mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-13 07:31:07 +00:00
1,485,420 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Linus Torvalds
|
9a32e0754d |
TTY/Serial fixes for 7.3-rc6
Here are some small tty/serial driver fixes for 7.3-rc6. Nothing major
here, just lots of small fixes for reported issues, some of them very
long-standing:
- tty hangup fixes that have been there since the BKL days and kept
tripping people up over time.
- vt selection bugfix
- other vt bugfixes (memory leaks and screen update fixes)
- n_gsm bugfix
- qcom-geni serial driver bugfix
- 8250 serial driver bugfixes
- other tiny serial driver fixes
All of these have been in linux-next, the last few only a few days but
testing here seems solid (this pull request was generated on that tree)
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCasDolg8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+ylcoACgyhWqs4wSTyeaaIX6JyVd0NUw4zQAnRtswXUh
ysy21VUW+OGNAJuqRUAd
=slH2
-----END PGP SIGNATURE-----
Merge tag 'tty-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty
Pull tty/serial fixes from Greg KH:
"Here are some small tty/serial driver fixes for 7.3-rc6. Nothing major
here, just lots of small fixes for reported issues, some of them very
long-standing:
- tty hangup fixes that have been there since the BKL days and kept
tripping people up over time.
- vt selection bugfix
- other vt bugfixes (memory leaks and screen update fixes)
- n_gsm bugfix
- qcom-geni serial driver bugfix
- 8250 serial driver bugfixes
- other tiny serial driver fixes
All of these have been in linux-next, the last few only a few days but
testing here seems solid (this pull request was generated on that
tree)"
* tag 'tty-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (37 commits)
tty: add missing driver flag kernel-doc colon
vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()
vt: skip screen update for DEC alignment test on backgroup consoles
vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF
serial: sc16is7xx: reduce TX refill rate with half-FIFO trigger
serial: sc16is7xx: refill TX FIFO below trigger using fresh TXLVL
serial: tegra: don't clear the Tx FIFO on an Rx-only reset
serial: sc16is7xx: fix TX gap caused by kfifo circular buffer wrap-around
tty: fix saved termios reset race
tty: serial: mpc52xx_uart: move static declarations up.
tty: serial: max3100: shut down timer before freeing port
tty: add break_wait kernel-doc
serial: qcom-geni: keep registered console runtime active
serial: qcom-geni: Fix unbalanced runtime PM resume for no_console_suspend
serial: qcom-geni: avoid unused-function warning
tty: serial: qcom_geni_serial: Keep console RX functional after deep idle
soc: qcom: geni-se: Correct QUP Core ICC vote constants
serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()
serial: vt8500: Fix clock reference leak in vt8500_serial_probe()
kgdboc: Fix tty driver reference leak in configure_kgdboc()
...
|
||
|
Linus Torvalds
|
903e23eda5 |
USB/Thunderbolt fixes for 7.3-rc6
Here is a big set of USB and Thunderbolt driver fixes for 7.3-rc6.
They were delayed on my side due to conference travel, not the fault of
the submitters at all. Included in here are:
- lots of small thunderbolt fixes for reported issues due to more
testing and devices and a few reverts as well based on that work
- more usb-serial device ids added
- usb-serial and cdc-acm driver hangup and other fixes
- dwc3 driver fixes for reported problems
- lots of usb gadget driver fixes as people again fuzz these drivers
and send in fixes, which is nice to finally see
- typec driver fixes for reported problems
- octeon-hcd driver fixes for reported problems
- more usb-storage quirks added
- other small USB driver bugs resolved for reported problems
All of these have been in linux-next without any reported issues
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-----BEGIN PGP SIGNATURE-----
iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCasDlTQ8cZ3JlZ0Brcm9h
aC5jb20ACgkQMUfUDdst+ylOTQCdEBigGDRRb0smeyW4VTv5cwCTXyMAoMvaredS
oOoIRhrQdBX3jlOUhm1N
=XZLj
-----END PGP SIGNATURE-----
Merge tag 'usb-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
Pull USB/Thunderbolt fixes from Greg KH:
"Here is a big set of USB and Thunderbolt driver fixes for 7.3-rc6.
They were delayed on my side due to conference travel, not the fault
of the submitters at all. Included in here are:
- lots of small thunderbolt fixes for reported issues due to more
testing and devices and a few reverts as well based on that work
- more usb-serial device ids added
- usb-serial and cdc-acm driver hangup and other fixes
- dwc3 driver fixes for reported problems
- lots of usb gadget driver fixes as people again fuzz these drivers
and send in fixes, which is nice to finally see
- typec driver fixes for reported problems
- octeon-hcd driver fixes for reported problems
- more usb-storage quirks added
- other small USB driver bugs resolved for reported problems
All of these have been in linux-next without any reported issues"
* tag 'usb-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (63 commits)
usb: dwc3: gadget: fix IRQ storm on invalid event buffer count
Revert "usb: dwc3: gadget: fix IRQ storm on invalid event buffer count"
USB: gadget: dummy-hcd: Fix wait for outstanding request completions
usb: typec: port-mapper: Only match USB4 port if host interface is available
usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe
usb: dwc3: gadget: fix IRQ storm on invalid event buffer count
usb: typec: ucsi: Get the connector fwnode based on reg value
usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd
usb: core: clear both ep_in and ep_out for non-ep0 control endpoints
USB: cdc-acm: skip URB restart in port_shutdown if disconnected
usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC
usb: gadget: aspeed-vhub: cancel wake work on device removal
thunderbolt: Disable CL states for the Anker Prime TB5 dock
thunderbolt: stream: Announce support for FMODE_NOWAIT
usb: typec: ucsi: displayport: Current CAM OOB index fixup
usb: ohci-st: disable controller wakeup on removal
usb: ohci-spear: disable controller wakeup on removal
usb: ohci-s3c2410: disable controller wakeup on removal
usb: ohci-da8xx: disable controller wakeup on cleanup
usb: cdns3: fix use-after-free in cdns3_gadget_exit()
...
|
||
|
Linus Torvalds
|
8623551a42 |
Input updates for v7.3-rc5
- A fix for the Samsung S6SY761 touchscreen driver to power on the controller before unmasking interrupts during resume and to re-enable touch sensing when the device is open - Updates to the Synaptics touchpad driver to enable SMBus/RMI4 mode on Lenovo ThinkPad T490 and restrict the ThinkPad T440p InterTouch disable quirk to LEN0036 so that ThinkPad L440 retains SMBus support - A quirk for the AT keyboard driver (atkbd) to skip keyboard deactivation on Lenovo IdeaPad Slim 3 15IWC11 so the internal keyboard functions properly - A DMI quirk for the i8042 controller to disable active multiplexing on Fujitsu LIFEBOOK U7410, preventing the internal keyboard and touchpad from dying shortly after boot. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCasCSQgAKCRBAj56VGEWX nF+JAQC4Hu4Xd9I1hIhUnJuLuMG3EzPWajzCQxYe50Nst7MAcgEAiW/+eAIJruut i3QCkvUoF8gPpOSjOn2Z2csKQeWBWgo= =BneD -----END PGP SIGNATURE----- Merge tag 'input-for-v7.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - A fix for the Samsung S6SY761 touchscreen driver to power on the controller before unmasking interrupts during resume and to re-enable touch sensing when the device is open - Updates to the Synaptics touchpad driver to enable SMBus/RMI4 mode on Lenovo ThinkPad T490 and restrict the ThinkPad T440p InterTouch disable quirk to LEN0036 so that ThinkPad L440 retains SMBus support - A quirk for the AT keyboard driver (atkbd) to skip keyboard deactivation on Lenovo IdeaPad Slim 3 15IWC11 so the internal keyboard functions properly - A DMI quirk for the i8042 controller to disable active multiplexing on Fujitsu LIFEBOOK U7410, preventing the internal keyboard and touchpad from dying shortly after boot. * tag 'input-for-v7.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11 Input: s6sy761 - fix resume ordering and restore sensing Input: synaptics - limit T440p InterTouch quirk to LEN0036 Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410 Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490 |
||
|
Linus Torvalds
|
f7c918b8d9 |
drm fixes for 7.3-rc6
xe: - keep VF LMEM bar size low if no VFs enabled i915: - Disable VRR DC balance by default to fix timing issues mediatek: - Add missing IS_ERR check for ovl_adaptor platform device - Fix VID_DOWNSAMPLE_CONFIG register offset - Fix pdev reference leak in mtk_drm_bind() - Fix runtime PM leak in mtk_hdmi_ddc_v2_probe() - Fix ovl adaptor platform device leak amdgpu: - dc_state_create_copy() fix - HDMI RGB limited range fix - eDP ASSR fix - DCE 6 fixes - DCE 8.1 fix - SI DPM fixes - Reset fixes - Workaround for multiple SDMA entities with DCC - PWM backlight fix - GPUVM fixes - Switcheroo fix - Error handling leak fixes - GC 6 unload FW leak fix - SDMA 7.1 fix - DML frame size limit fix - RGB vs YCbCr 4:4:4 fix - DP MST fix - DC Power module fixes - MacBookPro14,3 fix amdkfd: - SVM fix radeon: - sparc64 fix -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmrAxhoACgkQDHTzWXnE hr5QeQ/6A1vgxSH7c2FlI1u8WatzEM9CGwPI/NBMsAtrloVtBwvn02vyT9cCMKJZ L/Bb9DAzpPc4P4xW44KMF4T1DAb06FQzlHD/apK8CM4YcYS+OLGqq7fMeyMnQL9m iojDE4IyRWp/ihrZQAx2iQXRr3o6hZks7AAYugs0rRPaG/aI3KRhZTTGMTPcHEBM gPMBTqDZA55J9U7s3ZHuOVky/BJeSBhLiEb1sNZAIuxXsg4zSmp8jzyJXkIMQGoF t0b+e/VYVkktN/EFDUZ/LTjSoFsSLeJGvc7Rh6DR0dI/ZEPHeJ9MQD3M5D2dawOo arw6qWNBbN5/4uDImTK9WVZm0W+qVqidxFpjPbab05rrZeCaXUCzs8jVn3k6/h9L 3uGd6BDrANvAfxyucmY7JxhoqZV/BZJHhULunFLdkUtw3MpjfPdrVq3FCbaVAhb/ ocNRrOTyx+knMlGWZ+M5NY25/1VuDDa7b3IckdNEsTWQNTbDNU1tWi5jYIVQIBIB u7PMl5UFDOPVc6IPAcPXgXZlaJDwaG7RbLPozrZPqtKsAm1etcv0Tlc985aa9D1N Q8Iav5vUyX9jGJBTd8/yIzks1YkNjB4vG6uEpBBv/6ZfDAfDk0TzX1V5f7hfRWwB GKNwwQfeXwA6UiHS1BkunCOO2CifSWbYKER90nXQpC3nhVfOVVc= =lRm1 -----END PGP SIGNATURE----- Merge tag 'drm-fixes-2026-10-03' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Live from Brisbane airport, it's Saturday Night drm fixes. The misc fixes tree didn't get a PR this week, so I'll probably have that to you when I see it, there were a few patches in there. Otherwise amdgpu is the main act, mediatek has a guest spot, and xe/i915 bring in a fix each. xe: - keep VF LMEM bar size low if no VFs enabled i915: - Disable VRR DC balance by default to fix timing issues mediatek: - Add missing IS_ERR check for ovl_adaptor platform device - Fix VID_DOWNSAMPLE_CONFIG register offset - Fix pdev reference leak in mtk_drm_bind() - Fix runtime PM leak in mtk_hdmi_ddc_v2_probe() - Fix ovl adaptor platform device leak amdgpu: - dc_state_create_copy() fix - HDMI RGB limited range fix - eDP ASSR fix - DCE 6 fixes - DCE 8.1 fix - SI DPM fixes - Reset fixes - Workaround for multiple SDMA entities with DCC - PWM backlight fix - GPUVM fixes - Switcheroo fix - Error handling leak fixes - GC 6 unload FW leak fix - SDMA 7.1 fix - DML frame size limit fix - RGB vs YCbCr 4:4:4 fix - DP MST fix - DC Power module fixes - MacBookPro14,3 fix amdkfd: - SVM fix radeon: - sparc64 fix" * tag 'drm-fixes-2026-10-03' of https://gitlab.freedesktop.org/drm/kernel: (36 commits) drm/mediatek: Fix ovl adaptor platform device leak drm/mediatek: Fix runtime PM leak in mtk_hdmi_ddc_v2_probe() drm/mediatek: Fix pdev reference leak in mtk_drm_bind() drm/amdgpu: reset VI ASIC on MacBookPro14,3 drm/amd/pm/si: Fix updating clock limits on AC/DC drm/amd/display: Fix stale replay_events after mod_power stream removal drm/radeon: Read the VRAM VBIOS signature with readb() drm/amd/display: guard dc_sink dereferences in MST mode validation drm/amd/display: Try RGB before YCbCr 4:4:4 in stream validation drm/amd/display: Fix sanitizer check for the DML frame size limit drm/amdgpu/gmc12.1: properly pass flush_type to gmc_v12_1_flush_vm_hub() drm/amdgpu: drop userq callback assignment for sdma 7.1 drm/amdgpu/gfx6: fix firmware leak on teardown drm/amdgpu: fix ACP MFD device leak on init failure drm/amdgpu: fix IP instance memory leak on kobject add failure drm/amdgpu: skip the noirq suspend reset for a switcheroo-parked GPU drm/amdgpu/gmc12: properly pass flush_type to gmc_v12_0_flush_vm_hub() drm/amd/display: map PWM brightness through custom backlight curve drm/amdgpu: implement workaround for sdma dcc corruption drm/amdkfd: Fix always mapped range mapping to all ACCESS GPUs ... |
||
|
Linus Torvalds
|
c5adb6c8a2 |
arm64 fixes for -rc6
- Fix handling of CPU erratum #2645198 when batching pte updates - Fix truncation of CPU frequency calculation by using 64-bit arithmetic in arch_freq_get_on_cpu() - Work around AMU erratum #3821522 on Cortex-A725 - Fix panic when trying to restore an SVE sigframe on a CPU that only supports SME -----BEGIN PGP SIGNATURE----- iQFEBAABCgAuFiEEPxTL6PPUbjXGY88ct6xw3ITBYzQFAmq/tpYQHHdpbGxAa2Vy bmVsLm9yZwAKCRC3rHDchMFjNJ6gB/9ZmDMU4ED2AbyP7T8Q6FttzvH01X85F2yz hlaaXv/2MDzjGSiz0spxDAZOuteJF+WSLj1WjZhlyr95xnQWfumc6D89D+kHeNre +twed6hbOQTWJzLB+u8Ef+4nKGcztIZ/FafFvPD6PKjFuhG048al8X/6oNXetBPy Ka13ywRYhnccflsWaXyWlvSwfKn2xJHOnpu4Mfbsb9DfaULDLLahz2ug+6apwX23 tc/dy40Fi0G6wFzUQGF83R3nsyZgLiOv7LFBjjqDmoiu7W86KXn83UXEwHXrp8de Zbynk7F4Bxf0lsp6y+bxTmwzm8CwI355/NFU2ccxxu17e7Qv6PnJ =TRoC -----END PGP SIGNATURE----- Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "Half of this is broken hardware (AMU counters and TLB invalidation) and the other half is broken software (frequency scaling and signals). So it seems as though we're all as bad as each other. The AMU workaround is a little noisy, as it refactors an existing workaround so that it can more easily be applied to additional CPUs. Summary: - Fix handling of CPU erratum #2645198 when batching pte updates - Fix truncation of CPU frequency calculation by using 64-bit arithmetic in arch_freq_get_on_cpu() - Work around AMU erratum #3821522 on Cortex-A725 - Fix panic when trying to restore an SVE sigframe on a CPU that only supports SME" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems arm64: errata: Add Cortex-A725 erratum 3821522 workaround arm64: errata: Factor out broken AMU const counter cap arm64: topology: fix arch_freq_get_on_cpu() overflow above 4.19 GHz arm64: mm: Fix the break-before-make flush range for erratum 2645198 |
||
Jaidheer Sirigineedi
|
13dffca904 |
ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 15-eg3xxx (103c:8bfd)
The mute LED on the HP Pavilion Laptop 15-eg3xxx (PCI SSID 103c:8bfd, Realtek ALC287) does not work because the machine has no entry in the quirk table. No fixup is applied, so the mute LED is never driven, even though the mute function itself works. The LED is controlled via GPIO pin 4 (mask 0x10), which is exactly what ALC287_FIXUP_HP_GPIO_LED configures. This was verified on the hardware with hda-verb: setting the GPIO data bit lights the mute LED, and clearing it turns the LED off. hda-verb /dev/snd/hwC0D0 0x01 SET_GPIO_MASK 0x10 hda-verb /dev/snd/hwC0D0 0x01 SET_GPIO_DIRECTION 0x10 hda-verb /dev/snd/hwC0D0 0x01 SET_GPIO_DATA 0x10 # LED on hda-verb /dev/snd/hwC0D0 0x01 SET_GPIO_DATA 0x00 # LED off Add a quirk entry for 103c:8bfd using ALC287_FIXUP_HP_GPIO_LED. Signed-off-by: Jaidheer Sirigineedi <jaidheer7@gmail.com> Link: https://patch.msgid.link/20261002185951.33855-1-jaidheer7@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de> |
||
Mohamed Yassine Jebabli
|
408249089c |
ALSA: hda/tas2781: Accept V1 calibration data without CRC
Some Lenovo BIOSes (e.g. Legion Pro 7 16IRX9H, SSID 17aa:38cd) store valid V1 calibration data in the CALI_DATA EFI variable but leave the TimeStamp and CRC fields zeroed. The driver rejects such data, so the amplifiers always run with default parameters on these machines. The rejection was silent until commit |
||
Harin Lee
|
593d46fc6a |
ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers
Commit |
||
Eckhart Mohr
|
9a44b828dd |
ALSA: hda/realtek: Add quirk for ASRock NUC BOX-358H
Fix headphone jack detection for some devices Signed-off-by: Eckhart Mohr <e.mohr@tuxedocomputers.com> Signed-off-by: Werner Sembach <wse@tuxedocomputers.com> Link: https://patch.msgid.link/20261001183403.103990-1-wse@tuxedocomputers.com Signed-off-by: Takashi Iwai <tiwai@suse.de> |
||
Matus Gajdos
|
4e1462e7cd |
ALSA: usb-audio: Add native DSD support for Cambridge Audio streamers
The Cambridge Audio streamer advertises the UAC2 RAW_DATA format on
altsetting 2 of its playback interface, but without the DSD_RAW quirk
flag the driver exposes it only as a SPECIAL format that cannot be
used.
Add QUIRK_FLAG_DSD_RAW for the device (USB ID 22e8:ca10), so the
altsetting is exposed as DSD_U32_BE, enabling native DSD64/128/256
playback.
Tested with: gst-launch-1.0 filesrc location=file.dsf ! \
avdemux_dsf ! dsdconvert ! \
alsasink device=hw:2,0
Signed-off-by: Matus Gajdos <matuszpd@gmail.com>
Link: https://patch.msgid.link/20261002125237.82188-1-matuszpd@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
|
||
Sang-Hoon Choi
|
4aa9c0f377 |
nvmet: use the local P2P device on metadata allocation failure
nvmet_req_alloc_p2pmem_sgls() assigns req->p2p_dev only after the data
and metadata SGL allocations succeed. If the data allocation succeeds
but the metadata allocation fails, out_free_sg passes req->p2p_dev to
pci_p2pmem_free_sgl() before that assignment has taken place.
Pass the local p2p_dev argument instead, so cleanup uses the same PCI
device as the successful data allocation.
Fixes:
|
||
Palla Raghunath
|
b3ce757213 |
nvme-multipath: revalidate head zones after unfreezing the head queue
When a namespace on a multipath controller is updated,
nvme_update_ns_info() freezes the head disk queue, commits the new
limits, and then calls nvme_mpath_revalidate_zones() before it
unfreezes the queue again.
That is the wrong way round for blk_revalidate_disk_zones(). It starts
a limits update, which takes q->limits_lock, and it freezes the queue
itself while updating the zone resources. The block layer takes
limits_lock before freezing the queue, never the other way around, so
calling it with the head queue already frozen reverses that order.
syzbot has hit this twice. One report goes through q->limits_lock. The
other one is on linux-next, where blk_revalidate_disk_zones() also
takes disk->zone_revalidate_mutex and holds it across alloc_workqueue()
the first time a disk's zone resources are set up. Lockdep then sees:
q_usage_counter(io) (frozen head queue, nvme_update_ns_info())
--> &disk->zone_revalidate_mutex
--> wq_pool_mutex --> fs_reclaim --> q_usage_counter(io)
WARNING: possible circular locking dependency detected
kworker/u8:10/3352 is trying to acquire lock:
(&disk->zone_revalidate_mutex){+.+.}-{4:4}, at: blk_revalidate_disk_zones+0x1c5/0x1650
but task is already holding lock:
(&q->q_usage_counter(io)#75){++++}-{0:0}, at: nvme_update_ns_info+0x3ac/0x1200
...
blk_revalidate_disk_zones+0x1c5/0x1650 block/blk-zoned.c:2560
nvme_mpath_revalidate_zones+0x106/0x1c0 drivers/nvme/host/multipath.c:301
nvme_update_ns_info+0x984/0x1200 drivers/nvme/host/core.c:2620
The rest of the driver already does this correctly:
nvme_update_ns_info_block() unfreezes ns->disk->queue before calling
blk_revalidate_disk_zones(), and nvme_mpath_set_live() revalidates the
head zones without freezing the queue. Do the same here, and only
revalidate the head zones once the queue is unfrozen and the limits
update has succeeded.
Fixes:
|
||
Karl Bonde Torp
|
564e46d9f6 |
nvme: fix swapped ZRASF zone state values for full and read only
The Zone Management Receive command Zone Receive Action Specific (ZRASF)
reporting option values for the Full and Read Only zone states are swapped
compared to the NVM Express Zoned Namespace Command Set Specification,
Revision 1.5, Figure 35:
- 5h lists the zones in the ZSF:Full state.
- 6h lists the zones in the ZSRO:Read Only state.
The nvmet ZNS backend uses these constants to map the ZRASF value received
from the host to a block layer zone condition when filtering zones in
Report Zones. Because of the swap, a host asking for full zones was given
the read only zones, and a host asking for read only zones was given the
full zones.
Swap the values of NVME_ZRASF_ZONE_STATE_FULL and
NVME_ZRASF_ZONE_STATE_READONLY to match the specification.
Fixes:
|
||
Guixin Liu
|
d99bc5b456 |
nvmet: return Invalid Field for invalid NSIDs feature 82h
The Reservation Notification Mask feature (FID 82h) defines its own
status code for namespaces that do not support reservations:
"If a Set Features command or a Get Features command attempts to
access the Reservation Notification Mask on a namespace that does
not support reservations or is invalid, then that command is
aborted with status code of Invalid Field in Command."
-- NVMe Base Specification, section 5.2.26.1.33
The Set Features handler routes the namespace lookup through
nvmet_req_find_ns(), which returns Invalid Namespace or Format for an
unknown NSID. That is the correct status for the generic
namespace-scoped admin commands, but not for this feature: a Set
Features 82h naming a nonexistent NSID is aborted with Invalid
Namespace or Format instead of Invalid Field in Command.
Translate the lookup failure to Invalid Field in Command. The
broadcast NSID, the namespace-without-reservations case and everything
else keep their current behavior.
Fixes:
|
||
Martino Papero
|
3bf8d603fd |
Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11
The internal keyboard on the Lenovo IdeaPad Slim 3 15IWC11 (83RR) does not work correctly with the default i8042 settings. Using i8042.nopnp=1 and i8042.dumbkbd=1 restores keyboard input, but prevents the Caps Lock LED from working. Using i8042.nopnp=1 alone does not fix the keyboard. The laptop works correctly when atkbd_deactivate_fixup is used instead. Add a DMI quirk for the 83RR to enable it. This was tested without any i8042 command-line parameters. Keyboard input and the Caps Lock LED work correctly, including after suspend and resume and after a cold boot. Link: https://lore.kernel.org/all/4f43465f-98ba-4722-8e29-03df20315369@kernel.org/ Signed-off-by: Martino Papero <martino.papero@lcb.to.it> Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Link: https://patch.msgid.link/c0b597b8-e7ad-4fba-a2bb-5d252e3dfbd3@lcb.to.it Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> |
||
|
Linus Torvalds
|
e767a4ea70 |
Probes fixes for v7.3-rc5:
- fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching():
Exit handlers early if !rcu_is_watching() to prevent potential
use-after-free during unregistration in idle/quiescent states. Switch
to guard(rcu_sched_notrace) to avoid fast-path lockdep overhead and
recursion while ensuring safe grace period synchronization.
- kprobes: Skip disarmed probes when checking optkprobe overlap:
Continue past disarmed or unprepared probes in get_optimized_kprobe()
to find active optimized probes. This avoids overwriting active jump
displacements which can lead to panic.
-----BEGIN PGP SIGNATURE-----
iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmq/XSIbHG1hc2FtaS5o
aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8bi4AH/3FQZSTq4yeJTbsl0otB
gsi2Wkys+DzHrbyfxTn9lKtj6CbfUNSVyzbNQjQI62MHBl8gQ0m2Tom+UDLgjvbQ
tEBsrOTSYuVVTXfP+Fb1E4uds8u9TbozS8185W+8xDWQxty/kFo5gjFe48Of7/s0
ujp9/4b8EuAgIm8/gkbwQKt5UOg1Qmhayh2KTA6JOI4ELmxIDyIFBn96k9QvJJTz
5AKDOzx+p5tfaKOl7njamFEoXgpFftF1y0xytNnS+W7vGFuGGhvf9zAekrRHN3g9
x97HdACt8mXDmL1XeYZwLpB2qTW97Ryv40RzqbyycEtOJV7t/910ZY5iFcyn/+6c
TyY=
=Huo4
-----END PGP SIGNATURE-----
Merge tag 'probes-fixes-v7.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull probes fixes from Masami Hiramatsu:
- fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()
Exit handlers early if !rcu_is_watching() to prevent potential
use-after-free during unregistration in idle/quiescent states. Switch
to guard(rcu_sched_notrace) to avoid fast-path lockdep overhead and
recursion while ensuring safe grace period synchronization.
- kprobes: Skip disarmed probes when checking optkprobe overlap
Continue past disarmed or unprepared probes in get_optimized_kprobe()
to find active optimized probes. This avoids overwriting active jump
displacements which can lead to panic.
* tag 'probes-fixes-v7.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
kprobes: Skip disarmed probes when checking optkprobe overlap
fprobe: Use guard(rcu_sched_notrace) and check rcu_is_watching()
|
||
Dave Airlie
|
9c979cba98 |
amd-drm-fixes-7.3-2026-10-01:
amdgpu: - dc_state_create_copy() fix - HDMI RGB limited range fix - eDP ASSR fix - DCE 6 fixes - DCE 8.1 fix - SI DPM fixes - Reset fixes - Workaround for multiple SDMA entities with DCC - PWM backlight fix - GPUVM fixes - Switcheroo fix - Error handling leak fixes - GC 6 unload FW leak fix - SDMA 7.1 fix - DML frame size limit fix - RGB vs YCbCr 4:4:4 fix - DP MST fix - DC Power module fixes - MacBookPro14,3 fix amdkfd: - SVM fix radeon: - Sparc64 fix -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQQgO5Idg2tXNTSZAr293/aFa7yZ2AUCar7lbAAKCRC93/aFa7yZ 2NGnAQDx0u/syqZTvx8pQ8k6g2RkuXPRE1avwRd4hJ6icS6MPgEAgZrqRHs2p21N CZqOp91spby9O9VfHUKmHTp82e7J/go= =tHX/ -----END PGP SIGNATURE----- Merge tag 'amd-drm-fixes-7.3-2026-10-01' of https://gitlab.freedesktop.org/drm/amdgpu/kernel into drm-fixes amd-drm-fixes-7.3-2026-10-01: amdgpu: - dc_state_create_copy() fix - HDMI RGB limited range fix - eDP ASSR fix - DCE 6 fixes - DCE 8.1 fix - SI DPM fixes - Reset fixes - Workaround for multiple SDMA entities with DCC - PWM backlight fix - GPUVM fixes - Switcheroo fix - Error handling leak fixes - GC 6 unload FW leak fix - SDMA 7.1 fix - DML frame size limit fix - RGB vs YCbCr 4:4:4 fix - DP MST fix - DC Power module fixes - MacBookPro14,3 fix amdkfd: - SVM fix radeon: - Sparc64 fix Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20261001230115.1319089-1-alexander.deucher@amd.com |
||
|
Dave Airlie
|
47400a32d0 |
Mediatek DRM Fixes - 20261002
1. Add missing IS_ERR check for ovl_adaptor platform device 2. Fix VID_DOWNSAMPLE_CONFIG register offset 3. Fix pdev reference leak in mtk_drm_bind() 4. Fix runtime PM leak in mtk_hdmi_ddc_v2_probe() 5. Fix ovl adaptor platform device leak -----BEGIN PGP SIGNATURE----- iQJMBAABCgA2FiEEACwLKSDmq+9RDv5P4cpzo8lZTiQFAmq+7DsYHGNodW5rdWFu Zy5odUBrZXJuZWwub3JnAAoJEOHKc6PJWU4kGecP/RRjm19xz4RfetZ40rfAPgvB OHLOxZyLv6661kp4TAk7KY9Weuv+LwPQoUmKHClP1eMQhrt7jtktqpS0ZXk8LoJB A7AiiWigLzMEMRet8IeH3Bn8zuq0lefIZpo5ycMT8idkH0+I3SguTrYQ13sZw2CF PxkYGcTZidTDABhU1nOGuBhl+aq/uEi/nsKHi02YyqDlWNQJtvGXsfYpKnCU4TzV uGsSaR+eIWb6m4uFmJeqZ3Ltjm6F7lzfFF/JOsYOuAm4wCVG61TrNEwTCifnW9x9 auIYMS7vEpQAAEaIsVmBMSMQ+LAdpAb5Lv5kFYU3LUwldNRG0gb+zsEBEc8TWlkS fTDHXDZaWusAIVVjADaCB2UnIbcGmIl0aGmwJ/DJ35T+QdaJwYGO5VGomeORJkRD KO+J9vX94gdAvqJyjWJnojVnRVevzVe68ByHfyUuEIJ9bagmiqPQKXEVO9kenS8G ZUKaXKn5hG+TGJsXen6kzr93vrZuEt/W3IqrITFLe3TboQr4M/3Om4xkL5TAAYr+ ghzVXSTIYbSeUKxUE705L7SsxyyqJg+llp/ySPod+79zzk8m5tj0BZqABr55UJU8 VyoYx3fCcYGC/H8gbUpKFTItycvNpvJg7Vx2+rnyXmO7elozwT7lErjRUDS/EQGu LonAWuHIrTLDdXz4GVHW =WUlr -----END PGP SIGNATURE----- Merge tag 'mediatek-drm-fixes-20261002' of https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-fixes Mediatek DRM Fixes - 20261002 1. Add missing IS_ERR check for ovl_adaptor platform device 2. Fix VID_DOWNSAMPLE_CONFIG register offset 3. Fix pdev reference leak in mtk_drm_bind() 4. Fix runtime PM leak in mtk_hdmi_ddc_v2_probe() 5. Fix ovl adaptor platform device leak Signed-off-by: Dave Airlie <airlied@redhat.com> From: Chun-Kuang Hu <chunkuang.hu@kernel.org> Link: https://patch.msgid.link/20261001234906.14940-1-chunkuang.hu@kernel.org |
||
Imre Kaloz
|
f2e695a6c2 |
MAINTAINERS: update my email address
Switch my contact address to kaloz@kernel.org and update .mailmap. Signed-off-by: Imre Kaloz <kaloz@kernel.org> Link: https://lore.kernel.org/r/20260924101245.5011-1-kaloz@kernel.org Signed-off-by: Arnd Bergmann <arnd@arndb.de> |
||
Arnd Bergmann
|
e984d7bf46 |
OP-TEE fixes for v7.3
- Register the TEE devices only once fully initialized - Support FF-A shared memory offsets on large-page kernels -----BEGIN PGP SIGNATURE----- iQJUBAABCgA+FiEE0qerISgy2SKkqO79Wr/6JGat8H4FAmq/vYUgHGplbnMud2lr bGFuZGVyQG9zcy5xdWFsY29tbS5jb20ACgkQWr/6JGat8H6RMw/8D8FeS6QFcNCU UGfz4tlPorAT+rHPe8mgjmFE41ph40UdVDCW4SW5qSZK3R7Uq8gMgOakW2pkEXHR 7XCyBo36GRjAi6cBAUM79240Laghgtw1zuZQXqakmtKDWM/9/WkF0rZ+DVMWX56w Vi/YxbuRfj3mLjr2tG1tOGHOpPPxaV/PemQO0b57tMGt3Nu+v5k/sIs2ufgkoEJi KtCuFlNO+JUZ8ldKR/OcC025q+asjqYuLK13cVmLrTvhEkPXXXu52twbcjVYHiO1 9P4NNsvmtvNlk40scUsAtdSfZ7PpgTFjYZwbCFDYriqPt7BB9xDwUCXFcatn1I4K NhlsQXv27LUPPKz9nmKL9PmLB8jYWs4lNs/4Sz2dnOJmy0dTFYV/3CCoDeR2cK2M dCi9IZ2aepnxgUnCckbfvjw/Ap96yFGNf44GbqBpCTCdVRnJ3zuIeLRDwHDfzQiC ELwE5gUPdtuyBlmEQV6fLFMnA1lXcTNl91CL2y9vrzn/P9dcxU7HLOABUc4CQm35 T/jqf5tNbri6g65PCRA4HZJPPZA3OmfoOwpiZKDHedZ6lri8eZ+43rI2xzpQh/q1 bb+QWngUZuXeYetsx+a+8WxaUJrxpPvgSLiTAxCF5cTIYHxJslZ6ZOMZP204AO/Y MZzl5tTbV7li42WxegZSV9eSg9EiLDQ= =KtE/ -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmrAJH4ACgkQmmx57+YA GNlPLw//VgBaLvVruZ8XO65cGWZUSoaOXpZtuAt0s4YuYG6u/hBB69uN3AGPnyuK i1uqV2lclFd6cppJrYm/YmnXYe/7Hmuozbj7WzSoot/HSAiTF4H31oAkM4qWBbgi tPF/GOUXSLkOkb9jZIzGXGcH+CadbEA6s3+xMAxSaFotw8ibg5fFlbLoLldA5InY 1Bfm9DlqELmPw2v+4e8eKQt7XALEO1aPRepD614N/JOP4npZb+lF+7GPQnL3Te6g uWfcRUSb8GItazwTGCouHrsZyZfH1HZ4PdOMp6GINn4aVlQOeOpfRk4pX7GtUdNG 6dKXorVCpDkuJ7ziQXvtN2N05YvCw1IXJd2utZNnFVmHwOI9++FaT+y4U4UUKNBF W9IS3Jcmx0+9KWUr1CazKNAPXYeMxdIIopzPFFeCrFW4IyVEE/yZN8UxV4iHqshr LiTUlxZ6zoFlOkE7GJ8GD6Z5VN/P3M2cW5ql3OMI0EkhmsRmpQkIWmJz/aQ7K2GH okMuCkw2gKBRiPr6z1rD3RdCRP5jpTfvM4FAA8+owbjVjKVzniOsvKtIIETpLmS6 WQv/cwCa0K0OKyK8ndRwVjfpsgBU22Ue2TTQmw7bd3tfg+D/L20FnWmmtcix8TpX nEooQeuhg5CS8GLwE7bL5amJItywP1wT8ueEYeJszNr3UjfhAIA= =SO92 -----END PGP SIGNATURE----- Merge tag 'optee-fixes-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into arm/fixes OP-TEE fixes for v7.3 - Register the TEE devices only once fully initialized - Support FF-A shared memory offsets on large-page kernels * tag 'optee-fixes-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee: tee: optee: ffa: support shared memory offsets on large-page kernels optee: register TEE devices only once fully initialized Signed-off-by: Arnd Bergmann <arnd@arndb.de> |
||
|
Arnd Bergmann
|
8166a32515 |
iMX fixes for 7.3
- Fix incorrect pinmux values for LX2160A. - Fix Sonata SD I/O supply to avoid filesystem I/O errors because the kernel was disabling LDO5 during late init. -----BEGIN PGP SIGNATURE----- iQHFBAABCgAvFiEEJS45w2QNr0ezLVaoNF3oRQ23YkwFAmqylZ8RHGZyYW5rLmxp QG54cC5jb20ACgkQNF3oRQ23Ykyylgv8Di1CV50Pb0BlCL6AYfYAoDnmS0SzfFmE OrW57Lfi3CRq42klg4RfKY1/RoFcpD1ACkynuiiE1gyvRu/+fpsZD3qXh5KB3TYI Pr7zzR55anWgKP6GWGzCMDPnd2UQB0KaxWYYHCjyVFzkx7V6uWZAtlRxKkhIVxra 3hJrw9COfG130WICP6YUXR2ULCUZNWP+l5b/isz2McxkAw1f45x4tJEfAkwb3Cyh 4Yn+QSUto9QFcGUFt3r1V/eFzS8ebSC08679Jn4z9P3VvtjEKqLAG8XQIxYcILBi WBuJz3Nv8nGJUW2UUubSSVBDy/dZYWE4fkjRiK3cT0x3kuzZNZBMRjhVPjL1J02X 39xT7oLUtVwOk9yU45cYRpXLuJPMTUt8SIag+eEy3rXLWcVfBbhsY11atuHKHj+D aah++mqYVRcwQO0ooVsGDSarQ+zi5RmXyhioohB0181S3UAB1r2fln8lpB3vIv4T fiohlbth/ztvfz/sIWCYIGGwrVamgyD5 =JKsd -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmrAJF8ACgkQmmx57+YA GNmBmw//cBANa1oHA9AsVgTW+60W9fcmOk9rWYDvxawZrE2ufJ+EjcXjQqxlAZ2+ +KUX4tIxSeJdI36djhRCPy62RZW5YeW1zzWhWwQvzVNWYBR/4BdR8J+VaXA4hdu+ 9w+W+dUs/hlJQUuE9JXzuCV36hILRG0PS801WaRKXqdFhFC/PSF289PHUsmgX7lW /dywG9J54tzp/XHSWlXNRSKVgcOOiZAfM/qVf/iPmwrDRetAAUAmsfTosIc707u/ bUUn0hkjJNB7NTJ5wY2N7s9lHECZfR7/8iP9GjqZM1T72O0xFfEfvLt9EbBLpxEo As6GSQXWYiLx0WsjPHcP7b/XH2JI6BN7Ns0OsdRaroICItxlllRsG+C4b90AGoRu SlvQQevjj7n/MVLeos9SzdMnmtIks9IUWuyTuT2kHHGR7uNSgb4i0ez2uaW8nwQI M/ff3nfEO8xm1EeUitYX7ERvCM32mi66KPZepT6RWToO+/NAFFhLtbiXiqyPR9t5 FYnxGltvAOnlNQLjGb/bmcxtNCIoexIALahlZNNU7SiAEXsYxr0lfHJzkVdU9MDs adCDdITRQl6kw3whJCR45ovxVL24/gBgAspAdCuyuySJ5fkJyFEhNgS9UFZ4bcpc K/jrwjZMKyOelaY3NFVF0hjPyXsQbqePXNRvYk6iSlabqxPsSHc= =QdkN -----END PGP SIGNATURE----- Merge tag 'imx-fixes-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux into arm/fixes iMX fixes for 7.3 - Fix incorrect pinmux values for LX2160A. - Fix Sonata SD I/O supply to avoid filesystem I/O errors because the kernel was disabling LDO5 during late init. * tag 'imx-fixes-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux: arm64: dts: imx8mp-var-dart-sonata: Fix Sonata SD I/O supply arm64: dts: lx2160a: fix the iic5 spi3 pinmux offset and value arm64: dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single arm64: dts: lx2160a: fix incorrect pinmux Signed-off-by: Arnd Bergmann <arnd@arndb.de> |
||
|
Arnd Bergmann
|
26fb480bee |
Qualcomm Arm64 DeviceTree fix for v7.3
Fix microphone distortion on Hamoa and Purwa-based Surface Pro 11. -----BEGIN PGP SIGNATURE----- iQJCBAABCgAsFiEEBd4DzF816k8JZtUlCx85Pw2ZrcUFAmqygIAOHGJqb3JuQGty eW8uc2UACgkQCx85Pw2ZrcWRdA/5AUOlYj3UAcM0xGQEqeYXiMfIOdsyf/q9sCrG TRGZPlyqk+gJLXyxvs21dYzTx2pjf3Z74oriD6UzcAleoJ2qXzcYpEh4HCxf6xMu AREVPnI3QMmQeXl3sKSoehafasLfd1JJ7f496Bj7IOD9Tj4sQQJCyG3l0iQGYeXu 5uOF/0BgbbAYpH4qzsRN4FJePCPymMGbU6cRjuJKbG4VP69jwAyT8QKWTjqi6I44 woW5n1S9SournwN29xBMF7mHlfjTIZ4YpKHrEOrq1JCUjzKptqXWqpENlsTl/Noy fy4eV+ku8FU1TIQaUkawqkyOEbF7AgEPwJYrj545XxrZDM6OcwXtstoxQmfbncmm dCNTk6B2/EfFLBKbErD3BMDIMNvMkr7I2C8mA5W8jgbK7h/TfaulGky6cqM2dugi XxWge41NjRftbyTq/BMV/PJ4IjwwKbEnIKYz5hZIqalClHmrNCYjjjx/jXhf3hTZ KESTthejQguU5KnGjyDtJVP0ey0p7I+n6NlQ87h7qhKjaZvEf0NzUIJAipBFfH/a +X600JcWw5PJ7WwlNe9RdzukpGwup4KjClKi2EGVwG7u3Gpfh6YOvWWBF7YM+Lu2 xBrzYDZ5/3Ovx3apQYFQHAQ8d8Cxxt2N1HxmfFosujrseaFvwTdRk2LmsPUaXjPk NwdfGqQ= =4rAk -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmrAJDkACgkQmmx57+YA GNmDYA//aOxUgY9LDwtJQvOgcNtIwp0vI6Ea7XTrZDW5/yAfZ6KbazfOKKyTyPVj 1PqBP6EEkPni0qfI62R8zUaD52tgdnuGp/JXj+PwWnYhPECoUzzFSk3A4c4sVN9X S/VhZsAcS/nUtkUO/vzvtnAsWMfHW1CGMPpmcGgXpFE8SKaRgMsWeaQ25PViZn09 PV4JmhdWwjRHYbbwCVw71FFRLBRAEEd/UAGomczqZWgEFR/rGNodZlBUoVUvYZHd Fb8ENxkg4TClEKLa/G6Sxkursv5hdC3seBI8tGRDniR6ukT6za8wJojdiVcHpL3G vC6tMAb6GJLzEFxRZ711qTDrMWEx2v9IWvgyI6P/el+PE1ek3U9R2ajmdVGCxuBL 9nR0wHAhGfn9HoJmyglXenR5WAJ1ZGoMM8hX3XRTVRUum9kMmaQGSlYeGfq8bWlR K1mhxs5kQ7vGPB9spa2HXjbWBkq7ogTRZeyes8fcX/GPjANpODAsfueXCO4tCkXs imARkdvgD9du1vuVYoGILe2cD79ggoJOHuQZiz+P4Qml/xSfElrh21YB3ed/zLmb +RwAfKRicGFnfG6aO5zssEVanpZzTmx0h6oVZvcXzF5H6y9QQq6eGSpT1Kegcila vGRCkgtkpCi5xoP13zniktocNfW+dQmnwsDPCqLVgFo1df+fsaE= =TD8z -----END PGP SIGNATURE----- Merge tag 'qcom-arm64-fixes-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes Qualcomm Arm64 DeviceTree fix for v7.3 Fix microphone distortion on Hamoa and Purwa-based Surface Pro 11. * tag 'qcom-arm64-fixes-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: arm64: dts: qcom: x1-denali: Fix microphone distortion Signed-off-by: Arnd Bergmann <arnd@arndb.de> |
||
|
Arnd Bergmann
|
1d0f326d2d |
Qualcomm clock fixes for v7.3
Mark Kaanapali and Glymur GPU CX GDSC's voteable to use the right programming model. Fix the PCIE_RSCC clock programming in Eliza, Kaanapali, and Hawi. -----BEGIN PGP SIGNATURE----- iQJCBAABCgAsFiEEBd4DzF816k8JZtUlCx85Pw2ZrcUFAmqyfjYOHGJqb3JuQGty eW8uc2UACgkQCx85Pw2ZrcX9GRAAttpHalyMvpha8oSsPDkAxn+ns3JMQNCWOzS6 UCNv0cFkVP5UuILLFVpzeROqnmxFokz4dJx9+GdKvDm07jL3JnaJkZTWnZhofPnC gVTgHpTX+cm+c9Dbl7gqhNz8P8Ih2nXaLhZn1NYGzcO4GEk/LPFqGopljIHldDM8 Ie0vBkJDOq8kHD7dNjqClr6XUB10EFFGudEVXfA31Gr0X5n2CDBLEwa7tvatc5pt YNEuoRPi/+onV9oO5J10MQw5ALR3eunckmPxRX2V1Rnq93S7lp6p6BT6cG1R6gzO jUvwDx1RRrj2PiYA7GCLOAYppQRAbJV8yjTWjhB4NCFtNqIme6ivdUY1JPZVKmq9 qsIMnSBH1ZOjs0O82uSWfKbKCtJXPNtiDSA6YZeGh6StOXPAkQcd9V0mV7oJEK+/ WyDWR4OrZmQYuVwtdsE/390GPx9NooJm34tCv7qOJR+chO/WsuAMwtSYqMN+jBwB QldVpM3i1FpYSGRxH+N4XBvbs72bUT59MfyH+khmq/g66Igqj4s/pFZ0RlpJNwmM hPmlTVkt19IfFRIglcyvgLvXeaL7Daynjx/exw2i9feIizwgjQsvDN2WcW1qFNUO K+heGiZNEVW3LJFB09e9r7yclSQAZXoAYku11N82cXOIXTJLBV28wcSdWxcPM8IZ 05hkf4I= =wsgH -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmrAI1IACgkQmmx57+YA GNn7WxAAt1PBM0s6tvTIFOTQMIzC1Tyb8dVEDxQgcPyHVOInxSUUuMTdHaCK4LW+ 3NzSNuLfU8dBZ3y6VbzsBHTEHAuWnjXIRS3Ezg5oV4MuzjtPbGQ7eblFgB8Rl/uB MbGKkD9YGYwRgdxocPDRNLp9FLjTxbeAjjnQnDDKAlhbMHoAzlhHoTw5B8pYNh30 qkVBXkCOL0PHlS2TZUWwshlmxgGB0iyapxyn2wyAP0LasmybyZvLIBHGNFIUUtBd 5LhU0jIMI0soXZjF1eEl+p/LK8rabRBecnT0Zfcm3LuQUkBBmtzDFVxWd92BMfuN TJe03NZaWQoVBxeBm/AQoTJYZuNNtNND/ho4KTnzFQqilCsf8hGOy0Ce/WC6VlRw UKty+fKKP1PfSqLnWuAZjqBwX/uuJyRTLVl/CpUOCbkinJ0YeiWvf787MH5ixcXo XQW+qVwjqpjKJZgPrHKUQfEAP97uRejJ2IpXXZCcGI4VaFOpf4ELuspseY5AEYJr D/TX0b7Tsfo+R44v3kUgE+MmmJyrItvWVI8h9OSNJsNt3ZajVfmuZdFJaPQ5Fs7c pxoaepStKsV40i3Vd3gQzaFkkx885L6UqDq2G2hiRK7XmgFQoK+8B7Dlu1LoRk8o v8k9AIkAsMyGONeRlMvbPvEyg2Wju3Oa7sNfvSO+pdG4TfXjaro= =FI9Q -----END PGP SIGNATURE----- Merge tag 'qcom-clk-fixes-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes Qualcomm clock fixes for v7.3 Mark Kaanapali and Glymur GPU CX GDSC's voteable to use the right programming model. Fix the PCIE_RSCC clock programming in Eliza, Kaanapali, and Hawi. * tag 'qcom-clk-fixes-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: clk: qcom: gpucc-kaanapali: Mark the GPU CX GDSC as votable clk: qcom: gpucc-glymur: Mark the GPU CX GDSC as votable clk: qcom: gcc-kaanapali: Fix always-enabling PCIE_RSCC clocks clk: qcom: gcc-hawi: Fix always-enabling PCIE_RSCC clocks clk: qcom: gcc-eliza: Fix always-enabling PCIE_RSCC clocks Signed-off-by: Arnd Bergmann <arnd@arndb.de> |
||
|
Linus Torvalds
|
ff47652a4b |
smb client fixes for v7.3-rc6
- Stop data dirtied past EOF through an mmap from reappearing as file
content once the file is extended by a write, truncate, zero range,
copy range or clone range
- Flush dirty data and drain in-flight I/O before operations that
assume the pagecache and the server agree on the file: querying
allocated ranges, the O_TRUNC open, interior zero range, and
server-side copy/clone
- Stop a genuine size-extending zero range or preallocate from being
refused with -EOPNOTSUPP when the inode is not read caching, by
querying the server's authoritative EOF instead of trusting a stale
cached i_size
- Zero the untransferred tail of a short read, both in the netfs
read-gaps path (where stale folio content could otherwise be written
back to the server) and in the DIO/unbuffered read collector, and
tell a real EOF apart from a stale cached remote_i_size after a lease
downgrade
- Require stable pages on signed connections so a buffered write can't
modify a folio whose signature has already been computed and is in
flight, which the server rejected with STATUS_ACCESS_DENIED and the
client surfaced as -EIO
- Split several cifsFileInfo flags out of a shared bitfield byte so
concurrent updates taken under different locks no longer clobber each
other through a byte-level RMW
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQTcqRusfSdYROJQwGkpVtNKoQNdYwUCasAVCQAKCRApVtNKoQNd
YxLEAQDBsM7NZk2+hUlPZMDq/NK+8C12Vm8WnN8nqb3Dpt8jCwEA2JJGMeO+p9/L
/hwKubpM6CuWiG2yMbqyUHWVZSkOFwQ=
=8v7I
-----END PGP SIGNATURE-----
Merge tag 'cifs-fixes-7.3-rc6' of https://git.manguebit.org/linux
Pull smb client fixes from Paulo Alcantara:
"Fix a series of data corruption and I/O error bugs found by running
generic/363 (fsx) in a loop against Windows Server 2022 and Samba.
- Stop data dirtied past EOF through an mmap from reappearing as file
content once the file is extended by a write, truncate, zero range,
copy range or clone range
- Flush dirty data and drain in-flight I/O before operations that
assume the pagecache and the server agree on the file: querying
allocated ranges, the O_TRUNC open, interior zero range, and
server-side copy/clone
- Stop a genuine size-extending zero range or preallocate from being
refused with -EOPNOTSUPP when the inode is not read caching, by
querying the server's authoritative EOF instead of trusting a stale
cached i_size
- Zero the untransferred tail of a short read, both in the netfs
read-gaps path (where stale folio content could otherwise be
written back to the server) and in the DIO/unbuffered read
collector, and tell a real EOF apart from a stale cached
remote_i_size after a lease downgrade
- Require stable pages on signed connections so a buffered write
can't modify a folio whose signature has already been computed and
is in flight, which the server rejected with STATUS_ACCESS_DENIED
and the client surfaced as -EIO
- Split several cifsFileInfo flags out of a shared bitfield byte so
concurrent updates taken under different locks no longer clobber
each other through a byte-level RMW"
* tag 'cifs-fixes-7.3-rc6' of https://git.manguebit.org/linux:
smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races
smb: client: require stable pages for signed connections
smb: client: distinguish real EOF from a stale remote_i_size on read
netfs: zero the tail of a short DIO/unbuffered read
smb: client: only require read lease for size-extending preallocate
netfs: zero gaps in read-gaps folio to avoid writing back stale data
smb: client: only require read lease for size-extending zero range
smb: client: drain and invalidate before server-side copy/clone
smb: client: flush dirty data before zeroing a range
smb: client: drain outstanding I/O before truncating on O_TRUNC open
smb: client: flush and commit data before querying allocated ranges
smb: client: discard post-EOF pagecache when extending a file via clone range
smb: client: discard post-EOF pagecache when extending a file via copy range
smb: client: discard post-EOF pagecache when extending a file via zero range
smb: client: clear post-EOF pagecache when extending a file via truncate
netfs: clear post-EOF pagecache when extending a file via write
|
||
Jakub Kicinski
|
6dc989ea46 |
Merge branch 'intel-wired-lan-driver-updates-2026-09-28-idpf-ice-iavf'
Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2026-09-28 (ice) [part] For ice: Xuanqiang Luo resolves a use-after-free issue by changing order of operations so index is used before being freed. Bryan Fraschetti restores ordered MMIO writes for ice Tx doorbells by replacing writel_relaxed() call with writel(). Tristan Madani fixes representor use-after-free by releasing metadata_dst through dst_release() to ensure it is not freed until all references are dropped. ==================== Link: https://patch.msgid.link/20260928230429.495442-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
Tristan Madani
|
58858b8f14 |
ice: fix metadata_dst refcount handling on representor teardown
ice_eswitch_release_repr() uses metadata_dst_free() to release the
representor's metadata_dst. metadata_dst_free() directly frees the
underlying memory without checking the dst_entry refcount.
When ice_eswitch_port_start_xmit() processes a packet, it takes a
reference via dst_hold() and attaches the metadata_dst to the skb.
If the representor is torn down while packets are still queued on
the lower device (e.g. in a qdisc), the metadata_dst is freed while
references are still held.
Use dst_release() instead, which correctly decrements the refcount
and only frees the object when all references are dropped. The dst
subsystem already handles metadata_dst cleanup in dst_destroy() when
DST_METADATA is set.
Other drivers sharing this pattern (nfp, airoha, bnxt) already use
dst_release() for their metadata_dst lifecycle.
Fixes:
|
||
Bryan Fraschetti
|
7a579dec84 |
ice: Restore Ordered MMIO Writes for Tx Doorbells
The DQL accounting state which tracks the number of bytes queued for the NIC to transmit, namely dql->num_queued, is updated by the ICE driver when it invokes __netdev_tx_sent_queue(). Subsequently the driver updates the hardware queue tail allowing the NIC to begin processing the work queue. The queue accounting update should be ordered before the NIC begins transmitting descriptors. The transmit path currently updates the hardware doorbell using writel_relaxed(), which (on arm64) does not provide the same ordering guarantees between writes to normal memory and writes to MMIO registers that writel() does. This introduces a potential race where the NIC begins transmitting descriptors before the dql->num_queued update is globally visible. If the NIC finishes before the update is observed by dql_completed(), it detects an invalid state where more bytes have been completed than have been queued. When this happens the following BUG_ON is triggered. BUG_ON(count > num_queued - dql->num_completed); This has been observed and manifests as the following crash (note that the trace has been trimmed) in an environment with sustained network load that uses an Intel Corporation Ethernet Controller E810-XXV for SFP (rev 02) on an arm64 machine. Replacing writel_relaxed() with writel() in a test kernel eliminated the crash in the user's workload, which previously reproduced the issue reliably. kernel BUG at lib/dynamic_queue_limits.c:99 Internal error: Oops - BUG: 00000000f2000800 [#1] SMP pc : dql_completed+0x268/0x2a0 lr : ice_clean_tx_irq+0x1d4/0x620 [ice] Call trace: dql_completed+0x268/0x2a0 (P) ice_napi_poll+0x94/0x520 [ice] __napi_poll+0x48/0x3f0 net_rx_action+0x194/0x420 This restores the behaviour prior to commit |
||
Xuanqiang Luo
|
1402fc67d2 |
ice: fix use-after-free in dynamic port cleanup
ice_dealloc_dynamic_port() uses dyn_port->vsi->idx to erase the dynamic
port from pf->dyn_ports. However, it frees the VSI before reading the
index for the erase, resulting in a use-after-free.
Follow the reverse of the allocation order in ice_alloc_dynamic_port()
by erasing the xarray entry before freeing the VSI.
Fixes:
|
||
Daehyeon Ko
|
8b1f0af1fd |
tcp: reject net_iov in zerocopy receive mapping hints
After copying a readable prefix, receive_fallback_to_copy() asks
tcp_zerocopy_set_hint_for_skb() where page mapping can resume. If the
next skb is unreadable, find_next_mappable_frag() passes its net_iov
fragment to can_map_frag().
skb_frag_page() returns NULL for a net_iov, but can_map_frag()
dereferences it in PageCompound(). A v7.2 KASAN run on a connected TCP
socket with 64 readable bytes followed by a 4096-byte NET_IOV_DMABUF
fragment reported:
BUG: KASAN: null-ptr-deref in can_map_frag
tcp_zerocopy_receive -> can_map_frag
Kernel panic - not syncing: KASAN: panic_on_warn set
The diagnostic inserted the net_iov directly because the test host has
no devmem-capable NIC. Hardware end-to-end reachability remains untested
and requires CONFIG_NET_DEVMEM plus a supported DMA-buf-bound RX queue.
Reject all net_iov fragments before skb_frag_page(). This covers both
DMABUF and IOURING net_iov types while leaving page-backed checks
unchanged. With the guard, the same queue copied the readable prefix,
returned a 4096-byte skip hint, and completed without a fault.
Fixes:
|
||
|
Linus Torvalds
|
8f150ccedf |
bpf-fixes
-----BEGIN PGP SIGNATURE----- iQJRBAABCgA7FiEE+soXsSLHKoYyzcli6rmadz2vbToFAmq/0m8dHGFsZXhlaS5z dGFyb3ZvaXRvdkBnbWFpbC5jb20ACgkQ6rmadz2vbTpVWxAAgk0avmO+opg/LpC6 vQ6kQO743IkD1uc+jnGcRbOSo1YftUu5W1HY7hpj75MAdzSuScN3sflWyFb8Ng7l AG6HH9drhOIGzEMzc1847fDqM8BYO4DY72ofM/c6tAqlaO6v5EbT2zW/kXm8PPtS sRE60PP0lMh4NCuD2cH9X19GcR44CQXDijioW91hWAg8jxbGKgz9Skw6W+RHqIrH Gi5pkg7OV4Qz5+/XuLpJ0Sd7df8/LMtzAi+B6EG8EfldvkuSMT1vNyS04IKXjGN2 1BWyUhWuIuRs/ReJ7PbkIa+Byc5ToiMmwozLR8X0M2k5iI6lGSIxdjaAUN0W8sIn fk0aIIHhXa7L5Kf/6sOpLX3zESx5f/i+/7GdMFLYRkXiQTLsMBi2lqxvz++wxxak s/MzJ0luOrbYrU53ufb1tNpwX97mYpvu8YLu7PadfEuQuGf4g1yhrjYAu7wltOCo vPOOCm8SSm+WW0BTNkjET7acYP4nXNHxnAx6KI1BPNMVMBa/C/b7PH7BrQhkkIfp Fq1cXL2FFTRLr+CxhU9oDHfTekvSrY58OZG+lputgFSy4JMXahoioXImGWw2TaGP 00ExdJtA5lsTeskNuGoKDT0pZHWpgi0QlbGzdKWq4Qqv2fEOX5PWhgvnrucZ6+Ob +aH1vPjhom3qsWPxLKFKW/UZsN8= =+6qx -----END PGP SIGNATURE----- Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Pull bpf fixes from Alexei Starovoitov: - Fix overflow of backward jump offset in constant blinding (Alexei Starovoitov) - Fix packet range of packet pointers sharing an id when var_off tightens umax of one pointer and not the other (Alexei Starovoitov) - Fix objects stuck in free_by_rcu_ttrace list of bpf memalloc (Alexei Starovoitov) - Fix use-after-free of progs detached from busy trampolines: wait for an RCU tasks grace period before freeing trampoline progs, and patch detached progs out of trampoline images that are still in use (Florent Revest) - Hold map BTF for the memory allocator destructor record to fix UAF in deferred bpf_mem_alloc destruction (Kumar Kartikeya Dwivedi) - Fix missing migration protection in resizable hashtab lookup_and_delete batch operation (Ömer Mete Kaya) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch() selftests/bpf: Add a test for objects stuck in free_by_rcu_ttrace bpf: Fix objects stuck in free_by_rcu_ttrace bpf: Factor out __do_call_rcu_ttrace() selftests/bpf: Test packet range of pointers sharing an id bpf: Fix packet range of pointers sharing an id selftests/bpf: Detach a trampoline prog while a task sleeps before it bpf: Skip detached progs in trampoline images that are still in use bpf: Wait for an RCU tasks grace period before freeing trampoline progs bpf: Hold map BTF for the memory allocator destructor record bpf: Fix overflow of jump offset in constant blinding |
||
Suraj Gupta
|
bcf2573a68 |
net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop
In the dmaengine path the driver pre-submits RX buffers and holds
in-flight TX buffers whose SKBs are DMA-mapped by the driver and freed
only in the completion callbacks. On ndo_stop() dmaengine_terminate_sync()
aborts these descriptors without running their callbacks, and the driver
then frees only the ring shells, leaking every SKB still owned by the
engine and its DMA mapping on each ifdown. With 128 RX buffers pre-posted
per channel, the mapping leak can eventually exhaust a limited IOMMU
aperture.
Clear the slot's skb in the TX and RX callbacks so a non-NULL skb marks a
slot that still owns a live, DMA-mapped buffer, and on stop unmap and free
every such buffer.
axienet_dma_rx_cb() runs from the DMA tasklet and re-arms the RX ring on
each completion, so it can race axienet_stop(): a completion may submit a
fresh buffer after dmaengine_terminate_sync() has returned, leaving the
channel armed with a buffer the teardown then frees while the engine may
still write into it (dma_release_channel() does not stop it either). Add a
lock that axienet_dma_rx_cb() holds across the @stopping check and the
resubmit, and axienet_stop() holds to set @stopping before terminating.
Once @stopping is set no callback can arm a new buffer, and any armed just
before is aborted by the terminate, so teardown only frees buffers the
engine no longer owns.
Fixes:
|
||
|
Linus Torvalds
|
d2dbe503fd |
pci-v7.3-fixes-3
-----BEGIN PGP SIGNATURE----- iQJIBAABCgAyFiEEgMe7l+5h9hnxdsnuWYigwDrT+vwFAmq/2ngUHGJoZWxnYWFz QGdvb2dsZS5jb20ACgkQWYigwDrT+vzd3A/9H5f2phFvyMaiTUk4w3WuvBcWI2uo OBp6dT259y7BYUGqo15qPeFayOrKluw4tqUZ31Zq2nFOcE7HCT1iJBYx4AKxj7N2 /GWsOivm7gulZI34ntcEw7lU7kPbfrCw3Uno7jbLeq2K7hB6u+J+stN9A9aqYU/g 49bDaKU8i4Y7OC1p2UORsKm57jWdrk+iKaOZj6v6yFssT9s3a5SJvC/yXWyi20Oj GZrIKTd/U5ze7+DmcG3ErqdPJMYPMThb536fvxU8onZAGDrYU6NWXHP+v4lCk7Pc CqkFd5hLBtfw08LJXQiBEMXKzqdR9CgHDKPUqTRra2z+ko/8zy0Zwb71KzaRClps nd4N69+ges49nmx6eMKNv0uofUqusMG17YT87ncFLDN0/SfMOk+niigApKXT5Zi5 LC9eL1tqiSuBt/P7ucJ6e8dEBV55GIZwv4HbzFT34FPvlzbYotDl058AoysoeVIg 8vMxUQa9p0HTAgtid0FgVgFaXFAkZtCxCGfAPvjQhAvj4WlQthf3eO8PJ6NBB+4d vf5gd2OIMP2+lMtbscufMwRyrushIy3wZWFDyRXW5E/xHaYvmccNovRpGUYxzvOs DkLK0zUCnRHLHHP6z9QgNXCy1/qFpHOMUa854k/hQpsCX0LeKLO071xxckA5M/bM UDV7bMmy+P8YpLA= =QW4A -----END PGP SIGNATURE----- Merge tag 'pci-v7.3-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull PCI fix from Bjorn Helgaas: - Allow driver to use AtomicOps if already enabled by hypervisor; fixes regression when Root Port is not visible in a guest (Nikola Prica) * tag 'pci-v7.3-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI: Accept AtomicOps already enabled by the hypervisor |
||
|
Jakub Kicinski
|
184b5ddf82 |
bonding: fix the program leak when XDP is replaced
We need to release the reference on the old BPF prog, whether we are going to no-prog, or replacing the prog with another. Spotted by AI while running tests for the propagation series (leaked programs were accumulating). Selftest will come in the net-next series to avoid conflicts. Fixes: |
||
|
Linus Torvalds
|
3b7cab693b |
block-7.3-20261002
-----BEGIN PGP SIGNATURE-----
iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmq/wmgQHGF4Ym9lQGtl
cm5lbC5kawAKCRD301j7KXHgpgV+EADLF47GRHfu2Fi0Z7I/mnrvBKnBHaBFNbo3
cyedQKQhs3PhhnRfmxYpIfT0nqIPOwHCYMVZScqlyMRSoWN+kZ5y+2dSQpQK/SNY
Yoe2jJOaUpI9LgwC8oGiJl4vtALjtA8xbBHrL5nY6m5wCek9rXvcNxEx+LzVVwBa
EgA4lrAsVu+6f0mirWoS28+BbeQ8INBMvSz2NEHbPQQznjy5swITILzh+39h/ZiV
KPYH8fFr5augGg7U3+460OpO2qj8knowoAzS6MBByhuHqRLzp3U32dpIvBYcrIIZ
8F8tJWd4v0z3rwzDOPZQ2FAF7NvQDJIXqTDRm+gERUAoA5sVN51FA/YUXXgO4lrB
3c7fwad2M8OGtyoQsxR5+pbyhYzRAPhjP2efn2jJgOQL7/8aY45VJ9Ew5ywtF6RJ
/f8/JbAeqWi6DGEJIqRA1A2RjP87hAOge0hSVlzUq8PT7e5AO/qUmRIN30WvBqd2
CBNojahSNoOQJXCh59Ho4XBxfC9pBhEmF+lNSHkB7D6Szf1BoKUViVI8v18DFbgK
lWGsjeJLBpZPOybyenjUJsfqU9mt8h4dpnkiutwD8o6ha7mNV5McqSz3E7H8vxS3
gIz9vrUXkw2FUdDvwGrjcApr/OVYg9a7GZzFzFvA1Yh39MYU49lhcY2BqUCg+XO4
HDRVktN5ZA==
=wolG
-----END PGP SIGNATURE-----
Merge tag 'block-7.3-20261002' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull block fixes from Jens Axboe:
- NVMe fixes via Keith:
- Fix an out-of-bounds write in nvmet_auth_challenge(), where
sizeof() on a void pointer undercounted the challenge header and
let a short AUTH_RECEIVE buffer pass the check
- nvme-multipath fixes for an ANA log bounds check underflow, the
command effects log lifetime for multipath heads, and only
setting BLK_FEAT_ZONED after the zone info is known.
- nvmet fixes for ns->enabled teardown ordering, rejecting I/O
after the percpu ns reference is killed, device path preservation
on allocation failure, and too-short SGL segments in pci-epf
- nvme-tcp: revert the per-socket dynamic lockdep keys, and delay
the socket reclassification
- A DMA pool alignment quirk for the Micron 4100AT
- Controller state/reset race fixes, and -Wformat-security
workarounds
- blk-mq: set RQF_USE_SCHED when the operation is known, and allow
cached requests to be used for flush operations
- Reject polled dio with user integrity metadata
- Save the IRQ state in blkg_tryget_closest()
- Set the zone write granularity in virtio_blk
- ublk selftest fixes
* tag 'block-7.3-20261002' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (23 commits)
virtio_blk: set the zone write granularity
nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known
nvme: fix command effects log lifetime for multipath heads
nvmet: don't allow I/O admission after percpu ns reference is killed
nvmet: defer setting ns->enabled to false in nvmet_ns_disable()
nvmet: copy the hostid into the ctrl before creating PR pc_refs
nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()
nvmet: pci-epf: reject too-short SGL segments
nvme-multipath: fix underflow in ANA log bounds checks
nvme: work around all -Wformat-security warnings
nvme: work around -Wformat-security warning
nvme: do not reset controllers in NVME_CTRL_NEW state
nvme-tcp: delay nvme_tcp_reclassify_socket()
Revert "nvme-tcp: lockdep: use dynamic lockdep keys per socket instance"
drbd: remove unused drbd_nl_mcgrps[] array
blk-mq: allow cached requests to be used for flush operations
blk-mq: set RQF_USE_SCHED when the operation is known
block: reject polled dio with user integrity metadata
selftests: ublk: fix unused_result error
blk-cgroup: save IRQ state in blkg_tryget_closest()
...
|
||
|
Linus Torvalds
|
3f1fe48a36 |
io_uring-7.3-20261002
-----BEGIN PGP SIGNATURE----- iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmq/wk0QHGF4Ym9lQGtl cm5lbC5kawAKCRD301j7KXHgpkD/D/4mOJ3xw+h4BAzHa6SyquNgxXls8MXeJOrv DfTDjclyBMMY60ALlZENTfoM1lIY22eFyl/e0guc9WnDqFEG2MwOAmLh1+YLDEdP lX2c0ICo1Q3/JKUV2y6JPJeERalq+yP1HMl7ZhH2nIXX0vxW2ALGzWtmr1G5DfyI KakNq7pMSQC554p5dZe3+X9HcxYFX8/EslygmNVquiRo6hm1Ys4srG9kJw/iOsw4 7ryI6hRAMjgmI39h/RVBnUVvGSgo+MU2OzPCYUqIN6lK+fvPiGaPfWib5NTOdpSJ 09PNhtB4gijCW+bnYAvXEQohq2ikPOGPmRYN320vUF6rryWWRJLF86IbE4t+/j3n KV1i0UZK1Y7cL3HMRr1SKfedsNRjpoTdyBlMxC+hWbjcIFQNV1oLo6gEu5r/8M3b oMiaQl18KHKcWhw5bbLGr9dSjgN2XHCZ0j38QwzGbbjKC+TRS0mYrjXCgNzEfdIC tsnLWQE5CKPhWw2u3R/lMRFtSWs/ZWKOamONNGgxgGt53kbKOx1dY7UvhEx/cvxu nA84L6sgE6KQzkQ5PshF3OFXw7ckm3v7hh0aiUtjczGz7FUK6db/h3sudxfiXazg P7veXjlqnw4ny8MzfnSXkhjXM/zD3s8c33dNjEcgvVXVLCAkWWrTsiO9NTUA3fMI 7IC5n7RoSg== =Sg1l -----END PGP SIGNATURE----- Merge tag 'io_uring-7.3-20261002' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Fix a task_work add use-after-free with SQPOLL. The sqpoll thread could pop and complete the last request while io_req_normal_work_add() was still looking at them after the mpscq push. Use the same approach as DEFER_TASKRUN to protect from that, holding an RCU read lock across the add, and have exit wait for an RCU grace period for SQPOLL rings as well. - CQE32 ring fixes: correct the free entry check for 32b CQEs, zero the big_cqe for aux CQEs, and only post the dummy skip CQE on CQE_MIXED rings - Mark the source filter table as COW when cloning bpf filters, so registering another filter on the source doesn't modify the shared table in place - Initialize the task context before running the BPF loop - Requeue zcrx multishot receives stopped by a local resource - End a TX_TIMESTAMP multishot cmd when the CQ is full (lollipopkit) * tag 'io_uring-7.3-20261002' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring: fix task_work add use-after-free with SQPOLL io_uring/cmd_net: end TX_TIMESTAMP multishot when the CQ is full io_uring/zcrx: requeue multishot receives stopped by a local resource io_uring: initialize task context before running the BPF loop io_uring: zero big_cqe for aux CQEs on CQE32 rings io_uring: fix free entry check for 32b CQEs on CQE32 rings io_uring: only post the dummy skip CQE on CQE_MIXED rings io_uring/bpf_filter: mark source as COW when cloning filters |
||
|
Linus Torvalds
|
5d144c294a |
sound fixes for 7.3-rc6
A fair amount of small fixes, which became much larger as a pile of
pending homeworks during my vacation in the last weeks.
The majority of changes are device-specific quirks and ASoC updates,
along with a few ALSA core fixes and USB-audio hardening as well as a
few regression fixes.
ALSA Core:
- Serialize ALSA sequencer compat port-info ioctls
HD-audio:
- Fix ALC235 codec headset handling
- Fix regression on Tegra194 controller support
- Quirks / fixes for Lenovo, ASUS, Acer, Dell, Higole, HP, and IPASON
laptops
USB-audio:
- Hardening for line6 and ua101 drivers to deal with malformed packets
- Fix input device leak on probe error in caiaq driver
- Apply quirks generically for Audient and Behringer devices
- Quirks for ASUS SupremeFX Hi-Fi, HiBy FC4 (native DSD), and MSI MAG
B850M MORTAR WIFI
ASoC:
- Runtime PM fixes for SDCA class function driver
- Fix uninitialized stream configs in RT1017 and MAX98363 SDW codecs
- AMD ACP SoundWire support for ASUS and Lenovo models
- Quirks for Intel machines (Lenovo Yoga Slim 7, Chuwi Hi8)
- Qualcomm LPASS fixes for playback constraints and WSA macro volume
- Codec / platform fixes for rt274/rt286, cs42l43, wm8903, Tegra ASRC
Misc:
- Regression fix for silent playback on Creative Titanium HD
- Error handling fix at probe via auto-cleanup in ice1712
-----BEGIN PGP SIGNATURE-----
iQJCBAABCAAsFiEEIXTw5fNLNI7mMiVaLtJE4w1nLE8FAmq/qz0OHHRpd2FpQHN1
c2UuZGUACgkQLtJE4w1nLE88Qw/+MkSuwXjKwYysSqMUZvtMbwZr3MCAqBXtiw3K
xLAQU8CPkEFUFbTfBAhMWcngEbnzwWUQoZjBn8zsibFW3Hv8Pca7kgN3IrT7dDsU
HBUKVL6OC5EYq3he3LZ7I9p0XEgawJ/t+SbD1gy7VQrdfpeebv9bkTkeAlAL8nUL
/TulprOBgJ3C+8WZmzn28SFAS+mTTmFGU8x/VlRiJIW9PrWnUIUR/LfsQR1z+ZWf
cSJSSZk6Vw3TqYjRM7t8rDD1kfBZZdEWU5xzXww0t6sk8IY0ZneuRemB4Iq2fzTO
0kj2RzV8gao2PA/lPzNKbRR7WHdD5UsgZcl/jCYw+I+ZTfeOT1aGRBDqrJnyysiU
WOK5M94HyNzh/xtss+am7N86eHU3F7yGOyw4cInEM2iZygI1i4z4AXNvHTthgikx
CsefCtHCSCMyivKI4krhLlzKg/m6D/FCNSRWr+F2ot2nTJUZ0ZikWZTqF+2OsPRA
aPC6JnzB+Ko5PPd3ESnuWC+eSOJOzzhQoselIdadZkWGJ3chqMj6XLB6Og0KBInA
HGgISixQK+BN8viFUhaTx0WVzijCnBMV1+ajNSnb+Rhl+TE47EHbn60VhnYb/arA
AQjcJR2h73FrZYsylSo9bCZD2LfeypCh5xiJ4Kh/veVNWdc+Jb4GBmo4vIaAYMfZ
aurWW2c=
=jPeb
-----END PGP SIGNATURE-----
Merge tag 'sound-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"A fair amount of small fixes, which became much larger as a pile of
pending homework during my vacation in the last weeks.
The majority of changes are device-specific quirks and ASoC updates,
along with a few ALSA core fixes and USB-audio hardening as well as a
few regression fixes.
ALSA Core:
- Serialize ALSA sequencer compat port-info ioctls
HD-audio:
- Fix ALC235 codec headset handling
- Fix regression on Tegra194 controller support
- Quirks / fixes for Lenovo, ASUS, Acer, Dell, Higole, HP, and IPASON
laptops
USB-audio:
- Hardening for line6 and ua101 drivers to deal with malformed
packets
- Fix input device leak on probe error in caiaq driver
- Apply quirks generically for Audient and Behringer devices
- Quirks for ASUS SupremeFX Hi-Fi, HiBy FC4 (native DSD), and MSI MAG
B850M MORTAR WIFI
ASoC:
- Runtime PM fixes for SDCA class function driver
- Fix uninitialized stream configs in RT1017 and MAX98363 SDW codecs
- AMD ACP SoundWire support for ASUS and Lenovo models
- Quirks for Intel machines (Lenovo Yoga Slim 7, Chuwi Hi8)
- Qualcomm LPASS fixes for playback constraints and WSA macro volume
- Codec / platform fixes for rt274/rt286, cs42l43, wm8903, Tegra ASRC
Misc:
- Regression fix for silent playback on Creative Titanium HD
- Error handling fix at probe via auto-cleanup in ice1712"
* tag 'sound-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (53 commits)
spi: cs42l43: Workaround for wrong speaker ID on Dell XPS 13 DX13260
ALSA: ice1712: Fix the error handling via auto-cleanup at probe
ALSA: core: Define auto-cleanup for snd_card_free()
ALSA: hda/realtek: Add ALC235 support for headset mode
ALSA: hda/realtek: Add micmute LED quirk for Acer Swift SFG16-72
ALSA: hda/realtek: Fix mute and micmute LEDs on HP ENVY x360 15-ey0xxx
ALSA: hda/realtek: Add mute LED quirk for HP Pavilion 14-dv1001TU
ALSA: ctxfi: Fix silent playback on Titanium HD (SB1270)
ALSA: usb-audio: Apply IGNORE_CTL_ERROR quirk to all Audient devices
ALSA: usb-audio: Apply boot quirk for Behringer models generically
ASoC: codecs: lpass-wsa-macro: rewrite the interpolator volume after enabling clocks
ALSA: hda/realtek: Fix speakers on ASUS PM3406CHA
ALSA: hda/realtek: Add quirk for HP Pavilion AiO 24 speaker
ALSA: hda/realtek: Add mute LED quirk for HP Laptop 15-fd2xxx
ASoC: amd: acp-config: Add ACP70 DMI quirk for ASUS UM5406GA
ALSA: hda/realtek: Add mute LED quirks for HP Pavilion 15-eh3174nw and HP Laptop 15-dw1xxx
ASoC: Intel: Add quirk to block match table for Lenovo Yoga Slim 7
ALSA: hda/realtek: Add mute LED quirk for HP Victus 15-fb2xxx
ALSA: hda/realtek: Add quirk for Acer Nitro AN515-45
ALSA: hda/realtek: Add quirk for Lenovo ThinkBook G8+
...
|
||
Waiman Long
|
23b1ab15ca |
cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()
With commit |
||
|
Linus Torvalds
|
ac7445c28e |
Random number generator fixes for Linux 7.3-rc6.
-----BEGIN PGP SIGNATURE----- iQJPBAABCAA5FiEEq5lC5tSkz8NBJiCnSfxwEqXeA64FAmq/uGEbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMiwyAAoJEEn8cBKl3gOumEgQAK0gjA0n40rHWGlmgIJO WTqMZGcbTvVXpPRyEXuNE7tTRsDDopen4UnmDqDGafXkBO1vU1LaxN72JonPjp7O sg4EqCi0iciuiDvLrjwQ1oPtpkL/feyjcNuNzSH/h2E4hJCUcEnyhTpeaRHCm3t4 IGDXqqYYqjAQV4N6dWrzwN5K2oM75IOzccr0hyROkN/DBrqNZtupOco725MKxSsr FGTgoh0a6GlN3Yp+AIjqaHcPca/aUZApPUKmBzoWeqZmSqAmpzUIJgaHsBZAQS88 oMcSh71Fzi2tOepiazjaAK9nZC3Nh2xeRU8cwUtvLvluzYA6wnBhcuTBOqThJmp3 gEYz8yPbvil0aDIhfXB3xW2dxxsHaJrKJDLz0Smhi43D2lLKteQT3BE/2jQQ7OSa 6FcV905hys3lIxlHeCa2wE/7NgiNAy3qE1aazkIKRfI8dRJxIuhogvW3VpKGCAue TwvjfvuoVtkaPAW/gLyDGRsMzrUvGPFa8yVvP5JTPrYQh5P+bEIM8CozWO2ScVcH Cdu0/TDe9TTS5mIwh0CrSX3shV/80bvHTINL14sTAKBGtN0N0vJgA8NSdIYt8OaF 8qDDMg/XV5LY7sbMB3/Kru//wyfUw4LJdYhZSIJ0tZvzaRRIRiZGL1lT+X12PCrq uoaJ4AoDCf/ZiDaVTXEVf+28 =GmSm -----END PGP SIGNATURE----- Merge tag 'random-7.3-rc6-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random Pull random number generator fixes from Jason Donenfeld: - VMGENID memory needs to be mapped with the decrypted tag, so that SEV-SNP machines can boot - A fix for an initialization race in VMGENID, followed by a cleanup - Trivial kernel doc cleanups in siphash and random.c - A fix for a new compilation failure with recent clang on PPC and RISC-V, due to generating an out-of-line memset in the vDSO * tag 'random-7.3-rc6-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random: random: vDSO: avoid call to memset() when zeroing reserved parameter random: fix vgetrandom_opaque_params kernel-doc random: vDSO: fix repeated word 'to' in comment siphash: clean up kernel-doc comments virt: vmgenid: move to using dev_set/get_drvdata virt: vmgenid: set driver_data before registering notification handlers virt: vmgenid: remap memory as decrypted |
||
|
Linus Torvalds
|
4e9a2de02f |
slab fixes for 7.3-rc5
-----BEGIN PGP SIGNATURE----- iQFPBAABCAA5FiEEe7vIQRWZI0iWSE3xu+CwddJFiJoFAmq/c2obFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMiwyAAoJELvgsHXSRYiaJYQH/ihZin6VQt7ya7uIOFko FrAaalrw62d72vi3oRTOf3aTJY+tZLnoimGYVzBFBo9E6I7J5wpDbCJM+T0XGnBU ri98rBwjJHGO0hY12lKAlgMAmo4TQyyWLJEj2lCmsThIP8YkU9e3D3GUzgBuDzU3 vo3/kKdppj4UkFJ1dYMj+lGHPw+47WY/fscfv9atYCqAzWG/em2y0zQ/ay5mfI7h X3yiwJxeR8EsIOwBEuqurBk9rz0yMErcsb9DVgyDU23Y9SxnDL5BEr4dBuUQnV+b kru/RuPJ2Ubs8ZrlCm6T6a3yjgXZOg3m/YqJPlYX1OY1MKmZ3gefBpwcth2QiEA7 nUE= =6OkX -----END PGP SIGNATURE----- Merge tag 'slab-for-7.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/mm/slab Pull slab fixes from Vlastimil Babka: - Stable fix for a potential deadlock in kfree_rcu() when called from set_cpus_allowed_force() (Harry Yoo) - MAINTAINERS update of the slab.git URL * tag 'slab-for-7.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/mm/slab: mm/slab: do not wake up kswapd in __kfree_rcu_sheaf() MAINTAINERS: update slab.git URL |
||
|
Linus Torvalds
|
5e0f8396d4 |
hid-for-linus-2026100201
-----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEoEVH9lhNrxiMPSyI7MXwXhnZSjYFAmq/Y/IACgkQ7MXwXhnZ SjbT/RAAj7UFMT0n8z0bIScwEwzBABlpSYJlqjIg7gLlPTTKA6QWHkK7JWMNjGbP fBLH74kYz4a5e+lCv/zUm+Knw31z6GTzSRjF7wvJB2g+pAFcAfBJp595CiRXMoqg fprWpk616wsyD/5P4auJFcFfJxKvQl4TppiIJF0DuDz+/t3ZQOCG9NHCu6fvVGRH kId+OdETHgSBakgdNCNDQpPDNTC1heF68lb4chhiwpH5SrRyIXrtM7x8jgYEv/Jk 5k+qKPh2OSSah5xZlqXtxlMPd2So0BKgBae3eLZNVdHmztnhpCC1EyRVNrkacFOS UF2V0iY+vO+GQIvm6ktd27UH4d9qCY0u4WG5FV2X2BciJHfhzCFk0W5VAESsEP8j IvL/c3O3dn8ZHqveR9vTqE59B5WG5JNXFNTkoux7Mz0r2sSqZl/T86njX+j1uapT i1rrkKsj9oDh2vQcuggBQXHe1N2L0qY712pZyD+97DkF1t9Salg1pYKsMQ8A4hcF Er8x0ksZ49k2UT2R3jrsDiNWLzoit89zYbfViBXVZWAyoBkrytiOh5W2TPzEScNW sYVi/Bk55hGujhHLb/xULUAHsAlGL+Z7J1TWeWwdwqYKrytTbtZlkljvtbvqymSH DjJpehscXtkz2+1EwmUF3PwHWnE2/h8ARDNLC5qIlWD/izYf8ms= =oV+e -----END PGP SIGNATURE----- Merge tag 'hid-for-linus-2026100201' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Benjamin Tissoires: - Revert of the Bolt integration into hid-logitech-dj (Benjamin Tissoires) - A couple of buffer overflow in Intel-thc-hid (Even Xu) - A couple of Sashiko findings fixes in hid-multitouch and HID-BPF (Aldo Ariel Panzardo and Benjamin Tissoires) * tag 'hid-for-linus-2026100201' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: selftest/hid: add test for negative return codes for hid_bpf_hw_request HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request HID: Intel-thc-hid: Intel-quickspi: Fix buffer overflow HID: Intel-thc-hid: Intel-quicki2c: Fix buffer overflow HID: universal-pidff: Add support for Turtle Beach VelocityOne Race HID: multitouch: stop the release timer from being rearmed on remove Revert "HID: logitech: add Bolt receiver support for Logitech HID++ devices" |
||
Nikola Prica
|
40cce45b92 |
PCI: Accept AtomicOps already enabled by the hypervisor
pci_enable_atomic_ops_to_root() currently fails when no Root Port is visible. That is common in passthrough guests (ESXi, Hyper-V): the Endpoint is assigned to the VM, but the Root Port above it is not visible in the guest topology. In those setups the hypervisor may already have enabled AtomicOp Requester Enable on the device. If PCI_EXP_DEVCTL2_ATOMIC_REQ is set, treat AtomicOps as already enabled and return success instead of failing the Root Port walk. After |
||
|
Linus Torvalds
|
17a5800975 |
Hi,
Please pull these bug fixes, which have landed after v7.3-rc1. Br, Jarkko -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRE6pSOnaBC00OEHEIaerohdGur0gUCar9DmQAKCRAaerohdGur 0sVVAQDxPpzxXpSI1RaGiLK/Xd30r0Oy+mMpjktACUHC4C0KtQEAl32hX/eiGt7k dg35RzAKtXfGDl0FOgXo6YnHAVQ5oA0= =76Ob -----END PGP SIGNATURE----- Merge tag 'for-next-tpm-v7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull tpm fixes from Jarkko Sakkinen. - tpm error handling and buffer size fixes * tag 'for-next-tpm-v7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: tpm: Disable TPM on null key name mismatch tpm: fix off-by-four bounds check in tpm2_get_random() tpm: Fix auth session leak in tpm2_get_random() error path tpm: Fix heap buffer overflow in tpm_transmit_cmd() |
||
|
Palla Raghunath
|
08e9063337 |
Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown
syzbot hit a NULL pointer dereference in rfcomm_dev_shutdown() when an
RFCOMM tty is closed.
rfcomm_dev_add() puts the new device on rfcomm_dev_list first and only
then registers the tty device and saves it in dev->tty_dev. If that
registration fails, dev->tty_dev is never set at all. The device can be
looked up in the meantime, so an open() of /dev/rfcommN gets through
rfcomm_tty_install() and attaches to it. When that tty is closed again,
rfcomm_dev_shutdown() uses dev->tty_dev without checking it:
Oops: general protection fault, probably for non-canonical address
KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047]
RIP: 0010:rfcomm_dev_shutdown+0x48/0xb0 net/bluetooth/rfcomm/tty.c:131
Call Trace:
tty_port_shutdown+0x1bf/0x220 drivers/tty/tty_port.c:372
tty_port_close+0x4e/0x150 drivers/tty/tty_port.c:705
tty_release+0x359/0x1670 drivers/tty/tty_io.c:1718
__fput+0x418/0xa50 fs/file_table.c:512
rfcomm_dev_destruct() already copes with a NULL dev->tty_dev. Add the
same check to rfcomm_dev_shutdown(), so the tty device is only moved
when it was actually registered.
Fixes:
|
||
Runyu Xiao
|
25016fe8c1 |
Bluetooth: btintel_pcie: use managed IRQ teardown
The PCIe driver registers its MSI-X handlers with
devm_request_threaded_irq(), but remove() uses free_irq() directly. The
devres actions then retain registrations and attempt to release them again
during device cleanup.
Use devm_free_irq() for the remove path and for already registered vectors
when a later setup request fails. This removes the managed resource at the
same time as the IRQ is released and keeps MSI-X vector teardown ordered
after IRQ ownership is gone.
Fixes:
|
||
Mahantesh Salimath
|
3c0d2f1f43 |
tee: optee: ffa: support shared memory offsets on large-page kernels
OP-TEE FF-A memory objects use 4 KiB pages, while the kernel page
size may be larger. Consequently, tee_shm->offset can be greater than
or equal to FFA_PAGE_SIZE, but OP-TEE rejects such a value in
internal_offs.
Do not encode the excess page offset in offs_low/offs_high. Those
fields describe the logical memref offset and are copied back into
tee_param->shm_offs on return. Folding the page offset into them breaks
parameter round trips when a memref is reused. They are also ignored by
the OPTEE_RPC_CMD_SHM_ALLOC response path, which uses only global_id and
internal_offs to construct the shared-memory mobj.
Instead, start the FF-A descriptor at the 4 KiB page containing the
shared buffer, the same approach as optee_fill_pages_list() in the SMC
ABI. Store the remaining in-page offset in internal_offs and preserve
shm_offs in offs_low/offs_high. This keeps internal_offs within the
FF-A page size, maps RPC allocations at the correct address, and
preserves normal memref offsets across repeated invocations.
Tested on ARMv8-A with 64 KiB PAGE_SIZE. OP-TEE OS ran as a secure
partition under Hafnium (SPMC) over FF-A. Verified registered shared
memory with tee_shm->offset >= 4 KiB, memref reuse on the same
TEEC_Operation, and RPC OPTEE_RPC_CMD_SHM_ALLOC (xtest regression
6007-6009). optee_hello_world, optee_aes, and xtest regression 1005,
1007, 1008, 4001-4003 and 6001-6003 also passed.
Fixes:
|
||
Shao-Fu Chen
|
c108feca0a |
optee: register TEE devices only once fully initialized
optee_probe() called tee_device_register() on both the client and the
supplicant device before the rest of struct optee had been initialized.
tee_device_register() calls cdev_device_add(), which does two things at
once: it creates /dev/tee0 and /dev/teepriv0, and it links the device
into the tee class so that class_find_device() can find it. From that
moment on the device is reachable both from user space via tee_open()
and from kernel space via tee_client_open_context(). The only gate in
teedev_open() is tee_device_get(), which merely checks that
teedev->desc is non-NULL, which was already set by tee_device_alloc().
Therefore, there is effectively no gate at all.
A context opened in that window can run against a struct optee where
- optee->call_queue.mutex is not initialized by optee_cq_init()
- optee->supp mutex and completions is not initialized by
optee_supp_init()
- optee->rpmb_dev_mutex is not initialized yet,
- the message argument cache is not initialized by
optee_shm_arg_cache_init()
- optee->ctx is still NULL
Any open session or invoke during this window takes uninitialized
mutexes and dereferences a NULL pointer.
Fix it by moving both tee_device_register() calls down to the point
where all of struct optee is set up.
Fixes:
|
||
Takashi Iwai
|
b4e7fc36e3 |
ASoC: Fixes for v7.3
A bigger collection of fixes than usual due to your vacation but nothing hugely remarkable here, just fairly standard quirks and driver specific bugfixes. -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmq/pNMACgkQJNaLcl1U h9AUCwf7Bbgn8Pa9KH+F+4inKlkje4z1gF0xQfzDPnruzBjGw89/I1CRkKp8sudf YubFNgeXUNxzG1uthiVzo+0XzL/CrSFH7P6J0WBu8n/jUIoDZCx5nWUWQnZWSe/q TDrnDLOcJQ6Tn+2QOYgbvbX3gqsUEzeTDbMcRT90EaWeVAlJTdjzBwgwUbPG0u9F EcYaQeNJI1E/+PMPUOUDwzhIpst2q1TOop9wjttxxsdu9pqt3YjPdmaEe00IUtvN hzt82qMcEmSjCSpQl/TkL5/VsYSUB+BRsRE+TCZQu0fV2ZVDK8bjQD0kmRXaKpUx UwodwwTaecpSiV1H8f7+FrNhz1Njdw== =m+q5 -----END PGP SIGNATURE----- Merge tag 'asoc-fix-v7.3-rc5' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v7.3 A bigger collection of fixes than usual due to your vacation but nothing hugely remarkable here, just fairly standard quirks and driver specific bugfixes. |
||
Georgiy Osokin
|
b7f925fd52 |
tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()
tee_dyn_shm_alloc_helper() derives nr_pages from a caller-supplied size
and passes it to alloc_pages_exact() without checking it. For size == 0
nr_pages is 0, and alloc_pages_exact(0) calls get_order(0), which is
documented as undefined and returns BITS_PER_LONG - PAGE_SHIFT. The page
allocator then trips its order > MAX_PAGE_ORDER warning and fails the
allocation; on a panic_on_warn kernel that ends the boot.
This can be triggered by TEE_IOC_SHM_ALLOC with struct
tee_ioctl_shm_alloc_data where size is 0.
Reject a zero page count, as register_shm_helper() already does for the
register path.
Fixes:
|
||
Ömer Mete Kaya
|
de020dc804 |
bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch()
bpf_mem_cache_free_rcu() uses this_cpu_ptr() which requires migration
to be disabled. All callers of rhtab_delete_elem() disable migration
except __rhtab_map_lookup_and_delete_batch(), which calls it under
rcu_read_lock() only.
On CONFIG_PREEMPT_RCU, rcu_read_lock() does not disable preemption or
migration, so the task can migrate between CPUs during the delete loop,
causing this_cpu_ptr() to trigger:
BUG: using smp_processor_id() in preemptible [00000000] code
Fix by wrapping the delete loop in migrate_disable()/migrate_enable()
in __rhtab_map_lookup_and_delete_batch(), matching the migration
protection that the other callers already provide.
Fixes:
|
||
Frank Li
|
71a77ab76e |
net: allwinner: remove dmaengine_desc_free()
dmaengine_desc_free() is designed for DMA_CTRL_REUSE. If DMA_CTRL_REUSE is not set, dmaengine_desc_free() will return -EPERM. if (!dmaengine_desc_test_reuse(desc)) return -EPERM; So calling dmaengine_desc_free() does nothing. dmaengine_terminate_(a)sync() will free all already allocated descriptors. Signed-off-by: Frank Li <Frank.Li@nxp.com> Reviewed-by: Joe Damato <joe@dama.to> Signed-off-by: David S. Miller <davem@davemloft.net> |