mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-10 20:48:12 +00:00
1,485,420 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Linus Torvalds
|
c03c1a1450 | Linux 7.3 v7.3 | ||
|
Linus Torvalds
|
f909e534f5 |
SCSI fixes on 20261018
All fixes in drivers (or the tape ULD) and one core fix to bsg (the block ioctl equivalent of sg_io). The biggest is the race in auth updates fix in iscsi configfs, but the next biggest one is in bsg but the generic pieces of that are mostly threading reply_len. Signed-off-by: James E.J. Bottomley <James.Bottomley@HansenPartnership.com> -----BEGIN PGP SIGNATURE----- iLgEABMIAGAWIQTnYEDbdso9F2cI+arnQslM7pishQUCatTZmRsUgAAAAAAEAA5t YW51MiwyLjUrMS4xMiwyLDImHGphbWVzLmJvdHRvbWxleUBoYW5zZW5wYXJ0bmVy c2hpcC5jb20ACgkQ50LJTO6YrIWZfAD/ZC6Pwo0OMS8MuYYGwb+fF2YM0Msr+zAG 4gDRU5yDWl0A/jEw1iFbmGyoNTtBTHSE9I38j/nRAaa+UT/JeS4q0g1E =wBqG -----END PGP SIGNATURE----- Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "All fixes in drivers (or the tape ULD) and one core fix to bsg (the block ioctl equivalent of sg_io). The biggest is the race in auth updates fix in iscsi configfs, but the next biggest one is in bsg but the generic pieces of that are mostly threading reply_len" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies scsi: libsas: Fix SMP IO deadlock during HA resume scsi: libiscsi: Validate the task named by a management response scsi: libiscsi: Validate the ITT reflected in a Reject PDU scsi: libiscsi: Reject a negative task index from parse_pdu_itt scsi: target: iscsi: Fix race in discovery auth updates scsi: target: Disable interrupts while holding delayed_cmd_lock scsi: st: Fix use-after-free race between st_remove() and st_open() scsi: st: Save the visited block for the partition the drive is in scsi: xen/scsifront: Check for a NULL shadow entry on a backend response |
||
|
Linus Torvalds
|
8486d35712 |
spi: Fixes for v7.3
A small collection of driver specific fixes, all quite important if you have the relevant hardware. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQReagvpf3TrrA7BoYYv73Ows9A4iQUCatTACAAKCRAv73Ows9A4 if2lAQDfQLZHMIvrU2wGNFBX2CUe2repS3JyRnmRalP9nXSVkAEAgS4wY/wU8wzQ o+7ajrnUAZjgx/IK3HKoV0fXMOvlTAw= =1PL3 -----END PGP SIGNATURE----- Merge tag 'spi-fix-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A small collection of driver specific fixes, all quite important if you have the relevant hardware" * tag 'spi-fix-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: spi-fsl-lpspi: directly return ret in fsl_lpspi_transfer_one() spi: spi-fsl-lpspi: pass struct fsl_lpspi_data instead of struct spi_controller if possible spi: imx: fix slab corruption from undersized DMA bounce buffers spi: tegra114: assert CS GPIO for every transfer in a message |
||
|
Linus Torvalds
|
3d679a244e |
regmap: Fixes for v7.3
The main thing here is a fix for lockdep warnings with MMIO regmaps that use a raw spinlock and a cache, some other lockdep fixes we'd done for the benefit of the maple tree on sleeping buses meant that we were doing allocations for those MMIO regmaps under a raw spinlock. While fixing that Michael Reeves also noticed that the debugfs files were briefly available without the cache structures backing them. There's also a fix for interrupt freeing on error in regmap-irq which had been hanging around because it's not super urgent. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQReagvpf3TrrA7BoYYv73Ows9A4iQUCatS/PwAKCRAv73Ows9A4 idqeAP4y6bdFUzY0e9Ntiixana3IyzJ2dxzrjHIFHcOZl02UhwD8D2jWwFIw0CIs izZUkBabg5UyIeM1NkzZWtmDhkZTaAk= =AS9J -----END PGP SIGNATURE----- Merge tag 'regmap-fix-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap fixes from Mark Brown: "The main thing here is a fix for lockdep warnings with MMIO regmaps that use a raw spinlock and a cache, some other lockdep fixes we'd done for the benefit of the maple tree on sleeping buses meant that we were doing allocations for those MMIO regmaps under a raw spinlock. While fixing that Michael Reeves also noticed that the debugfs files were briefly available without the cache structures backing them. There's also a fix for interrupt freeing on error in regmap-irq which had been hanging around because it's not super urgent" * tag 'regmap-fix-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: Drop map lock during cache init and exit regmap: Remove debugfs before cache teardown regmap: irq: Free the irqdomain we create |
||
|
Linus Torvalds
|
72732cbee6 |
i2c-fixes for v7.3-rc8
Three independent clock management fixes, plus one for a simple reset mask blunder in the qcom-cci interrupt handler. - qcom-cci: prevent lost reset requests during interrupt handling - qcom-geni: preserve the selected source clock - viai2c-wmt: fix clock reference leak - xiic: fix clock disable warnings during removal -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQScDfrjQa34uOld1VLaeAVmJtMtbgUCatTkqQAKCRDaeAVmJtMt bmntAQCohnAvbkYQh6VfaPl5TzQPytHWTMg3AiqyLeDWs7MuAAD/RQS6vFQMyzvj kD1fK/ocHIs/D59T21JiOzhhiNSSNwo= =SdHD -----END PGP SIGNATURE----- Merge tag 'i2c-fixes-7.3-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux Pull i2c fixes from Andi Shyti: "Three independent clock management fixes, plus one for a simple reset mask blunder in the qcom-cci interrupt handler" * tag 'i2c-fixes-7.3-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux: i2c: xiic: restore non-managed runtime PM to fix clk WARN flood i2c: qcom-cci: Fix HALT_ACK reset request being dropped i2c: qcom-geni: Restore the source-clock selection policy i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe() |
||
|
Linus Torvalds
|
a0ff06b3a7 |
firewire fixes for 7.3-final
Fix a regression introduced in v6.19. It affects cancellation of the timer for split transaction timeout when handling a response. The issue is unlikely to occur in practice. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQQE66IEYNDXNBPeGKSsLtaWM8LwEwUCatQ4OwAKCRCsLtaWM8Lw E2sNAP49Zw/nOmC9OaYKthJtKUup5Oi+4kxQnNjnDDNIraa/2gEAnhum0sbs/PHt VCRl5/WMsHPQRgNMrihFO6G+2+KACgQ= =F+OT -----END PGP SIGNATURE----- Merge tag 'firewire-fixes-7.3-final' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire fix from Takashi Sakamoto: "Fix a regression introduced in v6.19. It affects cancellation of the timer for split transaction timeout when handling a response. The issue is unlikely to occur in practice" * tag 'firewire-fixes-7.3-final' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: firewire: core: fix race condition in split transaction handling |
||
|
Linus Torvalds
|
53cbbb09c1 |
x86/core update:
- Emit the FineIBT paranoid "cs" prefix as a byte,
to work around a GNU toolchain build warning (Kees Cook)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrUo24RHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1i2PhAAm4V2NsF3knhwSQ2WC55RTZbXmlYLAJAq
57rUJejuVM7eHrNhsT0FJIesMLbIDHz5RzVSllN7ESBB5zEkbiyIxRonaG6WTiKk
G0y/IyPsA4BWFp9Ojq5NyDhD95do0gTc08Oxd8eEeJULBzGAaErGl8ExX15SQJkh
eMVdAN4RcathkVrgKbdTklXkECa9j4I+rfBlkX4g8bJ22mbi8h8nfYNrlkX9vncf
IxWNwUh3eKAamLHnKeqbmDUOUrP7ss/hWGWRG0La7G+8jWoX3YlWQdzJeMtWzdV6
unNeFIjjP4lvBtKDkfUBf0JZN+mKo/Zwl5dWNQ/A26vOJTJmmFx03YsuWYDXR0+Q
Vqvm09PSSPbKdGWT7MmlJNhEdBUPOLmCSOT06hfHYKsk+Qkx8XMUIz/bTbNW5gVP
eeok5YWMBn3dQ2B4+LfBqxwMeu+jripgJjN0bj1JOHwkMzYthRce3SHyWRW6hsIh
oOReFnmxaImkh22ia1RLnPscp2efkV9InL5IpNXIH3MXpvlNiUfd0OiDMSGS6ici
AnErf5LK1aXLI+agmBx+7XovUb7umnWpUyvLy3f93E6i6o3urGJ2Tg9Eq+pLJPOR
OAYkzsdJiLCVZqiFm+S+8xNCmlnOs76rKk9bOElOBXUej80q0zwQXHzJ8Pl+yBU1
zw54ecYyK8A=
=xZLR
-----END PGP SIGNATURE-----
Merge tag 'x86-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86/core update from Ingo Molnar:
- Emit the FineIBT paranoid "cs" prefix as a byte,
to work around a GNU toolchain build warning (Kees Cook)
* tag 'x86-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/kcfi: Emit the FineIBT paranoid "cs" prefix as a byte
|
||
|
Linus Torvalds
|
23a38e7bb2 |
x86 fix:
- Fix kCFI decoding bug on CONFIG_FINEIBT=y kernels running in
kCFI mode (Kees Cook)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrUkT8RHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1i61BAAiBzFw9ztotYF8xYfsdETueYkK9Qh04sz
7zPFIe6XcGUCKO25EScQlG49wuLFO/n+tGuAEw4MgLsaM6wlzsAz1AY4xTVbkj4T
G7dckQWn0gYt3kooqO+YyTLpko1EGWSngGvLFEEGHpP6rTYVzI3sckfWcJvM1GJ1
UmfPnlOAJDDlzUeGzTJz6J7S5y5/Cb/AWTaktnHb2oiQo0TQFlo5vm2uWR7s4uRp
80WesVJi+lWpCf3BS+qDovXI0wsJCV7g4DpaxZGKuLUspOUjAOqG0/X2LJuNz0jD
PTZT4JZOf3q7k5av10nNRyu3FwSHm/6zR99UXeJgQDq6aLtaOAoEgOz7W0si10gS
uEzzwL0JaavDDtaSUMI6x12bcGmBddCXT4+w+/xWyPSQEj+26JJ0cj5RG1KvXUg/
iTHKd7PZHC6v2B1/8w6hexBxrYvpSb08eO/8w5kOO82fhhS/os5mvaPd1NafeUSM
xqiQYRvGUjJPywdYAFZFeTU7HMZQAa9N3dhA0T1G4ERjqHhd/MufNgiFadh/1DA1
VF+ManJ3KsG+BN0DcP9si5l9MTUJsy6f2n7BRjU4vvx7sCuhsAcQYNhGvAy1F7/0
VsYIpFvFkyUY4SDGEoZw+5t5goAcWDFDZxdjsbXvjdsDpDIHfbWRwU6KpfcoQ7Qr
s5STEOpNHhY=
=vXkY
-----END PGP SIGNATURE-----
Merge tag 'x86-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fix from Ingo Molnar:
- Fix kCFI decoding bug on CONFIG_FINEIBT=y kernels running in
kCFI mode (Kees Cook)
* tag 'x86-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/kcfi: Decode the kCFI check from the trap address
|
||
|
Linus Torvalds
|
88328f850d |
Scheduler fixes:
- Fix __sched_setscheduler() class change race causing
lost reschedules, exposed by recent RCU changes (K Prateek Nayak)
- Fix s64 multiplication overflow in place_entity()'s vlag
scaling code that can corrupt an entity's placement (Hui Su)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrUkEcRHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1j67g/+NaApCtC988ZaWipMkUyRsdYBQAxP+Nhy
TkodntDpFgL4rqLe5guo8d3NXMLJwnvhygcAC7pVy0dfVzWai+ExAUiABggjtrjF
mADPsPmhnzM/gNsgz//2hjJIpam5mivF9aIr20X04UtD9Dtn950RzKYqDibA6nv5
wH7xeB8+vfBElH++le/8NmRCH+6IjVMvpzpDqphbtzssdUutDHkQQRC2epXzIm1/
wjA0qoqoLWqyw1KgIcvP+ixvH1LT57b8K8NzJxnS4lsx62NzHiN+ZahkSmM9JNIY
WEjqOC1C3NyjwyKcroTuaWLuvjxa0R6Rp5mWabEGHXbhQjDJmWiPgacsmYS1ywFz
e5bzwpklcYqq/3x0JaYIhEt41zZ9HkN4X0TZzTsjDOotdxq8v3A81At39YycRRUZ
l6cFvxbQZbCXBAHdIKVzQAAy3t19zK8xsj1mgyffseFGXXMrJucw+IHBL3ExxmSA
WVZW9GRxStFvqzEBu0TxNFjH+VBBi4WGWotmQq4gRH1+gSQIbttwXYXZkt+B8nAT
u9M/CKFeFqGzqF6wZWMjPo8l1sOo9lzdCwFjU78Tjz2tGsL1tuA1Uia8rCxE7Hnw
josNULOdpiRhjrz9G0ycOyMtxu6GJ/sgoFeQiuKQ6MWsDI1xfdg/kM0EkWMkfXK2
Lhc0okwHz5o=
=bK3k
-----END PGP SIGNATURE-----
Merge tag 'sched-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull scheduler fixes from Ingo Molnar:
- Fix __sched_setscheduler() class change race causing
lost reschedules, exposed by recent RCU changes (K Prateek Nayak)
- Fix s64 multiplication overflow in place_entity()'s vlag
scaling code that can corrupt an entity's placement (Hui Su)
* tag 'sched-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
sched/fair: Avoid overflow in place_entity()
sched/core: Call wakeup_preempt() for queued tasks during class change
|
||
|
Linus Torvalds
|
8573787061 |
Perf events fixes:
- Fix x86 Intel uncore driver bug on Diamond Rapids CPUs
that erroneously always-cleared the invert bit (Guixiong Wei)
- Fix accounting bug in the perf mlock 'gift' code causing
unrelated RLIMIT_MEMLOCK functionality to fail (Lorenzo Stoakes)
- Fix perf_pmu_migrate_context() bug leaving events behind during
CPU hot-unplug (Haris Okanovic)
- Update cgroup time when rotating multiplexed events, to fix
time_running & scaled counts accounting bug (Antoine Huret)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrUjygRHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1jyHg/9EZ9g8CN+qf0pOiLM3yOZbyoe88VMZ2ZH
QBYGc1JgBVrrjT6JQYjuNQLakv9BJmbgQ1S/xtpaD93CtzJDzK/Jsg4SwuTINlE7
wB+P8lpoTMhE1tfP7rwOaGdZD9qmkJIwALaDmTFayk5z87MzEbSmlLzRRC2TlB8g
R3hF4KOtYtBwQKCrPIXiHi/LbHmx0c0zP4J9M/MbRvNLM8iZ47mF5PL++mpLyuTS
z+YhUu21cp5SAotOZNsgD1VrVOcPy0vpIdJVYSSC9+OWfvuENoqkcciyoSXWNkT0
O7RbMtBwfS7k2+wA2JgQ8ETcGVB0+G45NWXwHBmLHuU5XK5/Whbzn5cUKhvIdS0J
xnr1MCWm/R+cC6i/wgfH1ysd8VACI/51Lng88ckXaVmkUajj6RZPo+VB2FRG4pvq
FMC/Ap/fSjk2SdAjKHRMp87g19aOsoz+aWb6nGZPApMj0EGcxpPAZAcMSi+HUNyI
N5MmAOiD5imMPWB6UX3OCeDgjwUD2Hnbn3NkZeK2Glm7dUUr1MZTEgQ1QlnBv+Ou
vYMkVVEVEq9NJVA2ShnBF5+wRwUpLzI0+9w8L7ZUQPkiYL9tXAB988qYaQ5k08SZ
iUo9EVj48QFqR4ILNY4iAyp9AuT7LuKMF0cnO+O8rEGR8gxHBOBYLxVzR/xB12lq
48D1b2q3EiQ=
=AxtL
-----END PGP SIGNATURE-----
Merge tag 'perf-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull perf events fixes from Ingo Molnar:
- Fix x86 Intel uncore driver bug on Diamond Rapids CPUs
that erroneously always-cleared the invert bit (Guixiong Wei)
- Fix accounting bug in the perf mlock 'gift' code causing
unrelated RLIMIT_MEMLOCK functionality to fail (Lorenzo Stoakes)
- Fix perf_pmu_migrate_context() bug leaving events behind during
CPU hot-unplug (Haris Okanovic)
- Update cgroup time when rotating multiplexed events, to fix
time_running & scaled counts accounting bug (Antoine Huret)
* tag 'perf-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
perf: Update cgroup time when rotating multiplexed events
perf: Fix perf_pmu_migrate_context() leaving events behind
perf: Track the perf mlock gift separately
perf/x86/intel/uncore: Fix DMR CXL CM invert filter
|
||
|
Linus Torvalds
|
cf20e7f96a |
Locking fixes:
- Fix FUT_OFF_MMSHARED futex hashing bug that can cause
missed wakeups or spurious wakeups on futex-waiting
tasks (Jann Horn)
- Fix lockdep context tracking bug in the deferred hrtimer
rearming entry code, which causes a lockdep chain leak
that will eventually turn lockdep off (Mikhail Gavrilov)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrUjUgRHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1gmPg//W4D6TwoPAhod8ExaSApVeP9vrqUnMkEg
hf5GsvwT+0wW8cD8xaBnUVA2ylcLDurmu+eXedurOdc3VcRh/BSvJlBpPXMLA5pc
L+iiGI8sMK6koNQrDXtFcHJbcdm5CSmNVc7sv0Vodi+7Q4EjZWL1SLI34F/5EbMd
mvgJ1NDVVr/2L1gc1ojsPo6CUWnFTaq8sp48kYDrmpllo8epECQptJ248wfP2Grv
1v43UYjprCjCY/KOvWz6O5wsXL+25vGk5JX2mY9BemmWJEoq7QOlBceJGpZiFmCf
hO2b1a9aI7pKC7lBRBdeQF/GZHF5AF1E7NPmwR7nSSSGfG6z1rVeoq6e4/lewgui
irvPDY2EDz4F5eQxDxZXTXzS7oKddEha4pB2L50/q9leFXdR1JG5Xh5D5p2lK5K0
pUvo0ODt4TEVriX00sH8Q+2SBOyXhAGXfM2lwS0J5LMY9J+yexqn9MldM8ulg6Dm
BoHYw5FXMuJrcUeNA4RM410bN4YGwKRNSzV8JlngQsfMX3EH0m8aorDYJ8TlLd91
Tv3CfK0pIgNe0r2Tvx5xlNHjbypWk6a7GZBrWbQIeRvS1y60xFyus2kqd6OuF4W/
iELs6ZM732881GXtRIQFQz9GbijA5FfSSpL3iPyKO71e/OsOLZGezQi7LXqZ1ZgF
dk7g5R52Vb4=
=V72L
-----END PGP SIGNATURE-----
Merge tag 'locking-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull locking fixes from Ingo Molnar:
- Fix FUT_OFF_MMSHARED futex hashing bug that can cause
missed wakeups or spurious wakeups on futex-waiting
tasks (Jann Horn)
- Fix lockdep context tracking bug in the deferred hrtimer
rearming entry code, which causes a lockdep chain leak
that will eventually turn lockdep off (Mikhail Gavrilov)
* tag 'locking-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
entry: Account the deferred hrtimer rearm as hardirq context for lockdep
futex: Fix mm reuse handling for FUT_OFF_MMSHARED
|
||
Takashi Sakamoto
|
7f9f2d6abc |
firewire: core: fix race condition in split transaction handling
For a split transaction, either fw_core_handle_response() or
split_transaction_timeout_callback() may manipulate the same transaction
entry in the pending transaction list. The return value of timer_delete()
is used to determine which function handles the entry. If the transaction
is a split transaction and timer_delete() returns zero, the timeout
callback may already be running. In this case, the response handler must
leave the entry in the list for the timeout callback to remove.
A previous code refactoring broke this behavior, introducing a race
condition in which both functions could process the same transaction.
This could lead to a use-after-free on the transaction initiator side.
Fix the regression by ensuring that the response handler does not process
the transaction when timer_delete() returns zero. The timeout callback is
responsible for removing the entry from the pending transaction list.
Fixes:
|
||
Lukas Zobernig
|
32c52ec87d |
x86/insn-eval: Fix shadowed segment index in get_seg_reg_override_idx()
Commit |
||
|
Linus Torvalds
|
58161ead29 |
drm fixes for 7.3 final
MAINTAINERS update dma-buf: - revert dma-debug y on debug kernel due to msm interaction core: - fix drm_exec prelocked object interaction i915: - Fix ARL-S host bridge detection - Add sanity checks for malformed DMC firmware xe: - OA uAPI fix - shrinker fix - fix eviction of object with no bo resource - fix LRU for external objects amdgpu: - UVD fix - TTM sched entity fixes - SMU 14 fix - Userptr leak fixes - Runpm ref count fix - CRIU fix - UserQ fixes - USB4 fix - SDMA 3 fix virtio-gpu: - revert double setting blend property - reset device before deleting vqs on freeze vc4: - fix hdmi audio runtime_pm interaction amdxdna: - fix Kconfig invalid configuration rocket: - fix error path for failed init - fix core unbinding and scheduler lookup paths panthor: - fix immortalis configuration -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmrSnhgACgkQDHTzWXnE hr6LQA//T8IJaQ42T8wr4zCjWMzF03fzpZAXRLs+2pV0CfRr3vqsu3onVJn1+Ulw XuKP2jIt3kBHP2ai9G3C1yrkMNj3umM94SKTmH+96tDAilOe1NZ/MVUN7Yg6Ioi4 +E5SykvytJhx2bqCmFN7eFVK+4oIAW01YNNoCCwxzjY75qQuWhzKeQ4ULfA/Qwe4 JgIsKctCoXMfdw4Zt5MEFAN2wFgG2A31VyeYW9eVvR9N7FpwDztwi0VaOb3DzJkx 1SyvS8VQQnxX6KYxsRvylXV+rsg5sA1vJ28Yh403PciHEHmWqBlzJsiqyI13zKXk s5nfB/6fflICQT32qnbNnpLhBmaHUYez7hwuiFHKRxiLC4AikB3LX0NQII6uXlLg 1lmaOt/B9pNM8gpZAS/GqzERE2GoUP628vQ8bWmViD8zqVLij/fAebhQcqnlT3mm O/q7dlsztWEYyDif8Z5sXJ0ZDpbrTMRHlAIcxx5qQTjTxdRiwxoHU8Rb5OB3f6nX 7MGmVFPSIa+i29cfBROSm7XH0DcihHpGaylu5RlXJvP5oHYftVtn/9Pki4HNEof5 FGg9JOviyQ3UWc4TEDX1paLclASzUi4urPiR2eCuMHE5PWYVoQIv1SVX06wIYTjI OxjS/GqV984vyuH65dnMy+XxRMxMTeQHuhVLfIMq5sJ7e41GZIQ= =5s8l -----END PGP SIGNATURE----- Merge tag 'drm-fixes-2026-10-17' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Last set of fixes, mostly amdgpu, some i915 and xe. I think the dma-buf revert is probably the most important: while it is technically correct the fallout from it means we shouldn't enable DMABUF_DEBUG like that yet, and fix the fallout first. Summary: MAINTAINERS update dma-buf: - revert dma-debug y on debug kernel due to msm interaction core: - fix drm_exec prelocked object interaction i915: - Fix ARL-S host bridge detection - Add sanity checks for malformed DMC firmware xe: - OA uAPI fix - shrinker fix - fix eviction of object with no bo resource - fix LRU for external objects amdgpu: - UVD fix - TTM sched entity fixes - SMU 14 fix - Userptr leak fixes - Runpm ref count fix - CRIU fix - UserQ fixes - USB4 fix - SDMA 3 fix virtio-gpu: - revert double setting blend property - reset device before deleting vqs on freeze vc4: - fix hdmi audio runtime_pm interaction amdxdna: - fix Kconfig invalid configuration rocket: - fix error path for failed init - fix core unbinding and scheduler lookup paths panthor: - fix immortalis configuration" * tag 'drm-fixes-2026-10-17' of https://gitlab.freedesktop.org/drm/kernel: (31 commits) drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang drm/amdgpu: keep the eviction fence until the last handle is closed drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions drm/amdgpu/userq: actually validate userq BOs drm/amdgpu: report the BO alignment in bytes in GEM_LIST_HANDLES drm/amdgpu: free the userptr ranges when a CS fails after parser_bos drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl drm/amd/pm: add zero fan stop temperature support on smu 14.0.2 drm/amdgpu: destroy mutex when tearing down ttm buffer entity drm/amdgpu: fix sched entity leak in ttm buffer entity init drm/amdgpu/uvd3.1: Fix checking whether UVD firmware keyselect was already set drm/panthor: fix immortalis condition drm/i915/cx0_phy: Fix ARL-S host bridge detection drm/i915/dmc: Add sanity check for DMC load address drm/i915/dmc: Harden DMC firmware payload parsing drm/exec: don't immediately add prelocked obj to array of locked objs drm/virtio: Reset device before deleting virtqueues on freeze drm/xe: Bump LRU for external objects on exec and rebind drm/xe/oa: Zero OA buffer at allocation ... |
||
|
Linus Torvalds
|
a3bb7a0184 |
sound fixes for 7.3
Here are the (hopefully) last bits for 7.3. At this time, all changes are small and device-specific ASoC fixes. Not super-urgent, but should be fairly safe to take. -----BEGIN PGP SIGNATURE----- iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmrSViUOHHRpd2FpQHN1 c2UuZGUACgkQLtJE4w1nLE/VwRAAkan0lCo3yf6j+dvU3iyR2qYF+9s98dZLlaaw wRQk8ZtPdrSh40NwQ56GTkbbYGuXaKiKU9+YeYnvqodwOE88qpOJHHxy4Li8s3Gx CKg0TfGYSrtzKvDgEGF01EoKbHw8/r+YL6rWi6p3A+FD1bInwkl9qNYnmZWNq/gM tKsRWNgKsSP5jeFAuEAapSNzlaxoQp86Iz+AYGtVaFKK1tImotzvTuz9SUI9dTEv r5QbjvanR1QtPc15iQwTcyKNQIg8C9+LWqA1Lw4aI6dYVVDyIc2UsucFG2Ndnt3Y yeuIK1LIBJPGwc0A76YimztPk/fHOMk5xZPXi2Z6xy0mofN3ACwD8VKhktVVO0kF 7SVWWaGqCIDbCPpY2jpa7Kim9uqdefc18Jg8zHusO7+TU4NvuO8Iih0D1kLQ++WO 5C0O43OIuIvvN5hAiKXdv8wKPz4/BKufn2/RwuwwaRrfTnczsXOXXiHJQhd11gJ8 iGgVQc+1XAYR/u91LC6ilNx7l6dAosgaCiU9aCeL4o1BgeLG738OtObqFuxTRgfo 5Yjr6v5X3CXZB/7gBIhHcsCIwiWcP/iiEBlqifvUdbjJ8qy3z9de9tis2yg/1KFp 1Oqp2V3UTL3sq3xv6eBVXr1w78yR7kXkF8d5LKmTZL0nyjFV7IJRNFNtOsIfPZfO eGS4CFk= =AOo0 -----END PGP SIGNATURE----- Merge tag 'sound-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Here are the (hopefully) last bits for 7.3. At this time, all changes are small and device-specific ASoC fixes. Not super-urgent, but should be fairly safe to take" * tag 'sound-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ASoC: amd: yc: disable MSI on resume ASoC: nau8822: Fix the 128x oversampling switch bits ASoC: wm8978: Fix the 128x oversampling switch bits ASoC: max98371: Fix the Speaker DHT Min Volume bits ASoC: pcm3168a: Fix the DAC zero flag polarity bit ASoC: cs42l52: Fix the NG Type Switch bit ASoC: cs42l56: Put the Limiter Cushion control on the limiter register ASoC: stm32: spdifrx: fix synchronization state check ASoC: Intel: avs: Reset the stream unless it is already prepared ASoC: SOF: sof-client: Use event-handler mutex consistently ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture |
||
|
Linus Torvalds
|
4766082b79 |
pci-v7.3-fixes-6
-----BEGIN PGP SIGNATURE----- iQJIBAABCgAyFiEEgMe7l+5h9hnxdsnuWYigwDrT+vwFAmrSWyQUHGJoZWxnYWFz QGdvb2dsZS5jb20ACgkQWYigwDrT+vxZfg/9G4QxTP/m2gpQW6P+lMmU2xcACa08 K/lNG3HWLg08a0sqgveAv6Kb1dHw6OeUeCprGmZjjSFhkZMALsDiTZgU2pvE3a9m 00L0qKqb6oWRS2qOqULOchlCK8f10MUKJLlc823SKIRw+UEGCzxd+Qk91U3r+jX6 3J9e760m/pRFxmEoVEoW0Hcd1DDIDNII1wHB89J5JdSKJ9qMDSJQjiUoQy7aTWJo ig9bVyq7Rrx6pHBK7oGC/Ua7BRFw0yx8IEda4CbqIg+aj5vciTyaNIMVQkWyMpVT v+YKEIn4jb6zqI9Ei+joswYYq7XvTBe/r8TDLz/ZMqDoNpdRWyNQxkL4Z/hViMGf 51OoLBbXDZH9wi99DWyQrav5R2aGFpNDDOQRsPcNNiEboWu77DAALkPACoIBZvoS gc777dnY+D48vAl1e3wfCzlSReoEHMOm5ROYzBR4jQHTN7DN83nL7eyw/GilcoG4 JcCTaceKp79MngOHmiVGUUyEOfllZvdUq/dneMLRNNvZe9HvjvTnf+0TY4u/9ubb 8/O7hxbEeYqYcW/dk++0Pd02M0qTarvGL5okdajj8FtEzhnTs66Ka/lb4Ekuyxah CEKFeqpI5qzAlsmfkbpu6RCXcg4/gd7jcCe/0LrbMWjebzorPKsy0XVVyoXct5W4 8ZqkJoa8C78lreg= =RsGW -----END PGP SIGNATURE----- Merge tag 'pci-v7.3-fixes-6' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull PCI fixes from Bjorn Helgaas: - Ignore Immediate Readiness on Samsung 990 PRO and 990 EVO Plus NVMe, which falsely advertise it; removal of unrelated delays in v7.2 caused post-FLR state restoration to fail, resulting in a VFIO passthrough regression (Alexander Gruhlke) -Don't treat ~0 as 'device is ready' in pci_dev_wait(); with RRS SV, a device may respond with RRS (resulting in data of 0x0001) or may not respond at all (typically resulting in ~0 data). A v6.12 change treated ~0 as 'ready', resulting in a regression with Intel and Samsung NVMe SSDs (Alexander Gruhlke) * tag 'pci-v7.3-fixes-6' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI: Don't treat ~0 as ready in pci_dev_wait() with RRS SV PCI: Ignore Immediate Readiness on Samsung 990 PRO and 990 EVO Plus NVMe |
||
|
Linus Torvalds
|
9d586910e3 |
printk hotfixes for 7.3
-----BEGIN PGP SIGNATURE----- iQJPBAABCAA5FiEESH4wyp42V4tXvYsjUqAMR0iAlPIFAmrSRhIbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMiwyAAoJEFKgDEdIgJTyms0P/jeEH1xJq001K8uAfPeH +wXdGRlKNuN+0ZRxR+RqjF0KRhgdjG0CBGUZu4ZdhKwaPlTy0ooeZSxohpOeBc/E tEzblYRX7bueoOxHd/5Do2O22qPNxgWvAF1hGChHL/CasPpYjQYE2y5JH9yKsTum R7MpkEbWcn4MR5Dcnd4Kc267bJ1+5xSSppXgfaBPUFhdSR0LsNJ4bB4q59KUDBRy Kx4HS+bBVW7GP6+VwrZ0GdtPr/ztk5BRqVeZt1oETvxQKN7/BV7KWXDRIYjzjqcF f4EeUKgUCWFxa0VG7J+EzghfUu7qJjld5qQKeSMra49xpERgN2KgA3CudZKAvyDe +YHp76U51XD37PXRnNBCy+B0N1o4zzmw06p0sRD2Ka/XVHoWSptRDPV/YLYaihrW lhZkPcNai7U/vJKF8pExbAsfYIY38ai3ZecLCQr9NRdtuZceOl7JpdadW5mDPI0Y 1JJSuC4lt/fUDkcCquruZANLoe8CtE9ueCMGkUQv7yxa77tySoRjZ7GgsZczyyFd orrUhtiSPddepjRFRBf5Sz9msUiKXMFKCvj8v2gtH7ID1NooLh1auHM5bqKrgnag Ohp0HV+oXQ+vo5Gg0rksIxla5JnTbApICp41ksDiKVWeLXchMyL8NGzeo1eZ6wyv 2hbh85lj2TkmSkJOfd6vkYxl =nY7x -----END PGP SIGNATURE----- Merge tag 'printk-for-7.3-hotfix' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux Pull printk fixes from Petr Mladek: - Switch NBCON consoles to the emergency mode in emergency_restart() to see messages even in this shutdown code path - Postpone the start of printk kthreads after smp_init(). It prevents boot stalls on some HW - Typo fix in a previous hot-fix patch * tag 'printk-for-7.3-hotfix' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: printk: Postpone kthread startup printk: fix kernel-doc name for nbcon_write_context_is_braille nbcon/reboot: Switch NBCON consoles into the emergency mode in emergency_restart() |
||
|
Linus Torvalds
|
e2c278bc37 |
tracing fixes for v7.3:
- Fix NULL dereference when copying histogram field variable If event_hist_trigger_parse() creates an action that uses one of pseudo fields for its keys, the hist_data field element will have a NULL for its field member. When looking to match that key, the lookup uses key_field->field->name which will dereference a NULL pointer. Instead use the helper function that handles such cases: expr_field_str(). - Take the trace_types_lock when dropping the buffer_meta reference The tracing_buffer_meta_open() error return drops the trace_array reference with __trace_array_put() instead of trace_array_put() where the former doesn't take the lock and the latter does. - Fix NULL pointer dereference when reading per_cpu/cpuN/buffer_meta These files are created for every possible CPU. But it only contains data for CPUs that have come online. If one is read for a CPU that hasn't come online yet, it triggers a NULL pointer dereference. Have reading of CPUs that have not come on line yet return -ENODEV. - Fix an out-of-bounds shift in the log2 histogram modifier Histograms can take a log2 modifier to have the buckets defined by log2 increments. If a shift is greater than ULONG_MAX or above 2^63, the key falls into a lower order bucket. Use order_base_2() instead of "ilog2(n - 1) + 1" to have all overflowed keys go into the top bucket. - Fix the persistent ring buffer rb_meta_subbuf_idx() accounting The algorithm for finding the index of a sub-buffer in a persistent ring buffer buffer did not take into account the meta data at the beginning of the buffer causing the wrong index to be returned. As rb_subbufs_from_meta() does the proper accounting to find the first sub-buffer, use that function instead of repeating the logic (incorrectly) and make the calculations based off of that. - Fix the symbol name checks for the remote buffer code The remote ring buffer has a build time check to make sure its not using any code that will not be in the hypervisor. For various architectures, there has been false positive reports from this checker. Fix them. - Fix false warning in ring_buffer_map_get_reader() There is a WARN_ON() after rb_get_reader_page() if no reader is returned. But there are legitimate cases where this can happen. Remove the WARN_ON() and also a check that covers one of the legitimate cases that tries to exit out early. There's no need for the check if it just simply allows the return of NULL from rb_get_reader_page(). - Fix the ignored return value from resize_buffer_duplicate_size() Some clean up of the code in tracing_snapshot_write() removed checking the return value of resize_buffer_duplicate_size() and if that failed it would not be detected. - Fix the histogram timestamps for buffered events The histogram timestamps are taken from the events that are recorded. It currently reads ring_buffer_event_time_stamp() but if the event is buffered it does not read it properly. Use tracing_event_time_stamp() which handles both buffered and normal events. - Do not initialize tracefs if tracing is disabled at boot If tracing fails to allocate or some other error is detected, tracing_disabled is set. Do not initialize tracefs in this case as it may expect data to be initialized but is not. - Free eventfs inode after an RCU grace period Currently eventfs_inodes are freed after a SRCU grace period as the iterations in the code use SRCU. There are locations that the inode may still be accessed from the VFS that uses RCU which does not have the same synchronization as SRCU. Add an RCU wait before free eventfs inodes. - Do not fail persistent and remote buffers under memory pressure As persistent and remote buffers have their own pre-allocated memory, there's no reason to check how much memory is available before created them. By checking the memory pressure, these buffers may fail to be created even though their memory is already present. - Account for subbuffer size when checking how much memory is available Before allocating a ring buffer, the size is checked against the current memory pressure of the system. But it assumes every sub-buffer is of page size. This is no longer the case. Use the actual sub-buffer size when calculating how much memory will be used. - Reject non-stack fields for synthetic stacktrace fields Stack traces are special fields and the checks currently do not do enough to make sure that the fields being processed as stack traces are indeed stack traces. Update the logic to properly detect what is or is not a stack trace. - Fix a crash in print_graph_function_event() When a tracer does not define static or default flags the tr->current_trace_flags is set to NULL. If the ring buffer is not cleared when switching tracers, the previous tracers events could be read. The function_graph entries will dereference the tr->current_trace_flags and cause a crash. Set the tr->current_trace_flags to a empty set of flags to prevent it from being NULL. - Separate tracing filter predicate count from allocation The amount allocated for the predicate program is the number of predicates defined plus two for adding "true" and "false" at the end. The nr_preds is incremented by two to accommodate the booleans but is then used as the limit check for number of predicates. This is incorrect as it is now two higher than what is expected. Use a separate variable for the size of the predicate array. - Fix the filter operator stack check The operator stack increments the pointer and then writes the content onto the stack. The check for overflow compared the current pointer to see if it was greater than the stack size before doing so. This is an off by 2 error as the write will be at the size - 1 and the compare is done before the increment. Adjust the check accordingly. -----BEGIN PGP SIGNATURE----- iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCatItoRQccm9zdGVkdEBn b29kbWlzLm9yZwAKCRAp5XQQmuv6qmfsAP9XviDyrl49/PBpuanB2qQzlMGqYQlb CwISmzgWoO1jKQEArNiSpKsIdPLfSJSLfIHAGxAZfmT42SugA4M5jqhW3Qc= =7KiP -----END PGP SIGNATURE----- Merge tag 'trace-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Fix NULL dereference when copying histogram field variable If event_hist_trigger_parse() creates an action that uses one of pseudo fields for its keys, the hist_data field element will have a NULL for its field member. When looking to match that key, the lookup uses key_field->field->name which will dereference a NULL pointer. Instead use the helper function that handles such cases: expr_field_str(). - Take the trace_types_lock when dropping the buffer_meta reference The tracing_buffer_meta_open() error return drops the trace_array reference with __trace_array_put() instead of trace_array_put() where the former doesn't take the lock and the latter does. - Fix NULL pointer dereference when reading per_cpu/cpuN/buffer_meta These files are created for every possible CPU. But it only contains data for CPUs that have come online. If one is read for a CPU that hasn't come online yet, it triggers a NULL pointer dereference. Have reading of CPUs that have not come on line yet return -ENODEV. - Fix an out-of-bounds shift in the log2 histogram modifier Histograms can take a log2 modifier to have the buckets defined by log2 increments. If a shift is greater than ULONG_MAX or above 2^63, the key falls into a lower order bucket. Use order_base_2() instead of "ilog2(n - 1) + 1" to have all overflowed keys go into the top bucket. - Fix the persistent ring buffer rb_meta_subbuf_idx() accounting The algorithm for finding the index of a sub-buffer in a persistent ring buffer buffer did not take into account the meta data at the beginning of the buffer causing the wrong index to be returned. As rb_subbufs_from_meta() does the proper accounting to find the first sub-buffer, use that function instead of repeating the logic (incorrectly) and make the calculations based off of that. - Fix the symbol name checks for the remote buffer code The remote ring buffer has a build time check to make sure its not using any code that will not be in the hypervisor. For various architectures, there has been false positive reports from this checker. Fix them. - Fix false warning in ring_buffer_map_get_reader() There is a WARN_ON() after rb_get_reader_page() if no reader is returned. But there are legitimate cases where this can happen. Remove the WARN_ON() and also a check that covers one of the legitimate cases that tries to exit out early. There's no need for the check if it just simply allows the return of NULL from rb_get_reader_page(). - Fix the ignored return value from resize_buffer_duplicate_size() Some clean up of the code in tracing_snapshot_write() removed checking the return value of resize_buffer_duplicate_size() and if that failed it would not be detected. - Fix the histogram timestamps for buffered events The histogram timestamps are taken from the events that are recorded. It currently reads ring_buffer_event_time_stamp() but if the event is buffered it does not read it properly. Use tracing_event_time_stamp() which handles both buffered and normal events. - Do not initialize tracefs if tracing is disabled at boot If tracing fails to allocate or some other error is detected, tracing_disabled is set. Do not initialize tracefs in this case as it may expect data to be initialized but is not. - Free eventfs inode after an RCU grace period Currently eventfs_inodes are freed after a SRCU grace period as the iterations in the code use SRCU. There are locations that the inode may still be accessed from the VFS that uses RCU which does not have the same synchronization as SRCU. Add an RCU wait before free eventfs inodes. - Do not fail persistent and remote buffers under memory pressure As persistent and remote buffers have their own pre-allocated memory, there's no reason to check how much memory is available before created them. By checking the memory pressure, these buffers may fail to be created even though their memory is already present. - Account for subbuffer size when checking how much memory is available Before allocating a ring buffer, the size is checked against the current memory pressure of the system. But it assumes every sub-buffer is of page size. This is no longer the case. Use the actual sub-buffer size when calculating how much memory will be used. - Reject non-stack fields for synthetic stacktrace fields Stack traces are special fields and the checks currently do not do enough to make sure that the fields being processed as stack traces are indeed stack traces. Update the logic to properly detect what is or is not a stack trace. - Fix a crash in print_graph_function_event() When a tracer does not define static or default flags the tr->current_trace_flags is set to NULL. If the ring buffer is not cleared when switching tracers, the previous tracers events could be read. The function_graph entries will dereference the tr->current_trace_flags and cause a crash. Set the tr->current_trace_flags to a empty set of flags to prevent it from being NULL. - Separate tracing filter predicate count from allocation The amount allocated for the predicate program is the number of predicates defined plus two for adding "true" and "false" at the end. The nr_preds is incremented by two to accommodate the booleans but is then used as the limit check for number of predicates. This is incorrect as it is now two higher than what is expected. Use a separate variable for the size of the predicate array. - Fix the filter operator stack check The operator stack increments the pointer and then writes the content onto the stack. The check for overflow compared the current pointer to see if it was greater than the stack size before doing so. This is an off by 2 error as the write will be at the size - 1 and the compare is done before the increment. Adjust the check accordingly. * tag 'trace-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Check operator stack capacity before pushing tracing: Keep the predicate limit separate from program capacity tracing: Fix crash in print_graph_function_event() tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields ring-buffer: Use subbuf_order in available memory estimation ring-buffer: Skip si_mem_available() for persistent and remote buffers eventfs: Free the eventfs_inode after an rcu grace period too tracing: Do not initialize tracefs work if tracing is disabled tracing: Fix hist trigger timestamps for buffered events tracing: Fix ignored return value of resize_buffer_duplicate_size() ring-buffer: Fix false warning in ring_buffer_map_get_reader() tracing: Fix simple_ring_buffer undef check on sparc64 tracing: Fix simple_ring_buffer undef check on parisc tracing: Fix empty symbol names in simple_ring_buffer undef check ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx() tracing: Fix the shift out of bounds in the log2 histogram modifier ring-buffer: Do not show buffer_meta for CPUs without a buffer tracing: Take trace_types_lock when dropping the buffer_meta reference tracing: Fix NULL dereference when copying keys for a field variable |
||
|
Linus Torvalds
|
2d2fe9fd50 |
Probes fixes for v7.3-rc7:
- tracing: probes: error if BTF is required but unavailable Fix to return an error instead of NULL if BTF is not available when user specify '$args*' meta fetch argument for probe events. -----BEGIN PGP SIGNATURE----- iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmrSAywbHG1hc2FtaS5o aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8bY14IAIQNGUIk12JDJMKWAhZp Zv9jt7ER+3ei2v9qnhnykEvzbMA9PiuPu/6I8u1z+vTkJg7n7YK27DWWZ1o14E1m CRMgo/c+s5H+vWaBwCuxxwYBEWBFNGzB2LFBrb8L6n4cMq07AqSfIRmbz83fZHNl N8nxqK2aENVmnM3wvSM210TuZnYwihPQncRgSAsco6Y260G+LZbPdfDZXYbfWMTD pxkSbjdVGueiowz0zszkDyFMqIR5mtLW1hRMn8qMZaEdeZAPDeruo69hXSRyd2ny X379NoSSNjog2efWmXEzb3OYo5PuGVU1If5eGEBraDRgBiK18nB4a13HVkvfYWWW AM8= =vDMe -----END PGP SIGNATURE----- Merge tag 'probes-fixes-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull probes fix from Masami Hiramatsu: - error out if BTF is required but unavailable Fix to return an error instead of NULL if BTF is not available when user specify '$args*' meta fetch argument for probe events. * tag 'probes-fixes-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: probes: error if BTF is required but unavailable |
||
Alexander Gruhlke
|
e8df1d194c |
PCI: Don't treat ~0 as ready in pci_dev_wait() with RRS SV
With RRS Software Visibility, pci_dev_wait() considers a device ready as
soon as reading the Vendor ID doesn't return the RRS value. Devices aren't
required to respond with RRS while they aren't ready, so the read may
return ~0 and pci_dev_wait() stops waiting too early. This was seen with
Intel [8086:0a54] and Samsung [144d:a80c] NVMe SSDs.
Also wait while the Vendor ID reads ~0. A VF's Vendor ID always reads ~0,
so check its Command register instead, as is done without RRS SV.
Fixes:
|
||
|
Alexander Gruhlke
|
0f8b5d90d1 |
PCI: Ignore Immediate Readiness on Samsung 990 PRO and 990 EVO Plus NVMe
The Samsung 990 PRO [144d:a80c] advertises Immediate Readiness, so pcie_flr() doesn't wait after FLR, but the drive returns ~0 for up to 7 ms. Since commit |
||
Petr Mladek
|
54e1e89a97 | Merge branch 'for-7.3-hotfix' into for-linus | ||
|
Linus Torvalds
|
70dd4ee72e |
Pin control fixes for v7.3:
- AMD: Clear S4 wake bits when firmware has _AEI, this is important for some AMD systems. - Do not accumulate sunxi npins across probe() attempts with deferred probe. (desc->npins just went ++ and ++...) - Qualcomm patch galore: split QUP functions on the Nord pin controller, fix an OF module alias on IPQ5210 so the module modprobes, fix two groups on the IPQ5018, make direction changes exclusive on the SPMI-GPIO, and fix the interrupt target width on four different SoCs. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEElDRnuGcz/wPCXQWMQRCzN7AZXXMFAmrR5asACgkQQRCzN7AZ XXNTFg//S2kHTNXB1aZgHjo1bt0F82kFT0sFVsuddhxXW05Ss4ij27/qPCIRqgaU QY9cT8TRiLlM4eUZyehTeuBwSKT+sgjC8DlBNQj4omsWSK963h78RSbrBD3VpjEi Zra5XBOKvYcUF9DSiP6b+koQ2DgTxy+s7haQQ9wGqV12jGIKa7qrx69I+ERa7zc3 er+zC7ze05Tm3fm5reGKrn0aL4d1OnLrOUIlvsQsKI7CfwnPLf4dh767IUOHTHbD ewyAwZZI/X1cL7JlJ9qqPM33lBsNL1xUq61rJ+c5vhCNyO7XTAD4KuxrUCo03bQA MiNVXJBkPF89y47TNuiSp1evJvRLTf/gWpsLqMg8UwNw8n3huXZXDHQWhmkw2fAC 6Tkk1Te63fiQsaDhSYtT16vLApd1eSld5Fg/MD/7kPgb6me46vV2F4pniF3utF48 Xy+P5AEiMkajnkip6j80e9yiHor8bRh6MfTKRO+GbJcS05Rs42uUNZTZSQrV+pbs t6fml/k9H/pC95rABjHJmC9NMd0SOZz+xNRhC18PdnC7A17s4+e5eRyJ+VMcF9qL jJnIER084wgVnd3yaCai4xEOXKhWXTa7ctR74FxM1iIr8sFj1a0fYp8TAHJngS18 rDDZ0FIL/dPCwU1CRfHF0bOUdYg5dAUxvraxINl0lL8obCshXIE= =jqbg -----END PGP SIGNATURE----- Merge tag 'pinctrl-v7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: - AMD: Clear S4 wake bits when firmware has _AEI, this is important for some AMD systems. - Do not accumulate sunxi npins across probe() attempts with deferred probe. (desc->npins just went ++ and ++...) - Qualcomm patch galore: split QUP functions on the Nord pin controller, fix an OF module alias on IPQ5210 so the module modprobes, fix two groups on the IPQ5018, make direction changes exclusive on the SPMI-GPIO, and fix the interrupt target width on four different SoCs. * tag 'pinctrl-v7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: sunxi: dt: do not accumulate npins across probe attempts pinctrl: amd: Clear S4 wake bits when firmware has _AEI pinctrl: qcom: ipq5018: replace gcc_plltest with pwm2 on gpio12 pinctrl: qcom: ipq5018: update PWM groups and corresponding pin functions pinctrl: qcom: spmi-gpio: make direction changes exclusive pinctrl: qcom: ipq5018: add missing pwm3 function on gpio13 pinctrl: qcom: qcs8300: Fix intr_target_width pinctrl: qcom: maili: Fix intr_target_width pinctrl: qcom: hawi: Fix intr_target_width pinctrl: qcom: nord: fix GPIO interrupt target width pinctrl: qcom: ipq5210: Publish the OF module alias pinctrl: qcom: nord: Split QUP1 SE2/SE3 into lane-pair functions |
||
|
Linus Torvalds
|
7b441fe5a6 |
power sequencing fixes for v7.3
- with the PCIe code reworked to power the endpoint via pwrctl before it starts the link training, we can now remove the workaround for WLAN power which instead started causing an issue with endpoint enumeration -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEkeUTLeW1Rh17omX8BZ0uy/82hMMFAmrR5D4ACgkQBZ0uy/82 hMOEaxAApBLm3IqWdD5Ll1u63o09TXi1+vhgrdu3OkDekzhuI3gGDU8zfKNNuFpf UNZbGcf2HNIz3mWaKMZflt9BPnA4z/ruFp7coWTL2ytpz65StOZ500BtfVv2+/bX bm07lojdDini1IT0gvKSy3QdW2ygvIXDe78AhWZWYybwnFN+HRoOIj8Dzg13lJAb B4JAckLJZT4XEs5UvxTt97gn0KRDsr91XNlF6ADVP17VKo5MloYgeUsczlidYdeg P3w7OWNuqdvCXD0OZBN8oggGiiFljm7OFqjvQMAOyuMQ/CYev6qWE2FWVhglTMNc Xnvu9aLz4yKlP6oTs1k9InPvbD5mhOYXwyckyg7+FpvQyehsSBZ2qv8JraD6gNVi gQiB0WG04khhvYhxG/OYNLY1vEWw1zcVSKSYmLzv3YV/geF/qkFZ1x+l0s4PoCez ShiFDNnn5tkxMATJn14t8lNzZkXoWZvVXaER06hjsR2MTjf1bJc6K5rerw47KG1y FKMvwrnc07zslnB8GksXIHMFe6GAbXzoWIUwlZzrzwZ3GXXsB6xNMaz9dnzlkPEc vSo8wUT6LBuV17/6fXZMr4kI2M4nI6wiiF78c+fP0jyKw33HI0s9ybRyMzCKFW6L n9BZ2EbOlHs/N66UCcZQZs2/4KiPAvG5+dBOIGxeYU4MOxkyVug= =SaiM -----END PGP SIGNATURE----- Merge tag 'pwrseq-fixes-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull power sequencing fix from Bartosz Golaszewski: - with the PCIe code reworked to power the endpoint via pwrctl before it starts the link training, we can now remove the workaround for WLAN power which instead started causing an issue with endpoint enumeration * tag 'pwrseq-fixes-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: power: sequencing: qcom-wcn: power off WLAN at probe |
||
|
Linus Torvalds
|
586a28a179 |
gpio fixes for v7.3
- gracefully handle unsupported fwnode-only, no-device GPIO lookup for shared pins - mark the GPIO controller as sleeping in gpio-nct6694 - fix a GPIO device reference leak in kunit tests - fix memory leak in error path in gpiod_set_array_value_complex() - fix races in GPIO controller and its associated irqchip setup in gpio-mxc - use atomic bitops where races can occur in gpio-mxc - fix build failure in gpio tools -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEkeUTLeW1Rh17omX8BZ0uy/82hMMFAmrR4iEACgkQBZ0uy/82 hMNndxAAmWw+V/POtQI8MUVVpp9vvmxSbBA+E//owQRKE8+67RR42pxvVyL1KDj1 laLUX/ZEWSe4jfLwK11hSbqona3wcGTzgzNJIpDfix70QNwY2rKaJ9xx5xAF8+LJ v1do7Et54FYJyhhuoeMNgLvaULpSXw4Vg9FeO6yHlLdUmkbKRSEgxlBN2UZ70Wgb +7xeYgZpzN9OHQ/ldIsdsFwZTn8Zc7zx1a+dxlUy6OZ/ndXBBE5FOOOBCj97qCbN AdDhNuIxH72l9dMgGJ9uvgVYU0ZVFl6RXYG4XB239dVsX80ewDP/XolOJM9wlxVT p3i/zgv4SaTn8n/oKeUojvCNcR9dXrDouL/Fo2iRSEwwv87mVWyBMVAyWmTKAo9b tvi3F2cZeSLYrvf0ZKGz08BbOxtxToATWxHq303PYRExFWq1h5l9n5D0XairNZrZ cFeqP5rAOxWkB44aQRT1xU9LCZjYDO+LYYvevwfANrDseMpeJJmue/hBFPsIfWfs I2gWNpKC9cG1R5H/pNsEn9JqO7VwQCuYx6QswTIDUlE4Wca11qZcz3APeriDIO67 PAHBOSm7jwKJ9nuXp9PfLYjqGss+uT1o6pYiJfYOA8PtvZofwqkeXvU0B8G2OIFt KxcvHDg+soCqpaoYOBJLNAnMlvaJLg6ABHHi4SLrjUxsY1SiTAQ= =ZNMF -----END PGP SIGNATURE----- Merge tag 'gpio-fixes-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - gracefully handle unsupported fwnode-only, no-device GPIO lookup for shared pins - mark the GPIO controller as sleeping in gpio-nct6694 - fix a GPIO device reference leak in kunit tests - fix memory leak in error path in gpiod_set_array_value_complex() - fix races in GPIO controller and its associated irqchip setup in gpio-mxc - use atomic bitops where races can occur in gpio-mxc - fix build failure in gpio tools * tag 'gpio-fixes-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: mxc: fix race between gpiochip registration and IRQ domain setup gpio: mxc: fix wakeup_pads bit operations gpio: mxc: fix both_edges bit operations gpio: mxc: fix race between chained IRQ handler install and probe completion gpiolib: fix memory leak in gpiod_set_array_value_complex() on error paths gpio: kunit: fix GPIO device reference leak with __free() gpio: shared: gracefully handle no-device lookup of shared GPIOs gpio: shared: fix use-after-free bug when adding shared proxies tools: gpio: fix building from the top level with O= gpio: nct6694: Mark the GPIO controller as sleeping |
||
John Ogness
|
5f339c46f1 |
printk: Postpone kthread startup
There have been various bug reports related to SMP systems hanging
on boot. The reports vary but seem to have some overlap with regard
to missed IPI's during SMP setup. The reports also show that
reverting NBCON console usage allows the bugs to disappear.
The NBCON kthreads for console printing are started very early
during boot using early_initcall(). Since these kthreads are
asynchronously enabling/disabling interrupts during early boot, they
may be interfering with early SMP setup on some hardware platforms.
Starting the console printing kthreads later has shown to avoid the
hanging on systems that could previously reproduce the issue.
Postpone kthread starting until after all arch initcalls have
completed.
Reported-by: Derek Barbosa <debarbos@redhat.com>
Closes: https://lore.kernel.org/linux-rt-users/arPmYPbFLf2EldIl@debarbos-thinkpadt14gen5.rmtusma.csb
Fixes:
|
||
|
Linus Torvalds
|
1dbb742205 |
vfs-7.3-rc8.fixes
Please consider pulling these changes from the signed vfs-7.3-rc8.fixes tag.
Thanks!
Christian
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlQAKCRCRxhvAZXjc
ooBKAQCaO0P/WCAUk+nHRuqKMT5Wjpcb+RKbZEDYxMt+JobeOwEAhx4ThOT8eOwX
D2x/HjeOJ66fkbtFP1dXJzKaySf/PAs=
=g2mr
-----END PGP SIGNATURE-----
Merge tag 'vfs-7.3-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull vfs fixes from Christian Brauner:
- Fix a range of use-after-frees during rcu pathwalk caused by non-rcu
frees.
Whatever ->permission(), ->d_revalidate(), ->get_link(), ->d_hash()
and ->d_compare() read in rcu mode has to be freed after a grace
period. umount(2) hides most of it because namespace_unlock() waits
for one, but a chdir() out of a lazily unmounted directory or the
close() of the last file on it drops the last reference without.
* ext4_get_link() reads the sbi and the extent status counters for a
symlink stored in a data block. Both are freed after a grace
period now.
* The unicode map of casefolded ext4, f2fs and tmpfs was freed under
generic_ci_d_hash() and generic_ci_d_compare().
* ntfs3 with nocase freed its sbi and mount options under its dentry
hash and compare. A remount freed the old options right away too.
* eventfs freed an eventfs_inode after an SRCU grace period only
while tracefs_d_revalidate() reads it under rcu_read_lock().
* afs and 9p are only saved by the grace period their private bdi
gets in bdi_unregister(). They stop depending on it.
* create_ipc_ns() leaked the mqueue mount and its superblock on a
late failure. A long-term mount needs kern_unmount().
- Don't let idle threads pin the initramfs.
The idle threads of the secondary cpus are forked from PID 1 with a
private copy of its fs_struct, aren't on the task list so
pivot_root() never moves them and never exit. So the initramfs stayed
pinned forever on every machine with more than one cpu, 70 to 150 MB
in the reports. They share init_fs now like init_task does.
- A mount that copy_tree() leaves out can't take over a lock.
copy_tree() drops mounts of mount namespace files from the copies it
makes for unshare(CLONE_NEWNS) and propagation without looking at
MNT_LOCKED. So root in a user namespace could bind a child's
/proc/<pid>/ns/mnt beneath a locked cover, let it take the lock over,
unshare(CLONE_NEWNS) and read the file. copy_tree() refuses with
EPERM now and the move beneath a locked mount is refused up front.
- Revert "namei: don't reveal overmounted entries in refwalk" from the
rc7 fixes. The bug class is bigger than that patch.
- namei: lookup_fast_for_open() checked ->d_inode while
traverse_mounts() checks the type in d_flags, which is set second, so
a refwalk racing the instantiation could fail an O_CREAT open with
ENOENT. Use d_is_negative() in both places.
- Drop the smp_mb()s in mntput_no_expire_slowpath() and do_umount()
that mnt_get_count()'s own barrier made redundant.
- fsnotify: a mark added while fsnotify_destroy_marks() walks the
connector could be missed and the connector detached, so an fdinfo
read called igrab(NULL). New marks are refused during teardown.
- pipe: a failed second fasync enable on an O_RDWR FIFO removed the
existing reader entry and cleared FASYNC while the writer entry
stayed, a use-after-free in send_sigio() later.
- watch_queue: post_one_notification() could see nr_notes before the
note pool behind it and dereference a NULL array. An unprivileged
user can trigger that with a key watch. Publish nr_notes last.
- pid_namespace: zap_pid_ns_processes() waits without bound for a
tracer outside the namespace to reap its zombies and neither wait was
freezable, so every suspend attempt failed.
- exit: is_child_subreaper and has_child_subreaper shared a word with
other bitfields written without a common lock, so racing prctl()s
lost a bit. They are separate bools now.
- autofs: a notification write that failed on a pipe the daemon had
already replaced put the superblock into catatonic mode again and
closed the replacement. Only do that for the current pipe.
- ovl: reject a lowerdir ending with an unescaped backslash with EINVAL
instead of a confusing ENOENT later.
- ocfs2/dlm: take dlm_reco_state_lock when the debugfs state file walks
the recovery participant list.
- samples/pidfd: fix the userprogs typo that kept pidfd-metadata from
being built.
* tag 'vfs-7.3-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (24 commits)
Revert "namei: don't reveal overmounted entries in refwalk"
selftests/filesystems: test that a mntns file can't take over a lock
fs: let idle threads share init_fs
namespace: a mount that copy_tree() leaves out can't take over a lock
namei: test for a negative dentry the way traverse_mounts() does
fs: pass flags to copy_fs()
ovl: reject lowerdir ending with unescaped backslash
fsnotify: prevent mark additions during connector teardown
pid_namespace: make zap_pid_ns_processes() freezable
fs: drop the smp_mb()s that mnt_get_count() made redundant
autofs: ignore notification errors from a replaced pipe
ntfs3: free replaced mount options after a grace period
ntfs3: free the sbi after a grace period
unicode: free the map after a grace period
ipc: drop the mqueue mount with kern_unmount() on setup failure
eventfs: free the eventfs_inode after an rcu grace period too
9p: free the session after a grace period
watch_queue: Fix note pool publication race in watch_queue_set_size()
afs: free the super info after a grace period
pipe: preserve existing fasync readers on writer setup failure
...
|
||
Darrick J. Wong
|
519abe8d9a |
MAINTAINERS: remove myself
After 14 years at Oracle and 23 years working on Linux, I've decided to step back for a while. Signed-off-by: "Darrick J. Wong" <djwong@kernel.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
||
Toke Høiland-Jørgensen
|
90201351a8 |
wifi: atk9k: Revert "wifi: ath9k: reject short WMI command responses"
This reverts commit
|
||
Christian Brauner
|
214897acc8 |
Revert "namei: don't reveal overmounted entries in refwalk"
This reverts commit
|
||
Dave Airlie
|
f91a4ac696 |
amd-drm-fixes-7.3-2026-10-15:
amdgpu: - UVD fix - TTM sched entity fixes - SMU 14 fix - Userptr leak fixes - Runpm ref count fix - CRIU fix - UserQ fixes - USB4 fix - SDMA 3 fix -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQQgO5Idg2tXNTSZAr293/aFa7yZ2AUCatFOSAAKCRC93/aFa7yZ 2FitAQCbgycMNHcIO9TIMmLHjXYxf+i+anvcOWGisTKrVUSwvgEA9N66HO/gdHeu usvZZ/TNUapW/6U82aKwyBBLUaaM7Ag= =pby9 -----END PGP SIGNATURE----- Merge tag 'amd-drm-fixes-7.3-2026-10-15' of https://gitlab.freedesktop.org/drm/amdgpu/kernel into drm-fixes amd-drm-fixes-7.3-2026-10-15: amdgpu: - UVD fix - TTM sched entity fixes - SMU 14 fix - Userptr leak fixes - Runpm ref count fix - CRIU fix - UserQ fixes - USB4 fix - SDMA 3 fix Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20261015221002.1728931-1-alexander.deucher@amd.com |
||
|
Dave Airlie
|
7669e0b1b9 |
An OA uAPI fix by zeroing OA buffer at allocation,
and other 3 small fixes around eviction and shrinker. -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEbSBwaO7dZQkcLOKj+mJfZA7rE8oFAmrQzRUACgkQ+mJfZA7r E8pgrwf/YYQ5XFov4XIODAFxS4+d+3Opn1On2ppa7ikeNkM8pl3JyXosT9dl1qKB YSpStPfkmKhgMenMZ9xMk/6jRX5Dcwb19Yj1X6gZMGHRSnSLjFaFZCEu3MJY6ss+ e77BGbIOewenxm2rSbcSW6cztmLIuR+taXvrI+EIbUd0Q0y/7zcthKjIm7AB98iQ TnnAdHq73ZVsC8KJ3crN6AT4VDfKk/4cSpLrvehDWnUfiJeL+/QF/bx03i9YBZJB ZYlz4g/g6h/z1LzSHFJWlkQeTKL7gQLdGBFNqDvjOMokjZOO+3Hz53rIDpzOkQbf ee+/3/vy7T41321VFIeu8uvCbHeJSg== =SGK0 -----END PGP SIGNATURE----- Merge tag 'drm-xe-fixes-2026-10-15' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes An OA uAPI fix by zeroing OA buffer at allocation, and other 3 small fixes around eviction and shrinker. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/atDNMV-Aohu6s0gE@intel.com |
||
Antoine Huret
|
e4c7c401c6 |
perf: Update cgroup time when rotating multiplexed events
Since commit |
||
Haris Okanovic
|
e76b36b4be |
perf: Fix perf_pmu_migrate_context() leaving events behind
__perf_pmu_remove() walks the group leaders of a CPU and PMU with
perf_event_groups_for_cpu_pmu(), removing each one as it goes.
perf_remove_from_context() takes the leader out of the groups rbtree,
after which rb_next() on that node returns NULL, prematurely ending the
walk. Other groups stay behind in the source context.
On CPU hotplug, they are then torn down with the dying CPU. They keep
running until teardown, while the PMU's interrupt and migrated events
are on a new CPU, which drivers rely on never happening.
Walk ctx->event_list instead and pick out the PMU's events by their
pmu_ctx.
Fixes:
|
||
Lorenzo Stoakes (ARM)
|
78436f3882 |
perf: Track the perf mlock gift separately
The locked_vm field in struct user_struct was originally introduced by commit |
||
Hui Su
|
2f93bcb3f9 |
sched/fair: Avoid overflow in place_entity()
place_entity() inflates an entity's virtual lag with
lag * (load + weight) / load
Commit
|
||
Guixiong Wei
|
cf1f186e08 |
perf/x86/intel/uncore: Fix DMR CXL CM invert filter
The DMR CXL CM PMU places its invert filter at config bit 21 and its
9-bit threshold at bits 23-31. However, dmr_uncore_cxlcm uses
GENERIC_PMON_RAW_EVENT_MASK, which covers the threshold through the
generic bit 23 invert field and bits 24-31 threshold field, but does not
include the relocated invert bit. As a result, uncore_pmu_event_init()
silently clears bit 21 and inv=1 programs the same configuration as
inv=0.
Add bit 21 to a DMR CXL CM-specific event mask so the requested invert
filter reaches hardware.
Fixes:
|
||
|
Dave Airlie
|
2963ea57b0 |
A revert for the blend mode property patch being applied twice and a
patch to reset the device when frozen in virtio, a power state fix for vc4, a Kconfig fix for amdxdna, an error handling, reference counting, and a null pointer dereference fix for rocket, a revert for dma-buf for a commit introducing a dangling reference, a locking fix for exec, and a fix for panthor to handle 10-core GPUs. -----BEGIN PGP SIGNATURE----- iJUEABMJAB0WIQTkHFbLp4ejekA/qfgnX84Zoj2+dgUCatCZeAAKCRAnX84Zoj2+ diIFAX9m9Ghzv6Ih6aVNU0szvI9vS5Z3ESQGqOXfMO5A2Rb/8ksmaipmpTBDt3sj j/nYRaYBgMEFy8QEF7ISMhJ58bcJUI0vWUbot7NkLPxTzBOc2/fy422wdZH1nHjI fZkt0mESfA== =09LF -----END PGP SIGNATURE----- Merge tag 'drm-misc-fixes-2026-10-15' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes A revert for the blend mode property patch being applied twice and a patch to reset the device when frozen in virtio, a power state fix for vc4, a Kconfig fix for amdxdna, an error handling, reference counting, and a null pointer dereference fix for rocket, a revert for dma-buf for a commit introducing a dangling reference, a locking fix for exec, and a fix for panthor to handle 10-core GPUs. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maxime Ripard <mripard@kernel.org> Link: https://patch.msgid.link/atCZfcTvshZx6mcA@houat |
||
|
Dave Airlie
|
70db8dea2a |
Merge tag 'drm-intel-fixes-2026-10-15' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes
- Fix ARL-S host bridge detection - Add sanity checks for malformed DMC firmware Signed-off-by: Dave Airlie <airlied@redhat.com> From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com> Link: https://patch.msgid.link/atBtrhSxjkB7bVwm@jlahtine-mobl |
||
|
Linus Torvalds
|
2f2f7eeef8 |
soc: fixes for 7.3, part 3
A small number of last minute bug fixes came up since LPC.
Most of these are for devicetree files:
- Tegra264 needs fan descriptions to keep the system from
overheating
- A cleanup on TI DRA7 caused a regression on PCI support
and needs a fixup
- The beaglev-fire board can no longer probe the mcp3564
sensor after a an inconsistent update in 7.1
- A few fixes address compile time dtc warnings on tegra
The other three patches are all addressing minor problems
in tegra drivers and the sama5 defconfig.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmrRN+gACgkQmmx57+YA
GNk1DBAAiYSI8eVMq5N2EllU+A8Sdi2xf/2SwGlJ9StAR8IiQJy9hp+RvyKxfESJ
0Y00nME3eHklrDtlL8WZn3k9UmqK+yJDO+XuE2ZqIlDajWyzAWodyVRvsAT8KCNT
UqCyDTOWVdKO7J5E1PqGBdkYofyMzn12vmdlJxZT/GTs1tE0EXDuRIqoMcAwNAFw
TPMqhuFhpyNUTLBTyroUkQT/wkO+rGwSlgD0xVH3C+EO0FT9/RfeOiyJt/DjFJpF
XRrQyzglVuQG4IUfLyX/vJWTYnnMDH+2urFZKr70FmLwnaowv19NAUUMfDq2SM82
/XKYwDrV4PZrASQO8i7z6x+gyNs3J+mJccqO0DORxZ2y020SMLe6ovWyHJkvr2PQ
+bQD8XfocAV+GpoqdX9+jlg/xRsavtg56uToMP+wMkbzc1P0/Ujuz+AyOUmoiA+p
pMjOZX1Q+0UoKH+R5OgjoEXCnhWRsvvvpMpdDDfW3/c7KIzYtW/PumEqX2xphhHR
RC7b6iehd9/n+t8pBA2lScLTxuNVBPLz23yEEKbH5En7dJh9Wk1Prmdcx/uOFzRk
Iin7OFuc/vWVWGbUe+StY+HCPEOvCG8wEjNLc0eTbmyGIyC5CW8p5pJwoUznkomT
6Sa7z9+QpF14x+upjy38TiA4LdYh5oDfkacu0wram6HF6rSIu04=
=EhfK
-----END PGP SIGNATURE-----
Merge tag 'soc-fixes-7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
Pull SoC fixes from Arnd Bergmann:
"A small number of last minute bug fixes came up since LPC.
Most of these are for devicetree files:
- Tegra264 needs fan descriptions to keep the system from overheating
- A cleanup on TI DRA7 caused a regression on PCI support and needs a
fixup
- The beaglev-fire board can no longer probe the mcp3564 sensor after
a an inconsistent update in 7.1
- A few fixes address compile time dtc warnings on tegra
The other three patches are all addressing minor problems
in tegra drivers and the sama5 defconfig"
* tag 'soc-fixes-7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
ARM: configs: sama5: enable current Microchip KSZ DSA symbols
soc/tegra: pmc: Fix uninitialised clock rate
riscv: dts: microchip: beaglev-fire: remove double definition of gpio interrupts
ARM: dts: ti/omap: dra7: fix PCIe PHY clock divider definition
soc/tegra: fuse: Add missing newline to APBMISC error message
arm64: tegra: Add PCIe root ports on Tegra264
arm64: tegra: Reorder reg and reg-names to match bindings
arm64: tegra: Add PWM fan on Jetson AGX Thor DevKit
arm64: tegra: Add PWM controllers on Tegra264
|
||
Taeyang Lee
|
c47a7b11bc |
tracing: Check operator stack capacity before pushing
predicate_parse() uses the first operator stack entry before processing
any opening parentheses. A push then increments top before writing.
The existing check still permits that write when top already points to
the last allocated entry, which can access beyond the operator stack.
Reject the push when top reaches the last allocated entry.
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Taeyang Lee
|
803aa6fc2d |
tracing: Keep the predicate limit separate from program capacity
predicate_parse() adds two to nr_preds to reserve the terminal TRUE
and FALSE entries. It also uses that increased value as the limit for
parsed predicates. If the initial count is smaller than the number
actually parsed, the program can fill the allocation and subsequent
accesses can go past its end.
Keep nr_preds as the predicate limit and use a separate value for the
allocation size. This leaves space for both terminal entries and a
zeroed entry when parsing stops at the limit.
Cc: stable@vger.kernel.org
Fixes:
|
||
Hao Ge
|
3cc117514d |
tracing: Fix crash in print_graph_function_event()
tracing_set_tracer() assigns the flags of the newly selected tracer
with:
tr->current_trace_flags = t->flags ? : t->tracer->flags;
If the new tracer defines neither static flags nor default flags, like
hwlat, irqsoff or wakeup, add_tracer() has no per instance flags copy
for it, and both operands are NULL, so tr->current_trace_flags ends up
being NULL as well.
The ring buffer is not cleared when switching tracers: it is reset
inside tracer_init(), after current_trace_flags was already assigned.
If the buffer still holds function_graph entries of the previous
tracer, printing one of them dereferences the NULL pointer. This was
hit by cat trace during an ftrace stress test:
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor read access in kernel mode
RIP: 0010:print_graph_function_event+0xe/0x20
Call Trace:
s_show+0x4d/0x110
seq_read_iter+0x2d4/0x490
seq_read+0x130/0x170
vfs_read+0xb5/0x370
ksys_read+0x6d/0xe0
do_syscall_64+0xbc/0x450
The snapshot buffer is not reset at all, so this can be reproduced
without a race:
echo function_graph > /sys/kernel/tracing/current_tracer
echo 1 > /sys/kernel/tracing/snapshot
echo hwlat > /sys/kernel/tracing/current_tracer
cat /sys/kernel/tracing/snapshot
Rather than teaching every user of tr->current_trace_flags about this
corner case, make sure it is never NULL: when the newly selected
tracer has no flags at all, tracing_set_tracer() falls back to a
static empty no_tracer_flags. run_tracer_selftest() can hit the same
case, so the same fallback is added there too. The existing users
already handle opts == NULL, so these tracers keep behaving as before.
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261015130658.221198-1-hao.ge@linux.dev
Fixes:
|
||
Marc Kleine-Budde
|
b0f0c761ed |
spi: spi-fsl-lpspi: directly return ret in fsl_lpspi_transfer_one()
Both fsl_lpspi_dma_transfer() and fsl_lpspi_pio_transfer() only return negative error values in case of error or 0 in case of success. Directly return ret, there is no need to check for positive error values and return them as 0. Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Link: https://patch.msgid.link/20261009-spi-fsl-lpspi-more-cleanups-v1-2-2d4549d5205e@pengutronix.de Signed-off-by: Mark Brown <broonie@kernel.org> |
||
|
Marc Kleine-Budde
|
4eac392e48 |
spi: spi-fsl-lpspi: pass struct fsl_lpspi_data instead of struct spi_controller if possible
Instead of passing a spi_controller pointer to functions and using spi_controller_get_devdata() to get the struct fsl_lpspi_data pointer, directly pass a struct fsl_lpspi_data pointer. Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20261009-spi-fsl-lpspi-more-cleanups-v1-1-2d4549d5205e@pengutronix.de Signed-off-by: Mark Brown <broonie@kernel.org> |
||
Richard Leitner
|
59eb22641f |
spi: imx: fix slab corruption from undersized DMA bounce buffers
Since commit |
||
Abdurrahman Hussain
|
d33373c565 |
i2c: xiic: restore non-managed runtime PM to fix clk WARN flood
The devres conversion replaced manual pm_runtime_enable()/disable() with
devm_pm_runtime_set_active_enabled() and dropped the remove-time runtime
PM teardown. The managed release tears runtime PM down in the wrong
order: it calls pm_runtime_dont_use_autosuspend() before
pm_runtime_disable(), i.e. while runtime PM is still enabled, and devres
is LIFO so the devm_clk_get_enabled() release runs afterwards.
At remove(), pm_runtime_put_sync() leaves the device active with the
autosuspend timer armed. Clearing use_autosuspend then makes rpm_idle()
suspend immediately, and xiic_i2c_runtime_suspend() clk_disable()s the
clock. The later devm_clk_get_enabled() release clk_disable_unprepare()s
the already-disabled clock, so clk_core_disable() WARNs ("clkN already
disabled") on every teardown.
Drop the managed helper and restore the non-managed runtime PM setup and
teardown, so runtime PM is enabled once in probe and disabled once in
remove and the clock enable count stays balanced.
Order the remove teardown so runtime PM is disabled before the usage
count is dropped: pm_runtime_disable() followed by pm_runtime_put_noidle()
instead of pm_runtime_put_sync(). Dropping the count first with autosuspend
still enabled arms the autosuspend timer, and a preemption before
pm_runtime_disable() lets it expire, suspend the device and clk_disable()
the clock, which the devm release then disables again - the same WARN.
Restore the non-managed IRQ request as well. The probe error paths now
unwind runtime PM by hand via goto, and a devm-registered handler is only
freed later during devres unwind, so it would stay live across the manual
teardown (and across any future failing step added after it). Request the
IRQ with request_threaded_irq() and free it explicitly in the probe error
path and in remove. The probe error path also clears use_autosuspend, to
match the teardown in remove().
Fixes:
|
||
|
Linus Torvalds
|
62f482ff73 |
IOMMU Fixes for Linux v7.3-rc7:
Including:
- AMD IOMMU:
- Revert an interrupt remapping check removal that caused GPU
regressions on some platforms.
- Generic page tables:
- Fix KUnit builds with distributed Clang ThinLTO by preserving
compiler flags, preventing x86-64 code generation from arm64
bitcode.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEr9jSbILcajRFYWYyK/BELZcBGuMFAmrRHVAACgkQK/BELZcB
GuOjzQ/9GY563Et8jjc1CaAYjnVeBnD+s9waLfmnRgkiRUosgR46pe6+sbjLFCYv
QvciJFblQ5nbF5+tcTDD6lNZje/LvI4H0Rmx6gdFf+mApSlTpls/Pc2adf/Quhvw
rNAtZXxZuzPXocxPk50Q2eLcntvSuPWcyF2faUnlkY0cWbaSajjvWgG8Ak/qxIyx
ifnQG+cv3u006Rf+YAQ/yewiyt9fbm+1t+bLtlyLZmv9gDLZ5pOWx/2mHfYeg5Gc
EkeS4MYz/tR7RcPse3r8IHEVB55cVa+P1frx25oNlAHtl5xtjKGM7nAzugLLpGCK
eVnXGF8h6bRYta3AfIr2BrE9u4AgV8toXK4g5Dg3evhGtOBrI7i3/YQe/DfBa9fi
bP8HWyrT1SsFEDHBeyS9H0CmaXdYe0Try73m30OivDOP2hgNqv0uWoZUHxD8Ej4j
Ht/JsfbpJ40uH3b2nRyHmuWXPr3bmeyiAq0m9TKqG6AZEKgcjwRPopuce9bqtjku
IiVXmCIBAwrM9Guwhzlo/2R5E44edEPjvuoquu6hI4tjZFp1+8nmZe51FKmCMYCk
uFsCzCJINFZ5vB1lWGDgCoVD5csnNqlwx1kxNnxBUpvJMCDOluY9h3LOTZVKJFaW
hQEMl3639119WelxWhG8+Oc4P5DYeMWc4+mFrQ7YwYhzNCNcV+w=
=fthU
-----END PGP SIGNATURE-----
Merge tag 'iommu-fixes-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux
Pull IOMMU fixes from Joerg Roedel:
"AMD IOMMU:
- Revert an interrupt remapping check removal that caused GPU
regressions on some platforms
Generic page tables:
- Fix KUnit builds with distributed Clang ThinLTO by preserving
compiler flags, preventing x86-64 code generation from arm64
bitcode"
* tag 'iommu-fixes-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux:
iommupt/kunit: Use if_changed_rule for the kunit
Revert "iommu/amd: Remove redundant check in irq_remapping_select()"
|
||
Timur Kristóf
|
752480ad62 |
drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang
SDMA can randomly hang on Polaris 10. Hard to reproduce, but has been occurring sporadically in the Mesa CI on the RADV Polaris 10 job even when Mesa isn't using the SDMA engine. When Mesa actually uses the SDMA on Polaris, the hang becomes more frequent and the reproduction rate goes up significantly in the CI system. We don't know why the hangs occur, but it seems that inserting a single NOP packet before each POLL_REGMEM and FENCE packet works around it. At the moment it's unclear which GPUs are affected, so let's apply this to SDMA 3.x for now. Note that this issue is not documented or acknowledged by AMD. Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Timur Kristóf <timur.kristof@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit c343a27ed90823d08de125f7c447d96d056b75d9) Cc: stable@vger.kernel.org |
||
Jesse Zhang
|
3c44cbcec5 |
drm/amdgpu: keep the eviction fence until the last handle is closed
amdgpu_gem_object_close() detaches the user queue eviction fence from
the BO before it checks bo_va->ref_count, so closing any handle of a BO
removes the fence, even when the file still has another handle to the
BO and the bo_va with its GPU mappings stays. The BO can then be evicted
without suspending the user queues of the file, which keep accessing it
through mappings that are only marked for update.
Seen on navi31 with a SDMA user queue: a BO opened twice in the same
file (GEM_FLINK + GEM_OPEN) loses its eviction fence when the second
handle is closed (traced attach/detach of the fence):
attach bo=ffff8c78a6c84c00
GEM_CLOSE handle=7
detach bo=ffff8c78a6c84c00
while handle 6 and the mapping are still in use.
Only detach the fence when the last reference to the bo_va goes away,
matching amdgpu_gem_object_open(), which attaches it only when the
bo_va is created. With this the fence stays until the file is closed.
Fixes:
|