summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2025-12-28io_uring: IOPOLL polling improvementsJens Axboe
io_uring manages issued and pending IOPOLL read/write requests in a singly linked list. One downside of that is that individual items cannot easily be removed from that list, and as a result, io_uring will only complete a completed request N in that list if 0..N-1 are also complete. For homogenous IO this isn't necessarily an issue, but if different devices are involved in polling in the same ring, or if disparate IO from the same device is being polled for, this can defer completion of some requests unnecessarily. Move to a doubly linked list for iopoll completions instead, making it possible to easily complete whatever requests that were polled done successfully. Co-developed-by: Fengnan Chang <fengnanchang@gmail.com> Link: https://lore.kernel.org/io-uring/20251210085501.84261-1-changfengnan@bytedance.com/ Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-12-28brd: replace simple_strtol with kstrtoul in ramdisk_sizeThorsten Blum
Replace simple_strtol() with the recommended kstrtoul() for parsing the 'ramdisk_size=' boot parameter. Unlike simple_strtol(), which returns a long, kstrtoul() converts the string directly to an unsigned long and avoids implicit casting. Check the return value of kstrtoul() and reject invalid values. This adds error handling while preserving behavior for existing values, and removes use of the deprecated simple_strtol() helper. The current code silently sets 'rd_size = 0' if parsing fails, instead of leaving the default value (CONFIG_BLK_DEV_RAM_SIZE) unchanged. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-12-28rnull: replace `kernel::c_str!` with C-StringsTamir Duberstein
C-String literals were added in Rust 1.77. Replace instances of `kernel::c_str!` with C-String literals where possible. Signed-off-by: Tamir Duberstein <tamird@gmail.com> Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-12-28Linux 6.19-rc3v6.19-rc3Linus Torvalds
2025-12-28drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbufferKrzysztof Niemiec
Initialize the eb.vma array with values of 0 when the eb structure is first set up. In particular, this sets the eb->vma[i].vma pointers to NULL, simplifying cleanup and getting rid of the bug described below. During the execution of eb_lookup_vmas(), the eb->vma array is successively filled up with struct eb_vma objects. This process includes calling eb_add_vma(), which might fail; however, even in the event of failure, eb->vma[i].vma is set for the currently processed buffer. If eb_add_vma() fails, eb_lookup_vmas() returns with an error, which prompts a call to eb_release_vmas() to clean up the mess. Since eb_lookup_vmas() might fail during processing any (possibly not first) buffer, eb_release_vmas() checks whether a buffer's vma is NULL to know at what point did the lookup function fail. In eb_lookup_vmas(), eb->vma[i].vma is set to NULL if either the helper function eb_lookup_vma() or eb_validate_vma() fails. eb->vma[i+1].vma is set to NULL in case i915_gem_object_userptr_submit_init() fails; the current one needs to be cleaned up by eb_release_vmas() at this point, so the next one is set. If eb_add_vma() fails, neither the current nor the next vma is set to NULL, which is a source of a NULL deref bug described in the issue linked in the Closes tag. When entering eb_lookup_vmas(), the vma pointers are set to the slab poison value, instead of NULL. This doesn't matter for the actual lookup, since it gets overwritten anyway, however the eb_release_vmas() function only recognizes NULL as the stopping value, hence the pointers are being set to NULL as they go in case of intermediate failure. This patch changes the approach to filling them all with NULL at the start instead, rather than handling that manually during failure. Reported-by: Gangmin Kim <km.kim1503@gmail.com> Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15062 Fixes: 544460c33821 ("drm/i915: Multi-BB execbuf") Cc: stable@vger.kernel.org # 5.16.x Signed-off-by: Krzysztof Niemiec <krzysztof.niemiec@intel.com> Reviewed-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com> Reviewed-by: Krzysztof Karas <krzysztof.karas@intel.com> Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://lore.kernel.org/r/20251216180900.54294-2-krzysztof.niemiec@intel.com
2025-12-28vfio/xe: Fix use-after-free in xe_vfio_pci_alloc_file()Alper Ak
migf->filp is accessed after migf has been freed. Save the error value before calling kfree() to prevent use-after-free. Fixes: 1f5556ec8b9e ("vfio/xe: Add device specific vfio_pci driver variant for Intel graphics") Signed-off-by: Alper Ak <alperyasinak1@gmail.com> Link: https://lore.kernel.org/r/20251225151349.360870-1-alperyasinak1@gmail.com Signed-off-by: Alex Williamson <alex@shazbot.org>
2025-12-28vfio/pds: Fix memory leak in pds_vfio_dirty_enable()Zilin Guan
pds_vfio_dirty_enable() allocates memory for region_info. If interval_tree_iter_first() returns NULL, the function returns -EINVAL immediately without freeing the allocated memory, causing a memory leak. Fix this by jumping to the out_free_region_info label to ensure region_info is freed. Fixes: 2e7c6feb4ef52 ("vfio/pds: Add multi-region support") Signed-off-by: Zilin Guan <zilin@seu.edu.cn> Link: https://lore.kernel.org/r/20251225143150.1117366-1-zilin@seu.edu.cn Signed-off-by: Alex Williamson <alex@shazbot.org>
2025-12-28Merge tag 'usb-6.19-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some small USB fixes, and bunch of reverts for 6.19-rc3. Included in here are: - reverts of some typec ucsi driver changes that had a lot of regression reports after -rc1. Let's just revert it all for now and it will come back in a way that is better tested. - other typec bugfixes - usb-storage quirk fixups - dwc3 driver fix - other minor USB fixes for reported problems. All of these have passed 0-day testing and individual testing" * tag 'usb-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (22 commits) Revert "usb: typec: ucsi: Update UCSI structure to have message in and message out fields" Revert "usb: typec: ucsi: Add support for message out data structure" Revert "usb: typec: ucsi: Enable debugfs for message_out data structure" Revert "usb: typec: ucsi: Add support for SET_PDOS command" Revert "usb: typec: ucsi: Fix null pointer dereference in ucsi_sync_control_common" Revert "usb: typec: ucsi: Get connector status after enable notifications" usb: ohci-nxp: clean up probe error labels usb: gadget: lpc32xx_udc: clean up probe error labels usb: ohci-nxp: fix device leak on probe failure usb: phy: isp1301: fix non-OF device reference imbalance usb: gadget: lpc32xx_udc: fix clock imbalance in error path usb: typec: ucsi: Get connector status after enable notifications usb: usb-storage: Maintain minimal modifications to the bcdDevice range. usb: dwc3: of-simple: fix clock resource leak in dwc3_of_simple_probe usb: typec: ucsi: Fix null pointer dereference in ucsi_sync_control_common USB: lpc32xx_udc: Fix error handling in probe usb: typec: altmodes/displayport: Drop the device reference in dp_altmode_probe() usb: phy: fsl-usb: Fix use-after-free in delayed work during device removal usb: renesas_usbhs: Fix a resource leak in usbhs_pipe_malloc() usb: typec: ucsi: huawei-gaokin: add DRM dependency ...
2025-12-28Merge tag 'tty-6.19-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull serial driver fixes from Greg KH: "Here are some small serial driver fixes for some reported issues. Included in here are: - serial sysfs fwnode fix that was much reported - sh-sci driver fix - serial device init bugfix - 8250 bugfix - xilinx_uartps bugfix All of these have passed 0-day testing and individual testing" * tag 'tty-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serial: xilinx_uartps: fix rs485 delay_rts_after_send serial: sh-sci: Check that the DMA cookie is valid serial: core: Fix serial device initialization serial: 8250: longson: Fix NULL vs IS_ERR() bug in probe serial: core: Restore sysfs fwnode information
2025-12-28Merge tag 'firewire-fixes-6.19-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire fix from Takashi Sakamoto: "A fix for PCI driver for Texas Instruments PCILyx series. The driver had a bug where it allocated a DMA-coherent buffer of 16 KB but released it using PAGE_SIZE. This disproportion was reported in 2020, but the fix was never merged. It is finally resolved" * tag 'firewire-fixes-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: firewire: nosy: Fix dma_free_coherent() size
2025-12-28Merge tag 'riscv-for-linus-6.19-rc3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V updates from Paul Walmsley: "Nothing exotic here; these are the cleanup and new ISA extension probing patches (not including CFI): - Add probing and userspace reporting support for the standard RISC-V ISA extensions Zilsd and Zclsd, which implement load/store dual instructions on RV32 - Abstract the register saving code in setup_sigcontext() so it can be used for stateful RISC-V ISA extensions beyond the vector extension - Add the SBI extension ID and some initial data structure definitions for the RISC-V standard SBI debug trigger extension - Clean up some code slightly: change some page table functions to avoid atomic operations oinn !SMP and to avoid unnecessary casts to atomic_long_t; and use the existing RISCV_FULL_BARRIER macro in place of some open-coded 'fence rw,rw' instructions" * tag 'riscv-for-linus-6.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: Add SBI debug trigger extension and function ids riscv/atomic.h: use RISCV_FULL_BARRIER in _arch_atomic* function. riscv: hwprobe: export Zilsd and Zclsd ISA extensions riscv: add ISA extension parsing for Zilsd and Zclsd dt-bindings: riscv: add Zilsd and Zclsd extension descriptions riscv: mm: use xchg() on non-atomic_long_t variables, not atomic_long_xchg() riscv: mm: ptep_get_and_clear(): avoid atomic ops when !CONFIG_SMP riscv: mm: pmdp_huge_get_and_clear(): avoid atomic ops when !CONFIG_SMP riscv: signal: abstract header saving for setup_sigcontext
2025-12-28Merge tag 'powerpc-6.19-2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Madhavan Srinivasan: - Fix for kexec warning due to SMT disable or partial SMT enabled - Handle font bitmap pointer with reloc_offset to fix boot crash - Fix to enable cpuidle state for Power11 - Couple of misc fixes Thanks to Aboorva Devarajan, Aditya Bodkhe, Cedar Maxwell, Christian Zigotzky, Christophe Leroy, Christophe Leroy (CS GROUP), Finn Thain, Gopi Krishna Menon, Guenter Roeck, Jan Stancek, Joe Lawrence, Josh Poimboeuf, Justin M. Forbes, Madadi Vineeth Reddy, Naveen N Rao (AMD), Nysal Jan K.A., Sachin P Bappalige, Samir M, Sourabh Jain, Srikar Dronamraju, and Stan Johnson * tag 'powerpc-6.19-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/32: Restore disabling of interrupts at interrupt/syscall exit powerpc/powernv: Enable cpuidle state detection for POWER11 powerpc: Add reloc_offset() to font bitmap pointer used for bootx_printf() powerpc/tools: drop `-o pipefail` in gcc check scripts selftests/powerpc/pmu/: Add check_extended_reg_test to .gitignore powerpc/kexec: Enable SMT before waking offline CPUs
2025-12-28selftests/ublk: fix Makefile to rebuild on header changesMing Lei
Add header dependencies to kublk build rule so that changes to kublk.h, ublk_dep.h, or utils.h trigger a rebuild. Signed-off-by: Ming Lei <ming.lei@redhat.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-12-28selftests/ublk: add test for async partition scanMing Lei
Add test_generic_15.sh to verify that async partition scan prevents IO hang when reading partition tables. The test creates ublk devices with fault_inject target and very large delay (60s) to simulate blocked partition table reads, then kills the daemon to verify proper state transitions without hanging: 1. Without recovery support: - Create device with fault_inject and 60s delay - Kill daemon while partition scan may be blocked - Verify device transitions to DEAD state 2. With recovery support (-r 1): - Create device with fault_inject, 60s delay, and recovery - Kill daemon while partition scan may be blocked - Verify device transitions to QUIESCED state Before the async partition scan fix, killing the daemon during partition scan would cause deadlock as partition scan held ub->mutex while waiting for IO. With the async fix, partition scan happens in a work function and flush_work() ensures proper synchronization. Add _add_ublk_dev_no_settle() helper function to skip udevadm settle, which would otherwise hang waiting for partition scan events to complete when partition table read is delayed. Signed-off-by: Ming Lei <ming.lei@redhat.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-12-28ublk: scan partition in async wayMing Lei
Implement async partition scan to avoid IO hang when reading partition tables. Similar to nvme_partition_scan_work(), partition scanning is deferred to a work queue to prevent deadlocks. When partition scan happens synchronously during add_disk(), IO errors can cause the partition scan to wait while holding ub->mutex, which can deadlock with other operations that need the mutex. Changes: - Add partition_scan_work to ublk_device structure - Implement ublk_partition_scan_work() to perform async scan - Always suppress sync partition scan during add_disk() - Schedule async work after add_disk() for trusted daemons - Add flush_work() in ublk_stop_dev() before grabbing ub->mutex Reviewed-by: Caleb Sander Mateos <csander@purestorage.com> Reported-by: Yoav Cohen <yoav@nvidia.com> Closes: https://lore.kernel.org/linux-block/DM4PR12MB63280C5637917C071C2F0D65A9A8A@DM4PR12MB6328.namprd12.prod.outlook.com/ Fixes: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver") Signed-off-by: Ming Lei <ming.lei@redhat.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-12-28tools/sched_ext: update scx_show_state.py for scx_aborting changeKohei Enju
Commit a69040ed57f5 ("sched_ext: Simplify breather mechanism with scx_aborting flag") removed scx_in_softlockup and scx_breather_depth, replacing them with scx_aborting. Update the script accordingly. Fixes: a69040ed57f5 ("sched_ext: Simplify breather mechanism with scx_aborting flag") Signed-off-by: Kohei Enju <enjuk@amazon.com> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2025-12-28tools/sched_ext: fix scx_show_state.py for scx_root changeKohei Enju
Commit 48e126777386 ("sched_ext: Introduce scx_sched") introduced scx_root and removed scx_ops, causing scx_show_state.py to fail when searching for the 'scx_ops' object. [1] Fix by using 'scx_root' instead, with NULL pointer handling. [1] # drgn -s vmlinux ./tools/sched_ext/scx_show_state.py Traceback (most recent call last): File "/root/.venv/bin/drgn", line 8, in <module> sys.exit(_main()) ~~~~~^^ File "/root/.venv/lib64/python3.14/site-packages/drgn/cli.py", line 625, in _main runpy.run_path( ~~~~~~~~~~~~~~^ script_path, init_globals={"prog": prog}, run_name="__main__" ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ) ^ File "<frozen runpy>", line 287, in run_path File "<frozen runpy>", line 98, in _run_module_code File "<frozen runpy>", line 88, in _run_code File "./tools/sched_ext/scx_show_state.py", line 30, in <module> ops = prog['scx_ops'] ~~~~^^^^^^^^^^^ _drgn.ObjectNotFoundError: could not find 'scx_ops' Fixes: 48e126777386 ("sched_ext: Introduce scx_sched") Signed-off-by: Kohei Enju <enjuk@amazon.com> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Signed-off-by: Tejun Heo <tj@kernel.org>
2025-12-28block,bfq: fix aux stat accumulation destinationshechenglong
Route bfqg_stats_add_aux() time accumulation into the destination stats object instead of the source, aligning with other stat fields. Reviewed-by: Yu Kuai <yukuai@fnnas.com> Signed-off-by: shechenglong <shechenglong@xfusion.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-12-28af_unix: don't post cmsg for SO_INQ unless explicitly asked forJens Axboe
A previous commit added SO_INQ support for AF_UNIX (SOCK_STREAM), but it posts a SCM_INQ cmsg even if just msg->msg_get_inq is set. This is incorrect, as ->msg_get_inq is just the caller asking for the remainder to be passed back in msg->msg_inq, it has nothing to do with cmsg. The original commit states that this is done to make sockets io_uring-friendly", but it's actually incorrect as io_uring doesn't use cmsg headers internally at all, and it's actively wrong as this means that cmsg's are always posted if someone does recvmsg via io_uring. Fix that up by only posting a cmsg if u->recvmsg_inq is set. Additionally, mirror how TCP handles inquiry handling in that it should only be done for a successful return. This makes the logic for the two identical. Cc: stable@vger.kernel.org Fixes: df30285b3670 ("af_unix: Introduce SO_INQ.") Reported-by: Julian Orth <ju.orth@gmail.com> Link: https://github.com/axboe/liburing/issues/1509 Signed-off-by: Jens Axboe <axboe@kernel.dk> Reviewed-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/07adc0c2-2c3b-4d08-8af1-1c466a40b6a8@kernel.dk Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-12-28Merge tag 'counter-fixes-for-6.19' of ↵Greg Kroah-Hartman
ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/wbg/counter into char-misc-linus William writes: Counter fixes for 6.19 A fix for interrupt-cnt dropping the IRQF_NO_THREAD configuration to allow the IRQ handler to correctly acquire a spinlock_t lock. A fix for 104-quad-8 correcting quad8_irq_handler() to return irqreturn_t enum values rather than negative errno codes on error. * tag 'counter-fixes-for-6.19' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/wbg/counter: counter: 104-quad-8: Fix incorrect return value in IRQ handler counter: interrupt-cnt: Drop IRQF_NO_THREAD flag
2025-12-28PM: sleep: Fix suspend_test() at the TEST_CORE levelRafael J. Wysocki
Commit a10ad1b10402 ("PM: suspend: Make pm_test delay interruptible by wakeup events") replaced mdelay() in suspend_test() with msleep() which does not work at the TEST_CORE test level that calls suspend_test() while running on one CPU with interrupts off. Address this by making suspend_test() check if the test level is suitable for using msleep() and use mdelay() otherwise. Fixes: a10ad1b10402 ("PM: suspend: Make pm_test delay interruptible by wakeup events") Reported-by: Sebastian Reichel <sebastian.reichel@collabora.com> Closes: https://lore.kernel.org/linux-pm/aUsAk0k1N9hw8IkY@venus/ Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Tested-by: Sebastian Reichel <sebastian.reichel@collabora.com> Link: https://patch.msgid.link/6251576.lOV4Wx5bFT@rafael.j.wysocki
2025-12-28rust: Add SoC Driver SampleMatthew Maurer
Shows registration of a SoC device upon receipt of a probe. Signed-off-by: Matthew Maurer <mmaurer@google.com> Link: https://patch.msgid.link/20251226-soc-bindings-v4-3-2c2fac08f820@google.com Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2025-12-28rust: Add soc_device supportMatthew Maurer
Allow SoC drivers in Rust to present metadata about their devices to userspace through /sys/devices/socX and other drivers to identify their properties through `soc_device_match`. Signed-off-by: Matthew Maurer <mmaurer@google.com> Link: https://patch.msgid.link/20251226-soc-bindings-v4-1-2c2fac08f820@google.com Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2025-12-28arm64: dts: exynos: gs101: add OTP nodeTudor Ambarus
Add the OTP controller node. Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org> Reviewed-by: André Draszik <andre.draszik@linaro.org> Link: https://patch.msgid.link/20251222-gs101-chipid-v4-5-aa8e20ce7bb3@linaro.org Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2025-12-28soc: samsung: exynos-chipid: add google,gs101-otp supportTudor Ambarus
GS101 is different (but also e850 and autov9 I assume) from the SoCs that are currently handled by the exynos-chipid driver because the chip ID info is part of the OTP registers. GS101 OTP has a clock, an interrupt line, a register space (that contains product and chip ID, TMU data, ASV, etc) and a 32Kbit memory space that can be read/program/locked with specific commands. On GS101 the "ChipID block" is just an abstraction, it's not a physical device. When the power-on sequence progresses, the OTP chipid values are loaded to the OTP registers. Add the GS101 chip ID support. The support is intentionally added in the exynos-chipid driver, and not in a dedicated Exynos OTP driver, because we estimate that there will not be any OTP consumers in the kernel other than the chip ID/SoC interface. The downstream GS101 drivers confirm this supposition. Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org> Reviewed-by: André Draszik <andre.draszik@linaro.org> Link: https://patch.msgid.link/20251222-gs101-chipid-v4-4-aa8e20ce7bb3@linaro.org Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2025-12-28soc: samsung: exynos-chipid: downgrade dev_info to dev_dbg for soc infoTudor Ambarus
The SoC information is exposed to userspace using the standard soc interface. Downgrade to dev_dbg to stop polluting the console log. Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org> Reviewed-by: André Draszik <andre.draszik@linaro.org> Link: https://patch.msgid.link/20251222-gs101-chipid-v4-3-aa8e20ce7bb3@linaro.org Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2025-12-28soc: samsung: exynos-chipid: rename methodTudor Ambarus
s/product_id_to_soc_id/exynos_product_id_to_name. Prepend exynos_ to avoid name space pollution. The method translates the product id to a name, rename the method to make that clear. While touching the code where it is called, add a blank line for readability purposes. Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org> Reviewed-by: André Draszik <andre.draszik@linaro.org> Link: https://patch.msgid.link/20251222-gs101-chipid-v4-2-aa8e20ce7bb3@linaro.org Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2025-12-28dt-bindings: nvmem: add google,gs101-otpTudor Ambarus
Add binding for the OTP controller found on Google GS101. Reviewed-by: André Draszik <andre.draszik@linaro.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org> Link: https://patch.msgid.link/20251222-gs101-chipid-v4-1-aa8e20ce7bb3@linaro.org Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2025-12-28w1: fix redundant counter decrement in w1_attach_slave_device()Haoxiang Li
In w1_attach_slave_device(), if __w1_attach_slave_device() fails, put_device() -> w1_slave_release() is called to do the cleanup job. In w1_slave_release(), sl->family->refcnt and sl->master->slave_count have already been decremented. There is no need to decrement twice in w1_attach_slave_device(). Fixes: 2c927c0c73fd ("w1: Fix slave count on 1-Wire bus (resend)") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn> Link: https://patch.msgid.link/20251218111414.564403-1-lihaoxiang@isrc.iscas.ac.cn Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2025-12-28net: mana: Fix use-after-free in reset service rescan pathDipayaan Roy
When mana_serv_reset() encounters -ETIMEDOUT or -EPROTO from mana_gd_resume(), it performs a PCI rescan via mana_serv_rescan(). mana_serv_rescan() calls pci_stop_and_remove_bus_device(), which can invoke the driver's remove path and free the gdma_context associated with the device. After returning, mana_serv_reset() currently jumps to the out label and attempts to clear gc->in_service, dereferencing a freed gdma_context. The issue was observed with the following call logs: [ 698.942636] BUG: unable to handle page fault for address: ff6c2b638088508d [ 698.943121] #PF: supervisor write access in kernel mode [ 698.943423] #PF: error_code(0x0002) - not-present page [S[ 698.943793] Pat Dec 6 07:GD5 100000067 P4D 1002f7067 PUD 1002f8067 PMD 101bef067 PTE 0 0:56 2025] hv_[n e 698.944283] Oops: Oops: 0002 [#1] SMP NOPTI tvsc f8615163-00[ 698.944611] CPU: 28 UID: 0 PID: 249 Comm: kworker/28:1 ... [Sat Dec 6 07:50:56 2025] R10: [ 699.121594] mana 7870:00:00.0 enP30832s1: Configured vPort 0 PD 18 DB 16 000000000000001b R11: 0000000000000000 R12: ff44cf3f40270000 [Sat Dec 6 07:50:56 2025] R13: 0000000000000001 R14: ff44cf3f402700c8 R15: ff44cf3f4021b405 [Sat Dec 6 07:50:56 2025] FS: 0000000000000000(0000) GS:ff44cf7e9fcf9000(0000) knlGS:0000000000000000 [Sat Dec 6 07:50:56 2025] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [Sat Dec 6 07:50:56 2025] CR2: ff6c2b638088508d CR3: 000000011fe43001 CR4: 0000000000b73ef0 [Sat Dec 6 07:50:56 2025] Call Trace: [Sat Dec 6 07:50:56 2025] <TASK> [Sat Dec 6 07:50:56 2025] mana_serv_func+0x24/0x50 [mana] [Sat Dec 6 07:50:56 2025] process_one_work+0x190/0x350 [Sat Dec 6 07:50:56 2025] worker_thread+0x2b7/0x3d0 [Sat Dec 6 07:50:56 2025] kthread+0xf3/0x200 [Sat Dec 6 07:50:56 2025] ? __pfx_worker_thread+0x10/0x10 [Sat Dec 6 07:50:56 2025] ? __pfx_kthread+0x10/0x10 [Sat Dec 6 07:50:56 2025] ret_from_fork+0x21a/0x250 [Sat Dec 6 07:50:56 2025] ? __pfx_kthread+0x10/0x10 [Sat Dec 6 07:50:56 2025] ret_from_fork_asm+0x1a/0x30 [Sat Dec 6 07:50:56 2025] </TASK> Fix this by returning immediately after mana_serv_rescan() to avoid accessing GC state that may no longer be valid. Fixes: 9bf66036d686 ("net: mana: Handle hardware recovery events when probing the device") Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Long Li <longli@microsoft.com> Signed-off-by: Dipayaan Roy <dipayanroy@linux.microsoft.com> Link: https://patch.msgid.link/20251218131054.GA3173@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-12-28net: avoid prefetching NULL pointersEric Dumazet
Aditya Gupta reported PowerPC crashes bisected to the blamed commit. Apparently some platforms do not allow prefetch() on arbitrary pointers. prefetch(next); prefetch(&next->priority); // CRASH when next == NULL Only NULL seems to be supported, with specific handling in prefetch(). Add a conditional to avoid the two prefetches and the skb->next clearing for the last skb in the list. Fixes: b2e9821cff6c ("net: prefech skb->priority in __dev_xmit_skb()") Reported-by: Aditya Gupta <adityag@linux.ibm.com> Closes: https://lore.kernel.org/netdev/e9f4abee-b132-440f-a50e-bced0868b5a7@linux.ibm.com/T/#mddc372b64ec5a3b181acc9ee3909110c391cc18a Signed-off-by: Eric Dumazet <edumazet@google.com> Tested-by: Aditya Gupta <adityag@linux.ibm.com> Link: https://patch.msgid.link/20251218081844.809008-1-edumazet@google.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-12-28net: bridge: Describe @tunnel_hash member in net_bridge_vlan_group structBagas Sanjaya
Sphinx reports kernel-doc warning: WARNING: ./net/bridge/br_private.h:267 struct member 'tunnel_hash' not described in 'net_bridge_vlan_group' Fix it by describing @tunnel_hash member. Fixes: efa5356b0d9753 ("bridge: per vlan dst_metadata netlink support") Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com> Acked-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20251218042936.24175-2-bagasdotme@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-12-28net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_writeDeepanshu Kartikey
A deadlock can occur between nfc_unregister_device() and rfkill_fop_write() due to lock ordering inversion between device_lock and rfkill_global_mutex. The problematic lock order is: Thread A (rfkill_fop_write): rfkill_fop_write() mutex_lock(&rfkill_global_mutex) rfkill_set_block() nfc_rfkill_set_block() nfc_dev_down() device_lock(&dev->dev) <- waits for device_lock Thread B (nfc_unregister_device): nfc_unregister_device() device_lock(&dev->dev) rfkill_unregister() mutex_lock(&rfkill_global_mutex) <- waits for rfkill_global_mutex This creates a classic ABBA deadlock scenario. Fix this by moving rfkill_unregister() and rfkill_destroy() outside the device_lock critical section. Store the rfkill pointer in a local variable before releasing the lock, then call rfkill_unregister() after releasing device_lock. This change is safe because rfkill_fop_write() holds rfkill_global_mutex while calling the rfkill callbacks, and rfkill_unregister() also acquires rfkill_global_mutex before cleanup. Therefore, rfkill_unregister() will wait for any ongoing callback to complete before proceeding, and device_del() is only called after rfkill_unregister() returns, preventing any use-after-free. The similar lock ordering in nfc_register_device() (device_lock -> rfkill_global_mutex via rfkill_register) is safe because during registration the device is not yet in rfkill_list, so no concurrent rfkill operations can occur on this device. Fixes: 3e3b5dfcd16a ("NFC: reorder the logic in nfc_{un,}register_device") Cc: stable@vger.kernel.org Reported-by: syzbot+4ef89409a235d804c6c2@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=4ef89409a235d804c6c2 Link: https://lore.kernel.org/all/20251217054908.178907-1-kartikey406@gmail.com/T/ [v1] Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20251218012355.279940-1-kartikey406@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-12-28net: usb: asix: validate PHY address before useDeepanshu Kartikey
The ASIX driver reads the PHY address from the USB device via asix_read_phy_addr(). A malicious or faulty device can return an invalid address (>= PHY_MAX_ADDR), which causes a warning in mdiobus_get_phy(): addr 207 out of range WARNING: drivers/net/phy/mdio_bus.c:76 Validate the PHY address in asix_read_phy_addr() and remove the now-redundant check in ax88172a.c. Reported-by: syzbot+3d43c9066a5b54902232@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3d43c9066a5b54902232 Tested-by: syzbot+3d43c9066a5b54902232@syzkaller.appspotmail.com Fixes: 7e88b11a862a ("net: usb: asix: refactor asix_read_phy_addr() and handle errors on return") Link: https://lore.kernel.org/all/20251217085057.270704-1-kartikey406@gmail.com/T/ [v1] Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20251218011156.276824-1-kartikey406@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-12-28net: mdio: rtl9300: use scoped for loopsRosen Penev
Currently in the return path, fwnode_handle_put calls are missing. Just use _scoped to avoid the issue. Fixes: 24e31e474769 ("net: mdio: Add RTL9300 MDIO driver") Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://patch.msgid.link/20251217210153.14641-1-rosenp@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-12-27tools build: Fix the common set of features test wrt libopensslArnaldo Carvalho de Melo
The recent introduction of the libopenssl feature test forgot to add the -lssl to the test-all.o target, which made it always fail, fix it. Noticed by looking at this file after building: $ cat /tmp/build/perf-tools/feature/test-all.make.output /usr/bin/ld: /tmp/ccBhO8WH.ltrans0.ltrans.o: in function `main': /home/acme/git/perf-tools/tools/build/feature/test-libopenssl.c:6:(.text.startup+0x2ed): undefined reference to `OPENSSL_init_ssl' collect2: error: ld returned 1 exit status $ It was added only to the individual ssl test, that works: $ cat /tmp/build/perf-tools/feature/test-libopenssl.make.output $ ldd /tmp/build/perf-tools/feature/test-libopenssl.bin | grep ssl libssl.so.3 => /usr/lib64/libssl.so.3 (0x00007fb81eda8000) $ Fixes: 7678523109d1d9ee ("tools/build: Add a feature test for libopenssl") Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2025-12-27i2c: designware: Remove unnecessary function exportsHeikki Krogerus
The master and slave probe functions are only called from the core. Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://lore.kernel.org/r/20251218151509.361617-3-heikki.krogerus@linux.intel.com
2025-12-27i2c: designware: Remove useless driver specific option for I2C targetHeikki Krogerus
The generic option for I2C target is already user selectable, which makes the DesignWare specific option completely unnecessary. The DesignWare option also silently selected I2C_SLAVE instead of depending on it without any real need for it. Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com> Signed-off-by: Andi Shyti <andi.shyti@kernel.org> Link: https://lore.kernel.org/r/20251218151509.361617-2-heikki.krogerus@linux.intel.com
2025-12-27firmware: arm_scmi: Remove legacy protocol versioning logicCristian Marussi
Protocol version negotiation logic is centralized in the SCMI core stack so that most of the legacy per-protocol versioning logic is redundant and can be removed. Remove protocol-specific versioning code and refactor all the protocols to use the new simplified centralized logic. Signed-off-by: Cristian Marussi <cristian.marussi@arm.com> Message-Id: <20251227164132.1311988-3-cristian.marussi@arm.com> Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
2025-12-27firmware: arm_scmi: Rework protocol version negotiation logicCristian Marussi
Protocol version negotiation can be used by an agent to request the server to downgrade the version effectively utilized by a specific protocol during the current session, if the latest version used by the server is newer than the latest version known to the client. In order for the negotiation process to be fully effective at preventing any possible version incompatibility, it must happen early on, well before the specific protocol initialization phase takes place. Delegate protocol version querying to the core SCMI stack and rework the protocol negotiation logic in order to execute the needed negotiation exchanges upfront, right before the initialization phase takes place. Signed-off-by: Cristian Marussi <cristian.marussi@arm.com> Message-Id: <20251227164132.1311988-2-cristian.marussi@arm.com> Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
2025-12-27ASoC: rt1320: fix the remainder calculation of r0 valueShuming Fan
This patch fixes the remainder calculation of r0 value. Fixes: 836ecc740ca8 ("ASoC: rt1320: fix 32-bit link failure") Signed-off-by: Shuming Fan <shumingf@realtek.com> Link: https://patch.msgid.link/20251226064255.993735-1-shumingf@realtek.com Signed-off-by: Mark Brown <broonie@kernel.org>
2025-12-27ASoC: alc5623: tidyup clock inversion in alc5623_set_dai_fmt()Kuninori Morimoto
It supports inverted bitclock (= _NB_, _IB_), but has no control for the frame polarity (= _NF, _IF). Let's tidyup it. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87y0mrtogw.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2025-12-27mcb: Add missing modpost build supportJose Javier Rodriguez Barbarin
mcb bus is not prepared to autoload client drivers with the data defined on the drivers' MODULE_DEVICE_TABLE. modpost cannot access to mcb_table_id inside MODULE_DEVICE_TABLE so the data declared inside is ignored. Add modpost build support for accessing to the mcb_table_id coded on device drivers' MODULE_DEVICE_TABLE. Fixes: 3764e82e5150 ("drivers: Introduce MEN Chameleon Bus") Reviewed-by: Jorge Sanjuan Garcia <dev-jorge.sanjuangarcia@duagon.com> Signed-off-by: Jose Javier Rodriguez Barbarin <dev-josejavier.rodriguez@duagon.com> Acked-by: Nathan Chancellor <nathan@kernel.org> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Link: https://patch.msgid.link/20251202084200.10410-1-dev-josejavier.rodriguez@duagon.com Signed-off-by: Nicolas Schier <nsc@kernel.org>
2025-12-27kbuild: fix compilation of dtb specified on command-line without make ruleThomas De Schampheleire
Since commit e7e2941300d2 ("kbuild: split device tree build rules into scripts/Makefile.dtbs"), it is no longer possible to compile a device tree blob that is not specified in a make rule like: dtb-$(CONFIG_FOO) += foo.dtb Before the mentioned commit, one could copy a dts file to e.g. arch/arm64/boot/dts/ (or a new subdirectory) and then convert it to a dtb file using: make ARCH=arm64 foo.dtb In this scenario, both 'dtb-y' and 'dtb-' are empty, and the inclusion of scripts/Makefile.dtbs relies on 'targets' to contain the MAKECMDGOALS. The value of 'targets', however, is only final later in the code. Move the conditional include of scripts/Makefile.dtbs down to where the value of 'targets' is final. Since Makefile.dtbs updates 'always-y' which is used as a prerequisite in the build rule, the build rule also needs to move down. Fixes: e7e2941300d2 ("kbuild: split device tree build rules into scripts/Makefile.dtbs") Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com> Reviewed-by: Nathan Chancellor <nathan@kernel.org> Tested-by: Nathan Chancellor <nathan@kernel.org> Acked-by: Rob Herring (Arm) <robh@kernel.org> Link: https://patch.msgid.link/20251126100017.1162330-1-thomas.de_schampheleire@nokia.com Signed-off-by: Nicolas Schier <nsc@kernel.org>
2025-12-27Revert "scripts/clang-tools: Handle included .c files in gen_compile_commands"Nicolas Schier
This reverts commit 9362d34acf91a706c543d919ade3e651b9bd2d6f. Dmitry Vyukov reported that commit 9362d34acf91 ("scripts/clang-tools: Handle included .c files in gen_compile_commands") generates false entries in some cases for C files that are included in other C files but not meant for standalone compilation. For properly supporting clangd, including .c files is discouraged. Reported-by: Dmitry Vyukov <dvyukov@google.com> Closes: https://lore.kernel.org/r/CACT4Y+Z8aCz0XcoJx9XXPHZSZHxGF8Kx9iUbFarhpTSEPDhMfg@mail.gmail.com Acked-by: Nathan Chancellor <nathan@kernel.org> Acked-by: Dmitry Vyukov <dvyukov@google.com> Fixes: 9362d34acf91 ("scripts/clang-tools: Handle included .c files in gen_compile_commands") Link: https://patch.msgid.link/20251217-revert-scripts-clang-rools-handle-included-c-files-v1-1-def5651446da@kernel.org Signed-off-by: Nicolas Schier <nsc@kernel.org>
2025-12-27Merge tag 'spi-fix-v6.19-rc2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "We've got more fixes here for the Cadence QSPI controller, this time fixing some issues that come up when working with slower flashes on some platforms plus a general race condition. We also add support for the Allwinner A523, this is just some new compatibles" * tag 'spi-fix-v6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: cadence-quadspi: Improve CQSPI_SLOW_SRAM quirk if flash is slow spi: cadence-quadspi: Prevent lost complete() call during indirect read spi: sun6i: Support A523's SPI controllers spi: dt-bindings: sun6i: Add compatibles for A523's SPI controllers
2025-12-27net: dsa: b53: skip multicast entries for fdb_dump()Jonas Gorski
port_fdb_dump() is supposed to only add fdb entries, but we iterate over the full ARL table, which also includes multicast entries. So check if the entry is a multicast entry before passing it on to the callback(). Additionally, the port of those entries is a bitmask, not a port number, so any included entries would have even be for the wrong port. Fixes: 1da6df85c6fb ("net: dsa: b53: Implement ARL add/del/dump operations") Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com> Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com> Link: https://patch.msgid.link/20251217205756.172123-1-jonas.gorski@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-12-27Merge branch '40GbE' of ↵Paolo Abeni
git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2025-12-17 (i40e, iavf, idpf, e1000) For i40e: Przemyslaw immediately schedules service task following changes to filters to ensure timely setup for PTP. Gregory Herrero adjusts VF descriptor size checks to be device specific. For iavf: Kohei Enju corrects a couple of condition checks which caused off-by-one issues. For idpf: Larysa fixes LAN memory region call to follow expected requirements. Brian Vazquez reduces mailbox wait time during init to avoid lengthy delays. For e1000: Guangshuo Li adds validation of data length to prevent out-of-bounds access. * '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: e1000: fix OOB in e1000_tbi_should_accept() idpf: reduce mbx_task schedule delay to 300us idpf: fix LAN memory regions command on some NVMs iavf: fix off-by-one issues in iavf_config_rss_reg() i40e: validate ring_len parameter against hardware-specific values i40e: fix scheduling in set_rx_mode ==================== Link: https://patch.msgid.link/ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-12-27Merge tag 'regulator-fix-v6.19-rc2' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "A couple of fixes from Thomas, making the UAPI headers more robustly correct and ensuring they are covered by checkpatch, and one from Andreas fixing an update for a change to the DT bindings that I missed was requested during bindings review in the newly added fp9931 driver" * tag 'regulator-fix-v6.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: fp9931: fix regulator node pointer regulator: Add UAPI headers to MAINTAINERS regulator: uapi: Use UAPI integer type
2025-12-27Merge tag 'drm-fixes-2025-12-27' of https://gitlab.freedesktop.org/drm/kernelLinus Torvalds
Pull drm fixes from Dave Airlie: "Post overeating fixes, only msm for this week has anything, so quiet as expected. msm: - GPU: - Fix crash on a7xx GPUs not supporting IFPC - Fix perfcntr use with IFPC - Concurrent binning fix - DPU: - Fixed DSC and SSPP fetching issues - Switched to scnprint instead of snprintf - Added missing NULL checks in pingpong code" * tag 'drm-fixes-2025-12-27' of https://gitlab.freedesktop.org/drm/kernel: (27 commits) drm/msm: Replace unsafe snprintf usage with scnprintf drm/msm/dpu: Add missing NULL pointer check for pingpong interface Revert "drm/msm/dpu: Enable quad-pipe for DSC and dual-DSI case" Revert "drm/msm/dpu: support plane splitting in quad-pipe case" drm/msm: msm_iommu.c: fix all kernel-doc warnings drm/msm: msm_gpu.h: fix all kernel-doc warnings drm/msm: msm_gem_vma.c: fix all kernel-doc warnings drm/msm: msm_fence.h: fix all kernel-doc warnings drm/msm/dpu: dpu_hw_wb.h: fix all kernel-doc warnings drm/msm/dpu: dpu_hw_vbif.h: fix all kernel-doc warnings drm/msm/dpu: dpu_hw_top.h: fix all kernel-doc warnings drm/msm/dpu: dpu_hw_sspp.h: fix all kernel-doc warnings drm/msm/dpu: dpu_hw_pingpong.h: fix all kernel-doc warnings drm/msm/dpu: dpu_hw_merge3d.h: fix all kernel-doc warnings drm/msm/dpu: dpu_hw_lm.h: fix all kernel-doc warnings drm/msm/dpu: dpu_hw_intf.h: fix all kernel-doc warnings drm/msm/dpu: dpu_hw_dspp.h: fix all kernel-doc warnings drm/msm/dpu: dpu_hw_dsc.h: fix all kernel-doc warnings drm/msm/dpu: dpu_hw_cwb.h: fix all kernel-doc warnings drm/msm/dpu: dpu_hw_ctl.h: fix all kernel-doc warnings ...
generated by cgit v1.2.3 (git 2.25.1) at 2026-10-02 18:48:02 +0000