in driver comments
- Spreadtrum SC27xx: Transition to `devm_mfd_add_devices()` and separate MFD cell
tables for each PMIC model
- Timberdale: Move GPIO pin definitions into the driver and transition to using a
software node for the GPIO cell
- Wolfson WM8994: Remove dead legacy-GPIO code and its associated `irq_gpio` member
- Device Tree Binding Updates
- Aspeed AST2x00: Document the AST2700 SCU0 and add support for its SoC0/SoC1 pin
controllers
- Hisilicon Hi655x: Convert the Hi655x PMIC binding from text format to YAML DT schema
- Khadas MCU: Add a new compatible and fan-supply property for the Khadas VIM4 MCU
- MediaTek MT6397: Add support for the MT6365 PMIC and document regulator supplies for
the MT6359 variant
- Qualcomm TCSR: Add compatibles for Nord and IPQ5210 TCSR blocks
- Renesas RZ/G3L: Revert the addition of the `renesas,r9a08g046-lvds-cmn` compatible
string due to documentation errors
- Samsung S2MU005: Document the S2MU005 PMIC and its sub-devices (charger, MUIC,
flash and RGB LEDs)
- Spreadtrum SC2731: Include regulator bindings for the SC2730 variant
- STMPE: Fix the schema by marking 'compatible' and '#pwm-cells' as required for the
PWM subnode
- Texas Instruments BQ257xx: Expand the BQ25703A binding to include the BQ25792
variant
- Removals
- Motorola EZX PCAP: Remove the unused and non-functional driver for Motorola EZX
phones
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEdrbJNaO+IJqU8IdIUa+KL4f8d2EFAmoylaAACgkQUa+KL4f8
d2HKlw/+LNN6+pdOuvpFd/I+SnMyYnpFH/DMCHBDu7KnOWtn1AVsCAhKy7jz2cmz
8NCtKvPaYcJWvsV+zYw+VPWilgUJ0lU3mRDJ4b8KIRjMv37JYA9xhFrz3pr/MS/Z
z//gGHbWzzKsH9E8BEpbxHOx4kwqI1RiTBS2yV8OuooHpqfp8kg9E5lKW+roP4YQ
VcWkHduywOOkT+PKUjKySFx8qJ7ySskx6RFEVH8Nywu6AmSuNiKOeGtDkKKIGGFe
YL2L19m/In0p0z4aqwqJWpj5sZQ3CSOAMT82k25/ApR7+Aot8lsbWuANbySfr5l/
Yv695XrN01qaXrEmCkk7cpKpzW18QFxVEnfdpCJrZcG1OkfwvfHCcGbZC8ihD/xN
fGkaOP7f9Jx3uoQQX+j1dgU3GJyMPAABxPdrzU2o59mE6UFGUZobepFGWBqYSPCJ
b7P530qhnt8qp0iXKDwpnzt1LhxiAIo0PnZJ2DFDRiZXzl/IOOK0ywgBENu1cebn
gkL3xpA4TMASeHcE8dPCNdYeI6PqRjV0LO80HWG2vGk9nmolW8BnuvtGp4kHroxh
Y37yg9BR67JbTrUfTwFU/U9utqkiY3cTZ8skElff/rsKdysKGBcGXdeCh4dTEQXo
3XNGKb1RRUgiCixjPqQkf+iLWZalr+QY8Z40OmqcDncXQe8t3+o=
=9Igx
-----END PGP SIGNATURE-----
Merge tag 'mfd-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd
Pull MFD updates from Lee Jones:
"New Support & Features:
- Renesas RSMU: Add support for the IDT 8a34002 Clock Matrix
- Samsung S2MU005: Add support for the Samsung S2MU005 PMIC which
includes charger, MUIC, flash and RGB LED controllers
- SpacemiT P1: Add a reboot cell for the SpacemiT P1 chip
- Texas Instruments BQ25792: Add support for the TI BQ25792 charger
manager
Improvements & Fixes:
- Core: Unify the user-visible company name to "Qualcomm" across
various config options
- ChromeOS EC:
- Delay `dev_set_drvdata()` until the probe process has
successfully completed to avoid use-after-free issues
- Prevent adding `cros_ec_ucsi` as an MFD sub-device if it is
already defined in Device Tree or ACPI
- Cirrus Logic CS42L43: Add a sanity check for firmware size to
prevent out-of-bounds memory access during firmware loading
- Cirrus Logic CS5535: Associate the GPIO cell with a dedicated
software node to support board files requesting GPIOs
- Maxim MAX77620: Modernize poweroff handling by converting to the
sys-off API
- Qualcomm RPM: Add the missing QDSS clock resource for the MSM8960
SoC
- Renesas RSMU: Fix page register setup for the 8A3400x family by
correctly calculating the page address
- Renesas RZ/MTU3:
- Make the reset line optional to support newer SoC variants
(RZ/T2H, RZ/N2H)
- Modernize the driver by using device-managed APIs for reset
control and device addition
- Samsung Core: Set the coherent DMA mask to zero for the Samsung
PMIC device to suppress unnecessary "DMA mask not set" messages
- Silicon Motion SM501: Fix a reference leak on failed device
registration by properly dropping the platform device reference
- Texas Instruments:
- TPS65219: Make poweroff handler registration conditional on the
"system-power-controller" Device Tree property
- TPS6586x: Fix Device Tree node reference counting by manually
bumping the refcount for sub-devices
- TPS65910: Add return value checking for the dummy I2C transfer
used to work around silicon erratum SWCZ010
- TWL4030: Update board-specific checks to use Device Tree
compatibles instead of legacy machine IDs
Cleanups & Refactoring:
- Core: Consistently define `pci_device_id` arrays using named
initializers across various Intel and Silicon Motion drivers
- Maintainers: Shift maintenance of Samsung PMIC drivers to André
Draszik
- Maxim MAX77759: Improve code style by reformatting the IRQ table
and refining macro comments
- MEN MENF21BMC / Texas Instruments TWL: Correctly treat
`i2c_check_functionality()` as returning a boolean status
- Rohm BD72720: Drop the non-existent BUCK11 ID to improve code
clarity
- Silicon Labs Si476x: Fix various spelling mistakes in driver
comments
- Spreadtrum SC27xx: Transition to `devm_mfd_add_devices()` and
separate MFD cell tables for each PMIC model
- Timberdale: Move GPIO pin definitions into the driver and
transition to using a software node for the GPIO cell
- Wolfson WM8994: Remove dead legacy-GPIO code and its associated
`irq_gpio` member
Device Tree Binding Updates:
- Aspeed AST2x00: Document the AST2700 SCU0 and add support for its
SoC0/SoC1 pin controllers
- Hisilicon Hi655x: Convert the Hi655x PMIC binding from text format
to YAML DT schema
- Khadas MCU: Add a new compatible and fan-supply property for the
Khadas VIM4 MCU
- MediaTek MT6397: Add support for the MT6365 PMIC and document
regulator supplies for the MT6359 variant
- Qualcomm TCSR: Add compatibles for Nord and IPQ5210 TCSR blocks
- Renesas RZ/G3L: Revert the addition of the
`renesas,r9a08g046-lvds-cmn` compatible string due to documentation
errors
- Samsung S2MU005: Document the S2MU005 PMIC and its sub-devices
(charger, MUIC, flash and RGB LEDs)
- Spreadtrum SC2731: Include regulator bindings for the SC2730
variant
- STMPE: Fix the schema by marking 'compatible' and '#pwm-cells' as
required for the PWM subnode
- Texas Instruments BQ257xx: Expand the BQ25703A binding to include
the BQ25792 variant
Removals:
- Motorola EZX PCAP: Remove the unused and non-functional driver for
Motorola EZX phones"
* tag 'mfd-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (47 commits)
dt-bindings: mfd: syscon: Revert renesas,r9a08g046-lvds-cmn
dt-bindings: mfd: st,stmpe: Add missing properties for PWM subnode
mfd: rz-mtu3: Make reset optional
mfd: rz-mtu3: Store &pdev->dev in local variable
mfd: rz-mtu3: Use local variable for reset
mfd: rz-mtu3: Use device-managed APIs
dt-bindings: mfd: aspeed,ast2x00-scu: Support AST2700 SoC1 pinctrl
mfd: tps6586x: Fix OF node refcount
dt-bindings: mfd: sprd,sc2731: Include SC2730 regulator bindings
mfd: twl4030-power: Update checks for specific boards to use the DT
dt-bindings: mfd: qcom,tcsr: Document the IPQ5210 TCSR block
mfd: qcom_rpm: Add msm8960 QDSS clock resource
mfd: si476x-i2c: Fix spelling mistakes in comments
mfd: max77620: Convert poweroff support to sys-off API
mfd: dt-bindings: mt6397: Add regulator supplies
dt-bindings: mfd: mediatek: mt6397: Add MT6365 PMIC support
dt-bindings: mfd: mediatek: mt6397: Add rtc for MT6359
mfd: cs42l43: Sanity check firmware size
mfd: qcom: Unify user-visible "Qualcomm" name
mfd: cros_ec: Delay dev_set_drvdata() until probe success
...
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEL65usyKPHcrRDEicpmLzj2vtYEkFAmoxq94ACgkQpmLzj2vt
YElr1A//RPXn3om4Sm5QeIcbIFHrdVx6Un8QcXVaNSqL8XUB7yMCbsH+zD7NmWSP
U4wX9bDZ0F8/1gkQh80HuGDEEErSmzAQk8+iE3mhUTXmLmyPn7bgHClMXVmKD1UO
74f6+57RV7Y0Uo/cgna9hLr3kuSCR5+y81f9esWoXSz8j6BNzml6KyCNcNbbnYlk
RmS6c5MJ15KxnY593HKr04jWqC1zs++pdcAOmZF3gnwTf7X+Pl3hgP53jCQeAJqH
AGbXc8N09Nc+JBEJ9zUIgwpU0DwnJRe+/LptIWNGebpSW2/jqfXWabrHjpaXekuX
6hf+/bnkeoIKDQGIAXSFuqEBsP0WofEbAvCix0+QVEz3MBDtsR6/3h3q+/hbNEgJ
KrAO7rEHTEEOKPvYiIwQ6cMPAlNRF178k4Havy2EZaaT8w0v9/eovYRIR1J2H/34
0D7pRb+pyxV0vzuHosa7EKRTTga+8LOwWxLB5lJnG5UhSBUYghihGM6T8pCjBCw5
BuhcVPpGRT6kreOAIR82sUxfOZHcq6g8rj64iHofPNiPlAr/qkehhHGJ2sBLzeMm
CPSmYrI0hwULldRunR9/JBMBC44fzfhoRhcQZE1QaJbRu7KYPMWhRPRR8nNR6oEc
xDnbllexgSya9yAjKZ8mJKb4ywIFUrqpC0xacQmJbZmaXkTX8mI=
=O/MI
-----END PGP SIGNATURE-----
Merge tag 'hid-for-linus-2026061601' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid
Pull HID updates from Jiri Kosina:
"Core:
- semantic cleanup fixes for 'hid_device_id::driver_data' (Pawel
Zalewski)
Multitouch:
- UX improvement fixes for Yoga Book 9 (Dave Carey)
Logitech:
- fix for high resolution scrolling for Logitech HID++ 2.0 devices
(Lauri Saurus)
CP2112:
- fix for cp2112 firmware-based speed configuration, if available
(Danny Kaehn)
Wacom:
- memory corruption and scheduling while atomic and error fixes and
error handling fixes (Jinmo Yang, Myeonghun Pak)
New device support:
- OneXPlayer (Derek J. Clark)
- HORI Wireless Switch Pad (Hector Zelaya)
- Rakk Dasig X (Karl Cayme)
And other assorted small fixes and device ID additions"
* tag 'hid-for-linus-2026061601' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (39 commits)
HID: hidpp: fix potential UAF in hidpp_connect_event()
HID: logitech-hidpp: sync wheel multiplier on wheel mode changes
HID: intel-thc-hid: intel-quickspi: reset touch IC on system resume
HID: uhid: convert to hid_safe_input_report()
HID: hid-goodix-spi: validate report size to prevent stack buffer overflow
HID: nintendo: add support for HORI Wireless Switch Pad
HID: multitouch: Honor ContactCount for Yoga Book 9 to suppress ghost contacts
HID: pidff: Use correct effect type in effect update
HID: wacom: stop hardware after post-start probe failures
HID: core: demote warning to debug level
HID: lenovo: Use KEY_PERFORMANCE capability for ThinkPad X12 Tab Gen 2
HID: lenovo: Add support for ThinkPad X13 Folio keyboard
HID: cp2112: Configure I2C bus speed from firmware
HID: cp2112: Add fwnode support
HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove()
HID: Input: Add battery list cleanup with devm action
HID: logitech-hidpp: remove excess kernel-doc member in hidpp_scroll_counter
HID: wacom: use cleanup.h for wacom_wac_queue_flush() buffer management
HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush()
HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert
...
When reading .config input, Kconfig stores user-provided values first
and then resolves the final value after applying dependencies, ranges,
and other constraints.
If the final value differs from the user input, Kconfig already tracks
that state internally, but it does not provide a focused diagnostic to
show which explicit inputs were adjusted. This is particularly confusing
for requested values that get forced down by unmet dependencies or
clamped by ranges.
Add an opt-in diagnostic controlled by KCONFIG_WARN_CHANGED_INPUT. Emit
the warnings from conf_write() and conf_write_defconfig() after value
resolution. Print the diagnostic to stderr directly, not through the
normal message callback, so it remains visible when conf is run with -s,
such as from make -s.
Keep the diagnostic out of the conf_message() formatting buffer so long
warning lists are not truncated, and mark processed symbols as written
before the SYMBOL_WRITE check so duplicate menu nodes cannot emit
duplicate warnings.
Document the new environment variable and add tests for olddefconfig,
savedefconfig, and the silent-conf path.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Tested-by: Julian Braha <julianbraha@gmail.com>
Link: https://patch.msgid.link/20260611060000.23858-1-pengpeng@iscas.ac.cn
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
When building the kernel with Clang ThinLTO enabled, the compiler
can mangle static variable names by appending suffixes such as
".llvm.<hash>" to prevent naming collisions across translation units.
This name mangling breaks the section mismatch whitelisting in modpost.
modpost relies on glob patterns (e.g., "*_ops" or "*_probe") to identify
safe references between permanent data and initialization code. Because
the LTO suffix modifies the end of the symbol name, legitimately
whitelisted structures fail the match, resulting in false positive
warnings.
For example, a static pernet_operations struct triggers the following:
WARNING: modpost: vmlinux: section mismatch in reference: \
ping_v4_net_ops.llvm.5641696707737373282 (section: .data) -> \
ping_v4_proc_init_net (section: .init.text)
Fix this by ignoring "*_ops.llvm.*" in "from" symbol names (the same
as "*_ops").
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202606111233.kM8oo8Df-lkp@intel.com/
Signed-off-by: Rong Xu <xur@google.com>
Link: https://patch.msgid.link/20260617224623.1346309-1-xur@google.com
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
rpcif_spi_resume() currently passes the SPI controller device to
rpcif_hw_init(), but the function should be called with the RPC
interface device.
Retrieve the rpcif private data from the SPI controller and pass
rpc->dev instead. Also propagate the return value of rpcif_hw_init() so
that a failure during resume is properly reported rather than silently
ignored.
Fixes: ad4728740b ("spi: rpc-if: Add resume support for RZ/G3E")
Signed-off-by: Quang Nguyen <quang.nguyen.wx@renesas.com>
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20260618081932.172168-1-biju.das.jz@bp.renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
pci_host_common_init() is used by several generic ECAM host drivers.
After PCI core changes around pci_flags and preserve_config, these hosts
no longer opted into full bus number reassignment the way they did
before, which broke enumeration of devices on a Marvell CN106XX board.
When PCI_PROBE_ONLY is not set, add PCI_REASSIGN_ALL_BUS so
pci_scan_bridge_extend() takes the reassignment path: bus numbers can be
assigned from firmware EA data (e.g. pci_ea_fixed_busnrs()). Skip the
flag in probe-only mode so existing assignments are not overridden.
Fixes: 7246a4520b ("PCI: Use preserve_config in place of pci_flags")
Closes: https://lore.kernel.org/all/abkqm_LCd9zAM8cW@rkannoth-OptiPlex-7090/
Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com>
[mani: added stable tag]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
[bhelgaas: add problem report link]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Cc: Vidya Sagar <vidyas@nvidia.com>
Link: https://patch.msgid.link/20260414081730.3864372-1-rkannoth@marvell.com
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus
to avoid racing with concurrent rescan or hotplug operations triggered via
sysfs. Such races may lead to use-after-free issues or system crashes.
Signed-off-by: Hans Zhang <18255117159@163.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
[bhelgaas: commit log]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260521161822.132996-8-18255117159@163.com
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus
to avoid racing with concurrent rescan or hotplug operations triggered via
sysfs. Such races may lead to use-after-free issues or system crashes.
Signed-off-by: Hans Zhang <18255117159@163.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
[bhelgaas: commit log]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260521161822.132996-10-18255117159@163.com
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus
to avoid racing with concurrent rescan or hotplug operations triggered via
sysfs. Such races may lead to use-after-free issues or system crashes.
Signed-off-by: Hans Zhang <18255117159@163.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
[bhelgaas: commit log]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260521161822.132996-7-18255117159@163.com
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus
to avoid racing with concurrent rescan or hotplug operations triggered via
sysfs. Such races may lead to use-after-free issues or system crashes.
Signed-off-by: Hans Zhang <18255117159@163.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
[bhelgaas: commit log]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260521161822.132996-6-18255117159@163.com
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus
to avoid racing with concurrent rescan or hotplug operations triggered via
sysfs. Such races may lead to use-after-free issues or system crashes.
Signed-off-by: Hans Zhang <18255117159@163.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
[bhelgaas: commit log]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260521161822.132996-3-18255117159@163.com
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus
to avoid racing with concurrent rescan or hotplug operations triggered via
sysfs. Such races may lead to use-after-free issues or system crashes.
Signed-off-by: Hans Zhang <18255117159@163.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
[bhelgaas: commit log]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260521161822.132996-2-18255117159@163.com
Hold the pci_rescan_remove_lock lock while stopping and removing a root bus
to avoid racing with concurrent rescan or hotplug operations triggered via
sysfs. Such races may lead to use-after-free issues or system crashes.
Signed-off-by: Hans Zhang <18255117159@163.com>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
[bhelgaas: commit log]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260521161822.132996-5-18255117159@163.com
