summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-01-26platform/x86: lg-laptop: Recognize 2022-2025 modelsJonas Ringeis
The lg-laptop driver uses the DMI to identify the product year. Currently, the driver recognizes all models released after 2022 incorrectly as 2022. Update logic to handle model identifiers for years 2022-2025. Link: https://en.wikipedia.org/w/index.php?title=LG_Gram&oldid=1327931565#Comparison_of_Gram_models Signed-off-by: Jonas Ringeis <private@glitchdev.me> Link: https://patch.msgid.link/20260123225503.493467-1-private@glitchdev.me Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-01-26ARM: dts: samsung: Drop s3c6400.dtsiRob Herring (Arm)
This .dtsi file is not included anywhere in the tree and can't be tested. Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Link: https://patch.msgid.link/20251212203226.458694-7-robh@kernel.org Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org> Link: https://lore.kernel.org/r/20260117182257.14799-2-krzk@kernel.org Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-01-26ARM: dts: nuvoton: Minor whitespace cleanupKrzysztof Kozlowski
The DTS code coding style expects exactly one space around '=' character. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Link: https://patch.msgid.link/20250819131725.86770-3-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org> Link: https://lore.kernel.org/r/20260117182117.14483-4-krzk@kernel.org Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-01-26platform/x86/amd/pmc: Add quirk for MECHREVO Wujie 15X Progongqi
The MECHREVO Wujie 15X Pro suffers from spurious IRQ issues related to the AMD PMC. Add it to the quirk list to use the spurious_8042 fix. Signed-off-by: gongqi <550230171hxy@gmail.com> Link: https://patch.msgid.link/20260122155501.376199-4-550230171hxy@gmail.com Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-01-26Merge tag 'samsung-dt64-6.20' of ↵Arnd Bergmann
https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/dt Samsung DTS ARM64 changes for v6.20 1. ExynosAutov920: - Add MFD clock controller node. 2. Google GS101: - Add True Random Number Generator (TRNG) and OTP nvmem nodes. - Correct the PMU (Power Management Unit) compatibles by dropping fallback to syscon. The PMU on Samsung devices serves the role of syscon, however on GS101 it cannot be used via standard Linux syscon interface, because register accesses require custom regmap. It was simply never correctly working with "syscon" compatible fallback. - Add phandles to System Registers SYSREG blocks in clock controllers, necessary for enabling automatic clock control later. * tag 'samsung-dt64-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: arm64: dts: exynos: gs101: add OTP node arm64: dts: exynos: gs101: add samsung,sysreg property to CMU nodes arm64: dts: exynosautov920: add CMU_MFD clock DT nodes arm64: dts: exynos: gs101: remove syscon compatible from pmu node dt-bindings: soc: samsung: exynos-pmu: remove syscon for google,gs101-pmu arm64: dts: exynos: gs101: add TRNG node dt-bindings: rng: add google,gs101-trng compatible Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-01-26platform/x86: intel_telemetry: Fix PSS event register maskKaushlendra Kumar
The PSS telemetry info parsing incorrectly applies TELEM_INFO_SRAMEVTS_MASK when extracting event register count from firmware response. This reads bits 15-8 instead of the correct bits 7-0, causing misdetection of hardware capabilities. The IOSS path correctly uses TELEM_INFO_NENABLES_MASK for register count. Apply the same mask to PSS parsing for consistency. Fixes: 9d16b482b059 ("platform:x86: Add Intel telemetry platform driver") Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com> Link: https://patch.msgid.link/20251224061144.3925519-1-kaushlendra.kumar@intel.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-01-26platform/x86: intel_telemetry: Fix swapped arrays in PSS outputKaushlendra Kumar
The LTR blocking statistics and wakeup event counters are incorrectly cross-referenced during debugfs output rendering. The code populates pss_ltr_blkd[] with LTR blocking data and pss_s0ix_wakeup[] with wakeup data, but the display loops reference the wrong arrays. This causes the "LTR Blocking Status" section to print wakeup events and the "Wakes Status" section to print LTR blockers, misleading power management analysis and S0ix residency debugging. Fix by aligning array usage with the intended output section labels. Fixes: 87bee290998d ("platform:x86: Add Intel Telemetry Debugfs interfaces") Cc: stable@vger.kernel.org Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com> Link: https://patch.msgid.link/20251224032053.3915900-1-kaushlendra.kumar@intel.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-01-26platform/x86/intel/vsec: Add Nova Lake PUNIT supportDavid E. Box
Add PCI ID for Nova Lake, supporting PUNIT telemetry. Signed-off-by: David E. Box <david.e.box@linux.intel.com> Link: https://patch.msgid.link/20260122022110.3231344-1-david.e.box@linux.intel.com Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-01-26Merge tag 'dt64-cleanup-6.20' of ↵Arnd Bergmann
https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-dt into soc/dt Minor improvements in ARM64 DTS for v6.20 Several minor cleanups for Nuvoton, LG, Spreadtrum, Toshiba, Cavium, ARM and APM SoCs: 1. Switch to recommended node names by fixing style (s/lowercase/hyphen/), using generic naming and adhering to DT bindings. 2. Use consistent whitespaces around. 3. Add missing properties like UART clocks (Cavium Thunder 88xx) or "reg" (APM). 4. Drop incorrect or long time deprecated propeties. 5. Correct clock cells to 0 for fixed-factor-clock clocks. * tag 'dt64-cleanup-6.20' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-dt: arm64: dts: apm: Drop "dma" device_type arm64: dts: apm: Add "reg" to "syscon-reboot" and "syscon-poweroff" arm64: dts: apm: Use recommended i2c node names arm64: dts: apm/shadowcat: More clock clean-ups ARM: dts: vexpress/v2m-rs1: Use documented arm,vexpress,config-bus child node names arm64: dts: cavium: Drop thunder2 arm64: dts: cavium: thunder-88xx: Add missing PL011 "uartclk" arm64: dts: toshiba: Use recommended node names arm64: dts: sprd: Use recommended node names arm64: dts: lg: Use recommended simple-bus node name arm64: dts: nuvoton: npcm845: Minor whitespace cleanup arm64: dts: toshiba: tmpv7708: Align node names with DT bindings Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-01-26platform/x86: toshiba_haps: Fix memory leaks in add/remove routinesRafael J. Wysocki
toshiba_haps_add() leaks the haps object allocated by it if it returns an error after allocating that object successfully. toshiba_haps_remove() does not free the object pointed to by toshiba_haps before clearing that pointer, so it becomes unreachable allocated memory. Address these memory leaks by using devm_kzalloc() for allocating the memory in question. Fixes: 23d0ba0c908a ("platform/x86: Toshiba HDD Active Protection Sensor") Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-01-26platform/x86: panasonic-laptop: Fix sysfs group leak in error pathRafael J. Wysocki
The acpi_pcc_hotkey_add() error path leaks sysfs group pcc_attr_group if platform_device_register_simple() fails for the "panasonic" platform device. Address this by making it call sysfs_remove_group() in that case for the group in question. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/3398370.44csPzL39Z@rafael.j.wysocki Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-01-26Merge tag 'renesas-dts-for-v6.20-tag2' of ↵Arnd Bergmann
git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/dt Renesas DTS updates for v6.20 (take two) - Add cpufreq, thermal, GPIO IRQ, and CAN-FD support for the RZ/T2H and RZ/N2H SoCs and their EVK boards, - Add more serial (RSCI) and CAN-FD support for the RZ/V2H and RZ/V2N SoCs, - Drop unused .dtsi files, - Add I3C support for the RZ/G3E SMARC SoM, - Add GPIO support for the RZ/N1 SoC, - Miscellaneous fixes and improvements. * tag 'renesas-dts-for-v6.20-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: (27 commits) arm64: dts: renesas: rzt2h-rzn2h-evk: Reorder ADC nodes ARM: dts: r9a06g032: Add support for GPIO interrupts ARM: dts: r9a06g032: Add GPIO controllers arm64: dts: renesas: rzg3e-smarc-som: Enable I3C support arm64: dts: renesas: Use lowercase hex arm64: dts: renesas: Use hyphens in node names arm/arm64: dts: renesas: Drop unused .dtsi arm64: dts: renesas: rzt2h-n2h-evk-common: Use GPIO for SD0 write protect arm64: dts: renesas: r9a09g057: Add CANFD node arm64: dts: renesas: r9a09g056: Add CANFD node arm64: dts: renesas: r9a09g087m44-rzn2h-evk: Enable CANFD arm64: dts: renesas: r9a09g077m44-rzt2h-evk: Enable CANFD arm64: dts: renesas: r9a09g087: Add CANFD node arm64: dts: renesas: r9a09g077: Add CANFD node arm64: dts: renesas: r9a09g057: Add RSCI nodes arm64: dts: renesas: r9a09g056: Add RSCI nodes arm64: dts: renesas: r9a09g087m44-rzn2h-evk: Add GPIO keys arm64: dts: renesas: r9a09g077m44-rzt2h-evk: Add GPIO keys arm64: dts: renesas: r9a09g087: Add GPIO IRQ support arm64: dts: renesas: r9a09g077: Add GPIO IRQ support ... Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-01-26dm: use bio_clone_blkg_associationMikulas Patocka
The origin bio carries blk-cgroup information which could be set from foreground(task_css(css) - wbc->wb->blkcg_css), so the blkcg won't control buffer io since commit ca522482e3eaf ("dm: pass NULL bdev to bio_alloc_clone"). The synchronous io is still under control by blkcg, because 'bio->bi_blkg' is set by io submitting task which has been added into 'cgroup.procs'. Fix it by using bio_clone_blkg_association when submitting a cloned bio. Link: https://bugzilla.kernel.org/show_bug.cgi?id=220985 Fixes: ca522482e3eaf ("dm: pass NULL bdev to bio_alloc_clone") Reported-by: Zhihao Cheng <chengzhihao1@huawei.com> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Tested-by: Zhihao Cheng <chengzhihao1@huawei.com>
2026-01-26Merge tag 'renesas-dt-bindings-for-v6.20-tag1' of ↵Arnd Bergmann
git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/dt Renesas DT binding updates for v6.20 - Document the RZ/N1 GPIO Interrupt Multiplexer. * tag 'renesas-dt-bindings-for-v6.20-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: dt-bindings: soc: renesas: Document RZ/N1 GPIO Interrupt Multiplexer Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-01-26kselftest/arm64: Add missing file in .gitignoreI-Hsin Cheng
The binary generated by check_hugetlb_options is missing in .gitignore under the directory. Add it into the file so it won't be logged into version control. Signed-off-by: I-Hsin Cheng <richard120310@gmail.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-01-26KVM: nVMX: Remove explicit filtering of GUEST_INTR_STATUS from shadow VMCS ↵Sean Christopherson
fields Drop KVM's filtering of GUEST_INTR_STATUS when generating the shadow VMCS bitmap now that KVM drops GUEST_INTR_STATUS from the set of supported vmcs12 fields if the field isn't supported by hardware, and initialization of the shadow VMCS fields omits unsupported vmcs12 fields. Note, there is technically a small functional change here, as the vmcs12 filtering only requires support for Virtual Interrupt Delivery, whereas the shadow VMCS code being removed required "full" APICv support, i.e. required Virtual Interrupt Delivery *and* APIC Register Virtualizaton *and* Posted Interrupt support. Opportunistically tweak the comment to more precisely explain why the PML and VMX preemption timer fields need to be explicitly checked. Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com> Link: https://patch.msgid.link/20260115173427.716021-5-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-01-26KVM: nVMX: Disallow access to vmcs12 fields that aren't supported by "hardware"Sean Christopherson
Disallow access (VMREAD/VMWRITE), both emulated and via a shadow VMCS, to VMCS fields that the loaded incarnation of KVM doesn't support, e.g. due to lack of hardware support, as a middle ground between allowing access to any vmcs12 field defined by KVM (current behavior) and gating access based on the userspace-defined vCPU model (the most functionally correct, but very costly, implementation). Disallowing access to unsupported fields helps a tiny bit in terms of closing the virtualization hole (see below), but the main motivation is to avoid having to weed out unsupported fields when synchronizing between vmcs12 and a shadow VMCS. Because shadow VMCS accesses are done via VMREAD and VMWRITE, KVM _must_ filter out unsupported fields (or eat VMREAD/VMWRITE failures), and filtering out just shadow VMCS fields is about the same amount of effort, and arguably much more confusing. As a bonus, this also fixes a KVM-Unit-Test failure bug when running on _hardware_ without support for TSC Scaling, which fails with the same signature as the bug fixed by commit ba1f82456ba8 ("KVM: nVMX: Dynamically compute max VMCS index for vmcs12"): FAIL: VMX_VMCS_ENUM.MAX_INDEX expected: 19, actual: 17 Dynamically computing the max VMCS index only resolved the issue where KVM was hardcoding max index, but for CPUs with TSC Scaling, that was "good enough". Reviewed-by: Chao Gao <chao.gao@intel.com> Reviewed-by: Xin Li <xin@zytor.com> Cc: Xiaoyao Li <xiaoyao.li@intel.com> Cc: Yosry Ahmed <yosry.ahmed@linux.dev> Link: https://lore.kernel.org/all/20251026201911.505204-22-xin@zytor.com Link: https://lore.kernel.org/all/YR2Tf9WPNEzrE7Xg@google.com Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com> Link: https://patch.msgid.link/20260115173427.716021-4-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-01-26platform/wmi: string-kunit: Add missing oversized string test caseArmin Wolf
When compiling the WMI string kunit tests using llvm, the compiler will issue a warning about "oversized_test_utf8_string" being unused. This happens because the test case that was supposed to use said variable was accidentally omitted when adding the kunit tests. Fix this by adding the aforementioned test case. Fixes: 0e1a8143e797 ("platform/wmi: Add kunit test for the string conversion code") Reported-by: Nathan Chancellor <nathan@kernel.org> Closes: https://lore.kernel.org/platform-driver-x86/20260122234521.GA413183@ax162/ Signed-off-by: Armin Wolf <W_Armin@gmx.de> Link: https://patch.msgid.link/20260123211537.4448-1-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-01-26platform/x86/amd/pmf: Added a module parameter to disable the Smart PC functionAlexey Zagorodnikov
Addresses a low power limits issue on HP ZBook Ultra G1a. If vendor firmware capped APU power limits with 3rd-party AC adapters, the user can disable the Smart PC function via the module parameter Link: https://gitlab.freedesktop.org/drm/amd/-/issues/4868 [1] Signed-off-by: Alexey Zagorodnikov <xglooom@gmail.com> Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Link: https://patch.msgid.link/20260121143519.12318-1-xglooom@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-01-26drm/xe: derive mem copy capability from graphics versionNitin Gote
Drop .has_mem_copy_instr from the platform descriptors and set it in xe_info_init() after handle_gmdid() populates graphics_verx100. Centralizing the GRAPHICS_VER(xe) >= 20 check keeps MEM_COPY enabled on Xe2+ and removes redundant per-platform plumbing. Bspec: 57561 Fixes: 1e12dbae9d72 ("drm/xe/migrate: support MEM_COPY instruction") Cc: Matt Roper <matthew.d.roper@intel.com> Reviewed-by: Matthew Auld <matthew.auld@intel.com> Suggested-by: Matthew Auld <matthew.auld@intel.com> Signed-off-by: Nitin Gote <nitin.r.gote@intel.com> Link: https://patch.msgid.link/20260120054724.1982608-2-nitin.r.gote@intel.com Signed-off-by: Tejas Upadhyay <tejas.upadhyay@intel.com> (cherry picked from commit 6ef02656c3222b1e12032a40d644ed56806b14fc) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-01-26platform/x86/uniwill: Implement cTGP settingWerner Sembach
Uniwill offers user setable cTGP for their EC on devices using NVIDIA 3000 Series and newer GPUs. This patch implements this setting as a sysfs attribute. For one device, the TUXEDO InfinityBook Gen7, the variant with and without NVIDIA GPU can't be differentiated using only the DMI strings, so the new probe callback needs to be used to test a bit from the EC memory. Co-developed-by: Armin Wolf <W_Armin@gmx.de> Signed-off-by: Armin Wolf <W_Armin@gmx.de> Signed-off-by: Werner Sembach <wse@tuxedocomputers.com> Reviewed-by: Armin Wolf <W_Armin@gmx.de> Link: https://patch.msgid.link/20260115154332.402873-2-wse@tuxedocomputers.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-01-26platform/x86: uniwill-laptop: Introduce device descriptor systemArmin Wolf
Future additions to the driver will depend on device-specific initialization steps. Extend the DMI-based feature detection system to include device descriptors. Each descriptor contains a bitmap of supported features and a set of callback for performing device-specific initialization. Signed-off-by: Armin Wolf <W_Armin@gmx.de> Co-developed-by: Werner Sembach <wse@tuxedocomputers.com> Signed-off-by: Werner Sembach <wse@tuxedocomputers.com> Reviewed-by: Armin Wolf <W_Armin@gmx.de> Link: https://patch.msgid.link/20260115154332.402873-1-wse@tuxedocomputers.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-01-26drm/xe/xelp: Fix Wa_18022495364Tvrtko Ursulin
It looks I mistyped CS_DEBUG_MODE2 as CS_DEBUG_MODE1 when adding the workaround. Fix it. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Fixes: ca33cd271ef9 ("drm/xe/xelp: Add Wa_18022495364") Cc: Matt Roper <matthew.d.roper@intel.com> Cc: "Thomas Hellström" <thomas.hellstrom@linux.intel.com> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Cc: <stable@vger.kernel.org> # v6.18+ Reviewed-by: Matt Roper <matthew.d.roper@intel.com> Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> Link: https://patch.msgid.link/20260116095040.49335-1-tvrtko.ursulin@igalia.com (cherry picked from commit 7fe6cae2f7fad2b5166b0fc096618629f9e2ebcb) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-01-26drm/xe: Skip address copy for sync-only execsShuicheng Lin
For parallel exec queues, xe_exec_ioctl() copied the batch buffer address array from userspace without checking num_batch_buffer. If user creates a sync-only exec that doesn't use the address field, the exec will fail with -EFAULT. Add num_batch_buffer check to skip the copy, and the exec could be executed successfully. Here is the sync-only exec: struct drm_xe_exec exec = { .extensions = 0, .exec_queue_id = qid, .num_syncs = 1, .syncs = (uintptr_t)&sync, .address = 0, /* ignored for sync-only */ .num_batch_buffer = 0, /* sync-only */ }; Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: Matthew Brost <matthew.brost@intel.com> Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com> Reviewed-by: Matthew Brost <matthew.brost@intel.com> Signed-off-by: Matthew Brost <matthew.brost@intel.com> Link: https://patch.msgid.link/20260122214053.3189366-2-shuicheng.lin@intel.com (cherry picked from commit 4761791c1e736273d612ff564f318bfbbb04fa4e) Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
2026-01-26platform/x86/amd: Use scope-based cleanup for wbrf_record()Zilin Guan
Simplify resource management in wbrf_record() by using the scope-based cleanup helper __free(). This ensures that the tmp and obj are automatically freed when they go out of scope, eliminating the need for explicit error handling labels and manual freeing. Suggested-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Suggested-by: Markus Elfring <Markus.Elfring@web.de> Co-developed-by: Jianhao Xu <jianhao.xu@seu.edu.cn> Signed-off-by: Jianhao Xu <jianhao.xu@seu.edu.cn> Signed-off-by: Zilin Guan <zilin@seu.edu.cn> Link: https://patch.msgid.link/20260106091318.747019-2-zilin@seu.edu.cn Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-01-26Merge branch 'fixes' of into for-nextIlpo Järvinen
2026-01-26gfs2: Fix slab-use-after-free in qd_putAndreas Gruenbacher
Commit a475c5dd16e5 ("gfs2: Free quota data objects synchronously") started freeing quota data objects during filesystem shutdown instead of putting them back onto the LRU list, but it failed to remove these objects from the LRU list, causing LRU list corruption. This caused use-after-free when the shrinker (gfs2_qd_shrink_scan) tried to access already-freed objects on the LRU list. Fix this by removing qd objects from the LRU list before freeing them in qd_put(). Initial fix from Deepanshu Kartikey <kartikey406@gmail.com>. Fixes: a475c5dd16e5 ("gfs2: Free quota data objects synchronously") Reported-by: syzbot+046b605f01802054bff0@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=046b605f01802054bff0 Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2026-01-26gfs2: Introduce glock_{type,number,sbd} helpersAndreas Gruenbacher
Introduce glock_type(), glock_number(), and glock_sbd() helpers for accessing a glock's type, number, and super block pointer more easily. Created with Coccinelle using the following semantic patch: @@ struct gfs2_glock *gl; @@ - gl->gl_name.ln_type + glock_type(gl) @@ struct gfs2_glock *gl; @@ - gl->gl_name.ln_number + glock_number(gl) @@ struct gfs2_glock *gl; @@ - gl->gl_name.ln_sbd + glock_sbd(gl) glock_sbd() is a macro because it is used with const as well as non-const struct gfs2_glock * arguments. Instances in macro definitions, particularly in tracepoint definitions, replaced by hand. Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2026-01-26gfs2: gfs2_glock_hold cleanupAndreas Gruenbacher
Use lockref_get_not_dead() instead of an unguarded __lockref_is_dead() check. Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2026-01-26gfs: Use fixed GL_GLOCK_MIN_HOLD timeAndreas Gruenbacher
GL_GLOCK_MIN_HOLD represents the minimum time (in jiffies) that a glock should be held before being eligible for release. It is currently defined as 10, meaning that the duration depends on the timer interrupt frequency (CONFIG_HZ). Change that time to a constant 10ms independent of CONFIG_HZ. On CONFIG_HZ=1000 systems, the value remains the same. Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2026-01-26gfs2: Fix gfs2_log_get_bio argument typeAndreas Gruenbacher
Fix the type of gfs2_log_get_bio()'s op argument: callers pass in a blk_opf_t value and the function passes that value on as a blk_opf_t value, so the current argument type makes no sense. Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2026-01-26gfs2: gfs2_chain_bio start sector fixAndreas Gruenbacher
Pass the start sector into gfs2_chain_bio(): the new bio isn't necessarily contiguous with the previous one. Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2026-01-26gfs2: Initialize bio->bi_opf earlyAndreas Gruenbacher
Pass the right blk_opf_t value to bio_alloc() so that ->bi_ops is initialized correctly and doesn't have to be changed later. Adjust the call chain to pass that value through to where it is needed (and only there). Add a separate blk_opf_t argument to gfs2_chain_bio() instead of copying the value from the previous bio. Fixes: 8a157e0a0aa5 ("gfs2: Fix use of bio_chain") Reported-by: syzbot+f6539d4ce3f775aee0cc@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f6539d4ce3f775aee0cc Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2026-01-26gfs2: Rename gfs2_log_submit_{bio -> write}Andreas Gruenbacher
Rename gfs2_log_submit_bio() to gfs2_log_submit_write(): this function isn't used for submitting log reads. Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2026-01-26gfs2: Do not cancel internal demote requestsAndreas Gruenbacher
Trying to change the state of a glock may result in a "conversion deadlock" error, indicating that the requested state transition would cause a deadlock. In this case, we unlock and retry the state change. It makes no sense to try canceling those unlock requests, but the current code is not aware of that. In addition, if a locking request is canceled shortly after it is made, the cancelation request can currently overtake the locking request. This may result in deadlocks. Fix both of these bugs by repurposing the GLF_PENDING_REPLY flag into a GLF_MAY_CANCEL flag which is set only when the current locking request can be canceled. When trying to cancel a locking request in gfs2_glock_dq(), wait for this flag to be set. Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2026-01-26gfs2: run_queue cleanupAndreas Gruenbacher
In run_queue(), instead of always setting the GLF_LOCK flag, only set it when the flag is actually needed. This avoids having to undo the flag setting later. Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2026-01-26gfs2: Retries missing in gfs2_{rename,exchange}Andreas Gruenbacher
Fix a bug in gfs2's asynchronous glock handling for rename and exchange operations. The original async implementation from commit ad26967b9afa ("gfs2: Use async glocks for rename") mentioned that retries were needed but never implemented them, causing operations to fail with -ESTALE instead of retrying on timeout. Also makes the waiting interruptible. In addition, the timeouts used were too high for situations in which timing out is a rare but expected scenario. Switch to shorter timeouts with randomization and exponentional backoff. Fixes: ad26967b9afa ("gfs2: Use async glocks for rename") Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2026-01-26gfs2: glock cancelation flag fixAndreas Gruenbacher
When an asynchronous glock holder is dequeued that hasn't been granted yet (HIF_HOLDER not set) and no dlm operation is in progress on behalf of that holder (GLF_LOCK not set), the dequeuing takes place in __gfs2_glock_dq(). There, we are not clearing the HIF_WAIT flag and waking up waiters. Fix that. This bug prevents the same holder from being enqueued later (gfs2_glock_nq()) without first reinitializing it (gfs2_holder_reinit()). The code doesn't currently use this pattern, but this will change in the next commit. Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
2026-01-26Merge tag 'driver-core-6.19-rc7-deferred' into driver-core-nextDanilo Krummrich
Driver core fixes deferred from 6.19-rc7 [1, 2] were originally intended for -rc7. Patch [1] uncovered potential deadlocks that require a few driver fixes; [2] is one such fix. [1] https://patch.msgid.link/20260113162843.12712-1-hanguidong02@gmail.com [2] https://patch.msgid.link/20260121141215.29658-1-dakr@kernel.org Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-01-26RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_sendYi Liu
ib_uverbs_post_send() uses cmd.wqe_size from userspace without any validation before passing it to kmalloc() and using the allocated buffer as struct ib_uverbs_send_wr. If a user provides a small wqe_size value (e.g., 1), kmalloc() will succeed, but subsequent accesses to user_wr->opcode, user_wr->num_sge, and other fields will read beyond the allocated buffer, resulting in an out-of-bounds read from kernel heap memory. This could potentially leak sensitive kernel information to userspace. Additionally, providing an excessively large wqe_size can trigger a WARNING in the memory allocation path, as reported by syzkaller. This is inconsistent with ib_uverbs_unmarshall_recv() which properly validates that wqe_size >= sizeof(struct ib_uverbs_recv_wr) before proceeding. Add the same validation for ib_uverbs_post_send() to ensure wqe_size is at least sizeof(struct ib_uverbs_send_wr). Fixes: c3bea3d2dc53 ("RDMA/uverbs: Use the iterator for ib_uverbs_unmarshall_recv()") Signed-off-by: Yi Liu <liuy22@mails.tsinghua.edu.cn> Link: https://patch.msgid.link/20260122142900.2356276-2-liuy22@mails.tsinghua.edu.cn Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-01-26ata: libata-core: Quirk INTEL SSDSC2KG480G8 max_sectorsNiklas Cassel
Commit 9b8b84879d4a ("block: Increase BLK_DEF_MAX_SECTORS_CAP") increased the default max_sectors_kb from 1280 KiB to 4096 KiB. INTEL SSDSC2KG480G8 with FW rev XCV10120 times out when sending I/Os of size 4096 KiB. Enable ATA_QUIRK_MAX_SEC, with value 8191 (sectors) for this device, since any I/O with more sectors than that lead to I/O timeouts. With this, the INTEL SSDSC2KG480G8 is usable again. Link: https://lore.kernel.org/linux-ide/176839089913.2398366.61500945766820256@eldamar.lan/ Fixes: 9b8b84879d4a ("block: Increase BLK_DEF_MAX_SECTORS_CAP") Signed-off-by: Niklas Cassel <cassel@kernel.org> Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
2026-01-26Merge tag 'v6.19-rc7' into driver-core-nextDanilo Krummrich
We need the driver-core fixes in here as well to build on top of. Signed-off-by: Danilo Krummrich <dakr@kernel.org>
2026-01-26ASoC: fsl_sai: Add AUDMIX mode support on i.MX952Shengjiu Wang
One of SAI interfaces is connected to AUDMIX in the i.MX952 chip, but AUDMIX can be bypassed or not bypassed on the i.MX952 platform. There are three use cases: 1) SAI -> Codec (No AUDMIX between SAI and Codec) 2) SAI -> Codec (Has AUDMIX, but AUDMIX is bypassed) 3) SAI -> AUDMIX -> Codec (Has AUDMIX and used) So add 'fsl,sai-amix-mode' property for this feature fsl,sai-amix-mode = "none": is for case 1) fsl,sai-amix-mode = "bypass": is for case 2) fsl,sai-amix-mode = "audmix": is for case 3) Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com> Link: https://patch.msgid.link/20260123082501.4050296-5-shengjiu.wang@nxp.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-01-26ASoC: fsl_audmix: Add support for i.MX952 platformShengjiu Wang
Add compatible string to support AUDMIX on i.MX952 Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com> Link: https://patch.msgid.link/20260123082501.4050296-4-shengjiu.wang@nxp.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-01-26ASoC: dt-bindings: fsl,sai: Add AUDMIX mode support on i.MX952Shengjiu Wang
The SAI can connect to AUDMIX, but AUDMIX can be bypassed or not on i.MX952. There are three use cases: 1) SAI -> Codec (No AUDMIX between SAI and Codec) 2) SAI -> Codec (Has AUDMIX, but AUDMIX is bypassed) 3) SAI -> AUDMIX -> Codec (Has AUDMIX and used) So add 'fsl,sai-amix-mode' property for this feature fsl,sai-amix-mode = "none": is for case 1) fsl,sai-amix-mode = "bypass": is for case 2) fsl,sai-amix-mode = "audmix": is for case 3) Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com> Link: https://patch.msgid.link/20260123082501.4050296-3-shengjiu.wang@nxp.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-01-26ASoC: dt-bindings: fsl,audmix: Add support for i.MX952 platformShengjiu Wang
Add a compatible string for i.MX952 platform. There is a power domain on i.MX952 for the mix system of AUDMIX. But it is enabled by default, AUDMIX device don't need to enable it, so make the power-domains to be optional on i.MX952, and be required on i.MX8QM. Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20260123082501.4050296-2-shengjiu.wang@nxp.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-01-26drm: Do not allow userspace to trigger kernel warnings in ↵Tvrtko Ursulin
drm_gem_change_handle_ioctl() Since GEM bo handles are u32 in the uapi and the internal implementation uses idr_alloc() which uses int ranges, passing a new handle larger than INT_MAX trivially triggers a kernel warning: idr_alloc(): ... if (WARN_ON_ONCE(start < 0)) return -EINVAL; ... Fix it by rejecting new handles above INT_MAX and at the same time make the end limit calculation more obvious by moving into int domain. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com> Reported-by: Zhi Wang <wangzhi@stu.xidian.edu.cn> Fixes: 53096728b891 ("drm: Add DRM prime interface to reassign GEM handle") Cc: David Francis <David.Francis@amd.com> Cc: Felix Kuehling <felix.kuehling@amd.com> Cc: Christian König <christian.koenig@amd.com> Cc: <stable@vger.kernel.org> # v6.18+ Tested-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net> Link: https://lore.kernel.org/r/20260123141540.76540-1-tvrtko.ursulin@igalia.com
2026-01-26ASoC: soc-dapm: tidyup function namingKuninori Morimoto
Current soc-dapm is using random naming. Unified as dapm_xxx() for static functions. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87ecnlqgvn.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-01-26ASoC: soc-dapm: move struct snd_soc_dapm_contextKuninori Morimoto
All drivers are now using new dapm functions. Move struct snd_soc_dapm_context to soc-dapm.c Suggested-by: Cezary Rojewski <cezary.rojewski@intel.com> Link: https://lore.kernel.org/r/87o6x69h4y.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87fr81qgvu.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-01-26ASoC: soc-dapm: add snd_soc_dapm_alloc()Kuninori Morimoto
Because struct snd_soc_dapm_context is soc-dapm framework specific, user driver don't need to access its member directly, we would like to hide them. struct snd_soc_dapm_context will be removed from header in the future. Current card/component are using dapm_context instance. But it will be moved to soc-dapm.c, and we can use will be only pointer. Makes it to pointer. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Link: https://patch.msgid.link/87h5shqgw1.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-08-31 20:10:43 +0000