summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2025-11-11sched/deadline: Document dl_serverPeter Zijlstra
Place the notes that resulted from going through the dl_server code in a comment. Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
2025-11-11memblock: fix memblock_estimated_nr_free_pages() for soft-reserved memoryAkinobu Mita
memblock_estimated_nr_free_pages() returns the difference between the total size of the "memory" memblock type and the "reserved" memblock type. The "soft-reserved" memory regions are added to the "reserved" memblock type, but not to the "memory" memblock type. Therefore, memblock_estimated_nr_free_pages() may return a smaller value than expected, or if it underflows, an extremely large value. /proc/sys/kernel/threads-max is determined by the value of memblock_estimated_nr_free_pages(). This issue was discovered on machines with CXL memory because kernel.threads-max was either smaller than expected or extremely large for the installed DRAM size. This fixes the issue by replacing memblock_reserved_size() with memblock_reserved_kern_size() that tells how much memory was reserved from the actual RAM. Suggested-by: Mike Rapoport <rppt@kernel.org> Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com> Link: https://patch.msgid.link/20251111010010.7800-1-akinobu.mita@gmail.com Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2025-11-11smb: fix invalid username check in smb3_fs_context_parse_param()Yiqi Sun
Since the maximum return value of strnlen(..., CIFS_MAX_USERNAME_LEN) is CIFS_MAX_USERNAME_LEN, length check in smb3_fs_context_parse_param() is always FALSE and invalid. Fix the comparison in if statement. Signed-off-by: Yiqi Sun <sunyiqixm@gmail.com> Signed-off-by: Steve French <stfrench@microsoft.com>
2025-11-11clk: imx: add driver for imx8ulp's sim lpavLaurentiu Mihalcea
The i.MX8ULP System Integration Module (SIM) LPAV module is a block control module found inside the LPAV subsystem, which offers some clock gating options and reset line assertion/de-assertion capabilities. Therefore, the clock gate management is supported by registering the module's driver as a clock provider, while the reset capabilities are managed via the auxiliary device API to allow the DT node to act as a reset and clock provider. Signed-off-by: Laurentiu Mihalcea <laurentiu.mihalcea@nxp.com> Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com> Reviewed-by: Peng Fan <peng.fan@nxp.com> Link: https://lore.kernel.org/r/20251104120301.913-4-laurentiumihalcea111@gmail.com Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
2025-11-11dt-bindings: clock: document 8ULP's SIM LPAVLaurentiu Mihalcea
Add documentation for i.MX8ULP's SIM LPAV module. Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com> Signed-off-by: Laurentiu Mihalcea <laurentiu.mihalcea@nxp.com> Link: https://lore.kernel.org/r/20251104120301.913-3-laurentiumihalcea111@gmail.com Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
2025-11-11smb: server: let smb_direct_disconnect_rdma_connection() turn CREATED into ↵Stefan Metzmacher
DISCONNECTED When smb_direct_disconnect_rdma_connection() turns SMBDIRECT_SOCKET_CREATED into SMBDIRECT_SOCKET_ERROR, we'll have the situation that smb_direct_disconnect_rdma_work() will set SMBDIRECT_SOCKET_DISCONNECTING and call rdma_disconnect(), which likely fails as we never reached the RDMA_CM_EVENT_ESTABLISHED. it means that wait_event(sc->status_wait, sc->status == SMBDIRECT_SOCKET_DISCONNECTED) in free_transport() will hang forever in SMBDIRECT_SOCKET_DISCONNECTING never reaching SMBDIRECT_SOCKET_DISCONNECTED. So we directly go from SMBDIRECT_SOCKET_CREATED to SMBDIRECT_SOCKET_DISCONNECTED. Fixes: b3fd52a0d85c ("smb: server: let smb_direct_disconnect_rdma_connection() set SMBDIRECT_SOCKET_ERROR...") Cc: Namjae Jeon <linkinjeon@kernel.org> Cc: Steve French <smfrench@gmail.com> Cc: Tom Talpey <tom@talpey.com> Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher <metze@samba.org> Acked-by: Namjae Jeon <linkinjeon@kernel.org> Signed-off-by: Steve French <stfrench@microsoft.com>
2025-11-11soc: qcom: mdt_loader: rename 'firmware' parameter of qcom_mdt_load()Gabor Juhos
In the 'mdt_loader.h' header, both the prototype and the inline version of the qcom_mdt_load() function uses 'fw_name' as name for the firmware name parameter. Additionally, the other qcom_mdt_* functions are using that as well. For consistency, rename the 'firmware' parameter in the implementation of the qcom_mdt_load() to 'fw_name' and update the function accordingly. No functional changes. Signed-off-by: Gabor Juhos <j4g8y7@gmail.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Link: https://lore.kernel.org/r/20251111-mdt-loader-cleanup-v1-2-71afee094dce@gmail.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2025-11-11soc: qcom: mdt_loader: merge __qcom_mdt_load() and qcom_mdt_load_no_init()Gabor Juhos
The qcom_mdt_load_no_init() function is just a simple wrapper around of __qcom_mdt_load(). Since commit 0daf35da397b ("soc: qcom: mdt_loader: Remove pas id parameter") both functions are using the same type of parameters and providing the same functionality. Keeping two functions for the same purpose is superfluous, so rename the __qcom_mdt_load() function to qcom_mdt_load_no_init() and remove the wrapper. No functional changes. Signed-off-by: Gabor Juhos <j4g8y7@gmail.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Link: https://lore.kernel.org/r/20251111-mdt-loader-cleanup-v1-1-71afee094dce@gmail.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2025-11-11x86/coco/sev: Convert has_cpuflag() to use cpu_feature_enabled()Borislav Petkov (AMD)
Drop one redundant definition, while at it. There should be no functional changes. Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Link: https://patch.msgid.link/20251031122122.GKaQSpwhLvkinKKbjG@fat_crate.local
2025-11-11KVM: VMX: Make loaded_vmcs_clear() static in vmx.cSean Christopherson
Make loaded_vmcs_clear() local to vmx.c as there are no longer any external callers. No functional change intended. Link: https://patch.msgid.link/20251106205114.218226-1-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2025-11-11blk-mq-dma: fix kernel-doc function name for integrity DMA iteratorKriish Sharma
Documentation build reported: Warning: block/blk-mq-dma.c:373 expecting prototype for blk_rq_integrity_dma_map_iter_start(). Prototype was for blk_rq_integrity_dma_map_iter_next() instead The kernel-doc comment above `blk_rq_integrity_dma_map_iter_next()` used the wrong function name (`blk_rq_integrity_dma_map_iter_start`) in its header. This patch corrects the function name in the kernel-doc block to match the actual implementation, ensuring clean documentation builds. Fixes: fec9b16dc555 ("blk-mq-dma: add scatter-less integrity data DMA mapping") Signed-off-by: Kriish Sharma <kriish.sharma2006@gmail.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-11-11block: fix merging data-less biosKeith Busch
The data segment gaps the block layer tracks doesn't apply to bio's that don't have data. Skip calculating this to fix a NULL pointer access. Fixes: 2f6b2565d43cdb5 ("block: accumulate memory segment gaps per bio") Reported-by: Matthew Wilcox <willy@infradead.org> Signed-off-by: Keith Busch <kbusch@kernel.org> Reviewed-by: Yu Kuai <yukuai@fnnas.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-11-11wifi: ath12k: Remove Wi-Fi 7 header dependencies from common ath12k moduleAlok Singh
Remove all remaining Wi-Fi 7 header dependencies from dp_mon.c to finalize separation of Wi-Fi 7 specific monitor mode functionality. Remove these includes from dp_mon.c: - wifi7/hal_desc.h - wifi7/hal_qcn9274.h - wifi7/dp_rx.h Relocate hal_mon_buf_ring from wifi7/hal_desc.h to hal.h. Relocate HAL_RX_UL_OFDMA_USER_INFO_V0_W0_VALID and HAL_RX_FCS_LEN macros from wifi7/hal_rx.h to hal.h or dp_rx.h as appropriate. Move the following functions to the new file wifi7/dp_mon.c and add the ath12k_wifi7 prefix: - ath12k_dp_mon_rx_merg_msdus() - ath12k_dp_mon_update_radiotap() - ath12k_dp_mon_rx_deliver_msdu() - ath12k_dp_mon_get_buf_len() - ath12k_dp_mon_rx_deliver() Export several helper functions needed by the ath12k_wifi7 module. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 Signed-off-by: Alok Singh <quic_aloksing@quicinc.com> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Link: https://patch.msgid.link/20251110103713.3484779-13-quic_aloksing@quicinc.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-11-11wifi: ath12k: Move MSDU END TLV processing to Wi-Fi 7 moduleAlok Singh
Separate Wi-Fi 7-specific monitor handling from ath12k common code to improve modularity. Move the following MSDU END TLV processing functions into wifi7/dp_mon.c and rename them with the ath12k_wifi7_ prefix: - ath12k_dp_mon_parse_rx_msdu_end_err() - ath12k_dp_mon_parse_status_msdu_end() - ath12k_dp_mon_next_link_desc_get() Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 Signed-off-by: Alok Singh <quic_aloksing@quicinc.com> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Link: https://patch.msgid.link/20251110103713.3484779-12-quic_aloksing@quicinc.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-11-11wifi: ath12k: Move MU user processing to Wi-Fi 7 moduleAlok Singh
Move Wi-Fi 7-specific monitor functionality out of ath12k common code into the Wi-Fi 7 module to improve modularity. Move and rename the following MU user processing functions to wifi7/dp_mon.c with the ath12k_wifi7_ prefix: - ath12k_dp_mon_rx_handle_ofdma_info() - ath12k_dp_mon_rx_populate_mu_user_info() - ath12k_dp_mon_hal_rx_parse_user_info() Move the helper functions hal_rx_mon_hal_ru_size_to_ath12k_ru_size and hal_rx_ul_ofdma_ru_size_to_width to the Wi-Fi 7 module, and export the helpers required by the ath12k_wifi7 code. Isolate the parsing of MU-specific user information within the Wi-Fi 7 module to keep common code generic. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 Signed-off-by: Alok Singh <quic_aloksing@quicinc.com> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Link: https://patch.msgid.link/20251110103713.3484779-11-quic_aloksing@quicinc.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-11-11wifi: ath12k: Move remaining SIG TLV parsing to Wi-Fi 7 moduleAlok Singh
The ath12k common monitor path still contains Wi-Fi 7 specific SIG TLV parsing. Move these SIG TLV parsing to the Wi-Fi 7 module to improve modularity. Relocate the following functions into wifi7/dp_mon.c and rename them with the ath12k_wifi7_ prefix: - ath12k_dp_mon_parse_l_sig_b() - ath12k_dp_mon_parse_l_sig_a() - ath12k_dp_mon_hal_rx_parse_u_sig_cmn() - ath12k_dp_mon_hal_rx_parse_u_sig_tb() - ath12k_dp_mon_hal_rx_parse_u_sig_mu() - ath12k_dp_mon_hal_rx_parse_u_sig_hdr() Export the helper symbols needed by the Wi-Fi 7 module. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 Signed-off-by: Alok Singh <quic_aloksing@quicinc.com> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Link: https://patch.msgid.link/20251110103713.3484779-10-quic_aloksing@quicinc.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-11-11wifi: ath12k: Move EHT SIG processing to Wi-Fi 7 moduleAlok Singh
Split Wi-Fi 7 specific EHT SIG parsing out of ath12k common code into the Wi-Fi 7 module to improve modularity. Move the following EHT SIG processing functions to wifi7/dp_mon.c and add the ath12k_wifi7 prefix to each relocated function. - ath12k_dp_mon_hal_aggr_tlv() - ath12k_dp_mon_hal_rx_is_frame_type_ndp() - ath12k_dp_mon_hal_rx_is_non_ofdma() - ath12k_dp_mon_hal_rx_is_ofdma() - ath12k_dp_mon_hal_rx_parse_eht_sig_ndp() - ath12k_dp_mon_hal_rx_parse_usig_overflow() - ath12k_dp_mon_hal_rx_parse_non_ofdma_users() - ath12k_dp_mon_hal_rx_parse_eht_mumimo_user() - ath12k_dp_mon_hal_rx_parse_eht_non_mumimo_user() - ath12k_dp_mon_hal_rx_is_mu_mimo_user() - ath12k_dp_mon_hal_rx_parse_eht_sig_non_ofdma() - ath12k_dp_mon_hal_rx_parse_ru_allocation() - ath12k_dp_mon_hal_rx_parse_eht_sig_ofdma() - ath12k_dp_mon_parse_eht_sig_hdr() Export helper functions needed by the ath12k_wifi7 module. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 Signed-off-by: Alok Singh <quic_aloksing@quicinc.com> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Link: https://patch.msgid.link/20251110103713.3484779-9-quic_aloksing@quicinc.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-11-11wifi: ath12k: Move HE SIG processing to Wi-Fi 7 moduleAlok Singh
Separate Wi-Fi 7-specific monitor code from ath12k common code to improve modularity. Move following HE SIG processing functions to the wifi7/dp_mon.c and rename the relocated functions with the ath12k_wifi7 prefix: - ath12k_dp_mon_parse_he_sig_b2_ofdma() - ath12k_dp_mon_parse_he_sig_b2_mu() - ath12k_dp_mon_parse_he_sig_b1_mu() - ath12k_dp_mon_parse_he_sig_mu() - ath12k_dp_mon_parse_he_sig_su() Export helper functions required by the ath12k_wifi7 module. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 Signed-off-by: Alok Singh <quic_aloksing@quicinc.com> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Link: https://patch.msgid.link/20251110103713.3484779-8-quic_aloksing@quicinc.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-11-11wifi: ath12k: Move HT/VHT SIG processing to Wi-Fi 7 moduleAlok Singh
Separate Wi-Fi 7-specific monitor parsing from ath12k common code to improve modularity and keep Wi-Fi 7 logic within the Wi-Fi 7 module. Move following HT/VHT SIG parsing functions to wifi7/dp_mon.c and rename the functions with the ath12k_wifi7 prefix: - ath12k_dp_mon_parse_vht_sig_a() - ath12k_dp_mon_parse_ht_sig() Export helper functions required by the ath12k_wifi7 module. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 Signed-off-by: Alok Singh <quic_aloksing@quicinc.com> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Link: https://patch.msgid.link/20251110103713.3484779-7-quic_aloksing@quicinc.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-11-11wifi: ath12k: Move TX monitor functionality to Wi-Fi 7 moduleAlok Singh
Separate Wi-Fi 7-specific TX monitor functionality from ath12k common code to improve modularity and maintainability. Move following TX monitor processing functions to wifi7/dp_mon.c and rename the functions with the ath12k_wifi7_ prefix: - ath12k_dp_mon_tx_get_ppdu_info() - ath12k_dp_mon_hal_tx_ppdu_info() - ath12k_dp_mon_tx_alloc_skb() - ath12k_dp_mon_tx_gen_cts2self_frame() - ath12k_dp_mon_tx_gen_rts_frame() - ath12k_dp_mon_tx_gen_3addr_qos_null_frame() - ath12k_dp_mon_tx_gen_4addr_qos_null_frame() - ath12k_dp_mon_tx_gen_ack_frame() - ath12k_dp_mon_tx_gen_prot_frame() - ath12k_dp_mon_tx_parse_status_tlv() - ath12k_dp_mon_tx_status_get_num_user() - ath12k_dp_mon_tx_process_ppdu_info() - ath12k_dp_mon_tx_parse_mon_status() Export helper functions required by the ath12k_wifi7 module. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 Signed-off-by: Alok Singh <quic_aloksing@quicinc.com> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Link: https://patch.msgid.link/20251110103713.3484779-6-quic_aloksing@quicinc.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-11-11wifi: ath12k: Move RX status TLV parsing to Wi-Fi 7 moduleAlok Singh
Split Wi-Fi 7-specific monitor code out of ath12k common code to improve modularity. Move following RX status TLV parsing functions to the new file wifi7/dp_mon.c and rename the helpers with the ath12k_wifi7_ prefix: - ath12k_dp_mon_rx_parse_status_tlv() - ath12k_dp_mon_parse_rx_dest_tlv() Export helper functions required by the Wi-Fi 7 module. Temporarily include wifi7/hal_rx.h from dp_mon.h to provide HAL structure definitions; remove this dependency in a later patch. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 Signed-off-by: Alok Singh <quic_aloksing@quicinc.com> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Link: https://patch.msgid.link/20251110103713.3484779-5-quic_aloksing@quicinc.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-11-11wifi: ath12k: Move MPDU pop functionality to Wi-Fi 7 moduleAlok Singh
Separate Wi-Fi 7-specific monitor code from ath12k common code to improve modularity. Move the following monitor MPDU pop function to the new file wifi7/dp_mon.c and rename them with the ath12k_wifi7_ prefix: - ath12k_dp_rx_mon_mpdu_pop() Export helper functions required by the ath12k_wifi7 module. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 Signed-off-by: Alok Singh <quic_aloksing@quicinc.com> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Link: https://patch.msgid.link/20251110103713.3484779-4-quic_aloksing@quicinc.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-11-11wifi: ath12k: Move monitor status processing to Wi-Fi 7 moduleAlok Singh
Split Wi-Fi 7-specific monitor status processing out of ath12k common code and into the Wi-Fi 7 module to improve modularity. Move the following functions to wifi7/dp_mon.c and rename them with the ath12k_wifi7_ prefix: - ath12k_dp_mon_rx_parse_mon_status() - ath12k_dp_rx_reap_mon_status_ring() - ath12k_dp_mon_parse_rx_dest() - ath12k_dp_rx_mon_buf_done() - ath12k_dp_rx_mon_dest_process() - ath12k_dp_mon_rx_memset_ppdu_info() Export helper functions required by the Wi-Fi 7 monitor path. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 Signed-off-by: Alok Singh <quic_aloksing@quicinc.com> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Link: https://patch.msgid.link/20251110103713.3484779-3-quic_aloksing@quicinc.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-11-11wifi: ath12k: Move monitor ring processing to Wi-Fi 7 moduleAlok Singh
Separate Wi-Fi 7-specific monitor-mode processing from common ath12k data path code to improve modularity. Move monitor status ring processing to wifi7/dp_mon.c: - ath12k_dp_mon_srng_process() - __ath12k_dp_mon_process_ring() - ath12k_dp_mon_process_ring() Rename the above to use the ath12k_wifi7_ prefix and export helper functions required by the ath12k_wifi7 module. Update the Wi-Fi 7 module Makefile to build dp_mon.o. No functional changes are intended; this is preparatory refactoring to isolate Wi-Fi 7 monitor-mode code from shared ath12k code. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 Signed-off-by: Alok Singh <quic_aloksing@quicinc.com> Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com> Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com> Link: https://patch.msgid.link/20251110103713.3484779-2-quic_aloksing@quicinc.com Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-11-11ntfs3: fix double free of sbi->options->nls and clarify ownership of ↵YangWen
fc->fs_private commit 02f312754c87 ("ntfs3: fix use-after-free of sbi->options in cmp_fnames") introduced a use-after-free bug due to improper handling of sbi->options in error paths. This resulted in crashes when superblock cleanup is performed in ntfs_put_super. This patch ensures that the options structure and its subfields are properly freed, preventing the memory corruption and use-after-free errors. Fixes: 02f312754c87 ("ntfs3: fix use-after-free of sbi->options in cmp_fnames") Reported-by: syzbot+cc433e4cd6d54736bf80@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=cc433e4cd6d54736bf80 Signed-off-by: YangWen <anmuxixixi@gmail.com> [almaz.alexandrovich@paragon-software.com: added fixes and closes tags] Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
2025-11-11fs/ntfs3: Initialize allocated memory before useBartlomiej Kubik
KMSAN reports: Multiple uninitialized values detected: - KMSAN: uninit-value in ntfs_read_hdr (3) - KMSAN: uninit-value in bcmp (3) Memory is allocated by __getname(), which is a wrapper for kmem_cache_alloc(). This memory is used before being properly cleared. Change kmem_cache_alloc() to kmem_cache_zalloc() to properly allocate and clear memory before use. Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") Fixes: 78ab59fee07f ("fs/ntfs3: Rework file operations") Tested-by: syzbot+332bd4e9d148f11a87dc@syzkaller.appspotmail.com Reported-by: syzbot+332bd4e9d148f11a87dc@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=332bd4e9d148f11a87dc Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block") Fixes: 78ab59fee07f ("fs/ntfs3: Rework file operations") Tested-by: syzbot+0399100e525dd9696764@syzkaller.appspotmail.com Reported-by: syzbot+0399100e525dd9696764@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0399100e525dd9696764 Reviewed-by: Khalid Aziz <khalid@kernel.org> Signed-off-by: Bartlomiej Kubik <kubik.bartlomiej@gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
2025-11-11fuse: fix readahead reclaim deadlockJoanne Koong
Commit e26ee4efbc79 ("fuse: allocate ff->release_args only if release is needed") skips allocating ff->release_args if the server does not implement open. However in doing so, fuse_prepare_release() now skips grabbing the reference on the inode, which makes it possible for an inode to be evicted from the dcache while there are inflight readahead requests. This causes a deadlock if the server triggers reclaim while servicing the readahead request and reclaim attempts to evict the inode of the file being read ahead. Since the folio is locked during readahead, when reclaim evicts the fuse inode and fuse_evict_inode() attempts to remove all folios associated with the inode from the page cache (truncate_inode_pages_range()), reclaim will block forever waiting for the lock since readahead cannot relinquish the lock because it is itself blocked in reclaim: >>> stack_trace(1504735) folio_wait_bit_common (mm/filemap.c:1308:4) folio_lock (./include/linux/pagemap.h:1052:3) truncate_inode_pages_range (mm/truncate.c:336:10) fuse_evict_inode (fs/fuse/inode.c:161:2) evict (fs/inode.c:704:3) dentry_unlink_inode (fs/dcache.c:412:3) __dentry_kill (fs/dcache.c:615:3) shrink_kill (fs/dcache.c:1060:12) shrink_dentry_list (fs/dcache.c:1087:3) prune_dcache_sb (fs/dcache.c:1168:2) super_cache_scan (fs/super.c:221:10) do_shrink_slab (mm/shrinker.c:435:9) shrink_slab (mm/shrinker.c:626:10) shrink_node (mm/vmscan.c:5951:2) shrink_zones (mm/vmscan.c:6195:3) do_try_to_free_pages (mm/vmscan.c:6257:3) do_swap_page (mm/memory.c:4136:11) handle_pte_fault (mm/memory.c:5562:10) handle_mm_fault (mm/memory.c:5870:9) do_user_addr_fault (arch/x86/mm/fault.c:1338:10) handle_page_fault (arch/x86/mm/fault.c:1481:3) exc_page_fault (arch/x86/mm/fault.c:1539:2) asm_exc_page_fault+0x22/0x27 Fix this deadlock by allocating ff->release_args and grabbing the reference on the inode when preparing the file for release even if the server does not implement open. The inode reference will be dropped when the last reference on the fuse file is dropped (see fuse_file_put() -> fuse_release_end()). Fixes: e26ee4efbc79 ("fuse: allocate ff->release_args only if release is needed") Cc: stable@vger.kernel.org Signed-off-by: Joanne Koong <joannelkoong@gmail.com> Reported-by: Omar Sandoval <osandov@fb.com> Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
2025-11-11clk: imx: imx8mp-audiomix: use devm_auxiliary_device_create() to simple codePeng Fan
Use helper function devm_auxiliary_device_create() to remove some boilerplate code. Reviewed-by: Abel Vesa <abel.vesa@linaro.org> Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com> Reviewed-by: Shengjiu Wang <shengjiu.wang@gmail.com> Link: https://lore.kernel.org/r/20251024-auxiliary-v2-1-a353dc9e6b1a@nxp.com Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
2025-11-11clk: imx: Add some delay before deassert the resetJacky Bai
Some of the PCCs on i.MX8ULP have a sw_rst bit to control the peripheral reset through SW method. For peripherals like GPU that need sync reset, some delay is necessary befere & after release the reset to make sure the HW is reset into a known status. So add some delay before & after release reset. Signed-off-by: Jacky Bai <ping.bai@nxp.com> Reviewed-by: Peng Fan <peng.fan@nxp.com> Link: https://lore.kernel.org/r/20250801072153.1974428-1-ping.bai@nxp.com Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
2025-11-11scripts: headers_install.sh: Remove two outdated config leak ignore entriesNicolas Schier
Remove config leak ignore entries for arch/arc/include/uapi/asm/page.h as they have been removed in commit d3e5bab923d3 ("arch: simplify architecture specific page size configuration"). Reviewed-by: Nathan Chancellor <nathan@kernel.org> Link: https://patch.msgid.link/20251105-update-headers-install-config-leak-ignore-list-v1-1-40be3eed68cb@kernel.org Signed-off-by: Nicolas Schier <nsc@kernel.org>
2025-11-11ublk: return unsigned from ublk_{,un}map_io()Caleb Sander Mateos
ublk_map_io() and ublk_unmap_io() never return negative values, and their return values are stored in variables of type unsigned. Clarify that they can't fail by making their return types unsigned. Signed-off-by: Caleb Sander Mateos <csander@purestorage.com> Reviewed-by: Ming Lei <ming.lei@redhat.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-11-11ublk: remove unnecessary checks in ublk_check_and_get_req()Caleb Sander Mateos
ub = iocb->ki_filp->private_data cannot be NULL, as it's set in ublk_ch_open() before it returns succesfully. req->mq_hctx cannot be NULL as any inflight ublk request must belong to some queue. And req->mq_hctx->driver_data cannot be NULL as it's set to the ublk_queue pointer in ublk_init_hctx(). So drop the unnecessary checks. Signed-off-by: Caleb Sander Mateos <csander@purestorage.com> Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com> Reviewed-by: Ming Lei <ming.lei@redhat.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-11-11io_uring: move flags check to io_uring_sanitise_paramsPavel Begunkov
io_uring_sanitise_params() sanitises most of the setup flags invariants, move the IORING_SETUP_FLAGS check from io_uring_setup() into it. Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-11-11io_uring: use mem_is_zero to check ring paramsPavel Begunkov
mem_is_zero() does the job without hand rolled loops, use that to verify reserved fields of ring params. Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-11-11io_uring: pass sq entries in the params structPavel Begunkov
There is no need to pass the user requested number of SQ entries separately from the main parameter structure io_uring_params. Initialise it at the beginning and stop passing it in favour of struct io_uring_params::sq_entries. Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-11-11io_uring: add helper calculating region byte sizePavel Begunkov
There has been type related issues with region size calculation, add an utility helper function that returns the size and handles type conversions right. Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-11-11io_uring/query: buffer size calculations with a unionPavel Begunkov
Instead of having an array of a calculated size as a buffer, put all query uapi structures into a union and pass that around. That way everything is well typed, and the compiler will prevent opcode handling using a structure not accounted into the buffer size. Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-11-11io_uring/zcrx: call netdev_queue_get_dma_dev() under instance lockDavid Wei
netdev ops must be called under instance lock or rtnl_lock, but io_register_zcrx_ifq() isn't doing this for netdev_queue_get_dma_dev(). Fix this by taking the instance lock using netdev_get_by_index_lock(). Extended the instance lock section to include attaching a memory provider. Could not move io_zcrx_create_area() outside, since the dmabuf codepath IORING_ZCRX_AREA_DMABUF requires ifq->dev. Fixes: 59b8b32ac8d4 ("io_uring/zcrx: add support for custom DMA devices") Signed-off-by: David Wei <dw@davidwei.uk> Reviewed-by: Pavel Begunkov <asml.silence@gmail.com> Reviewed-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-11-11net: export netdev_get_by_index_lock()David Wei
Need to call netdev_get_by_index_lock() from io_uring/zcrx.c, but it is currently private to net. Export the function in linux/netdevice.h. Signed-off-by: David Wei <dw@davidwei.uk> Acked-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-11-11block: add lockdep to queue_limits_commit_update()Chaitanya Kulkarni
queue_limits_commit_update() expects q->limits_lock to be held by the caller (via queue_limits_start_update()). The API pattern is: lim = queue_limits_start_update(q); /* acquires lock */ /* modify lim */ queue_limits_commit_update(q, &lim); /* releases lock */ OR queue_limits_commit_update_frozen(q, &lim); lim = queue_limits_start_update(q); /* acquires lock */ queue_limits_commit_update(q, &lim); /* releases lock */ Add lockdep_assert_held() to report incorrect API usage. Signed-off-by: Chaitanya Kulkarni <ckulkarnilinux@gmail.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-11-11nbd: defer config unlock in nbd_genl_connectZheng Qixing
There is one use-after-free warning when running NBD_CMD_CONNECT and NBD_CLEAR_SOCK: nbd_genl_connect nbd_alloc_and_init_config // config_refs=1 nbd_start_device // config_refs=2 set NBD_RT_HAS_CONFIG_REF open nbd // config_refs=3 recv_work done // config_refs=2 NBD_CLEAR_SOCK // config_refs=1 close nbd // config_refs=0 refcount_inc -> uaf ------------[ cut here ]------------ refcount_t: addition on 0; use-after-free. WARNING: CPU: 24 PID: 1014 at lib/refcount.c:25 refcount_warn_saturate+0x12e/0x290 nbd_genl_connect+0x16d0/0x1ab0 genl_family_rcv_msg_doit+0x1f3/0x310 genl_rcv_msg+0x44a/0x790 The issue can be easily reproduced by adding a small delay before refcount_inc(&nbd->config_refs) in nbd_genl_connect(): mutex_unlock(&nbd->config_lock); if (!ret) { set_bit(NBD_RT_HAS_CONFIG_REF, &config->runtime_flags); + printk("before sleep\n"); + mdelay(5 * 1000); + printk("after sleep\n"); refcount_inc(&nbd->config_refs); nbd_connect_reply(info, nbd->index); } Fixes: e46c7287b1c2 ("nbd: add a basic netlink interface") Signed-off-by: Zheng Qixing <zhengqixing@huawei.com> Reviewed-by: Yu Kuai <yukuai@fnnas.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-11-11mlx5: Fix default values in create CQAkiva Goldberger
Currently, CQs without a completion function are assigned the mlx5_add_cq_to_tasklet function by default. This is problematic since only user CQs created through the mlx5_ib driver are intended to use this function. Additionally, all CQs that will use doorbells instead of polling for completions must call mlx5_cq_arm. However, the default CQ creation flow leaves a valid value in the CQ's arm_db field, allowing FW to send interrupts to polling-only CQs in certain corner cases. These two factors would allow a polling-only kernel CQ to be triggered by an EQ interrupt and call a completion function intended only for user CQs, causing a null pointer exception. Some areas in the driver have prevented this issue with one-off fixes but did not address the root cause. This patch fixes the described issue by adding defaults to the create CQ flow. It adds a default dummy completion function to protect against null pointer exceptions, and it sets an invalid command sequence number by default in kernel CQs to prevent the FW from sending an interrupt to the CQ until it is armed. User CQs are responsible for their own initialization values. Callers of mlx5_core_create_cq are responsible for changing the completion function and arming the CQ per their needs. Fixes: cdd04f4d4d71 ("net/mlx5: Add support to create SQ and CQ for ASO") Signed-off-by: Akiva Goldberger <agoldberger@nvidia.com> Reviewed-by: Moshe Shemesh <moshe@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Acked-by: Leon Romanovsky <leon@kernel.org> Link: https://patch.msgid.link/1762681743-1084694-1-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-11-11Bluetooth: btrtl: Avoid loading the config file on security chipsMax Chou
For chips with security enabled, it's only possible to load firmware with a valid signature pattern. If key_id is not zero, it indicates a security chip, and the driver will not load the config file. - Example log for a security chip. Bluetooth: hci0: RTL: examining hci_ver=0c hci_rev=000a lmp_ver=0c lmp_subver=8922 Bluetooth: hci0: RTL: rom_version status=0 version=1 Bluetooth: hci0: RTL: btrtl_initialize: key id 1 Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_fw.bin Bluetooth: hci0: RTL: cfg_sz 0, total sz 71301 Bluetooth: hci0: RTL: fw version 0x41c0c905 - Example log for a normal chip. Bluetooth: hci0: RTL: examining hci_ver=0c hci_rev=000a lmp_ver=0c lmp_subver=8922 Bluetooth: hci0: RTL: rom_version status=0 version=1 Bluetooth: hci0: RTL: btrtl_initialize: key id 0 Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_fw.bin Bluetooth: hci0: RTL: loading rtl_bt/rtl8922au_config.bin Bluetooth: hci0: RTL: cfg_sz 6, total sz 71307 Bluetooth: hci0: RTL: fw version 0x41c0c905 Tested-by: Hilda Wu <hildawu@realtek.com> Signed-off-by: Nial Ni <niall_ni@realsil.com.cn> Signed-off-by: Max Chou <max.chou@realtek.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
2025-11-11Merge branch 'mlx5e-misc-fixes-2025-11-09'Paolo Abeni
Tariq Toukan says: ==================== mlx5e misc fixes 2025-11-09 This patchset provides misc bug fixes from the team to the mlx5 Eth driver. ==================== Link: https://patch.msgid.link/1762681073-1084058-1-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-11-11net/mlx5e: Fix potentially misleading debug messageGal Pressman
Change the debug message to print the correct units instead of always assuming Gbps, as the value can be in either 100 Mbps or 1 Gbps units. Fixes: 5da8bc3effb6 ("net/mlx5e: DCBNL, Add debug messages log") Signed-off-by: Gal Pressman <gal@nvidia.com> Reviewed-by: Nimrod Oren <noren@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/1762681073-1084058-6-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-11-11net/mlx5e: Fix wraparound in rate limiting for values above 255 GbpsGal Pressman
Add validation to reject rates exceeding 255 Gbps that would overflow the 8 bits max bandwidth field. Fixes: d8880795dabf ("net/mlx5e: Implement DCBNL IEEE max rate") Signed-off-by: Gal Pressman <gal@nvidia.com> Reviewed-by: Nimrod Oren <noren@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/1762681073-1084058-5-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-11-11net/mlx5e: Fix maxrate wraparound in threshold between unitsGal Pressman
The previous calculation used roundup() which caused an overflow for rates between 25.5Gbps and 26Gbps. For example, a rate of 25.6Gbps would result in using 100Mbps units with value of 256, which would overflow the 8 bits field. Simplify the upper_limit_mbps calculation by removing the unnecessary roundup, and adjust the comparison to use <= to correctly handle the boundary condition. Fixes: d8880795dabf ("net/mlx5e: Implement DCBNL IEEE max rate") Signed-off-by: Gal Pressman <gal@nvidia.com> Reviewed-by: Nimrod Oren <noren@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/1762681073-1084058-4-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-11-11net/mlx5e: Trim the length of the num_doorbell errorCosmin Ratiu
When trying to set num_doorbells to a value greater than the max number of channels, the error message was going over the netlink limit of 80 chars, truncating the most important part of the message, the number of channels. Fix that by trimming the length a bit. Fixes: 11bbcfb7668c ("net/mlx5e: Use the 'num_doorbells' devlink param") Signed-off-by: Cosmin Ratiu <cratiu@nvidia.com> Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/1762681073-1084058-3-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-11-11net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state()Carolina Jubran
Assign the return value of mlx5_eswitch_block_mode() to 'err' before checking it to avoid returning an uninitialized error code. Fixes: 22239eb258bc ("net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed") Reported-by: kernel test robot <lkp@intel.com> Reported-by: Dan Carpenter <dan.carpenter@linaro.org> Closes: https://lore.kernel.org/r/202510271649.uwsIxD6O-lkp@intel.com/ Closes: http://lore.kernel.org/linux-rdma/aPIEK4rLB586FdDt@stanley.mountain/ Signed-off-by: Carolina Jubran <cjubran@nvidia.com> Reviewed-by: Jianbo Liu <jianbol@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/1762681073-1084058-2-git-send-email-tariqt@nvidia.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2025-11-11Merge branch 'net-sched-initialize-struct-tc_ife-to-fix-kernel-infoleak'Paolo Abeni
Ranganath says: ==================== net: sched: initialize struct tc_ife to fix kernel-infoleak This series addresses the uninitialization of the struct which has 2 bytes of padding. And copying this uninitialized data to userspace can leak info from kernel memory. This series ensures all members and padding are cleared prior to begin copied. This change silences the KMSAN report and prevents potential information leaks from the kernel memory. v3: https://lore.kernel.org/lkml/20251106195635.2438-1-vnranganath.20@gmail.com/#t v2: https://lore.kernel.org/r/20251101-infoleak-v2-0-01a501d41c09@gmail.com v1: https://lore.kernel.org/r/20251031-infoleak-v1-1-9f7250ee33aa@gmail.com Signed-off-by: Ranganath V N <vnranganath.20@gmail.com> Acked-by: Cong Wang <xiyou.wangcong@gmail.com> ==================== Link: https://patch.msgid.link/20251109091336.9277-1-vnranganath.20@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
generated by cgit v1.3 (git 2.53.0) at 2026-11-06 20:06:25 +0000