mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-10 20:48:12 +00:00
1,485,420 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
HyeongJun An
|
203436d2ae |
ASoC: cs42l56: Put the Limiter Cushion control on the limiter register
The Limiter Cushion control writes bits 4:2 of the ALC Thresholds
register. Those bits are ALCMIN, which the ALC MIN control owns. The
datasheet puts CUSH at bits 4:2 of the Limit Thresholds Control
register, next to LMAX, which the Limiter MAX control already uses.
So setting the limiter cushion changes the ALC minimum threshold, and
the cushion itself cannot be set.
Use CS42L56_LIM_THRESHOLD_CTL.
Fixes:
|
||
Hui Su
|
6ac4544eff |
sched_ext: idle: Respect task affinity in restricted CPU selection
The restricted select_cpu kfunc path handles single-CPU and
migration-disabled tasks without going through scx_select_cpu_dfl().
It currently uses prev_cpu as the candidate, even though prev_cpu is only a
hint and may no longer be usable after an affinity change. With a
caller-provided @allowed mask, this can also return an idle CPU outside
p->cpus_ptr.
Derive the candidate from task state instead: use the sole CPU in
p->cpus_ptr for single-CPU tasks and task_cpu(p) for migration-disabled
tasks. Validate it against p->cpus_ptr and @allowed before claiming its
idle state.
Since the derived candidate may be on a different NUMA node from
prev_cpu, also preserve SCX_PICK_IDLE_IN_NODE by rejecting cross-node
candidates.
Perform all checks before scx_idle_test_and_clear_cpu(), as a successful
call consumes the CPU's idle bit.
Fixes:
|
||
Tejun Heo
|
5bdeca322a |
sched_ext: Fix the bypass dispatch claim for schedulers bypassed by an ancestor
scx_bypass() claims bypass dispatch when the scheduler's depth goes from
zero to one and releases it when the depth returns to zero, but propagates
only the depth to the descendants, not the claim. A descendant that starts
bypassing with its ancestor never claims, and one whose own bypass ends
under the ancestor's keeps its claim, as its depth does not return to zero.
A sub-scheduler enable whose bypass ends under a PM suspend thus leaks its
claim: the parent keeps hosting bypass dispatch and the sub-scheduler's next
bypass trips the WARN_ON_ONCE() on the claim. A sub-scheduler disable that
starts under a PM suspend has no claim, so once the resume lifts the root's
bypass its tasks sit on the parent's bypass DSQs with nobody consuming them.
Claim for every descendant whose depth goes from zero to one in the
propagation and release every scheduler in the subtree whose depth returned
to zero once the tasks have moved out of the bypass DSQs. A parent that is
bypassing itself when a descendant claims consumes only its own bypass DSQs,
empty until it leaves bypass and becomes the host.
Fixes:
|
||
|
Tejun Heo
|
dcf7f650a2 |
sched_ext: Propagate every bypass depth change to the descendants
scx_bypass() propagates a depth change to the descendants only when the
scheduler's own depth crosses zero, so an own bypass that starts under an
ancestor's never reaches them. When the ancestor's bypass ends first, the
descendants leave bypass while the scheduler is still bypassing: a
sub-scheduler disabled under a PM suspend has its children re-queue their
tasks through their own BPF schedulers at resume, mid-teardown. If the own
bypass then ends, every descendant is decremented once more than incremented
and dec_bypass_depth() warns, though no current caller gets there.
Propagate on every call so that a descendant's depth is the sum of its own
bypasses and its ancestors'. The early return follows the walk, as a
descendant's depth is at least the scheduler's and nothing changes bypass
state unless the scheduler's own does.
Fixes:
|
||
Avi Weiss
|
0936bbd35a |
ASoC: stm32: spdifrx: fix synchronization state check
The interrupt handler uses a logical AND to check whether SPDIFRX
was in the SYNC state before clearing errors. Since both SYNC (1)
and ENABLE (3) are nonzero, this also treats ENABLE as SYNC (and
any other non-zero value that might be added).
The logical && basically just converts this to check for != 0.
So errors occurring while SPDIFRX is enabled cause the driver
to retry synch instead of disconnecting the PCM stream.
Fix is to change the logical && to equality (==) and only retry
when exactly in sync state.
Fixes:
|
||
Sergey Tiraspolsky
|
f6be9f558a |
ASoC: Intel: avs: Reset the stream unless it is already prepared
Commit |
||
Paolo Bonzini
|
e90ab36691 |
KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes
When running Hyper-V from Windows 11, KVM is seeing the SS bit set in nested page fault error codes produced for shadowed NPT. The AMD manual is unclear about when SS is set, including whether it can be set when SupervisorShadowStackEn (bit 6) is not set in the MISC_CTL field of the VMCB. Nevertheless, the unexpected SS bit causes out of bounds accesses in permission_fault(), seen as either WARNs or UBSAN reports: kernel: UBSAN: array-index-out-of-bounds in arch/x86/kvm/mmu.h:225:27 kernel: index 34 is out of range for type 'u16 [16]' (in this case, the page fault error code is 34*2=0x44, i.e. SS|U; the report shows SS|U|W happening as well). Fix the handling of unknown error codes by dropping SS and (with a WARN) any bits not among those that permission_fault() expects to receive. At the same time, given the uncertainty about when hardware sets SS, follow the processor's behavior when constructing the fault's error code, and preserve the SS bit as passed to FNAME(walk_addr_generic). While the behavior is surprising, there's a possibility that Hyper-V expects it (Hyper-V does not even enable CET unless it finds MBEC/GMET!), so retain the information when reflecting the fault to L1 instead of unconditionally discarding it. Bisection shows that this started happening with commit |
||
Liam R. Howlett
|
8240e19d32 |
accel/amdxdna: Fix Kconfig invalid configuration
The amdxdna has a soft dependency on the amd_pmf module. It will use an
exported function if it is available and fall back to another function
if it is not enabled.
amdxdna and amd_pmf are tridstate modules supporting both built [y] and
modularized [m] in the .config file. Since the amdxdna decides to use
the amd_pmf if it is either a module or built in (see
drivers/accel/amdxdna/aie2_pci.h), then there is an issue if they are
not compiled either both as modules or both as built-in.
Adding the optional dependency to Kconfig does not allow the
configuration from being selected.
Fixes:
|
||
Paolo Abeni
|
8e2fbe0e75 |
Merge branch 'net-rds-rdma-cm-event-handler-fixes-for-non-ib-devices'
Allison Henderson says:
====================
net/rds: RDMA-CM event handler fixes for non-IB devices
This is v4 of Aohan Mei's fix for the uninitialized transport pointer
in the RDMA-CM event handler (v1 at [1], v2 at [2], v3 at [3]), now a
two-patch set.
Patch 1 is the fix itself. v3 only rejected a connect request
arriving on a non-IB device; the active side can bind an id to one
as well, and resolving a route on an iWARP id leaves
cm_id->route.path_rec unset, which the ROUTE_RESOLVED case
dereferences. Such a connection is now dropped at ADDR_RESOLVED
instead of resolving a route.
Patch 2 fixes a neighbouring problem in the same case: a synchronous
rdma_resolve_route() failure was handed back to the rdma_cm, which
then destroyed an id RDS still owns as ic->i_cm_id and would later
disconnect and destroy again from the connection's shutdown.
On net-next the rdma_cm ids RDS creates are restricted to IB devices
(commit
|
||
Allison Henderson
|
98d446b7c0 |
net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure
rds_rdma_cm_event_handler_cmn() hands the return value of
rdma_resolve_route() straight back to the rdma_cm on
RDMA_CM_EVENT_ADDR_RESOLVED. A synchronous failure there - -ENOMEM
from the route work allocation, an SA query that cannot be set up, a
RoCE route with no usable device - makes addr_handler() destroy the
id the event was delivered on. That id is ic->i_cm_id, and nothing
clears the pointer: the connection sits in RDS_CONN_CONNECTING with a
freed id until its shutdown calls rdma_disconnect() and
rdma_destroy_id() on it.
The ROUTE_RESOLVED case already avoids this: rds_ib_cm_initiate_connect()
forces a zero return while ic->i_cm_id == cm_id, as the comment there
explains. Do the same here - drop the connection and return 0 - so
the id stays RDS's to destroy from the shutdown, and the reconnect
gets a fresh one.
Fixes:
|
||
Andy Yan
|
7afc36c92a |
MAINTAINERS: update my email address
Switch my contact address to andyshrk@163.com Signed-off-by: Andy Yan <andyshrk@163.com> Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com> Signed-off-by: Heiko Stuebner <heiko@sntech.de> Link: https://patch.msgid.link/20261010134705.2131-1-andyshrk@163.com |
||
Aohan Mei
|
492ba6ac1b |
net: rds: fix uninitialized trans dereference in CM event handler
rds_rdma_cm_event_handler_cmn() assigns trans only when the RDMA
device is an InfiniBand CA (RDMA_NODE_IB_CA). On any other device
type, e.g. an iWARP RNIC such as siw, trans stays uninitialized, but
the event switch dereferences it: unconditionally in the
RDMA_CM_EVENT_CONNECT_REQUEST case via trans->cm_handle_connect(),
and (with a connection context) in the ROUTE_RESOLVED and
ESTABLISHED cases.
An RDS listener on an iWARP device therefore crashes the kernel as
soon as a connect request arrives: with CONFIG_INIT_STACK_ALL_ZERO
the wild load becomes a NULL dereference at offset 0xa0
(&trans->cm_handle_connect) in the iw_cm_wq workqueue.
GCC masks the bug in default builds by folding the uninitialized
load into &rds_ib_transport; Clang-built kernels take the real
uninitialized path and oops.
The active side can land on a non-IB device too: the id that
rds_ib_conn_path_connect() creates is not restricted to a node type,
so rdma_resolve_addr() binds it to whichever device serves the local
address, and an iWARP RNIC on the same netdev qualifies. The crash
there is different: resolving a route on an iWARP id never fills in
cm_id->route.path_rec, and the ROUTE_RESOLVED case writes
path_rec[0].sl before it calls into the transport.
The iWARP transport was dropped long ago and IB is the only
transport left, so make that explicit: initialize trans to
&rds_ib_transport at declaration, drop the conditional assignment,
reject a connect request that arrives on a non-IB device, and drop a
connection whose address resolved to one instead of resolving a
route on it. The rejection is limited to RDMA_CM_EVENT_CONNECT_REQUEST
on purpose: a non-zero return from the handler makes rdma_cm destroy
the id the event was delivered on, which is right for the request's
freshly created id but would free a connection id that RDS still owns
for any other event. On the active side the id stays ic->i_cm_id and
the connection's shutdown destroys it, so that case returns 0.
Fixes:
|
||
Thomas Hellström
|
ffbfd3f98f |
drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change
Pinned bos have their pages removed from the shrinker's shrinkable /
purgeable counts on pin, and added back on unpin according to the
bo's purgeable state at that time.
However, xe_bo_set_purgeable_shrinker() unconditionally transfers
pages between the shrinkable and purgeable counts. If the purgeable
state of a pinned bo changes, for example by userspace madvising
DONTNEED on a VMA of a bo that is also pinned as a scanout buffer,
this underflows one count and, after unpin, leaves the other one
permanently inflated.
Only update the purgeable flag for pinned bos, and leave the page
accounting to unpin.
Fixes:
|
||
Michal Luczaj
|
4f6ac74fa5 |
vsock: treat TCP_CLOSING as once-established
Handle the TCP_ESTABLISHED -> TCP_CLOSING transition on OP_RST, which can race with the connect loop. Immediately break and return 0 on ESTABLISHED/CLOSING. The return value of connect() should reflect what happened up to the point the connection was established or failed. Events that occur afterwards must not affect it. E.g. even if OP_RW has already set sk_err, connect() should still return 0, not ENOBUFS because of it. Adapt the inaccurate comment above signal_pending(). Resetting a socket that is still present in connected_table can lead to memory corruption. The reporter noted lost transports for in-flight skbs, and I have reproduced crashes caused by re-insertion into connected_table. list_add double add: new=, prev=, next=. kernel BUG at lib/list_debug.c:35! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI Workqueue: vsock-loopback vsock_loopback_work RIP: 0010:__list_add_valid_or_report+0x11f/0x130 Call Trace: vsock_insert_connected.cold+0xe/0x13 virtio_transport_recv_pkt+0x10e9/0x1460 vsock_loopback_work+0x305/0x480 process_one_work+0xe4c/0x1560 worker_thread+0x4f1/0xd60 kthread+0x36e/0x470 ret_from_fork+0x47b/0x6b0 ret_from_fork_asm+0x1a/0x30 This fix is supplementary to commit |
||
Sasha Levin
|
52336337f1 |
tools: gpio: fix building from the top level with O=
"make O=<dir> tools/gpio" fails: Makefile:27: /tools/build/Makefile.include: No such file or directory tools/Makefile clears srctree, and the gpio Makefile only works it out again when building_out_of_srctree is not set, which the top-level Makefile sets for O= builds. Also work out srctree when it is empty, as tools/bpf/Makefile does since commit |
||
Ming Yu
|
fcbc48dc65 |
gpio: nct6694: Mark the GPIO controller as sleeping
The GPIO callbacks take a mutex and issue USB transfers, so this GPIO
chip must not be used in atomic context. Change the can_sleep switch in
struct gpio_chip to true.
Fixes:
|
||
François Roux
|
dbd674ccf3 |
power: sequencing: qcom-wcn: power off WLAN at probe
The WLAN enable GPIO is requested with GPIOD_ASIS and then kept at its current level, so that a WLAN module left powered on by the firmware is not switched off. The FIXME explains why: toggling it would take the PCIe link down, and the controller driver could not recover from that. That reasoning held while the PCIe link was trained before the sequencer probed. Since commit |
||
Dave Stevenson
|
3f57b34485 |
drm/vc4: hdmi: Move packet RAM enable to PM runtime
Audio can be triggered by the HPD handler and start up before video has
been restored, calling vc4_hdmi_write_infoframe() for the audio infoframe.
vc4_hdmi_write_infoframe() needs Packet RAM to be on to store the
infoframe, however, if the video hasn't been enabled,
vc4_hdmi_encoder_post_crtc_enable() hasn't been called and therefore, the
Packet RAM can be disabled by the time vc4_hdmi_write_infoframe() executes,
causing the following splat:
[ 201.570266] ------------[ cut here ]------------
[ 201.570293] Packet RAM has to be on to store the packet.
[ 201.570367] WARNING: drivers/gpu/drm/vc4/vc4_hdmi.c:683 at vc4_hdmi_write_infoframe+0x404/0x494 [vc4], CPU#0: wireplumber/1606
[...]
[ 201.658650] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT)
[...]
[ 201.758499] Call trace:
[ 201.760967] vc4_hdmi_write_infoframe+0x404/0x494 [vc4] (P)
[ 201.766607] vc4_hdmi_write_audio_infoframe+0x1c/0x28 [vc4]
[ 201.772247] write_infoframe+0xbc/0x140 [drm_display_helper]
[ 201.777975] drm_atomic_helper_connector_hdmi_update_audio_infoframe+0x80/0xdc [drm_display_helper]
[ 201.787140] vc4_hdmi_audio_prepare+0x4ac/0x570 [vc4]
[ 201.792252] drm_connector_hdmi_audio_prepare+0x24/0x30 [drm_display_helper]
[ 201.799390] hdmi_codec_prepare+0x100/0x160 [snd_soc_hdmi_codec]
[ 201.805471] snd_soc_pcm_dai_prepare+0xd4/0x100 [snd_soc_core]
[ 201.811375] __soc_pcm_prepare+0x60/0x12c [snd_soc_core]
[ 201.816752] soc_pcm_prepare+0x34/0x58 [snd_soc_core]
[ 201.821863] snd_pcm_do_prepare+0x70/0x8c [snd_pcm]
[ 201.826798] snd_pcm_action_nonatomic+0xe4/0x174 [snd_pcm]
[ 201.832350] snd_pcm_prepare+0xc8/0xd8 [snd_pcm]
[ 201.837021] snd_pcm_common_ioctl+0x458/0x614 [snd_pcm]
[ 201.842308] snd_pcm_ioctl+0x30/0x48 [snd_pcm]
[ 201.846802] __arm64_sys_ioctl+0x88/0xd8
[ 201.850769] invoke_syscall+0x48/0xf4
[ 201.854470] el0_svc_common+0x80/0xd8
[ 201.858171] do_el0_svc+0x1c/0x28
[ 201.861520] el0_svc+0x3c/0xb0
[ 201.864605] el0t_64_sync_handler+0x68/0xdc
[ 201.868834] el0t_64_sync+0x198/0x19c
[ 201.872536] ---[ end trace 0000000000000000 ]---
Considering that Packet RAM enable is essentially a power management
configuration, move its enabling/disabling to the Runtime PM hooks.
Note that post_crtc_disable() still stops all infoframes, but keeps Packet
RAM enabled, leaving it to be disabled by runtime suspend.
Link: https://github.com/raspberrypi/linux/issues/7069
Fixes:
|
||
Kees Cook
|
41d1119e2f |
x86/kcfi: Emit the FineIBT paranoid "cs" prefix as a byte
The "cs" prefix on the LEA in the FineIBT paranoid caller template is padding: it places the LEA's 0xf0 immediate byte where it doubles as the LOCK prefix that makes the failing Jcc raise #UD. GNU as warns about it in every CONFIG_FINEIBT=y build: Warning: segment override on `lea' is ineffectual Clang's integrated assembler does not warn, and both assemble the same bytes. Emit the prefix with ".byte 0x2e" to silence GNU as. Build tested ARCH=x86_64 defconfig with CONFIG_CFI=y, with GCC 17.0.0 (experimental, with the kCFI series) and GNU as 2.47, and with Clang 24.0.0git: GNU as no longer warns, and the template assembles to the same bytes as before with both. Under QEMU with cfi=fineibt,paranoid, the paranoid caller check catches LKDTM's CFI_FORWARD_PROTO with both. Assisted-by: LLM Signed-off-by: Kees Cook <kees@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20261012090436.1676525-2-kees@kernel.org |
||
|
Kees Cook
|
4505a262de |
x86/kcfi: Decode the kCFI check from the trap address
Since commit |
||
Pablo Mazzini
|
c5895eadf2 |
pinctrl: sunxi: dt: do not accumulate npins across probe attempts
init_pins_table() adds to npins in the driver's static descriptor, so
after a probe deferral the count doubles and the next probe fails with
"pin 0 already registered". Reset it first.
Signed-off-by: Pablo Mazzini <pmazzini@gmail.com>
Fixes:
|
||
Arnd Bergmann
|
59f522f5a0 |
Microchip AT91 fixes for v7.3
This update includes: - use the correct Kconfig flags for the Microchip KSZ switch -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQTsZ8eserC1pmhwqDmejrg/N2X7/QUCasgArwAKCRCejrg/N2X7 /W8VAP9hLLiVdnALOjkSIAqNqeJauUEdeH6te2Z3wWgo/056JQEAtBJG07U44iD7 jN9rOO5rHArikOUJgyEo7sn+YC4UkAk= =dGAU -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmrMmhAACgkQmmx57+YA GNnjVBAAjKpVCdY+3xzPPj5BRF8OeWrThBPXpQFWC7Or8T+MnQK0g38Oa/Qhdk+t 8owb56uwry7TwxCtITsDQmbBkLCydA2In2lOS6fMfG1hUMdOPeAtFHUYKIE9M2Yz a8aIqGfCjMPZakWQlo9Ti0yQVDyy09UvA1uofgLgTd1mUUip+HkYrGYp1evxn1N+ +6VanhOedksyI4u5tMmmGgStHIbHSgjL90xJtSb3yzjDBifSSmejaztUSHBpVQdB 0IQxnC4b+y0o8KuDNROCe7vBGsGTXog5xqSSxx/AUXCzQlGTM67OQB8oN1TYoafA 771s8SHVnUdSMl3o9Bt+SFJfoSGiwuLrtDVHPsGviJ5SPCp+H2AdHoTsev9rbx7K bC4by5wE66HjJQAPueOgVuJJoWhDnUdcDXwDlIcECBbcyMVSdxNgDKq0z0v7jFTt ofa1jpZky/AM4R7FMIrZ6P6qvo5PMUE+XyGbqR2cbIjlsioj9imUzJ6stAVU9F3x yrTfs/IPqx8MJnnJTyYwXX3u7PVoMbyzVryKfiRZV6/6cQ88dBy1fTBPdDnVuFLA PMFixJ9K+2MCq7Bxf+6gC0E/SEZW0iEFY3iEUxrQay0O/2jxn5Ao5jOIqNn2r2QG JCakJ0tEApOFanHMlx5YrNUrlXngUdoecEP1GRIavC8cerkyuPM= =/imz -----END PGP SIGNATURE----- Merge tag 'at91-fixes-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into arm/fixes Microchip AT91 fixes for v7.3 This update includes: - use the correct Kconfig flags for the Microchip KSZ switch * tag 'at91-fixes-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: ARM: configs: sama5: enable current Microchip KSZ DSA symbols Signed-off-by: Arnd Bergmann <arnd@arndb.de> |
||
|
Arnd Bergmann
|
558c56d4bf |
arm64: tegra: Device tree fixes for v7.3
This contains various fixes for Tegra264. While the PWM and fan patches look like they'd be feature additions, I'd like to get them into stable kernels because without them, these devices either end up with the fan running at full speed or not at all, neither of which are great, but in case of the fan not running at all, it can cause the system to overheat. The remainder are some minor fixes for PCIe, mostly to satisfy the device tree validation. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEiOrDCAFJzPfAjcif3SOs138+s6EFAmrA0E8ACgkQ3SOs138+ s6EZoA//aYGrH6UJvTMak8A/o8mP/Ftb7jK3nEyjOiDRim3QcpMGao2PrLrMykJy U8TsiY0G6+lWDP1M+3v+SRR05KSN37qy3zXR17618yBR8cjf3fV75uwQfUSFzmQM UMiOjRQIn4iIQnc5Ln0zG5osT2uC9BpmabZlnsxZfM6J4xK9gidO0kmUUWjylwa4 bZbX1DwgE8pB0JRNSwExrJTvmFwfNhi+KYMhaM6OE2i2G0KS1MJT3hK6ZUmWNTha ZJtTznJCK+slqCVfizBfY0Jj7C4DCckHZ/F02/uCsSvGvN6Yvi86yXCj1NG+LcBM lop3pjcjPa0yF1BGQgYgyzQgzX6sZvXCMlnxctM+hfWScrC8NwwgHJ7UFFRXAEqm FM6OndcZLACIq7FXmHTio59fxcQsm03gtr780MUFasQjH4K6E7b2+JaWyWxLodwb HZJKMgKN6mrnjSn+vfI+Zg9xnrgkuMa2EBIF16IvfZr0be1/GFFmQEUdWpQ1M0e2 KcxYtV8uem6IrDLUW1phxQZc/lJOnuQwIB2yO8eBSGP/3QUEqvfGof/AkYJDgUew yP+5lrYW6gwp7JqkveAjcbBBygf4DFqc5qV4Pyhsj5Xy/rdvOjFGWVGkg1HM2WYm f/fWEUwDuVyCCu6o285W+Ge7OmXq+e4HscFdBZIIsuDxBbgpVAI= =iIxj -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmrMlsAACgkQmmx57+YA GNn+8w//Q/uvSlFR1iFm8MAkw1AfU8pDiO3ret/ecex+pgDhQqBLVW08XIi6EkTZ 2qoZTAFGRgW+QnOW4qZCBsf46P3uv6IOKaZ4Ip2Xo3rzWHXy+vOeXdLdqBEAKbvi 6uRKcrndZs2qUBSJQ4Gfk/R1w47nJOlpIUqBQ9m8+nqM80d1frDdrVPLqGFwPooJ 9B6Johce0gQfhjQAzZeXR2hG+ouF09VOjIvRU4Qnw0NH5g/vJGUr7GgsOHyYBGGy rZ/psCFVVq0EaNj4GWacm06Fqd45spR7j7r7NciBmyAsRyGSGCxM/85ROPW601Y2 uG4MsNKRklTLDVszPlzxqUKEaVTTGNxbHJznjkhk+ZQ30quH+5slbrjXruzsuJL9 AYFoJeSucUwZkEMFsgAa1Huib995+WKqX48uFaxNUB7iJfSSfC5qX6OpxafYeZgU lwFhUMHngV+DKQBOGmwJhiJtaV2u4RKU3ykrA8AsDLfI9L/Yhuzdw6a3Dhr+4ANH WR8mDGn0ndejwRnZPdHbkErCTIQNhwWvCdarT3IDLNuk9x9V6ktKufHUIYPFGfPo jmF4XOEm/v7gDHPEpseWlwXMrxzyZ0pzGqZWzDSGU8NrxN8BSyT6f8pli06EzgFz F/TOoJVsCaUHJ+/e84zUYttbWffMVEnoqZboYzDemkds6O6977E= =cwei -----END PGP SIGNATURE----- Merge tag 'tegra-for-7.3-arm64-dt-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into arm/fixes arm64: tegra: Device tree fixes for v7.3 This contains various fixes for Tegra264. While the PWM and fan patches look like they'd be feature additions, I'd like to get them into stable kernels because without them, these devices either end up with the fan running at full speed or not at all, neither of which are great, but in case of the fan not running at all, it can cause the system to overheat. The remainder are some minor fixes for PCIe, mostly to satisfy the device tree validation. * tag 'tegra-for-7.3-arm64-dt-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: arm64: tegra: Add PCIe root ports on Tegra264 arm64: tegra: Reorder reg and reg-names to match bindings arm64: tegra: Add PWM fan on Jetson AGX Thor DevKit arm64: tegra: Add PWM controllers on Tegra264 Signed-off-by: Arnd Bergmann <arnd@arndb.de> |
||
|
Arnd Bergmann
|
182d918a68 |
ARM: dts: OMAP fixes for v7.3-rc
- ti/omap: dra7: fix PCIe PHY clock divider definition -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEe4dGDhaSf6n1v/EMWTcYmtP7xmUFAmq6pFgACgkQWTcYmtP7 xmUYBw/+KSPwiHM/bQBVXfFtezIxsrJ1Iwhy1BABChGJRsaSBPeF9GNCpKMMK5Gx XvT1G2+tMczNVsinzWoOFwnpl3O/X6CMl8eG4OoCUbk78OSWVkxx9HHH4RlVo7jp zCNhIdCatNX5x0l3LT3S8e5Y5NUR7r771lnKJP9Ky4Roucp1PbjpnNaRpEO3pLrI 9/p4D5JII0t2sY8X+K8KRgcd/N/J2jQ2lJCZsIItSXbRTKKML7ApFpWFDEYKAE2o 9cB6NCDIyf+zR3t09Ubdprco5xE3pVTRuZ8LNKF5eYxMvNMBpfnuxSHALef7I4wX lxDklP06uvKEGhstgbzETt+L0XGJ7aTchx5Fjx1HdlhHGn1CI1RbFolhDHulCSz+ aMzcCDzaZ6lLaspTLNKNRpI8gLi5v41/FjvbjhRXQngl3Wh+ZYzrkLD9CTEyRZh+ VQNcA2nu4J12YtXaYkjo4k305X1ttWTN7fxSHjpeJTLBPZiMUFwum7WT2LL9JWNi ebq8D5qnUEtK/dWzh6OWSfYbdmMwlXD576X6bikve0vSdlQExbBgaQtUw5T+Xgua m3k+OkFX2MxdkzP5BVbt5+WqpgB6iWtISFzIlK87nJth4CK0B7Njl9ZmdiWUQwus Z7kWNV6IAAwNtOYZacHIsMpiTX0uRsW2WpS8HwvaHphUBfcW5zg= =yBBF -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmrMi2QACgkQmmx57+YA GNlboRAAhbm4bM8M7UhlwU5b20kwPjNBFW1yMTyvcFYyIqdawHs9yUQ5lSD9XvK9 OOCfA4mPNlkosxpNGQy4ci4MI05z7Y13dN3exJE7T8OKTdNYtqdy7JWHgIs194xE SA044nDKhphp5/wfehFlGhP9/wzMeOoKErZG4dFA5+Fw7xtje6w1zFWmrtQsA5Pn s81NGNgO0QRmkI+C4c2Y87aVi9xoGoidYwj0GXZG5QJi+OKjV/WBY/6EJ593pUGg cPByAwV46ucOEscaFDwMpzmidU3pVKda7yGrajGriSLyRVx5yIbFpxay+x3neJ1Q qVyrwBx0vT3YjEDNRr7z/6QGMWTM9kHsOFhnALbIO1SBOob7drzExN8+73nAdDFN v8vrjxXAkXLjvdPIr8WMZhsqbsZvCipkYnsAVsaJXpGJOIaeZ4HRx8a5UmVjix1i m2vrKBW/cZuw7359BGpNzgGTMIftQgRGfThYN4cLUKExeG4rF645SeoPbc3sS9yv lJDAVpPZ6w2aIBJ7Gm5KlGIUtFxGpnKavkOdSr7JSU77dfrJ458EwDvT+PToG5Gp mGJKpLtJZVvdDG8p5ah06gAFrwoawrCw+6hlQlaJFR62XemVI/dIKap3JKGZyUgB vsNQMPTuuQCIrQGGb6VjZW2YjFYrV5gI2nvnEWszMurD64Wl1Bs= =2WyM -----END PGP SIGNATURE----- Merge tag 'omap-for-v7.3/fixes-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap into arm/fixes ARM: dts: OMAP fixes for v7.3-rc - ti/omap: dra7: fix PCIe PHY clock divider definition * tag 'omap-for-v7.3/fixes-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap: ARM: dts: ti/omap: dra7: fix PCIe PHY clock divider definition Signed-off-by: Arnd Bergmann <arnd@arndb.de> |
||
|
Arnd Bergmann
|
2f46e80fa9 |
RISC-V devicetrees fixes for v7.3-rc
Microchip: Remove double definition of interrupts on the BeagleV-Fire, which cause the sensor to be associated the wrong plic interrupt. Signed-off-by: Conor Dooley <conor.dooley@microchip.com> -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRh246EGq/8RLhDjO14tDGHoIJi0gUCaranWQAKCRB4tDGHoIJi 0s31AP4hv9Vv6RhMscNC9uyNsiwDvXMhg/Xx1JQY6kAJiRUaSAEA1zPUblcy1D/w QiJp5LLikCsP/xlF10TnyQFJMrK62g4= =S04/ -----END PGP SIGNATURE----- Merge tag 'riscv-dt-fixes-for-v7.3-rc' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into arm/fixes RISC-V devicetrees fixes for v7.3-rc Microchip: Remove double definition of interrupts on the BeagleV-Fire, which cause the sensor to be associated the wrong plic interrupt. Signed-off-by: Conor Dooley <conor.dooley@microchip.com> * tag 'riscv-dt-fixes-for-v7.3-rc' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux: riscv: dts: microchip: beaglev-fire: remove double definition of gpio interrupts |
||
|
Arnd Bergmann
|
d610d871b1 |
soc/tegra: Fixes for v7.3
This contains two minor fixes for a missing newline in an error message and an uninitialized clock rate used during suspend. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEiOrDCAFJzPfAjcif3SOs138+s6EFAmrAz58ACgkQ3SOs138+ s6FQnBAAqGcuCCWwfEb78osasuda9JsHtvj44rO6Iq8lwUxZO5fP9D1/VgIjzrOa LBCEyP93UfJiyeJ/2doLynW+g9zsStfCnJ41tnzZGrbLIZ7hKX+xl0+rM4HTgnRY v2LSNiblLtuOTJ94x0gEMU5s+R89ws5a/wjVuEAuxq4Udz25xxVhF6+oun+WAyo0 q1F7Q/7e8FRS5e/aqfEurC255FKkULrRO9J7oHc/108bdE3hMhYI8qBkaFMCb8y/ ovjCRP7PR+FCElXNsHE8RC54P4EGeE2wHkNGil7gPMh/roHvtyqyaajddNrznjun hDELz0HAOHLtI8SV2vXjsyiTROK9jpKwc/s1qrosg74t20bWcdVQ9VA/syjEAb9Y SoueqRJaiJk59s9L1stGaWxP7O0Y9ocu9IBn3kDbyzLxtxT29/ZnDP1WCPrgcQ4A LKFysA5EYZUMo1EUqh/F/aHygT6clEPG6fP9Tm3HVQRuRYbeozF9ogDEL4iEJccf 5Z9hIlXfdHpzCKywwXzg3RFhCtzpoJ45sNHb+ts6BSk4+/yhL3Bulk7aDpaidV2b FQ//RgqtGCHRJoFu61wa+auDib3YmdfL1PJk2U3yGlRRwjUm7kSeD/4RwqtOGuCD QnJ/cj4wkWelU17OJDyHuGyK2SUEIb/Vc3eYVRG6Ie9grYmJalY= =+gD/ -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmrMiYkACgkQmmx57+YA GNmmsRAAw8fAgrUeZwz368Vds64A7vmNg3pw2+rwKeWs/4o7XqlPyH8HKqKGsqwz Nc/tmkVLMcO0Dlyc79WP0/WptNZ9m15voSWhDP7uDTaW1ZrAqE/b3jboNfFv1o4Q HWw13McAqYePe3H3rk+j7jFYMlHMdIvH1QudXrJXXg0asESv+gqOalk+aOPNk3cL oz1XpJzU2IhUJWLv8oBVLdA7l204PpF55sA8mcmLaTJRwheOHvhYB+jgDqmIjp4l cATI3LnALGeZlZ6XtsnIzhST7hlAjuUStLTQRF0m3gnNRuZaKZBUEm3ZOHmcj2ax lId9rcICPQfRelr527L+3eIbn2DQ8lGJoNiV/Mo6WgCWK/2y6Exd14NVpqZOSfNf mDcUN9lQ4eyO0b24X0BEluJXqamQcJ7GaZLxhOPrAcR42VZETUpn1Xq2kC4azJyd aBOVCf/eRwttSZzbAMxHmck6IDWK0kqpt6Jw+jDxT7MwZxvs6MzTLq6K6fKStByU DMA2kRc7L3dYEPnIBETYkb217sNbVqdzerWFEMLL7ieeWLVktv3FSJS4/oaPVCoI eHIBdxlC/el5kShLDQyA30a7fjftpDsvHl9DKcH9EGjzVGWiy9BLfJv1rzvaGgOo 5rOe8PLjLNR6X61Stn7VdRwNXb4OV8Fjjdupy+EEkktqzam/D6k= =3JiU -----END PGP SIGNATURE----- Merge tag 'tegra-for-7.3-soc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into arm/fixes soc/tegra: Fixes for v7.3 This contains two minor fixes for a missing newline in an error message and an uninitialized clock rate used during suspend. * tag 'tegra-for-7.3-soc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: soc/tegra: pmc: Fix uninitialised clock rate soc/tegra: fuse: Add missing newline to APBMISC error message Signed-off-by: Arnd Bergmann <arnd@arndb.de> |
||
|
Sasha Levin
|
a1ddc27214 |
bootconfig: give the footer size static_assert a message
static_assert() without a message is a C23 feature, so clang warns:
main.c:498:56: warning: '_Static_assert' with no message is a C23 extension [-Wc23-extensions]
Add a message.
Link: http://lkml.kernel.org/r/20261011223358.2327625-13-sashal@kernel.org
Fixes:
|
||
Linus Torvalds
|
24a19b953e | Linux 7.3-rc7 v7.3-rc7 | ||
Dmitry Osipenko
|
e415915c52 |
Revert "drm/virtio: Add pixel blend mode property to cursor plane"
The cursor blending mode was added twice because the same change was
applied by accident from different patches. Revert the second patch.
Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
Link: https://lore.kernel.org/dri-devel/ce84d3d2-e78b-4939-aecf-9ef7267bd42a@samsung.com/
Fixes:
|
||
|
Linus Torvalds
|
d6d3455d87 |
Landlock fix for v7.3-rc7
-----BEGIN PGP SIGNATURE----- iIYEABYKAC4WIQSVyBthFV4iTW/VU1/l49DojIL20gUCasuxWRAcbWljQGRpZ2lr b2QubmV0AAoJEOXj0OiMgvbSHaEA/2qsakLl6MYmTQ5+c4MAdtPcJXttnQJoAWJl t5OrpCQEAP9A/DSj46Ci2ocnfbfvhtfHgzX5CQMef8nxUillfVYnBw== =G4p3 -----END PGP SIGNATURE----- Merge tag 'landlock-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux Pull Landlock fix from Mickaël Salaün: "This fixes a Clang bug by removing an annotation, which was introduced mostly for documentation" * tag 'landlock-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: landlock: Drop __counted_by from landlock_domain.handled_masks |
||
|
Linus Torvalds
|
f479598167 |
spi: Fixes for v7.3
A small collection of driver specific fixes, plus a new device ID in the DesignWare device tree binding. One of the sg2044 fixes which enforces clock limits properly is more critical than average since getting them wrong might lead to data corruption. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQReagvpf3TrrA7BoYYv73Ows9A4iQUCasrOmAAKCRAv73Ows9A4 iVT3AP9OD2ppR1G68eZZH3qB1Q9jhHAWREihWUqZZ+Y3I+hiVQEA8O0uTgTFveMw usHV1vv81Ca4EPAEmAKbrhBAH3oAMgY= =ibsk -----END PGP SIGNATURE----- Merge tag 'spi-fix-v7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A small collection of driver specific fixes, plus a new device ID in the DesignWare device tree binding. One of the sg2044 fixes which enforces clock limits properly is more critical than average since getting them wrong might lead to data corruption" * tag 'spi-fix-v7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: dt-bindings: snps,dw-apb-ssi: Add Synaptics sl2610 spi spi: sg2044-nor: Honor SPI clock limits spi: sg2044-nor: Return transfer errors spi: cadence-qspi: Fix status polling with octal DTR chips spi: spi-nxp-fspi: exit stop mode before waiting for DLL lock |
||
|
Linus Torvalds
|
5906f156e8 |
regulator: Fixes for v7.3
There's a couple of core fixes here, there were a couple of issues with of_regulator_bulk_get_all() not behaving consistently with the other bulk regulator APIs which caused memory leaks and error handling issues in users. We also have a of fairly standard driver specific fixes. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQReagvpf3TrrA7BoYYv73Ows9A4iQUCasrJ0QAKCRAv73Ows9A4 iSA9AP9lETVKHzhDIU+QiXmXh5mDVXTrpA0JXC6HL7fMUAgS6QEA4REJaKEbp9pU lvMfR/lTS88EbrtKF+ZuDM+EkIa+qQc= =xELe -----END PGP SIGNATURE----- Merge tag 'regulator-fix-v7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "There's a couple of core fixes here: there were a couple of issues with of_regulator_bulk_get_all() not behaving consistently with the other bulk regulator APIs which caused memory leaks and error handling issues in users. We also have a couple of fairly standard driver specific fixes" * tag 'regulator-fix-v7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: ltc3676: don't read the write-only HRST and CLIRQ registers regulator: of: state who owns the array from of_regulator_bulk_get_all() regulator: of: fill in supply names in of_regulator_bulk_get_all() regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4 |
||
|
Linus Torvalds
|
d5b6dc381d |
SCSI fixes on 20261011
Driver (and tape media changer) only fixes. Three of the fixes are about the same size, (ch, ufs decouble CQ and ufs avoid unsafe MMIO) but the unsafe MMIO is the least obvious logic change. -----BEGIN PGP SIGNATURE----- iLgEABMIAGAWIQTnYEDbdso9F2cI+arnQslM7pishQUCasspJRsUgAAAAAAEAA5t YW51MiwyLjUrMS4xMiwyLDImHGphbWVzLmJvdHRvbWxleUBoYW5zZW5wYXJ0bmVy c2hpcC5jb20ACgkQ50LJTO6YrIUL5gD+Lwi6HVanx/zkn6Qy+9N0Kx0IZTsamTpM Aug3Rx74YWYA/ii94bbXr0xrdohBAdPO1MppOQGfmcTqdHAIP/7lxWzn =EeOd -----END PGP SIGNATURE----- Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Driver (and tape media changer) only fixes. Three of the fixes are about the same size, (ch, ufs decouble CQ and ufs avoid unsafe MMIO) but the unsafe MMIO is the least obvious logic change" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: core: Decouple CQ sweep from request iterator in MCQ scsi: ufs: core: Avoid unsafe MMIO reads in ufshcd_mcq_compl_all_cqes_lock() scsi: ch: Do not keep references to data transfer element devices scsi: ufs: mediatek: Handle mPHY power-on failures scsi: qedi: Initialize callback state before registration scsi: ufs: core: Hold a clock reference across the probe |
||
|
Linus Torvalds
|
4375b45d70 |
block-7.3-20261010
-----BEGIN PGP SIGNATURE-----
iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmrLiicQHGF4Ym9lQGtl
cm5lbC5kawAKCRD301j7KXHgpvOmD/452m7OeggU07h2q1wqdiw2lh5zIvXcjQIF
ih4nl5lezismqbenazF6IqSsz5YAq5SM0EroNEXrQnr2UzndjyXyVN3fPdQVA+7R
8Hg3rlU31XzGW+WZknGx25RfaIGovNbJUFhPMuYpY41raOSevwIhx2X3k5UZUAWd
4id28sXJTMk097XdQnfqNcaXcu3FDHx9ZcOKlSyRWaZD36vY4XPFwrFESyMzyWWJ
PhfwTBG6/MxxzOS0QdCzkSpA1L1Ipj48LO87X/RMX8NnrXw5Gar6+1NhVykfocdb
acKxUaAw5VF72Uinrrm+f7tMIAmsoFzwJR+VXJJxYNQMB2GLBL69BOsz9Qmr6qaA
71GQ52wfGh8fajeUH5C+pTDab4zZwY9X+ugGoocXaK/f43vxLARYLevC/MEionD/
HbZazH79Ock4dLolMBKgDXhrLUZbk/d0TiJpJezaaO+v09KlWDyhf+uzFOKkfdUL
YUsXGkQT+cp1ymN2M7Stiey+b2EMPhU8NjL/Sb52o3gllxeP8tUfXfGimxIWH1k3
fhzqYHpZNROCB8wzqeawqkZzJPpe7Xj5H5FRDf6fiqWZ+BelD1Je+mq1Ck53XLKr
tmDnmFwl7B+FrX519u4BqObW95PKC/0JsrmW5BeW+mHjbIHnOCTVsZiEoW+Q+Q57
3twF8ITLUA==
=jxPV
-----END PGP SIGNATURE-----
Merge tag 'block-7.3-20261010' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull block fixes from Jens Axboe:
- NVMe fixes via Keith:
- Fix swapped ZRASF zone state values for full and read only
- nvme-multipath revalidate head zones after unfreezing the head
queue
- Revert "nvme: do not reset controllers in NVME_CTRL_NEW state",
which broke things
- nvmet fixes for invalid NSIDs on feature 82h and using the local
P2P device on metadata allocation failure
- zloop: zero out only the unread tail of a short read
* tag 'block-7.3-20261010' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
Revert "nvme: do not reset controllers in NVME_CTRL_NEW state"
zloop: zero out only the unread tail of short reads
nvmet: use the local P2P device on metadata allocation failure
nvme-multipath: revalidate head zones after unfreezing the head queue
nvme: fix swapped ZRASF zone state values for full and read only
nvmet: return Invalid Field for invalid NSIDs feature 82h
|
||
Nguyen Ngoc Thang
|
3d8cc52db2 |
landlock: Drop __counted_by from landlock_domain.handled_masks
With clang 22 and CONFIG_FORTIFY_SOURCE, the second
landlock_restrict_self() call hits a bogus fortify report in
inherit_ruleset():
memcpy: detected buffer overflow: 4 byte write of buffer size 0
Call Trace:
__fortify_panic
landlock_merge_ruleset
__se_sys_landlock_restrict_self
handled_masks[] lives in an anonymous struct inside the anonymous union
that overlays work_free. For such a flexible array, clang computes the
address of the __counted_by counter as the start of the array instead of
&num_layers. The bound is then read from handled_masks[0], i.e. from
the first layer's access masks, which is not a count. The same layout
crashes clang itself in a standalone test.
The annotation was added as documentation, so drop it rather than
restructure the union. Keep the information in the member comment.
Reported-by: syzbot+a0eecb22de4d821a9e5d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a0eecb22de4d821a9e5d
Fixes:
|
||
|
Linus Torvalds
|
b7c0316c1a |
io_uring-7.3-20261010
-----BEGIN PGP SIGNATURE----- iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmrLihgQHGF4Ym9lQGtl cm5lbC5kawAKCRD301j7KXHgpqHYD/0WmtUynMfrRLjrod20cJV39pzOSBLVgAgu 9q4y6/o5UP6AFlenvvejA09AzAW14TpIx1xw+wz9W7kOIEfBFdYr+8ZlLdJCVY7+ COMDryOgoSZqd77CTUZ54V7d+z4dEOEYtkfpDBxq/0bbUrZpDB3UGHcQm1GBAj7y FGPIAqmjJ6BH5ymNlCwjmBhgkSSsscKtlJXHUgpDNrwPwndmcg38on3QWmNJP97u tnOO2j8Xy5TYDoGJ8liK37y56YKtR+vYiIRd1rlCvdtvtmaMBKkj3NNFMUGMEC25 1qapshKstL+20ZUmXTITGMxOfsrsZSj3nT93BV3W8jt/POMbhzX5W7zO8fS3gDKW 9XNYQXL2zMfp6iF3zIU3nsdcggK/T1uBtDXQureM8zl8QQa7XgJOCW8b8eNJZAo2 /W7Hz5TKshnrkXGEIvKWCb/UcrijHMLbtQ+eGcj/TeteMvO69bl+fQn0tzlOud0t lqMmFsuZMa6mkYn2XV86Ie2tf0AOS5LSGKsWwvkmAg5Pkz1l5qIDTyuLFEDfWQpg N3uLC/uo4+ap1s3ccUX6Pb8feZ1GVtjS7Wsqe04DFxFCESllbYiwkUMAGPFST7l8 SFZuafe/eJbW/MFnB/AKk5jBWMcwXP+usBWq/0w1/ETA4DhWXLQQnIefI1FoZpZa OjOfFuKDYA== =GaD2 -----END PGP SIGNATURE----- Merge tag 'io_uring-7.3-20261010' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring fixes from Jens Axboe: - Don't spin on local work the exiting task can't run. For a ring still R_DISABLED when the task got its tctx node, the submitter is set later and may be another task, so DEFER_TASKRUN local work stays pending forever and the exiting task spins in do_exit(). - Don't charge the SQ/CQ rings or provided buffer rings to RLIMIT_MEMLOCK. The region API conversion started charging them, which the rings had been exempt from. - Don't exempt disabled rings from task restrictions on register - Populate the CONNECT filter fields for a 24-byte sockaddr_in6 * tag 'io_uring-7.3-20261010' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: io_uring/cancel: don't spin on local work the task can't run io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6 io_uring/register: don't exempt disabled rings from task restrictions io_uring/kbuf: don't charge provided buffer rings to RLIMIT_MEMLOCK io_uring: do not charge the SQ/CQ rings to RLIMIT_MEMLOCK |
||
|
Linus Torvalds
|
5f97a3ec36 |
xfs: fixes for 7.3-rc7
Signed-off-by: Carlos Maiolino <cem@kernel.org> -----BEGIN PGP SIGNATURE----- iJUEABMJAB0WIQSmtYVZ/MfVMGUq1GNcsMJ8RxYuYwUCassr8wAKCRBcsMJ8RxYu Y0zlAYDt4ReluNicsRWxFKTeSU9GSJ3asMlyV24nBxOxj6ggzpMkJpU76aVDFCaq NDn13vEBgMVppi1VVMez8tYOOL390yfzlWnpq38mPaMnv4cXDQGZUvETcL1n+4U+ xVf/7NasOQ== =X+Ty -----END PGP SIGNATURE----- Merge tag 'xfs-fixes-7.3-rc7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Carlos Maiolino: "This fixes a data corruption vector where a user could trick the exchange-range feature to add shared blocks beyond the file's EOF, which may then be used to modify data on another file" * tag 'xfs-fixes-7.3-rc7' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: fix exchange-range-to-eof file size exchange xfs: stop exchanging reflink flags when exchanging mappings |
||
|
Linus Torvalds
|
4d61397c86 |
x86 fix:
- Work around AMD TLBI Erratum #1718 (Borislav Petkov) Signed-off-by: Ingo Molnar <mingo@kernel.org> -----BEGIN PGP SIGNATURE----- iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrLN7QRHG1pbmdvQGtl cm5lbC5vcmcACgkQEnMQ0APhK1hFohAAqJHoyW96qIFMKak6sY63CaJ3lDfFmaB2 8aZW8oKhmjTCECHH/Ff7wDxIL733CsdaxynnJ9YxAmujpsAmaO6Tk8PxuGaVPJsJ pTW8w4ViVJdnsaNzCQpbm8iB3Q5anmiqwgSd/2C8mmEZVF04ZtzmMKyGeGG99GPH p7AzpQKkh0UAjIGCV0i1KXQzboHXld4APJGcoiQIAmNBzdHjJBVrJA+vsUzdcLOf nufTe01afNa2ehlB2cwy0eOn9/+cnZsF4jObFBvmXYjD1rucYSRvUCWOFTMNt5vP Sj57hhhU5ozSHkZVz9I2l6W+7txk9qhLXPA3cFs3FDFjhXFqUo/mmRn/oQxwGzCR fsMq5ImTWTzdTuTzlhWFbNLUJOc0OFWMidyVb2eul9kipz451KFVssuTEWwpV3Mb fEfjPZnnuEAz+0kVckuLGEsROQFst0VDv53BVUSfmunIGZFtyWH1rIpEn4AeIYUC vT66l/pPYqF1tJcX2OB2tHgY2Qw2OCfQPloYrchLTsE2us+fpwZIp8du2yqjasGK 75V0AGDFV2xNkt+x76HZ0bKaFihfg3M7e0NZbon1BF3d4w/Z0HZ/JVaUEBglKTnz QdLD6Y8nKroaTazHfwCwR8JUPesFOuxAqIlZdEXWt2/adfgs7HaTjwu14nD5rrbQ eQhaUR6PyUE= =x9f4 -----END PGP SIGNATURE----- Merge tag 'x86-urgent-2026-10-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Ingo Molnar: - Work around AMD TLBI Erratum #1718 (Borislav Petkov) * tag 'x86-urgent-2026-10-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/CPU/AMD: Fix AMD TLBI Erratum #1718 |
||
|
Linus Torvalds
|
b2d929a1c2 |
RISC-V updates for v7.3-rc7
- Fix a regression in the Zbb-enabled strnlen() implementation when
huge counts are specified
- When userspace pointer masking is enabled, strip the tag from
user-specified pointers in two spots in the RISC-V futex code where
this was missing
- When CONFIG_SHADOW_CALL_STACK=y, use a supervisor mode-only CSR bit
to determine whether the trap came from userspace or not, rather
than a userspace-writable register
- Reset the HSTATUS.HU bit during CPU initialization to avoid
unexpected behavior, as the RISC-V specification does not require
this bit to be hardware-reset
- Fix the T-Head GhostWrite probing code when !CONFIG_ERRATA_THEAD_MAE
- Fix RV32 boots using 32-bit.config by constraining NR_CPUS
- Implement a workaround for SiFive MAL-9092, which requires fences
around hypervisor load/store instructions
- Fix the RISC-V patch_map() code to work properly for EXECMEM
addresses when !CONFIG_STRICT_MODULE_RWX
- Fix ptrace register set access reporting when CFI landing pad or
shadow stack support is enabled
- Avoid copying garbage into the target's vstate when PTRACE_SETREGSET
is called with a short iov_len
- Fix load_unaligned_zeropad() on RV32 kernels with
CONFIG_RISCV_EFFICIENT_UNALIGNED_ACCESS=y
- Fix build breakage for any userspace program that includes
uapi/asm/vendor/mips.h
- Fix a build warning for 32-bit allmodconfig builds related to SiFive
errata
- Fix misspecified inline assembly constraints in the vector context
save/restore code
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEElRDoIDdEz9/svf2Kx4+xDQu9KksFAmrLCxIACgkQx4+xDQu9
Kkv0uRAAmTamkNXZpPx0WF9/i48d+40TS7U45u+w0wKbNxgRR+R4jNHOGr91bNQn
82pOG7c8AQbDJv0bed9EgdYQCQR58VC+GXLcCdV9ZvINs9ffIpyoYlD0kL5YXjSv
0kEM6ZCFn3+tLLko8e3UuBGZwnwN2VeyBae1TOutJx/jjTU6R2vrZHAsNd4ol3PB
CcZX533cbNDY4NKZHzniPXdWPdzWK42I5+HwNayf3BFUEsnN/JUZwHI0sTt3wgZo
DpOTRm/C883VelF8NnpPl0cAEux/0KfTP0GPsnPFOvuvIDA/Hn/PfRhweyjCRZ1r
LYWYLpvpbkCOPvyzFL0eKzl1DOgz8KtqdqOA/qUUooxog1egJ9uBynXrh0We4IV1
EbxRjKDiJ7QJJsX8m0xpWtMFYU0hQ3MHxePAxeSVdA5mHksEhWxvudWScwm2Cpt7
9Vq01WmyV3uBMlq7Cd9KJxyNGOTikpciMnUIR4h0WaHZxuevAfgXhs2dVRS2u/Be
a2CztPGV931/1BGLP+wV6I6BXqet+4Q86VDo1Dcj7u6Zr0NyjmJYfz64cmNrSVWZ
CDm9wvxhEedD+9fNvP4fx8B+8nRNZDpWtpevkFy5iDHkd9xeauKax9njrH/gw2S4
lIZZ1+5D14c/d6s0OJIwrMe+xcYu3cZ6qVCEmQXuO3jTHiXky4I=
=ZFs2
-----END PGP SIGNATURE-----
Merge tag 'riscv-for-linus-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux
Pull RISC-V fixes from Paul Walmsley:
"Several security fixes, a significant strnlen() regression fix, and
several other miscellaneous fixes:
- Fix a regression in the Zbb-enabled strnlen() implementation when
huge counts are specified
- When userspace pointer masking is enabled, strip the tag from
user-specified pointers in two spots in the RISC-V futex code where
this was missing
- When CONFIG_SHADOW_CALL_STACK=y, use a supervisor mode-only CSR bit
to determine whether the trap came from userspace or not, rather
than a userspace-writable register
- Reset the HSTATUS.HU bit during CPU initialization to avoid
unexpected behavior, as the RISC-V specification does not require
this bit to be hardware-reset
- Fix the T-Head GhostWrite probing code when
!CONFIG_ERRATA_THEAD_MAE
- Fix RV32 boots using 32-bit.config by constraining NR_CPUS
- Implement a workaround for SiFive MAL-9092, which requires fences
around hypervisor load/store instructions
- Fix the RISC-V patch_map() code to work properly for EXECMEM
addresses when !CONFIG_STRICT_MODULE_RWX
- Fix ptrace register set access reporting when CFI landing pad or
shadow stack support is enabled
- Avoid copying garbage into the target's vstate when
PTRACE_SETREGSET is called with a short iov_len
- Fix load_unaligned_zeropad() on RV32 kernels with
CONFIG_RISCV_EFFICIENT_UNALIGNED_ACCESS=y
- Fix build breakage for any userspace program that includes
uapi/asm/vendor/mips.h
- Fix a build warning for 32-bit allmodconfig builds related to
SiFive errata
- Fix misspecified inline assembly constraints in the vector context
save/restore code"
* tag 'riscv-for-linus-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
riscv: fix load_unaligned_zeropad() fixup for RV32
riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp
riscv: ptrace: Zero-initialize regset buffers before copyin
riscv: ptrace: reject CFI regset access when extensions are absent
riscv: fix NR_CPUS range leaking 64-bit default onto 32-bit builds
riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE
riscv: futex: untag the user pointer before the atomic access
riscv: lib: Fix ZBB strnlen wrap-around regression on huge counts
riscv: patch: fix handling of bpf-jit execmem addresses
RISC-V: Clear HSTATUS.HU on CPU initialization
RISC-V: errata: Add SiFive MAL-9092 workaround
riscv: vector: Fix output operands in context save
riscv: vector: Fix data pointer constraints in context save/restore
riscv: limit sifive errata to CONFIG_64BIT
riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi header
|
||
|
Linus Torvalds
|
b88c841d11 |
Input updates for v7.3-rc6
- A fix for the ati_remote2 sysfs attributes handling, resolving type confusion after conversion to dev_groups - Updates to the xpad joystick driver adding support for the Corsair Novablade Pro controller (wired and 2.4 GHz wireless) and a newer hardware revision of the 8BitDo Pro 2 Wired Controller for Xbox. -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQST2eWILY88ieB2DOtAj56VGEWXnAUCasr21QAKCRBAj56VGEWX nBWuAQCBO6dsRJKdKICBgjj55mb8P9yOmtAXUDaSWnMONbcWJAEA3l0SJ8GnL0jh 4hLh6aCf4tTjIrB/cyKx47dSvj5YxQg= =3bCc -----END PGP SIGNATURE----- Merge tag 'input-for-v7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - A fix for the ati_remote2 sysfs attributes handling, resolving type confusion after conversion to dev_groups - Updates to the xpad joystick driver adding support for the Corsair Novablade Pro controller (wired and 2.4 GHz wireless) and a newer hardware revision of the 8BitDo Pro 2 Wired Controller for Xbox. * tag 'input-for-v7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: xpad - add support for 8BitDo Pro 2 Wired Controller for Xbox Input: xpad - add support for Corsair Novablade Pro Input: ati_remote2 - fix type confusion in device attribute handlers |
||
Darrick J. Wong
|
7dfb218c82 |
xfs: fix exchange-range-to-eof file size exchange
Norbert Szetei posted a patch containing an incomplete description of a
bug in XFS_IOC_EXCHANGE_RANGE's TO_EOF flag. The bug tricks
exchange-range into modifying a file so that it has shared blocks
starting beyond EOF, which is never allowed because files never have
written data beyond EOF, and you can only share written data blocks.
This is key to all the incorrect behavior that follows.
Eventually I got from Norbert a description of what's going wrong:
> Fair. Here it is with physical block numbers, 4k blocks. peer is the file
> that gets rewritten and file1 is the one that ends up with the flag
> cleared.
>
> Start, nothing shared:
>
> peer size 4096 -> [100]
> file1 size 12288 -> [200] [201] [202]
> donor1 size 4096 -> [300]
> donor2 size 4096 -> [400]
>
> 1. FICLONERANGE peer's block into file1's middle slot:
>
> peer size 4096 -> [100]
> file1 size 12288 -> [200] [100] [202] reflink flag set
> ^^^^^ both files own block 100
>
> 2. XFS_IOC_EXCHANGE_RANGE file1 against donor1, file1_offset 0,
> file2_offset 8192, length 0, TO_EOF. One block is exchanged, and the sizes
> are exchanged with it:
>
> file1 size 4096 -> [200] [100] [300] reflink flag set
> ^^^^^^^^^^^ still owned, now past the size
> donor1 size 12288 -> [202]
>
> file1 says it is one block long while it still owns three. Nothing was
> unmapped. file2_offset is block 2, so this exchange cannot clear a flag.
>
> 3. XFS_IOC_EXCHANGE_RANGE file1 against donor2, both offsets 0, length 4096.
> By i_disk_size this is two one-block files exchanging everything, so
> xmi_can_exchange_reflink_flags() agrees and the flag is cleared:
>
> file1 size 4096 -> [400] [100] [300] reflink flag CLEARED
> donor2 size 4096 -> [200]
>
> Block 100 is still shared with peer.
>
> 4. pwrite(file1, 4096, 4096), which is file1's second slot, block 100.
> xfs_is_cow_inode(file1) is false, so no CoW:
>
> peer size 4096 -> [100] same block, new contents
>
> Block 100 is the only one that matters here. PoC below, it reads a file
> called peer in the current directory. The filesystem needs reflink and
> exchange-range, which mkfs.xfs 7.x turns on by default.
So yes, TO_EOF is screwing up the file size even if it's actually
exchanging the data block correctly. The following is the intended
behavior of XFS_EXCHANGE_RANGE_TO_EOF, as described by its manpage:
"Ignore the length parameter. All bytes in file1_fd from file1_offset
to EOF are moved to file2_fd, and file2's size is set to
(file2_offset+(file1_length-file1_offset)). Meanwhile, all bytes in
file2 from file2_offset to EOF are moved to file1 and file1's size is
set to (file1_offset+(file2_length-file2_offset))."
In other words, if we only exchange a portion of the file data, then we
should only exchange the portion of the file size that relates to the
exchanged data. Unfortunately, the code swaps the ondisk file size and
the incore file sizes, which is incorrect if the caller passes in a
nonzero offset.
Having confused the file sizes, the PoC uses a second exchange-range
call on what looks like a non-reflinked single-block file. Because the
file size is set incorrectly, exchange-range thinks it's exchanging the
full contents of two files and clears the reflink flag on the broken
file. That enables an extending write of the broken file to rewrite the
shared block that's just past EOF. This has become known colloquially
as refluxfs.
Once the file sizes are set correctly, the second exchange-range no
longer thinks that it's doing a full-contents swap, so it won't clear
the reflink flag on either of its file arguments.
Norbert followed up to an earlier version of this patch with a second
complaint about us not handling the i_disk_size state correctly:
> The offsets are bounded against the incore i_size but subtracted from
> the ondisk i_disk_size, so a file that has not been written back gives
> xmi_isize1 = 0 + (0 - 12288).
>
> For instance, you can do:
>
> $ xfs_io -f -c "pwrite -q 0 4096" -c fsync file1
> $ xfs_io -f -c "pwrite -q 0 12288" \
> -c "exchangerange -s 0 -d 12288 file1" dirty
> $ stat -c %s file1
> 0
> $ stat -c %i file1
> 131
> $ sudo xfs_io -r -c "bulkstat_single 131" . | grep bs_size
> bs_size = 18446744073709539328
That's wrong, and the new file size update logic depends on the ondisk
i_disk_size matching the incore i_size, so flush the pagecache as needed
to push it upwards.
Link: https://lore.kernel.org/linux-xfs/1E196589-DEBE-40AC-AFEA-D420DAAB067F@doyensec.com/
Reported-by: Norbert Szetei <norbert@doyensec.com>
Cc: stable@vger.kernel.org # v6.10
Fixes:
|
||
Norbert Szetei
|
d84d6c1a7f |
xfs: stop exchanging reflink flags when exchanging mappings
When an exchange covers both files from offset 0 to i_disk_size, xmi_can_exchange_reflink_flags() assumes every mapping moved and hands the reflink flag over to the other file. That assumption is wrong. A file can still own shared blocks past i_disk_size, e.g. after EXCHANGE_RANGE_TO_EOF sets a smaller size without unmapping anything. The flag is cleared anyway, and the next write to such a block happens in place instead of CoW, corrupting the other file that shares it. Commit |
||
|
Linus Torvalds
|
a5ebb76233 |
- amd64_edac: Shorten the ErrorInformation field read from the MCA_SYND MSR to
only two bits. It is perfectly fine to do so because no system ever supported more than 2 bits of information (the Chip Selects used were only 4 maximum) and newer hardware will use only 2 bits anyway -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmrKvjAACgkQEsHwGGHe VUrXohAAkfpqZl6l2SOOyrDNEAX8VqhhuIlp/wV+xpWtP32AZWDb3xyjrUB+Vzxs aR68mt57xzEWDQY0ciwIDWrxPSydDIWBIG6xeHAJc6PcT9BhP406MZ19mmJGRS85 Yl5yYlqm2Ucr8UGCe2vlS+4/CU2nbnRsXC7OeOMbVEKm73E/0Auq0Za8N+45SwcN 5QoPt1ffZBL6MJMceX73uztwwvXoh68/jnVd4LjjF8w7JUoXuOa1m/tDosL3zDNR 4Oy+i5YOfXNQ96L4OS4nwLBuUdwH4psWcWOwAD3WN+10OBWtMxUIV5cJgwcB+oHm SL0J5TECPJtWRmzNBraqPnOW8hwMFLrT1KOxOaq/nO7D1T2K+2Hf8Wo1/btoQWqz jisRSfNbaGeDuiXAoZKsWf6AkVBMHb3eXPsNRCywXh13+oZ5BfMtojXBYD9BHQsy U9DGLNuecccCvVbMvqci3wj+nYNgWt5ZRkqT9HeIcnFSRc6kC7O3c40qNAtwl1Qj NbGKkfelAQRaJFaT7l1tPj4NlsanqL/J3sF+wV5HZShhiWkUmaT9Pr6NXXKzq7I+ eUO7ccDb7RaAdGTvK1V6Gl3oPaHa+o23qFvBSqKA6GGClwZpO3G8qwVSEoZHGtS1 L0wEC1bzN3I+C9Uq/SKyCuaefouvBQJGMGr0XhwZ8RRTFfISjnA= =F1H/ -----END PGP SIGNATURE----- Merge tag 'edac_urgent_for_v7.3_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC fix from Borislav Petkov: - amd64_edac: Shorten the ErrorInformation field read from the MCA_SYND MSR to only two bits. It is perfectly fine to do so because no system ever supported more than 2 bits of information (the Chip Selects used were only 4 maximum) and newer hardware will use only 2 bits anyway * tag 'edac_urgent_for_v7.3_rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/amd64: Mask UMC chip select to the four implemented selects |
||
|
Linus Torvalds
|
bb934c29fd |
drm fixes for 7.3-rc7
fb: - defer setup when fbdev_probe() fails, not just on -EAGAIN bridge: - Fix unlocked list_del in drm_bridge_add() - Fix unlocked list access in drm_bridge_attach() - th1520-dw-hdmi: Fix error check on dw_hdmi_probe() return value - th1520-dw-hdmi: Fix remove() callback aspeed: - Balance the display clock enable on teardown i915: - Fix a GT park race that could trigger spurious RPM wakelock warnings - Fix execbuffer relocation cleanup to avoid out-of-bounds free xe: - i2c removal - system Controller Maibox header handling - two bo pin/unpin accounting bugs - not emitting a w/a twice - xe_mmio_wait32() to honor delay/sleep maximums amdgpu: - Fix direct scanout alpha on some DRM_FORMATs - UserQ fixes - Fix tearing flips with PSR - GPU reset vblank fix - Debugfs register interface fix - Fix display mode patching - Expand Mac reserved memory workaround amdkfd: - SDMA doorbell fix - Fix dma-buf reference leak in error path imagination: - fix reference and vm_bo handling in remap() - size page table preallocation by device address gud: - don't keep a connector without a CRTC as connector_state panthor: - validate userspace queue count against initialized firmware slot count nouveau: - fix null ptr regression - skip turing CE workaround for non-GR vmwgfx: - validate pitch value - add blend mode property vc4: - drain hangcheck timer on unbind - free BO cache on teardown - use kvmalloc_objs for bo cache size list - disable V3D interrupt across runtime suspend - fix binner slot allocation - fix fw refcount leak -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmrKj3sACgkQDHTzWXnE hr6e+A/+I1d+UvVkSnIsMv7NGLGiNvDClWvTnypF0ys2poiUGZ88UPzGuE7r8zfc BK9zZnQ/+LSYu/NLhmLnxDxYmx+Y2rKMjQEq22RsjUAzrPhn0/UsoWTt5jRMfim+ If9gW5p51rX4TBH90fgiTiwvAHxfSSzPjIlQIcjSAQKFxOIZ6mQtyKU4453H//XQ AO1fIDOvcUnZXyQCveoLtaU9ICKv5HNTwF4UBAnRfOmrJr/1ny2H51/tsFkh4Dwy h/OMyJDMNSfa/w9JZOGC/+fEipEQZ15Hk3QUy8i+UUEtD/JKFeG2nlNPuKqjjhrA slQa8E9M7anw+akPjJ0vWrOrqMXcxXE9huRWUUvv9MXkXpFjYmUeBTw1Q9Oc2No4 kdqmS9Skl6R/VJjeWeV2m/iNftL0k3CUWr2paCb9nGUOoaxdoMC72JVl7MprrSOT KG46ggDMfqhIygfkT+PBighZkMCJs/Fkw/UCM9Dldc3M3ds1VmQnH9I+1W+LUqjN OHT5FJfiabejImgnrPtPDtGJtZQub7K9ZUJc13GqxjCK3IXp1oqit8wVZS1qqmw7 3dpc+mWB0Re9CnlaOVb/WTzbip3WGlX8mdHrm+gKYHhigR5EjwiZSal7jP+fKYqK riXBBTU4CE44Y92lutvtJ4NjSqiShK/pzAkzPVVL8bCYoQAL4fk= =TKVJ -----END PGP SIGNATURE----- Merge tag 'drm-fixes-2026-10-11' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Ailie: "Live from Dublin Airport, it's Saturday Night drm fixes. This week has the missing misc fixes from last week which I tracked down and seemed to be a race/bug in my lei setup somehow, once I asked lei to ignore it's cache I got the missing email. But there are more misc fixes this week and amd and intel ones. The main ones in this are amdgpu and xe, with vc4, vmwgfx, nouveau and imagination in the middle, with a bunch of small single fixes. Bit busier than I'd like, but the missing misc might explain it, anyways time for me to fly home. fb: - defer setup when fbdev_probe() fails, not just on -EAGAIN bridge: - Fix unlocked list_del in drm_bridge_add() - Fix unlocked list access in drm_bridge_attach() - th1520-dw-hdmi: - Fix error check on dw_hdmi_probe() return value - Fix remove() callback aspeed: - Balance the display clock enable on teardown i915: - Fix a GT park race that could trigger spurious RPM wakelock warnings - Fix execbuffer relocation cleanup to avoid out-of-bounds free xe: - i2c removal - system Controller Maibox header handling - two bo pin/unpin accounting bugs - not emitting a w/a twice - xe_mmio_wait32() to honor delay/sleep maximums amdgpu: - Fix direct scanout alpha on some DRM_FORMATs - UserQ fixes - Fix tearing flips with PSR - GPU reset vblank fix - Debugfs register interface fix - Fix display mode patching - Expand Mac reserved memory workaround amdkfd: - SDMA doorbell fix - Fix dma-buf reference leak in error path imagination: - fix reference and vm_bo handling in remap() - size page table preallocation by device address gud: - don't keep a connector without a CRTC as connector_state panthor: - validate userspace queue count against initialized firmware slot count nouveau: - fix null ptr regression - skip turing CE workaround for non-GR vmwgfx: - validate pitch value - add blend mode property vc4: - drain hangcheck timer on unbind - free BO cache on teardown - use kvmalloc_objs for bo cache size list - disable V3D interrupt across runtime suspend - fix binner slot allocation - fix fw refcount leak" * tag 'drm-fixes-2026-10-11' of https://gitlab.freedesktop.org/drm/kernel: (39 commits) drm/nouveau: Skip the Turing CE workaround object for non-GR channels drm/vc4: Fix binner slot allocation failing on an idle GPU drm/vc4: Disable the V3D interrupt across runtime suspend drm/imagination: Size page table preallocation by device address drm/imagination: Fix reference and vm_bo handling in remap() drm/amdgpu: make Mac FB workaround generic drm/amdkfd: fix dma_buf reference leak in get_dmabuf_info drm/amd/display: Don't replace a sink mode that shares the native totals drm/amdkfd: align SDMA doorbell base for shader doorbell writes drm/amdgpu: copy debugfs register data outside the GRBM/SRBM locks drm/amdgpu: serialize vblank counter reads against GPU reset drm/amd/display: disable self-refresh on tearing flips drm/amdgpu/userq: return the memdup_user() error for the user MQD drm/amdgpu/userq: only accept doorbell BOs as queue doorbell drm/amd/display: Fix direct scanout alpha on some DRM_FORMATs drm/xe/i2c: cancel the client work on remove drm/xe/sysctrl: Fix mailbox header handling drm/i915/gt: Unmask interrupts only when ACTIVE is true drm/i915/gem: Prevent overstepping exec array boundary drm/gud: don't keep a connector without a CRTC as connector_state ... |
||
|
Linus Torvalds
|
b62f58bd71 |
i2c-fixes for v7.3-rc7
qcom-geni: fix runtime PM reference leak on xfer -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQScDfrjQa34uOld1VLaeAVmJtMtbgUCasoNSwAKCRDaeAVmJtMt bvJNAQDmm2Rj8dyCOMlm6pNRJv8Wh6CpydUbmTbko/GRMsBWiAEAsPiRtXC07Z+w GrOIQdIVrKCPiShnW0ajDufnMZjDpg4= =i2NX -----END PGP SIGNATURE----- Merge tag 'i2c-fixes-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux Pull i2c fix from Andi Shyti: "Just one qcom-geni fix for a runtime PM reference leak during transfer setup" * tag 'i2c-fixes-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux: i2c: qcom-geni: release runtime PM reference when set_rate fails |
||
Dave Airlie
|
c61e23ed14 |
A pointer assignment fix for gud, a reference fix and a preallocation
size fix for imagination, a suspend fix and an allocation fix when idle for vc4, and a hardware variant fix for nouveau. -----BEGIN PGP SIGNATURE----- iJUEABMJAB0WIQTkHFbLp4ejekA/qfgnX84Zoj2+dgUCasjkYwAKCRAnX84Zoj2+ dpu/AX0QwkYdn5r75S9Nsud12AGxs68MQYdf9O/JnsJYO5+Y5L078rTScygmDnvT civ/Y3ABgIhqXI1I/vXtyC7T+REXa47Gpll+ZVtw2FLj7c9czWjgr2iHIqXpn8pK 3A7y86s0kA== =YUdz -----END PGP SIGNATURE----- Merge tag 'drm-misc-fixes-2026-10-09' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes A pointer assignment fix for gud, a reference fix and a preallocation size fix for imagination, a suspend fix and an allocation fix when idle for vc4, and a hardware variant fix for nouveau. Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maxime Ripard <self@mripard.dev> Link: https://patch.msgid.link/asjkbknTHg2t8JGy@houat |
||
|
Dave Airlie
|
492c4ded0f |
amd-drm-fixes-7.3-2026-10-08:
amdgpu: - Fix direct scanout alpha on some DRM_FORMATs - UserQ fixes - Fix tearing flips with PSR - GPU reset vblank fix - Debugfs register interface fix - Fix display mode patching - Expand Mac reserved memory workaround amdkfd: - SDMA doorbell fix - Fix dma-buf reference leak in error path -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQQgO5Idg2tXNTSZAr293/aFa7yZ2AUCasfVFQAKCRC93/aFa7yZ 2Nf6AP0T/qzbqO519Aih3Zr1Y8rETWjQ38fCoDbojom9/tzAoQD9HgNQkNvkO+fK R4uCeUzG91tnJK2Yuzv+WzWIbLQrdAA= =Ptpq -----END PGP SIGNATURE----- Merge tag 'amd-drm-fixes-7.3-2026-10-08' of https://gitlab.freedesktop.org/drm/amdgpu/kernel into drm-fixes amd-drm-fixes-7.3-2026-10-08: amdgpu: - Fix direct scanout alpha on some DRM_FORMATs - UserQ fixes - Fix tearing flips with PSR - GPU reset vblank fix - Debugfs register interface fix - Fix display mode patching - Expand Mac reserved memory workaround amdkfd: - SDMA doorbell fix - Fix dma-buf reference leak in error path Signed-off-by: Dave Airlie <airlied@redhat.com> From: Alex Deucher <alexander.deucher@amd.com> Link: https://patch.msgid.link/20261008174658.2506431-1-alexander.deucher@amd.com |
||
|
Dave Airlie
|
a8013cbe8d |
Fixes on:
- i2c removal (Fan) - system Controller Maibox header handling (Mallesh) - two bo pin/unpin accounting bugs (Thomas) - not emitting a w/a twice (Tvrtko) - xe_mmio_wait32() to honor delay/sleep maximums (Al\ an) -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEbSBwaO7dZQkcLOKj+mJfZA7rE8oFAmrHxFUACgkQ+mJfZA7r E8py7Qf+ODo88JXxsL6C62wpd4nNbYxxBxLGW0TLrmtveBm/2uLvQQInOJpkE/Ni awXUrW92CbJWN1cAxvrvrGQBO1NedkypCMxHgmfsiUmSmEpT34/KXLExn8A5Kddo m+VzMxHWavk0k4ELsullJlFSZbnTC3hwOZlK7tJ0HaKatEpH8uM8EQk3qZqGEnOM OjuQDLLyEF3MwwvSv+Y81oZLfeNHaJ6esjmSX4mccd3sxjmRa0dFPAjRaRzLa+2P A+cw3ep+cRBZSutNBhElWPJZTrRzgNBKkBnB05+FeIctcRNbhvUf23IiWlf2kWvg G4DkiE/m/G/RKO+/t0DNsiDcnIloGA== =610A -----END PGP SIGNATURE----- Merge tag 'drm-xe-fixes-2026-10-08' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Fixes on: - i2c removal (Fan) - system Controller Maibox header handling (Mallesh) - two bo pin/unpin accounting bugs (Thomas) - not emitting a w/a twice (Tvrtko) - xe_mmio_wait32() to honor delay/sleep maximums (Alan) Signed-off-by: Dave Airlie <airlied@redhat.com> From: Rodrigo Vivi <rodrigo.vivi@intel.com> Link: https://patch.msgid.link/asfEfgbIjs0GJ-RF@intel.com |
||
|
Tejun Heo
|
069403dff3 |
sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue
A deferred reenqueue can read a freed user DSQ. The request stays on its
CPU's deferred list until run_deferred() takes it, and the RCU callback that
frees the DSQ assumes that the grace period has flushed it, so exit_dsq()
checks the per-CPU node without the deferred list lock. A grace period waits
for readers in flight, not for a pending run_deferred(). A run_deferred()
which starts after the grace period began can detach the request right
before the callback looks and then read the freed DSQ's id.
Cancel the pending requests before the grace period instead. The irq work
that frees the DSQ unlinks every CPU's request under the per-CPU deferred
list lock, and schedule_dsq_reenq() ignores a new request under the same
lock once the id is invalid. Only a run_deferred() that started before the
grace period can hold a request, and it runs with IRQs disabled, so the
grace period waits for it and nothing touches the DSQ after the callback.
Fixes:
|
||
|
Tejun Heo
|
7a9df76679 |
sched_ext: Fix stall when a task enqueued with SCX_ENQ_LAST lands back on its CPU's local DSQ
With SCX_OPS_ENQ_LAST, the last runnable task on a CPU is passed to
ops.enqueue() instead of being kept running. Exiting tasks without
SCX_OPS_ENQ_EXITING, migration disabled tasks without
SCX_OPS_ENQ_MIGRATION_DISABLED and tasks on an offline rq skip ops.enqueue()
and go straight to the local DSQ. This happens in put_prev_task_scx() after
the pick has settled on idle, so nothing reschedules the CPU, which idles
with the task queued until an unrelated wakeup lands on it or the watchdog
fires.
scx_mitosis, which sets SCX_OPS_ENQ_LAST without SCX_OPS_ENQ_EXITING, hit
this during mass cgroup teardown: exiting tasks stuck in exit_mmap() for
over 40 seconds.
A task put on the local DSQ runs, as anywhere else. If the SCX_ENQ_LAST
enqueue left the task on this CPU's local DSQ, set need_resched on the task
being switched in, as proxy_resched_idle() does. resched_curr() would flag
the task being put instead, and __schedule() clears that right after the
pick.
Fixes:
|