syzbot triggered a warning[1] about the number of mdb entries in a context.
It turned out that there are multiple ways to trigger that warning today
(some got added during the years), the root cause of the problem is that
the increase is done conditionally, and over the years these different
conditions increased so there were new ways to trigger the warning, that is
to do a decrease which wasn't paired with a previous increase.
For example one way to trigger it is with flush:
$ ip l add br0 up type bridge vlan_filtering 1 mcast_snooping 1
$ ip l add dumdum up master br0 type dummy
$ bridge mdb add dev br0 port dumdum grp 239.0.0.1 permanent vid 1
$ ip link set dev br0 down
$ ip link set dev br0 type bridge mcast_vlan_snooping 1
^^^^ this will enable snooping, but will not update mdb_n_entries
because in __br_multicast_enable_port_ctx() we check !netif_running
$ bridge mdb flush dev br0
^^^ this will trigger the warning because it will delete the pg which
we added above, which will try to decrease mdb_n_entries
Fix the problem by removing the conditional increase and always keep the
count up-to-date while the vlan exists. In order to do that we have to
first initialize it on port-vlan context creation, and then always increase
or decrease the value regardless of mcast options. To keep the current
behaviour we have to enforce the mdb limit only if the context is port's or
if the port-vlan's mcast snooping is enabled.
[1]
------------[ cut here ]------------
n == 0
WARNING: net/bridge/br_multicast.c:718 at br_multicast_port_ngroups_dec_one net/bridge/br_multicast.c:718 [inline], CPU#0: syz.4.4607/22043
WARNING: net/bridge/br_multicast.c:718 at br_multicast_port_ngroups_dec net/bridge/br_multicast.c:771 [inline], CPU#0: syz.4.4607/22043
WARNING: net/bridge/br_multicast.c:718 at br_multicast_del_pg+0x1bbe/0x1e20 net/bridge/br_multicast.c:825, CPU#0: syz.4.4607/22043
Modules linked in:
CPU: 0 UID: 0 PID: 22043 Comm: syz.4.4607 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
RIP: 0010:br_multicast_port_ngroups_dec_one net/bridge/br_multicast.c:718 [inline]
RIP: 0010:br_multicast_port_ngroups_dec net/bridge/br_multicast.c:771 [inline]
RIP: 0010:br_multicast_del_pg+0x1bbe/0x1e20 net/bridge/br_multicast.c:825
Code: 41 5f 5d e9 04 7a 48 f7 e8 3f 73 5c f7 90 0f 0b 90 e9 cf fd ff ff e8 31 73 5c f7 90 0f 0b 90 e9 16 fd ff ff e8 23 73 5c f7 90 <0f> 0b 90 e9 60 fd ff ff e8 15 73 5c f7 eb 05 e8 0e 73 5c f7 48 8b
RSP: 0018:ffffc9000c207220 EFLAGS: 00010293
RAX: ffffffff8a68042d RBX: ffff88807c6f1800 RCX: ffff888066e90000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffff888066e90000 R09: 000000000000000c
R10: 000000000000000c R11: 0000000000000000 R12: ffff8880303ef800
R13: dffffc0000000000 R14: ffff888050eb11c4 R15: 1ffff1100a1d6238
FS: 00007fa45921b6c0(0000) GS:ffff8881256f5000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa4591f9ff8 CR3: 0000000081df2000 CR4: 00000000003526f0
Call Trace:
<TASK>
br_mdb_flush_pgs net/bridge/br_mdb.c:1525 [inline]
br_mdb_flush net/bridge/br_mdb.c:1544 [inline]
br_mdb_del_bulk+0x5e2/0xb20 net/bridge/br_mdb.c:1561
rtnl_mdb_del+0x48a/0x640 net/core/rtnetlink.c:-1
rtnetlink_rcv_msg+0x77e/0xbe0 net/core/rtnetlink.c:6967
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
____sys_sendmsg+0xa68/0xad0 net/socket.c:2592
___sys_sendmsg+0x2a5/0x360 net/socket.c:2646
__sys_sendmsg net/socket.c:2678 [inline]
__do_sys_sendmsg net/socket.c:2683 [inline]
__se_sys_sendmsg net/socket.c:2681 [inline]
__x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2681
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa45839aeb9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa45921b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fa458615fa0 RCX: 00007fa45839aeb9
RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000004
RBP: 00007fa458408c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa458616038 R14: 00007fa458615fa0 R15: 00007fff0b59fae8
</TASK>
Fixes: b57e8d870d ("net: bridge: Maintain number of MDB entries in net_bridge_mcast_port")
Reported-by: syzbot+d5d1b7343531d17bd3c5@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/aYrWbRp83MQR1ife@debil/T/#t
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: Nikolay Aleksandrov <nikolay@nvidia.com>
Link: https://patch.msgid.link/20260213070031.1400003-2-nikolay@nvidia.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
The sysfb_primary_display structure is now part of efi-init.c but
conditionally defined. One of the users is missing in the condition:
aarch64-linux-ld: drivers/video/fbdev/core/fbmon.o: in function `fb_firmware_edid':
fbmon.c:(.text.fb_firmware_edid+0x3c): undefined reference to `sysfb_primary_display'
Export it whenever CONFIG_FIRMWARE_EDID is set, so the fbdev core
code can use it.
Fixes: 4fcae63588 ("sysfb: Move edid_info into sysfb_primary_display")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202602111543.Do4nkY5l-lkp@intel.com/
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Commit 8c14f9c703 ("ARCNET: add com20020 PCI IDs with metadata")
converted the com20020-pci driver to use a card info structure instead
of a single flag mask in driver_data. However, it failed to take into
account that in the original code, driver_data of 0 indicates a card
with no special flags, not a card that should not have any card info
structure. This introduced a null pointer dereference when cards with
no flags were probed.
Commit bd6f1fd5d3 ("net: arcnet: com20020: Fix null-ptr-deref in
com20020pci_probe()") then papered over this issue by rejecting cards
with no driver_data instead of resolving the problem at its source.
Fix the original issue by introducing a new card info structure for
2.5Mbit cards that does not set any flags and using it if no
driver_data is present.
Fixes: 8c14f9c703 ("ARCNET: add com20020 PCI IDs with metadata")
Fixes: bd6f1fd5d3 ("net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe()")
Cc: stable@vger.kernel.org
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Link: https://patch.msgid.link/20260213045510.32368-1-enelsonmoore@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Commit 3db6e0d172 ("rds: use RCU to synchronize work-enqueue with
connection teardown") modifies rds_sendmsg to avoid enqueueing work
while a tear down is in progress. However, it also changed the return
value of rds_sendmsg to that of rds_send_xmit instead of the
payload_len. This means the user may incorrectly receive errno values
when it should have simply received a payload of 0 while the peer
attempts a reconnections. So this patch corrects the teardown handling
code to only use the out error path in that case, thus restoring the
original payload_len return value.
Fixes: 3db6e0d172 ("rds: use RCU to synchronize work-enqueue with connection teardown")
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Allison Henderson <achender@kernel.org>
Link: https://patch.msgid.link/20260213035409.1963391-1-achender@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
A malicious or buggy Xen guest can write "0" to the xenbus key
"multi-queue-num-queues". The connect() function in the backend only
validates the upper bound (requested_num_queues > xenvif_max_queues)
but not zero, allowing requested_num_queues=0 to reach
vzalloc(array_size(0, sizeof(struct xenvif_queue))), which triggers
WARN_ON_ONCE(!size) in __vmalloc_node_range().
On systems with panic_on_warn=1, this allows a guest-to-host denial
of service.
The Xen network interface specification requires
the queue count to be "greater than zero".
Add a zero check to match the validation already present
in xen-blkback, which has included this
guard since its multi-queue support was added.
Fixes: 8d3d53b3e4 ("xen-netback: Add support for multiple queues")
Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
Reviewed-by: Juergen Gross <jgross@suse.com>
Link: https://patch.msgid.link/20260212224040.86674-1-n7l8m4@u.northwestern.edu
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
catc_probe() fills three URBs with hardcoded endpoint pipes without
verifying the endpoint descriptors:
- usb_sndbulkpipe(usbdev, 1) and usb_rcvbulkpipe(usbdev, 1) for TX/RX
- usb_rcvintpipe(usbdev, 2) for interrupt status
A malformed USB device can present these endpoints with transfer types
that differ from what the driver assumes.
Add a catc_usb_ep enum for endpoint numbers, replacing magic constants
throughout. Add usb_check_bulk_endpoints() and usb_check_int_endpoints()
calls after usb_set_interface() to verify endpoint types before use,
rejecting devices with mismatched descriptors at probe time.
Similar to
- commit 90b7f29617 ("net: usb: rtl8150: enable basic endpoint checking")
which fixed the issue in rtl8150.
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Suggested-by: Simon Horman <horms@kernel.org>
Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
Link: https://patch.msgid.link/20260212214154.3609844-1-n7l8m4@u.northwestern.edu
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
When deleting a peer in case of keepalive expiration, the peer is
removed from the OpenVPN hashtable and is temporary inserted in a
"release list" for further processing.
This happens in:
ovpn_peer_keepalive_work()
unlock_ovpn(release_list)
This processing includes detaching from the socket being used to
talk to this peer, by restoring its original proto and socket
ops/callbacks.
In case of TCP it may happen that, while the peer is sitting in
the release list, userspace decides to close the socket.
This will result in a concurrent execution of:
tcp_close(sk)
__tcp_close(sk)
sock_orphan(sk)
sk_set_socket(sk, NULL)
The last function call will set sk->sk_socket to NULL.
When the releasing routine is resumed, ovpn_tcp_socket_detach()
will attempt to dereference sk->sk_socket to restore its original
ops member. This operation will crash due to sk->sk_socket being NULL.
Fix this race condition by testing-and-accessing
sk->sk_socket atomically under sk->sk_callback_lock.
Link: https://lore.kernel.org/netdev/176996279620.3109699.15382994681575380467@eldamar.lan/
Link: https://github.com/OpenVPN/ovpn-net-next/issues/29
Signed-off-by: Antonio Quartulli <antonio@openvpn.net>
Fixes: 11851cbd60 ("ovpn: implement TCP transport")
Link: https://patch.msgid.link/20260212213130.11497-1-antonio@openvpn.net
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
* set sk_user_data before installing callbacks, to avoid dropping early
packets
* fix use-after-free in ovpn_net_xmit when accessing shared skbs that
got released
* fix TX bytes stats by adding-up every positively processed GSO
segment
-----BEGIN PGP SIGNATURE-----
iJEEABYIADkWIQQKU153ubb5unbkl6Gx/ZpNW1HNdwUCaY3n+RsUgAAAAAAEAA5t
YW51MiwyLjUrMS4xMSwyLDIACgkQsf2aTVtRzXflQAEAoU7xhL/j06/Ibbs0W34+
vUe6oJgbcY9ubQleW/7pjRMA/3Cj1cR0Ubo9vEPqjd4abPgz8dACLVRsZ7suRoHo
/+UO
=/iwu
-----END PGP SIGNATURE-----
Merge tag 'ovpn-net-20260212' of https://github.com/OpenVPN/ovpn-net-next
Antonio Quartulli says:
====================
This batch includes the following fixes:
* set sk_user_data before installing callbacks, to avoid dropping early
packets
* fix use-after-free in ovpn_net_xmit when accessing shared skbs that
got released
* fix TX bytes stats by adding-up every positively processed GSO
segment
====================
Link: https://patch.msgid.link/20260212210340.11260-1-antonio@openvpn.net
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Bobby Eshleman says:
====================
eth: fbnic: fix and improve header/data split configuration
This series fixes TCP HDS configuration in the fbnic driver and adds a
devmem selftest for the intended behavior.
The issues fixed include setting the correct CSR for EN_HDR_SPLIT,
adjusting the hds threshold clamp to avoid long headers overflowing into
the payload page, and configuring the device to use L4/L3/L2 header
boundaries when present by programming the DMA hint bit unconditionally
for all steering rule types.
Prior to these fixes, small payloads fail devmem.check_rx_hds().
Testing:
IFC0=enp1s0
IFC1=eth0
export REMOTE_TYPE=netns
export REMOTE_ARGS=ns-remote
export NETIF=$IFC0
export LOCAL_V4=192.0.3.1
export REMOTE_V4=192.0.3.2
sysctl -w net.ipv6.conf.$IFC0.keep_addr_on_down=1
./tools/testing/selftests/drivers/net/hw/devmem.py
TAP version 13
1..4
ok 1 devmem.check_rx
ok 2 devmem.check_tx
ok 3 devmem.check_tx_chunks
ok 4 devmem.check_rx_hds
To: Alexander Duyck <alexanderduyck@fb.com>
To: Jakub Kicinski <kuba@kernel.org>
To: kernel-team@meta.com
To: Andrew Lunn <andrew+netdev@lunn.ch>
To: David S. Miller <davem@davemloft.net>
To: Eric Dumazet <edumazet@google.com>
To: Paolo Abeni <pabeni@redhat.com>
To: Mohsin Bashir <mohsin.bashr@gmail.com>
To: Shuah Khan <shuah@kernel.org>
Cc: netdev@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: linux-kselftest@vger.kernel.org
Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com>
====================
Link: https://patch.msgid.link/20260211-fbnic-tcp-hds-fixes-v1-0-55d050e6f606@meta.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Add check_rx_hds test that verifies header/data split works across
payload sizes. The test sweeps payload sizes from 1 byte to 8KB, if any
data propagates up to userspace as SCM_DEVMEM_LINEAR, then the test
fails. This shows that regardless of payload size, ncdevmem's
configuration of hds-thresh to 0 is respected.
Add -L (--fail-on-linear) flag to ncdevmem that causes the receiver to
fail if any SCM_DEVMEM_LINEAR cmsg is received.
Use socat option for fixed block sizing and tcp nodelay to disable
nagle's algo to avoid buffering.
Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com>
Link: https://patch.msgid.link/20260211-fbnic-tcp-hds-fixes-v1-4-55d050e6f606@meta.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
fbnic always advertises ETHTOOL_TCP_DATA_SPLIT_ENABLED via ethtool
.get_ringparam. To enable proper splitting for all flow types, even for
IP/Ethernet flows, this patch sets DMA_HINT_L4 unconditionally for all
RSS and NFC flow steering rules. According to the spec, L4 falls back to
L3 if no valid L4 is found, and L3 falls back to L2 if no L3 is found.
This makes sure that the correct header boundary is used regardless of
traffic type. This is important for zero-copy use cases where we must
ensure that all ZC packets are split correctly.
Fixes: 2b30fc01a6 ("eth: fbnic: Add support for HDS configuration")
Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com>
Link: https://patch.msgid.link/20260211-fbnic-tcp-hds-fixes-v1-3-55d050e6f606@meta.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Increase FBNIC_HDR_BYTES_MIN from 128 to 256 bytes. The previous minimum
was too small to guarantee that very long L2+L3+L4 headers always fit
within the header buffer. When EN_HDR_SPLIT is disabled and a packet
exceeds MAX_HEADER_BYTES, splitting occurs at that byte offset instead
of the header boundary, resulting in some of the header landing in the
payload page. The increased minimum ensures headers always fit with the
MAX_HEADER_BYTES cut off and land in the header page.
Fixes: 2b30fc01a6 ("eth: fbnic: Add support for HDS configuration")
Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com>
Acked-by: Mohsin Bashir <mohsin.bashr@gmail.com>
Link: https://patch.msgid.link/20260211-fbnic-tcp-hds-fixes-v1-2-55d050e6f606@meta.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Fix EN_HDR_SPLIT configuration by writing the field to RDE_CTL0 instead
of RDE_CTL1.
Because drop mode configuration and header splitting enablement both use
RDE_CTL0, we consolidate these configurations into the single function
fbnic_config_drop_mode.
Fixes: 2b30fc01a6 ("eth: fbnic: Add support for HDS configuration")
Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com>
Acked-by: Mohsin Bashir <mohsin.bashr@gmail.com>
Link: https://patch.msgid.link/20260211-fbnic-tcp-hds-fixes-v1-1-55d050e6f606@meta.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reset all counters, tasks and vruntime_head list on restart.
Signed-off-by: David Carlier <devnexen@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
fcg_read_stats() had a VLA allocating 21 * nr_cpus * 8 bytes on the
stack, risking stack overflow on large CPU counts (nr_cpus can be up
to 512).
Fix by using a single heap allocation with the correct size, reusing
it across all stat indices, and freeing it at the end.
Signed-off-by: David Carlier <devnexen@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Stefano reports that after commit 62089b8048 ("kbuild: rpm-pkg:
Generate debuginfo package manually"), building with an rpm package
using rpm 4.20.0 fails with:
RPM build errors:
Dependency tokens must begin with alpha-numeric, '_' or '/': #�) = 0x0d000002
Dependency tokens must begin with alpha-numeric, '_' or '/': �) = 0x0d000000
Dependency tokens must begin with alpha-numeric, '_' or '/': ) = 0x7c0e000000
Unknown rich dependency op 'Hat': (Red Hat 15.2.1-7)) = 0x3130363230322000
Unknown rich dependency op 'Hat': (Red Hat 15.2.1-7)) = 0x4728203a43434800
Unknown rich dependency op 'Hat': (Red Hat 15.2.1-7)) = 0x3130363230322000
Unknown rich dependency op 'Hat': (Red Hat 15.2.1-7)) = 0x4728203a43434800
This error comes from the automatic requirements feature of rpm. The
-debuginfo subpackage has no dependencies, so disable this feature with
'AutoReq: 0' for this subpackage, avoiding the error. This matches the
official %_debug_template macro that rpm provides. While automatic
provides should be default enabled, be explicit like %_debug_template
does.
Additionally, while in the area, add the manual debug information
package to the Development/Debug group, further aligning with
%_debug_template.
Cc: stable@vger.kernel.org
Fixes: 62089b8048 ("kbuild: rpm-pkg: Generate debuginfo package manually")
Reported-by: Stefano Garzarella <sgarzare@redhat.com>
Closes: https://lore.kernel.org/CAGxU2F7FFNgb781_A7a1oL63n9Oy8wsyWceKhUpeZ6mLk=focw@mail.gmail.com/
Tested-by: Stefano Garzarella <sgarzare@redhat.com>
Link: https://patch.msgid.link/20260216-improve-manual-debuginfo-template-v1-1-e584b3f8d3be@kernel.org
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
It's quite possible that opcodes that have payloads attached to them,
like IORING_OP_OPENAT/OPENAT2 or IORING_OP_SOCKET, that these paylods
can change over time. For example, on the openat/openat2 side, the
struct open_how argument is extensible, and could be extended in the
future to allow further arguments to be passed in.
Allow registration of a cBPF filter to give the size of the filter as
seen by userspace. If that filter is for an opcode that takes extra
payload data, allow it if the application payload expectation is the
same size than the kernels. If that is the case, the kernel supports
filtering on the payload that the application expects. If the size
differs, the behavior depends on the IO_URING_BPF_FILTER_SZ_STRICT flag:
1) If IO_URING_BPF_FILTER_SZ_STRICT is set and the size expectation
differs, fail the attempt to load the filter.
2) If IO_URING_BPF_FILTER_SZ_STRICT isn't set, allow the filter if
the userspace pdu size is smaller than what the kernel offers.
3) Regardless if IO_URING_BPF_FILTER_SZ_STRICT, fail loading the filter
if the userspace pdu size is bigger than what the kernel supports.
An attempt to load a filter due to sizing will error with -EMSGSIZE.
For that error, the registration struct will have filter->pdu_size
populated with the pdu size that the kernel uses.
Reported-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Rather than open-code this logic in io_uring_populate_bpf_ctx() with
a switch, move it to the issue side definitions. Outside of making this
easier to extend in the future, it's also a prep patch for using the
pdu size for a given opcode filter elsewhere.
Signed-off-by: Jens Axboe <axboe@kernel.dk>
-----BEGIN PGP SIGNATURE-----
iQFPBAABCAA5FiEEe7vIQRWZI0iWSE3xu+CwddJFiJoFAmmTRqgbFIAAAAAABAAO
bWFudTIsMi41KzEuMTEsMiwyAAoJELvgsHXSRYiaUboIAIQRGZNZLzAD04PpEwDe
LP3g1iI6DytfzHkcqkf+cV1OHpsKZjKUDY8xw42L3ztktzD83W6ypSzQBz1opnUx
5w7N8EoE/GtY+pbOgBwGi7rvwg2i0+IkCdt9R8VpKa5fmwcgWcIpNtp0XRdWjWTb
pn04sRTHiNHlMZxdVHVAmlxgcC/8SNBHi4w5KJtDUrq+bkZUS3XAN2ssU3oKBpMy
OxhZw7BwfIO7PbBLFTrGQNPjfDU6IL7q8p7T6JcLyugPmqbvzAk07fDOs6GBFPBt
jc1wZvC8h32y7WnWqA4rU+g06jXb088B71IywpxzUSIyPs0rfGy/eEtdEOBWrqIT
5o8=
=dulw
-----END PGP SIGNATURE-----
Merge tag 'slab-for-7.0-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab
Pull more slab updates from Vlastimil Babka:
- Two stable fixes for kmalloc_nolock() usage from NMI context (Harry
Yoo)
- Allow kmalloc_nolock() allocations to be freed with kfree() and thus
also kfree_rcu() and simplify slabobj_ext handling - we no longer
need to track how it was allocated to use the matching freeing
function (Harry Yoo)
* tag 'slab-for-7.0-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab:
mm/slab: drop the OBJEXTS_NOSPIN_ALLOC flag from enum objext_flags
mm/slab: allow freeing kmalloc_nolock()'d objects using kfree[_rcu]()
mm/slab: use prandom if !allow_spin
mm/slab: do not access current->mems_allowed_seq if !allow_spin
By having them share the same space in struct io_cancel_data, it ends up
disallowing IORING_ASYNC_CANCEL_FD|IORING_ASYNC_CANCEL_USERDATA from
working. Eg you cannot match on both a file and user_data for
cancelation purposes. This obviously isn't a common use case as nobody
has reported this, but it does result in -ENOENT potentially being
returned when trying to match on both, rather than actually doing what
the API says it would.
Fixes: 4bf94615b8 ("io_uring: allow IORING_OP_ASYNC_CANCEL with 'fd' key")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Please consider pulling these changes from the signed vfs-7.0-rc1.misc.2 tag.
Thanks!
Christian
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCaZMOCwAKCRCRxhvAZXjc
oswrAP9r1zjzMimjX2J0hBoMnYjNzQfLLew8+IRygImQ+yaqWgD9Fiw/cQ9eE1Hm
TMLqck/ky588ywSDaBzfztrXAY3ISgg=
=4yr2
-----END PGP SIGNATURE-----
Merge tag 'vfs-7.0-rc1.misc.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull more misc vfs updates from Christian Brauner:
"Features:
- Optimize close_range() from O(range size) to O(active FDs) by using
find_next_bit() on the open_fds bitmap instead of linearly scanning
the entire requested range. This is a significant improvement for
large-range close operations on sparse file descriptor tables.
- Add FS_XFLAG_VERITY file attribute for fs-verity files, retrievable
via FS_IOC_FSGETXATTR and file_getattr(). The flag is read-only.
Add tracepoints for fs-verity enable and verify operations,
replacing the previously removed debug printk's.
- Prevent nfsd from exporting special kernel filesystems like pidfs
and nsfs. These filesystems have custom ->open() and ->permission()
export methods that are designed for open_by_handle_at(2) only and
are incompatible with nfsd. Update the exportfs documentation
accordingly.
Fixes:
- Fix KMSAN uninit-value in ovl_fill_real() where strcmp() was used
on a non-null-terminated decrypted directory entry name from
fscrypt. This triggered on encrypted lower layers when the
decrypted name buffer contained uninitialized tail data.
The fix also adds VFS-level name_is_dot(), name_is_dotdot(), and
name_is_dot_dotdot() helpers, replacing various open-coded "." and
".." checks across the tree.
- Fix read-only fsflags not being reset together with xflags in
vfs_fileattr_set(). Currently harmless since no read-only xflags
overlap with flags, but this would cause inconsistencies for any
future shared read-only flag
- Return -EREMOTE instead of -ESRCH from PIDFD_GET_INFO when the
target process is in a different pid namespace. This lets userspace
distinguish "process exited" from "process in another namespace",
matching glibc's pidfd_getpid() behavior
Cleanups:
- Use C-string literals in the Rust seq_file bindings, replacing the
kernel::c_str!() macro (available since Rust 1.77)
- Fix typo in d_walk_ret enum comment, add porting notes for the
readlink_copy() calling convention change"
* tag 'vfs-7.0-rc1.misc.2' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
fs: add porting notes about readlink_copy()
pidfs: return -EREMOTE when PIDFD_GET_INFO is called on another ns
nfsd: do not allow exporting of special kernel filesystems
exportfs: clarify the documentation of open()/permission() expotrfs ops
fsverity: add tracepoints
fs: add FS_XFLAG_VERITY for fs-verity files
rust: seq_file: replace `kernel::c_str!` with C-Strings
fs: dcache: fix typo in enum d_walk_ret comment
ovl: use name_is_dot* helpers in readdir code
fs: add helpers name_is_dot{,dot,_dotdot}
ovl: Fix uninit-value in ovl_fill_real
fs: reset read-only fsflags together with xflags
fs/file: optimize close_range() complexity from O(N) to O(Sparse)
Please consider pulling these changes from the signed kernel-7.0-rc1.misc tag.
Thanks!
Christian
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCaZL+JwAKCRCRxhvAZXjc
ovU/AP4xgVxEegnNYrXZ+TpdCXbCtQZ54JqowFX73MBtaBHY1QD/YkDaIzl6K70v
d9P2Fe8Y6wOnIHxcjE4MIdMansphjAM=
=TN3q
-----END PGP SIGNATURE-----
Merge tag 'kernel-7.0-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull pidfs updates from Christian Brauner:
- pid: introduce task_ppid_vnr() helper
- pidfs: convert rb-tree to rhashtable
Mateusz reported performance penalties during task creation because
pidfs uses pidmap_lock to add elements into the rbtree. Switch to an
rhashtable to have separate fine-grained locking and to decouple from
pidmap_lock moving all heavy manipulations outside of it
Also move inode allocation outside of pidmap_lock. With this there's
nothing happening for pidfs under pidmap_lock
- pid: reorder fields in pid_namespace to reduce false sharing
- Revert "pid: make __task_pid_nr_ns(ns => NULL) safe for zombie
callers"
- ipc: Add SPDX license id to mqueue.c
* tag 'kernel-7.0-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs:
pid: introduce task_ppid_vnr() helper
pidfs: implement ino allocation without the pidmap lock
Revert "pid: make __task_pid_nr_ns(ns => NULL) safe for zombie callers"
pid: reorder fields in pid_namespace to reduce false sharing
pidfs: convert rb-tree to rhashtable
ipc: Add SPDX license id to mqueue.c
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
iEYEABECAAYFAmmTFjgACgkQ+iyteGJfRspirQCg1WlYh7sMQCS9zX2lXguYY1+9
qKsAn27lMglOgT/4pn8q215Z1YgVcNrW
=qZ12
-----END PGP SIGNATURE-----
Merge tag 'linux-watchdog-6.20-rc1' of git://www.linux-watchdog.org/linux-watchdog
Pull watchdog updates from Wim Van Sebroeck:
- iTCO: Drop vendor support
- s3c2410_wdt: Drop S3C2410 support
- Convert mpc8xxx-wdt to YAML
- Several small fixes and improvements
* tag 'linux-watchdog-6.20-rc1' of git://www.linux-watchdog.org/linux-watchdog:
dt-bindings: watchdog: qcom-wdt: Document Glymur watchdog
dt-bindings: watchdog: Convert mpc8xxx-wdt to YAML
dt-bindings: watchdog: samsung-wdt: Split if:then: and constrain more
dt-bindings: watchdog: samsung-wdt: Drop S3C2410
watchdog: s3c2410_wdt: Drop S3C2410 support
dt-bindings: watchdog: samsung-wdt: Define cluster constraints top-level
watchdog: rzv2h_wdt: Discard pm_runtime_put() return value
watchdog: rz: Discard pm_runtime_put() return values
watchdog: Make API functions const correct
watchdog: imx7ulp_wdt: handle the nowayout option
watchdog: sbsa: Update the W_IIDR Implementer bit mask to 0xFFF
watchdog: Always return time left until watchdog times out
watchdog: iTCO: Drop vendor support
watchdog: starfive-wdt: Fix PM reference leak in probe error path
fix it87_wdt early reboot by reporting running timer
- New Support & Features
* Add support for the TI LP5812 4x3 matrix RGB LED driver, including autonomous animation engine
control and extensive scan multiplexing modes.
* Add a new driver for the ams Osram AS3668 4-channel I2C LED controller.
* Extend the is31fl32xx driver to support the is31fl3293 variant, which features 3 channels and
12-bit PWM resolution.
- Improvements & Fixes
* Prevent the ExpressWire KTD2801 chip from entering an undefined state by disabling interrupts
during time-sensitive communication.
* Ensure the Qualcomm LPG driver detects hardware write failures by checking the return value of
regmap_bulk_write() during LUT programming.
* Fix kernel-doc warnings in the lm3692x driver by documenting missing struct members and
standardizing the comment style.
* Update the ExpressWire library to use fsleep() and unexport internal-only functions.
* Improve the is31fl32xx driver by reordering code to eliminate unnecessary forward declarations.
- Cleanups & Refactoring
* Simplify the LP55XX common LED driver by utilizing the for_each_available_child_of_node_scoped()
macro for more concise node iteration.
- Device Tree Bindings Updates
* Add new YAML bindings for the TI LP5860 and LP5812 LED controllers, and the ams Osram AS3668.
* Convert the TI LM3697 white LED driver binding to DT schema format.
* Allow multicolor LED nodes to be named with numeric suffixes (e.g., multi-led-0) to handle
multiple instances without unit addresses.
* Document support for the PMH0101 variant in the Qualcomm LPG PWM and SPMI Flash LED bindings.
* Add the issi,is31fl3293 compatible string to the is31fl32xx binding.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEdrbJNaO+IJqU8IdIUa+KL4f8d2EFAmmN1yEACgkQUa+KL4f8
d2Fk8w/+NbgkKGY/B8j7f78Tlriy9QvZLXFVwj7SvlKBgMWlH2WwaEEfj7qTQntr
ZheZsY9eU1rAT78zCOuPLIRujLSCurVSaX77YWKvgl3/j3KVC9jHkEA0ShftNGeL
RXR0/dnzrPhfyrRLpIXvBY4QPHG4/CBpxhdvYsaxQ0+0Jl6jN262xdPS4MZjNJB/
MPM01Bo3bXMUE3i8feiGUNqMe0yitHRqw8yfNEUo4nBnOkmT0WbGnatW/ifiWos8
3q+XQDgj36eU9uCnTiXLbT/YMGPC4ZvZxy96MaCLWnGabaVE4XWwtHCzKoHdXpCG
6g8FcAapg2XK+iNqmThbFjIhzk048bIQkDNuM/FGTUNsi7gUDODfAWbT133pB/gx
v8moBUNo9csFCctM4BI4Is/xkmzrEzQQK3OQ7KZw1XymoC66vi0cc6mCzetwevAM
08TTQmtlDdQGFHFrBNWvx0AXwe8uHDv154lE7taEx5d2by+eBi1Eh5nCum4346N0
0jssEjwT78eFuwAV0pZW5rHvH5kchKnoWfTS+zpuPSUKTW5jTkUBoVcywu/YTm0e
X1EkxJxZ/fQJvcL79QSqKnex1jXFC/a+D/81+piJZrQajkGFeutBQ28Wh0ka/n0j
AjyxNAob5nGt65az7bpG26LIcXpXfdTwlmcKA3q5rOU4u0dmvsI=
=IyMQ
-----END PGP SIGNATURE-----
Merge tag 'leds-next-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds
Pull LED updates from Lee Jones:
"New Support & Features:
- Add support for the TI LP5812 4x3 matrix RGB LED driver, including
autonomous animation engine control and extensive scan multiplexing
modes
- Add a new driver for the ams Osram AS3668 4-channel I2C LED
controller
- Extend the is31fl32xx driver to support the is31fl3293 variant,
which features 3 channels and 12-bit PWM resolution
Improvements & Fixes:
- Prevent the ExpressWire KTD2801 chip from entering an undefined
state by disabling interrupts during time-sensitive communication
- Ensure the Qualcomm LPG driver detects hardware write failures by
checking the return value of regmap_bulk_write() during LUT
programming
- Fix kernel-doc warnings in the lm3692x driver by documenting
missing struct members and standardizing the comment style
- Update the ExpressWire library to use fsleep() and unexport
internal-only functions
- Improve the is31fl32xx driver by reordering code to eliminate
unnecessary forward declarations
Cleanups & Refactoring:
- Simplify the LP55XX common LED driver by utilizing the
for_each_available_child_of_node_scoped() macro for more concise
node iteration
Device Tree Bindings Updates:
- Add new YAML bindings for the TI LP5860 and LP5812 LED controllers,
and the ams Osram AS3668
- Convert the TI LM3697 white LED driver binding to DT schema format
- Allow multicolor LED nodes to be named with numeric suffixes (e.g.,
multi-led-0) to handle multiple instances without unit addresses
- Document support for the PMH0101 variant in the Qualcomm LPG PWM
and SPMI Flash LED bindings
- Add the issi,is31fl3293 compatible string to the is31fl32xx
binding"
* tag 'leds-next-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds:
dt-bindings: leds: Convert ti,lm3697 to DT schema
leds: as3668: Driver for the ams Osram 4-channel i2c LED driver
dt-bindings: leds: Add new as3668 support
docs: leds: Document TI LP5812 LED driver
leds: Add basic support for TI/National Semiconductor LP5812 LED Driver
leds: qcom-lpg: Check the return value of regmap_bulk_write()
dt-bindings: leds: qcom,spmi-flash-led: Add PMH0101 compatible
dt-bindings: leds: leds-qcom-lpg: Add support for PMH0101 PWM
dt-bindings: leds: Allow differently named multicolor LEDs
leds: lp55xx: Simplify with scoped for each OF child loop
dt-bindings: leds: add TI/National Semiconductor LP5812 LED Driver
leds: is31f132xx: Add support for is31fl3293
leds: is31f132xx: Re-order code to remove forward declarations
dt-bindings: leds: Add issi,is31fl3293 to leds-is31fl32xx
leds: expresswire: Fix chip state breakage
dt-bindings: leds: Add LP5860 LED controller
leds: lm3692x: Fix kernel-doc for struct lm3692x_led
- New Support & Features
* Add a new driver for the Congatec Board Controller (CGBC) backlight, providing brightness
control via the board controller's PWM interface.
- Improvements & Fixes
* Resolve build failures in the Awinic AW99706 driver by switching to the correct GPIO consumer
header.
* Extend the Qualcomm WLED driver to support the specific over-voltage protection (OVP) values
required for the PMI8994 and PMI8950 variants.
- Device Tree Bindings Updates
* Document the device-specific over-voltage protection (OVP) millivolt ranges and default values
for Qualcomm PMI8994 and PMI8950 WLED controllers.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEdrbJNaO+IJqU8IdIUa+KL4f8d2EFAmmN1zAACgkQUa+KL4f8
d2G2PQ//Xqf8GggiXYQ6gMPeIx7ksGXkSnBuYcYFsxbtdTvOQIa33VOUsYGYIbj6
vSBOxt8CvVlVeOvpwc53l//AcR7Hjbd7fTgaxmyok8cYrHDAPhgpoXYAWnHYrN7o
ZDmJA3McjjRlFyOWlDWC989o4oC24jsyCvZbb7La1nNtSpHzilKhL/9sUgrPBBst
eQeJyNiPovbnwE+tUfjdNy3wxJsBkVhnSh9TWzvczOtFA2zMiwqJgX0taLI+Va4c
qdOMBd5pPAIo8yz0lq0V6lboeM7dd6ilSrfjEmCgrwMO+F1LKKkpd7QCK4j9Qjsp
GR2QTHzPssEi6Ji3yjE+RZ/e10HZFnqpYKOlln7+5WczZyEc1c0AwVmdO9Y/dKFN
djUzExxU0duSlAghJBPCozb4kojL3kcrn2Lk1ahDpNfCYqOeps6m8zdf4B/YtQBo
v7txb8cPNGJkr5Anl0ACK0NoO8XeZjiuaVWoQj2tQDeN3uUvd242lQVKWr+fxS4b
u0E9bchxgegNg9guw2RaRekJkbCYsLYQ2tLOHLMDfInLLfJyppBuNfauPk8ZS6UO
9SG8c2Zw82u8vBhHTU1MOFprU11XttgZEeb6elA5c7tGSxpH+wbs+67pDmMWiT8+
Po8hmKbUgvAAeoA2vMw5m7XKFm066EcrXloo52mZKJyAb5XCKWo=
=Jf1S
-----END PGP SIGNATURE-----
Merge tag 'backlight-next-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight
Pull backlight updates from Lee Jones:
"New Support & Features:
- Add a new driver for the Congatec Board Controller (CGBC)
backlight, providing brightness control via the board controller's
PWM interface
Improvements & Fixes:
- Resolve build failures in the Awinic AW99706 driver by switching to
the correct GPIO consumer header
- Extend the Qualcomm WLED driver to support the specific
over-voltage protection (OVP) values required for the PMI8994 and
PMI8950 variants
Device Tree Bindings Updates:
- Document the device-specific over-voltage protection (OVP)
millivolt ranges and default values for Qualcomm PMI8994 and
PMI8950 WLED controllers"
* tag 'backlight-next-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight:
backlight: qcom-wled: Change PM8950 WLED configurations
dt-bindings: backlight: qcom-wled: Document ovp values for PMI8950
backlight: qcom-wled: Support ovp values for PMI8994
dt-bindings: backlight: qcom-wled: Document ovp values for PMI8994
backlight: aw99706: Fix build errors caused by wrong gpio header
backlight: Add Congatec Board Controller (CGBC) backlight support
- New Support & Features
* Add comprehensive support for the ROHM BD72720 PMIC, including core MFD, regulator, GPIO,
clock gate, RTC, and power-supply drivers.
* Add support for the Rockchip RK801 PMIC, including core MFD and regulator drivers.
* Add support for the ROHM BD73900 PMIC by leveraging existing common drivers.
* Wire up RTC, hwmon, and input sub-devices for the Apple SMC (macsmc) driver.
* Add support for the Delta Networks TN48M switch CPLD via the simple-mfd-i2c driver.
* Add support for the TS133 variant to the QNAP MCU driver.
* Provide support for the sama7d65 XLCD controller in the Atmel HLCDC driver.
* Add backlight sub-device support to the Congatec Board Controller (cgbc).
* Add Intel Nova Lake-S (NVL-S) PCI IDs to the Intel LPSS driver.
- Improvements & Fixes
* Implement a "wrapper regmap" for the ROHM BD72720 to handle dual I2C slave addresses (0x4b and
0x4c) transparently for child devices.
* Introduce mutex locking around 'mfd_of_node_list' in the MFD core to ensure safe concurrent
access.
* Fix a potential regulator resource leak in the Arizona core driver during boot sequence
failures.
* Resolve child device duplication issues on driver rebind for Qualcomm PM8xxx and OMAP USB host
drivers by using of_platform_depopulate().
* Fix IRQ domain name duplication for the Samsung S2MPG10 by adding a unique domain suffix.
* Implement LOCK register handling for the TI TPS65214 variant to unlock registers at probe
time.
* Fully convert the Loongson-2K BMC driver to use managed resources (pcim) and the standard PCI
resource API.
* Ensure the Apple SMC mutex is correctly initialized during probe to prevent NULL pointer
dereferences.
* Expand the ROHM BD71828 power-supply driver to support 9-bit register addresses.
* Simplify the Samsung S5M RTC driver by querying platform device IRQ resources directly.
* Revert an incorrect read-to-write mask change in the DA9052 SPI driver to restore default OTP
behavior.
* Fix kernel-doc warnings in the TI TPS6105x driver.
- Cleanups & Refactoring
* Simplify the MFD core by utilizing the scoped for_each_child_of_node_scoped() macro and
streamlining device_node storage.
* Rename ROHM BD71828 IC-specific entities to use consistent prefixes for better extensibility.
* Refactor ROHM BD71828 regmap definitions using the regmap_reg_range() macro.
* Update the ROHM BD71828 driver to use standard C-style comment headers.
* Remove the now unused 'irq_data' field from the Samsung SEC core structure.
* Drop unnecessary use of irqd_get_trigger_type() in the Maxim MAX77759 driver.
* Default MFD_SPACEMIT_P1 to 'm' if ARCH_SPACEMIT is selected.
* Add missing charger-related registers to the ROHM BD71828 core header and Type-C CC registers
to the AXP717.
- Device Tree Binding Updates
* Add new bindings for the ROHM BD72720 PMIC, Rockchip RK801 PMIC, Bitmain BM1880 System
Controller, and NXP LPC32xx System Control Block.
* Clarify trickle-charge terminology and add properties for voltage drop (VDR) correction and
upper charge limits to the generic battery binding.
* Document GPR syscon for NXP S32 SoCs and the smp-memram subnode for Aspeed SCU.
* Document numerous new Qualcomm SPMI PMIC compatibles (pmcx0102, pmh0101, pmk8850, etc.).
* Add compatibles for the sama7d65 XLCD (Atmel), LAN9691 Flexcom (Microchip), and various
MediaTek SCPSYS and regulator components.
* Fix a dead link to the audio codec binding in the DA9055 documentation.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEdrbJNaO+IJqU8IdIUa+KL4f8d2EFAmmN1SgACgkQUa+KL4f8
d2FmCg//dSaWBfdNSIibUQg08g/hUUx+TTZ3RsRdBqGym0/+n6cTRqxSRM9LwWmC
4jAq+fdqBhWEdTvB28aJT/UxFkDuKTsXtoycwLVvX0Vfb5zvE8SjAIycS4/PMRqZ
qYyZ3fblfwx/bm+/1+0yVsi4TVtjLZdiRQEpKAXN/FNd9/6mHD8x4VNjtB5jj0nR
tcCXKevmgRcCqXi2OfAWQ20VO/N04rkRj0r07UI4+u+lC3iet5XMmWaPc+QbQ0Be
EkTCHBvfqtC6+C6aZtGjCOx8OA08I3MZAmS5eNly4T3GuVTHVtzobZEM7lEk4ScQ
mzdXnhNBxxJzLXcv5B7FuDlaEcBya1tf5fe2lPgyD5Mp4khPynBZWQdDQe5Zv0TV
9EhdGazltNdYXUcTX5yhgQOpFgdGBb59AczRG5j/EMpLVJSwyUJQC7HMf3OyirCo
d4ZtCVXAp9KlUuEAvkLIgq6ZU/8fY5LVWK07tO0QJDHz7vEhEzZ7us5kvHQ9gFzu
ihE3EKMBrAnjx/ZJ6pHFcfiEpPxO1rRhIFMCg5SGFVeJWKhvBycz5CjFs26GQzX6
OTREzRbcOtuIAwBow4yafozUh0z2HWlpMNPbeuyz1h4jg5RbcYWmKG+eO5dKQXU0
8UGTJelPzMvfx3NJ/LC9pImLrGh+twz42aqwv8LakH0y/zuT1dw=
=BxGL
-----END PGP SIGNATURE-----
Merge tag 'mfd-next-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd
Pull MFD updates from Lee Jones:
"New Support & Features:
- Add comprehensive support for the ROHM BD72720 PMIC, including core
MFD, regulator, GPIO, clock gate, RTC, and power-supply drivers
- Add support for the Rockchip RK801 PMIC, including core MFD and
regulator drivers
- Add support for the ROHM BD73900 PMIC by leveraging existing common
drivers
- Wire up RTC, hwmon, and input sub-devices for the Apple SMC
(macsmc) driver
- Add support for the Delta Networks TN48M switch CPLD via the
simple-mfd-i2c driver
- Add support for the TS133 variant to the QNAP MCU driver
- Provide support for the sama7d65 XLCD controller in the Atmel HLCDC
driver
- Add backlight sub-device support to the Congatec Board Controller
(cgbc)
- Add Intel Nova Lake-S (NVL-S) PCI IDs to the Intel LPSS driver
Improvements & Fixes:
- Implement a "wrapper regmap" for the ROHM BD72720 to handle dual
I2C slave addresses (0x4b and 0x4c) transparently for child devices
- Introduce mutex locking around 'mfd_of_node_list' in the MFD core
to ensure safe concurrent access
- Fix a potential regulator resource leak in the Arizona core driver
during boot sequence failures
- Resolve child device duplication issues on driver rebind for
Qualcomm PM8xxx and OMAP USB host drivers by using
of_platform_depopulate()
- Fix IRQ domain name duplication for the Samsung S2MPG10 by adding a
unique domain suffix
- Implement LOCK register handling for the TI TPS65214 variant to
unlock registers at probe time
- Fully convert the Loongson-2K BMC driver to use managed resources
(pcim) and the standard PCI resource API
- Ensure the Apple SMC mutex is correctly initialized during probe to
prevent NULL pointer dereferences
- Expand the ROHM BD71828 power-supply driver to support 9-bit
register addresses
- Simplify the Samsung S5M RTC driver by querying platform device IRQ
resources directly
- Revert an incorrect read-to-write mask change in the DA9052 SPI
driver to restore default OTP behavior
- Fix kernel-doc warnings in the TI TPS6105x driver
- Cleanups & Refactoring
- Simplify the MFD core by utilizing the scoped
for_each_child_of_node_scoped() macro and streamlining device_node
storage
- Rename ROHM BD71828 IC-specific entities to use consistent prefixes
for better extensibility
- Refactor ROHM BD71828 regmap definitions using the
regmap_reg_range() macro
- Update the ROHM BD71828 driver to use standard C-style comment
headers
- Remove the now unused 'irq_data' field from the Samsung SEC core
structure
- Drop unnecessary use of irqd_get_trigger_type() in the Maxim
MAX77759 driver
- Default MFD_SPACEMIT_P1 to 'm' if ARCH_SPACEMIT is selected
- Add missing charger-related registers to the ROHM BD71828 core
header and Type-C CC registers to the AXP717
Device Tree Binding Updates:
- Add new bindings for the ROHM BD72720 PMIC, Rockchip RK801 PMIC,
Bitmain BM1880 System Controller, and NXP LPC32xx System Control
Block
- Clarify trickle-charge terminology and add properties for voltage
drop (VDR) correction and upper charge limits to the generic
battery binding
- Document GPR syscon for NXP S32 SoCs and the smp-memram subnode for
Aspeed SCU
- Document numerous new Qualcomm SPMI PMIC compatibles (pmcx0102,
pmh0101, pmk8850, etc)
- Add compatibles for the sama7d65 XLCD (Atmel), LAN9691 Flexcom
(Microchip), and various MediaTek SCPSYS and regulator components
- Fix a dead link to the audio codec binding in the DA9055
documentation"
* tag 'mfd-next-6.20' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (41 commits)
dt-bindings: mfd: da9055: Fix dead link to codec binding
mfd: cgbc: Add support for backlight
dt-bindings: mfd: qcom,spmi-pmic: Document PMICs present on Glymur and Kaanapali
dt-bindings: mfd: Document smp-memram subnode for aspeed,ast2x00-scu
mfd: intel-lpss: Add Intel Nova Lake-S PCI IDs
mfd: ls2kbmc: Use PCI API instead of direct accesses
mfd: ls2kbmc: Fully convert to use managed resources
dt-bindings: mfd: mediatek: mt6397: Add missing MT6331 regulator compat
dt-bindings: mfd: mediatek,mt8195-scpsys: Add mediatek,mt6795-scpsys
dt-bindings: mfd: atmel,sama5d2-flexcom: Add microchip,lan9691-flexcom
mfd: omap-usb-host: Fix OF populate on driver rebind
mfd: qcom-pm8xxx: Fix OF populate on driver rebind
dt-bindings: mfd: syscon: Allow syscon compatible for mediatek,mt7981-topmisc
mfd: qnap-mcu: Add driver data for TS133 variant
dt-bindings: mfd: qnap,ts433-mcu: Add qnap,ts133-mcu compatible
mfd: sec: Fix IRQ domain names duplication
mfd: simple-mfd-i2c: Add Delta TN48M CPLD support
mfd: macsmc: Initialize mutex
dt-bindings: mfd: nxp: Add NXP LPC32xx System Control Block
mfd: Kconfig: Default MFD_SPACEMIT_P1 to 'm' if ARCH_SPACEMIT
...
Creating debugfs entries can trigger fs reclaim, which can enter back
into the block layer request_queue. This can cause deadlock if the
queue is frozen.
Previously, a WARN_ON_ONCE check was used in debugfs_create_files()
to detect this condition, but it was racy since the queue can be frozen
from another context at any time.
Introduce blk_debugfs_lock()/blk_debugfs_unlock() helpers that combine
the debugfs_mutex with memalloc_noio_save()/restore() to prevent fs
reclaim from triggering block I/O. Also add blk_debugfs_lock_nomemsave()
and blk_debugfs_unlock_nomemrestore() variants for callers that don't
need NOIO protection (e.g., debugfs removal or read-only operations).
Replace all raw debugfs_mutex lock/unlock pairs with these helpers,
using the _nomemsave/_nomemrestore variants where appropriate.
Reported-by: Yi Zhang <yi.zhang@redhat.com>
Closes: https://lore.kernel.org/all/CAHj4cs9gNKEYAPagD9JADfO5UH+OiCr4P7OO2wjpfOYeM-RV=A@mail.gmail.com/
Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Closes: https://lore.kernel.org/all/aYWQR7CtYdk3K39g@shinmob/
Suggested-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Core changes:
- Drop the unused devm_pinctrl_unregister() function.
- Move pretended generic pin control functionality out of the
core and into the Amlogic AM4 driver. We have something better
coming (hopefully).
New hardware support:
- Spacemit K3 (RISC-V) pin control support.
- Atmel AT91 PIO4 (ARM32) SAMA7D65 pin control support.
- Exynos9610 (ARM64) pin control support.
- Qualcomm Mahua TLMM (ARM64) pin control support.
- Microchip Polarfire MSSIO (RISC-V) pin control support.
- Ocelot LAN9645XF (multiplatform) pin control support.
Improvements:
- Using a few more guards for locking.
- Various nonurgent fixes and tweaks.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEElDRnuGcz/wPCXQWMQRCzN7AZXXMFAmmS7tgACgkQQRCzN7AZ
XXMnww/+ON7+DH8YA5+yI3fPdejv+6LK4es22B3r8bPVW4HtnfGxNqC7HZ8v9SWQ
H7BkSiEv0XLNVjKIV00WESeaK2V5MN9e52V2HfsSEDEheVdG7uA+9UVM7K2WkDnX
zhfucJdYHa1OEwcnrWMZl+6gAMw7cjuaG3ckNzay+okNme9kiyrnjFzT7NWoCut8
WBbzmpbMCtWdHMk7HSkPDF2LhyB7jVBbbH7qvjjrfxy1L+ybAf8tZJ6urwn+7uCZ
dEe5YYghre2SXi4j9v+WJ+8024RaXG//7JsZvUEGs7Kb9CZAcqAdHwUiRK/rLckj
anHoDEpall0yyH3gZA5ETn8Gw7vChAhm1CTfhUYcV9kc7/9MiShOE1UbBNvjXvCW
e+0zixRrBp0LzJEkJD7b2NhjMLHyXS3D/uN1l5+d04uFwskttVhtQ26Icz3P/3T/
aELNcIemwLQeAIy4btAWYu5dKE0IR80Z/nYozR7W+at9rzt9/8FleALScMXgPRMf
HfcdKj9/cDzFNYOVtPf20gVXqSm/Yv+ZPYTpq45jKDH8U393Ly3XmNXAYOhflf+i
Zt0KBSFf86/+u3Uo0EsQo+4JBK8FpEJT3qz6On7hXevbFiVZsXvfH0MU9up6s11d
zfW56C4mHe0anB8y5Kc0ZKuOt4MzMJm0OOuuiZqnpnK2xFLBmlU=
=lmwJ
-----END PGP SIGNATURE-----
Merge tag 'pinctrl-v7.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl
Pull pin control updates from Linus Walleij:
"Core changes:
- Drop the unused devm_pinctrl_unregister() function
- Move pretended generic pin control functionality out of the core
and into the Amlogic AM4 driver. We have something better coming
(hopefully)
New hardware support:
- Spacemit K3 (RISC-V) pin control support
- Atmel AT91 PIO4 (ARM32) SAMA7D65 pin control support
- Exynos9610 (ARM64) pin control support
- Qualcomm Mahua TLMM (ARM64) pin control support
- Microchip Polarfire MSSIO (RISC-V) pin control support
- Ocelot LAN9645XF (multiplatform) pin control support
Improvements:
- Using a few more guards for locking
- Various nonurgent fixes and tweaks"
* tag 'pinctrl-v7.0-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (73 commits)
pinctrl: generic: move function to amlogic-am4 driver
pinctrl: intel: Align Copyright note with corporate guidelines
pinctrl: mediatek: remove unused drv_offset field
pinctrl: canaan: k230: Fix NULL pointer dereference when parsing devicetree
pinctrl: single: fix refcount leak in pcs_add_gpio_func()
pinctrl: meson: amlogic-a4: Fix device node reference leak in bank helpers
pinctrl: qcom: sm8250-lpass-lpi: Fix i2s2_data_groups definition
pinctrl: core: Remove duplicate error messages
pinctrl: core: Simplify devm_pinctrl_*()
pinctrl: core: Remove unused devm_pinctrl_unregister()
dt-bindings: pinctrl: spacemit: fix drive-strength check warning
pinctrl: fix kismet issues with GENERIC_PINCTRL
pinctrl: tangier: Join tng_pinctrl_probe() into its wrapper
pinctrl: tangier: Remove duplicate error messages
pinctrl: lynxpoint: Remove duplicate error messages
pinctrl: cherryview: Remove duplicate error messages
pinctrl: baytrail: Remove duplicate error messages
pinctrl: intel: Remove duplicate error messages
pinctrl: equilibrium: Fix device node reference leak in pinbank_init()
dt-bindings: pinctrl: pinctrl-microchip-sgpio: add LAN969x
...
-----BEGIN PGP SIGNATURE-----
iQJOBAABCAA4FiEEbt46xwy6kEcDOXoUeZbBVTGwZHAFAmmS5oAaHHRzYm9nZW5k
QGFscGhhLmZyYW5rZW4uZGUACgkQeZbBVTGwZHD+LQ//fuj3BDTImgyHTBlj8yDC
XF4zl5xv7ivMgTTnW9PiJdKXZOvyzGZ3Tiu4ZUdOhvpSZHtcSzJISdQC+fbTMPF6
dN7SXnF27rRzjp2nV1nhhvOWMqY53hgQiVv17qJhCwb4/nyh/69ckQu0Ut4wagn4
n/+ebRq7kIgQtzrQLnw/3oX2mcAuCQ+sPm2SRib2PbTxvQu4WqMwY8rfAtUss8dg
jiXs5XgH9fHpYvPDscJ95HVfZIRqvXyLx5x8QsEvBsdS2DIv2Qy/xCzNPB/HPp9d
AzRZMexSPHmC/nU7DqC4iw7FnK0//rUeUmTMjrb7+xW4P1/qTmf9LYJc5DR5N7my
FJBpqLdhu8A56nGnzP5v7DdU7lffHFBzKC4AQ96re3yqZAHhyc2humDc3/0hBbPA
DuD907llNsFlgQrD2DDg3F0ha9rEhkqhfP2QrZAXG90puoo/oRqfVF8QOF7Y2sal
7NJIZkh3DLsVaokiOKYLFdjcMED+3/VJB0b3JE0omrLjqZG8f1kVLVISawyv/jDz
NYgg3uDQ7oGJLNnKi+gCiAL4ZFZHwj3A4rJYlMIB7Q1XR+cx4cKpmiwYtwoWIv9r
AxDR6yvi8mrZ2xx4vleyeqmoB6xrHjdUJfKVXQ1kCgg7tZJWRplxQAl4HHh+cU4F
EYIoq92L+PrXrq7RNILYd0o=
=ZT9I
-----END PGP SIGNATURE-----
Merge tag 'mips_7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux
Pull MIPS updates from Thomas Bogendoerfer:
"Cleanups and fixes"
* tag 'mips_7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (28 commits)
Revert "clk: microchip: core: allow driver to be compiled with COMPILE_TEST"
Revert "clk: microchip: fix typo in reference to a config option"
MIPS: Implement ARCH_HAS_CC_CAN_LINK
MIPS: rb532: Fix MMIO UART resource registration
MIPS: Work around LLVM bug when gp is used as global register variable
MIPS: Loongson64: env: Fixup serial clock-frequency when using LEFI
MIPS: Loongson2ef: Use pcibios_align_resource() to block io range
MIPS: Loongson2ef: Register PCI controller in early stage
clk: microchip: fix typo in reference to a config option
MIPS: Loongson64: dts: fix phy-related definition of LS7A GMAC
clk: microchip: core: allow driver to be compiled with COMPILE_TEST
MIPS: drop unused pic32.h header
watchdog: pic32-wdt: update include to use pic32.h from platform_data
watchdog: pic32-dmt: update include to use pic32.h from platform_data
serial: pic32_uart: update include to use pic32.h from platform_data
rtc: pic32: update include to use pic32.h from platform_data
pinctrl: pic32: update include to use pic32.h from platform_data
mmc: sdhci-pic32: update include to use pic32.h from platform_data
irqchip/irq-pic32-evic: update include to use pic32.h from platform_data
clk: microchip: core: update include to use pic32.h from platform_data
...
On the THUNDEROBOT ZERO laptop, the second NVMe slot and the discrete
NVIDIA GPU are both controlled by power-resource PXP. Due to the SSDT table
bug (lack of reference), PXP will be shut dow as an "unused" power resource
during initialization, making the NVMe slot #2 + NVIDIA both inaccessible.
This issue was introduced by commit a1224f34d7 ("ACPI: PM: Check
states of power resources during initialization"). Here are test
results on the three consecutive commits:
(bad again!) a1224f34d7 ACPI: PM: Check states of power resources during initialization
(good) bc28368596 ACPI: PM: Do not turn off power resources in unknown state
(bad) 519d81956e Linux 5.15-rc6
On commit bc28368596 ("ACPI: PM: Do not turn off power resources in
unknown state") this was not an issue because the power resource state
left UNKNOWN thus being ignored.
See also commit 9b04d99788 ("ACPI: PM: Do not turn of unused power
resources on the Toshiba Click Mini") which is another almost identical
case to this one.
Fixes: a1224f34d7 ("ACPI: PM: Check states of power resources during initialization")
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221087
Signed-off-by: Zhai Can <bczhc0@126.com>
Link: https://patch.msgid.link/20260214161452.2849346-1-bczhc0@126.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Most of struct blk_stat_callback documentation is already in kernel-doc
format. Convert the remaining struct members to kernel-doc to avoid
kernel-doc warnings:
Warning: block/blk-stat.h:62 struct member 'list' not described
in 'blk_stat_callback'
Warning: block/blk-stat.h:62 struct member 'timer_fn' not described
in 'blk_stat_callback'
Warning: block/blk-stat.h:62 struct member 'rcu' not described
in 'blk_stat_callback'
Warning: block/blk-stat.h:133 No description found for return value of
'blk_stat_is_active'
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Fix all kernel-doc warnings in blk_types.h:
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_READ' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_WRITE' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_FLUSH' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_DISCARD' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_SECURE_ERASE' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_ZONE_APPEND' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_WRITE_ZEROES' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_ZONE_OPEN' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_ZONE_CLOSE' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_ZONE_FINISH' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_ZONE_RESET' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_ZONE_RESET_ALL' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_DRV_IN' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_DRV_OUT' not described in enum 'req_op'
Warning: include/linux/blk_types.h:371 Enum value 'REQ_OP_LAST' not described in enum 'req_op'
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Commit 979dd8da76 ("regulator: s2mps11: add S2MPG11 regulator")
incorrectly ended up using macros for S2MPG10 in the S2MPG11 case. They
happen to end up giving the same result, but for clarity, the correct
macros should be used.
No functional change.
Signed-off-by: André Draszik <andre.draszik@linaro.org>
Link: https://patch.msgid.link/20260210-s2mpg1x-regulators-fixes-v2-2-ab3d3457f1ae@linaro.org
Signed-off-by: Mark Brown <broonie@kernel.org>
The sanity checks being removed in this commit are useless as earlier
code already checks for all conditions, including all error cases like
out-of-bounds conditions. In other words, the code being removed here
has no effect, as any potential error it could catch will already have
been caught by earlier code.
The checks removed here are also incomplete (as they're off-by-one) -
they should have been checking >= ARRAY_SIZE() to be complete.
Simply remove this redundant and incorrect code.
No functional change.
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/all/aYmsu8qREppwBESH@stanley.mountain/
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: André Draszik <andre.draszik@linaro.org>
Link: https://patch.msgid.link/20260210-s2mpg1x-regulators-fixes-v2-1-ab3d3457f1ae@linaro.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Add support for the QUINARY_MI2S_RX which is used on some devices to
send audio data to speaker amplifiers.
Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://patch.msgid.link/20260211-snd-sm8250-quinary-mi2s-v1-1-f62e49d85af8@fairphone.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The ASUS Vivobook Pro 15X (M6501RR) with AMD Ryzen 9 6900HX has an
internal DMIC that is not detected without a DMI quirk entry, as the
BIOS does not set the AcpDmicConnected ACPI _DSD property.
Adding the DMI entry enables the ACP6x DMIC machine driver to probe
successfully.
Cc: stable@vger.kernel.org
Signed-off-by: Gustavo Salvini <guspatagonico@gmail.com>
Link: https://patch.msgid.link/20260210155156.29079-1-guspatagonico@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
This patch implements delayed allocation (delalloc) in ntfs3 driver.
It introduces an in-memory delayed-runlist (run_da) and the helpers to
track, reserve and later convert those delayed reservations into real
clusters at writeback time. The change keeps on-disk formats untouched and
focuses on pagecache integration, correctness and safe interaction with
fallocate, truncate, and dio/iomap paths.
Key points:
- add run_da (delay-allocated run tree) and bookkeeping for delayed clusters.
- mark ranges as delalloc (DELALLOC_LCN) instead of immediately allocating.
Actual allocation performed later (writeback / attr_set_size_ex / explicit
flush paths).
- direct i/o / iomap paths updated to avoid dio collisions with
delalloc: dio falls back or forces allocation of delayed blocks before
proceeding.
- punch/collapse/truncate/fallocate check and cancel delay-alloc reservations.
Sparse/compressed files handled specially.
- free-space checks updated (ntfs_check_free_space) to account for reserved
delalloc clusters and MFT record budgeting.
- delayed allocations are committed on last writer (file release) and on
explicit allocation flush paths.
Tested-by: syzbot@syzkaller.appspotmail.com
Reported-by: syzbot+2bd8e813c7f767aa9bb1@syzkaller.appspotmail.com
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
Deduplicate io_buffer_validate() calls by moving the checks into
io_sqe_buffer_register(). Now we also don't need special handling in
io_buffer_validate() passing through buffer removal requests. I also
was using it as a cleanup before some other changes.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
zc->len and zc->buf are not actually used once you get to the retry
stage. The buffer remains in kmsg->msg.msg_iter, which is setup in
io_send_setup.
Note: it still seems needed in io_send due to io_send_select_buffer
needing it (for the len parameter).
Signed-off-by: Dylan Yudaken <dyudaken@gmail.com>
Reviewed-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Attempting SOCKET_URING_OP_SETSOCKOPT on an AF_NETLINK socket resulted
in an -EOPNOTSUPP, as AF_NETLINK doesn't have an ioctl in its struct
proto, but only in struct proto_ops.
Prior to the blamed commit, io_uring_cmd_sock() only had two cmd_op
operations, both requiring ioctl, thus the check was warranted.
Since then, 4 new cmd_op operations have been added, none of which
depend on ioctl. This patch moves the ioctl check, so it only applies
to the original operations.
AFAICT, the ioctl requirement was unintentional, and it wasn't
visible in the blamed patch within 3 lines of context.
Cc: stable@vger.kernel.org
Fixes: a5d2f99aff ("io_uring/cmd: Introduce SOCKET_URING_OP_GETSOCKOPT")
Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.net>
Reviewed-by: Gabriel Krisman Bertazi <krisman@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
- kprobes: Use a dedicated kernel thread to optimize the kprobes
instead of using workqueue thread. Since the kprobe optimizer waits
a long time for synchronize_rcu_task(), it can block other workers
in the same queue if it uses a workqueue.
- kprobe-events: Returns immediately if no new probe events are
specified on the kernel command line at boot time. This shorten the
kernel boot time.
- kprobes: When a kprobe is fully removed from the kernel code,
retry optimizing another kprobe which is blocked by that kprobe.
-----BEGIN PGP SIGNATURE-----
iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmmPtX4bHG1hc2FtaS5o
aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8bgoUH/0oZ9/c+wkn9AKxFlOAw
AIbtTfKiQHXPirhamYuEbJJWTUH2O/Wr0SQrIkbwJzToou5CRTuT5UQBpmOk2GKZ
uZ5bO63nOMn/1ECbDpc+lFGV5J4Dn5Pw2GFjUTR6EPwms+CN/d6f2LlvuAVfJX7Y
klL2X9/QLwV5QT8La5zNEka2zBfrZlZ9a5DGoLtgdwX2zosuef9aDnisS2jkLenH
wugZLryx0Qvlj9DXimP7oVZpYDHr0hZEI3CNQPge0gMQDj1XajGawYfkhrfaeFMX
4eXjFCN+NQG6fBUpDugcOThOypWmjlJhoYxxROJu0eFcLQjsuWjp6jLixI9Nr7P+
tQk=
=syAj
-----END PGP SIGNATURE-----
Merge tag 'probes-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull kprobes updates from Masami Hiramatsu:
- Use a dedicated kernel thread to optimize the kprobes instead of
using workqueue thread. Since the kprobe optimizer waits a long time
for synchronize_rcu_task(), it can block other workers in the same
queue if it uses a workqueue.
- kprobe-events: return immediately if no new probe events are
specified on the kernel command line at boot time. This shortens
the kernel boot time.
- When a kprobe is fully removed from the kernel code, retry optimizing
another kprobe which is blocked by that kprobe.
* tag 'probes-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
kprobes: Use dedicated kthread for kprobe optimizer
tracing: kprobe-event: Return directly when trace kprobes is empty
kprobes: retry blocked optprobe in do_free_cleaned_kprobes
Some XRUN-related error messages may repeat themselves, because there
can be multiple pending packets. Modify notify_xrun() function to
return whether it's being stopped or not, and show the error message
only once when the XRUN is actually handled.
Along with it, fix a typo of word package to packet in the error
message.
Link: https://patch.msgid.link/20260216141209.1849200-5-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
At silencing the playback URB packets in the implicit fb mode before
the actual playback, we blindly assume that the received packets fit
with the buffer size. But when the setup in the capture stream
differs from the playback stream (e.g. due to the USB core limitation
of max packet size), such an inconsistency may lead to OOB writes to
the buffer, resulting in a crash.
For addressing it, add a sanity check of the transfer buffer size at
prepare_silent_urb(), and stop the data copy if the received data
overflows. Also, report back the transfer error properly from there,
too.
Note that this doesn't fix the root cause of the playback error
itself, but this merely covers the kernel Oops.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=221076
Link: https://patch.msgid.link/20260216141209.1849200-4-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
We did manual copies over loop for the packet data update of the
implicit feedback, but this can be optimized with a simple memcpy().
Along with it, change the data type of snd_usb_packet_info struct to
align with other (from uint32_t to int).
No functional changes but only code optimizations.
Link: https://patch.msgid.link/20260216141209.1849200-3-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
At receiving the packets from the implicit feedback source, we didn't
update ctx->packets field but only the ctx->packet_size[] data.
In exceptional cases, this might lead to unexpectedly superfluous data
transfer (although this won't happen usually due to the nature of USB
isochronous transfer). Fix it to update the field properly.
Link: https://patch.msgid.link/20260216141209.1849200-2-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
In linehandle_create(), there is a statement like this:
retain_and_null_ptr(lh);
Soon after, there is a debug printout that dereferences "lh", which
will crash things.
Avoid the crash by using handlereq.lines, which is the same value.
Fixes: da7e394bf5 ("gpio: convert linehandle_create() to FD_PREPARE()")
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://patch.msgid.link/20260215120555.v2.1.I77c3eb563271c21870379eefd16ebbc4e09635bb@changeid
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
The function gpio_device_get_desc() can return an error pointer and is
not checked for one. Add check for error pointer.
Fixes: ddeb66d2cb ("gpio: nomadik: don't print out global GPIO numbers in debugfs callbacks")
Cc: stable@vger.kernel.org
Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
Link: https://patch.msgid.link/20260214044531.43539-1-ethantidmore06@gmail.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
. defconfig cleanup
. fix for legacy 68000 CPU memmove() of non-aligned pointers
. replace strcpy() with strscpy() for ucsimm target
-----BEGIN PGP SIGNATURE-----
iQJEBAABCgAuFiEEmsfM6tQwfNjBOxr3TiQVqaG9L4AFAmmLy1AQHGdlcmdAa2Vy
bmVsLm9yZwAKCRBOJBWpob0vgI2YEACrotnY29SvLcDQHg2vtPySITrti3+4SPX7
e8aKCp7DU4L5atxCDxsv5CL11eVKs8lJMHXS8dytB2kQOuOY03TZQOeafqqkFNIO
vmx8hxCdwZWhtHe35bxIjU1tgK6f7c23fhppF9OJzbSmu1hp5py+v4il6wVTMx7J
4SlFHyW58Kol2prv22dPSW/EjyYMAa4PxcMeYTsnsH5EVH/ZQiUiDbIAiH8ibFca
JbTu0xBz7bePt6xLnB3FkumBmuHv4gQyklKIJDs7nBvgUH7ac2hbzgNuvEjrq1/e
wBQoRohqTsflscA3YyVBASpLBdkFhms6/aorUiuQZFMHs2LfGJ11DFK8u0jCcHPv
pNGSVC3p8ClUxJ59HdQb+iET0YsBLdTB2YMfAeLlNGNZUxYA4AiIe0h+WR4DySSm
huKI6OIbgkN6YrfCkO4ZvIY+tPHPDfmB7p2JnvwmurpxuCJPPjoVVBoaEs8yx4uv
XPDSHhuWQhMOiyVLVmMFcAwqJUXrInmRS5D6Ugnp22LgB4DanhNUslCcleiuRzoB
ULrJKcYXopQUPsqNI6q+m+h+XnDLs/xEwph2XKq1gDvzc0nXOsR81MNqLyUjTXf9
wLlWXx7okcbW5FnZDA15/5rvEsYYQFM48DPz7F1VXh5jpCyO52lWYRWvzJbuxacN
j5CgL3PkHQ==
=r0QB
-----END PGP SIGNATURE-----
Merge tag 'm68knommu-for-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu
Pull m68knommu updates from Greg Ungerer:
- defconfig cleanup
- fix for legacy 68000 CPU memmove() of non-aligned pointers
- replace strcpy() with strscpy() for ucsimm target
* tag 'm68knommu-for-v7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu:
m68knommu: Replace deprecated strcpy with strscpy in init_ucsimm
m68k: nommu: fix memmove() with differently aligned src and dest for 68000
m68k: defconfig: Clean up references to non-existing configs
Currently, when smb signature verification fails, the behaviour is to log
the failure without any action to terminate the session.
Call cifs_reconnect() when client required signature verification fails.
Otherwise, log the error without reconnecting.
Signed-off-by: Aaditya Kansal <aadityakansal390@gmail.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
