mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-08 18:57:22 +00:00
1,465,160 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Linus Torvalds
|
8d3ae59288 | Linux 7.2 v7.2 | ||
|
Linus Torvalds
|
fd923b32d7 |
- Make sure a delayed sched entity's runtime stats are updated at the right
time so that it receives the proper lag compensation -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmqB/CQACgkQEsHwGGHe VUq4Eg//ZeldqtFqUxohjcy5ZrgJ9dhdxwRfqZgYhZCSqTJHVLqAxWVAHnJZWfiz Vh63rnt78rIPpVX6E/lZLnYm2VwhEO6P6piMzG4CVlh2pMySjhoRIQ3ufNAQRt0o P79Y29rLhDhHkOaL+jjgSr+ePiDzerrkBfYHK0wJ+BAjphjWxML1wYyCGwhWk/Lu KuXN/jzbEbAn2QWEwEy9KyxztzJlTYTE+l8jiGfRywAeZOBo8HaXg0HhuCwLnaXb yPmarhof2/7XUdW/CBGYggLaXF+mW6VeMaiqdhxSKl48KMpIfPnBC99/YCJy6vmQ pD+kOiysGSFy+3vMbTvjwOYV8T3g7LOpeVkY8KkVmAHUFVF9wBSyPULyooNuxGS9 2pBv6Uz2ojm3wMVk+gggt2VU5uVNLsn9IKpNObyuBRDkt3My4Jej3cQ89LeqyS8Z q49JbAhEwCRfGpxq92WW6izMWjOnduhiTd9TXF/WoXVtcT9ZSbyxJ3sCxbTBrJxd na7xln2xsR8w9+G91DmmNPRnBtBkBOJ6xRGacKDeV8dcfKcZGGH6/sRMN9mIhP8v huCVazSwNCVWDaHn8o/ORBJ0dEJ/536a806ysYfB6MdNzZYtU8iepCj5Lr+uAG/Q W49ftqYFst9o22wT2i4ZdTfrDrkbekVU67BLv9yu8VcmoQJgt90= =bK3W -----END PGP SIGNATURE----- Merge tag 'sched_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fix from Borislav Petkov: - Make sure a delayed sched entity's runtime stats are updated at the right time so that it receives the proper lag compensation * tag 'sched_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched: Update time before requeueing delayed entities |
||
|
Linus Torvalds
|
240de1acf3 |
- Detect a broken EL2 virtual timer in the bcm2712 SoC boards (RPi5) and
fallback to the physical one instead - Fix a build error with ARM rpc_defconfig and function tracer enabled -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmqB+qQACgkQEsHwGGHe VUr7zQ//d2p80ASoa/3p6qzDs5FiySg2tWEfdRp6PoWDeonu5xVcXHs4GJyFFunP X7pu4kZ+gXq5RoWuk/ClFschaakeij0XtNCjMrpA7ZZpqwBwx387nv3v/9KecU3n IGqS6bz22d/99te9cMo+1vj3gm/PBIE3SOEnwQQ7oD2pAc2TzdLeoXo554EE5zZu tBpgdCz4fDcvmpr9sXzw9fDjgJgPjlVJYq/+juCtxXAWQtGJnHWCqGdMxbOtzHHo E2lLQhZNgC3Vi+jbTYB7mpa70R9iS8TmjuosjKpan3uxakQZnE/+pqN6xFpDh3Ho 090dtBFOUYxx7LDcX6RjXrbddIaHwZNCP1W6OB0EKPUntcpD6MMo4GMBURUxJ4mO TT0gCtd1bsgYhNwZDVBUxhwoqM1e+EtL44ndT26E0HnIIT0gqr4QE6ODvFpeUQmj 2sNdnBSslrLYeHYypBFRRo3aiDmfYCrML2z/OWEdRmAOYvUssJP4euXrBbInobd5 VtBxjjQmBCSiV7nD0vor9eU5kJ4y6VNfiDDBuByNBzIWliMznLNgN92zAGPn7uwR IZ1wBWSbMYoc2C8h0CIPax1J+S517G17WVhMbJnYNlg9SzMAxttBWoHHvrdGMfW8 Nua9plybvDVa+SRgCgJl7fiY19/UtXh/9NxHFQtcJnqR0eQfxJs= =IlDf -----END PGP SIGNATURE----- Merge tag 'timers_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fixes from Borislav Petkov: - Detect a broken EL2 virtual timer in the bcm2712 SoC boards (RPi5) and fallback to the physical one instead - Fix a build error with ARM rpc_defconfig and function tracer enabled * tag 'timers_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: clocksource/drivers/arm_arch_timer: Workaround bcm2712 broken EL2 virtual timer tick: Include ktime.h and jiffies.h in linux/tick.h |
||
|
Linus Torvalds
|
7820dd4a12 |
- Prevent a lockup when rseq grants a timeslice extension
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmqB+IQACgkQEsHwGGHe VUoLoA//UiK75T3O49g7pPmQh3lOqoadcvFduoGPVulWr9MqMYb9la+XRAPTO2aX lMldJhHoQBdL4chQU/2r1LgcM9i2GF753ssqO+MhAQHrDUMhZD87fRkQt+0e1jEc iAfjQCWVV7+abzsgKbZOlvXeYBFY6Bcy/EwGr9OhNPn1Zg6yGT73gV/ihgc1KYtj gyUCNjgu5n5UWLZOsAfy0JpSxdeHqCaydYKRRIWbQrbjlp+fauRPtbyOXua3mwNt gCnBpXnB3rD3R98KGr9C1GHg4DhwTSWZIQj67KMSnEKLco3fzhzq1PW1GwY3UFqn 81OKGIqKHP+VDJTNsk4F0zrXLqG3NWaKwCu9jLV5yhA1z3/4GXNAE3iOT8DT3lmp upDnQ85aNkPSruF/ZjFxeNT3qrPOLCyMz0p/6qhZN7A3V/4R+B9vRYpvWZunvzvC k5hqeV1NyeRSoqvEp8ySH++v7Ifny2LbltIcuL+9wWUvRCb45ACQTgsjfIIRrm8F 5mGBRyZs53lU7NthyE1FScNrVUFw7HaWAIapzaZPZIqhNh2+MAOODclTggYp0Y2A tIEGLohrsuEiPDA3xwa+6a+826M7Uan0lfIVV39BwTM2axuMOuapn/Ou5GmPSvx6 guE0WRugo7TN5st8e+Go0ZrUMXzcQ61G3fdNJOR7UIbQROmrgEo= =7htY -----END PGP SIGNATURE----- Merge tag 'core_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull rseq fix from Borislav Petkov: - Prevent a lockup when rseq grants a timeslice extension * tag 'core_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: rseq: Prevent hard lockup on granted time slice extension |
||
Charlie-cy Wu
|
d6e7d57ed9 |
wifi: mt76: mt7921: refactor regd update to fix recursive mutex deadlock
Split mt7921_mcu_regd_update() into two functions to prevent recursive
mutex acquisition. Introduce __mt7921_mcu_regd_update() as the internal
implementation that assumes the mutex is already held by the caller,
while mt7921_mcu_regd_update() remains as the external interface that
handles mutex acquisition and release.
This fixes a deadlock issue when mt7921_regd_set_6ghz_power_type() is
called with the device mutex already held. Without this change, calling
mt7921_mcu_regd_update() would attempt to acquire the same mutex again,
causing a recursive lock deadlock.
The __mt7921_mcu_regd_update() function can be safely called when the
caller has already acquired the device mutex, avoiding the deadlock
while maintaining proper synchronization for regulatory domain updates.
Fixes: dc2608cf5224 ("wifi: mt76: mt7921: refactor regulatory notifier flow")
Signed-off-by: Charlie-cy Wu <Charlie-cy.Wu@mediatek.com>
Tested-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com>
Tested-by: Devin Wittmayer <lucid_duck@justthetip.ca>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
||
|
Linus Torvalds
|
d5b95e612c |
Revert "i2c: designware: defer probe if child GpioInt controllers are not bound"
This reverts commit
|
||
|
Linus Torvalds
|
9da3fc37f5 |
- Prevent the use of exited events as group leaders
- Avoid use-after-free of an event's group leader by promoting detached sibling events to standalone entities and correct related accounting and state transitions -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmqB6xQACgkQEsHwGGHe VUpWFQ/+KyU6R2DC48ifpChzgTFmQ2gmIjy1IIsWSGmdSbyD5CEWar8hHDRq1X9r peuQizTXTQ2Ze75atTMIBExR6eUFYb2sKA1HpobcGnB96cpK8e2vmxhvXoHgB3IZ TYDXQ1RMPnbyTn2rCQwr5cgSq2Qe7w2tMXMQKzfmDxP1r7cE81zJVFAsRdVVZP75 kvlcCL43pIwzxzP7sDb9bU9lTkW2Sw83dLIp3jBd3iiUpIQpwqV+UG3/fkInV58n L56cYFsovLbvWdxq4oj6cFwRBmvyrYKV0zkT+zW0SO2AzlVhfwCD/o74hxLwrN// Gas0d51uQfWt+5M7s6T0KFQYBfClG4uoIi2yh7zXxWEXyhcNuvmAVrY3xiQxReIi m88+ByWHfBc/mYTHKWJAqb8sHhJiktU52T55ktOJaPNGczA5+O/4alnOg3Kxvw7d CXp1raxJLqDxvd7Ubu/LVjWY96ds+fAaC15ydC6Lh08b9LPhA8rRCavf7NeSOzOD E1NA3QLS3TwbrTboaGqLMmzOLPkBBZ+28PUASg1ZpyfGnw91Ggv/gOVNUgr5PvMU D/gzRCwEYfDdhOrIHzGrfJ1fwj4qFsZ6HSge3sHDj8/BCcQYj/zmlTKe0CHKbaiy D7bkLNwdBc0z+eh5T7UfCYodUu0qiiek5Y0G3q8FVad0mFDYtUA= =moR8 -----END PGP SIGNATURE----- Merge tag 'perf_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fixes from Borislav Petkov: - Prevent the use of exited events as group leaders - Avoid use-after-free of an event's group leader by promoting detached sibling events to standalone entities and correct related accounting and state transitions * tag 'perf_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/core: Fix group leader use-after-free after sibling detach perf: Reject exited events as group leaders |
||
|
Linus Torvalds
|
16429bb371 |
- Add a proper kernel cmdline option to control the TLB invalidation method on
x86 prompted mainly by a recent finding on AMD related to INVLPGB/TYLBSYNC invalidations. Having the command line option is simply another way to alleviate the situation short-term -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmqB44wACgkQEsHwGGHe VUqKSRAAgQKrFw3mH29qsNGjS0GH1m1B6DShBB6/BwJb716gGNfFV/EmYrcwRM4+ GTSA+LGLkKrb45gR+PkKkyoiXDPB/OzfmSlNvD+VCt1t78RdHCXLByye7SxxFjV/ smboswwphQJPLJ8iTeJn+I1jbfC45Wla1hlMgCdHC7tTyyBOPfg32JdQ37cnd2PE 8igsVVhMbEvszhbDrjVAWWUUjlWEjax8ix4rEKMV9J9zETgurK6Vy/G4QNTePSQU cc31FFUp+z+iBNWjCv1jhsuxUbxsH4u7SM3x18cTmgfKz03DQwVnCafkGPy8Rs2o nIdgojAnDginPQ0CsGvB1la7zHQ2MFtBRbNabW+m6WGs2OdwHs1+ATcm0/bFuQBh UqXic8fZ9jYsoGwRfqy/Nsg1ywkrm+IJ5RxSD1+wreGgYPPpEk5tzs5tx4vPFemX dm2ZizKr+kDxZThdTutwV0WY1A/xaix8M5y2poXb929zMy6E+sMwe7fjdnFSZph4 I84PzW4vlH5BTnEK96ROl+ZB4tTMLGBGM/3ymtlmeXAkLiyrj10f+QdKCF1GPHsO Ljv0LVtVL6h4/AJzoV6mYNLCOQUmooMkwwvTYWoHZ3yoqjHGWjGlWDyx7b5uL6BY mFv81rxp0TWcFKLxv8g737NLKH95JAbP9/bKbldc9rmMl/tBOKE= =1btz -----END PGP SIGNATURE----- Merge tag 'x86_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Borislav Petkov: - Add a proper kernel cmdline option to control the TLB invalidation method on x86 prompted mainly by a recent finding on AMD related to INVLPGB/TYLBSYNC invalidations. Having the command line option is simply another way to alleviate the situation short-term * tag 'x86_urgent_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/CPU: Add a tlbi= cmdline switch |
||
|
Linus Torvalds
|
dcb68831ea |
block-7.2-20260815
-----BEGIN PGP SIGNATURE----- iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmqBJfoQHGF4Ym9lQGtl cm5lbC5kawAKCRD301j7KXHgpnZvEAC5y7aQuMkr++q00K/+gkRF2mef/kZPyySR N7alVJW69FgAluun+2MD9Sg1SXNXKlJ+8WAouKwhwbo/LuzzxdrJhJ8FO+94JTqn Dnf01ZCsbSU2KU1/D5Nk81vJTJMHTAmaefvejdJ1X0R8arBNLJ+8TZRRtuxixyez 6kt5HZTEY4n7WtkJs1sDUrbUCYt3jGXRz+sE+bNSzNFOCaTDBqCEquucZpa5QGRl Z7uVdHmpl8aQBCPNJq3H9l3HCav3FYCP8j+6DOzw8wNamlFdBj7ALldEz6uX1Kr9 EySUjW5MT9WwkN6dbSGOmF5bNQYuO8Umv0VsWTnIxXmEb34Jsz7PwVKZ+lJydsp5 Lm1JN9qT0uvN0CHyAL4ni3FnsTZnWDiTozBrZ4+vEPO8jRhTHg52eWtF4kfpaMxJ h2gw0MmPW+TaMQ13EiJ6fqppm/BrqtsX7WBKyKyflZIDXTy+KOoXxaiMO/IDMV0i ttS3yc6qLtvTR9BacLKlGc6YkiP4R9/1xSLWpOjNh18qljzgFFYjxOuszbcCE0/p vrefCd8J14HcCt5Qlw2XGYBptowbsNkEJ/k6L8Og36RAnyYzE84kbfVpiWddk0EU WqwAFWKc1J+1Ujf0TvmiprU1OfCPPeNp2xbDMMCGMRgLb6WSDUgUwBTiM9Hl2TmN N59eL2LfxA== =jmZj -----END PGP SIGNATURE----- Merge tag 'block-7.2-20260815' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fix from Jens Axboe: "A single fix for a regression in this cycle, where drbd would leak shared secrets over netlink. This restores the behavior to match what we had before" * tag 'block-7.2-20260815' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: drbd: don't leak the shared secret to unprivileged netlink dumps |
||
|
Linus Torvalds
|
0bae94aab8 |
io_uring-7.2-20260815
-----BEGIN PGP SIGNATURE----- iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmqA/oQQHGF4Ym9lQGtl cm5lbC5kawAKCRD301j7KXHgpj4ND/9OYcaM9+R/w7sv5+gefzm0omHhlLeg1nZ9 RCUKvG86yq2PaNQfL4Tu+xJAiAMoW1maL0BIhLITzB4Q7X+L6MA6ddEi7180YvoH J3vimltNwJRdwRwQVFgjMI+L5DpBbM864s8Uk53Dj8nYl6pNh/0rcVxxjEfy/6Mz XyT5lijBXSHieL5qynLxPnHyz5jLq0Y/Y9uVWhPxRuYYwrOjWNVPugsnrg17vNpC 3m9OwDzYldsAvoJehd8d6jrDGU/yxRynvP9NV8UfMnwg9k3F+C1f0PdbUrVwQlHh KqmpGluSpYyPuoyL82nS3WUpZ3iTpCvzPEl6g3HpKK3xo2DutaohrqLFt0q/oJd0 B1LoMuIs7nO486ZoodtyvzWWevkEFbKtYlOleLYhYX9N+oOPRczsO64ZL3lyT2MG FsNWaiyN6F5VlI4UAZyxg1PNqtTFutcU6WZjrsWVhOOEvq+rf5on1RgXH/i6LR4n DxEBTXeVrBUWOT0+Y2txxHz6T1UbcWkqdpk781dOZY+HCTg1MVCha20x3YttASBd 9JY03+JSolbBFzocaFXF/mWR1MGJdATWu3mutrdNoboeUiy5R/Kb3E81+a0CCR2K fI0TQ9RhQ+UxI8XW7IkxlTK/6bSyxiEIudgv0sYmKEZgH9O8SNY6ZTD8MeuA1fVN YgbVYoS8eA== =vArh -----END PGP SIGNATURE----- Merge tag 'io_uring-7.2-20260815' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fix from Jens Axboe: "Just a single fix for a potential issue on 32-bit x86 with PAE" * tag 'io_uring-7.2-20260815' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/rsrc: reject overflowing regvec bvec byte counts |
||
Christoph Böhmwalder
|
c71bf113df |
drbd: don't leak the shared secret to unprivileged netlink dumps
The conversion to explicit netlink serialization dropped the
exclude_sensitive parameter from net_conf_to_skb(), so each caller has
to sanitize by hand. Two dump paths were missed:
drbd_nl_get_connections_dumpit() and the volume-less connection branch
of get_one_status(). Neither op carries GENL_ADMIN_PERM, so any
unprivileged local user could read the CRAM-HMAC secret.
Add a net_conf_to_skb_sanitized() wrapper and route all three callers
through it.
Fixes:
|
||
|
Linus Torvalds
|
3eb40771c0 |
SoC fixes for 7.2, part 3
These are three last-minute fixes for the 7.2 release, though nothing alarming: - one error handling fix for optee firmware - incorrect i2c data for the apple M3 that was added in 7.2 - a boot time warning fix for nvidia tegra -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmp/kkEACgkQmmx57+YA GNn0sRAAnDh3M8YkrmeGdU4aLCEIFDa+SB4+5OF2ANtjunGy3kUlPj1f9y9Sk7aq CEA2foLgAOThE7anz3VrV5RC+OHBqfe3OD39kMqdlTJlqZNLpVEbqFsyoMr8owAw zpfwDl8n1u9ROjGEyQ7t6QAE512ZLbwZ3wducoQPFGXZfjTpiuF4P00lpXa729xF H+Pb0WOMz3zytIfGKvKx4RWkiH0/xatiLoy0AO+73b2lCQgkJF4bhdkM+G5XAIvG XBhzO488Pu9vuoXpNnY0lizE2xZiJdhBJkR8/Ad0KrTlaLsjwJkF237ozWQ89F8U /00wS8zE9FXsEQNw9uJj7EjW7nKItxTloq3MELjoXbGV7xW5sEsjWZM3xsvFX5rD uJo4laNmjp7LZgTvlOZ9T5HM3XIMes3MNTqa4qx0bmrpxwy8BiaTuED9ugrUAIkv xR2xejKQdFEIEfJRga9YSVbVhF1fDH0dFG+8BVchx6npFWwFRk/RI0JycFGqUul7 8CNXuweWNaVb0Q/zfwWz99pVNqdDySJpAMh4Pl4GKB++jYRvnHU4sCSqDYrkqWRo UGMpZhuXHpwzVWu3B/gPdk2YW/Mo1jfGN6dPFP3JsfdQx1BaUx/2j4ggJn20nTUw v7bBU2i0ljMvNkClCqY8sIfgWDxiI1vsFzabW5o2PRzm8R+jm94= =xgY+ -----END PGP SIGNATURE----- Merge tag 'soc-fixes-7.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC fixes from Arnd Bergmann: "These are three last-minute fixes for the 7.2 release, though nothing alarming: - one error handling fix for optee firmware - incorrect i2c data for the apple M3 that was added in 7.2 - a boot time warning fix for nvidia tegra" * tag 'soc-fixes-7.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 arm64: dts: apple: t8122: Fix I2C resources optee: ffa: Add NULL check in optee_ffa_lend_protmem |
||
|
Linus Torvalds
|
5e060ff9d1 |
OpenRISC fix for 7.2
A bug fix found by researchers.
* Ensure to mask all privileged bits when restoring the supervisor
register from sigreturn.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE2cRzVK74bBA6Je/xw7McLV5mJ+QFAmqABmQACgkQw7McLV5m
J+TL9A/7BmXvg+A5KT0xKxYrC//OCvD5dGwwKVhc5tEtNhpcWZU4fQo9WioRUpcz
OfbBcKN4RGrpm9Do685mqc2+nOGFcK9SId6eN47ri2G1ZJ1+wXE1IVKLIddlpBzp
rBJJyStBAKG2ICQfgoKM26JGbRttH19hJWSDITLzA2vAMp2gxpV7I1tSiLMrbOym
e/fKuclQ2tlH3DX+CJrRia/azeKRMjhlTCsSCH+FQSG+oegtCd6PP+rWi+i7cIas
pdSrDes+ES6LcGncK+uaNQfIi4D9tm37POYOK1zq4cyQknl4yl0mCWzHDegHocM3
EMAeZXgIxWR2sDn/xGl42gXsEjsIxgwUn9eufvAaNNVomFKOE8cVTsTAI7sgOCsj
9eiLLTCAQdGt8wiKYZLfnSm/tkIrtUs+Uc0v1OWslWUN9pVOuhiE5RYVwt6oOgyf
/16K0OFVggElHSyCkk9WPWryER1fg2n/eaOHflyOCO7YaQj9LL2e6TkVae7jQ+re
vZ1ZgNuSO9ZchcemvtQ0gH28sceRy+R2ICQV7ytuR+7Isxk1kQwXuKFhjNkKcy35
pTVFaFY1d/PwrtgUglk45/9ITFLJZNiz4ToE8jrP8P9+DlQhdp7tmZ2gNmtPb3Ll
H0fOU2Bh4QeAQm4T0XDGlm1U2eGA5gy3HFUUNMXomLdNfpT2vIU=
=p9Ll
-----END PGP SIGNATURE-----
Merge tag 'for-linus' of https://github.com/openrisc/linux
Pull OpenRISC fix from Stafford Horne:
"A bug fix found by researchers:
- mask all privileged bits when restoring the supervisor register
from sigreturn"
* tag 'for-linus' of https://github.com/openrisc/linux:
openrisc: signal: do not restore privileged SR bits on sigreturn
|
||
Ali Ahmet Memis
|
32ef1b30ad |
openrisc: signal: do not restore privileged SR bits on sigreturn
restore_sigcontext() copies the whole supervision register (SR) from the
signal frame and only clears SPR_SR_SM before the value is reloaded into
the hardware SR (through ESR and l.rfe) on the return to user space. All
other SR bits are left under user control.
An unprivileged task can thus return from a signal handler through a
crafted sigframe that clears SPR_SR_DME. With the data MMU disabled the
CPU performs no translation or protection on data accesses, so the task
gains read and write access to arbitrary physical memory, a local
privilege escalation. SPR_SR_IME, SPR_SR_SUMRA, SPR_SR_LEE, SPR_SR_EPH
and the cache-enable bits are exposed the same way. The ptrace GPR regset
already refuses any change to SR for exactly this reason.
Restore only the arithmetic flag bits (F, CY, OV) from the signal frame
and take every privileged control bit from the SR the kernel saved on
signal entry.
Verified with qemu-system-or1k -M or1k-sim: before this change an
unprivileged PoC clears SPR_SR_DME in rt_sigreturn and writes a marker to
physical address 0x03000000 (beyond the kernel's mem=32M); afterwards the
same PoC receives SIGSEGV and physical memory is unchanged.
Fixes:
|
||
|
Linus Torvalds
|
15ef2f78c4 |
Input updates for v7.2-rc7
- A couple of fixes to the sur40 touchscreen driver to correct registration and teardown ordering, and to fix error path unwinding when video device registration fails. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCan/qAgAKCRBAj56VGEWX nIwLAQCryq8oWRzTY1H7QurNDJ89vSwdRJ8CxiLqQgJmWCzgzQD/Vr9SJmWacfn1 TEtDiqHoRSk2wOrZaSDRgsWTH2BOYQI= =RCXW -----END PGP SIGNATURE----- Merge tag 'input-for-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - A couple of fixes to the sur40 touchscreen driver to correct registration and teardown ordering, and to fix error path unwinding when video device registration fails. * tag 'input-for-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: sur40 - fix V4L error path cleanup Input: sur40 - fix input device registration ordering |
||
|
Linus Torvalds
|
dac3e89a2c |
drm fixes for 7.2 final:
scheduler: - revert fair scheduler patches due to regression - mark fair as experimental connector: - fix OOB read in hdmi audio infoframe log: - fix divide by 0 if module param is set to 0 - fix OOB read on empty message - fix infinite loop for too large scale xe: - Fix DPT Allocation paths - Fixes around UM queue BO - Order ring writes before ring tail updates - Add termination on resume for PXP - Document Sentinel and make CTX_TIMESTAMP read TOCTOU-safe - Fix sync entry leak on OA config emit failure - Check managed mutex initilization errors - Fix min frequency setting - Fix xe_device_probe error path amdgpu: - Bounds checking fix in CS IOCTL - Bounds checking fix in GEM IOCTL - Display fixes - GPUVM fix - ASPM fix - UVD bounds checking fixes - VCE 3 fix - BT.2020 fixes - NBIF 6.3.1 fix - IP discovery fix radeon: - Runtime pm fix amdxdna: - skip attempting to populate unmapped pages -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmp/eCcACgkQDHTzWXnE hr4BoA/7By6sGa+PelN5D3XzzJCHWd8/G/A3TFAFLrtpVK6M84qzNHenGFTNO1SF 3stK9CANA5GmXTudR3UJ4/ZagTde2ZU2hI0tHwOlldRvV91+Ed4lTcr6Kf4xzSnP R+Z3KZ/ggvGpKb628Z7hbwhNBkbkTY4TgotY0vCGK59t1M9Is0b3rMDB9ok7Z9ET B2nQr6UQ/3rb7aoOm0cYik2vTplTI7P1pchq0yKaXwZLNGlmuf556u/t3zsb2+3T E2ouifY82di75Fq+mQFhr4IP9SnFukxeXZw0mkykg2TUlPNRosHHYifdBWZztVLn ZVICunIDuzBb/bSgCeC3qM1nhNW3IBse9xTwpcNIm6zA7qantoCB83t8MPbR6d/C C1NVGcWC89AP7sKT5s15Yzpk7Ink1CJ8GReDV87g0NGFQKCihb4MnW8AkF4nRR5O CZuIwEE3M8MDncDBErL+9K1KmHO5UnIy0FEV3lEgSmoRqgG9m/6BAMwzNXbVU3W4 CwlgcKyeFS23f++GW02OMWJVAp4VV7S7b4pxllL0zoL2ZPQZ827BYwpnKBtiOrJp Sb0U0dIKxgho+nA6R2XvdCZItN0OvjyvQK6OCNYAMtC7XEGboJJ3jBf+rkvgM4jo rpumV+1lI/urWO9rhhg2Ri318N9mWIWqIbmKYPIMrGojG3MiKBw= =rauR -----END PGP SIGNATURE----- Merge tag 'drm-fixes-2026-08-15' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "While this is large for rc8 time but also AI driven fixes is a lot of it, we had a more traditional screw up, and a regression was just found in the fair scheduling patches that went in back in rc1. This reverts the fair scheduler back to an option and sets the default back to what it should have been. We might have been a bit overly zealous in switching over, but at least it feels more normal than the AI driven fixes. Apart from the scheduler, it's mostly amdgpu and xe fixes, with some misc fixes to the log code and connector code. scheduler: - revert fair scheduler patches due to regression - mark fair as experimental connector: - fix OOB read in hdmi audio infoframe log: - fix divide by 0 if module param is set to 0 - fix OOB read on empty message - fix infinite loop for too large scale xe: - Fix DPT Allocation paths - Fixes around UM queue BO - Order ring writes before ring tail updates - Add termination on resume for PXP - Document Sentinel and make CTX_TIMESTAMP read TOCTOU-safe - Fix sync entry leak on OA config emit failure - Check managed mutex initilization errors - Fix min frequency setting - Fix xe_device_probe error path amdgpu: - Bounds checking fix in CS IOCTL - Bounds checking fix in GEM IOCTL - Display fixes - GPUVM fix - ASPM fix - UVD bounds checking fixes - VCE 3 fix - BT.2020 fixes - NBIF 6.3.1 fix - IP discovery fix radeon: - Runtime pm fix amdxdna: - skip attempting to populate unmapped pages" * tag 'drm-fixes-2026-08-15' of https://gitlab.freedesktop.org/drm/kernel: (51 commits) drm/log: Fix infinite loop when scale is too large for display drm/log: Fix out-of-bounds read on empty message length drm/log: Fix division by zero when scale module parameter is 0 drm/xe: Fix xe_device_probe() failure drm/xe: Fix a bug in pc_adjust_freq_bounds() drm/xe/oa: Check managed mutex initialization errors drm/xe/oa: Fix sync entry leak on OA config emit failure drm/xe/lrc: document sentinel and make CTX_TIMESTAMP read TOCTOU-safe drm/xe/pxp: add termination on resume drm/xe: Order ring writes before ring tail updates drm/xe/guc_ads: use uncached mapping for UM queue BO drm/xe/guc_ads: allocate UM queues in VRAM on dGFX drm/xe/guc_ads: allocate UM queues in a separate BO drm/xe: Fix DPT allocation paths. accel/amdxdna: Skip unmapped range in aie2_populate_range() drm/amdgpu: Prefer default discovery offset drm/amdgpu: Reject UVD message with invalid number of h265 refs drm/amdgpu: fix nbif 6.3.1 l1 low power not functional drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix ... |
||
|
Linus Torvalds
|
b26d316aaa |
Fixes for the Qualcomm, Rockchip, and SpacemiT clk drivers
- Keep audio working on Rockchip rk3588 by skipping disabling
unused clks
- Fix SpacemiT USB2 clk data so they actually work and keep the
HDMA bus clk enabled to avoid system hangs
- Avoid clk hangs on Qualcomm Eliza display hardware and revert
a patch that breaks PCIe on some Qualcomm platforms
-----BEGIN PGP SIGNATURE-----
iQJIBAABCAAyFiEE9L57QeeUxqYDyoaDrQKIl8bklSUFAmp/RRMUHHN3Ym95ZEBj
aHJvbWl1bS5vcmcACgkQrQKIl8bklSUNJw/9H0FynE4W1JnI5G4KMWJ5g3DUI+BH
y8r/Z+RiCtuwSx7rnu7rKI8Exsg6P1pT2s6Gj4CZN+xBtjDbVIC3hXty99d2VhC6
VwEvUW2/fxTYT2B0UwUNCjvxboWtVLP10DrvVrFSYF7AhYZhRNrq1XygqfXpCF5E
/v1duwPQoYsFrjCbV9eC55IL6rka7CNk1Yqm5scmGG+musPy9x/RaP1wdQbotSI/
Q/oFkNsRcM1/jo/QDVYCP4cZDPgbc+bfydj0a0dGqknW/PIueGu7dOZUIT/q+RoA
9GIcM4jEkBUHb6IVbDKPXvJClirF3kFKmjm3sAnD38MCbiA2D/pdUK6I5GFS2ieB
I1//j6qG08chWzq94HLKJ5Xpkn/L+R6btErwNmodHPgJ/+JnKJHkWWrNVmxR+Txm
YfDK2bP9fPp3Lj8bUDFAHFpWZHSbSNoGHsDrlkHyTA4qt076KGR0XxQfNMJWiVkz
oqctmn9pUJAX5bFFSlxQVs/vQAO87wIijTrIdrRLbhyHR1gu6rDBB+TvCKFokkvR
087zTihEeumyl2P/SrQl8UCXiJm98869SrvsCbfJ4Xvf0C5wwTejhjoOLJoIAJwC
UOJ1Pdi5XsLTbGXheFofeZy09UPzBWzGRxsXkYh8KGtLxi0kov2PULAPYuTMfwga
hLo5q75jO3OWxVA=
=Vc/s
-----END PGP SIGNATURE-----
Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux
Pull clk fixes from Stephen Boyd:
"Fixes for the Qualcomm, Rockchip, and SpacemiT clk drivers:
- Keep audio working on Rockchip rk3588 by skipping disabling unused
clks
- Fix SpacemiT USB2 clk data so they actually work and keep the HDMA
bus clk enabled to avoid system hangs
- Avoid clk hangs on Qualcomm Eliza display hardware and revert a
patch that breaks PCIe on some Qualcomm platforms"
* tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
dt-bindings: clock: Replace bouncing emails
Revert "clk: qcom: regmap-phy-mux: Rework the implementation"
clk: spacemit: k3: set hdma clock as critical
clk: spacemit: k3: fix USB2 bus clock
clk: qcom: dispcc-eliza: Fix disp_cc_mdss_mdp_clk_src RCG stall on Eliza EVK
clk: rockchip: rk3588: don't disable unused I2S MCLK output gates
|
||
|
Linus Torvalds
|
06d9a86e02 |
spi: Final fixes for v7.2
A couple of relatively minor (but as ever important if you're hitting them) and straightforward driver specific fixes, plus one new device ID documented in the DT bindings for the DesignWare controller. -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmp/Vl4ACgkQJNaLcl1U h9Af0Af+J2MqcGcVuUFYO6NG9agqkqZkylfW5rPNPeEL63GqPjo2jh1YTaIiOO1X pOvWxt6Ihf0WQF7MD6WJu7N+wWe2nkVR5AIvLe9HzD5xDBYv8xLd3JQi1O4LsrjL /8aINGhuhizY+PSVQXf5mps0POGX8sb5vE9Q12bE6FCxmUgFSRMISs/dCend8qQl p7YWIQkxkpEj5OWX95iG7wz5Yt0d8JGns+1cCdRaibdKKTG6SlfaQNX0vEV7n1Dx tN3aJyOggSNS4ADed1S/pd1cZyv3663fRvYpya5nL84ynFJFKdHZvElo8AjOuUaO up15wJ4SPnabI5wepnVlNCleLluK/Q== =mKW0 -----END PGP SIGNATURE----- Merge tag 'spi-fix-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A couple of relatively minor (but as ever important if you're hitting them) and straightforward driver specific fixes, plus one new device ID documented in the DT bindings for the DesignWare controller" * tag 'spi-fix-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: virtio: mark device ready before registering the controller spi: dw: fix wrong RX_SAMPLE_DLY setting after resume spi: dt-bindings: snps,dw-apb-ssi: Document Axiado AX3005 |
||
|
Linus Torvalds
|
53313bf327 |
regulator: Final changes for v7.2
There's one fix here for a data entry error in the voltage mapping in the fp9931 driver, and a device ID addition for a LDO in the Qualcomm PM8350b that's just a trivial quirk. -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmp/VZAACgkQJNaLcl1U h9BIiwf+OhrDj0zdVbufHV+m1+Nb8EP+UyfHfluhopSJi3dq1tY1P2Z0patUZdhU gHMizes0lq0e1xce5H4W0cqSRJGylVR9NEDYmrO+c7sePKzVWmb0lznSIrQBg6MA fMtaSfRxn1DjR78oms1h2O1qKHxFuHfIF0mKXEKYJKyKa48l3zU782xgXsXIIeXE xB+4j5DVAW4aPROT/BCsJEmfjCwLw7lwf5o1tsfgtgKO520hdJ7L6wlrHnnmSZFr g9YZDb4J9CDwHbbsBc9FCCJZw4u8rXm/fNQkVYF4DFCfodWQqPvdrB25JBYZM+Lf rOabFiJ99+29qn22bhvg80FdFQAwog== =y4W7 -----END PGP SIGNATURE----- Merge tag 'regulator-fix-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "There's one fix here for a data entry error in the voltage mapping in the fp9931 driver, and a device ID addition for a LDO in the Qualcomm PM8350b that's just a trivial quirk" * tag 'regulator-fix-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: fp9931: Fix VPOS/VNEG voltage selector table regulator: qcom-rpmh: Add support for PM8350B regulator: dt-bindings: qcom,rpmh: Add support for PM8350B |
||
|
Linus Torvalds
|
beea256806 |
regmap: Final fixes for v7.2
A couple more fixes for regmap, this time for the SoundWire MBQ support.
- Several drivers omit the readable_reg callback and it's generally
optional in regmap but the MBQ code had an assumption that one was
present added in one of the APIs, remove that.
- The timeout and retry intervals were swapped in read_poll_timeout()
for soundwire-mbq.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmp/VQkACgkQJNaLcl1U
h9B47Qf7BRh4U/G5/UZqHworvgBB+CUqdc/PdEzPlB7u8VmlEDixRID8tvJv4vX5
oG6dduuNnR/Op9SWD91lU0aicFQgeCPArMKYxsl9A4DRJBcYws70897yJgNdIly+
2sdTxpRhl80bL0FIBaUYOMI9Gg0LD/OuudVaLzEwyYde8M+xfQEBFEjRTPbe68Vr
yg/aAVVsefID3P0fGzbNhuiCLbhUT29K5sXxSM+LDtPk2Bz9Rrt8tBiYGtDmTBxj
J6CGe6wF7kLxLW/PPF4/eNMtnU8oGfq/X2L9G57b9q3QwHV8PcrHFKqH5GuXl1wJ
13QpamimMfyqKmcOUF5GqVbyFG7mww==
=jwlB
-----END PGP SIGNATURE-----
Merge tag 'regmap-fix-v7.2-rc7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap
Pull regmap fixes from Mark Brown:
"A couple more fixes for regmap, this time for the SoundWire MBQ
support:
- Several drivers omit the readable_reg callback and it's generally
optional in regmap but the MBQ code had an assumption that one was
present added in one of the APIs, remove that
- The timeout and retry intervals were swapped in read_poll_timeout()
for soundwire-mbq"
* tag 'regmap-fix-v7.2-rc7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
regmap: sdw-mbq: don't call an unset readable_reg callback
regmap: sdw-mbq: Fix swap of timeout and retry times
|
||
|
Linus Torvalds
|
d2ed9eaaf2 |
MMC host:
- atmel-mci: Fix use-after-free in atmci_remove due to race condition
- loongson2: Fix sg iteration in data reorder functions
- omap_hsmmc: Fix busy_timeout overflow in ns conversion on 32-bit
- sdhci: Make tuning_err a signed int
- sdhci: Unmap the bounce buffer before device release
-----BEGIN PGP SIGNATURE-----
iQJEBAABCgAuFiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmp/I6EQHHVsZmhAa2Vy
bmVsLm9yZwAKCRD+JoQlc1iMKfYNEAC51HDTsIkN0SWfsxC0YT1jeo/90MViAoSm
j8HIXfdueeiV6iJcb2g9oYUKvfdstxWd4Q7Nx5rM6vRwOJqc/gPY9sTbSW/wnyqR
LdJoGSxV88dwmnk3Pc2r2SlB9pbNhFGcGime+RQ/Ri2G1pNpu5FDiFLLAI1c/Rko
5s2kuGOn8LHeezZZdVr5mPDq5Ya+SYZkUmPbdqfJO2NdxZm/XGFcV7V/vAqYizCX
UlgjbFtsSJ6lxhW7cG6IcmDZro2i8hxMZhbdip6qsnY9sazgeG7EkWqDBcqGfAhF
VbgXwk2v/kXvIbN0ygpsoUxA1LTw+Xg09h4gXx6EisQkhUJWiLpipZBNMCcezbEl
HtdfYq/omUfA3ZhvxXTJPFuaT3OqSimYHJs7FF0fbAYpVqS49ep6JeVp0zYH6tjH
Y5ydsDYj31e4e+nuBCvibIfhL3vusXGk9ehXO4kboFSe8YVd6rCz6iJYcNFYKq+B
Hif9bY6FORI1//5nnhFGCSNzyysdeO6mVtDvv08/+1JfNmtGEFQQJQmsTv4W51r+
crlONm41WfNaPFgWtNh6cEyNHJk+tVd6FlotiQnKu3QSWu6FG7vuXrRyuVyOzHYb
G5YEwFyQR1iIrgRsAm9YH084tR7pZLmFwcjXSt/LxNnTw4tGq9RjtLxGBH2GsRtt
UnyQXxL3bA==
=Ihe4
-----END PGP SIGNATURE-----
Merge tag 'mmc-v7.2-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc
Pull MMC fixes from Ulf Hansson:
- atmel-mci: Fix use-after-free in atmci_remove due to race condition
- loongson2: Fix sg iteration in data reorder functions
- omap_hsmmc: Fix busy_timeout overflow in ns conversion on 32-bit
- sdhci:
- Make tuning_err a signed int
- Unmap the bounce buffer before device release
* tag 'mmc-v7.2-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
mmc: loongson2: Fix sg iteration in data reorder functions
mmc: omap_hsmmc: fix busy_timeout overflow in ns conversion on 32-bit
mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition
mmc: sdhci: unmap the bounce buffer before device release
mmc: sdhci: make tuning_err a signed int
|
||
|
Linus Torvalds
|
a823c9da52 |
pmdomain providers:
- arm: Don't treat performance state 0 as an error - mediatek: Fix mt8183 hang on boot - mediatek: Fix potential null pointer dereference - mediatek: Prevent using uninitialized data - mediatek: Avoid setting RTFF's CLK_DIS before NRESTORE - qcom: Add missing MXC and MMCX power domains for Eliza -----BEGIN PGP SIGNATURE----- iQJEBAABCgAuFiEEugLDXPmKSktSkQsV/iaEJXNYjCkFAmp/IjIQHHVsZmhAa2Vy bmVsLm9yZwAKCRD+JoQlc1iMKcMiEACePh2D5q9HrQfb1R1oRjTLm5ozqmR4SHNj bSJ4doCKlqLkAWR8uxeHGqk0RICnXUmeBWg72y3kp1FhymCWu7tr97/jwTtnmgP1 ztWATvb4IxkmjZE6Z+bhGZWnGiMZa2lITvWYnCzC5++dACQkLTTXlo6nBEk824/w RXw85ph/cnXilaQOH6l3T45uZolCmLJWeq+NqDoKhA5aStUmzO8+zAg53MjRpkR0 vZyemvBtrgO0ojYyI/APA4bUQFicmuZY3sXMjUHzRZNU8BWu4lsH8H8Pe3q2qVbn hUKCZmEkukKWFLyOeOMRibm3pKnEXvNuABcNL1KmyAMM91kXN1dfNaVbXUxS/3/2 /+0T4anwQfyTw0qrUUf68HtqaPrCBo9Pj/oP2BODKMORj9MsY2J1LUBNbGQvxux9 MHeT6v71eve7OV7LcQ9sZk1aM6X03BySVQsBhr5su8XQ6XuGVQqv3tTr1tLamoqd N8e0TRjJIjnqa+hu/bDHCcEIOaFDLlvBxFd9c9uLk+NRT1URDIFCzo16W+l01AYn 2XRAKtBpHNqq+2iQVhvnQIVjaijF3pasmkyUr6IsDm6QfKuI9EyJXBeoeqI0ZyQ3 PsuXhaZumFCigvWChvELMkRyScsb8Czyw0fNP2cLlTb77bL1pdXrq8AjfDCoSjp5 S0CskFrnNg== =oG0O -----END PGP SIGNATURE----- Merge tag 'pmdomain-v7.2-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain fixes from Ulf Hansson: - arm: Don't treat performance state 0 as an error - mediatek: - Fix mt8183 hang on boot - Fix potential null pointer dereference - Prevent using uninitialized data - Avoid setting RTFF's CLK_DIS before NRESTORE - qcom: Add missing MXC and MMCX power domains for Eliza * tag 'pmdomain-v7.2-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev() pmdomain: qcom: rpmhpd: Add missing MXC and MMCX power domains for Eliza pmdomain: arm: Fix -EINVAL from scmi_pd_set_perf_state() on state 0 pmdomain: mediatek: Fix mt8183 hang on boot pmdomain: mediatek: fix remaining %pOF after of_node_put() pmdomains: mediatek: Avoid setting RTFF's CLK_DIS before NRESTORE |
||
|
Linus Torvalds
|
a5161661ae |
sound fixes for 7.2
A handful of small device-specific quirks, regression fixes, and build
fixes. Nothing really stands out.
- Fix for a potential UAF in in USB-audio MIDI2 endpoint handling
- Fix for a mixer regression on SteelSeries Arctis Nova 5 in USB-audio
- ASoC Intel HDMI-In capture, ACPI match table additions and quirks
- ASoC AMD quirk for HyperX OMEN
- Fix for ASoC Xilinx about crash in pcm formatter IRQ handlers
- Fixes for ASoC Realtek rt1320 and rt5645 codecs
- Fixes for ASoC TI tas2781 and tac5xx2-sdw build errors
-----BEGIN PGP SIGNATURE-----
iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmp+2KkOHHRpd2FpQHN1
c2UuZGUACgkQLtJE4w1nLE+2nRAAtyZCuZHuWm8ws01CDmLH5bthPVwgW0iBjnHy
mEAA0dRhwsa2lxICsAzcO8C1a+vSN3hOeQS0d+YzbCnaATj6sXMEPXDyy2NvGTWA
lRcv4HIIloDvm+cKw10jJp6p8v6n6OqP80ME34cq8c8LpLoiFDq31yGYqVekRJ+6
JyHEfyqzUCRY1wiZ9TEBnoU0I6112jWbQWhgsJxI/ZURXSBZM8r/nXfyg2cqUwIw
8P/TVhouXEvGSCdbOP7J2r3AglLBnjCcUiGx27cY9T9CJWt0hLzeYIclkZBAFIJV
l8VsiaenCNS0fHGr7fBF7gZx1WooO2724bdHxZiHmWkxNe5wOuWrqa2j66BjbiQM
EUrqpwZRO2fOg3/f2odw8VMIn+XWdszNIdDs75EoNTUZdb31sw3Ac/U1j0NBb3n2
vgXgDrZf+FSfxJ3V5+jwwrt5S2cliynj6qGMa3dObCoCP8dRKrqQoTdYMW+uMmTj
nn4bR2kjdudCJKqe6myqr9HWz8dK6XnfJbnUkYX0zBiFWrvy1yecwcyd9PEF2311
xdpdDbCXXBHvCjSo33e4wIhwd+F/tdwtonIbBpo893pC4ZTKL27Ba9quXJwu6xxB
R8MYBz7sRRlLG93a9Dixrxjp0tRrL6ZnmkW7D524rqD786D2W6sR8FpCTp4uCBwz
bkmGkgM=
=+V0F
-----END PGP SIGNATURE-----
Merge tag 'sound-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai"
"A handful of small device-specific quirks, regression fixes, and build
fixes. Nothing really stands out.
- Fix for a potential UAF in in USB-audio MIDI2 endpoint handling
- Fix for a mixer regression on SteelSeries Arctis Nova 5 in
USB-audio
- ASoC Intel HDMI-In capture, ACPI match table additions and quirks
- ASoC AMD quirk for HyperX OMEN
- Fix for ASoC Xilinx about crash in pcm formatter IRQ handlers
- Fixes for ASoC Realtek rt1320 and rt5645 codecs
- Fixes for ASoC TI tas2781 and tac5xx2-sdw build errors"
* tag 'sound-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
ASoC: Intel: NVL: Add entry for HDMI-In capture support to non-I2S codec boards.
ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers
ASoC: tac5xx2-sdw: select REGMAP_SOUNDWIRE_MBQ
ASoC: rt1320: run the initialisation preset on the first hardware init
ASoC: rt5645: Perform the initial jack detect at probe
ASoC: Intel: sof_rt5682: Add HDMI-In capture with rt5682 support for NVL.
ASoC: Intel: soc-acpi: Add entry for HDMI_In capture support in NVL match table
ASoC: amd: yc: Add DMI quirk for HyperX OMEN Gaming Laptop 16-ap1xxx
ASoC: tas2781: fix clang build error for goto bypassing cleanup variable
ALSA: usb-audio: Fix mixer regression on SteelSeries Arctis Nova 5
ALSA: usb: Fix UAF at delayed release of MIDI2 EPs
|
||
|
Linus Torvalds
|
c5890ac6d5 |
A handful of tiny fixes, with the main ones being a follow-up for
CEPH_IOC_SET_LAYOUT{,_POLICY} ioctl permissions check that went into
-rc5 and a userspace compatibility fixup. The rest mostly harden
against malformed network input. All marked for stable.
-----BEGIN PGP SIGNATURE-----
iQFHBAABCgAxFiEEydHwtzie9C7TfviiSn/eOAIR84sFAmp/SyQTHGlkcnlvbW92
QGdtYWlsLmNvbQAKCRBKf944AhHzi+OMB/9DOUyMrxqGptG9BhzMmHPIMNE7PI+m
jHh0zEnMsE2rKaYfkLNf/p7RrcvcK4PSMCYZKXSUx0D6n3PoEccDW/JTC/rro5B/
3fZIAaZBg8B25o6b0uGjO29e7BY+WouoNAC6fU9F/DtVTnYp4bk40DsvQS6pvFiN
K2sVLIsSBhDZ7czmVlMlpc/er64TRYnWGmaxaAPMuiW5HEhWxvFDav3/r3gsP/fk
mFJ5QU4qcq/q0QmMW7gO9Q+GXjOK2+9eaplNF3wCOSdHIF2nX5knbvgu5n7a4Qoh
GNf0ak7PfFCzUoRdC/4XkMRQAO9IYgzq45EivApJQKvKmETWrzFLQ1uP
=pOld
-----END PGP SIGNATURE-----
Merge tag 'ceph-for-7.2-rc8' of https://github.com/ceph/ceph-client
Pull ceph fixes from Ilya Dryomov:
"A handful of tiny fixes, with the main ones being a follow-up for
CEPH_IOC_SET_LAYOUT{,_POLICY} ioctl permissions check that went into
rc5 and a userspace compatibility fixup. The rest mostly harden
against malformed network input. All marked for stable"
* tag 'ceph-for-7.2-rc8' of https://github.com/ceph/ceph-client:
ceph: use the mount idmap for the owner checks in the SET_LAYOUT ioctls
ceph: fix MDS random selection readiness predicate
libceph: Avoid using invalid osd indices from primary_temp
libceph: fix OOB read in decode_watchers() via missing bounds check
libceph: fix multiple unsafe decodes in decode_locker()
libceph: tolerate addrvecs with multiple entries of the same type
|
||
|
Linus Torvalds
|
ad8d485e66 |
vfs-7.2-rc8.fixes
Please consider pulling these changes from the signed vfs-7.2-rc8.fixes tag. Thanks! Christian -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCan7RJAAKCRCRxhvAZXjc olPOAP9C1jX75LIMjyoJb9lpVAvCdlrvf0wcD88NXVBylueILAEA6GC8/lVpvUX8 nSFAZojyykVsPitfUdsbLagltXwLqgU= =/Rxi -----END PGP SIGNATURE----- Merge tag 'vfs-7.2-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - Don't warn when a mount is completed from another user namespace. fsopen() records the caller's user namespace in fc->user_ns and hands back an ordinary file descriptor. The task that calls fsconfig(FSCONFIG_CMD_CREATE) doesn't have to be the one that created the context, and mount_capable() lets it through as long as the caller has CAP_SYS_ADMIN over fc->user_ns, which anyone in an ancestor namespace does. So fc->user_ns != current_user_ns() is something an unprivileged user can arrange. Both overlayfs and binfmt_misc WARN_ON() that. Overlayfs already has the same check as a plain error return in ovl_parse_param(). Drop the WARN_ON() and just refuse. Add selftests for both cases. - Reject pid allocations through dead ancestor pid namespaces. Require PIDNS_ADDING in every namespace that will receive the pid before publishing any of them. That preserves the invariant that free_pid() never decrements pid_allocated in a namespace whose child_reaper is no longer live. The existing ENOMEM behavior is unchanged. * tag 'vfs-7.2-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: pid: reject allocations through dead ancestor pid namespaces selftests/filesystems: test completing a context from another user namespace binfmt_misc: don't warn when the mount is completed from another user namespace ovl: don't warn when the mount is completed from another user namespace |
||
|
Linus Torvalds
|
97a91cc439 |
RISC-V updates for late v7.2-rc
- Fix a fault caused when the RISC-V Zbb-enabled strlen() is executed on a string that ends right before a page boundary, when the next page is unmapped - Fix a race with the misaligned vector performance testing code that can prevent the outcome of the test from being stored into the vDSO cache - Fix a kernel warning generated by the ftrace code when ftrace_modify_call_code() runs against a ftrace-traced function where a kprobe has already been attached. This shows up in the bpf kselftests -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEElRDoIDdEz9/svf2Kx4+xDQu9KksFAmp+hQMACgkQx4+xDQu9 KktD/hAAgVmzmzpnDwAEpENS57aWo9oNp8uihbM9Dlsi/MVzKKrT0AEsJbjifAQQ IBOIca4z+/R4TBxDif/npui/Z3JRsGzCR2iePbjmg1g78j79P3KTEihF2AN+pVnP Syx5lj6ilOMd9vvI7Akigceh+ZxNQ/OMPrfDFQtWHqyiJgy4Iskr9sM2elTsUx65 rEyYzqlHneq8L4GgeAWzzq4jbaWpEanlsGHKQ8WXC3UFdtZI70pFCrRSQ8qHx59k ZkDW280CaAUX52cqUc7W8EBgIXHG0vgfzyJ66NIumKo7eTlU0OXzLz4x41S05hep OEueIcyLMfMus7nfUZD6AeWrp4xJE0UW7aBD0COV9w1+uPJptahla8vH/NPcFLee uMuAP7S3B9Q/h3LlHUIQKIPa4jT1di2piuQZMScJokzjaEV2/xi7pt0N0kG8pHbu t1pc56KswXZzqqqHPHt9lS2NZimCnWw3ZS4mu8WJ/r/qMm7iLt2lSAySGfoCsdXi Eo3Fg2+HQr53ttm9SRUlKv6/iA3VIW60ZCz/n3eTcym7roz6HWqUqiZNmI/m6TW2 M33gGnvxm78+DxXbt5GNbHpbZQOxHM6xEZrmMwiWc4jXqh7IiD03ITMk8dq2ojNi oLm1qrv3Cv8MCXi2i/Hr+8qs+oVYm/Z6Jl7M9BsHEB1WuSPBrtw= =KAg1 -----END PGP SIGNATURE----- Merge tag 'riscv-for-linus-v7.2-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: - Fix a fault caused when the RISC-V Zbb-enabled strlen() is executed on a string that ends right before a page boundary, when the next page is unmapped - Fix a race with the misaligned vector performance testing code that can prevent the outcome of the test from being stored into the vDSO cache - Fix a kernel warning generated by the ftrace code when ftrace_modify_call_code() runs against a ftrace-traced function where a kprobe has already been attached. This shows up in the bpf kselftests * tag 'riscv-for-linus-v7.2-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: lib: Fix ZBB strnlen reading past count boundary riscv: hwprobe: Register unaligned probes before usermode riscv: ftrace: Fix ftrace_modify_call failure on kprobed functions |
||
Gao Xiang
|
a64d500b00 |
erofs: fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS on some UP platforms
CONFIG_NR_CPUS doesn't define on some UP platforms (e.g. arm), so this can cause make oldconfig to loop indefinitely when CONFIG_SMP=n: $ make ARCH=arm allmodconfig $ sed -i "/CONFIG_SMP=y/d" .config $ sed -i "/CONFIG_EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS.*/d" .config EROFS LZMA default maximum decompression streams (EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS) [0] (NEW) EROFS LZMA default maximum decompression streams (EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS) [0] (NEW) ... Let's guard NR_CPUS with SMP instead of using a hardcoded arbitrary CPU uplimit here, similar to commit |
||
Vincent Guittot
|
333238da9a |
sched: Update time before requeueing delayed entities
In order to compute the right lag, it is required to update time to 'now'. Without this, the delayed entity might appear younger than it really is and receive less compensation for having waited. Signed-off-by: Vincent Guittot <vincent.guittot@linaro.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> |
||
Dave Airlie
|
b2601e783a |
Driver Changes:
- Fix DPT Allocation paths (Maarten) - Fixes around UM queue BO (Jia) - Order ring writes before ring tail updates (Matthew Brost) - Add termination on resume for PXP (Daniele) - Document Sentinel and make CTX_TIMESTAMP read TOCTOU-safe (Gajendra) - Fix sync entry leak on OA config emit failure (Linmao Li) - Check managed mutex initilization errors (Linmao Li) - Fix min frequency setting (Vinay) - Fix xe_device_probe error path (Raag) -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRskUM7w1oG5rx2IZO4FpNVCsYGvwUCan4Y0QAKCRC4FpNVCsYG vw4gAQD/56NgUmv0Rx3BsDCQhjCMb99DtTGbnEvhehmb6nJ0gQD/eBPPDmobVJYZ P0pGk6B014FrmH+PDjD9Vo2EbswLFQE= =ez0c -----END PGP SIGNATURE----- Merge tag 'drm-xe-fixes-2026-08-13' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Driver Changes: - Fix DPT Allocation paths (Maarten) - Fixes around UM queue BO (Jia) - Order ring writes before ring tail updates (Matthew Brost) - Add termination on resume for PXP (Daniele) - Document Sentinel and make CTX_TIMESTAMP read TOCTOU-safe (Gajendra) - Fix sync entry leak on OA config emit failure (Linmao Li) - Check managed mutex initilization errors (Linmao Li) - Fix min frequency setting (Vinay) - Fix xe_device_probe error path (Raag) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Thomas Hellstrom <thomas.hellstrom@linux.intel.com> Link: https://patch.msgid.link/an4ZogmPqP2Xtfx3@fedora |
||
|
Dave Airlie
|
7581e7c73e |
drm-misc-fixes for v7.3:
- Revert fair scheduler patches and mark fair policy as experimental due to reported regressions. - Fix OOB read in connector/hdmi infoframe. - Handle invalid scaling parameters and empty messages in log target. - Skip attempting to populate unmapped pages in amdxdna. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEuXvWqAysSYEJGuVH/lWMcqZwE8MFAmp936wACgkQ/lWMcqZw E8MzVA//aKT/DVfDA9dUljxQS70lC17W0a9sf16rpQsftuRxCUci1x2kXJG5sIGa MaKdxmP8PaR0J+xNC/2rGuk2cyKiQxd4BaRnNYXHY4pLG8FbUmSbhWMrICgxj9XE DUBDXzwqjfq7lxXRsKsqARhkn4rHzb9TS84YeQaUZuuwgL2AbDeSEGZkXMTxKCuJ 0sDD8kklVNJKn4ofke5za3KWJ1gIWP/y+kosmi38kG8oZ5M3Uen6JXv/mp0VhMMd UAM+vRUFtWmkYVTsvxC9BXxdo6nqMUWRviXAeHnt6BijuysQ0ZAIuFvnf7/o+Knu NXDABvoZFuFm6pP4t3BSEX2M2RrwczxfvT465UvYaoLwgLutGxwP4AvmWE4vLe32 5pNQLpfllCkxZeOYuxewTEfWLhykxF8wnSeVy9l6II+/OpkPnUjDAFJkDHcaTk+V dPPmPZrOGC/LeLtD7JYbhRX6FkNQzTKNLjXSDjt3w/Sori3nhXkSAuj0zFDM7rHj KAnXh6B4j3vOAbqUEOHmabLqoRmlgpfP30NSyvLc47hMqvHJj+YV9V+5Ay1Yg3Sh otMusvCZY/vpwvVhlFS45XA8k81YdjnxmUqLrQceJS/KGYHt5Qzc1kP2JynjX+D7 /byp/TzTuBnO8cdXaDz58coAEPdoyfGSjH2qVYs4FgeT06ZPOYQ= =Stgd -----END PGP SIGNATURE----- Merge tag 'drm-misc-fixes-2026-08-13' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes drm-misc-fixes for v7.3: - Revert fair scheduler patches and mark fair policy as experimental due to reported regressions. - Fix OOB read in connector/hdmi infoframe. - Handle invalid scaling parameters and empty messages in log target. - Skip attempting to populate unmapped pages in amdxdna. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Link: https://patch.msgid.link/a9b38792-bdd0-42da-a46a-7a048c26c0c2@linux.intel.com |
||
|
Dave Airlie
|
c3da119ddf |
amd-drm-fixes-7.2-2026-08-12:
amdgpu: - Bounds checking fix in CS IOCTL - Bounds checking fix in GEM IOCTL - Display fixes - GPUVM fix - ASPM fix - UVD bounds checking fixes - VCE 3 fix - BT.2020 fixes - NBIF 6.3.1 fix - IP discovery fix radeon: - Runtime pm fix -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQQgO5Idg2tXNTSZAr293/aFa7yZ2AUCanzNKAAKCRC93/aFa7yZ 2BTKAPwO7Y4oJfUq81w8inePMePgjCn1ML/RtKMErD0VTjfwbgD+MxbL1ABHf1Ar wyHayFAnS2mMGc+3wPoOW21E9TnL4w0= =XNgL -----END PGP SIGNATURE----- Merge tag 'amd-drm-fixes-7.2-2026-08-12' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-7.2-2026-08-12: amdgpu: - Bounds checking fix in CS IOCTL - Bounds checking fix in GEM IOCTL - Display fixes - GPUVM fix - ASPM fix - UVD bounds checking fixes - VCE 3 fix - BT.2020 fixes - NBIF 6.3.1 fix - IP discovery fix radeon: - Runtime pm fix Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20260812200720.2155401-1-alexander.deucher@amd.com |
||
|
Linus Torvalds
|
2f1baf1fc8 |
tracing fixes for v7.2:
- Fix NULL pointer dereference when matching unloaded module wildcard event
The set_event can take events for modules that have not been loaded
yet. This is done by writing '<event>:mod:<module>'.
If '<event>' is not added, then it means to add all events in <module>.
This wildcard is represented by a NULL pointer. If one were to try to
remove the same module item with a named event it would cause a NULL
pointer dereference when comparing the NULL with the name in strcmp().
echo ':mod:kvm' > /sys/kernel/tracing/set_event
echo '!kvm_ack_irq:mod:kvm' >> /sys/kernel/tracing/set_event
The above will do a strcmp("kvm_ack_irq", NULL) and crash the kernel.
Test for NULL (wildcard) before doing the strcmp().
- Fix event data field race in loading two modules at the same time
When a module loads, its trace events get registered. The fields
of the events are also dynamically created and added to the events
fields list. It also will call a function that will look at all the
events for updates that need to be done. If two modules load at the
same time, the one that scans all events and their fields may read
the one being added as the scan doesn't take the event_mutex.
This may cause a data race.
Have the scan take the event_mutex to prevent the race.
-----BEGIN PGP SIGNATURE-----
iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCan438BQccm9zdGVkdEBn
b29kbWlzLm9yZwAKCRAp5XQQmuv6qq6EAPwNoL0MQ5Yk+rRuWIwDj33FFd3Skwe6
DfqVdxVEzCDdzAEArW2usswnZRlOCZddZPUCVj0MWdNz2sVin3p/j0Qklgg=
=W3ej
-----END PGP SIGNATURE-----
Merge tag 'trace-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull tracing fixes from Steven Rostedt:
- Fix NULL pointer dereference when matching unloaded module wildcard
event
The set_event can take events for modules that have not been loaded
yet. This is done by writing '<event>:mod:<module>'.
If '<event>' is not added, then it means to add all events in
<module>. This wildcard is represented by a NULL pointer. If one were
to try to remove the same module item with a named event it would
cause a NULL pointer dereference when comparing the NULL with the
name in strcmp().
echo ':mod:kvm' > /sys/kernel/tracing/set_event
echo '!kvm_ack_irq:mod:kvm' >> /sys/kernel/tracing/set_event
The above will do a strcmp("kvm_ack_irq", NULL) and crash the kernel.
Test for NULL (wildcard) before doing the strcmp().
- Fix event data field race in loading two modules at the same time
When a module loads, its trace events get registered. The fields of
the events are also dynamically created and added to the events
fields list. It also will call a function that will look at all the
events for updates that need to be done. If two modules load at the
same time, the one that scans all events and their fields may read
the one being added as the scan doesn't take the event_mutex. This
may cause a data race.
Have the scan take the event_mutex to prevent the race.
* tag 'trace-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
tracing: Fix race between update_event_fields and, event_define_fields
tracing: Fix NULL pointer dereference in module event cache removal
|
||
Michael Wu
|
c3730b8373 |
tracing: Fix race between update_event_fields and, event_define_fields
The following sequence may leads race between event_define_fields()
and update_event_fields():
CPU0 (loads module A) CPU1 (loads module B)
=============================== ===============================
load_module(A) load_module(B)
notifier_call_chain notifier_call_chain
trace_module_notify trace_module_notify
mutex_lock(&event_mutex) trace_event_update_all()
trace_module_add_events(A) down_write(&trace_event_sem)
__register_event(call_A)
__add_event_to_tracers(call_A)
event_define_fields(call_A)
for each f: list_for_each_entry(field,
list_add(&f->link, &class->fields, link)
&class->fields) field = class->fields->next;
Where access to the class->fields is not protected by the event_mutex in
trace_event_update_all().
This produces the following panic:
Unable to handle kernel access ... at virtual address 0000000000000018
pc : update_event_fields+0xf8/0x368
Call trace:
update_event_fields+0xf8/0x368
trace_event_update_all+0x7c/0x2b4
trace_module_notify+0x4c/0x1dc
notifier_call_chain+0x84/0x168
blocking_notifier_call_chain_robust+0x64/0xd4
load_module+0x10c8/0x123c
__arm64_sys_finit_module+0x230/0x31c
Fix by taking event_mutex in trace_event_update_all() before
trace_event_sem.
Cc: stable@vger.kernel.org
Fixes:
|
||
Hui Su
|
b69859204d |
tracing: Fix NULL pointer dereference in module event cache removal
A module-only event filter such as ":mod:foo" is cached with a NULL
event_mod->match when foo has not been loaded. If a later write tries to
remove a specific match from the same module, remove_cache_mod() passes
the NULL cached match to strcmp(), causing a NULL pointer dereference.
The issue can be reproduced from userspace:
echo ':mod:trace_events_kunit_missing' > /sys/kernel/tracing/set_event
echo '!foo_bar:mod:trace_events_kunit_missing' >> /sys/kernel/tracing/set_event
The second write must be a concatenation (">>") to not include O_TRUNC as
that would cause ftrace_clear_events() to clear the cached modules lines.
The crash was reproduced on x86_64 QEMU while KUnit workers contended on
the event tracing path:
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor read access in kernel mode
RIP: 0010:strcmp+0x10/0x30
Call Trace:
__ftrace_set_clr_event_nolock+0x373/0x4a0
ftrace_set_clr_event+0xf0/0x180
ftrace_event_write+0xdf/0x110
vfs_write+0xf6/0x440
ksys_write+0x68/0xe0
do_syscall_64+0xf9/0x540
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Check event_mod->match before comparing it, consistent with the existing
NULL checks for the cached system and event fields. The mismatched removal
continues to return -EINVAL; a broad cached module filter is removed with
"!:mod:<module>".
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260811173902.1927376-2-sh_def@163.com
Fixes:
|
||
Jasper Wise
|
11058bd3d4 |
spi: virtio: mark device ready before registering the controller
virtio_spi_probe() registers the SPI controller with devm_spi_register_controller(). spi_register_controller() binds a child inline unless its driver has asked for asynchronous probing, so a peripheral that performs a transfer during its own probe reaches virtio_spi_transfer_one(), which kicks the virtqueue before probe has returned. The driver never calls virtio_device_ready(), so DRIVER_OK is set on its behalf by virtio_dev_probe(), only once probe has returned. The virtio spec is explicit about that ordering in 3.1 Device Initialization: | The driver MUST NOT send any buffer available notifications to the | device before setting DRIVER_OK. A device that waits for DRIVER_OK before servicing the queue therefore leaves the transfer unanswered, and virtio_spi_transfer_one() waits for its completion with no timeout, so probe never returns. Mark the device ready before registering the controller, as done for the same reason in commit |
||
Mikhail Gavrilov
|
3aa1dcaa4f |
Revert "wifi: mt76: Disable napi when removing device"
This reverts commit |
||
|
Linus Torvalds
|
e14aacefb7 |
There is a known WiFi/mt76 regression, waiting for a complete fix that
should land soonish.
Including fixes from netfilter.
Previous releases - regressions:
- tcp: fix icsk_ack.ato bitfield overflow
- af_unix: Unlink scc_entry in unix_del_edge().
- ipv4: fix use-after-free in fib_nhc_update_mtu()
- netfilter:
- ipset: fix refcount race between list:set GC and swap
- nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
- sched: act_ct: fix sk_buff leak when the header checks reject a packet
- sctp: clear new_transport when removing a peer
- dibs: correct freeing of dmb_clientid_arr
- ovpn: fix NULL dereference when killing missing key
- eth: veth: fix queue index used to wake the peer txq in veth_poll
- eth: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling
- eth: gve: fix zero-length skb frag with header-split
Previous releases - always broken:
- core: fix skb length accounting after generic XDP frag adjustment
- af_packet: don't send zero-byte data in tpacket_snd().
- eth: bnxt: avoid deadlock when canceling IRQ affinity notifier
- eth: ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-----BEGIN PGP SIGNATURE-----
iQJGBAABCgAwFiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmp93xcSHHBhYmVuaUBy
ZWRoYXQuY29tAAoJECkkeY3MjxOkMMEP/AyjDJBRLMNyKkqY5lEK1ZvPqgaCTWuE
U/A8ZBxveuCmRDCWkEJhQp2bQHuwJsqW9wYmFob8eEEsAmjey7362t3z7OxKuq7x
kL8MOpkSY7MyB1kJBrzNMhBSHtSfbRQ/6vqJApoeXkMYxldi9NKvT1pndVwx1vdZ
G0dVD0dMTR/bWuALfg1aQXAHziACL7eR19eJ/IR9IF2F+Tqi8LgrZpiv0FT9ZU8G
vHeX9P1WpiorU4nnyqpBoNNpam3mTupcXg+ScqSKlkYKUCZV8ILA0rLZijZxXTrK
WbO7VxzAjwoz//GMTHAdnw4m0lsPVpCXGzWm/CIUQ/Z1OO04NXGru6LPOlsgufZ1
LNtbon7+GJ3JWl54/cvBYuDMBaYY+9CW6WdiWdlQuxlaZmixAWpbSxCZuwZMlV9Z
5HRhQfbg1N20zSTNnmKi5o6uwWOWxpQpxIwDkmPlDIpFPX2HtD+gNJ8UqHwIhgcG
j6h2oP2up6PS6NxtWm5+UFXqrwL/0AyI1R5x5hdbOO2rfyfcDDec4eo+qhrOhnkq
uKvBADD4b9zO7hllOz/XQ0uDYfylZlnp4Gx3+6JMYkqeMbk+TmSxrras+g6jnPyk
gTQ9MK2RHoFywDGMiNebDUJAX/fNWxWywzyzuY3izW4B1jho9YGMSLilaJ/xDDQ9
AL7fWaTpvCty
=asb8
-----END PGP SIGNATURE-----
Merge tag 'net-7.2-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Paolo Abeni:
"Including fixes from netfilter.
There is a known WiFi/mt76 regression, waiting for a complete fix that
should land soonish.
Previous releases - regressions:
- tcp: fix icsk_ack.ato bitfield overflow
- af_unix: Unlink scc_entry in unix_del_edge()
- ipv4: fix use-after-free in fib_nhc_update_mtu()
- netfilter:
- ipset: fix refcount race between list:set GC and swap
- nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort
path
- sched: act_ct: fix sk_buff leak when the header checks reject a
packet
- sctp: clear new_transport when removing a peer
- dibs: correct freeing of dmb_clientid_arr
- ovpn: fix NULL dereference when killing missing key
- eth:
- veth: fix queue index used to wake the peer txq in veth_poll
- ngbe: fix NULL pointer dereference in non-MSI-X interrupt
enabling
- gve: fix zero-length skb frag with header-split
Previous releases - always broken:
- core: fix skb length accounting after generic XDP frag adjustment
- af_packet: don't send zero-byte data in tpacket_snd().
- eth:
- bnxt: avoid deadlock when canceling IRQ affinity notifier
- ipvlan: inherit needed_headroom and needed_tailroom from
phy_dev"
* tag 'net-7.2-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (55 commits)
l2tp: fix tunnel and session refcount leak on seq_file release
net/sched: cls_bpf: reject dev-bound programs bound to a different device
sctp: fix use-after-free of cached ASCONF chunk
net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
sctp: clear new_transport when removing a peer
net/dibs: Correct freeing of dmb_clientid_arr
net/sched: cls_u32: skip hash tables in u32_bind_class()
gve: fix NULL dereference due to missing ptp adjfine
gve: fix zero-length skb frag with header-split
net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
af_packet: Don't send zero-byte data in tpacket_snd().
tipc: read le->link under the node lock in tipc_node_link_down()
selftests: tls: cover splice after a failed decrypt
net/tls: Fail tls_sw_splice_read() after a failed async decrypt
net: ngbe: fix NULL pointer dereference in non-MSI-X interrupt enabling
net: tap: fix wrong transport_header when sending VLAN-tagged frame
net: packet: fix wrong transport_header when sending VLAN-tagged frame
vxlan: do not arm the ageing timer on a device that is down
ipv4: fix use-after-free in fib_nhc_update_mtu()
NTB: ntb_netdev: Preserve RX queue depth on allocation failure
...
|
||
|
Linus Torvalds
|
83a4f90e98 |
firewire fixes for 7.2-final
Fix a NULL pointer dereference in 1394 OHCI PCI driver when probe() returns early with an error, as detected by Syzkaller. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQQE66IEYNDXNBPeGKSsLtaWM8LwEwUCan2ycwAKCRCsLtaWM8Lw ExX4APkBTU8zkvG/Gy7oSsFtLZWmy2BXkWxh88PiLkbs2GG3sgEA/x9Y43ysmoM+ OTLeNES8O/tmGjGrq8tZxfYL+AjCCg0= =l4pB -----END PGP SIGNATURE----- Merge tag 'firewire-fixes-7.2-final' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire fix from Takashi Sakamoto: "Fix a NULL pointer dereference in 1394 OHCI PCI driver when probe() returns early with an error, as detected by Syzkaller" * tag 'firewire-fixes-7.2-final' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: firewire: ohci: fix NULL pointer dereference in ar_context_release |
||
|
Linus Torvalds
|
b4f5144d37 |
gpio fixes for v7.2
- use raw_spinlock_t in gpio-ml-ioh to avoid locking context issues - fix a race condition in gpio-ml-ioh by sharing the register locks across channels - fix a use-after-free bug in unbind path in gpio-sloppy-logic-analyzer -----BEGIN PGP SIGNATURE----- iQIyBAABCgAdFiEEkeUTLeW1Rh17omX8BZ0uy/82hMMFAmp9fVYACgkQBZ0uy/82 hMM2bg/4lIfsWQF7GiSs7cgOa/J0DNIo1PZuf2h9cSJYuR10gMBszCVrBrM/qFT0 05MbJGQcaPSW8Zq8QwR+BoaZ20d64iXuipWOkqg53lN5whU28Tm2z2/YFdC/UHAO niXbIstc4d26mm1hc6AwjGV4p6lgzTR2W+IcbkImUAAUQDJX+YE6iasclL2EViz5 fufRQ2VaF159AD5zeNjMxoYRwGlZGAU+qeXwbYDhkt0CBOhAZ0eUhnyQi8zYcnpN OsKmqRplq/tm6jdUjGBoHOFWoXnp4QdukvyEHP/M56WfxyYPOcc9ABCMK45MqpvX b+9eAy0LjQg+38D6geQIP53ZzVKUrbg4NnLItGV8ad6WR9e0t8+xm0c01hKQ9fdw n5R12KMr2OdYjSjq1MAuBbUSRrwBjwdgZuxcE5fo3w0aLYfaVAX9LoFkpuv8WP/U hSUuO9cMxLRnb2ckDVCoazI4lBNuBG2E7si3eodPkFfU6UoiAN8+TQFW3O1AeOnz LDFMnRb3EADMC4LFdnYSUiQRRm0mHnjhLj1BNZ4Rjgd3ZEgfsHv7ez2JNtIyJs5F r7H4XBMH1cthyaIkdXWPoKPyE2AJiEg9g0KyvNTHqp2+ORDtz7o3m11AsXDAjGZm y22YVJUPKUwqVzAabOuoJY872fPQ1N9Zkf9aLrGWNL9MvI+bAw== =Mmpx -----END PGP SIGNATURE----- Merge tag 'gpio-fixes-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - use raw_spinlock_t in gpio-ml-ioh to avoid locking context issues - fix a race condition in gpio-ml-ioh by sharing the register locks across channels - fix a use-after-free bug in unbind path in gpio-sloppy-logic-analyzer * tag 'gpio-fixes-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind gpio: ml-ioh: share the register lock across channels gpio: ml-ioh: use raw_spinlock_t for the register lock gpiolib: Check gc->get_direction() before calling gpiod_get_direction() |
||
|
Linus Torvalds
|
64dc3ba55e |
m68k fixes for v7.2
- m68k: Define NR_CPUS to 1. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQQ9qaHoIs/1I4cXmEiKwlD9ZEnxcAUCan13fAAKCRCKwlD9ZEnx cIo6AP9d3BCY2IMGKEHyeF/W+KUtQ5Abgmpe3IW+aztsxtsZgwD+MR6iM0TIaTg+ e5zlvNICBmIiKHDo3sD1vSssHB3WaQU= =VhE7 -----END PGP SIGNATURE----- Merge tag 'm68k-for-v7.2-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k fix from Geert Uytterhoeven: "Define NR_CPUS to 1. This fixes a long-standing but never critical before oddity on m68k, that turned into a serious configuration issue after a recent erofs change" * tag 'm68k-for-v7.2-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k: Define NR_CPUS to 1 |
||
Shixiong Ou
|
f4f2bba28d |
drm/log: Fix infinite loop when scale is too large for display
When scale is large enough that scaled_font exceeds the display
dimensions, rows or columns become 0. A columns value of 0 causes
an infinite loop in drm_log_draw_kmsg_record() because the loop
never decrements len.
Check for zero rows/columns in drm_log_setup_modeset() and return
an error, cleaning up the already allocated buffer to avoid a leak.
Fixes:
|
||
|
Shixiong Ou
|
60baa179ed |
drm/log: Fix out-of-bounds read on empty message length
drm_log_draw_kmsg_record() accesses s[len - 1] to strip the trailing
newline, but len is unsigned int. If len is 0, the subtraction wraps
to UINT_MAX, causing an out-of-bounds read.
Add an early return when len is 0.
Fixes:
|
||
|
Shixiong Ou
|
921ac6cb06 |
drm/log: Fix division by zero when scale module parameter is 0
The scale module parameter can be set to 0 via kernel command line.
When scale is 0, scaled_font_h and scaled_font_w become 0, causing
a division by zero in the rows/columns calculation.
Since the scale module parameter is read-only (0444 permissions), it
cannot be changed at runtime via sysfs. Clamp it to 1 once in
drm_log_register().
Fixes:
|
||
Takashi Iwai
|
a92ee0d248 |
ASoC: Fixes for v7.2
This set of fixes is bulked out quite a bit by the inclusion of a lot of quirks for various x86 platforms, though there are a few driver specific fixes in here too. Nothing here is terribly critical, we should be fine waiting for the merge window if it's too much. -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmp9tZ0ACgkQJNaLcl1U h9DXYAf/R1QWsCP/mXjOb7M5A2KNRvOR4uIUDtbQYYRF3jibOEWgcq8eRUH40w/P wHKuCQVKGLyFv7g3yiGjfMccHn/CAcOtUBMarnjFWL9c465LLwNkydJAcEe3K7Vf XUNIMEzj7qq4rbCVouWRm3UuPOQXoPwbJxtsDIjKApPD2ml5dmmL7E5e7aC3m4hf RgVzWn4KUvWvr30EdiCUj/5LleysY+OgEDl8MkDm4ZJb1hcZ2wswkGkx1rILVkjR 2ZsqUl2/HYGhYbMerhsuIfTGN9SSMYgPJ4qAWoPhAmfhZHNCwGYGvMg/1Uo3JjB+ /Wmk4NA0yoW9msrCqmFu9ZNDfAQ54A== =3J8V -----END PGP SIGNATURE----- Merge tag 'asoc-fix-v7.2-rc7' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v7.2 This set of fixes is bulked out quite a bit by the inclusion of a lot of quirks for various x86 platforms, though there are a few driver specific fixes in here too. Nothing here is terribly critical, we should be fine waiting for the merge window if it's too much. |
||
Raag Jadav
|
ef526d122b |
drm/xe: Fix xe_device_probe() failure
Currently, xe_device_probe() jumps to err_unregister_display label in case of failure except for its last call, which directly returns the error without required cleanup handling. This results in stale drm device that isn't cleaned up on unwind. Fix it. [ 810.194180] sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:01.0/0000:01:00.0/0000:02:01.0/0000:03:00.0/drm/renderD128' [ 810.194183] CPU: 9 UID: 0 PID: 5616 Comm: modprobe Kdump: loaded Tainted: G S U E 7.2.0-rc2-xe #382 PREEMPT(full) [ 810.194185] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER, [E]=UNSIGNED_MODULE [ 810.194186] Hardware name: ASUS System Product Name/PRIME Z790-P WIFI, BIOS 1805 10/30/2024 [ 810.194186] Call Trace: [ 810.194187] <TASK> [ 810.194188] dump_stack_lvl+0xe0/0x100 [ 810.194195] dump_stack+0x14/0x20 [ 810.194197] sysfs_warn_dup+0x5f/0x80 [ 810.194204] sysfs_create_dir_ns+0xbe/0xd0 [ 810.194210] kobject_add_internal+0xbc/0x2b0 [ 810.194215] kobject_add+0x7c/0xe0 [ 810.194220] ? get_device_parent+0xcf/0x1e0 [ 810.194227] device_add+0xe3/0x870 [ 810.194231] ? __pfx_drm_gem_name_info+0x10/0x10 [drm] [ 810.194280] drm_minor_register+0x73/0x130 [drm] [ 810.194322] drm_dev_register+0x76/0x2a0 [drm] Cc: stable@vger.kernel.org Fixes: |
||
Vinay Belgaumkar
|
5cf82c8cec |
drm/xe: Fix a bug in pc_adjust_freq_bounds()
In cases where min frequency was actually greater than BMG_MIN_FREQ, we were not using the updated min frequency as there was a missing call to pc_action_query_task_state() between the two settings of min frequency. Since we know what min_freq was last set, use that cached value while comparing to BMG_MIN_FREQ to fix this issue. v2: pc->freq_ready is not set until after pc_adjust_freq_bounds(). Stay with pc_action_query_task_state() instead. v3: Update commit message (Stuart) Fixes: |
||
Linmao Li
|
f110dbbfa2 |
drm/xe/oa: Check managed mutex initialization errors
drmm_mutex_init() can fail while registering its managed cleanup action. On failure, the reset path destroys the mutex, so continuing OA setup leaves an unusable lock that later paths may acquire. Return the error from per-GT OA initialization and abort device-wide OA initialization if the metrics lock cannot be initialized. Fixes: |
||
|
Linmao Li
|
8d33c4987c |
drm/xe/oa: Fix sync entry leak on OA config emit failure
xe_oa_emit_oa_config() releases the sync entries and the syncs array only on its success path. When it fails before the point of no return (fence allocation, config buffer allocation or batch submission), it returns without touching stream->syncs. The stream open path handles such failures in the caller, but xe_oa_config_locked() propagates the error without any cleanup, so the syncs array and the fence references held by the parsed entries are leaked. The next config ioctl overwrites stream->syncs, making the memory unreachable for good. Clean up the parsed syncs when xe_oa_emit_oa_config() fails, matching the cleanup done by the stream open error path. Fixes: |
||
Gajendra Uttamchand
|
cb4afddf9e |
drm/xe/lrc: document sentinel and make CTX_TIMESTAMP read TOCTOU-safe
Problem: CTX_TIMESTAMP MMIO reads could be stale if a context switched out between check and read; LRC stores a sentinel while a context starts that must not be treated as a real timestamp. Fix: Check the LRC-stored sentinel before and after the MMIO read; return the LRC value if the context switched out to avoid TOCTOU. Note: Keep XE_LRC_CTX_TIMESTAMP_ACTIVE in xe_lrc.h as the canonical sentinel. Fixes: |
||
Daniele Ceraolo Spurio
|
51afaf53e0 |
drm/xe/pxp: add termination on resume
Suspend/resume causes the PXP keys to become invalid, but doesn't actually kill the session. The driver also doesn't explicitly kill and re-start the session until a new PXP request comes in, which means that the "zombie" session can potentially stick around if there are no new requests from userspace. While this is not an issue for PXP, HDCP has a new behavior starting on PTL where a communication is sent to GSC if a session is active at suspend time (even if it doesn't have a valid key), which can lead to delays in the suspend flow if we suspend while the zombie session is still active. To avoid this, we can trigger a termination on resume and kill the zombie session immediately, instead of delaying the termination to the next PXP request. Due to restrictions in the rpm suspend/resume flow, we can't call the termination flow from within the resume call itself, so the pxp irq worker is expanded to cover this scenario. The existing logic in the worker doesn't work as-is for the new flow, because the pm_get_if_active will fail if the worker runs before the pci_resume call has completed (which is possible, since we queue it from within that call) or after we're started to suspend again. Given that we always want to run the worker after a resume (differently from the irq case, where we want to skip if we're suspended), we can solve this by just taking the PM reference before queueing the worker. As part of this rework, the pxp->events variable has been moved to atomic, to avoid having to take xe->irq.lock from non-irq related paths. Fixes: |