Commit graph

1,426,898 commits

Author SHA1 Message Date
Danilo Krummrich
db22fbc15a gpu: nova-core: fw: get rid of redundant Result in GspFirmware::new()
In GspFirmware::new(), utilize pin_init_scope() to get rid of the Result
in the returned

	Result<impl PinInit<T, Error>>

which is unnecessarily redundant.

Reviewed-by: Joel Fernandes <joelagnelf@nvidia.com>
Link: https://patch.msgid.link/20251218155239.25243-2-dakr@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2025-12-29 17:54:31 +01:00
Haotian Zhang
03f336a869 PCI: endpoint: Add missing NULL check for alloc_workqueue()
alloc_workqueue() can return NULL on memory allocation failure. Without
proper error checking, this may lead to a NULL pointer dereference when
queue_work() is later called with the NULL workqueue pointer in
epf_ntb_epc_init().

Add a NULL check immediately after alloc_workqueue() and return -ENOMEM on
failure to prevent the driver from loading with an invalid workqueue
pointer.

Fixes: e35f56bb03 ("PCI: endpoint: Support NTB transfer between RC and EP")
Fixes: 8b821cf761 ("PCI: endpoint: Add EP function driver to provide NTB functionality")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20251110040446.2065-1-vulab@iscas.ac.cn
2025-12-29 10:36:37 -06:00
Wei Fang
a48e232210 net: stmmac: fix the crash issue for zero copy XDP_TX action
There is a crash issue when running zero copy XDP_TX action, the crash
log is shown below.

[  216.122464] Unable to handle kernel paging request at virtual address fffeffff80000000
[  216.187524] Internal error: Oops: 0000000096000144 [#1]  SMP
[  216.301694] Call trace:
[  216.304130]  dcache_clean_poc+0x20/0x38 (P)
[  216.308308]  __dma_sync_single_for_device+0x1bc/0x1e0
[  216.313351]  stmmac_xdp_xmit_xdpf+0x354/0x400
[  216.317701]  __stmmac_xdp_run_prog+0x164/0x368
[  216.322139]  stmmac_napi_poll_rxtx+0xba8/0xf00
[  216.326576]  __napi_poll+0x40/0x218
[  216.408054] Kernel panic - not syncing: Oops: Fatal exception in interrupt

For XDP_TX action, the xdp_buff is converted to xdp_frame by
xdp_convert_buff_to_frame(). The memory type of the resulting xdp_frame
depends on the memory type of the xdp_buff. For page pool based xdp_buff
it produces xdp_frame with memory type MEM_TYPE_PAGE_POOL. For zero copy
XSK pool based xdp_buff it produces xdp_frame with memory type
MEM_TYPE_PAGE_ORDER0. However, stmmac_xdp_xmit_back() does not check the
memory type and always uses the page pool type, this leads to invalid
mappings and causes the crash. Therefore, check the xdp_buff memory type
in stmmac_xdp_xmit_back() to fix this issue.

Fixes: bba2556efa ("net: stmmac: Enable RX via AF_XDP zero-copy")
Signed-off-by: Wei Fang <wei.fang@nxp.com>
Reviewed-by: Hariprasad Kelam <hkelam@marvell.com>
Link: https://patch.msgid.link/20251204071332.1907111-1-wei.fang@nxp.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-12-29 17:35:36 +01:00
Marco Crivellari
0d325cbdc5 PCI: endpoint: Replace use of system_wq with system_percpu_wq
Currently work items enqueued by schedule_delayed_work() use "system_wq" (a
per-CPU wq) while queue_delayed_work() uses WORK_CPU_UNBOUND (used when a
CPU is not specified). The same applies to schedule_work() that is using
system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND.  This
lack of consistency cannot be addressed without refactoring the API.

This continues the effort to refactor workqueue APIs, which began with the
introduction of new workqueues and a new alloc_workqueue() flag in:

  128ea9f6cc ("workqueue: Add system_percpu_wq and system_dfl_wq")
  930c2ea566 ("workqueue: Add new WQ_PERCPU flag")

Replace system_wq with system_percpu_wq, keeping the same behavior.  The
old wq (system_wq) will be kept for a few release cycles.

Suggested-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Marco Crivellari <marco.crivellari@suse.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20251105151649.256274-1-marco.crivellari@suse.com
2025-12-29 10:33:22 -06:00
Marco Crivellari
78f5d0d5a2 PCI: Add WQ_PERCPU to alloc_workqueue() users
Currently work items enqueued by schedule_delayed_work() use "system_wq" (a
per-CPU wq), while queue_delayed_work() uses WORK_CPU_UNBOUND (used when a
CPU is not specified). The same applies to schedule_work() that is using
system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND.  This
lack of consistency cannot be addressed without refactoring the API.

alloc_workqueue() treats all queues as per-CPU by default, while unbound
workqueues must opt-in via WQ_UNBOUND.

This default is suboptimal: most workloads benefit from unbound queues,
allowing the scheduler to place worker threads where they're needed and
reducing noise when CPUs are isolated.

This continues the effort to refactor workqueue APIs, which began with the
introduction of new workqueues and a new alloc_workqueue() flag in:

  128ea9f6cc ("workqueue: Add system_percpu_wq and system_dfl_wq")
  930c2ea566 ("workqueue: Add new WQ_PERCPU flag")

Add WQ_PERCPU to explicitly request alloc_workqueue() to be per-CPU when
WQ_UNBOUND has not been specified.

With the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND),
any alloc_workqueue() caller that doesn't explicitly specify WQ_UNBOUND
must now use WQ_PERCPU.

Once migration is complete, WQ_UNBOUND can be removed and unbound will
become the implicit default.

Suggested-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Marco Crivellari <marco.crivellari@suse.com>
[bhelgaas: squash similar commits]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20251107142526.234685-1-marco.crivellari@suse.com
Link: https://patch.msgid.link/20251107142835.237636-1-marco.crivellari@suse.com
Link: https://patch.msgid.link/20251107143108.240025-1-marco.crivellari@suse.com
Link: https://patch.msgid.link/20251107143335.242342-1-marco.crivellari@suse.com
Link: https://patch.msgid.link/20251107143624.244978-1-marco.crivellari@suse.com
2025-12-29 10:18:02 -06:00
Paolo Abeni
a6694b7e39 Various fixes all over, most are recent regressions but
also some long-standing issues:
 
  - cfg80211:
     - fix an issue with overly long SSIDs
 
  - mac80211:
     - long-standing beacon protection issue on some devices
     - for for a multi-BSSID AP-side issue
     - fix a syzbot warning on OCB (not really used in practice)
     - remove WARN on connections using disabled channels,
       as that can happen due to changes in the disable flag
     - fix monitor mode list iteration
 
  - iwlwifi:
     - fix firmware loading on certain (really old) devices
     - add settime64 to PTP clock to avoid a warning and clock
       registration failure, but it's not actually supported
 
  - rtw88:
     - remove WQ_UNBOUND since it broke USB adapters
       (because it can't be used with WQ_BH)
     - fix SDIO issues with certain devices
 
  - rtl8192cu: fix TID array out-of-bounds (since 6.9)
 
  - wlcore (TI): add missing skb push headroom increase
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEpeA8sTs3M8SN2hR410qiO8sPaAAFAmlDDm8ACgkQ10qiO8sP
 aABxLQ/8D/ZDTy8caVoOIrR2SiF6OxeNMjy9hapRXxD9YozeiWMjS0gspKeQQQsV
 uOGrbNGpF+DilxXsKGShh7kH2dpDhI01C+ikPCqJJKvWp5F02Bbiq6lIxm4ibQjM
 gzSmUJmov/NjiY0E4hV/h2cClmRyccDdlRyTDiP+KiPhOH9ijZuxE3HCZXt7oroD
 bK6M15I0F8gwr9L282efVMVwoE2aDhOHALgU4NtM3NY6r7cwfweVOZYmM6wy2anp
 Hi4aXmc3K2xWLO6xscQyofbvVDWRizIF0ZRhWdcs4581yHDUCYrWyNlaL/g4UAu8
 Dorf2ZLsv8eWQBSSQiL2ae4hQGeG34ODrbSCOLfZx8jwPMZ0UvwE17vXj8kDx637
 GbZCU/Sfot6mcWrIW0lhjRPD4M+Wsllt12Ku2XpGn0x7IGYwySnXRykWc2ITJOWH
 DHwm4Jid7a4m+je3tZLrkPcccibUA7j+anTO5UGe6BIuiUp/GaI7HXwXKijVY8iC
 wk2Lj3kmwfWAJSNQ7TGWyPgqRGI4GM4vQ9mYjumKpDeHIV7XjX1hEqkaYodX3Wmk
 nuOSiYJubjr4NG8DRlosvJEVYvLPtKfPV2MaDjW7rHt1oBtoY5sgFTtrlOf30D2X
 sOfYqDffOe2WLvwwDUIJwf2ANbNzRgp2R3ltnf4srYrzfxz4O+s=
 =3fsX
 -----END PGP SIGNATURE-----

Merge tag 'wireless-2025-12-17' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless

Johannes Berg says:

====================
Various fixes all over, most are recent regressions but
also some long-standing issues:

 - cfg80211:
    - fix an issue with overly long SSIDs

 - mac80211:
    - long-standing beacon protection issue on some devices
    - for for a multi-BSSID AP-side issue
    - fix a syzbot warning on OCB (not really used in practice)
    - remove WARN on connections using disabled channels,
      as that can happen due to changes in the disable flag
    - fix monitor mode list iteration

 - iwlwifi:
    - fix firmware loading on certain (really old) devices
    - add settime64 to PTP clock to avoid a warning and clock
      registration failure, but it's not actually supported

 - rtw88:
    - remove WQ_UNBOUND since it broke USB adapters
      (because it can't be used with WQ_BH)
    - fix SDIO issues with certain devices

 - rtl8192cu: fix TID array out-of-bounds (since 6.9)

 - wlcore (TI): add missing skb push headroom increase

* tag 'wireless-2025-12-17' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:
  wifi: iwlwifi: Implement settime64 as stub for MVM/MLD PTP
  wifi: iwlwifi: Fix firmware version handling
  wifi: mac80211: ocb: skip rx_no_sta when interface is not joined
  wifi: mac80211: do not use old MBSSID elements
  wifi: mac80211: don't WARN for connections on invalid channels
  wifi: wlcore: ensure skb headroom before skb_push
  wifi: cfg80211: sme: store capped length in __cfg80211_connect_result()
  wifi: mac80211: fix list iteration in ieee80211_add_virtual_monitor()
  wifi: mac80211: Discard Beacon frames to non-broadcast address
  Revert "wifi: rtw88: add WQ_UNBOUND to alloc_workqueue users"
  wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc()
  wifi: rtw88: limit indirect IO under powered off for RTL8822CS
====================

Link: https://patch.msgid.link/20251217201441.59876-3-johannes@sipsolutions.net
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-12-29 17:04:01 +01:00
Anshumali Gaur
85f4b0c650 octeontx2-pf: fix "UBSAN: shift-out-of-bounds error"
This patch ensures that the RX ring size (rx_pending) is not
set below the permitted length. This avoids UBSAN
shift-out-of-bounds errors when users passes small or zero
ring sizes via ethtool -G.

Fixes: d45d897984 ("octeontx2-pf: Add basic ethtool support")
Signed-off-by: Anshumali Gaur <agaur@marvell.com>
Link: https://patch.msgid.link/20251219062226.524844-1-agaur@marvell.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-12-29 16:46:19 +01:00
Denis Benato
6a02651c4c
platform/x86: asus-armoury: fix ppt data for FA507R
PPT data for FA507R was reported to be wrong by a user:
change limits to make them equal to Armoury Crate limits.

Fixes: 39ae6c50e5 ("platform/x86: asus-armoury: add ppt_* and nv_* tuning knobs")
Signed-off-by: Denis Benato <denis.benato@linux.dev>
Link: https://patch.msgid.link/20251229150755.1351495-1-denis.benato@linux.dev
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2025-12-29 17:41:21 +02:00
Brendan Jackman
4992ed7813 Documentation/x86: Fix PR_SET_SPECULATION_CTRL error codes
If you force-disable mitigations on the kernel cmdline, for SPEC_STORE_BYPASS
this ends up with the prctl returning -ENXIO, but contrary to the current docs
for the other controls it returns -EPERM. Fix that.

Note that this return value should probably be considered a bug. But, making
the behaviour consistent with the current docs seems more likely to break
existing users than help anyone out in practice, so just "fix" it by
specifying it as correct.

Since this is getting more wordy and confusing, also be more explicit about
"control is not possible" be mentioning the boot configuration, to better
distinguish this case conceptually from the FORCE_DISABLE failure mode.

Signed-off-by: Brendan Jackman <jackmanb@google.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://patch.msgid.link/20251111-b4-prctl-docs-2-v2-1-bc9d14ec9662@google.com
2025-12-29 16:27:45 +01:00
Alok Tiwari
66e245db16
platform/x86/intel/pmt/discovery: use valid device pointer in dev_err_probe
The PMT feature probe creates a child device with device_create().
If device creation fail, the code pass priv->dev (which is an ERR_PTR)
to dev_err_probe(), which is not a valid device pointer.

This patch change the dev_err_probe() call to use the parent auxiliary
device (&auxdev->dev) and update the error message to reference the
parent device name. It ensure correct error reporting and avoid
passing an invalid device pointer.

Fixes: d9a0788093 ("platform/x86/intel/pmt: Add PMT Discovery driver")
Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Link: https://patch.msgid.link/20251224095133.115678-1-alok.a.tiwari@oracle.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2025-12-29 17:22:44 +02:00
Tingmao Wang
ef4536f152
landlock: Improve the comment for domain_is_scoped
Currently it is not obvious what "scoped" mean, and the fact that the
function returns true when access should be denied is slightly surprising
and in need of documentation.

Cc: Tahera Fahimi <fahimitahera@gmail.com>
Signed-off-by: Tingmao Wang <m@maowtm.org>
Link: https://lore.kernel.org/r/06393bc18aee5bc278df5ef31c64a05b742ebc10.1766885035.git.m@maowtm.org
[mic: Fix formatting and improve consistency]
Signed-off-by: Mickaël Salaün <mic@digikod.net>
2025-12-29 16:19:39 +01:00
Tingmao Wang
55dc93a7c2
selftests/landlock: Use scoped_base_variants.h for ptrace_test
ptrace_test.c currently contains a duplicated version of the
scoped_domains fixture variants.  This patch removes that and make it use
the shared scoped_base_variants.h instead, like in
scoped_abstract_unix_test and scoped_signal_test.

This required renaming the hierarchy fixture to scoped_domains, but the
test is otherwise the same.

Cc: Tahera Fahimi <fahimitahera@gmail.com>
Signed-off-by: Tingmao Wang <m@maowtm.org>
Link: https://lore.kernel.org/r/48148f0134f95f819a25277486a875a6fd88ecf9.1766885035.git.m@maowtm.org
Signed-off-by: Mickaël Salaün <mic@digikod.net>
2025-12-29 16:19:39 +01:00
Tingmao Wang
7aa593d8fb
selftests/landlock: Fix missing semicolon
Add missing semicolon after EXPECT_EQ(0, close(stream_server_child)) in
the scoped_vs_unscoped test.  I suspect currently it's just not executing
the close statement after the line, but this causes no observable
difference.

Fixes: fefcf0f7cf ("selftests/landlock: Test abstract UNIX socket scoping")
Cc: Tahera Fahimi <fahimitahera@gmail.com>
Signed-off-by: Tingmao Wang <m@maowtm.org>
Link: https://lore.kernel.org/r/d9e968e4cd4ecc9bf487593d7b7220bffbb3b5f5.1766885035.git.m@maowtm.org
Signed-off-by: Mickaël Salaün <mic@digikod.net>
2025-12-29 16:19:38 +01:00
Tingmao Wang
14c00e30d3
selftests/landlock: Fix typo in fs_test
Signed-off-by: Tingmao Wang <m@maowtm.org>
Link: https://lore.kernel.org/r/62d18e06eeb26f62bc49d24c4467b3793c5ba32b.1766885035.git.m@maowtm.org
Signed-off-by: Mickaël Salaün <mic@digikod.net>
2025-12-29 16:19:38 +01:00
Mickaël Salaün
602acfb541
landlock: Optimize stack usage when !CONFIG_AUDIT
Until now, each landlock_request struct were allocated on the stack, even
if not really used, because is_access_to_paths_allowed() unconditionally
modified the passed references.  Even if the changed landlock_request
variables are not used, the compiler is not smart enough to detect this
case.

To avoid this issue, explicitly disable the related code when
CONFIG_AUDIT is not set, which enables elision of log_request_parent*
and associated caller's stack variables thanks to dead code elimination.
This makes it possible to reduce the stack frame by 32 bytes for the
path_link and path_rename hooks, and by 20 bytes for most other
filesystem hooks.

Here is a summary of scripts/stackdelta before and after this change
when CONFIG_AUDIT is disabled:

  current_check_refer_path    560  320  -240
  current_check_access_path   328  184  -144
  hook_file_open              328  184  -144
  is_access_to_paths_allowed  376  360  -16

Also, add extra pointer checks to be more future-proof.

Cc: Günther Noack <gnoack@google.com>
Reported-by: Tingmao Wang <m@maowtm.org>
Closes: https://lore.kernel.org/r/eb86863b-53b0-460b-b223-84dd31d765b9@maowtm.org
Fixes: 2fc80c69df ("landlock: Log file-related denials")
Link: https://lore.kernel.org/r/20251219142302.744917-2-mic@digikod.net
Reviewed-by: Günther Noack <gnoack3000@gmail.com>
[mic: Improve stack usage measurement accuracy with scripts/stackdelta]
Signed-off-by: Mickaël Salaün <mic@digikod.net>
2025-12-29 16:19:35 +01:00
Christophe JAILLET
9e371032cb null_blk: Constify struct configfs_item_operations and configfs_group_operations
'struct configfs_item_operations' and 'configfs_group_operations' are not
modified in this driver.

Constifying these structures moves some data to a read-only section, so
increases overall security, especially when the structure holds some
function pointers.

On a x86_64, with allmodconfig:
Before:
======
   text	   data	    bss	    dec	    hex	filename
 100263	  37808	   2752	 140823	  22617	drivers/block/null_blk/main.o

After:
=====
   text	   data	    bss	    dec	    hex	filename
 100423	  37648	   2752	 140823	  22617	drivers/block/null_blk/main.o

Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-12-29 08:19:15 -07:00
Brendan Shephard
255153afbc drm/nova: Align GEM memory allocation to system page size
Use page::page_align for GEM object memory allocation to ensure the
allocation is page aligned. This is important on systems where the
default page size is not 4k. Such as 16k or 64k aarch64 systems.

This change uses the updated page_align() function which returns
Option<usize> for overflow safety. (See "rust: Return Option from
page_align and ensure no usize overflow").

Signed-off-by: Brendan Shephard <bshephar@bne-home.net>
Link: https://patch.msgid.link/20251215083416.266469-1-bshephar@bne-home.net
[ Import page module only. - Danilo ]
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2025-12-29 15:43:20 +01:00
Brendan Shephard
f91ffed95c rust: Return Option from page_align and ensure no usize overflow
Change `page_align()` to return `Option<usize>` to allow validation
of the provided `addr` value. This ensures that any value that is
within one `PAGE_SIZE` of `usize::MAX` will not panic, and instead
returns `None` to indicate overflow.

Signed-off-by: Brendan Shephard <bshephar@bne-home.net>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: Alexandre Courbot <acourbot@nvidia.com>
Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com>
Link: https://patch.msgid.link/20251223055647.9761-1-bshephar@bne-home.net
[ Use kernel vertical style for imports; use markdown in comments.
  - Danilo ]
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2025-12-29 15:32:53 +01:00
Chen Ni
0923a618a7 RAS/AMD/ATL: Remove an unneeded semicolon
Remove an unneeded semicolon. No functional changes.

Detected by Coccinelle.

Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://patch.msgid.link/20240701072118.846277-1-nichen@iscas.ac.cn
2025-12-29 15:30:02 +01:00
Shawn Lin
68ac85fb42 PCI: dwc: Use cfg0_base as iMSI-RX target address to support 32-bit MSI devices
commit f3a296405b ("PCI: dwc: Strengthen the MSI address allocation
logic") strengthened the iMSI-RX target address allocation logic to handle
64-bit addresses for platforms without 32-bit DMA addresses. However, it
still left 32-bit MSI capable endpoints (EPs) non-functional on such
platforms.

Per DWC databook r6.21a, sec 3.10.2.3, it states:
"The iMSI-RX is programmed with an address (MSI_CTRL_ADDR_OFF and
MSI_CTRL_UPPER_ADDR_OFF) that is used as the system MSI address. When an
inbound MWr request is passed to the AXI bridge and matches this address
as well as the conditions specified for an MSI memory write request, an
MSI interrupt is detected. When this MWr is about to be driven onto the
AXI bridge master interface1, it is dropped and never appears on the AXI
bus."

Since iMSI-RX MSI_CTRL_ADDR doesn't require actual system memory mapping,
any 32-bit address that won't be used for BAR memory allocations can be
assigned. So assign cfg0_base to the iMSI-RX target address as the first
option if it's a 32-bit address, which satisfies this requirement.
Otherwise, fallback to the existing coherent allocation.

cc: Ajay Agarwal <ajayagarwal@google.com>
cc: Will McVicker <willmcvicker@google.com>
Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
[mani: trimmed the description to exclude testbed info and used imperative tone]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/1766540332-24235-1-git-send-email-shawn.lin@rock-chips.com
2025-12-29 19:29:48 +05:30
Andy Shevchenko
c18bde8570 auxdisplay: arm-charlcd: Remove redundant ternary operators
For ternary operators in the form of a ? true : false, if a itself returns
a boolean result, the ternary operator can be omitted. Remove redundant
ternary operators to clean up the code.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2025-12-29 14:52:19 +01:00
Andy Shevchenko
548d6800fa auxdisplay: arm-charlcd: Join string literals back
For easy grepping on debug purposes join string literals back in
the messages.

No functional change.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2025-12-29 14:52:19 +01:00
Andy Shevchenko
b7eda5634e auxdisplay: arm-charlcd: Use readl_poll_timeout
Use readl_poll_timeout_atomic() from <iopoll.h> instead of using
custom poll loops.

The timeout settings are different, but that shouldn't be much of a
problem. Instead of polling 10 times in a close loop, it polls for
one millisecond.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2025-12-29 14:52:19 +01:00
Andy Shevchenko
de2248f7a4 auxdisplay: arm-charlcd: Don't use "proxy" headers
Update header inclusions to follow IWYU (Include What You Use) principle.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2025-12-29 14:52:18 +01:00
Andy Shevchenko
c77851631c auxdisplay: arm-charlcd: drop of_match_ptr()
The general recommendation is to not use of_match_ptr(). Drop it.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2025-12-29 14:52:18 +01:00
Junrui Luo
e44c42c830
platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing
The hp_populate_*_elements_from_package() functions in the hp-bioscfg
driver contain out-of-bounds array access vulnerabilities.

These functions parse ACPI packages into internal data structures using
a for loop with index variable 'elem' that iterates through
enum_obj/integer_obj/order_obj/password_obj/string_obj arrays.

When processing multi-element fields like PREREQUISITES and
ENUM_POSSIBLE_VALUES, these functions read multiple consecutive array
elements using expressions like 'enum_obj[elem + reqs]' and
'enum_obj[elem + pos_values]' within nested loops.

The bug is that the bounds check only validated elem, but did not consider
the additional offset when accessing elem + reqs or elem + pos_values.

The fix changes the bounds check to validate the actual accessed index.

Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Reported-by: Junrui Luo <moonafterrain@outlook.com>
Fixes: e6c7b3e155 ("platform/x86: hp-bioscfg: string-attributes")
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Link: https://patch.msgid.link/SYBPR01MB788173D7DD4EA2CB6383683DAFB0A@SYBPR01MB7881.ausprd01.prod.outlook.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2025-12-29 15:42:53 +02:00
Konstantin Komarov
099ef9ab92
fs/ntfs3: implement iomap-based file operations
This patch modifies the ntfs3 driver by replacing the buffer_head-based
operations with the iomap ones.

Implementation details:
- Implements core iomap operations (ntfs_iomap_begin/end) for block mapping:
    Proper handling of resident attributes via IOMAP_INLINE.
    Support for sparse files through IOMAP_HOLE semantics.
    Correct unwritten extent handling for zeroing operations.
- Replaces custom implementations with standardized iomap helpers:
    Converts buffered reads to use iomap_read_folio and iomap_readahead.
    Implements iomap_file_buffered_write for write operations.
    Uses iomap_dio_rw for direct I/O paths.
    Migrates zero range operations to iomap_zero_range.
- Preserves special handling paths for compressed files
- Implements proper EOF/valid data size management during writes

Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
2025-12-29 13:33:32 +00:00
Szymon Wilczek
e37a75bb86
fs/ntfs3: fix deadlock in ni_read_folio_cmpr
Syzbot reported a task hung in ni_readpage_cmpr (now ni_read_folio_cmpr).
This is caused by a lock inversion deadlock involving the inode mutex
(ni_lock) and page locks.

Scenario:
1. Task A enters ntfs_read_folio() for page X. It acquires ni_lock.
2. Task A calls ni_read_folio_cmpr(), which attempts to lock all pages in
   the compressed frame (including page Y).
3. Concurrently, Task B (e.g., via readahead) has locked page Y and
   calls ntfs_read_folio().
4. Task B waits for ni_lock (held by A).
5. Task A waits for page Y lock (held by B).
   -> DEADLOCK.

The fix is to restructure locking: do not take ni_lock in ntfs_read_folio().
Instead, acquire ni_lock inside ni_read_folio_cmpr() ONLY AFTER all required
page locks for the frame have been successfully acquired. This restores the
correct lock ordering (Page Lock -> ni_lock) consistent with VFS.

Reported-by: syzbot+5af33dd272b913b65880@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=5af33dd272b913b65880
Fixes: f35590ee26 ("fs/ntfs3: remove ntfs_bio_pages and use page cache for compressed I/O")
Signed-off-by: Szymon Wilczek <swilczek.lx@gmail.com>
[almaz.alexandrovich@paragon-software.com: ni_readpage_cmpr was renamed to ni_read_folio_cmpr]
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
2025-12-29 13:33:31 +00:00
Konstantin Komarov
c613269677
fs/ntfs3: implement llseek SEEK_DATA/SEEK_HOLE by scanning data runs
The generic llseek implementation does not understand ntfs data runs,
sparse regions, or compression semantics, and therefore cannot correctly
locate data or holes in files.

Add a filesystem-specific llseek handler that scans attribute data runs
to find the next data or hole starting at the given offset. Handle
resident attributes, sparse runs, compressed holes, and the implicit hole
at end-of-file.

Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
2025-12-29 13:33:31 +00:00
Konstantin Komarov
356fa24816
fs/ntfs3: zero-fill folios beyond i_valid in ntfs_read_folio()
Handle ntfs_read_folio() early when the folio offset is beyond i_valid
by zero-filling the folio and marking it uptodate. This avoids needless
I/O and locking, improves read performance.

Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
2025-12-29 13:33:30 +00:00
Konstantin Komarov
576248a34b
fs/ntfs3: handle attr_set_size() errors when truncating files
If attr_set_size() fails while truncating down, the error is silently
ignored and the inode may be left in an inconsistent state.

Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
2025-12-29 13:33:30 +00:00
Konstantin Komarov
3a6aba7f3c
fs/ntfs3: drop preallocated clusters for sparse and compressed files
Do not keep preallocated clusters for sparsed and compressed files.
Preserving preallocation in these cases causes fsx failures when running
with sparse files and preallocation enabled.

Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
2025-12-29 13:33:29 +00:00
Konstantin Komarov
dcd9d6a471
fs/ntfs3: fsync files by syncing parent inodes
Some xfstests expect fsync() on a file or directory to also persist
directory metadata up the parent chain. Using generic_file_fsync() is not
sufficient for ntfs, because parent directories are not explicitly
written out.

Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
2025-12-29 13:33:19 +00:00
Chris J Arges
377cae9851 ima: Fix stack-out-of-bounds in is_bprm_creds_for_exec()
KASAN reported a stack-out-of-bounds access in ima_appraise_measurement
from is_bprm_creds_for_exec:

BUG: KASAN: stack-out-of-bounds in ima_appraise_measurement+0x12dc/0x16a0
 Read of size 1 at addr ffffc9000160f940 by task sudo/550
The buggy address belongs to stack of task sudo/550
and is located at offset 24 in frame:
  ima_appraise_measurement+0x0/0x16a0
This frame has 2 objects:
  [48, 56) 'file'
  [80, 148) 'hash'

This is caused by using container_of on the *file pointer. This offset
calculation is what triggers the stack-out-of-bounds error.

In order to fix this, pass in a bprm_is_check boolean which can be set
depending on how process_measurement is called. If the caller has a
linux_binprm pointer and the function is BPRM_CHECK we can determine
is_check and set it then. Otherwise set it to false.

Fixes: 95b3cdafd7 ("ima: instantiate the bprm_creds_for_exec() hook")

Signed-off-by: Chris J Arges <carges@cloudflare.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
2025-12-29 08:28:50 -05:00
Andy Shevchenko
a8f4a4fb34 auxdisplay: arm-charlcd: Remove unneeded info message
When probe succeeds we have other means to check if it was successful,
no need to pollute kernel log with the practically duplicated info.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2025-12-29 14:27:56 +01:00
Andy Shevchenko
483d86cf4b auxdisplay: arm-charlcd: convert to use device managed APIs
The current probe function of the driver is implemented by using
plain old APIs. As Geert noted, one of the error paths has a mistake
that may lead to a wrong call. Instead of targeting that particular
issue, convert the driver to use device managed APIs altogether.
It's not needed per se (driver can never be removed once loaded),
but it simplifies coding and error handling.

Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Closes: https://lore.kernel.org/r/CAMuHMdVquNEoxRQkcBEH0nC+CDuib6o0H6m3CBk3ZN2267LpQw@mail.gmail.com
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
2025-12-29 14:27:55 +01:00
Chancel Liu
4e6c3b68c1 arm64: dts: imx93-14x14-evk: Add audio XCVR sound card
Add audio XCVR sound card, which supports SPDIF TX & RX only,
eARC RX, ARC RX are not supported.

Signed-off-by: Chancel Liu <chancel.liu@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29 21:16:56 +08:00
Chancel Liu
adee0d6614 arm64: dts: imx93-14x14-evk: Add bt-sco sound card support
Add bt-sco sound card, which is used by BT HFP case.
It supports wb profile as default.

Signed-off-by: Chancel Liu <chancel.liu@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29 21:16:56 +08:00
Vitor Soares
15599306fb arm64: dts: freescale: imx95-toradex-smarc: fix SMARC_SDIO_WP label position
Fix the SMARC_SDIO_WP gpio-line-name position. It should be on line 15
of som_gpio_expander_1, not line 17.

Fixes: 90bbe88e0e ("arm64: dts: freescale: add Toradex SMARC iMX95")
Signed-off-by: Vitor Soares <vitor.soares@toradex.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29 21:13:44 +08:00
Vitor Soares
466798368e arm64: dts: freescale: imx95-toradex-smarc: use edge trigger for ethphy1 interrupt
Change the PHY interrupt trigger type from IRQ_TYPE_LEVEL_LOW to
IRQ_TYPE_EDGE_FALLING to match the PCA9745 GPIO expander hardware
capabilities and avoid emulated level detection.

Fixes: 90bbe88e0e ("arm64: dts: freescale: add Toradex SMARC iMX95")
Signed-off-by: Vitor Soares <vitor.soares@toradex.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29 21:13:43 +08:00
Dmitry Baryshkov
9915bc977b ARM: multi_v7_defconfig: enable DA9052 and MC13XXX
Enable PMICs used on i.MX53 Quick-Start Boards: DA9052 for i.MX53 QSB
and MC13XXX for i.MX53 QSRB (it has Freescale MC34708 PMIC).

Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29 21:11:45 +08:00
Yilin Chen
3691fd19cc rust: device_id: replace incorrect word in safety documentation
The safety documentation incorrectly refers to `RawDeviceId` when
transmuting to `RawType`. This fixes the documentation to correctly
indicate that implementers must ensure layout compatibility with
`RawType`, not `RawDeviceId`.

Fixes: 9b90864bb4 ("rust: implement `IdArray`, `IdTable` and `RawDeviceId`")
Signed-off-by: Yilin Chen <1479826151@qq.com>
Link: https://patch.msgid.link/tencent_C18DD5047749311142ED455779C7CCCF3A08@qq.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2025-12-29 14:09:18 +01:00
Laurentiu Mihalcea
e00ac93be0 arm64: dts: imx8ulp: add sim lpav node
Add DT node for the SIM LPAV module.

Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Laurentiu Mihalcea <laurentiu.mihalcea@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29 21:09:12 +08:00
Haibo Chen
a4f7357d53 arm64: dts: imx943-evk: add flexcan support
Add flexcan2 and flexcan4, and related phys support.

Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29 21:05:40 +08:00
Daniel Schultz
fb617c00e4 arm64: dts: imx8mm: Add label to thermal-zones
Add 'thermal_zones' as a label to the thermal-zones node.

Without this label, it is not possible to add additional
trip points in board files. For example, to add an active
trip point for controlling a fan.

Signed-off-by: Daniel Schultz <d.schultz@phytec.de>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29 21:04:41 +08:00
Rogerio Pimentel
bb5b318f11 arm64: dts: add support for NXP i.MX8MP FRDM board
The FRDM-i.MX8MP is an NXP development platform based on the i.MX8M Plus
SoC, featuring a quad Cortex-A53, Cortex-M7 co-processor, 4GB LPDDR4,
32GB eMMC, Wi-Fi 6/Bluetooth 5.4/802.15.4 tri-radio, Ethernet, HDMI/MIPI
display interfaces, camera connectors, and standard expansion headers.

Based on the device tree found in the NXP repository at github
https://github.com/nxp-imx-support/meta-imx-frdm and on imx8mp-evk
board kernel mainline device tree.

This is a basic device tree supporting:

 - Quad Cortex-A53
 - 4GB LPDDR4 DRAM
 - PCA9450C PMIC with regulators
 - Two NXP PCAL6416 GPIO expanders
 - RGB LEDs via GPIO expander
 - I2C1, I2C2, I2C3 controllers
 - UART2 (console) and UART3 (with RTS/CTS)
 - USDHC3 (8-bit eMMC)
 - SNVS power key (onboard power button)

Co-developed-by: Xiaofeng Wei <xiaofeng.wei@nxp.com>
Signed-off-by: Xiaofeng Wei <xiaofeng.wei@nxp.com>
Signed-off-by: Rogerio Pimentel <rpimentel.silva@gmail.com>
Acked-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29 21:04:41 +08:00
Alexander Stein
7834d199a7 arm64: dts: tqma8xxs-mb-smarc-2: replace 0 with IMX_LPCG_CLK_0 for lpcg indices
Replace the 0 with IMX_LPCG_CLK_0 for LPCG clock indices. Although the
numerical value is identical, the LPCG input is defined as
IMX_LPCG_CLK_<n>, so using the symbolic constant improves clarity and
consistency with the LPCG clock naming convention.

Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29 21:04:41 +08:00
Alexander Stein
81c6b6ffbd arm64: dts: tqma8xxs: replace 0 with IMX_LPCG_CLK_0 for lpcg indices
Replace the 0 with IMX_LPCG_CLK_0 for LPCG clock indices. Although the
numerical value is identical, the LPCG input is defined as
IMX_LPCG_CLK_<n>, so using the symbolic constant improves clarity and
consistency with the LPCG clock naming convention.

Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29 21:04:41 +08:00
Frank Li
4ea67ed403 arm64: dts: imx8qxp-mek: Add sensors under i2c1 bus
Add sensors under i2c1 bus.

Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29 21:04:41 +08:00
Frank Li
92ecc94b27 arm64: dts: mba8xx: replace 0 with IMX_LPCG_CLK_0 for lpcg indices
Replace the 0 with IMX_LPCG_CLK_0 for LPCG clock indices. Although the
numerical value is identical, the LPCG input is defined as
IMX_LPCG_CLK_<n>, so using the symbolic constant improves clarity and
consistency with the LPCG clock naming convention.

Signed-off-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
2025-12-29 21:04:41 +08:00