* [PATCH 6.18 000/188] 6.18.32-rc1 review
@ 2026-05-15 15:46 Greg Kroah-Hartman
2026-05-15 15:46 ` [PATCH 6.18 001/188] HID: playstation: Clamp num_touch_reports Greg Kroah-Hartman
` (192 more replies)
0 siblings, 193 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
This is the start of the stable review cycle for the 6.18.32 release.
There are 188 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun, 17 May 2026 15:46:37 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.32-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 6.18.32-rc1
Benjamin Cheng <benjamin.cheng@amd.com>
drm/amdgpu/vcn4: Avoid overflow on msg bound check
Benjamin Cheng <benjamin.cheng@amd.com>
drm/amdgpu/vcn3: Avoid overflow on msg bound check
Dudu Lu <phx0fer@gmail.com>
vsock/virtio: fix accept queue count leak on transport mismatch
Eric Dumazet <edumazet@google.com>
vsock/virtio: fix potential unbounded skb queue
Stefano Garzarella <sgarzare@redhat.com>
vsock/virtio: fix empty payload in tap skb for non-linear buffers
Stefano Garzarella <sgarzare@redhat.com>
vsock/virtio: fix length and offset in tap skb for split packets
Norbert Szetei <norbert@doyensec.com>
vsock: fix buffer size clamping order
Sven Eckelmann <sven@narfation.org>
batman-adv: tp_meter: fix tp_num leak on kmalloc failure
Masami Hiramatsu (Google) <mhiramat@kernel.org>
tracing/fprobe: Remove fprobe from hash in failure path
Masami Hiramatsu (Google) <mhiramat@kernel.org>
tracing/fprobe: Unregister fprobe even if memory allocation fails
Menglong Dong <menglong8.dong@gmail.com>
tracing: fprobe: optimization for entry only case
Menglong Dong <menglong8.dong@gmail.com>
tracing: fprobe: use rhltable for fprobe_ip_table
Yochai Eisenrich <yochaie@sweet.security>
btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak
Guangshuo Li <lgs201920130244@gmail.com>
btrfs: fix double free in create_space_info_sub_group() error path
Filipe Manana <fdmanana@suse.com>
btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type()
Selvarasu Ganesan <selvarasu.g@samsung.com>
usb: dwc3: Move GUID programming after PHY initialization
Prashanth K <prashanth.k@oss.qualcomm.com>
usb: dwc3: Add dwc pointer to dwc3_readl/writel
Prashanth K <prashanth.k@oss.qualcomm.com>
usb: dwc3: Remove of dep->regs
Tejun Heo <tj@kernel.org>
sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters
zhidao su <suzhidao@xiaomi.com>
sched/ext: Implement cgroup_set_idle() callback
David Carlier <devnexen@gmail.com>
Bluetooth: hci_conn: fix potential UAF in create_big_sync
Johan Hovold <johan@kernel.org>
spi: zynq-qspi: fix controller deregistration
Pei Xiao <xiaopei01@kylinos.cn>
spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled()
Johan Hovold <johan@kernel.org>
spi: tegra114: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: tegra20-sflash: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: uniphier: fix controller deregistration
Pei Xiao <xiaopei01@kylinos.cn>
spi: uniphier: Simplify clock handling with devm_clk_get_enabled()
Ritesh Harjani (IBM) <ritesh.list@gmail.com>
pseries/papr-hvpipe: Fix race with interrupt handler
Christian Brauner <brauner@kernel.org>
papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE()
Prasanna Kumar T S M <ptsm@linux.microsoft.com>
EDAC/versalnet: Fix device name memory leak
Damien Le Moal <dlemoal@kernel.org>
block: fix zone write plug removal
Thomas Zimmermann <tzimmermann@suse.de>
fbcon: Avoid OOB font access if console rotation fails
Thomas Zimmermann <tzimmermann@suse.de>
fbcon: Rename struct fbcon_ops to struct fbcon_par
Alex Deucher <alexander.deucher@amd.com>
drm/amdgpu: rework how we handle TLB fences
Prike Liang <Prike.Liang@amd.com>
Revert "drm/amdgpu: don't attach the tlb fence for SI"
Timur Kristóf <timur.kristof@gmail.com>
drm/amdgpu: Fix validating flush_gpu_tlb_pasid()
Prike Liang <Prike.Liang@amd.com>
drm/amdgpu: validate the flush_gpu_tlb_pasid()
SeongJae Park <sj@kernel.org>
mm/damon/core: disallow time-quota setting zero esz
Amit Sunil Dhamne <amitsd@google.com>
usb: typec: tcpm: reset internal port states on soft reset AMS
SeongJae Park <sj@kernel.org>
mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values
SeongJae Park <sj@kernel.org>
mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values
SeongJae Park <sj@kernel.org>
mm/damon/core: implement damon_kdamond_pid()
Xianglai Li <lixianglai@loongson.cn>
LoongArch: KVM: Compile switch.S directly into the kernel
Pavel Begunkov <asml.silence@gmail.com>
io_uring/zcrx: warn on freelist violations
Pavel Begunkov <asml.silence@gmail.com>
io_uring/zcrx: use guards for locking
Andrea Righi <arighi@nvidia.com>
sched_ext: Use HK_TYPE_DOMAIN_BOOT to detect isolcpus= domain isolation
Sven Eckelmann <sven@narfation.org>
batman-adv: bla: put backbone reference on failed claim hash insert
Sven Eckelmann <sven@narfation.org>
batman-adv: bla: only purge non-released claims
Sven Eckelmann <sven@narfation.org>
batman-adv: bla: prevent use-after-free when deleting claims
Jiexun Wang <wangjiexun2025@gmail.com>
batman-adv: stop caching unowned originator pointers in BAT IV
Jiexun Wang <wangjiexun2025@gmail.com>
batman-adv: stop tp_meter sessions during mesh teardown
Jiexun Wang <wangjiexun2025@gmail.com>
batman-adv: reject new tp_meter sessions during teardown
Lyes Bourennani <lbourennani@fuzzinglabs.com>
batman-adv: fix integer overflow on buff_pos
Ben Morris <bmorris@anthropic.com>
sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL
Siddharth Vadapalli <s-vadapalli@ti.com>
arm64: dts: ti: k3-am62a7-sk: Fix pin name in comment from M19 to N22
Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
arm64: dts: qcom: lemans: Correct QUP interrupt numbers
Alex Deucher <alexander.deucher@amd.com>
drm/amdgpu/pm: align Hawaii mclk workaround with radeon
Alex Deucher <alexander.deucher@amd.com>
drm/amdgpu/pm: add missing revision check for CI
John B. Moore <jbmoore61@gmail.com>
drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission
Felix Kuehling <felix.kuehling@amd.com>
drm/amdkfd: Make all TLB-flushes heavy-weight
Icenowy Zheng <zhengxingda@iscas.ac.cn>
drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds
Kory Maincent (TI) <kory.maincent@bootlin.com>
drm/bridge: tda998x: Use __be32 for audio port OF property pointer
John B. Moore <jbmoore61@gmail.com>
drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ
Icenowy Zheng <zhengxingda@iscas.ac.cn>
drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds
Osama Abdelkader <osama.abdelkader@gmail.com>
drm/exynos: remove bridge when component_add fails
Philip Yang <Philip.Yang@amd.com>
drm/amdgpu: zero-initialize GART table on allocation
Alex Deucher <alexander.deucher@amd.com>
drm/radeon: add missing revision check for CI
Francis, David <David.Francis@amd.com>
drm: Set old handle to NULL before prime swap in change_handle
Jia Yao <jia.yao@intel.com>
drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise
Shuicheng Lin <shuicheng.lin@intel.com>
drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked()
Shuicheng Lin <shuicheng.lin@intel.com>
drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()
Shuicheng Lin <shuicheng.lin@intel.com>
drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked()
Shuicheng Lin <shuicheng.lin@intel.com>
drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure
Shixiong Ou <oushixiong@kylinos.cn>
drm/udl: Increase GET_URB_TIMEOUT
Alysa Liu <Alysa.Liu@amd.com>
drm/amdkfd: validate SVM ioctl nattr against buffer size
Sasha Finkelstein <k@chaosmail.tech>
drm/appletbdrm: Use kvzalloc for big allocations
Ashutosh Desai <ashutoshdesai993@gmail.com>
drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()
Mario Kleiner <mario.kleiner.de@gmail.com>
drm/amd/display: Change dither policy for 10 bpc output back to dithering
Benjamin Cheng <benjamin.cheng@amd.com>
drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg
Benjamin Cheng <benjamin.cheng@amd.com>
drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg
Benjamin Cheng <benjamin.cheng@amd.com>
drm/amdgpu/vce: Prevent partial address patches
Benjamin Cheng <benjamin.cheng@amd.com>
drm/amdgpu/vcn4: Prevent OOB reads when parsing IB
Benjamin Cheng <benjamin.cheng@amd.com>
drm/amdgpu: Add bounds checking to ib_{get,set}_value
Alysa Liu <Alysa.Liu@amd.com>
drm/amdkfd: Add upper bound check for num_of_nodes
Yang Wang <kevinyang.wang@amd.com>
drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x
Chenglei Xie <Chenglei.Xie@amd.com>
drm/amdgpu: gate VM CPU HDP flush on reset lock
Ramalingeswara Reddy, Kanala <Kanala.RamalingeswaraReddy@amd.com>
drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count.
Amir Shetaia <Amir.Shetaia@amd.com>
drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure
Jouni Högander <jouni.hogander@intel.com>
drm/i915/psr: Init variable to avoid early exit from et alignment loop
Anna Maniscalco <anna.maniscalco2000@gmail.com>
drm/msm: always recover the gpu
Marek Vasut <marex@nabladev.com>
drm/imx: parallel-display: Prefer bus format set via legacy "interface-pix-fmt" DT property
Yasuaki Torimaru <yasuakitorimaru@gmail.com>
drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata()
Johan Hovold <johan@kernel.org>
spi: cadence: fix clock imbalance on probe failure
Johan Hovold <johan@kernel.org>
spi: cadence: fix unclocked access on unbind
Johan Hovold <johan@kernel.org>
spi: cadence: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: mpc52xx: fix use-after-free on unbind
Johan Hovold <johan@kernel.org>
spi: mpc52xx: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: mpc52xx: fix use-after-free on registration failure
Johan Hovold <johan@kernel.org>
spi: orion: fix clock imbalance on registration failure
Johan Hovold <johan@kernel.org>
spi: orion: fix runtime pm leak on unbind
Johan Hovold <johan@kernel.org>
spi: orion: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: mxic: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: imx: fix runtime pm leak on probe deferral
Johan Hovold <johan@kernel.org>
spi: mpfs: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: img-spfi: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: slave-mt27xx: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: sh-msiof: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: rspi: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: sprd: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: pic32-sqi: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: cavium-thunderx: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: npcm-pspi: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: coldfire-qspi: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: bcmbca-hsspi: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: fsl: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: sh-hspi: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: ch341: fix devres lifetime
Johan Hovold <johan@kernel.org>
spi: pl022: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: mtk-nor: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: pic32: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: omap2-mcspi: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: fsl-espi: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: s3c64xx: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: dln2: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: mt65xx: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: mxs: fix controller deregistration
Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
media: qcom: camss: Add missing clocks for VFE lite on sa8775p
Thomas Fourier <fourier.thomas@gmail.com>
media: iris: Fix dma_free_attrs() size in iris_hfi_queues_init()
Arnd Bergmann <arnd@arndb.de>
media: venus: fix QCOM_MDT_LOADER dependency
Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
media: qcom: iris: increase H265D_MAX_SLICE to fix H.265 decoding on SC7280
Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
media: qcom: camss: Fix csid IRQ offset for sa8775p
Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
media: qcom: camss: Fix csid clock configuration for sa8775p
Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
media: iris: Fix use-after-free in iris_release_internal_buffers()
Arnd Bergmann <arnd@arndb.de>
media: iris: fix QCOM_MDT_LOADER dependency
Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
media: omap3isp: drop the use count of v4l2 pipeline
Matthias Fend <matthias.fend@emfend.at>
media: i2c: ov08d10: fix runtime PM handling in probe
Matthias Fend <matthias.fend@emfend.at>
media: i2c: ov08d10: fix image vertical start setting
Michael Tretter <m.tretter@pengutronix.de>
media: staging: imx: request mbus_config in csi_start
Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
media: i2c: imx412: Assert reset GPIO during probe
Sergey Shtylyov <s.shtylyov@auroraos.dev>
media: dib8000: avoid division by 0 in dib8000_set_dds()
Abdun Nihaal <nihaal@cse.iitm.ac.in>
media: pci: zoran: fix potential memory leak in zoran_probe()
Gregor Herburger <gregor.herburger@linutronix.de>
arm64: dts: broadcom: bcm2712-d-rpi-5-b: update uart10 interrupt
Gregor Herburger <gregor.herburger@linutronix.de>
arm64: dts: broadcom: bcm2712-d-rpi-5-b: add fixes for pinctrl/pinctrl_aon
Luigi Leonardi <leonardi@redhat.com>
vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to copy
Krishna Chomal <krishna.chomal108@gmail.com>
platform/x86: hp-wmi: Ignore backlight and FnLock events
Johan Hovold <johan@kernel.org>
spi: aspeed-smc: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: amlogic-spisg: fix controller deregistration
Wang Jun <1742789905@qq.com>
media: saa7164: add ioremap return checks and cleanups
Johan Hovold <johan@kernel.org>
spi: at91-usart: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: qup: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: meson-spicc: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: lantiq-ssc: fix controller deregistration
Johan Hovold <johan@kernel.org>
regulator: bd9571mwv: fix OF node reference imbalance
Johan Hovold <johan@kernel.org>
regulator: s2dos05: fix OF node reference imbalance
Johan Hovold <johan@kernel.org>
regulator: act8945a: fix OF node reference imbalance
Jai Luthra <jai.luthra@ideasonboard.com>
media: i2c: imx283: Fix hang when going from large to small resolution
Ethan Tidmore <ethantidmore06@gmail.com>
media: intel/ipu6: fix error pointer dereference
Janne Grunau <j@jannau.net>
media: videobuf2: Set vma_flags in vb2_dma_sg_mmap
Johan Hovold <johan@kernel.org>
regulator: rk808: fix OF node reference imbalance
Johan Hovold <johan@kernel.org>
regulator: bq257xx: fix OF node reference imbalance
Jai Luthra <jai.luthra@ideasonboard.com>
media: i2c: imx283: Enter full standby when stopping streaming
Oliver Neukum <oneukum@suse.com>
media: rc: streamzap: Error handling in probe
Oliver Neukum <oneukum@suse.com>
media: rc: xbox_remote: heed DMA restrictions
Johan Hovold <johan@kernel.org>
regulator: max77650: fix OF node reference imbalance
Johan Hovold <johan@kernel.org>
spi: st-ssc4: fix controller deregistration
Johan Hovold <johan@kernel.org>
regulator: mt6357: fix OF node reference imbalance
Sakari Ailus <sakari.ailus@linux.intel.com>
staging: media: atomisp: Disallow all private IOCTLs
Josua Mayer <josua@solid-run.com>
arm64: dts: lx2160a-cex7/lx2162a-sr-som: fix usd-cd & gpio pinmux
Johan Hovold <johan@kernel.org>
spi: atmel: fix controller deregistration
Johan Hovold <johan@kernel.org>
spi: bcm63xx: fix controller deregistration
Matthew Brost <matthew.brost@intel.com>
drm/gpusvm: Force unmapping on error in drm_gpusvm_get_pages
Ziyi Guo <n7l8m4@u.northwestern.edu>
media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change()
Ziyi Guo <n7l8m4@u.northwestern.edu>
media: chips-media: wave5: add missing spinlock protection for send_eos_event()
Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init()
Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
media: dt-bindings: rockchip,vdec: Mark reg-names required for RK35{76,88}
Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
media: dt-bindings: rockchip,vdec: Add alternative reg-names order for RK35{76,88}
Alexander Koskovich <akoskovich@pm.me>
media: i2c: ov8856: free control handler on error in ov8856_init_controls()
Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
media: renesas: vin: Fix RAW8 (again)
Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
media: renesas: vsp1: Fix NULL pointer deref on module unload
Guoniu Zhou <guoniu.zhou@nxp.com>
media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0
Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
drm/msm/hdmi: Fix wrong CTRL1 register used in writing info frames
Ricardo Ribalda <ribalda@chromium.org>
media: uvcvideo: Enable VB2_DMABUF for metadata stream
Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
HID: pidff: Fix integer overflow in pidff_rescale
Benjamin Tissoires <bentiss@kernel.org>
HID: core: introduce hid_safe_input_report()
Benjamin Tissoires <bentiss@kernel.org>
HID: pass the buffer size to hid_report_raw_event
Sangyun Kim <sangyun.kim@snu.ac.kr>
HID: appletb-kbd: run inactivity autodim from workqueues
Sangyun Kim <sangyun.kim@snu.ac.kr>
HID: appletb-kbd: fix UAF in inactivity-timer cleanup path
T.J. Mercier <tjmercier@google.com>
HID: playstation: Clamp num_touch_reports
-------------
Diffstat:
.../devicetree/bindings/media/rockchip,vdec.yaml | 22 +-
Makefile | 4 +-
arch/arm64/boot/dts/broadcom/bcm2712-d-rpi-5-b.dts | 14 +
.../arm64/boot/dts/freescale/fsl-lx2160a-cex7.dtsi | 7 +
.../dts/freescale/fsl-lx2160a-clearfog-itx.dtsi | 2 +
arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi | 24 ++
.../boot/dts/freescale/fsl-lx2162a-clearfog.dts | 2 +
.../boot/dts/freescale/fsl-lx2162a-sr-som.dtsi | 7 +
arch/arm64/boot/dts/qcom/lemans.dtsi | 8 +-
arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 2 +-
arch/loongarch/Kbuild | 2 +-
arch/loongarch/include/asm/asm-prototypes.h | 20 +
arch/loongarch/include/asm/kvm_host.h | 3 -
arch/loongarch/kvm/Makefile | 3 +-
arch/loongarch/kvm/main.c | 35 +-
arch/loongarch/kvm/switch.S | 20 +-
arch/powerpc/platforms/pseries/papr-hvpipe.c | 59 +--
block/blk-zoned.c | 149 +++-----
drivers/edac/versalnet_edac.c | 3 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 3 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 13 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 6 +
drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 11 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 3 +
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 9 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 2 +
drivers/gpu/drm/amd/amdgpu/amdgpu_vm_cpu.c | 12 +-
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 31 +-
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 -
drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 4 +-
drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 25 +-
drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 46 ++-
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 33 +-
.../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 6 +-
drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 10 +-
drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 4 +-
drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 11 +
drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 2 +-
.../gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c | 13 +-
.../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 10 +-
drivers/gpu/drm/bridge/tda998x_drv.c | 2 +-
drivers/gpu/drm/drm_gem.c | 25 +-
drivers/gpu/drm/drm_gem_framebuffer_helper.c | 4 +-
drivers/gpu/drm/drm_gpusvm.c | 1 +
drivers/gpu/drm/exynos/exynos_drm_mic.c | 8 +-
drivers/gpu/drm/i915/display/intel_psr.c | 2 +-
drivers/gpu/drm/imx/ipuv3/parallel-display.c | 15 +-
drivers/gpu/drm/msm/hdmi/hdmi_bridge.c | 4 +-
drivers/gpu/drm/msm/msm_drv.c | 7 +-
drivers/gpu/drm/msm/msm_gpu.c | 42 +--
drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 2 +
drivers/gpu/drm/panel/panel-himax-hx83102.c | 2 +
drivers/gpu/drm/radeon/ci_dpm.c | 9 +-
drivers/gpu/drm/tiny/appletbdrm.c | 4 +-
drivers/gpu/drm/udl/udl_main.c | 3 +-
drivers/gpu/drm/udl/udl_modeset.c | 5 +-
drivers/gpu/drm/xe/xe_bo.c | 8 +-
drivers/gpu/drm/xe/xe_dma_buf.c | 23 +-
drivers/gpu/drm/xe/xe_vm_madvise.c | 47 +++
drivers/hid/bpf/hid_bpf_dispatch.c | 6 +-
drivers/hid/hid-appletb-kbd.c | 58 +--
drivers/hid/hid-core.c | 67 +++-
drivers/hid/hid-gfrm.c | 4 +-
drivers/hid/hid-logitech-hidpp.c | 2 +-
drivers/hid/hid-multitouch.c | 2 +-
drivers/hid/hid-playstation.c | 6 +-
drivers/hid/hid-primax.c | 2 +-
drivers/hid/hid-vivaldi-common.c | 2 +-
drivers/hid/i2c-hid/i2c-hid-core.c | 7 +-
drivers/hid/usbhid/hid-core.c | 11 +-
drivers/hid/usbhid/hid-pidff.c | 7 +-
drivers/hid/wacom_sys.c | 6 +-
drivers/media/common/videobuf2/videobuf2-dma-sg.c | 1 +
drivers/media/dvb-frontends/dib8000.c | 4 +-
drivers/media/i2c/imx283.c | 15 +-
drivers/media/i2c/imx412.c | 2 +-
drivers/media/i2c/ov08d10.c | 21 +-
drivers/media/i2c/ov8856.c | 10 +-
drivers/media/pci/intel/ipu6/ipu6.c | 2 +-
drivers/media/pci/saa7164/saa7164-core.c | 47 ++-
drivers/media/pci/zoran/zoran_card.c | 2 +-
.../media/platform/chips-media/wave5/wave5-vdi.c | 1 +
.../platform/chips-media/wave5/wave5-vpu-dec.c | 14 +-
.../media/platform/nxp/imx8-isi/imx8-isi-video.c | 2 +-
.../media/platform/qcom/camss/camss-csid-gen3.c | 6 +-
drivers/media/platform/qcom/camss/camss.c | 80 ++--
drivers/media/platform/qcom/iris/Kconfig | 2 +-
drivers/media/platform/qcom/iris/iris_buffer.c | 8 +-
drivers/media/platform/qcom/iris/iris_hfi_queue.c | 2 +-
drivers/media/platform/qcom/iris/iris_vpu_buffer.h | 2 +-
drivers/media/platform/qcom/venus/Kconfig | 2 +-
drivers/media/platform/renesas/rcar-vin/rcar-dma.c | 22 ++
.../media/platform/renesas/rcar-vin/rcar-v4l2.c | 12 +
drivers/media/platform/renesas/vsp1/vsp1_drv.c | 8 +-
drivers/media/platform/ti/omap3isp/ispvideo.c | 1 +
drivers/media/rc/streamzap.c | 12 +-
drivers/media/rc/xbox_remote.c | 9 +-
drivers/media/usb/uvc/uvc_queue.c | 3 +-
drivers/platform/x86/hp/hp-wmi.c | 5 +
drivers/regulator/act8945a-regulator.c | 3 +-
drivers/regulator/bd9571mwv-regulator.c | 3 +-
drivers/regulator/bq257xx-regulator.c | 3 +-
drivers/regulator/max77650-regulator.c | 2 +-
drivers/regulator/mt6357-regulator.c | 2 +-
drivers/regulator/rk808-regulator.c | 3 +-
drivers/regulator/s2dos05-regulator.c | 2 +-
drivers/spi/spi-amlogic-spisg.c | 4 +-
drivers/spi/spi-aspeed-smc.c | 9 +-
drivers/spi/spi-at91-usart.c | 8 +-
drivers/spi/spi-atmel.c | 8 +-
drivers/spi/spi-bcm63xx.c | 8 +-
drivers/spi/spi-bcmbca-hsspi.c | 4 +-
drivers/spi/spi-cadence.c | 21 +-
drivers/spi/spi-cavium-thunderx.c | 8 +-
drivers/spi/spi-ch341.c | 7 +-
drivers/spi/spi-coldfire-qspi.c | 10 +-
drivers/spi/spi-dln2.c | 8 +-
drivers/spi/spi-fsl-espi.c | 10 +-
drivers/spi/spi-fsl-spi.c | 14 +-
drivers/spi/spi-img-spfi.c | 8 +-
drivers/spi/spi-imx.c | 1 +
drivers/spi/spi-lantiq-ssc.c | 8 +-
drivers/spi/spi-meson-spicc.c | 8 +-
drivers/spi/spi-mpc52xx.c | 9 +-
drivers/spi/spi-mpfs.c | 4 +-
drivers/spi/spi-mt65xx.c | 4 +-
drivers/spi/spi-mtk-nor.c | 4 +-
drivers/spi/spi-mxic.c | 3 +-
drivers/spi/spi-mxs.c | 8 +-
drivers/spi/spi-npcm-pspi.c | 8 +-
drivers/spi/spi-omap2-mcspi.c | 8 +-
drivers/spi/spi-orion.c | 16 +-
drivers/spi/spi-pic32-sqi.c | 8 +-
drivers/spi/spi-pic32.c | 11 +-
drivers/spi/spi-pl022.c | 8 +-
drivers/spi/spi-qup.c | 8 +-
drivers/spi/spi-rspi.c | 10 +-
drivers/spi/spi-s3c64xx.c | 4 +-
drivers/spi/spi-sh-hspi.c | 10 +-
drivers/spi/spi-sh-msiof.c | 10 +-
drivers/spi/spi-slave-mt27xx.c | 10 +-
drivers/spi/spi-sprd.c | 8 +-
drivers/spi/spi-st-ssc4.c | 8 +-
drivers/spi/spi-tegra114.c | 8 +-
drivers/spi/spi-tegra20-sflash.c | 8 +-
drivers/spi/spi-uniphier.c | 24 +-
drivers/spi/spi-zynq-qspi.c | 55 +--
drivers/staging/greybus/hid.c | 2 +-
drivers/staging/media/atomisp/pci/atomisp_ioctl.c | 4 +
drivers/staging/media/imx/imx-media-csi.c | 40 +-
drivers/usb/dwc3/core.c | 204 +++++-----
drivers/usb/dwc3/core.h | 10 +-
drivers/usb/dwc3/debugfs.c | 44 +--
drivers/usb/dwc3/drd.c | 76 ++--
drivers/usb/dwc3/ep0.c | 20 +-
drivers/usb/dwc3/gadget.c | 162 ++++----
drivers/usb/dwc3/gadget.h | 4 +-
drivers/usb/dwc3/io.h | 7 +-
drivers/usb/dwc3/ulpi.c | 10 +-
drivers/usb/typec/tcpm/tcpm.c | 2 +
drivers/video/fbdev/core/bitblit.c | 120 +++---
drivers/video/fbdev/core/fbcon.c | 419 ++++++++++-----------
drivers/video/fbdev/core/fbcon.h | 6 +-
drivers/video/fbdev/core/fbcon_ccw.c | 146 +++----
drivers/video/fbdev/core/fbcon_cw.c | 146 +++----
drivers/video/fbdev/core/fbcon_rotate.c | 43 ++-
drivers/video/fbdev/core/fbcon_rotate.h | 6 +-
drivers/video/fbdev/core/fbcon_ud.c | 162 ++++----
drivers/video/fbdev/core/softcursor.c | 18 +-
drivers/video/fbdev/core/tileblit.c | 28 +-
fs/btrfs/ioctl.c | 5 +-
fs/btrfs/space-info.c | 8 +-
fs/btrfs/sysfs.c | 5 +-
fs/btrfs/sysfs.h | 3 +-
include/linux/damon.h | 1 +
include/linux/fprobe.h | 3 +-
include/linux/hid.h | 6 +-
include/linux/hid_bpf.h | 14 +-
include/linux/sched/ext.h | 1 +
io_uring/zcrx.c | 17 +-
kernel/sched/ext.c | 26 +-
kernel/sched/ext_internal.h | 13 +-
kernel/trace/fprobe.c | 380 +++++++++++++------
mm/damon/core.c | 25 +-
mm/damon/lru_sort.c | 83 ++--
mm/damon/reclaim.c | 83 ++--
net/batman-adv/bat_iv_ogm.c | 85 +++--
net/batman-adv/bridge_loop_avoidance.c | 11 +-
net/batman-adv/main.c | 1 +
net/batman-adv/tp_meter.c | 116 +++++-
net/batman-adv/tp_meter.h | 1 +
net/batman-adv/types.h | 4 +
net/bluetooth/hci_conn.c | 19 +-
net/sctp/socket.c | 9 +
net/vmw_vsock/af_vsock.c | 6 +-
net/vmw_vsock/virtio_transport_common.c | 57 ++-
196 files changed, 2699 insertions(+), 1709 deletions(-)
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 001/188] HID: playstation: Clamp num_touch_reports
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
@ 2026-05-15 15:46 ` Greg Kroah-Hartman
2026-05-15 15:46 ` [PATCH 6.18 002/188] HID: appletb-kbd: fix UAF in inactivity-timer cleanup path Greg Kroah-Hartman
` (191 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xingyu Jin, T.J. Mercier,
Jiri Kosina
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: T.J. Mercier <tjmercier@google.com>
commit cac61b58a3b6340c52afa06bb15eac033158db2f upstream.
A device would never lie about the number of touch reports would it?
If it does the loop in dualshock4_parse_report will read off the end of
the touch_reports array, up to about 2 KiB for the maximum number of 256
loop iteraions. The data that is read is emitted via evdev if the
DS4_TOUCH_POINT_INACTIVE bit happens to be set. Protect against this by
clamping the num_touch_reports value provided by the device to the
maximum size of the touch_reports array.
Fixes: 752038248808 ("HID: playstation: add DualShock4 touchpad support.")
Cc: stable@vger.kernel.org
Reported-by: Xingyu Jin <xingyuj@google.com>
Signed-off-by: T.J. Mercier <tjmercier@google.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-playstation.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/hid/hid-playstation.c
+++ b/drivers/hid/hid-playstation.c
@@ -2378,7 +2378,8 @@ static int dualshock4_parse_report(struc
(struct dualshock4_input_report_usb *)data;
ds4_report = &usb->common;
- num_touch_reports = usb->num_touch_reports;
+ num_touch_reports = min_t(u8, usb->num_touch_reports,
+ ARRAY_SIZE(usb->touch_reports));
touch_reports = usb->touch_reports;
} else if (hdev->bus == BUS_BLUETOOTH && report->id == DS4_INPUT_REPORT_BT &&
size == DS4_INPUT_REPORT_BT_SIZE) {
@@ -2392,7 +2393,8 @@ static int dualshock4_parse_report(struc
}
ds4_report = &bt->common;
- num_touch_reports = bt->num_touch_reports;
+ num_touch_reports = min_t(u8, bt->num_touch_reports,
+ ARRAY_SIZE(bt->touch_reports));
touch_reports = bt->touch_reports;
} else if (hdev->bus == BUS_BLUETOOTH &&
report->id == DS4_INPUT_REPORT_BT_MINIMAL &&
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 002/188] HID: appletb-kbd: fix UAF in inactivity-timer cleanup path
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
2026-05-15 15:46 ` [PATCH 6.18 001/188] HID: playstation: Clamp num_touch_reports Greg Kroah-Hartman
@ 2026-05-15 15:46 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 003/188] HID: appletb-kbd: run inactivity autodim from workqueues Greg Kroah-Hartman
` (190 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sangyun Kim, Jiri Kosina
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sangyun Kim <sangyun.kim@snu.ac.kr>
commit 4db2af929279c799b5653a39eb0795c72baffca4 upstream.
Commit 38224c472a03 ("HID: appletb-kbd: fix slab use-after-free bug in
appletb_kbd_probe") added timer_delete_sync(&kbd->inactivity_timer) to
both the probe close_hw error path and appletb_kbd_remove(), but the
way it was wired in left the inactivity timer reachable during driver
tear-down via two distinct windows.
Window A -- put_device() before timer_delete_sync():
put_device(&kbd->backlight_dev->dev);
timer_delete_sync(&kbd->inactivity_timer);
The inactivity_timer softirq reads kbd->backlight_dev and calls
backlight_device_set_brightness() -> mutex_lock(&ops_lock). If a
concurrent hid_appletb_bl unbind drops the last devm reference
between these two calls, the backlight_device is freed and the
mutex_lock() touches freed memory.
Window B -- backlight cleanup before hid_hw_stop():
if (kbd->backlight_dev) {
timer_delete_sync(...);
put_device(...);
}
hid_hw_close(hdev);
hid_hw_stop(hdev);
Even after Window A is closed, hid_hw_close()/hid_hw_stop() still run
afterwards, so a late ".event" callback from the HID core (USB URB
completion on real Apple hardware) can arrive after
timer_delete_sync() drained the softirq but before put_device() drops
the reference. That callback reaches reset_inactivity_timer(), which
calls mod_timer() and re-arms the timer. The freshly re-armed timer
can then fire on the about-to-be-freed backlight_device.
Both windows produce the same KASAN slab-use-after-free:
BUG: KASAN: slab-use-after-free in __mutex_lock+0x1aab/0x21c0
Read of size 8 at addr ffff88803ee9a108 by task swapper/0/0
Call Trace:
<IRQ>
__mutex_lock
backlight_device_set_brightness
appletb_inactivity_timer
call_timer_fn
run_timer_softirq
handle_softirqs
Allocated by task N:
devm_backlight_device_register
appletb_bl_probe
Freed by task M:
(concurrent hid_appletb_bl unbind path)
Close both windows at once by reworking the tear-down in
appletb_kbd_remove() and in the probe close_hw error path so that
1) hid_hw_close()/hid_hw_stop() run before the backlight cleanup,
guaranteeing no further .event callback can fire and re-arm the
timer, and
2) inside the "if (kbd->backlight_dev)" block, timer_delete_sync()
runs before put_device(), so the softirq is drained before the
final reference is dropped.
Fixes: 38224c472a03 ("HID: appletb-kbd: fix slab use-after-free bug in appletb_kbd_probe")
Cc: stable@vger.kernel.org
Signed-off-by: Sangyun Kim <sangyun.kim@snu.ac.kr>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-appletb-kbd.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
--- a/drivers/hid/hid-appletb-kbd.c
+++ b/drivers/hid/hid-appletb-kbd.c
@@ -440,13 +440,13 @@ static int appletb_kbd_probe(struct hid_
unregister_handler:
input_unregister_handler(&kbd->inp_handler);
close_hw:
- if (kbd->backlight_dev) {
- put_device(&kbd->backlight_dev->dev);
- timer_delete_sync(&kbd->inactivity_timer);
- }
hid_hw_close(hdev);
stop_hw:
hid_hw_stop(hdev);
+ if (kbd->backlight_dev) {
+ timer_delete_sync(&kbd->inactivity_timer);
+ put_device(&kbd->backlight_dev->dev);
+ }
return ret;
}
@@ -457,13 +457,13 @@ static void appletb_kbd_remove(struct hi
appletb_kbd_set_mode(kbd, APPLETB_KBD_MODE_OFF);
input_unregister_handler(&kbd->inp_handler);
+ hid_hw_close(hdev);
+ hid_hw_stop(hdev);
+
if (kbd->backlight_dev) {
- put_device(&kbd->backlight_dev->dev);
timer_delete_sync(&kbd->inactivity_timer);
+ put_device(&kbd->backlight_dev->dev);
}
-
- hid_hw_close(hdev);
- hid_hw_stop(hdev);
}
#ifdef CONFIG_PM
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 003/188] HID: appletb-kbd: run inactivity autodim from workqueues
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
2026-05-15 15:46 ` [PATCH 6.18 001/188] HID: playstation: Clamp num_touch_reports Greg Kroah-Hartman
2026-05-15 15:46 ` [PATCH 6.18 002/188] HID: appletb-kbd: fix UAF in inactivity-timer cleanup path Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 004/188] HID: pass the buffer size to hid_report_raw_event Greg Kroah-Hartman
` (189 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sangyun Kim, Jiri Kosina
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sangyun Kim <sangyun.kim@snu.ac.kr>
commit 1654e53349d4e657b331de354313461f401f5063 upstream.
The autodim code in hid-appletb-kbd takes backlight_device->ops_lock
via backlight_device_set_brightness() -> mutex_lock() from two
different atomic contexts:
* appletb_inactivity_timer() is a struct timer_list callback, so it
runs in softirq context. Every expiry triggers
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:591
Call Trace:
<IRQ>
__might_resched
__mutex_lock
backlight_device_set_brightness
appletb_inactivity_timer
call_timer_fn
run_timer_softirq
* reset_inactivity_timer() is called from appletb_kbd_hid_event() and
appletb_kbd_inp_event(). On real USB hardware these run in
softirq/IRQ context (URB completion and input-event dispatch).
When the Touch Bar has already been dimmed or turned off, the
reset path calls backlight_device_set_brightness() directly to
restore brightness, producing the same warning.
Both call sites hit the same mutex_lock()-from-atomic bug. Fix them
together by moving the blocking work onto the system workqueue:
* Convert the inactivity timer from struct timer_list to
struct delayed_work; the callback (appletb_inactivity_work) now
runs in process context where mutex_lock() is legal.
* Add a dedicated struct work_struct restore_brightness_work and have
reset_inactivity_timer() schedule it instead of calling
backlight_device_set_brightness() directly.
Cancel both works synchronously during driver tear-down alongside the
existing backlight reference drop.
The semantics are unchanged (same delays, same state transitions on
dim, turn-off and user activity); only the execution context of the
sleeping call changes. The timer field and callback are renamed to
match their new type; reset_inactivity_timer() keeps its name because
it is invoked from input event paths that read naturally as "reset
the inactivity timer".
Fixes: 93a0fc489481 ("HID: hid-appletb-kbd: add support for automatic brightness control while using the touchbar")
Cc: stable@vger.kernel.org
Signed-off-by: Sangyun Kim <sangyun.kim@snu.ac.kr>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-appletb-kbd.c | 44 ++++++++++++++++++++++++++++--------------
1 file changed, 30 insertions(+), 14 deletions(-)
--- a/drivers/hid/hid-appletb-kbd.c
+++ b/drivers/hid/hid-appletb-kbd.c
@@ -17,7 +17,7 @@
#include <linux/module.h>
#include <linux/string.h>
#include <linux/backlight.h>
-#include <linux/timer.h>
+#include <linux/workqueue.h>
#include <linux/input/sparse-keymap.h>
#include "hid-ids.h"
@@ -62,7 +62,8 @@ struct appletb_kbd {
struct input_handle kbd_handle;
struct input_handle tpd_handle;
struct backlight_device *backlight_dev;
- struct timer_list inactivity_timer;
+ struct delayed_work inactivity_work;
+ struct work_struct restore_brightness_work;
bool has_dimmed;
bool has_turned_off;
u8 saved_mode;
@@ -164,16 +165,18 @@ static int appletb_tb_key_to_slot(unsign
}
}
-static void appletb_inactivity_timer(struct timer_list *t)
+static void appletb_inactivity_work(struct work_struct *work)
{
- struct appletb_kbd *kbd = timer_container_of(kbd, t, inactivity_timer);
+ struct appletb_kbd *kbd = container_of(to_delayed_work(work),
+ struct appletb_kbd,
+ inactivity_work);
if (kbd->backlight_dev && appletb_tb_autodim) {
if (!kbd->has_dimmed) {
backlight_device_set_brightness(kbd->backlight_dev, 1);
kbd->has_dimmed = true;
- mod_timer(&kbd->inactivity_timer,
- jiffies + secs_to_jiffies(appletb_tb_idle_timeout));
+ mod_delayed_work(system_wq, &kbd->inactivity_work,
+ secs_to_jiffies(appletb_tb_idle_timeout));
} else if (!kbd->has_turned_off) {
backlight_device_set_brightness(kbd->backlight_dev, 0);
kbd->has_turned_off = true;
@@ -181,16 +184,25 @@ static void appletb_inactivity_timer(str
}
}
+static void appletb_restore_brightness_work(struct work_struct *work)
+{
+ struct appletb_kbd *kbd = container_of(work, struct appletb_kbd,
+ restore_brightness_work);
+
+ if (kbd->backlight_dev)
+ backlight_device_set_brightness(kbd->backlight_dev, 2);
+}
+
static void reset_inactivity_timer(struct appletb_kbd *kbd)
{
if (kbd->backlight_dev && appletb_tb_autodim) {
if (kbd->has_dimmed || kbd->has_turned_off) {
- backlight_device_set_brightness(kbd->backlight_dev, 2);
kbd->has_dimmed = false;
kbd->has_turned_off = false;
+ schedule_work(&kbd->restore_brightness_work);
}
- mod_timer(&kbd->inactivity_timer,
- jiffies + secs_to_jiffies(appletb_tb_dim_timeout));
+ mod_delayed_work(system_wq, &kbd->inactivity_work,
+ secs_to_jiffies(appletb_tb_dim_timeout));
}
}
@@ -408,9 +420,11 @@ static int appletb_kbd_probe(struct hid_
dev_err_probe(dev, -ENODEV, "Failed to get backlight device\n");
} else {
backlight_device_set_brightness(kbd->backlight_dev, 2);
- timer_setup(&kbd->inactivity_timer, appletb_inactivity_timer, 0);
- mod_timer(&kbd->inactivity_timer,
- jiffies + secs_to_jiffies(appletb_tb_dim_timeout));
+ INIT_DELAYED_WORK(&kbd->inactivity_work, appletb_inactivity_work);
+ INIT_WORK(&kbd->restore_brightness_work,
+ appletb_restore_brightness_work);
+ mod_delayed_work(system_wq, &kbd->inactivity_work,
+ secs_to_jiffies(appletb_tb_dim_timeout));
}
kbd->inp_handler.event = appletb_kbd_inp_event;
@@ -444,7 +458,8 @@ close_hw:
stop_hw:
hid_hw_stop(hdev);
if (kbd->backlight_dev) {
- timer_delete_sync(&kbd->inactivity_timer);
+ cancel_delayed_work_sync(&kbd->inactivity_work);
+ cancel_work_sync(&kbd->restore_brightness_work);
put_device(&kbd->backlight_dev->dev);
}
return ret;
@@ -461,7 +476,8 @@ static void appletb_kbd_remove(struct hi
hid_hw_stop(hdev);
if (kbd->backlight_dev) {
- timer_delete_sync(&kbd->inactivity_timer);
+ cancel_delayed_work_sync(&kbd->inactivity_work);
+ cancel_work_sync(&kbd->restore_brightness_work);
put_device(&kbd->backlight_dev->dev);
}
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 004/188] HID: pass the buffer size to hid_report_raw_event
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 003/188] HID: appletb-kbd: run inactivity autodim from workqueues Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 005/188] HID: core: introduce hid_safe_input_report() Greg Kroah-Hartman
` (188 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benjamin Tissoires, Johan Hovold,
Jiri Kosina
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Tissoires <bentiss@kernel.org>
commit 2c85c61d1332e1e16f020d76951baf167dcb6f7a upstream.
commit 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing
bogus memset()") enforced the provided data to be at least the size of
the declared buffer in the report descriptor to prevent a buffer
overflow. However, we can try to be smarter by providing both the buffer
size and the data size, meaning that hid_report_raw_event() can make
better decision whether we should plaining reject the buffer (buffer
overflow attempt) or if we can safely memset it to 0 and pass it to the
rest of the stack.
Fixes: 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing bogus memset()")
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Acked-by: Johan Hovold <johan@kernel.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/bpf/hid_bpf_dispatch.c | 6 +++--
drivers/hid/hid-core.c | 42 ++++++++++++++++++++++++-------------
drivers/hid/hid-gfrm.c | 4 +--
drivers/hid/hid-logitech-hidpp.c | 2 -
drivers/hid/hid-multitouch.c | 2 -
drivers/hid/hid-primax.c | 2 -
drivers/hid/hid-vivaldi-common.c | 2 -
drivers/hid/wacom_sys.c | 6 ++---
drivers/staging/greybus/hid.c | 2 -
include/linux/hid.h | 4 +--
include/linux/hid_bpf.h | 14 +++++++-----
11 files changed, 53 insertions(+), 33 deletions(-)
--- a/drivers/hid/bpf/hid_bpf_dispatch.c
+++ b/drivers/hid/bpf/hid_bpf_dispatch.c
@@ -24,7 +24,8 @@ EXPORT_SYMBOL(hid_ops);
u8 *
dispatch_hid_bpf_device_event(struct hid_device *hdev, enum hid_report_type type, u8 *data,
- u32 *size, int interrupt, u64 source, bool from_bpf)
+ size_t *buf_size, u32 *size, int interrupt, u64 source,
+ bool from_bpf)
{
struct hid_bpf_ctx_kern ctx_kern = {
.ctx = {
@@ -74,6 +75,7 @@ dispatch_hid_bpf_device_event(struct hid
*size = ret;
}
+ *buf_size = ctx_kern.ctx.allocated_size;
return ctx_kern.data;
}
EXPORT_SYMBOL_GPL(dispatch_hid_bpf_device_event);
@@ -508,7 +510,7 @@ __hid_bpf_input_report(struct hid_bpf_ct
if (ret)
return ret;
- return hid_ops->hid_input_report(ctx->hid, type, buf, size, 0, (u64)(long)ctx, true,
+ return hid_ops->hid_input_report(ctx->hid, type, buf, size, size, 0, (u64)(long)ctx, true,
lock_already_taken);
}
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -2029,24 +2029,32 @@ out:
}
EXPORT_SYMBOL_GPL(__hid_request);
-int hid_report_raw_event(struct hid_device *hid, enum hid_report_type type, u8 *data, u32 size,
- int interrupt)
+int hid_report_raw_event(struct hid_device *hid, enum hid_report_type type, u8 *data,
+ size_t bufsize, u32 size, int interrupt)
{
struct hid_report_enum *report_enum = hid->report_enum + type;
struct hid_report *report;
struct hid_driver *hdrv;
int max_buffer_size = HID_MAX_BUFFER_SIZE;
u32 rsize, csize = size;
+ size_t bsize = bufsize;
u8 *cdata = data;
int ret = 0;
report = hid_get_report(report_enum, data);
if (!report)
- goto out;
+ return 0;
+
+ if (unlikely(bsize < csize)) {
+ hid_warn_ratelimited(hid, "Event data for report %d is incorrect (%d vs %ld)\n",
+ report->id, csize, bsize);
+ return -EINVAL;
+ }
if (report_enum->numbered) {
cdata++;
csize--;
+ bsize--;
}
rsize = hid_compute_report_size(report);
@@ -2059,11 +2067,16 @@ int hid_report_raw_event(struct hid_devi
else if (rsize > max_buffer_size)
rsize = max_buffer_size;
+ if (bsize < rsize) {
+ hid_warn_ratelimited(hid, "Event data for report %d was too short (%d vs %ld)\n",
+ report->id, rsize, bsize);
+ return -EINVAL;
+ }
+
if (csize < rsize) {
- hid_warn_ratelimited(hid, "Event data for report %d was too short (%d vs %d)\n",
- report->id, rsize, csize);
- ret = -EINVAL;
- goto out;
+ dbg_hid("report %d is too short, (%d < %d)\n", report->id,
+ csize, rsize);
+ memset(cdata + csize, 0, rsize - csize);
}
if ((hid->claimed & HID_CLAIMED_HIDDEV) && hid->hiddev_report_event)
@@ -2071,7 +2084,7 @@ int hid_report_raw_event(struct hid_devi
if (hid->claimed & HID_CLAIMED_HIDRAW) {
ret = hidraw_report_event(hid, data, size);
if (ret)
- goto out;
+ return ret;
}
if (hid->claimed != HID_CLAIMED_HIDRAW && report->maxfield) {
@@ -2083,15 +2096,15 @@ int hid_report_raw_event(struct hid_devi
if (hid->claimed & HID_CLAIMED_INPUT)
hidinput_report_event(hid, report);
-out:
+
return ret;
}
EXPORT_SYMBOL_GPL(hid_report_raw_event);
static int __hid_input_report(struct hid_device *hid, enum hid_report_type type,
- u8 *data, u32 size, int interrupt, u64 source, bool from_bpf,
- bool lock_already_taken)
+ u8 *data, size_t bufsize, u32 size, int interrupt, u64 source,
+ bool from_bpf, bool lock_already_taken)
{
struct hid_report_enum *report_enum;
struct hid_driver *hdrv;
@@ -2116,7 +2129,8 @@ static int __hid_input_report(struct hid
report_enum = hid->report_enum + type;
hdrv = hid->driver;
- data = dispatch_hid_bpf_device_event(hid, type, data, &size, interrupt, source, from_bpf);
+ data = dispatch_hid_bpf_device_event(hid, type, data, &bufsize, &size, interrupt,
+ source, from_bpf);
if (IS_ERR(data)) {
ret = PTR_ERR(data);
goto unlock;
@@ -2145,7 +2159,7 @@ static int __hid_input_report(struct hid
goto unlock;
}
- ret = hid_report_raw_event(hid, type, data, size, interrupt);
+ ret = hid_report_raw_event(hid, type, data, bufsize, size, interrupt);
unlock:
if (!lock_already_taken)
@@ -2167,7 +2181,7 @@ unlock:
int hid_input_report(struct hid_device *hid, enum hid_report_type type, u8 *data, u32 size,
int interrupt)
{
- return __hid_input_report(hid, type, data, size, interrupt, 0,
+ return __hid_input_report(hid, type, data, size, size, interrupt, 0,
false, /* from_bpf */
false /* lock_already_taken */);
}
--- a/drivers/hid/hid-gfrm.c
+++ b/drivers/hid/hid-gfrm.c
@@ -66,7 +66,7 @@ static int gfrm_raw_event(struct hid_dev
switch (data[1]) {
case GFRM100_SEARCH_KEY_DOWN:
ret = hid_report_raw_event(hdev, HID_INPUT_REPORT, search_key_dn,
- sizeof(search_key_dn), 1);
+ sizeof(search_key_dn), sizeof(search_key_dn), 1);
break;
case GFRM100_SEARCH_KEY_AUDIO_DATA:
@@ -74,7 +74,7 @@ static int gfrm_raw_event(struct hid_dev
case GFRM100_SEARCH_KEY_UP:
ret = hid_report_raw_event(hdev, HID_INPUT_REPORT, search_key_up,
- sizeof(search_key_up), 1);
+ sizeof(search_key_up), sizeof(search_key_up), 1);
break;
default:
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -3664,7 +3664,7 @@ static int hidpp10_consumer_keys_raw_eve
memcpy(&consumer_report[1], &data[3], 4);
/* We are called from atomic context */
hid_report_raw_event(hidpp->hid_dev, HID_INPUT_REPORT,
- consumer_report, 5, 1);
+ consumer_report, sizeof(consumer_report), 5, 1);
return 1;
}
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -531,7 +531,7 @@ static void mt_get_feature(struct hid_de
}
ret = hid_report_raw_event(hdev, HID_FEATURE_REPORT, buf,
- size, 0);
+ size, size, 0);
if (ret)
dev_warn(&hdev->dev, "failed to report feature\n");
}
--- a/drivers/hid/hid-primax.c
+++ b/drivers/hid/hid-primax.c
@@ -44,7 +44,7 @@ static int px_raw_event(struct hid_devic
data[0] |= (1 << (data[idx] - 0xE0));
data[idx] = 0;
}
- hid_report_raw_event(hid, HID_INPUT_REPORT, data, size, 0);
+ hid_report_raw_event(hid, HID_INPUT_REPORT, data, size, size, 0);
return 1;
default: /* unknown report */
--- a/drivers/hid/hid-vivaldi-common.c
+++ b/drivers/hid/hid-vivaldi-common.c
@@ -85,7 +85,7 @@ void vivaldi_feature_mapping(struct hid_
}
ret = hid_report_raw_event(hdev, HID_FEATURE_REPORT, report_data,
- report_len, 0);
+ report_len, report_len, 0);
if (ret) {
dev_warn(&hdev->dev, "failed to report feature %d\n",
field->report->id);
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -90,7 +90,7 @@ static void wacom_wac_queue_flush(struct
kfree(buf);
continue;
}
- err = hid_report_raw_event(hdev, HID_INPUT_REPORT, buf, size, false);
+ err = hid_report_raw_event(hdev, HID_INPUT_REPORT, buf, size, size, false);
if (err) {
hid_warn(hdev, "%s: unable to flush event due to error %d\n",
__func__, err);
@@ -334,7 +334,7 @@ static void wacom_feature_mapping(struct
data, n, WAC_CMD_RETRIES);
if (ret == n && features->type == HID_GENERIC) {
ret = hid_report_raw_event(hdev,
- HID_FEATURE_REPORT, data, n, 0);
+ HID_FEATURE_REPORT, data, n, n, 0);
} else if (ret == 2 && features->type != HID_GENERIC) {
features->touch_max = data[1];
} else {
@@ -395,7 +395,7 @@ static void wacom_feature_mapping(struct
data, n, WAC_CMD_RETRIES);
if (ret == n) {
ret = hid_report_raw_event(hdev, HID_FEATURE_REPORT,
- data, n, 0);
+ data, n, n, 0);
} else {
hid_warn(hdev, "%s: could not retrieve sensor offsets\n",
__func__);
--- a/drivers/staging/greybus/hid.c
+++ b/drivers/staging/greybus/hid.c
@@ -201,7 +201,7 @@ static void gb_hid_init_report(struct gb
* we just need to setup the input fields, so using
* hid_report_raw_event is safe.
*/
- hid_report_raw_event(ghid->hid, report->type, ghid->inbuf, size, 1);
+ hid_report_raw_event(ghid->hid, report->type, ghid->inbuf, ghid->bufsize, size, 1);
}
static void gb_hid_init_reports(struct gb_hid *ghid)
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -1258,8 +1258,8 @@ static inline u32 hid_report_len(struct
return DIV_ROUND_UP(report->size, 8) + (report->id > 0);
}
-int hid_report_raw_event(struct hid_device *hid, enum hid_report_type type, u8 *data, u32 size,
- int interrupt);
+int hid_report_raw_event(struct hid_device *hid, enum hid_report_type type, u8 *data,
+ size_t bufsize, u32 size, int interrupt);
/* HID quirks API */
unsigned long hid_lookup_quirk(const struct hid_device *hdev);
--- a/include/linux/hid_bpf.h
+++ b/include/linux/hid_bpf.h
@@ -72,8 +72,8 @@ struct hid_ops {
int (*hid_hw_output_report)(struct hid_device *hdev, __u8 *buf, size_t len,
u64 source, bool from_bpf);
int (*hid_input_report)(struct hid_device *hid, enum hid_report_type type,
- u8 *data, u32 size, int interrupt, u64 source, bool from_bpf,
- bool lock_already_taken);
+ u8 *data, size_t bufsize, u32 size, int interrupt, u64 source,
+ bool from_bpf, bool lock_already_taken);
struct module *owner;
const struct bus_type *bus_type;
};
@@ -200,7 +200,8 @@ struct hid_bpf {
#ifdef CONFIG_HID_BPF
u8 *dispatch_hid_bpf_device_event(struct hid_device *hid, enum hid_report_type type, u8 *data,
- u32 *size, int interrupt, u64 source, bool from_bpf);
+ size_t *buf_size, u32 *size, int interrupt, u64 source,
+ bool from_bpf);
int dispatch_hid_bpf_raw_requests(struct hid_device *hdev,
unsigned char reportnum, __u8 *buf,
u32 size, enum hid_report_type rtype,
@@ -215,8 +216,11 @@ int hid_bpf_device_init(struct hid_devic
const u8 *call_hid_bpf_rdesc_fixup(struct hid_device *hdev, const u8 *rdesc, unsigned int *size);
#else /* CONFIG_HID_BPF */
static inline u8 *dispatch_hid_bpf_device_event(struct hid_device *hid, enum hid_report_type type,
- u8 *data, u32 *size, int interrupt,
- u64 source, bool from_bpf) { return data; }
+ u8 *data, size_t *buf_size, u32 *size,
+ int interrupt, u64 source, bool from_bpf)
+{
+ return data;
+}
static inline int dispatch_hid_bpf_raw_requests(struct hid_device *hdev,
unsigned char reportnum, u8 *buf,
u32 size, enum hid_report_type rtype,
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 005/188] HID: core: introduce hid_safe_input_report()
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 004/188] HID: pass the buffer size to hid_report_raw_event Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 006/188] HID: pidff: Fix integer overflow in pidff_rescale Greg Kroah-Hartman
` (187 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Benjamin Tissoires, Jiri Kosina
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Tissoires <bentiss@kernel.org>
commit 206342541fc887ae919774a43942dc883161fece upstream.
hid_input_report() is used in too many places to have a commit that
doesn't cross subsystem borders. Instead of changing the API, introduce
a new one when things matters in the transport layers:
- usbhid
- i2chid
This effectively revert to the old behavior for those two transport
layers.
Fixes: 0a3fe972a7cb ("HID: core: Mitigate potential OOB by removing bogus memset()")
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-core.c | 25 +++++++++++++++++++++++++
drivers/hid/i2c-hid/i2c-hid-core.c | 7 ++++---
drivers/hid/usbhid/hid-core.c | 11 ++++++-----
include/linux/hid.h | 2 ++
4 files changed, 37 insertions(+), 8 deletions(-)
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -2177,6 +2177,7 @@ unlock:
* @interrupt: distinguish between interrupt and control transfers
*
* This is data entry for lower layers.
+ * Legacy, please use hid_safe_input_report() instead.
*/
int hid_input_report(struct hid_device *hid, enum hid_report_type type, u8 *data, u32 size,
int interrupt)
@@ -2187,6 +2188,30 @@ int hid_input_report(struct hid_device *
}
EXPORT_SYMBOL_GPL(hid_input_report);
+/**
+ * hid_safe_input_report - report data from lower layer (usb, bt...)
+ *
+ * @hid: hid device
+ * @type: HID report type (HID_*_REPORT)
+ * @data: report contents
+ * @bufsize: allocated size of the data buffer
+ * @size: useful size of data parameter
+ * @interrupt: distinguish between interrupt and control transfers
+ *
+ * This is data entry for lower layers.
+ * Please use this function instead of the non safe version because we provide
+ * here the size of the buffer, allowing hid-core to make smarter decisions
+ * regarding the incoming buffer.
+ */
+int hid_safe_input_report(struct hid_device *hid, enum hid_report_type type, u8 *data,
+ size_t bufsize, u32 size, int interrupt)
+{
+ return __hid_input_report(hid, type, data, bufsize, size, interrupt, 0,
+ false, /* from_bpf */
+ false /* lock_already_taken */);
+}
+EXPORT_SYMBOL_GPL(hid_safe_input_report);
+
bool hid_match_one_id(const struct hid_device *hdev,
const struct hid_device_id *id)
{
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c
@@ -574,9 +574,10 @@ static void i2c_hid_get_input(struct i2c
if (ihid->hid->group != HID_GROUP_RMI)
pm_wakeup_event(&ihid->client->dev, 0);
- hid_input_report(ihid->hid, HID_INPUT_REPORT,
- ihid->inbuf + sizeof(__le16),
- ret_size - sizeof(__le16), 1);
+ hid_safe_input_report(ihid->hid, HID_INPUT_REPORT,
+ ihid->inbuf + sizeof(__le16),
+ ihid->bufsize - sizeof(__le16),
+ ret_size - sizeof(__le16), 1);
}
return;
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -283,9 +283,9 @@ static void hid_irq_in(struct urb *urb)
break;
usbhid_mark_busy(usbhid);
if (!test_bit(HID_RESUME_RUNNING, &usbhid->iofl)) {
- hid_input_report(urb->context, HID_INPUT_REPORT,
- urb->transfer_buffer,
- urb->actual_length, 1);
+ hid_safe_input_report(urb->context, HID_INPUT_REPORT,
+ urb->transfer_buffer, urb->transfer_buffer_length,
+ urb->actual_length, 1);
/*
* autosuspend refused while keys are pressed
* because most keyboards don't wake up when
@@ -482,9 +482,10 @@ static void hid_ctrl(struct urb *urb)
switch (status) {
case 0: /* success */
if (usbhid->ctrl[usbhid->ctrltail].dir == USB_DIR_IN)
- hid_input_report(urb->context,
+ hid_safe_input_report(urb->context,
usbhid->ctrl[usbhid->ctrltail].report->type,
- urb->transfer_buffer, urb->actual_length, 0);
+ urb->transfer_buffer, urb->transfer_buffer_length,
+ urb->actual_length, 0);
break;
case -ESHUTDOWN: /* unplug */
unplug = 1;
--- a/include/linux/hid.h
+++ b/include/linux/hid.h
@@ -990,6 +990,8 @@ struct hid_field *hid_find_field(struct
int hid_set_field(struct hid_field *, unsigned, __s32);
int hid_input_report(struct hid_device *hid, enum hid_report_type type, u8 *data, u32 size,
int interrupt);
+int hid_safe_input_report(struct hid_device *hid, enum hid_report_type type, u8 *data,
+ size_t bufsize, u32 size, int interrupt);
struct hid_field *hidinput_get_led_field(struct hid_device *hid);
unsigned int hidinput_count_leds(struct hid_device *hid);
__s32 hidinput_calc_abs_res(const struct hid_field *field, __u16 code);
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 006/188] HID: pidff: Fix integer overflow in pidff_rescale
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 005/188] HID: core: introduce hid_safe_input_report() Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 007/188] media: uvcvideo: Enable VB2_DMABUF for metadata stream Greg Kroah-Hartman
` (186 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tomasz Pakuła, Jiri Kosina
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
commit 48d1677779ad6816978ad4a4f7588aec5ec960fe upstream.
Rescaling values close to the max (U16_MAX) temporarily creates values
that exceed the s32 range. This caused value overflow in case when, for
example, a periodic effect phase was higer than 180 degrees. In turn,
rescale function could return values outised of the logical range of the
HID field.
Fix by using 64 bit signed integer to store the value during calculation
but still return only 32 bit integer.
Closes: https://github.com/JacKeTUs/universal-pidff/issues/116
Fixes: 224ee88fe395 ("Input: add force feedback driver for PID devices")
Cc: stable@vger.kernel.org
Signed-off-by: Tomasz Pakuła <tomasz.pakula.oficjalny@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/usbhid/hid-pidff.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/hid/usbhid/hid-pidff.c
+++ b/drivers/hid/usbhid/hid-pidff.c
@@ -11,6 +11,7 @@
#include "hid-pidff.h"
#include <linux/hid.h>
#include <linux/input.h>
+#include <linux/math64.h>
#include <linux/minmax.h>
#include <linux/slab.h>
#include <linux/usb.h>
@@ -325,8 +326,10 @@ static s32 pidff_clamp(s32 i, struct hid
*/
static int pidff_rescale(int i, int max, struct hid_field *field)
{
- return i * (field->logical_maximum - field->logical_minimum) / max +
- field->logical_minimum;
+ /* 64 bits needed for big values during rescale */
+ s64 result = field->logical_maximum - field->logical_minimum;
+
+ return div_s64(result * i, max) + field->logical_minimum;
}
/*
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 007/188] media: uvcvideo: Enable VB2_DMABUF for metadata stream
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 006/188] HID: pidff: Fix integer overflow in pidff_rescale Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 008/188] drm/msm/hdmi: Fix wrong CTRL1 register used in writing info frames Greg Kroah-Hartman
` (185 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ricardo Ribalda, Laurent Pinchart,
Hans de Goede, Hans Verkuil
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <ribalda@chromium.org>
commit fbac03467e53d8d72e5099c03df26d9adae11416 upstream.
The UVC driver has two video streams, one for the frames and another one
for the metadata. Both streams share most of the codebase, but only the
data stream declares support for DMABUF transfer mode.
I have tried the DMABUF transfer mode with CONFIG_DMABUF_HEAPS_SYSTEM
and the frames looked correct.
This patch announces the support for DMABUF for the metadata stream.
This is useful for apps/HALs that only want to support DMABUF.
Cc: stable@vger.kernel.org
Fixes: 088ead2552458 ("media: uvcvideo: Add a metadata device node")
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Hans de Goede <johannes.goede@oss.qualcomm.com>
Link: https://patch.msgid.link/20260309-uvc-metadata-dmabuf-v1-1-fc8b87bd29c5@chromium.org
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/uvc/uvc_queue.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/media/usb/uvc/uvc_queue.c
+++ b/drivers/media/usb/uvc/uvc_queue.c
@@ -243,7 +243,7 @@ int uvc_queue_init(struct uvc_video_queu
int ret;
queue->queue.type = type;
- queue->queue.io_modes = VB2_MMAP | VB2_USERPTR;
+ queue->queue.io_modes = VB2_MMAP | VB2_USERPTR | VB2_DMABUF;
queue->queue.drv_priv = queue;
queue->queue.buf_struct_size = sizeof(struct uvc_buffer);
queue->queue.mem_ops = &vb2_vmalloc_memops;
@@ -256,7 +256,6 @@ int uvc_queue_init(struct uvc_video_queu
queue->queue.ops = &uvc_meta_queue_qops;
break;
default:
- queue->queue.io_modes |= VB2_DMABUF;
queue->queue.ops = &uvc_queue_qops;
break;
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 008/188] drm/msm/hdmi: Fix wrong CTRL1 register used in writing info frames
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 007/188] media: uvcvideo: Enable VB2_DMABUF for metadata stream Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 009/188] media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 Greg Kroah-Hartman
` (184 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski,
Dmitry Baryshkov
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
commit 8c6c93b7db42d15c6e8c2540a648d32986a04b1a upstream.
Commit 384d2b03d0a1 ("drm/msm/hdmi: make use of the drm_connector_hdmi
framework") changed the unconditional register writes in few places to
updates: read, apply mask, write. The new code reads
REG_HDMI_INFOFRAME_CTRL1 register, applies fields/mask for
HDMI_INFOFRAME_CTRL0 register and finally writes to
HDMI_INFOFRAME_CTRL0. This difference between CTRL1 and CTRL0 looks
unintended and may result in wrong data being written to HDMI bridge
registers.
Cc: <stable@vger.kernel.org>
Fixes: 384d2b03d0a1 ("drm/msm/hdmi: make use of the drm_connector_hdmi framework")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/711156/
Link: https://lore.kernel.org/r/20260311191620.245394-2-krzysztof.kozlowski@oss.qualcomm.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/msm/hdmi/hdmi_bridge.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/msm/hdmi/hdmi_bridge.c
+++ b/drivers/gpu/drm/msm/hdmi/hdmi_bridge.c
@@ -80,7 +80,7 @@ static int msm_hdmi_config_avi_infoframe
for (i = 0; i < ARRAY_SIZE(buf); i++)
hdmi_write(hdmi, REG_HDMI_AVI_INFO(i), buf[i]);
- val = hdmi_read(hdmi, REG_HDMI_INFOFRAME_CTRL1);
+ val = hdmi_read(hdmi, REG_HDMI_INFOFRAME_CTRL0);
val |= HDMI_INFOFRAME_CTRL0_AVI_SEND |
HDMI_INFOFRAME_CTRL0_AVI_CONT;
hdmi_write(hdmi, REG_HDMI_INFOFRAME_CTRL0, val);
@@ -116,7 +116,7 @@ static int msm_hdmi_config_audio_infofra
buffer[9] << 16 |
buffer[10] << 24);
- val = hdmi_read(hdmi, REG_HDMI_INFOFRAME_CTRL1);
+ val = hdmi_read(hdmi, REG_HDMI_INFOFRAME_CTRL0);
val |= HDMI_INFOFRAME_CTRL0_AUDIO_INFO_SEND |
HDMI_INFOFRAME_CTRL0_AUDIO_INFO_CONT |
HDMI_INFOFRAME_CTRL0_AUDIO_INFO_SOURCE |
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 009/188] media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 008/188] drm/msm/hdmi: Fix wrong CTRL1 register used in writing info frames Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 010/188] media: renesas: vsp1: Fix NULL pointer deref on module unload Greg Kroah-Hartman
` (183 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guoniu Zhou, Laurent Pinchart,
Hans Verkuil
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guoniu Zhou <guoniu.zhou@nxp.com>
commit 2f38622d0f85f317be9e6b131da6cd511db94fd2 upstream.
Fix a hang issue when capturing a single frame with applications like cam
in libcamera. It would hang waiting for the driver to complete the buffer,
but streaming never starts because min_queued_buffers was set to 2.
The ISI module uses a ping-pong buffer mechanism that requires two buffers
to be programmed at all times. However, when fewer than 2 user buffers are
available, the driver use internal discard buffers to fill the remaining
slot(s). Reduce minimum queued buffers from 2 to 0 allows streaming to
start without any queued buffers.
Fixes: cf21f328fcaf ("media: nxp: Add i.MX8 ISI driver")
Cc: stable@vger.kernel.org
Signed-off-by: Guoniu Zhou <guoniu.zhou@nxp.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Link: https://patch.msgid.link/20260312-isi_min_buffers-v2-1-d5ea1c79ad81@nxp.com
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c
+++ b/drivers/media/platform/nxp/imx8-isi/imx8-isi-video.c
@@ -1410,7 +1410,7 @@ int mxc_isi_video_register(struct mxc_is
q->mem_ops = &vb2_dma_contig_memops;
q->buf_struct_size = sizeof(struct mxc_isi_buffer);
q->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC;
- q->min_queued_buffers = 2;
+ q->min_queued_buffers = 0;
q->lock = &video->lock;
q->dev = pipe->isi->dev;
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 010/188] media: renesas: vsp1: Fix NULL pointer deref on module unload
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 009/188] media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 011/188] media: renesas: vin: Fix RAW8 (again) Greg Kroah-Hartman
` (182 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tomi Valkeinen, Kieran Bingham,
Jacopo Mondi, Sakari Ailus, Hans Verkuil
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
commit 58b1e9664d8f74d55d8411cc7a7b275a76a6f24f upstream.
When unloading the module on gen 4, we hit a NULL pointer dereference.
This is caused by the cleanup code calling vsp1_drm_cleanup() where it
should be calling vsp1_vspx_cleanup().
Fix this by checking the IP version and calling the drm or vspx function
accordingly, the same way as the init code does.
Fixes: d06c1a9f348d ("media: vsp1: Add VSPX support")
Cc: stable@vger.kernel.org
Signed-off-by: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
Reviewed-by: Kieran Bingham <kieran.bingham+renesas@ideasonboard.com>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/renesas/vsp1/vsp1_drv.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/renesas/vsp1/vsp1_drv.c b/drivers/media/platform/renesas/vsp1/vsp1_drv.c
index 2de515c497eb..627b5046fa80 100644
--- a/drivers/media/platform/renesas/vsp1/vsp1_drv.c
+++ b/drivers/media/platform/renesas/vsp1/vsp1_drv.c
@@ -240,8 +240,12 @@ static void vsp1_destroy_entities(struct vsp1_device *vsp1)
media_device_unregister(&vsp1->media_dev);
media_device_cleanup(&vsp1->media_dev);
- if (!vsp1->info->uapi)
- vsp1_drm_cleanup(vsp1);
+ if (!vsp1->info->uapi) {
+ if (vsp1->info->version == VI6_IP_VERSION_MODEL_VSPX_GEN4)
+ vsp1_vspx_cleanup(vsp1);
+ else
+ vsp1_drm_cleanup(vsp1);
+ }
}
static int vsp1_create_entities(struct vsp1_device *vsp1)
--
2.54.0
^ permalink raw reply related [flat|nested] 195+ messages in thread
* [PATCH 6.18 011/188] media: renesas: vin: Fix RAW8 (again)
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 010/188] media: renesas: vsp1: Fix NULL pointer deref on module unload Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 012/188] media: i2c: ov8856: free control handler on error in ov8856_init_controls() Greg Kroah-Hartman
` (181 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tomi Valkeinen,
Niklas Söderlund, Sakari Ailus, Hans Verkuil
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
commit 40c6da8a9c0f897f99a439330584d93ca7d41226 upstream.
Commit e7376745ad5c ("media: rcar-vin: Fix stride setting for RAW8
formats") removed dividing the stride by two for RAW8 formats. It is
unclear how this was tested, but in any of the recent tests this does
not seem to work and produces quite distorted images.
However, reverting the patch fixes the issues only partially. VNIS_REG
requires alignment to 16 bytes, and when dividing the stride by 2, in
some cases we end up with a non-aligned stride, producing a tilted
image. This issue has to be fixed in rvin_format_bytesperline() where we
do the alignment for bytesperline.
Adding back the stride division and increasing the alignment for RAW8
formats to 0x20 fixes the problems related to RAW8.
Fixes: e7376745ad5c ("media: rcar-vin: Fix stride setting for RAW8 formats")
Cc: stable@vger.kernel.org
Signed-off-by: Tomi Valkeinen <tomi.valkeinen+renesas@ideasonboard.com>
Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/renesas/rcar-vin/rcar-dma.c | 22 ++++++++++++++++++++
drivers/media/platform/renesas/rcar-vin/rcar-v4l2.c | 12 ++++++++++
2 files changed, 34 insertions(+)
--- a/drivers/media/platform/renesas/rcar-vin/rcar-dma.c
+++ b/drivers/media/platform/renesas/rcar-vin/rcar-dma.c
@@ -676,8 +676,30 @@ void rvin_crop_scale_comp(struct rvin_de
if (vin->scaler)
vin->scaler(vin);
+ /*
+ * VNIS_REG has four lowest bits always 0, i.e. the stride has to be
+ * aligned to 16 bytes. This is done in rvin_format_bytesperline().
+ */
+
fmt = rvin_format_from_pixel(vin, vin->format.pixelformat);
stride = vin->format.bytesperline / fmt->bpp;
+
+ /*
+ * RAW8 format bpp is 1, but the hardware process RAW8 format in 2 pixel
+ * units, so we need to divide the stride by 2.
+ */
+ switch (vin->format.pixelformat) {
+ case V4L2_PIX_FMT_SBGGR8:
+ case V4L2_PIX_FMT_SGBRG8:
+ case V4L2_PIX_FMT_SGRBG8:
+ case V4L2_PIX_FMT_SRGGB8:
+ case V4L2_PIX_FMT_GREY:
+ stride /= 2;
+ break;
+ default:
+ break;
+ }
+
rvin_write(vin, stride, VNIS_REG);
}
--- a/drivers/media/platform/renesas/rcar-vin/rcar-v4l2.c
+++ b/drivers/media/platform/renesas/rcar-vin/rcar-v4l2.c
@@ -155,6 +155,18 @@ static u32 rvin_format_bytesperline(stru
case V4L2_PIX_FMT_NV16:
align = 0x20;
break;
+ case V4L2_PIX_FMT_SBGGR8:
+ case V4L2_PIX_FMT_SGBRG8:
+ case V4L2_PIX_FMT_SGRBG8:
+ case V4L2_PIX_FMT_SRGGB8:
+ case V4L2_PIX_FMT_GREY:
+ /*
+ * RAW8 format bpp is 1, but the hardware process RAW8 format in
+ * 2 pixel units, and we need to align to 32 bytes. See
+ * rvin_crop_scale_comp().
+ */
+ align = 0x20;
+ break;
default:
align = 0x10;
break;
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 012/188] media: i2c: ov8856: free control handler on error in ov8856_init_controls()
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 011/188] media: renesas: vin: Fix RAW8 (again) Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 013/188] media: dt-bindings: rockchip,vdec: Add alternative reg-names order for RK35{76,88} Greg Kroah-Hartman
` (180 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Koskovich, Sakari Ailus,
Hans Verkuil
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Koskovich <akoskovich@pm.me>
commit f75e160745663ce9b13362ae6e90bd439c58df69 upstream.
The control handler wasn't freed if adding controls failed, add an error
exit label and convert the existing error return to use it.
Fixes: 879347f0c258 ("media: ov8856: Add support for OV8856 sensor")
Cc: stable@vger.kernel.org
Signed-off-by: Alexander Koskovich <akoskovich@pm.me>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/i2c/ov8856.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
--- a/drivers/media/i2c/ov8856.c
+++ b/drivers/media/i2c/ov8856.c
@@ -1951,12 +1951,18 @@ static int ov8856_init_controls(struct o
V4L2_CID_HFLIP, 0, 1, 1, 0);
v4l2_ctrl_new_std(ctrl_hdlr, &ov8856_ctrl_ops,
V4L2_CID_VFLIP, 0, 1, 1, 0);
- if (ctrl_hdlr->error)
- return ctrl_hdlr->error;
+ if (ctrl_hdlr->error) {
+ ret = ctrl_hdlr->error;
+ goto err_ctrl_handler_free;
+ }
ov8856->sd.ctrl_handler = ctrl_hdlr;
return 0;
+
+err_ctrl_handler_free:
+ v4l2_ctrl_handler_free(ctrl_hdlr);
+ return ret;
}
static void ov8856_update_pad_format(struct ov8856 *ov8856,
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 013/188] media: dt-bindings: rockchip,vdec: Add alternative reg-names order for RK35{76,88}
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 012/188] media: i2c: ov8856: free control handler on error in ov8856_init_controls() Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 014/188] media: dt-bindings: rockchip,vdec: Mark reg-names required " Greg Kroah-Hartman
` (179 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nicolas Dufresne,
Krzysztof Kozlowski, Cristian Ciocaltea, Hans Verkuil
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
commit 35c8178ed2bd9821a75a406d762b2f2e161f9c70 upstream.
With the introduction of the RK3588 SoC, and RK3576 afterwards, three
register blocks have been provided for the video decoder unit instead of
just one, which are further referenced in vendor's datasheet by 'link
table', 'function' and 'cache'. The former is present at the top of the
listing, starting at video decoder unit base address.
However, while documenting RK3588, the binding broke the convention
expecting the unit address to indicate the start of the primary register
range, i.e. the 'function' block got listed before the 'link' one.
Since the binding changes have been already released and a fix would
bring up an ABI break, mark the current 'reg-names' ordering as
deprecated and introduce an alternative 'link,function,cache' listing
which follows the address-based ordering according to the TRM.
Additionally, drop the 'reg' description items as the order is not fixed
anymore, while the information they offer is not very relevant anyway.
It's worth noting there are currently no (known) users impacted by these
binding changes, since the video decoder support for the aforementioned
SoCs in mainline driver and devicetrees hasn't been released yet - it
landed in v7.0-rc1 while all DTS updates resulting from this will be
handled before v7.0 is out.
Fixes: c6ffb7e1fb90 ("media: dt-bindings: rockchip: Document RK3588 Video Decoder bindings")
Fixes: a5c4a6526476 ("media: dt-bindings: rockchip: Add RK3576 Video Decoder bindings")
Cc: stable@vger.kernel.org
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/devicetree/bindings/media/rockchip,vdec.yaml | 20 +++++++------
1 file changed, 12 insertions(+), 8 deletions(-)
--- a/Documentation/devicetree/bindings/media/rockchip,vdec.yaml
+++ b/Documentation/devicetree/bindings/media/rockchip,vdec.yaml
@@ -27,16 +27,20 @@ properties:
reg:
minItems: 1
- items:
- - description: The function configuration registers base
- - description: The link table configuration registers base
- - description: The cache configuration registers base
+ maxItems: 3
reg-names:
- items:
- - const: function
- - const: link
- - const: cache
+ oneOf:
+ - items:
+ - const: link
+ - const: function
+ - const: cache
+ - items:
+ - const: function
+ - const: link
+ - const: cache
+ deprecated: true
+ description: Use link,function,cache block order instead.
interrupts:
maxItems: 1
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 014/188] media: dt-bindings: rockchip,vdec: Mark reg-names required for RK35{76,88}
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 013/188] media: dt-bindings: rockchip,vdec: Add alternative reg-names order for RK35{76,88} Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 015/188] media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init() Greg Kroah-Hartman
` (178 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Conor Dooley, Cristian Ciocaltea,
Conor Dooley, Nicolas Dufresne, Hans Verkuil
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
commit a11db8d8b403eba1f82728f440727128e9997edd upstream.
The Rockchip Video Decoder driver expects reg-names to be mandatory for
RK3576 and RK3588 SoCs, however the binding does not currently require
the use of them.
As a consequence, driver would fail to probe with a hypothetical
devicetree that doesn't provide the reg-names for these SoCs, but which
is otherwise a perfectly valid DT from the binding perspective.
Update the binding and make reg-names required for the aforementioned
SoCs. While this change introduces an ABI break, the expected impact on
potential users would be minimal, if any, since the old SoCs are
unaffected, while the video decoder support for these newer variants in
mainline driver and devicetrees hasn't been released yet.
Moreover, this is also a prerequisite for a subsequent binding update
introducing an alternative reg-names order, according to the
address-based listing in the vendor's datasheet.
Reported-by: Conor Dooley <conor@kernel.org>
Closes: https://lore.kernel.org/all/20260227-urologist-gratitude-7984733f2d41@spud/
Fixes: c6ffb7e1fb90 ("media: dt-bindings: rockchip: Document RK3588 Video Decoder bindings")
Fixes: a5c4a6526476 ("media: dt-bindings: rockchip: Add RK3576 Video Decoder bindings")
Cc: stable@vger.kernel.org
Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/devicetree/bindings/media/rockchip,vdec.yaml | 2 ++
1 file changed, 2 insertions(+)
--- a/Documentation/devicetree/bindings/media/rockchip,vdec.yaml
+++ b/Documentation/devicetree/bindings/media/rockchip,vdec.yaml
@@ -126,6 +126,8 @@ allOf:
minItems: 5
reset-names:
minItems: 5
+ required:
+ - reg-names
else:
properties:
reg:
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 015/188] media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init()
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 014/188] media: dt-bindings: rockchip,vdec: Mark reg-names required " Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 016/188] media: chips-media: wave5: add missing spinlock protection for send_eos_event() Greg Kroah-Hartman
` (177 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haoxiang Li, Nicolas Dufresne,
Hans Verkuil
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
commit 95bd174a453f77b09ea66e1e22834680754ba501 upstream.
Add wave5_vdi_free_dma_memory() in the error path of
wave5_vdi_init() to prevent a potential memory leak.
Fixes: 45d1a2b93277 ("media: chips-media: wave5: Add vpuapi layer")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/chips-media/wave5/wave5-vdi.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/media/platform/chips-media/wave5/wave5-vdi.c
+++ b/drivers/media/platform/chips-media/wave5/wave5-vdi.c
@@ -49,6 +49,7 @@ int wave5_vdi_init(struct device *dev)
if (!PRODUCT_CODE_W_SERIES(vpu_dev->product_code)) {
WARN_ONCE(1, "unsupported product code: 0x%x\n", vpu_dev->product_code);
+ wave5_vdi_free_dma_memory(vpu_dev, &vpu_dev->common_mem);
return -EOPNOTSUPP;
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 016/188] media: chips-media: wave5: add missing spinlock protection for send_eos_event()
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 015/188] media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init() Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 017/188] media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change() Greg Kroah-Hartman
` (176 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ziyi Guo, Nicolas Dufresne,
Hans Verkuil
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziyi Guo <n7l8m4@u.northwestern.edu>
commit f48050436746be75227fbc90066a8658cbe94d17 upstream.
Add spin_lock_irqsave()/spin_unlock_irqrestore() around send_eos_event()
calls in the VB2 buffer queue and streamoff callbacks to fix the missing
lock protection.
wave5_vpu_dec_buf_queue_dst() and streamoff_output() call send_eos_event()
without holding inst->state_spinlock. However, send_eos_event() has
lockdep_assert_held(&inst->state_spinlock) indicating that callers must
hold this lock.
Other callers of send_eos_event() properly acquire the spinlock:
- wave5_vpu_dec_finish_decode() acquires lock at line 431
- wave5_vpu_dec_encoder_cmd() acquires lock at line 821
- wave5_vpu_dec_device_run() acquires lock at line 1592
Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Fixes: 9707a6254a8a6b ("media: chips-media: wave5: Add the v4l2 layer")
Cc: stable@vger.kernel.org
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c
+++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c
@@ -1265,13 +1265,17 @@ static void wave5_vpu_dec_buf_queue_dst(
if (vb2_is_streaming(vb->vb2_queue) && v4l2_m2m_dst_buf_is_last(m2m_ctx)) {
unsigned int i;
+ unsigned long flags;
for (i = 0; i < vb->num_planes; i++)
vb2_set_plane_payload(vb, i, 0);
vbuf->field = V4L2_FIELD_NONE;
+ spin_lock_irqsave(&inst->state_spinlock, flags);
send_eos_event(inst);
+ spin_unlock_irqrestore(&inst->state_spinlock, flags);
+
v4l2_m2m_last_buffer_done(m2m_ctx, vbuf);
} else {
v4l2_m2m_buf_queue(m2m_ctx, vbuf);
@@ -1415,8 +1419,13 @@ static int streamoff_output(struct vb2_q
inst->codec_info->dec_info.stream_rd_ptr = new_rd_ptr;
inst->codec_info->dec_info.stream_wr_ptr = new_rd_ptr;
- if (v4l2_m2m_has_stopped(m2m_ctx))
+ if (v4l2_m2m_has_stopped(m2m_ctx)) {
+ unsigned long flags;
+
+ spin_lock_irqsave(&inst->state_spinlock, flags);
send_eos_event(inst);
+ spin_unlock_irqrestore(&inst->state_spinlock, flags);
+ }
/* streamoff on output cancels any draining operation */
inst->eos = false;
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 017/188] media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change()
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 016/188] media: chips-media: wave5: add missing spinlock protection for send_eos_event() Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 018/188] drm/gpusvm: Force unmapping on error in drm_gpusvm_get_pages Greg Kroah-Hartman
` (175 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ziyi Guo, Nicolas Dufresne,
Hans Verkuil
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziyi Guo <n7l8m4@u.northwestern.edu>
commit cb8bdd3ffca280d014311ab395651d33f58a8708 upstream.
Add spin_lock_irqsave()/spin_unlock_irqrestore() around the
handle_dynamic_resolution_change() call in initialize_sequence() to fix
the missing lock protection.
initialize_sequence() calls handle_dynamic_resolution_change() without
holding inst->state_spinlock. However, handle_dynamic_resolution_change()
has lockdep_assert_held(&inst->state_spinlock) indicating that callers
must hold this lock.
Other callers of handle_dynamic_resolution_change() properly acquire the
spinlock:
- wave5_vpu_dec_finish_decode()
- wave5_vpu_dec_device_run()
Signed-off-by: Ziyi Guo <n7l8m4@u.northwestern.edu>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Fixes: 9707a6254a8a6b ("media: chips-media: wave5: Add the v4l2 layer")
Cc: stable@vger.kernel.org
Signed-off-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c
+++ b/drivers/media/platform/chips-media/wave5/wave5-vpu-dec.c
@@ -1544,6 +1544,7 @@ static int initialize_sequence(struct vp
{
struct dec_initial_info initial_info;
int ret = 0;
+ unsigned long flags;
memset(&initial_info, 0, sizeof(struct dec_initial_info));
@@ -1565,7 +1566,9 @@ static int initialize_sequence(struct vp
return ret;
}
+ spin_lock_irqsave(&inst->state_spinlock, flags);
handle_dynamic_resolution_change(inst);
+ spin_unlock_irqrestore(&inst->state_spinlock, flags);
return 0;
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 018/188] drm/gpusvm: Force unmapping on error in drm_gpusvm_get_pages
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 017/188] media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change() Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 019/188] spi: bcm63xx: fix controller deregistration Greg Kroah-Hartman
` (174 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Matthew Brost, Francois Dugast
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Brost <matthew.brost@intel.com>
commit 556dba95473900073a6c03121361c11f646dc551 upstream.
drm_gpusvm_get_pages() only sets the local flags prior to committing the
pages. If an error occurs mid-mapping, has_dma_mapping will be clear,
causing the unmap function to skip unmapping pages that were
successfully mapped before the error. Fix this by forcibly setting
has_dma_mapping in the error path to ensure all previously mapped pages
are properly unmapped.
Fixes: 99624bdff867 ("drm/gpusvm: Add support for GPU Shared Virtual Memory")
Cc: stable@vger.kernel.org
Signed-off-by: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: Francois Dugast <francois.dugast@intel.com>
Link: https://patch.msgid.link/20260130194928.3255613-2-matthew.brost@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_gpusvm.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/drm_gpusvm.c
+++ b/drivers/gpu/drm/drm_gpusvm.c
@@ -1443,6 +1443,7 @@ set_seqno:
return 0;
err_unmap:
+ svm_pages->flags.has_dma_mapping = true;
__drm_gpusvm_unmap_pages(gpusvm, svm_pages, num_dma_mapped);
drm_gpusvm_notifier_unlock(gpusvm);
err_free:
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 019/188] spi: bcm63xx: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 018/188] drm/gpusvm: Force unmapping on error in drm_gpusvm_get_pages Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 020/188] spi: atmel: " Greg Kroah-Hartman
` (173 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Fainelli, Johan Hovold,
Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit c39e65a4e3b8e764efed0b2f5152a1a8547b80fd upstream.
Make sure to deregister the controller before disabling underlying
resources like clocks during driver unbind.
Fixes: b42dfed83d95 ("spi: add Broadcom BCM63xx SPI controller driver")
Cc: stable@vger.kernel.org # 3.4
Cc: Florian Fainelli <florian@openwrt.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260409120419.388546-6-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-bcm63xx.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-bcm63xx.c
+++ b/drivers/spi/spi-bcm63xx.c
@@ -603,7 +603,7 @@ static int bcm63xx_spi_probe(struct plat
goto out_clk_disable;
/* register and we are done */
- ret = devm_spi_register_controller(dev, host);
+ ret = spi_register_controller(host);
if (ret) {
dev_err(dev, "spi register failed\n");
goto out_clk_disable;
@@ -626,11 +626,17 @@ static void bcm63xx_spi_remove(struct pl
struct spi_controller *host = platform_get_drvdata(pdev);
struct bcm63xx_spi *bs = spi_controller_get_devdata(host);
+ spi_controller_get(host);
+
+ spi_unregister_controller(host);
+
/* reset spi block */
bcm_spi_writeb(bs, 0, SPI_INT_MASK);
/* HW shutdown */
clk_disable_unprepare(bs->clk);
+
+ spi_controller_put(host);
}
static int bcm63xx_spi_suspend(struct device *dev)
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 020/188] spi: atmel: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 019/188] spi: bcm63xx: fix controller deregistration Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 021/188] arm64: dts: lx2160a-cex7/lx2162a-sr-som: fix usd-cd & gpio pinmux Greg Kroah-Hartman
` (172 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Johan Hovold, Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 8d4de97e83520be89d0ff40610ca633b3963a7de upstream.
Make sure to deregister the controller before disabling underlying
resources like clocks during driver unbind.
Fixes: 754ce4f29937 ("[PATCH] SPI: atmel_spi driver")
Cc: stable@vger.kernel.org # 2.6.21
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260409120419.388546-5-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-atmel.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-atmel.c
+++ b/drivers/spi/spi-atmel.c
@@ -1655,7 +1655,7 @@ static int atmel_spi_probe(struct platfo
pm_runtime_set_active(&pdev->dev);
pm_runtime_enable(&pdev->dev);
- ret = devm_spi_register_controller(&pdev->dev, host);
+ ret = spi_register_controller(host);
if (ret)
goto out_free_dma;
@@ -1689,8 +1689,12 @@ static void atmel_spi_remove(struct plat
struct spi_controller *host = platform_get_drvdata(pdev);
struct atmel_spi *as = spi_controller_get_devdata(host);
+ spi_controller_get(host);
+
pm_runtime_get_sync(&pdev->dev);
+ spi_unregister_controller(host);
+
/* reset the hardware and block queue progress */
if (as->use_dma) {
atmel_spi_stop_dma(host);
@@ -1717,6 +1721,8 @@ static void atmel_spi_remove(struct plat
pm_runtime_put_noidle(&pdev->dev);
pm_runtime_disable(&pdev->dev);
+
+ spi_controller_put(host);
}
static int atmel_spi_runtime_suspend(struct device *dev)
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 021/188] arm64: dts: lx2160a-cex7/lx2162a-sr-som: fix usd-cd & gpio pinmux
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 020/188] spi: atmel: " Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 022/188] staging: media: atomisp: Disallow all private IOCTLs Greg Kroah-Hartman
` (171 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josua Mayer, Frank Li
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josua Mayer <josua@solid-run.com>
commit 70008aee892bbb5c2969bbe9e5778fc081b14bd2 upstream.
Commit 8a1365c7bbc1 ("arm64: dts: lx2160a: add pinmux and i2c gpio to
support bus recovery") introduced pinmux nodes for lx2160 i2c
interfaces, allowing runtime change between i2c and gpio functions
implementing bus recovery.
However, the dynamic configuration area (overwrite MUX) used by the
pinctrl-single driver initially reads as zero and does not reflect the
actual hardware state set by the Reset Configuration Word (RCW) at
power-on.
Because multiple groups of pins are configured from a single 32-bit
register, the first write from the pinctrl driver unintentionally clears
all other bits to zero.
For example, on the LX2162A Clearfog, RCWSR12 is initialized to
0x08000006. When any i2c pinmux is applied, it clears all other fields.
This inadvertently disables SD card-detect (IIC2_PMUX) and some GPIOs
(SDHC1_DIR_PMUX):
LX2162-CF RCWSR12: 0b0000100000000000 0000000000000110
IIC2_PMUX ||| ||| || | ||| |||XXX : I2C/GPIO/CD-WP
SDHC1_DIR_PMUX XXX ||| || | ||| ||| : SDHC/GPIO/SPI
Reverting the commit in question was considered but bus recovery is an
important feature.
Instead add pinmux nodes for those pins that were unintentionally
reconfigured on SolidRun LX2160A Clearfog-CX and LX2162A Clearfog
boards.
Fixes: 8a1365c7bbc1 ("arm64: dts: lx2160a: add pinmux and i2c gpio to support bus recovery")
Cc: stable@vger.kernel.org
Signed-off-by: Josua Mayer <josua@solid-run.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/freescale/fsl-lx2160a-cex7.dtsi | 7 +++
arch/arm64/boot/dts/freescale/fsl-lx2160a-clearfog-itx.dtsi | 2 +
arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi | 24 ++++++++++++
arch/arm64/boot/dts/freescale/fsl-lx2162a-clearfog.dts | 2 +
arch/arm64/boot/dts/freescale/fsl-lx2162a-sr-som.dtsi | 7 +++
5 files changed, 42 insertions(+)
--- a/arch/arm64/boot/dts/freescale/fsl-lx2160a-cex7.dtsi
+++ b/arch/arm64/boot/dts/freescale/fsl-lx2160a-cex7.dtsi
@@ -162,6 +162,8 @@
};
&fspi {
+ pinctrl-names = "default";
+ pinctrl-0 = <&fspi_data74_pins>, <&fspi_data30_pins>, <&fspi_dqs_sck_cs10_pins>;
status = "okay";
flash@0 {
@@ -177,6 +179,11 @@
};
};
+&pinmux_i2crv {
+ pinctrl-names = "default";
+ pinctrl-0 = <&gpio0_14_12_pins>;
+};
+
&usb0 {
status = "okay";
};
--- a/arch/arm64/boot/dts/freescale/fsl-lx2160a-clearfog-itx.dtsi
+++ b/arch/arm64/boot/dts/freescale/fsl-lx2160a-clearfog-itx.dtsi
@@ -89,6 +89,8 @@
};
&esdhc0 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&esdhc0_cd_wp_pins>, <&esdhc0_cmd_data30_clk_vsel_pins>;
sd-uhs-sdr104;
sd-uhs-sdr50;
sd-uhs-sdr25;
--- a/arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi
+++ b/arch/arm64/boot/dts/freescale/fsl-lx2160a.dtsi
@@ -1717,6 +1717,10 @@
pinctrl-single,bits = <0x0 0x1 0x7>;
};
+ esdhc0_cd_wp_pins: iic2-sdhc-pins {
+ pinctrl-single,bits = <0x0 0x6 0x7>;
+ };
+
i2c2_scl: i2c2-scl-pins {
pinctrl-single,bits = <0x0 0 (0x7 << 3)>;
};
@@ -1749,6 +1753,26 @@
pinctrl-single,bits = <0x0 (0x1 << 12) (0x7 << 12)>;
};
+ fspi_data74_pins: xspi1-data74-pins {
+ pinctrl-single,bits = <0x0 0x0 (0x7 << 15)>;
+ };
+
+ fspi_data30_pins: xspi1-data30-pins {
+ pinctrl-single,bits = <0x0 0x0 (0x7 << 18)>;
+ };
+
+ fspi_dqs_sck_cs10_pins: xspi1-base-pins {
+ pinctrl-single,bits = <0x0 0x0 (0x7 << 21)>;
+ };
+
+ esdhc0_cmd_data30_clk_vsel_pins: sdhc1-base-sdhc-vsel-pins {
+ pinctrl-single,bits = <0x0 0x0 (0x7 << 24)>;
+ };
+
+ gpio0_14_12_pins: sdhc1-dir-gpio-pins {
+ pinctrl-single,bits = <0x0 (0x1 << 27) (0x7 << 27)>;
+ };
+
i2c6_scl: i2c6-scl-pins {
pinctrl-single,bits = <0x4 0x2 0x7>;
};
--- a/arch/arm64/boot/dts/freescale/fsl-lx2162a-clearfog.dts
+++ b/arch/arm64/boot/dts/freescale/fsl-lx2162a-clearfog.dts
@@ -223,6 +223,8 @@
};
&esdhc0 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&esdhc0_cd_wp_pins>, <&esdhc0_cmd_data30_clk_vsel_pins>;
sd-uhs-sdr104;
sd-uhs-sdr50;
sd-uhs-sdr25;
--- a/arch/arm64/boot/dts/freescale/fsl-lx2162a-sr-som.dtsi
+++ b/arch/arm64/boot/dts/freescale/fsl-lx2162a-sr-som.dtsi
@@ -30,6 +30,8 @@
};
&fspi {
+ pinctrl-names = "default";
+ pinctrl-0 = <&fspi_data74_pins>, <&fspi_data30_pins>, <&fspi_dqs_sck_cs10_pins>;
status = "okay";
flash@0 {
@@ -80,3 +82,8 @@
reg = <0x6f>;
};
};
+
+&pinmux_i2crv {
+ pinctrl-names = "default";
+ pinctrl-0 = <&gpio0_14_12_pins>;
+};
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 022/188] staging: media: atomisp: Disallow all private IOCTLs
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 021/188] arm64: dts: lx2160a-cex7/lx2162a-sr-som: fix usd-cd & gpio pinmux Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 023/188] regulator: mt6357: fix OF node reference imbalance Greg Kroah-Hartman
` (170 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Soufiane Dani, Sakari Ailus,
Mauro Carvalho Chehab
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <sakari.ailus@linux.intel.com>
commit 2b7eb2c5dc72f0fc954ac4aa155f9e285e937f7c upstream.
Disallow all private IOCTLs. These aren't quite as safe as one could
assume of IOCTL handlers; disable them for now. Instead of removing the
code, return in the beginning of the function if cmd is non-zero in order
to keep static checkers happy.
Reported-by: Soufiane Dani <soufianeda@tutanota.com>
Closes: https://lore.kernel.org/linux-staging/20260210-atomisp-fix-v1-1-024429cbff31@tutanota.com/
Cc: stable@vger.kernel.org
Fixes: a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2")
Fixes: ad85094b293e ("Revert "media: staging: atomisp: Remove driver"")
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/media/atomisp/pci/atomisp_ioctl.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/staging/media/atomisp/pci/atomisp_ioctl.c
+++ b/drivers/staging/media/atomisp/pci/atomisp_ioctl.c
@@ -1357,6 +1357,10 @@ static int atomisp_s_parm(struct file *f
static long atomisp_vidioc_default(struct file *file, void *fh,
bool valid_prio, unsigned int cmd, void *arg)
{
+ /* Disable all private IOCTLs for now! */
+ if (cmd)
+ return -EINVAL;
+
struct video_device *vdev = video_devdata(file);
struct atomisp_sub_device *asd = atomisp_to_video_pipe(vdev)->asd;
int err;
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 023/188] regulator: mt6357: fix OF node reference imbalance
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 022/188] staging: media: atomisp: Disallow all private IOCTLs Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 024/188] spi: st-ssc4: fix controller deregistration Greg Kroah-Hartman
` (169 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Johan Hovold, Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 2f38e96c273e15f5e9f5d1fc2c0cbba703751602 upstream.
The driver reuses the OF node of the parent multi-function device but
fails to take another reference to balance the one dropped by the
platform bus code when unbinding the MFD and deregistering the child
devices.
Fix this by using the intended helper for reusing OF nodes.
Fixes: dafc7cde23dc ("regulator: add mt6357 regulator")
Cc: stable@vger.kernel.org # 6.2
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260408073055.5183-5-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/regulator/mt6357-regulator.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/regulator/mt6357-regulator.c
+++ b/drivers/regulator/mt6357-regulator.c
@@ -410,7 +410,7 @@ static int mt6357_regulator_probe(struct
struct regulator_dev *rdev;
int i;
- pdev->dev.of_node = pdev->dev.parent->of_node;
+ device_set_of_node_from_dev(&pdev->dev, pdev->dev.parent);
for (i = 0; i < MT6357_MAX_REGULATOR; i++) {
config.dev = &pdev->dev;
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 024/188] spi: st-ssc4: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 023/188] regulator: mt6357: fix OF node reference imbalance Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 025/188] regulator: max77650: fix OF node reference imbalance Greg Kroah-Hartman
` (168 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lee Jones, Johan Hovold, Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 19857374010d06ca6a2f7c2c53464122eb804df0 upstream.
Make sure to deregister the controller before disabling underlying
resources like clocks during driver unbind.
Fixes: 9e862375c542 ("spi: Add new driver for STMicroelectronics' SPI Controller")
Cc: stable@vger.kernel.org # 4.0
Cc: Lee Jones <lee@kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260410081757.503099-18-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-st-ssc4.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-st-ssc4.c
+++ b/drivers/spi/spi-st-ssc4.c
@@ -349,7 +349,7 @@ static int spi_st_probe(struct platform_
platform_set_drvdata(pdev, host);
- ret = devm_spi_register_controller(&pdev->dev, host);
+ ret = spi_register_controller(host);
if (ret) {
dev_err(&pdev->dev, "Failed to register host\n");
goto rpm_disable;
@@ -371,10 +371,16 @@ static void spi_st_remove(struct platfor
struct spi_controller *host = platform_get_drvdata(pdev);
struct spi_st *spi_st = spi_controller_get_devdata(host);
+ spi_controller_get(host);
+
+ spi_unregister_controller(host);
+
pm_runtime_disable(&pdev->dev);
clk_disable_unprepare(spi_st->clk);
+ spi_controller_put(host);
+
pinctrl_pm_select_sleep_state(&pdev->dev);
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 025/188] regulator: max77650: fix OF node reference imbalance
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 024/188] spi: st-ssc4: fix controller deregistration Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 026/188] media: rc: xbox_remote: heed DMA restrictions Greg Kroah-Hartman
` (167 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bartosz Golaszewski, Johan Hovold,
Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 2edaf5f7ada0ab5c9ec1f0836bd19779a8d85262 upstream.
The driver reuses the OF node of the parent multi-function device but
fails to take another reference to balance the one dropped by the
platform bus code when unbinding the MFD and deregistering the child
devices.
Fix this by using the intended helper for reusing OF nodes.
Fixes: bcc61f1c44fd ("regulator: max77650: add regulator support")
Cc: stable@vger.kernel.org # 5.1
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260408073055.5183-4-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/regulator/max77650-regulator.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/regulator/max77650-regulator.c
+++ b/drivers/regulator/max77650-regulator.c
@@ -337,7 +337,7 @@ static int max77650_regulator_probe(stru
parent = dev->parent;
if (!dev->of_node)
- dev->of_node = parent->of_node;
+ device_set_of_node_from_dev(dev, parent);
rdescs = devm_kcalloc(dev, MAX77650_REGULATOR_NUM_REGULATORS,
sizeof(*rdescs), GFP_KERNEL);
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 026/188] media: rc: xbox_remote: heed DMA restrictions
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 025/188] regulator: max77650: fix OF node reference imbalance Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 027/188] media: rc: streamzap: Error handling in probe Greg Kroah-Hartman
` (166 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Oliver Neukum, Sean Young,
Hans Verkuil
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <oneukum@suse.com>
commit e280d1e5e3f2595bbb43fe6e1bce00c59a43c0ff upstream.
The buffer for IO must not be part of the device structure
because that violates the DMA coherency rules.
Fixes: 02d32bdad3123 ("media: rc: add driver for Xbox DVD Movie Playback Kit")
Cc: stable@vger.kernel.org
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/rc/xbox_remote.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/drivers/media/rc/xbox_remote.c
+++ b/drivers/media/rc/xbox_remote.c
@@ -55,7 +55,7 @@ struct xbox_remote {
struct usb_interface *interface;
struct urb *irq_urb;
- unsigned char inbuf[DATA_BUFSIZE] __aligned(sizeof(u16));
+ u8 *inbuf;
char rc_name[NAME_BUFSIZE];
char rc_phys[NAME_BUFSIZE];
@@ -218,6 +218,10 @@ static int xbox_remote_probe(struct usb_
if (!xbox_remote || !rc_dev)
goto exit_free_dev_rdev;
+ xbox_remote->inbuf = kzalloc(DATA_BUFSIZE, GFP_KERNEL);
+ if (!xbox_remote->inbuf)
+ goto exit_free_inbuf;
+
/* Allocate URB buffer */
xbox_remote->irq_urb = usb_alloc_urb(0, GFP_KERNEL);
if (!xbox_remote->irq_urb)
@@ -262,6 +266,8 @@ exit_kill_urbs:
usb_kill_urb(xbox_remote->irq_urb);
exit_free_buffers:
usb_free_urb(xbox_remote->irq_urb);
+exit_free_inbuf:
+ kfree(xbox_remote->inbuf);
exit_free_dev_rdev:
rc_free_device(rc_dev);
kfree(xbox_remote);
@@ -286,6 +292,7 @@ static void xbox_remote_disconnect(struc
usb_kill_urb(xbox_remote->irq_urb);
rc_unregister_device(xbox_remote->rdev);
usb_free_urb(xbox_remote->irq_urb);
+ kfree(xbox_remote->inbuf);
kfree(xbox_remote);
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 027/188] media: rc: streamzap: Error handling in probe
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 026/188] media: rc: xbox_remote: heed DMA restrictions Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 028/188] media: i2c: imx283: Enter full standby when stopping streaming Greg Kroah-Hartman
` (165 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Oliver Neukum, Sean Young,
Hans Verkuil
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <oneukum@suse.com>
commit 42844992664f03ef9f930e64f7370fa481e9c267 upstream.
If submitting the URB fails, the device will be unusable.
Probe() must fail.
Fixes: 7a569f524dd36 ("V4L/DVB: IR/streamzap: functional in-kernel decoding")
Cc: stable@vger.kernel.org
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/rc/streamzap.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/drivers/media/rc/streamzap.c
+++ b/drivers/media/rc/streamzap.c
@@ -219,9 +219,8 @@ static void streamzap_callback(struct ur
case -ESHUTDOWN:
/*
* this urb is terminated, clean up.
- * sz might already be invalid at this point
*/
- dev_err(sz->dev, "urb terminated, status: %d\n", urb->status);
+ dev_dbg(sz->dev, "urb terminated, status: %d\n", urb->status);
return;
default:
break;
@@ -358,11 +357,16 @@ static int streamzap_probe(struct usb_in
usb_set_intfdata(intf, sz);
- if (usb_submit_urb(sz->urb_in, GFP_ATOMIC))
+ retval = usb_submit_urb(sz->urb_in, GFP_ATOMIC);
+ if (retval < 0) {
dev_err(sz->dev, "urb submit failed\n");
+ goto rc_submit_fail;
+ }
return 0;
-
+rc_submit_fail:
+ rc_free_device(sz->rdev);
+ usb_set_intfdata(intf, NULL);
rc_dev_fail:
usb_free_urb(sz->urb_in);
free_buf_in:
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 028/188] media: i2c: imx283: Enter full standby when stopping streaming
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 027/188] media: rc: streamzap: Error handling in probe Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 029/188] regulator: bq257xx: fix OF node reference imbalance Greg Kroah-Hartman
` (164 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jai Luthra, Kieran Bingham,
Sakari Ailus, Mauro Carvalho Chehab
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jai Luthra <jai.luthra@ideasonboard.com>
commit bce1349dbf6348ddee47308e2ed08878356de317 upstream.
Use IMX283_STANDBY (bit 0) instead of IMX283_STBLOGIC (bit 1) when
stopping streaming. STBLOGIC only puts the sensor logic into standby but
leaves the MIPI interface (along with other components) in an
indeterminate state.
This (presumably) causes the CSI receiver (e.g. Raspberry Pi's CFE) to
miss the LP-11 to HS transition when streaming restarts, resulting in a
hang of 10+ seconds. The issue is most visible when immediately
restarting a full-resolution stream after stopping a 3x3 binned one, so
that runtime suspend hasn't yet been triggered.
Writing IMX283_STANDBY puts the entire sensor into standby. The
imx283_standby_cancel() sequence already handles the full wakeup from
this suspended state.
Cc: stable@vger.kernel.org
Link: https://github.com/raspberrypi/linux/issues/7153
Link: https://github.com/will127534/OneInchEye/issues/12
Fixes: ccb4eb4496fa ("media: i2c: Add imx283 camera sensor driver")
Signed-off-by: Jai Luthra <jai.luthra@ideasonboard.com>
Tested-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/i2c/imx283.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/i2c/imx283.c
+++ b/drivers/media/i2c/imx283.c
@@ -1158,7 +1158,7 @@ static int imx283_disable_streams(struct
if (pad != IMAGE_PAD)
return -EINVAL;
- ret = cci_write(imx283->cci, IMX283_REG_STANDBY, IMX283_STBLOGIC, NULL);
+ ret = cci_write(imx283->cci, IMX283_REG_STANDBY, IMX283_STANDBY, NULL);
if (ret)
dev_err(imx283->dev, "Failed to stop stream\n");
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 029/188] regulator: bq257xx: fix OF node reference imbalance
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 028/188] media: i2c: imx283: Enter full standby when stopping streaming Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 030/188] regulator: rk808: " Greg Kroah-Hartman
` (163 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris Morgan, Douglas Anderson,
Johan Hovold, Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 7ea07bc030d8d6395524dec22ff3267441a28c0d upstream.
The driver reuses the OF node of the parent multi-function device but
fails to take another reference to balance the one dropped by the
platform bus code when unbinding the MFD and deregistering the child
devices.
Fix this by using the intended helper for reusing OF nodes.
Fixes: 981dd162b635 ("regulator: bq257xx: Add bq257xx boost regulator driver")
Cc: stable@vger.kernel.org # 6.18
Cc: Chris Morgan <macromorgan@hotmail.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260408073055.5183-2-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/regulator/bq257xx-regulator.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/regulator/bq257xx-regulator.c
+++ b/drivers/regulator/bq257xx-regulator.c
@@ -142,8 +142,7 @@ static int bq257xx_regulator_probe(struc
struct device_node *np = dev->of_node;
struct regulator_config cfg = {};
- pdev->dev.of_node = pdev->dev.parent->of_node;
- pdev->dev.of_node_reused = true;
+ device_set_of_node_from_dev(&pdev->dev, pdev->dev.parent);
pdata = devm_kzalloc(&pdev->dev, sizeof(struct bq257xx_reg_data), GFP_KERNEL);
if (!pdata)
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 030/188] regulator: rk808: fix OF node reference imbalance
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 029/188] regulator: bq257xx: fix OF node reference imbalance Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 031/188] media: videobuf2: Set vma_flags in vb2_dma_sg_mmap Greg Kroah-Hartman
` (162 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sebastian Reichel, Douglas Anderson,
Johan Hovold, Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 65290b24d8a5f0b8cd065201e653db824c4a4da6 upstream.
The driver reuses the OF node of the parent multi-function device but
fails to take another reference to balance the one dropped by the
platform bus code when unbinding the MFD and deregistering the child
devices.
Fix this by using the intended helper for reusing OF nodes.
Fixes: 647e57351f8e ("regulator: rk808: reduce 'struct rk808' usage")
Cc: stable@vger.kernel.org # 6.2
Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260408073055.5183-3-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/regulator/rk808-regulator.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/regulator/rk808-regulator.c
+++ b/drivers/regulator/rk808-regulator.c
@@ -1875,8 +1875,7 @@ static int rk808_regulator_probe(struct
struct regmap *regmap;
int ret, i, nregulators;
- pdev->dev.of_node = pdev->dev.parent->of_node;
- pdev->dev.of_node_reused = true;
+ device_set_of_node_from_dev(&pdev->dev, pdev->dev.parent);
regmap = dev_get_regmap(pdev->dev.parent, NULL);
if (!regmap)
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 031/188] media: videobuf2: Set vma_flags in vb2_dma_sg_mmap
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 030/188] regulator: rk808: " Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 032/188] media: intel/ipu6: fix error pointer dereference Greg Kroah-Hartman
` (161 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Janne Grunau, Marek Szyprowski,
Hans Verkuil
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Janne Grunau <j@jannau.net>
commit 7254b31a13aaa0c2c0f9ffbc335b718656117ff4 upstream.
vb2_dma_contig sets VMA flags VM_DONTEXPAND and VM_DONTDUMP and I do not
see a reason why vb2_dma_sg should behave differently. This avoids
hitting `WARN_ON(!(vma->vm_flags & VM_DONTEXPAND));` in
drm_gem_mmap_obj() during mmap() of an imported dma-buf from the out of
tree Apple ISP camera capture driver which uses vb2_dma_sg_memops.
gst-launch-1.0 v4l2src ! gtk4paintablesink
[ 38.201528] ------------[ cut here ]------------
[ 38.202135] WARNING: CPU: 7 PID: 2362 at drivers/gpu/drm/drm_gem.c:1144 drm_gem_mmap_obj+0x1f8/0x210
[ 38.203278] Modules linked in: rfcomm snd_seq_dummy snd_hrtimer
snd_seq snd_seq_device uinput nf_conntrack_netbios_ns
nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib
nft_reject_inet nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat
nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables qrtr bnep
nls_ascii i2c_dev loop fuse dm_multipath nfnetlink brcmfmac_wcc
hid_magicmouse hci_bcm4377 brcmfmac brcmutil bluetooth ecdh_generic
cfg80211 ecc btrfs xor xor_neon rfkill hid_apple raid6_pq joydev
aop_als apple_nvmem_spmi industrialio snd_soc_aop apple_z2
snd_soc_cs42l84 tps6598x snd_soc_tas2764 macsmc_reboot spi_nor
macsmc_hwmon rtc_macsmc gpio_macsmc macsmc_power regmap_spmi
macsmc_input dockchannel_hid panel_summit appledrm nvme_apple dwc3
snd_soc_macaudio drm_client_lib nvme_core phy_apple_atc hwmon
apple_sart apple_dockchannel macsmc apple_rtkit_helper
spmi_apple_controller aop apple_wdt mfd_core nvmem_apple_efuses
pinctrl_apple_gpio apple_isp apple_dcp videobuf2_dma_sg mux_core
spi_apple
[ 38.203300] videobuf2_memops i2c_pasemi_platform snd_soc_apple_mca videobuf2_v4l2 videodev clk_apple_nco videobuf2_common snd_pcm_dmaengine adpdrm asahi apple_admac adpdrm_mipi drm_dma_helper pwm_apple i2c_pasemi_core drm_display_helper mc cec apple_dart ofpart apple_soc_cpufreq leds_pwm phram
[ 38.217677] CPU: 7 UID: 1000 PID: 2362 Comm: gst-launch-1.0 Tainted: G W 6.17.6+ #asahi-dev PREEMPT(full)
[ 38.219040] Tainted: [W]=WARN
[ 38.219398] Hardware name: Apple MacBook Pro (13-inch, M2, 2022) (DT)
[ 38.220213] pstate: 21400005 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
[ 38.221088] pc : drm_gem_mmap_obj+0x1f8/0x210
[ 38.221643] lr : drm_gem_mmap_obj+0x78/0x210
[ 38.222178] sp : ffffc0008dc678e0
[ 38.222579] x29: ffffc0008dc678e0 x28: 0000000000042a97 x27: ffff8000b701b480
[ 38.223465] x26: 00000000000000fb x25: ffffc0008dc67d20 x24: ffffc0008dc67968
[ 38.224402] x23: ffff8000e3ca5600 x22: ffff8000265b7800 x21: ffff80003000c0c0
[ 38.225279] x20: 0000000000000000 x19: ffff8000b68c5200 x18: ffffc0008dc67968
[ 38.226151] x17: 0000000000000000 x16: 0000000000000000 x15: ffffc000810a30a8
[ 38.227042] x14: 00007fff637effff x13: 00005555de91ffff x12: 00007fff63293fff
[ 38.227942] x11: 0000000000000000 x10: ffff8000184ecf08 x9 : ffffc0007a1900c8
[ 38.228824] x8 : ffffc0008dc67968 x7 : 0000000000000012 x6 : ffffc0015cf1c000
[ 38.229703] x5 : ffffc0008dc676a0 x4 : ffffc00081a27dc0 x3 : 0000000000000038
[ 38.230607] x2 : 0000000000000003 x1 : 0000000000000003 x0 : 00000000100000fb
[ 38.231488] Call trace:
[ 38.231806] drm_gem_mmap_obj+0x1f8/0x210 (P)
[ 38.232342] drm_gem_mmap+0x140/0x260
[ 38.232813] __mmap_region+0x488/0x9a0
[ 38.233277] mmap_region+0xd0/0x148
[ 38.233703] do_mmap+0x350/0x5c0
[ 38.234148] vm_mmap_pgoff+0x14c/0x200
[ 38.234612] ksys_mmap_pgoff+0x150/0x208
[ 38.235107] __arm64_sys_mmap+0x34/0x50
[ 38.235611] invoke_syscall+0x50/0x120
[ 38.236075] el0_svc_common.constprop.0+0x48/0xf0
[ 38.236680] do_el0_svc+0x24/0x38
[ 38.237113] el0_svc+0x38/0x168
[ 38.237507] el0t_64_sync_handler+0xa0/0xe8
[ 38.238034] el0t_64_sync+0x198/0x1a0
[ 38.238491] ---[ end trace 0000000000000000 ]---
There were discussions in [1] at the end of 2023 that mmap() on imported
dma-bufs should not be supported but as of v6.17 drm_gem_shmem_mmap() in
drm_gem_shmem_helper.c still supports it.
This might affect all gpu or accel drivers using drm_gem_shmem_mmap() or
the wrapper drm_gem_shmem_object_mmap().
[1] https://lore.kernel.org/dri-devel/bc7f7844-0aa3-4802-b203-69d58e8be2fa@linux.intel.com/
Cc: stable@vger.kernel.org
Fixes: 5ba3f757f059 ("[media] v4l: videobuf2: add DMA scatter/gather allocator")
Signed-off-by: Janne Grunau <j@jannau.net>
Acked-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/common/videobuf2/videobuf2-dma-sg.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/media/common/videobuf2/videobuf2-dma-sg.c
+++ b/drivers/media/common/videobuf2/videobuf2-dma-sg.c
@@ -345,6 +345,7 @@ static int vb2_dma_sg_mmap(void *buf_pri
return err;
}
+ vm_flags_set(vma, VM_DONTEXPAND | VM_DONTDUMP);
/*
* Use common vm_area operations to track buffer refcount.
*/
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 032/188] media: intel/ipu6: fix error pointer dereference
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 031/188] media: videobuf2: Set vma_flags in vb2_dma_sg_mmap Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 033/188] media: i2c: imx283: Fix hang when going from large to small resolution Greg Kroah-Hartman
` (160 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ethan Tidmore, Sakari Ailus,
Mauro Carvalho Chehab
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ethan Tidmore <ethantidmore06@gmail.com>
commit 8dd088b8b106f7b119664f965b691785998edcfb upstream.
In a error path isp->psys is confirmed to be an error pointer not NULL so
this condition is true and the error pointer is dereferenced. So isp-psys
should be set to NULL before going to out_ipu6_bus_del_devices.
Detected by Smatch:
drivers/media/pci/intel/ipu6/ipu6.c:690 ipu6_pci_probe() error:
'isp->psys' dereferencing possible ERR_PTR()
Fixes: 25fedc021985a ("media: intel/ipu6: add Intel IPU6 PCI device driver")
Cc: stable@vger.kernel.org
Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
[Sakari Ailus: Fix commit message.]
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/pci/intel/ipu6/ipu6.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/pci/intel/ipu6/ipu6.c
+++ b/drivers/media/pci/intel/ipu6/ipu6.c
@@ -686,7 +686,7 @@ out_free_irq:
out_ipu6_rpm_put:
pm_runtime_put_sync(&isp->psys->auxdev.dev);
out_ipu6_bus_del_devices:
- if (isp->psys) {
+ if (!IS_ERR_OR_NULL(isp->psys)) {
ipu6_cpd_free_pkg_dir(isp->psys);
ipu6_buttress_unmap_fw_image(isp->psys, &isp->psys->fw_sgt);
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 033/188] media: i2c: imx283: Fix hang when going from large to small resolution
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 032/188] media: intel/ipu6: fix error pointer dereference Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 034/188] regulator: act8945a: fix OF node reference imbalance Greg Kroah-Hartman
` (159 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jai Luthra, Kieran Bingham,
Sakari Ailus, Mauro Carvalho Chehab
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jai Luthra <jai.luthra@ideasonboard.com>
commit 9206359b2c396ff594adf39bc7daaadab0fcb367 upstream.
When switching between modes (e.g. full resolution to binned),
standby_cancel() previously cleared XMSTA (starting master mode data
output) before the new mode's MDSEL, crop, and timing registers were
programmed in start_streaming(). This caused the sensor to briefly
output MIPI data using the previous mode's configuration.
On receivers like imx-mipi-csis, this leads to FIFO overflow errors
when switching from a higher to a lower resolution, as the receiver is
configured for the new smaller frame size but receives stale
full-resolution data.
Fix this by moving the XMSTA and SYNCDRV register writes from
standby_cancel() to the end of start_streaming(), after all mode,
crop, and timing registers have been configured. Also explicitly stop
master mode (XMSTA=1) when stopping the stream, matching the pattern
used by other Sony sensor drivers (imx290, imx415).
Use named macros IMX283_XMSTA_START/STOP instead of raw 0/BIT(0) for
readability.
Cc: stable@vger.kernel.org
Fixes: ccb4eb4496fa ("media: i2c: Add imx283 camera sensor driver")
Signed-off-by: Jai Luthra <jai.luthra@ideasonboard.com>
Tested-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/i2c/imx283.c | 15 ++++++++++-----
1 file changed, 10 insertions(+), 5 deletions(-)
--- a/drivers/media/i2c/imx283.c
+++ b/drivers/media/i2c/imx283.c
@@ -129,7 +129,8 @@
/* Master Mode Operation Control */
#define IMX283_REG_XMSTA CCI_REG8(0x3105)
-#define IMX283_XMSTA BIT(0)
+#define IMX283_XMSTA_START 0
+#define IMX283_XMSTA_STOP BIT(0)
#define IMX283_REG_SYNCDRV CCI_REG8(0x3107)
#define IMX283_SYNCDRV_XHS_XVS (0xa0 | 0x02)
@@ -1023,8 +1024,6 @@ static int imx283_standby_cancel(struct
usleep_range(19000, 20000);
cci_write(imx283->cci, IMX283_REG_CLAMP, IMX283_CLPSQRST, &ret);
- cci_write(imx283->cci, IMX283_REG_XMSTA, 0, &ret);
- cci_write(imx283->cci, IMX283_REG_SYNCDRV, IMX283_SYNCDRV_XHS_XVS, &ret);
return ret;
}
@@ -1117,6 +1116,10 @@ static int imx283_start_streaming(struct
/* Apply customized values from controls (HMAX/VMAX/SHR) */
ret = __v4l2_ctrl_handler_setup(imx283->sd.ctrl_handler);
+ /* Start master mode */
+ cci_write(imx283->cci, IMX283_REG_XMSTA, IMX283_XMSTA_START, &ret);
+ cci_write(imx283->cci, IMX283_REG_SYNCDRV, IMX283_SYNCDRV_XHS_XVS, &ret);
+
return ret;
}
@@ -1153,12 +1156,14 @@ static int imx283_disable_streams(struct
u64 streams_mask)
{
struct imx283 *imx283 = to_imx283(sd);
- int ret;
+ int ret = 0;
if (pad != IMAGE_PAD)
return -EINVAL;
- ret = cci_write(imx283->cci, IMX283_REG_STANDBY, IMX283_STANDBY, NULL);
+ cci_write(imx283->cci, IMX283_REG_XMSTA, IMX283_XMSTA_STOP, &ret);
+ cci_write(imx283->cci, IMX283_REG_STANDBY, IMX283_STANDBY, &ret);
+
if (ret)
dev_err(imx283->dev, "Failed to stop stream\n");
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 034/188] regulator: act8945a: fix OF node reference imbalance
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 033/188] media: i2c: imx283: Fix hang when going from large to small resolution Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 035/188] regulator: s2dos05: " Greg Kroah-Hartman
` (158 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wenyou Yang, Johan Hovold,
Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 0d15ce31375ccef4162f960b34547a821b7619d2 upstream.
The driver reuses the OF node of the parent multi-function device but
fails to take another reference to balance the one dropped by the
platform bus code when unbinding the MFD and deregistering the child
devices.
Fix this by using the intended helper for reusing OF nodes.
Fixes: 38c09961048b ("regulator: act8945a: add regulator driver for ACT8945A")
Cc: stable@vger.kernel.org # 4.6
Cc: Wenyou Yang <wenyou.yang@atmel.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260408073055.5183-7-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/regulator/act8945a-regulator.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/regulator/act8945a-regulator.c
+++ b/drivers/regulator/act8945a-regulator.c
@@ -302,8 +302,9 @@ static int act8945a_pmic_probe(struct pl
num_regulators = ARRAY_SIZE(act8945a_regulators);
}
+ device_set_of_node_from_dev(&pdev->dev, pdev->dev.parent);
+
config.dev = &pdev->dev;
- config.dev->of_node = pdev->dev.parent->of_node;
config.driver_data = act8945a;
for (i = 0; i < num_regulators; i++) {
rdev = devm_regulator_register(&pdev->dev, ®ulators[i],
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 035/188] regulator: s2dos05: fix OF node reference imbalance
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 034/188] regulator: act8945a: fix OF node reference imbalance Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 036/188] regulator: bd9571mwv: " Greg Kroah-Hartman
` (157 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dzmitry Sankouski, Johan Hovold,
Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit ebe694d67f159899b063eee61bacda4cb825ed7b upstream.
The driver reuses the OF node of the parent multi-function device but
fails to take another reference to balance the one dropped by the
platform bus code when unbinding the MFD and deregistering the child
devices.
Fix this by using the intended helper for reusing OF nodes.
Fixes: bb2441402392 ("regulator: add s2dos05 regulator support")
Cc: stable@vger.kernel.org # 6.18
Cc: Dzmitry Sankouski <dsankouski@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260408073055.5183-6-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/regulator/s2dos05-regulator.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/regulator/s2dos05-regulator.c
+++ b/drivers/regulator/s2dos05-regulator.c
@@ -126,7 +126,7 @@ static int s2dos05_pmic_probe(struct pla
s2dos05->regmap = iodev->regmap_pmic;
s2dos05->dev = dev;
if (!dev->of_node)
- dev->of_node = dev->parent->of_node;
+ device_set_of_node_from_dev(dev, dev->parent);
config.dev = dev;
config.driver_data = s2dos05;
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 036/188] regulator: bd9571mwv: fix OF node reference imbalance
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 035/188] regulator: s2dos05: " Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 037/188] spi: lantiq-ssc: fix controller deregistration Greg Kroah-Hartman
` (156 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marek Vasut, Johan Hovold,
Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 8498100ee1d00422b8c5b161b3e332278b92a59a upstream.
The driver reuses the OF node of the parent multi-function device but
fails to take another reference to balance the one dropped by the
platform bus code when unbinding the MFD and deregistering the child
devices.
Fix this by using the intended helper for reusing OF nodes.
Fixes: e85c5a153fe2 ("regulator: Add ROHM BD9571MWV-M PMIC regulator driver")
Cc: stable@vger.kernel.org # 4.12
Cc: Marek Vasut <marek.vasut@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260408073055.5183-8-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/regulator/bd9571mwv-regulator.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/regulator/bd9571mwv-regulator.c
+++ b/drivers/regulator/bd9571mwv-regulator.c
@@ -287,8 +287,9 @@ static int bd9571mwv_regulator_probe(str
platform_set_drvdata(pdev, bdreg);
+ device_set_of_node_from_dev(&pdev->dev, pdev->dev.parent);
+
config.dev = &pdev->dev;
- config.dev->of_node = pdev->dev.parent->of_node;
config.driver_data = bdreg;
config.regmap = bdreg->regmap;
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 037/188] spi: lantiq-ssc: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 036/188] regulator: bd9571mwv: " Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 038/188] spi: meson-spicc: " Greg Kroah-Hartman
` (155 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hauke Mehrtens, Johan Hovold,
Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit b99206710d032c16b7f8b75e4bc18414d8e4b9f4 upstream.
Make sure to deregister the controller before releasing underlying
resources like clocks during driver unbind.
Fixes: 17f84b793c01 ("spi: lantiq-ssc: add support for Lantiq SSC SPI controller")
Cc: stable@vger.kernel.org # 4.11
Cc: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260409120419.388546-17-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-lantiq-ssc.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-lantiq-ssc.c
+++ b/drivers/spi/spi-lantiq-ssc.c
@@ -995,7 +995,7 @@ static int lantiq_ssc_probe(struct platf
"Lantiq SSC SPI controller (Rev %i, TXFS %u, RXFS %u, DMA %u)\n",
revision, spi->tx_fifo_size, spi->rx_fifo_size, supports_dma);
- err = devm_spi_register_controller(dev, host);
+ err = spi_register_controller(host);
if (err) {
dev_err(dev, "failed to register spi host\n");
goto err_wq_destroy;
@@ -1017,6 +1017,10 @@ static void lantiq_ssc_remove(struct pla
{
struct lantiq_ssc_spi *spi = platform_get_drvdata(pdev);
+ spi_controller_get(spi->host);
+
+ spi_unregister_controller(spi->host);
+
lantiq_ssc_writel(spi, 0, LTQ_SPI_IRNEN);
lantiq_ssc_writel(spi, 0, LTQ_SPI_CLC);
rx_fifo_flush(spi);
@@ -1025,6 +1029,8 @@ static void lantiq_ssc_remove(struct pla
destroy_workqueue(spi->wq);
clk_put(spi->fpi_clk);
+
+ spi_controller_put(spi->host);
}
static struct platform_driver lantiq_ssc_driver = {
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 038/188] spi: meson-spicc: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 037/188] spi: lantiq-ssc: fix controller deregistration Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 039/188] spi: qup: " Greg Kroah-Hartman
` (154 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Johan Hovold,
Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 77953c76bec9af4191f8692a10225dd816208718 upstream.
Make sure to deregister the controller before disabling it to allow SPI
device drivers to do I/O during deregistration.
Fixes: 454fa271bc4e ("spi: Add Meson SPICC driver")
Cc: stable@vger.kernel.org # 4.13
Cc: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260409120419.388546-18-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-meson-spicc.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-meson-spicc.c
+++ b/drivers/spi/spi-meson-spicc.c
@@ -1082,7 +1082,7 @@ static int meson_spicc_probe(struct plat
}
}
- ret = devm_spi_register_controller(&pdev->dev, host);
+ ret = spi_register_controller(host);
if (ret) {
dev_err(&pdev->dev, "spi registration failed\n");
goto out_host;
@@ -1100,8 +1100,14 @@ static void meson_spicc_remove(struct pl
{
struct meson_spicc_device *spicc = platform_get_drvdata(pdev);
+ spi_controller_get(spicc->host);
+
+ spi_unregister_controller(spicc->host);
+
/* Disable SPI */
writel(0, spicc->base + SPICC_CONREG);
+
+ spi_controller_put(spicc->host);
}
static const struct meson_spicc_data meson_spicc_gx_data = {
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 039/188] spi: qup: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 038/188] spi: meson-spicc: " Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 040/188] spi: at91-usart: " Greg Kroah-Hartman
` (153 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Johan Hovold, Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 443e3a0005a4342b218b6dbd4c6387d3c7fed85a upstream.
Make sure to deregister the controller before disabling underlying
resources like clocks during driver unbind.
Fixes: 64ff247a978f ("spi: Add Qualcomm QUP SPI controller support")
Cc: stable@vger.kernel.org # 3.15
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260410081757.503099-10-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-qup.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-qup.c
+++ b/drivers/spi/spi-qup.c
@@ -1194,7 +1194,7 @@ static int spi_qup_probe(struct platform
pm_runtime_set_active(dev);
pm_runtime_enable(dev);
- ret = devm_spi_register_controller(dev, host);
+ ret = spi_register_controller(host);
if (ret)
goto disable_pm;
@@ -1321,6 +1321,10 @@ static void spi_qup_remove(struct platfo
struct spi_qup *controller = spi_controller_get_devdata(host);
int ret;
+ spi_controller_get(host);
+
+ spi_unregister_controller(host);
+
ret = pm_runtime_get_sync(&pdev->dev);
if (ret >= 0) {
@@ -1340,6 +1344,8 @@ static void spi_qup_remove(struct platfo
pm_runtime_put_noidle(&pdev->dev);
pm_runtime_disable(&pdev->dev);
+
+ spi_controller_put(host);
}
static const struct of_device_id spi_qup_dt_match[] = {
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 040/188] spi: at91-usart: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 039/188] spi: qup: " Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 041/188] media: saa7164: add ioremap return checks and cleanups Greg Kroah-Hartman
` (152 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Radu Pirea, Johan Hovold, Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 9acecc9bcff058eaef40fd7a4c3650e88b06b220 upstream.
Make sure to deregister the controller before disabling and releasing
underlying resources like clocks and DMA during driver unbind.
Fixes: e1892546ff66 ("spi: at91-usart: Add driver for at91-usart as SPI")
Cc: stable@vger.kernel.org # 4.20
Cc: Radu Pirea <radu.pirea@microchip.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260409120419.388546-4-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-at91-usart.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-at91-usart.c
+++ b/drivers/spi/spi-at91-usart.c
@@ -556,7 +556,7 @@ static int at91_usart_spi_probe(struct p
spin_lock_init(&aus->lock);
init_completion(&aus->xfer_completion);
- ret = devm_spi_register_controller(&pdev->dev, controller);
+ ret = spi_register_controller(controller);
if (ret)
goto at91_usart_fail_register_controller;
@@ -634,8 +634,14 @@ static void at91_usart_spi_remove(struct
struct spi_controller *ctlr = platform_get_drvdata(pdev);
struct at91_usart_spi *aus = spi_controller_get_devdata(ctlr);
+ spi_controller_get(ctlr);
+
+ spi_unregister_controller(ctlr);
+
at91_usart_spi_release_dma(ctlr);
clk_disable_unprepare(aus->clk);
+
+ spi_controller_put(ctlr);
}
static const struct dev_pm_ops at91_usart_spi_pm_ops = {
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 041/188] media: saa7164: add ioremap return checks and cleanups
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 040/188] spi: at91-usart: " Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 042/188] spi: amlogic-spisg: fix controller deregistration Greg Kroah-Hartman
` (151 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wang Jun, Hans Verkuil
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Jun <1742789905@qq.com>
commit d51c60a498e83c9a79884c8e420f97e3885c9583 upstream.
Add checks for ioremap return values in saa7164_dev_setup(). If
ioremap for BAR0 or BAR2 fails, release the already allocated PCI
memory regions, remove the device from the global list, decrement
the device count, and return -ENODEV.
This prevents potential null pointer dereferences and ensures proper
cleanup on memory mapping failures.
Fixes: 443c1228d505 ("V4L/DVB (12923): SAA7164: Add support for the NXP SAA7164 silicon")
Cc: stable@vger.kernel.org
Signed-off-by: Wang Jun <1742789905@qq.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/pci/saa7164/saa7164-core.c | 47 +++++++++++++++++++++++--------
1 file changed, 35 insertions(+), 12 deletions(-)
--- a/drivers/media/pci/saa7164/saa7164-core.c
+++ b/drivers/media/pci/saa7164/saa7164-core.c
@@ -888,6 +888,15 @@ static int get_resources(struct saa7164_
return -EBUSY;
}
+static void release_resources(struct saa7164_dev *dev)
+{
+ release_mem_region(pci_resource_start(dev->pci, 0),
+ pci_resource_len(dev->pci, 0));
+
+ release_mem_region(pci_resource_start(dev->pci, 2),
+ pci_resource_len(dev->pci, 2));
+}
+
static int saa7164_port_init(struct saa7164_dev *dev, int portnr)
{
struct saa7164_port *port = NULL;
@@ -947,9 +956,9 @@ static int saa7164_dev_setup(struct saa7
snprintf(dev->name, sizeof(dev->name), "saa7164[%d]", dev->nr);
- mutex_lock(&devlist);
- list_add_tail(&dev->devlist, &saa7164_devlist);
- mutex_unlock(&devlist);
+ scoped_guard(mutex, &devlist) {
+ list_add_tail(&dev->devlist, &saa7164_devlist);
+ }
/* board config */
dev->board = UNSET;
@@ -996,11 +1005,17 @@ static int saa7164_dev_setup(struct saa7
}
/* PCI/e allocations */
- dev->lmmio = ioremap(pci_resource_start(dev->pci, 0),
- pci_resource_len(dev->pci, 0));
+ dev->lmmio = pci_ioremap_bar(dev->pci, 0);
+ if (!dev->lmmio) {
+ dev_err(&dev->pci->dev, "Failed to remap MMIO BAR 0\n");
+ goto err_ioremap_bar0;
+ }
- dev->lmmio2 = ioremap(pci_resource_start(dev->pci, 2),
- pci_resource_len(dev->pci, 2));
+ dev->lmmio2 = pci_ioremap_bar(dev->pci, 2);
+ if (!dev->lmmio2) {
+ dev_err(&dev->pci->dev, "Failed to remap MMIO BAR 2\n");
+ goto err_ioremap_bar2;
+ }
dev->bmmio = (u8 __iomem *)dev->lmmio;
dev->bmmio2 = (u8 __iomem *)dev->lmmio2;
@@ -1019,17 +1034,25 @@ static int saa7164_dev_setup(struct saa7
saa7164_pci_quirks(dev);
return 0;
+
+err_ioremap_bar2:
+ iounmap(dev->lmmio);
+err_ioremap_bar0:
+ release_resources(dev);
+
+ scoped_guard(mutex, &devlist) {
+ list_del(&dev->devlist);
+ }
+ saa7164_devcount--;
+
+ return -ENODEV;
}
static void saa7164_dev_unregister(struct saa7164_dev *dev)
{
dprintk(1, "%s()\n", __func__);
- release_mem_region(pci_resource_start(dev->pci, 0),
- pci_resource_len(dev->pci, 0));
-
- release_mem_region(pci_resource_start(dev->pci, 2),
- pci_resource_len(dev->pci, 2));
+ release_resources(dev);
if (!atomic_dec_and_test(&dev->refcount))
return;
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 042/188] spi: amlogic-spisg: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 041/188] media: saa7164: add ioremap return checks and cleanups Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 043/188] spi: aspeed-smc: " Greg Kroah-Hartman
` (150 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sunny Luo, Johan Hovold, Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 84d31bb1f6256eea0db6cf64a3c7a53145f92bb9 upstream.
Make sure to deregister the controller before disabling underlying
resources like clocks during driver unbind.
Fixes: cef9991e04ae ("spi: Add Amlogic SPISG driver")
Cc: stable@vger.kernel.org # 6.17: b8db95529979
Cc: stable@vger.kernel.org # 6.17
Cc: Sunny Luo <sunny.luo@amlogic.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260409120419.388546-2-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-amlogic-spisg.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-amlogic-spisg.c
+++ b/drivers/spi/spi-amlogic-spisg.c
@@ -801,7 +801,7 @@ static int aml_spisg_probe(struct platfo
goto out_clk;
}
- ret = devm_spi_register_controller(dev, ctlr);
+ ret = spi_register_controller(ctlr);
if (ret) {
dev_err(&pdev->dev, "spi controller registration failed\n");
goto out_clk;
@@ -824,6 +824,8 @@ static void aml_spisg_remove(struct plat
{
struct spisg_device *spisg = platform_get_drvdata(pdev);
+ spi_unregister_controller(spisg->controller);
+
if (!pm_runtime_suspended(&pdev->dev)) {
pinctrl_pm_select_sleep_state(&spisg->pdev->dev);
clk_disable_unprepare(spisg->core);
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 043/188] spi: aspeed-smc: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 042/188] spi: amlogic-spisg: fix controller deregistration Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 044/188] platform/x86: hp-wmi: Ignore backlight and FnLock events Greg Kroah-Hartman
` (149 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cédric Le Goater, Johan Hovold,
Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 1044e5a4ccd57bf5a64f90100a321b498e0267a2 upstream.
Make sure to deregister the controller before disabling it to allow
SPI device drivers to do I/O during deregistration.
Fixes: e3228ed92893 ("spi: spi-mem: Convert Aspeed SMC driver to spi-mem")
Cc: stable@vger.kernel.org # 5.19
Cc: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260409120419.388546-3-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-aspeed-smc.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/drivers/spi/spi-aspeed-smc.c
+++ b/drivers/spi/spi-aspeed-smc.c
@@ -726,7 +726,7 @@ static int aspeed_spi_probe(struct platf
return -ENOMEM;
aspi = spi_controller_get_devdata(ctlr);
- platform_set_drvdata(pdev, aspi);
+ platform_set_drvdata(pdev, ctlr);
aspi->data = data;
aspi->dev = dev;
@@ -765,7 +765,7 @@ static int aspeed_spi_probe(struct platf
ctlr->num_chipselect = data->max_cs;
ctlr->dev.of_node = dev->of_node;
- ret = devm_spi_register_controller(dev, ctlr);
+ ret = spi_register_controller(ctlr);
if (ret)
dev_err(&pdev->dev, "spi_register_controller failed\n");
@@ -774,7 +774,10 @@ static int aspeed_spi_probe(struct platf
static void aspeed_spi_remove(struct platform_device *pdev)
{
- struct aspeed_spi *aspi = platform_get_drvdata(pdev);
+ struct spi_controller *ctlr = platform_get_drvdata(pdev);
+ struct aspeed_spi *aspi = spi_controller_get_devdata(ctlr);
+
+ spi_unregister_controller(ctlr);
aspeed_spi_enable(aspi, false);
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 044/188] platform/x86: hp-wmi: Ignore backlight and FnLock events
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 043/188] spi: aspeed-smc: " Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 045/188] vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to copy Greg Kroah-Hartman
` (148 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Artem S. Tashkinov, Krishna Chomal,
Ilpo Järvinen
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krishna Chomal <krishna.chomal108@gmail.com>
commit e8c597368b8500a824c639bfb5ed0044068c6870 upstream.
On HP OmniBook 7 the keyboard backlight and FnLock keys are handled
directly by the firmware. However, they still trigger WMI events which
results in "Unknown key code" warnings in dmesg.
Add these key codes to the keymap with KE_IGNORE to silence the warnings
since no software action is needed.
Tested-by: Artem S. Tashkinov <aros@gmx.com>
Reported-by: Artem S. Tashkinov <aros@gmx.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221181
Signed-off-by: Krishna Chomal <krishna.chomal108@gmail.com>
Link: https://patch.msgid.link/20260403080155.169653-1-krishna.chomal108@gmail.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/hp/hp-wmi.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/platform/x86/hp/hp-wmi.c
+++ b/drivers/platform/x86/hp/hp-wmi.c
@@ -362,6 +362,11 @@ static const struct key_entry hp_wmi_key
{ KE_KEY, 0x21a9, { KEY_TOUCHPAD_OFF } },
{ KE_KEY, 0x121a9, { KEY_TOUCHPAD_ON } },
{ KE_KEY, 0x231b, { KEY_HELP } },
+ { KE_IGNORE, 0x21ab, }, /* FnLock on */
+ { KE_IGNORE, 0x121ab, }, /* FnLock off */
+ { KE_IGNORE, 0x30021aa, }, /* kbd backlight: level 2 -> off */
+ { KE_IGNORE, 0x33221aa, }, /* kbd backlight: off -> level 1 */
+ { KE_IGNORE, 0x36421aa, }, /* kbd backlight: level 1 -> level 2*/
{ KE_END, 0 }
};
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 045/188] vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to copy
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 044/188] platform/x86: hp-wmi: Ignore backlight and FnLock events Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 046/188] arm64: dts: broadcom: bcm2712-d-rpi-5-b: add fixes for pinctrl/pinctrl_aon Greg Kroah-Hartman
` (147 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stefano Garzarella, Arseniy Krasnov,
Luigi Leonardi, Jakub Kicinski
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luigi Leonardi <leonardi@redhat.com>
commit 080f22f5d30233faf3d83be3098f35b8be9b7a00 upstream.
`virtio_transport_stream_do_peek()` does not account for the skb offset
when computing the number of bytes to copy.
This means that, after a partial recv() that advances the offset, a peek
requesting more bytes than are available in the sk_buff causes
`skb_copy_datagram_iter()` to go past the valid payload, resulting in
a -EFAULT.
The dequeue path already handles this correctly.
Apply the same logic to the peek path.
Fixes: 0df7cd3c13e4 ("vsock/virtio/vhost: read data from non-linear skb")
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Acked-by: Arseniy Krasnov <avkrasnov@salutedevices.com>
Signed-off-by: Luigi Leonardi <leonardi@redhat.com>
Link: https://patch.msgid.link/20260415-fix_peek-v4-1-8207e872759e@redhat.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/vmw_vsock/virtio_transport_common.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/net/vmw_vsock/virtio_transport_common.c
+++ b/net/vmw_vsock/virtio_transport_common.c
@@ -546,9 +546,8 @@ virtio_transport_stream_do_peek(struct v
skb_queue_walk(&vvs->rx_queue, skb) {
size_t bytes;
- bytes = len - total;
- if (bytes > skb->len)
- bytes = skb->len;
+ bytes = min_t(size_t, len - total,
+ skb->len - VIRTIO_VSOCK_SKB_CB(skb)->offset);
spin_unlock_bh(&vvs->rx_lock);
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 046/188] arm64: dts: broadcom: bcm2712-d-rpi-5-b: add fixes for pinctrl/pinctrl_aon
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 045/188] vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to copy Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 047/188] arm64: dts: broadcom: bcm2712-d-rpi-5-b: update uart10 interrupt Greg Kroah-Hartman
` (146 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gregor Herburger, Florian Fainelli
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregor Herburger <gregor.herburger@linutronix.de>
commit aeb078cebc40d421f61a8f07b0e7919aeb44d751 upstream.
On the -d revision of the bcm2712 the pinctrl differs from the c0
revision. The driver already supports both and distinguishes the two
with the compatible string.
Update the compatible string and reg length to reflect the different
pinctrl.
Signed-off-by: Gregor Herburger <gregor.herburger@linutronix.de>
Link: https://lore.kernel.org/r/20260226-raspi-dts-updates-v1-5-60832d20ff04@linutronix.de
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/broadcom/bcm2712-d-rpi-5-b.dts | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/arch/arm64/boot/dts/broadcom/bcm2712-d-rpi-5-b.dts
+++ b/arch/arm64/boot/dts/broadcom/bcm2712-d-rpi-5-b.dts
@@ -35,3 +35,13 @@
"PMIC_SCL", // AON_SGPIO_04
"PMIC_SDA"; // AON_SGPIO_05
};
+
+&pinctrl {
+ compatible = "brcm,bcm2712d0-pinctrl";
+ reg = <0x7d504100 0x20>;
+};
+
+&pinctrl_aon {
+ compatible = "brcm,bcm2712d0-aon-pinctrl";
+ reg = <0x7d510700 0x1c>;
+};
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 047/188] arm64: dts: broadcom: bcm2712-d-rpi-5-b: update uart10 interrupt
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 046/188] arm64: dts: broadcom: bcm2712-d-rpi-5-b: add fixes for pinctrl/pinctrl_aon Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 048/188] media: pci: zoran: fix potential memory leak in zoran_probe() Greg Kroah-Hartman
` (145 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gregor Herburger, Florian Fainelli,
Rasmus Villemoes
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregor Herburger <gregor.herburger@linutronix.de>
commit 18d4a06e10051681de074a9250e54afc1f3ee312 upstream.
On the -d revision of bcm2712 the uart interrupt is on 120. Update it
accordingly.
Signed-off-by: Gregor Herburger <gregor.herburger@linutronix.de>
Link: https://lore.kernel.org/r/20260226-raspi-dts-updates-v1-6-60832d20ff04@linutronix.de
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
Cc: Rasmus Villemoes <ravi@prevas.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/broadcom/bcm2712-d-rpi-5-b.dts | 4 ++++
1 file changed, 4 insertions(+)
--- a/arch/arm64/boot/dts/broadcom/bcm2712-d-rpi-5-b.dts
+++ b/arch/arm64/boot/dts/broadcom/bcm2712-d-rpi-5-b.dts
@@ -45,3 +45,7 @@
compatible = "brcm,bcm2712d0-aon-pinctrl";
reg = <0x7d510700 0x1c>;
};
+
+&uart10 {
+ interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>;
+};
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 048/188] media: pci: zoran: fix potential memory leak in zoran_probe()
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 047/188] arm64: dts: broadcom: bcm2712-d-rpi-5-b: update uart10 interrupt Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 049/188] media: dib8000: avoid division by 0 in dib8000_set_dds() Greg Kroah-Hartman
` (144 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Hans Verkuil
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
commit 8ea21435fe36fb853706f4935d78bc11beb63fb4 upstream.
The memory allocated for codec in videocodec_attach() is not freed in
one of the error paths, due to an incorrect goto label. Fix the label
to free it on error.
Fixes: 8f7cc5c0b0eb ("media: staging: media: zoran: introduce zoran_i2c_init")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/pci/zoran/zoran_card.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/pci/zoran/zoran_card.c
+++ b/drivers/media/pci/zoran/zoran_card.c
@@ -1373,7 +1373,7 @@ static int zoran_probe(struct pci_dev *p
}
if (zr->codec->type != zr->card.video_codec) {
pci_err(pdev, "%s - wrong codec\n", __func__);
- goto zr_unreg_videocodec;
+ goto zr_detach_codec;
}
}
if (zr->card.video_vfe != 0) {
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 049/188] media: dib8000: avoid division by 0 in dib8000_set_dds()
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 048/188] media: pci: zoran: fix potential memory leak in zoran_probe() Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 050/188] media: i2c: imx412: Assert reset GPIO during probe Greg Kroah-Hartman
` (143 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sergey Shtylyov, Hans Verkuil
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Shtylyov <s.shtylyov@auroraos.dev>
commit dde3c37af95cd6fa301c4906f33d627bc9dd874c upstream.
In dib8000_set_dds(), 1 << 26 (67108864) divided by e.g. 1 apparently can't
fit into 16-bit variable unit_khz_dds_val, being truncated to 0; this will
cause division by 0 while calling dprintk() with debugging enabled (via the
module parameter). Use s32 instead of s16 to declare the variable, getting
rid of the cast to u16 in the *else* branch as well...
Found by Linux Verification Center (linuxtesting.org) with the Svace static
analysis tool.
Fixes: 173a64cb3fcf ("[media] dib8000: enhancement")
Cc: stable@vger.kernel.org
Signed-off-by: Sergey Shtylyov <s.shtylyov@auroraos.dev>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/dvb-frontends/dib8000.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/media/dvb-frontends/dib8000.c
+++ b/drivers/media/dvb-frontends/dib8000.c
@@ -2695,7 +2695,7 @@ static void dib8000_viterbi_state(struct
static void dib8000_set_dds(struct dib8000_state *state, s32 offset_khz)
{
- s16 unit_khz_dds_val;
+ s32 unit_khz_dds_val;
u32 abs_offset_khz = abs(offset_khz);
u32 dds = state->cfg.pll->ifreq & 0x1ffffff;
u8 invert = !!(state->cfg.pll->ifreq & (1 << 25));
@@ -2716,7 +2716,7 @@ static void dib8000_set_dds(struct dib80
dds = (1<<26) - dds;
} else {
ratio = 2;
- unit_khz_dds_val = (u16) (67108864 / state->cfg.pll->internal);
+ unit_khz_dds_val = 67108864 / state->cfg.pll->internal;
if (offset_khz < 0)
unit_khz_dds_val *= -1;
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 050/188] media: i2c: imx412: Assert reset GPIO during probe
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 049/188] media: dib8000: avoid division by 0 in dib8000_set_dds() Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 051/188] media: staging: imx: request mbus_config in csi_start Greg Kroah-Hartman
` (142 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wenmeng Liu, Sakari Ailus,
Mauro Carvalho Chehab
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
commit 8467c5ff5acae28513bc1e0af535e06b41b04344 upstream.
Assert the reset GPIO before first power up. This avoids a mismatch where
the first power up (when the reset GPIO defaults deasserted) differs from
subsequent cycles.
Signed-off-by: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
Fixes: 9214e86c0cc1 ("media: i2c: Add imx412 camera sensor driver")
Cc: stable@vger.kernel.org
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/i2c/imx412.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/i2c/imx412.c
+++ b/drivers/media/i2c/imx412.c
@@ -925,7 +925,7 @@ static int imx412_parse_hw_config(struct
/* Request optional reset pin */
imx412->reset_gpio = devm_gpiod_get_optional(imx412->dev, "reset",
- GPIOD_OUT_LOW);
+ GPIOD_OUT_HIGH);
if (IS_ERR(imx412->reset_gpio)) {
dev_err(imx412->dev, "failed to get reset gpio %ld\n",
PTR_ERR(imx412->reset_gpio));
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 051/188] media: staging: imx: request mbus_config in csi_start
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 050/188] media: i2c: imx412: Assert reset GPIO during probe Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 052/188] media: i2c: ov08d10: fix image vertical start setting Greg Kroah-Hartman
` (141 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Frank Li, Michael Tretter,
Philipp Zabel, Hans Verkuil
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Tretter <m.tretter@pengutronix.de>
commit 9df2aaa64890c0b6226057eb6fcb6352bd2df432 upstream.
Request the upstream mbus_config in csi_start, which starts the stream,
instead of caching it in link_validate.
This allows to get rid of the mbus_cfg field in the struct csi_priv and
avoids state in the driver.
Fixes: 4a34ec8e470c ("[media] media: imx: Add CSI subdev driver")
Cc: stable@vger.kernel.org
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Michael Tretter <m.tretter@pengutronix.de>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/media/imx/imx-media-csi.c | 40 ++++++++++++++++++------------
1 file changed, 24 insertions(+), 16 deletions(-)
--- a/drivers/staging/media/imx/imx-media-csi.c
+++ b/drivers/staging/media/imx/imx-media-csi.c
@@ -97,9 +97,6 @@ struct csi_priv {
/* the mipi virtual channel number at link validate */
int vc_num;
- /* media bus config of the upstream subdevice CSI is receiving from */
- struct v4l2_mbus_config mbus_cfg;
-
spinlock_t irqlock; /* protect eof_irq handler */
struct timer_list eof_timeout_timer;
int eof_irq;
@@ -403,7 +400,8 @@ static void csi_idmac_unsetup_vb2_buf(st
}
/* init the SMFC IDMAC channel */
-static int csi_idmac_setup_channel(struct csi_priv *priv)
+static int csi_idmac_setup_channel(struct csi_priv *priv,
+ struct v4l2_mbus_config *mbus_cfg)
{
struct imx_media_video_dev *vdev = priv->vdev;
const struct imx_media_pixfmt *incc;
@@ -432,7 +430,7 @@ static int csi_idmac_setup_channel(struc
image.phys0 = phys[0];
image.phys1 = phys[1];
- passthrough = requires_passthrough(&priv->mbus_cfg, infmt, incc);
+ passthrough = requires_passthrough(mbus_cfg, infmt, incc);
passthrough_cycles = 1;
/*
@@ -572,11 +570,12 @@ static void csi_idmac_unsetup(struct csi
csi_idmac_unsetup_vb2_buf(priv, state);
}
-static int csi_idmac_setup(struct csi_priv *priv)
+static int csi_idmac_setup(struct csi_priv *priv,
+ struct v4l2_mbus_config *mbus_cfg)
{
int ret;
- ret = csi_idmac_setup_channel(priv);
+ ret = csi_idmac_setup_channel(priv, mbus_cfg);
if (ret)
return ret;
@@ -595,7 +594,8 @@ static int csi_idmac_setup(struct csi_pr
return 0;
}
-static int csi_idmac_start(struct csi_priv *priv)
+static int csi_idmac_start(struct csi_priv *priv,
+ struct v4l2_mbus_config *mbus_cfg)
{
struct imx_media_video_dev *vdev = priv->vdev;
int ret;
@@ -619,7 +619,7 @@ static int csi_idmac_start(struct csi_pr
priv->last_eof = false;
priv->nfb4eof = false;
- ret = csi_idmac_setup(priv);
+ ret = csi_idmac_setup(priv, mbus_cfg);
if (ret) {
v4l2_err(&priv->sd, "csi_idmac_setup failed: %d\n", ret);
goto out_free_dma_buf;
@@ -701,7 +701,8 @@ static void csi_idmac_stop(struct csi_pr
}
/* Update the CSI whole sensor and active windows */
-static int csi_setup(struct csi_priv *priv)
+static int csi_setup(struct csi_priv *priv,
+ struct v4l2_mbus_config *mbus_cfg)
{
struct v4l2_mbus_framefmt *infmt, *outfmt;
const struct imx_media_pixfmt *incc;
@@ -719,7 +720,7 @@ static int csi_setup(struct csi_priv *pr
* if cycles is set, we need to handle this over multiple cycles as
* generic/bayer data
*/
- if (is_parallel_bus(&priv->mbus_cfg) && incc->cycles) {
+ if (is_parallel_bus(mbus_cfg) && incc->cycles) {
if_fmt.width *= incc->cycles;
crop.width *= incc->cycles;
}
@@ -730,7 +731,7 @@ static int csi_setup(struct csi_priv *pr
priv->crop.width == 2 * priv->compose.width,
priv->crop.height == 2 * priv->compose.height);
- ipu_csi_init_interface(priv->csi, &priv->mbus_cfg, &if_fmt, outfmt);
+ ipu_csi_init_interface(priv->csi, mbus_cfg, &if_fmt, outfmt);
ipu_csi_set_dest(priv->csi, priv->dest);
@@ -745,9 +746,17 @@ static int csi_setup(struct csi_priv *pr
static int csi_start(struct csi_priv *priv)
{
+ struct v4l2_mbus_config mbus_cfg = { .type = 0 };
struct v4l2_fract *input_fi, *output_fi;
int ret;
+ ret = csi_get_upstream_mbus_config(priv, &mbus_cfg);
+ if (ret) {
+ v4l2_err(&priv->sd,
+ "failed to get upstream media bus configuration\n");
+ return ret;
+ }
+
input_fi = &priv->frame_interval[CSI_SINK_PAD];
output_fi = &priv->frame_interval[priv->active_output_pad];
@@ -758,7 +767,7 @@ static int csi_start(struct csi_priv *pr
return ret;
/* Skip first few frames from a BT.656 source */
- if (priv->mbus_cfg.type == V4L2_MBUS_BT656) {
+ if (mbus_cfg.type == V4L2_MBUS_BT656) {
u32 delay_usec, bad_frames = 20;
delay_usec = DIV_ROUND_UP_ULL((u64)USEC_PER_SEC *
@@ -769,12 +778,12 @@ static int csi_start(struct csi_priv *pr
}
if (priv->dest == IPU_CSI_DEST_IDMAC) {
- ret = csi_idmac_start(priv);
+ ret = csi_idmac_start(priv, &mbus_cfg);
if (ret)
goto stop_upstream;
}
- ret = csi_setup(priv);
+ ret = csi_setup(priv, &mbus_cfg);
if (ret)
goto idmac_stop;
@@ -1138,7 +1147,6 @@ static int csi_link_validate(struct v4l2
mutex_lock(&priv->lock);
- priv->mbus_cfg = mbus_cfg;
is_csi2 = !is_parallel_bus(&mbus_cfg);
if (is_csi2) {
/*
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 052/188] media: i2c: ov08d10: fix image vertical start setting
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 051/188] media: staging: imx: request mbus_config in csi_start Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 053/188] media: i2c: ov08d10: fix runtime PM handling in probe Greg Kroah-Hartman
` (140 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthias Fend, Sakari Ailus,
Hans Verkuil
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthias Fend <matthias.fend@emfend.at>
commit 5d150fa0f16096d736bd24d13e04495da5116fab upstream.
The current settings for the "image vertical start" register appear to be
incorrect. While this only results in an incorrect start line for native
modes, this faulty setting causes actual problems in binning mode. At least
on an i.MX8MP test system, only corrupted frames could be received.
To correct this, the recommended settings from the reference register sets
are used for all modes. Since this shifts the start by one line, the Bayer
pattern also changes, which has also been corrected.
Fixes: 7be91e02ed57 ("media: i2c: Add ov08d10 camera sensor driver")
Cc: stable@vger.kernel.org
Signed-off-by: Matthias Fend <matthias.fend@emfend.at>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/i2c/ov08d10.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/drivers/media/i2c/ov08d10.c
+++ b/drivers/media/i2c/ov08d10.c
@@ -217,7 +217,7 @@ static const struct ov08d10_reg lane_2_m
{0x9a, 0x30},
{0xa8, 0x02},
{0xfd, 0x02},
- {0xa1, 0x01},
+ {0xa1, 0x00},
{0xa2, 0x09},
{0xa3, 0x9c},
{0xa5, 0x00},
@@ -335,7 +335,7 @@ static const struct ov08d10_reg lane_2_m
{0x9a, 0x30},
{0xa8, 0x02},
{0xfd, 0x02},
- {0xa1, 0x09},
+ {0xa1, 0x08},
{0xa2, 0x09},
{0xa3, 0x90},
{0xa5, 0x08},
@@ -467,7 +467,7 @@ static const struct ov08d10_reg lane_2_m
{0xaa, 0xd0},
{0xab, 0x06},
{0xac, 0x68},
- {0xa1, 0x09},
+ {0xa1, 0x04},
{0xa2, 0x04},
{0xa3, 0xc8},
{0xa5, 0x04},
@@ -613,8 +613,8 @@ static const struct ov08d10_lane_cfg lan
static u32 ov08d10_get_format_code(struct ov08d10 *ov08d10)
{
static const u32 codes[2][2] = {
- { MEDIA_BUS_FMT_SGRBG10_1X10, MEDIA_BUS_FMT_SRGGB10_1X10},
- { MEDIA_BUS_FMT_SBGGR10_1X10, MEDIA_BUS_FMT_SGBRG10_1X10},
+ { MEDIA_BUS_FMT_SBGGR10_1X10, MEDIA_BUS_FMT_SGBRG10_1X10 },
+ { MEDIA_BUS_FMT_SGRBG10_1X10, MEDIA_BUS_FMT_SRGGB10_1X10 },
};
return codes[ov08d10->vflip->val][ov08d10->hflip->val];
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 053/188] media: i2c: ov08d10: fix runtime PM handling in probe
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 052/188] media: i2c: ov08d10: fix image vertical start setting Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 054/188] media: omap3isp: drop the use count of v4l2 pipeline Greg Kroah-Hartman
` (139 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Philipp Zabel, Matthias Fend,
Sakari Ailus, Hans Verkuil
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthias Fend <matthias.fend@emfend.at>
commit 35c7046be2be5e60be8128facb359a47f39e99cd upstream.
Set the device's runtime PM status and enable runtime PM before registering
the async sub-device. This is needed to avoid the case where the device is
runtime PM resumed while runtime PM has not been enabled yet.
Remove the related, non-driver-specific comment while at it.
Fixes: 7be91e02ed57 ("media: i2c: Add ov08d10 camera sensor driver")
Cc: stable@vger.kernel.org
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Matthias Fend <matthias.fend@emfend.at>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/i2c/ov08d10.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
--- a/drivers/media/i2c/ov08d10.c
+++ b/drivers/media/i2c/ov08d10.c
@@ -1430,6 +1430,9 @@ static int ov08d10_probe(struct i2c_clie
goto probe_error_v4l2_ctrl_handler_free;
}
+ pm_runtime_set_active(ov08d10->dev);
+ pm_runtime_enable(ov08d10->dev);
+
ret = v4l2_async_register_subdev_sensor(&ov08d10->sd);
if (ret < 0) {
dev_err(ov08d10->dev, "failed to register V4L2 subdev: %d",
@@ -1437,17 +1440,13 @@ static int ov08d10_probe(struct i2c_clie
goto probe_error_media_entity_cleanup;
}
- /*
- * Device is already turned on by i2c-core with ACPI domain PM.
- * Enable runtime PM and turn off the device.
- */
- pm_runtime_set_active(ov08d10->dev);
- pm_runtime_enable(ov08d10->dev);
pm_runtime_idle(ov08d10->dev);
return 0;
probe_error_media_entity_cleanup:
+ pm_runtime_disable(ov08d10->dev);
+ pm_runtime_set_suspended(ov08d10->dev);
media_entity_cleanup(&ov08d10->sd.entity);
probe_error_v4l2_ctrl_handler_free:
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 054/188] media: omap3isp: drop the use count of v4l2 pipeline
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 053/188] media: i2c: ov08d10: fix runtime PM handling in probe Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 055/188] media: iris: fix QCOM_MDT_LOADER dependency Greg Kroah-Hartman
` (138 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haoxiang Li, Sakari Ailus,
Mauro Carvalho Chehab
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
commit 9da49bd9d4224035cff39b40d7395310abb10201 upstream.
In isp_video_open(), drop the use count of v4l2
pipeline if vb2_queue_init() fails.
Fixes: 8fd390b89cc8 ("media: Split v4l2_pipeline_pm_use into v4l2_pipeline_pm_{get, put}")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/ti/omap3isp/ispvideo.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/media/platform/ti/omap3isp/ispvideo.c
+++ b/drivers/media/platform/ti/omap3isp/ispvideo.c
@@ -1325,6 +1325,7 @@ static int isp_video_open(struct file *f
ret = vb2_queue_init(&handle->queue);
if (ret < 0) {
+ v4l2_pipeline_pm_put(&video->video.entity);
omap3isp_put(video->isp);
goto done;
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 055/188] media: iris: fix QCOM_MDT_LOADER dependency
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 054/188] media: omap3isp: drop the use count of v4l2 pipeline Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 056/188] media: iris: Fix use-after-free in iris_release_internal_buffers() Greg Kroah-Hartman
` (137 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Konrad Dybcio,
Dikshita Agarwal, Bryan ODonoghue, Bryan ODonoghue, Hans Verkuil
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
commit a297c5165f91366cbc3490e630aabd1c0f70efb8 upstream.
When build-testined with CONFIG_QCOM_MDT_LOADER=m and VIDEO_QCOM_IRIS=y,
the kernel fails to link:
x86_64-linux-ld: drivers/media/platform/qcom/iris/iris_firmware.o: in function `iris_fw_load':
iris_firmware.c:(.text+0xb0): undefined reference to `qcom_mdt_get_size'
iris_firmware.c:(.text+0xfd): undefined reference to `qcom_mdt_load'
The problem is the conditional 'select' statement. Change this to
make the driver built-in here regardless of CONFIG_ARCH_QCOM.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Fixes: d19b163356b8 ("media: iris: implement video firmware load/unload")
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/qcom/iris/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/platform/qcom/iris/Kconfig
+++ b/drivers/media/platform/qcom/iris/Kconfig
@@ -3,7 +3,7 @@ config VIDEO_QCOM_IRIS
depends on VIDEO_DEV
depends on ARCH_QCOM || COMPILE_TEST
select V4L2_MEM2MEM_DEV
- select QCOM_MDT_LOADER if ARCH_QCOM
+ select QCOM_MDT_LOADER
select QCOM_SCM
select VIDEOBUF2_DMA_CONTIG
help
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 056/188] media: iris: Fix use-after-free in iris_release_internal_buffers()
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 055/188] media: iris: fix QCOM_MDT_LOADER dependency Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 057/188] media: qcom: camss: Fix csid clock configuration for sa8775p Greg Kroah-Hartman
` (136 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Dikshita Agarwal,
Vikash Garodia, Bryan ODonoghue, Hans Verkuil
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
commit f27cfdcfc916bb59297825805f4c3499f89f9e76 upstream.
The recent change in commit 1dabf00ee206 ("media: iris: gen1: Destroy
internal buffers after FW releases") introduced a regression where
session_release_buf() may free the buffer. The caller,
iris_release_internal_buffers(), continued to access `buffer` after the
call, leading to a potential use-after-free.
Fix this by setting BUF_ATTR_PENDING_RELEASE before calling
session_release_buf(), and reverting the flag if the call fails. This
ensures no dereference occurs after potential freeing.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Closes: https://lore.kernel.org/lkml/aYXvKAX3Pg3sL37P@stanley.mountain/#r
Signed-off-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Fixes: 1dabf00ee206 ("media: iris: gen1: Destroy internal buffers after FW releases")
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/qcom/iris/iris_buffer.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/media/platform/qcom/iris/iris_buffer.c
+++ b/drivers/media/platform/qcom/iris/iris_buffer.c
@@ -571,10 +571,12 @@ static int iris_release_internal_buffers
continue;
if (!(buffer->attr & BUF_ATTR_QUEUED))
continue;
+ buffer->attr |= BUF_ATTR_PENDING_RELEASE;
ret = hfi_ops->session_release_buf(inst, buffer);
- if (ret)
+ if (ret) {
+ buffer->attr &= ~BUF_ATTR_PENDING_RELEASE;
return ret;
- buffer->attr |= BUF_ATTR_PENDING_RELEASE;
+ }
}
return 0;
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 057/188] media: qcom: camss: Fix csid clock configuration for sa8775p
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 056/188] media: iris: Fix use-after-free in iris_release_internal_buffers() Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 058/188] media: qcom: camss: Fix csid IRQ offset " Greg Kroah-Hartman
` (135 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wenmeng Liu, Bryan ODonoghue,
Bryan ODonoghue, Hans Verkuil
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
commit fe56c674118aa46da1a3e65aa22ca709ebd7d812 upstream.
Fix the mismatch between clock list and clock rate table for CSID lite
instances. The current implementation has 5 clocks defined but only 2
are actually needed (vfe_lite_csid and vfe_lite_cphy_rx), while the
clock rate table doesn't match this configuration.
Update both clock list and rate table to maintain consistency:
- Remove unused clocks: cpas_vfe_lite, vfe_lite_ahb, vfe_lite
- Update clock rate table to match the remaining two clocks
Signed-off-by: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Fixes: ed03e99de0fa ("media: qcom: camss: Add support for CSID 690")
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/qcom/camss/camss.c | 40 +++++++++++-------------------
1 file changed, 15 insertions(+), 25 deletions(-)
--- a/drivers/media/platform/qcom/camss/camss.c
+++ b/drivers/media/platform/qcom/camss/camss.c
@@ -2782,12 +2782,10 @@ static const struct camss_subdev_resourc
/* CSID2 (lite) */
{
.regulators = {},
- .clock = { "cpas_vfe_lite", "vfe_lite_ahb",
- "vfe_lite_csid", "vfe_lite_cphy_rx",
- "vfe_lite"},
+ .clock = { "vfe_lite_csid", "vfe_lite_cphy_rx" },
.clock_rate = {
- { 0, 0, 400000000, 400000000, 0},
- { 0, 0, 400000000, 480000000, 0}
+ { 400000000, 480000000 },
+ { 400000000, 480000000 }
},
.reg = { "csid_lite0" },
.interrupt = { "csid_lite0" },
@@ -2801,12 +2799,10 @@ static const struct camss_subdev_resourc
/* CSID3 (lite) */
{
.regulators = {},
- .clock = { "cpas_vfe_lite", "vfe_lite_ahb",
- "vfe_lite_csid", "vfe_lite_cphy_rx",
- "vfe_lite"},
+ .clock = { "vfe_lite_csid", "vfe_lite_cphy_rx" },
.clock_rate = {
- { 0, 0, 400000000, 400000000, 0},
- { 0, 0, 400000000, 480000000, 0}
+ { 400000000, 480000000 },
+ { 400000000, 480000000 }
},
.reg = { "csid_lite1" },
.interrupt = { "csid_lite1" },
@@ -2820,12 +2816,10 @@ static const struct camss_subdev_resourc
/* CSID4 (lite) */
{
.regulators = {},
- .clock = { "cpas_vfe_lite", "vfe_lite_ahb",
- "vfe_lite_csid", "vfe_lite_cphy_rx",
- "vfe_lite"},
+ .clock = { "vfe_lite_csid", "vfe_lite_cphy_rx" },
.clock_rate = {
- { 0, 0, 400000000, 400000000, 0},
- { 0, 0, 400000000, 480000000, 0}
+ { 400000000, 480000000 },
+ { 400000000, 480000000 }
},
.reg = { "csid_lite2" },
.interrupt = { "csid_lite2" },
@@ -2839,12 +2833,10 @@ static const struct camss_subdev_resourc
/* CSID5 (lite) */
{
.regulators = {},
- .clock = { "cpas_vfe_lite", "vfe_lite_ahb",
- "vfe_lite_csid", "vfe_lite_cphy_rx",
- "vfe_lite"},
+ .clock = { "vfe_lite_csid", "vfe_lite_cphy_rx" },
.clock_rate = {
- { 0, 0, 400000000, 400000000, 0},
- { 0, 0, 400000000, 480000000, 0}
+ { 400000000, 480000000 },
+ { 400000000, 480000000 }
},
.reg = { "csid_lite3" },
.interrupt = { "csid_lite3" },
@@ -2858,12 +2850,10 @@ static const struct camss_subdev_resourc
/* CSID6 (lite) */
{
.regulators = {},
- .clock = { "cpas_vfe_lite", "vfe_lite_ahb",
- "vfe_lite_csid", "vfe_lite_cphy_rx",
- "vfe_lite"},
+ .clock = { "vfe_lite_csid", "vfe_lite_cphy_rx" },
.clock_rate = {
- { 0, 0, 400000000, 400000000, 0},
- { 0, 0, 400000000, 480000000, 0}
+ { 400000000, 480000000 },
+ { 400000000, 480000000 }
},
.reg = { "csid_lite4" },
.interrupt = { "csid_lite4" },
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 058/188] media: qcom: camss: Fix csid IRQ offset for sa8775p
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 057/188] media: qcom: camss: Fix csid clock configuration for sa8775p Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 059/188] media: qcom: iris: increase H265D_MAX_SLICE to fix H.265 decoding on SC7280 Greg Kroah-Hartman
` (134 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wenmeng Liu, Bryan ODonoghue,
Bryan ODonoghue, Hans Verkuil
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
commit dd1b373941079cc102cc18bc68884e18245f5912 upstream.
Fix BUF_DONE_IRQ_STATUS_RDI_OFFSET calculation for csid lite on
sa8775p platform. The offset should be 0 for csid lite on sa8775p,
Signed-off-by: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Fixes: ed03e99de0fa ("media: qcom: camss: Add support for CSID 690")
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/qcom/camss/camss-csid-gen3.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/media/platform/qcom/camss/camss-csid-gen3.c
+++ b/drivers/media/platform/qcom/camss/camss-csid-gen3.c
@@ -48,9 +48,9 @@
#define IS_CSID_690(csid) ((csid->camss->res->version == CAMSS_8775P) \
|| (csid->camss->res->version == CAMSS_8300))
#define CSID_BUF_DONE_IRQ_STATUS 0x8C
-#define BUF_DONE_IRQ_STATUS_RDI_OFFSET (csid_is_lite(csid) ?\
- 1 : (IS_CSID_690(csid) ?\
- 13 : 14))
+#define BUF_DONE_IRQ_STATUS_RDI_OFFSET (csid_is_lite(csid) ? \
+ ((IS_CSID_690(csid) ? 0 : 1)) : \
+ ((IS_CSID_690(csid) ? 13 : 14)))
#define CSID_BUF_DONE_IRQ_MASK 0x90
#define CSID_BUF_DONE_IRQ_CLEAR 0x94
#define CSID_BUF_DONE_IRQ_SET 0x98
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 059/188] media: qcom: iris: increase H265D_MAX_SLICE to fix H.265 decoding on SC7280
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 058/188] media: qcom: camss: Fix csid IRQ offset " Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 060/188] media: venus: fix QCOM_MDT_LOADER dependency Greg Kroah-Hartman
` (133 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Dikshita Agarwal,
Vikash Garodia, Konrad Dybcio, Bryan ODonoghue, Hans Verkuil
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
commit 3e0b2053751657ed2924adfe3ff25b1450231e33 upstream.
Follow the commit bfe1326573ff ("venus: Fix for H265 decoding failure.")
and increase H265D_MAX_SLICE following firmware requirements on that
platform. Otherwise decoding of the H.265 streams fails with the
"insufficient scratch_1 buffer size" from the firmware.
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Reviewed-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
Reviewed-by: Vikash Garodia <vikash.garodia@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
[bod: Fixed commit log withthe => with the]
Fixes: e1f5d32608ec ("media: iris: Add internal buffer calculation for HEVC and VP9 decoders")
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/qcom/iris/iris_vpu_buffer.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/platform/qcom/iris/iris_vpu_buffer.h
+++ b/drivers/media/platform/qcom/iris/iris_vpu_buffer.h
@@ -61,7 +61,7 @@ struct iris_inst;
#define SIZE_DOLBY_RPU_METADATA (41 * 1024)
#define H264_CABAC_HDR_RATIO_HD_TOT 1
#define H264_CABAC_RES_RATIO_HD_TOT 3
-#define H265D_MAX_SLICE 1200
+#define H265D_MAX_SLICE 3600
#define SIZE_H265D_HW_PIC_T SIZE_H264D_HW_PIC_T
#define H265_CABAC_HDR_RATIO_HD_TOT 2
#define H265_CABAC_RES_RATIO_HD_TOT 2
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 060/188] media: venus: fix QCOM_MDT_LOADER dependency
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 059/188] media: qcom: iris: increase H265D_MAX_SLICE to fix H.265 decoding on SC7280 Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 061/188] media: iris: Fix dma_free_attrs() size in iris_hfi_queues_init() Greg Kroah-Hartman
` (132 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Konrad Dybcio,
Dikshita Agarwal, Bryan ODonoghue, Hans Verkuil
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
commit aa23c94cc433b145d1ce93820ecdfe16d8940e28 upstream.
When build-testined with CONFIG_QCOM_MDT_LOADER=m and VIDEO_QCOM_VENUS=y,
the kernel fails to link:
x86_64-linux-ld: drivers/media/platform/qcom/venus/firmware.o: in function `venus_boot':
firmware.c:(.text+0x1e3): undefined reference to `qcom_mdt_get_size'
firmware.c:(.text+0x25a): undefined reference to `qcom_mdt_load'
firmware.c:(.text+0x272): undefined reference to `qcom_mdt_load_no_init'
The problem is the conditional 'select' statement. Change this to
make the driver built-in here regardless of CONFIG_ARCH_QCOM,
same as for the similar IRIS driver.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
Fixes: 0399b696f7f4 ("media: venus: fix compile-test build on non-qcom ARM platform")
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/qcom/venus/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/platform/qcom/venus/Kconfig
+++ b/drivers/media/platform/qcom/venus/Kconfig
@@ -4,7 +4,7 @@ config VIDEO_QCOM_VENUS
depends on VIDEO_DEV && QCOM_SMEM
depends on (ARCH_QCOM && ARM64 && IOMMU_API) || COMPILE_TEST
select OF_DYNAMIC if ARCH_QCOM
- select QCOM_MDT_LOADER if ARCH_QCOM
+ select QCOM_MDT_LOADER
select QCOM_SCM
select VIDEOBUF2_DMA_CONTIG
select V4L2_MEM2MEM_DEV
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 061/188] media: iris: Fix dma_free_attrs() size in iris_hfi_queues_init()
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 060/188] media: venus: fix QCOM_MDT_LOADER dependency Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 062/188] media: qcom: camss: Add missing clocks for VFE lite on sa8775p Greg Kroah-Hartman
` (131 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Fourier, Dikshita Agarwal,
Bryan ODonoghue, Hans Verkuil
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Fourier <fourier.thomas@gmail.com>
commit 4a49ae56b0e4268d48fd96babe0cc68596bc301a upstream.
The core->iface_q_table_vaddr buffer is alloc'd with size queue_size
but freed with sizeof(*q_tbl_hdr) which is different.
Change the dma_free_attrs() size.
Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
Reviewed-by: Dikshita Agarwal <dikshita.agarwal@oss.qualcomm.com>
Fixes: d7378f84e94e ("media: iris: introduce iris core state management with shared queues")
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/qcom/iris/iris_hfi_queue.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/platform/qcom/iris/iris_hfi_queue.c
+++ b/drivers/media/platform/qcom/iris/iris_hfi_queue.c
@@ -263,7 +263,7 @@ int iris_hfi_queues_init(struct iris_cor
GFP_KERNEL, DMA_ATTR_WRITE_COMBINE);
if (!core->sfr_vaddr) {
dev_err(core->dev, "sfr alloc and map failed\n");
- dma_free_attrs(core->dev, sizeof(*q_tbl_hdr), core->iface_q_table_vaddr,
+ dma_free_attrs(core->dev, queue_size, core->iface_q_table_vaddr,
core->iface_q_table_daddr, DMA_ATTR_WRITE_COMBINE);
return -ENOMEM;
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 062/188] media: qcom: camss: Add missing clocks for VFE lite on sa8775p
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 061/188] media: iris: Fix dma_free_attrs() size in iris_hfi_queues_init() Greg Kroah-Hartman
@ 2026-05-15 15:47 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 063/188] spi: mxs: fix controller deregistration Greg Kroah-Hartman
` (130 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryan ODonoghue, Wenmeng Liu,
Bryan ODonoghue, Hans Verkuil
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
commit d31fac47b39f5e1ed85a587688ca70b793e421b4 upstream.
Add missing required clocks (cpas_ahb and camnoc_axi) for VFE lite
instances on sa8775p platform. These clocks are necessary for proper
VFE lite operation:
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Wenmeng Liu <wenmeng.liu@oss.qualcomm.com>
Fixes: e7b59e1d06fb ("media: qcom: camss: Add support for VFE 690")
Cc: stable@vger.kernel.org
Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/qcom/camss/camss.c | 40 ++++++++++++++++++------------
1 file changed, 25 insertions(+), 15 deletions(-)
--- a/drivers/media/platform/qcom/camss/camss.c
+++ b/drivers/media/platform/qcom/camss/camss.c
@@ -2926,15 +2926,17 @@ static const struct camss_subdev_resourc
/* VFE2 (lite) */
{
.regulators = {},
- .clock = { "cpas_vfe_lite", "vfe_lite_ahb",
+ .clock = { "cpas_ahb", "cpas_vfe_lite", "vfe_lite_ahb",
"vfe_lite_csid", "vfe_lite_cphy_rx",
- "vfe_lite"},
+ "vfe_lite", "camnoc_axi"},
.clock_rate = {
- { 0, 0, 0, 0 },
+ { 0 },
+ { 0 },
{ 300000000, 400000000, 400000000, 400000000 },
{ 400000000, 400000000, 400000000, 400000000 },
{ 400000000, 400000000, 400000000, 400000000 },
{ 480000000, 600000000, 600000000, 600000000 },
+ { 400000000 },
},
.reg = { "vfe_lite0" },
.interrupt = { "vfe_lite0" },
@@ -2949,15 +2951,17 @@ static const struct camss_subdev_resourc
/* VFE3 (lite) */
{
.regulators = {},
- .clock = { "cpas_vfe_lite", "vfe_lite_ahb",
+ .clock = { "cpas_ahb", "cpas_vfe_lite", "vfe_lite_ahb",
"vfe_lite_csid", "vfe_lite_cphy_rx",
- "vfe_lite"},
+ "vfe_lite", "camnoc_axi"},
.clock_rate = {
- { 0, 0, 0, 0 },
+ { 0 },
+ { 0 },
{ 300000000, 400000000, 400000000, 400000000 },
{ 400000000, 400000000, 400000000, 400000000 },
{ 400000000, 400000000, 400000000, 400000000 },
{ 480000000, 600000000, 600000000, 600000000 },
+ { 400000000 },
},
.reg = { "vfe_lite1" },
.interrupt = { "vfe_lite1" },
@@ -2972,15 +2976,17 @@ static const struct camss_subdev_resourc
/* VFE4 (lite) */
{
.regulators = {},
- .clock = { "cpas_vfe_lite", "vfe_lite_ahb",
+ .clock = { "cpas_ahb", "cpas_vfe_lite", "vfe_lite_ahb",
"vfe_lite_csid", "vfe_lite_cphy_rx",
- "vfe_lite"},
+ "vfe_lite", "camnoc_axi"},
.clock_rate = {
- { 0, 0, 0, 0 },
+ { 0 },
+ { 0 },
{ 300000000, 400000000, 400000000, 400000000 },
{ 400000000, 400000000, 400000000, 400000000 },
{ 400000000, 400000000, 400000000, 400000000 },
{ 480000000, 600000000, 600000000, 600000000 },
+ { 400000000 },
},
.reg = { "vfe_lite2" },
.interrupt = { "vfe_lite2" },
@@ -2995,15 +3001,17 @@ static const struct camss_subdev_resourc
/* VFE5 (lite) */
{
.regulators = {},
- .clock = { "cpas_vfe_lite", "vfe_lite_ahb",
+ .clock = { "cpas_ahb", "cpas_vfe_lite", "vfe_lite_ahb",
"vfe_lite_csid", "vfe_lite_cphy_rx",
- "vfe_lite"},
+ "vfe_lite", "camnoc_axi"},
.clock_rate = {
- { 0, 0, 0, 0 },
+ { 0 },
+ { 0 },
{ 300000000, 400000000, 400000000, 400000000 },
{ 400000000, 400000000, 400000000, 400000000 },
{ 400000000, 400000000, 400000000, 400000000 },
{ 480000000, 600000000, 600000000, 600000000 },
+ { 400000000 },
},
.reg = { "vfe_lite3" },
.interrupt = { "vfe_lite3" },
@@ -3018,15 +3026,17 @@ static const struct camss_subdev_resourc
/* VFE6 (lite) */
{
.regulators = {},
- .clock = { "cpas_vfe_lite", "vfe_lite_ahb",
+ .clock = { "cpas_ahb", "cpas_vfe_lite", "vfe_lite_ahb",
"vfe_lite_csid", "vfe_lite_cphy_rx",
- "vfe_lite"},
+ "vfe_lite", "camnoc_axi"},
.clock_rate = {
- { 0, 0, 0, 0 },
+ { 0 },
+ { 0 },
{ 300000000, 400000000, 400000000, 400000000 },
{ 400000000, 400000000, 400000000, 400000000 },
{ 400000000, 400000000, 400000000, 400000000 },
{ 480000000, 600000000, 600000000, 600000000 },
+ { 400000000 },
},
.reg = { "vfe_lite4" },
.interrupt = { "vfe_lite4" },
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 063/188] spi: mxs: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2026-05-15 15:47 ` [PATCH 6.18 062/188] media: qcom: camss: Add missing clocks for VFE lite on sa8775p Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 064/188] spi: mt65xx: " Greg Kroah-Hartman
` (129 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jingoo Han, Johan Hovold, Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 8b0d0011af20fb547aa67a1cefbf320992fd5e92 upstream.
Make sure to deregister the controller before releasing underlying
resources like DMA during driver unbind.
Fixes: 33e195acf268 ("spi: mxs: use devm_spi_register_master()")
Cc: stable@vger.kernel.org # 3.13
Cc: Jingoo Han <jg1.han@samsung.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260410081757.503099-4-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-mxs.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-mxs.c
+++ b/drivers/spi/spi-mxs.c
@@ -619,7 +619,7 @@ static int mxs_spi_probe(struct platform
if (ret)
goto out_pm_runtime_put;
- ret = devm_spi_register_controller(&pdev->dev, host);
+ ret = spi_register_controller(host);
if (ret) {
dev_err(&pdev->dev, "Cannot register SPI host, %d\n", ret);
goto out_pm_runtime_put;
@@ -650,11 +650,17 @@ static void mxs_spi_remove(struct platfo
spi = spi_controller_get_devdata(host);
ssp = &spi->ssp;
+ spi_controller_get(host);
+
+ spi_unregister_controller(host);
+
pm_runtime_disable(&pdev->dev);
if (!pm_runtime_status_suspended(&pdev->dev))
mxs_spi_runtime_suspend(&pdev->dev);
dma_release_channel(ssp->dmach);
+
+ spi_controller_put(host);
}
static struct platform_driver mxs_spi_driver = {
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 064/188] spi: mt65xx: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 063/188] spi: mxs: fix controller deregistration Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 065/188] spi: dln2: " Greg Kroah-Hartman
` (128 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Leilk Liu, Johan Hovold, Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 2ad30599cccc572ba2fc11010670eb6e01ea6bfc upstream.
Make sure to deregister the controller before disabling underlying
resources like clocks during driver unbind.
Fixes: a568231f4632 ("spi: mediatek: Add spi bus for Mediatek MT8173")
Cc: stable@vger.kernel.org # 4.3: ace145802350
Cc: stable@vger.kernel.org # 4.3
Cc: Leilk Liu <leilk.liu@mediatek.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260410081757.503099-2-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-mt65xx.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-mt65xx.c
+++ b/drivers/spi/spi-mt65xx.c
@@ -1326,7 +1326,7 @@ static int mtk_spi_probe(struct platform
pm_runtime_enable(dev);
- ret = devm_spi_register_controller(dev, host);
+ ret = spi_register_controller(host);
if (ret) {
pm_runtime_disable(dev);
return dev_err_probe(dev, ret, "failed to register host\n");
@@ -1341,6 +1341,8 @@ static void mtk_spi_remove(struct platfo
struct mtk_spi *mdata = spi_controller_get_devdata(host);
int ret;
+ spi_unregister_controller(host);
+
cpu_latency_qos_remove_request(&mdata->qos_request);
if (mdata->use_spimem && !completion_done(&mdata->spimem_done))
complete(&mdata->spimem_done);
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 065/188] spi: dln2: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 064/188] spi: mt65xx: " Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 066/188] spi: s3c64xx: " Greg Kroah-Hartman
` (127 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Laurentiu Palcu, Johan Hovold,
Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit c353020fbfa8514ee91a6de2d88de4e5edca5803 upstream.
Make sure to deregister the controller before disabling it to allow
SPI device drivers to do I/O during deregistration.
Fixes: 3d8c0d749da3 ("spi: add support for DLN-2 USB-SPI adapter")
Cc: stable@vger.kernel.org # 4.0
Cc: Laurentiu Palcu <laurentiu.palcu@intel.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260409120419.388546-12-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-dln2.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-dln2.c
+++ b/drivers/spi/spi-dln2.c
@@ -761,7 +761,7 @@ static int dln2_spi_probe(struct platfor
pm_runtime_set_active(&pdev->dev);
pm_runtime_enable(&pdev->dev);
- ret = devm_spi_register_controller(&pdev->dev, host);
+ ret = spi_register_controller(host);
if (ret < 0) {
dev_err(&pdev->dev, "Failed to register host\n");
goto exit_register;
@@ -786,10 +786,16 @@ static void dln2_spi_remove(struct platf
struct spi_controller *host = platform_get_drvdata(pdev);
struct dln2_spi *dln2 = spi_controller_get_devdata(host);
+ spi_controller_get(host);
+
+ spi_unregister_controller(host);
+
pm_runtime_disable(&pdev->dev);
if (dln2_spi_enable(dln2, false) < 0)
dev_err(&pdev->dev, "Failed to disable SPI module\n");
+
+ spi_controller_put(host);
}
#ifdef CONFIG_PM_SLEEP
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 066/188] spi: s3c64xx: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 065/188] spi: dln2: " Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 067/188] spi: fsl-espi: " Greg Kroah-Hartman
` (126 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Johan Hovold, Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit c1446b61e472da24d1547525193467b4bea4a7cb upstream.
Make sure to deregister the controller before releasing underlying
resources like DMA during driver unbind.
Fixes: 91800f0e9005 ("spi/s3c64xx: Use managed registration")
Cc: stable@vger.kernel.org # 3.13: 76fbad410c0f
Cc: stable@vger.kernel.org # 3.13
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260410081757.503099-12-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-s3c64xx.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-s3c64xx.c
+++ b/drivers/spi/spi-s3c64xx.c
@@ -1370,7 +1370,7 @@ static int s3c64xx_spi_probe(struct plat
S3C64XX_SPI_INT_TX_OVERRUN_EN | S3C64XX_SPI_INT_TX_UNDERRUN_EN,
sdd->regs + S3C64XX_SPI_INT_EN);
- ret = devm_spi_register_controller(&pdev->dev, host);
+ ret = spi_register_controller(host);
if (ret != 0) {
dev_err(&pdev->dev, "cannot register SPI host: %d\n", ret);
goto err_pm_put;
@@ -1400,6 +1400,8 @@ static void s3c64xx_spi_remove(struct pl
pm_runtime_get_sync(&pdev->dev);
+ spi_unregister_controller(host);
+
writel(0, sdd->regs + S3C64XX_SPI_INT_EN);
pm_runtime_put_noidle(&pdev->dev);
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 067/188] spi: fsl-espi: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 066/188] spi: s3c64xx: " Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 068/188] spi: omap2-mcspi: " Greg Kroah-Hartman
` (125 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Heiner Kallweit, Johan Hovold,
Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit e506a700a7ad229f5c8f01f4b8350119cccb4158 upstream.
Make sure to deregister the controller before disabling runtime PM
(which can leave the controller disabled) to allow SPI device drivers to
do I/O during deregistration.
Fixes: e9abb4db8d10 ("spi: fsl-espi: add runtime PM")
Cc: stable@vger.kernel.org # 4.3
Cc: Heiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260409120419.388546-14-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-fsl-espi.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-fsl-espi.c
+++ b/drivers/spi/spi-fsl-espi.c
@@ -719,7 +719,7 @@ static int fsl_espi_probe(struct device
pm_runtime_enable(dev);
pm_runtime_get_sync(dev);
- ret = devm_spi_register_controller(dev, host);
+ ret = spi_register_controller(host);
if (ret < 0)
goto err_pm;
@@ -783,7 +783,15 @@ static int of_fsl_espi_probe(struct plat
static void of_fsl_espi_remove(struct platform_device *dev)
{
+ struct spi_controller *host = platform_get_drvdata(dev);
+
+ spi_controller_get(host);
+
+ spi_unregister_controller(host);
+
pm_runtime_disable(&dev->dev);
+
+ spi_controller_put(host);
}
#ifdef CONFIG_PM_SLEEP
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 068/188] spi: omap2-mcspi: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 067/188] spi: fsl-espi: " Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 069/188] spi: pic32: " Greg Kroah-Hartman
` (124 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Johan Hovold, Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit fb45f95c377e4a4bdece2c5e17643b459c9c13e7 upstream.
Make sure to deregister the controller before releasing underlying
resources like DMA during driver unbind.
Fixes: ccdc7bf92573 ("SPI: omap2_mcspi driver")
Cc: stable@vger.kernel.org # 2.6.23
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260410081757.503099-6-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-omap2-mcspi.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-omap2-mcspi.c
+++ b/drivers/spi/spi-omap2-mcspi.c
@@ -1585,7 +1585,7 @@ static int omap2_mcspi_probe(struct plat
if (status < 0)
goto disable_pm;
- status = devm_spi_register_controller(&pdev->dev, ctlr);
+ status = spi_register_controller(ctlr);
if (status < 0)
goto disable_pm;
@@ -1606,11 +1606,17 @@ static void omap2_mcspi_remove(struct pl
struct spi_controller *ctlr = platform_get_drvdata(pdev);
struct omap2_mcspi *mcspi = spi_controller_get_devdata(ctlr);
+ spi_controller_get(ctlr);
+
+ spi_unregister_controller(ctlr);
+
omap2_mcspi_release_dma(ctlr);
pm_runtime_dont_use_autosuspend(mcspi->dev);
pm_runtime_put_sync(mcspi->dev);
pm_runtime_disable(&pdev->dev);
+
+ spi_controller_put(ctlr);
}
/* work with hotplug and coldplug */
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 069/188] spi: pic32: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 068/188] spi: omap2-mcspi: " Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 070/188] spi: mtk-nor: " Greg Kroah-Hartman
` (123 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Purna Chandra Mandal, Johan Hovold,
Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 6b627bfe0c44e064aba464839e430dc1ca2b0bb8 upstream.
Make sure to deregister the controller before releasing underlying
resources like DMA during driver unbind.
Fixes: 1bcb9f8ceb67 ("spi: spi-pic32: Add PIC32 SPI master driver")
Cc: stable@vger.kernel.org # 4.7
Cc: Purna Chandra Mandal <purna.mandal@microchip.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260410081757.503099-7-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-pic32.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
--- a/drivers/spi/spi-pic32.c
+++ b/drivers/spi/spi-pic32.c
@@ -821,7 +821,7 @@ static int pic32_spi_probe(struct platfo
}
/* register host */
- ret = devm_spi_register_controller(&pdev->dev, host);
+ ret = spi_register_controller(host);
if (ret) {
dev_err(&host->dev, "failed registering spi host\n");
goto err_bailout;
@@ -840,11 +840,16 @@ err_host:
static void pic32_spi_remove(struct platform_device *pdev)
{
- struct pic32_spi *pic32s;
+ struct pic32_spi *pic32s = platform_get_drvdata(pdev);
+
+ spi_controller_get(pic32s->host);
+
+ spi_unregister_controller(pic32s->host);
- pic32s = platform_get_drvdata(pdev);
pic32_spi_disable(pic32s);
pic32_spi_dma_unprep(pic32s);
+
+ spi_controller_put(pic32s->host);
}
static const struct of_device_id pic32_spi_of_match[] = {
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 070/188] spi: mtk-nor: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 069/188] spi: pic32: " Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 071/188] spi: pl022: " Greg Kroah-Hartman
` (122 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chuanhong Guo, Johan Hovold,
Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 76336f24934621db286cabb20b483773ee01dcaa upstream.
Make sure to deregister the controller before disabling underlying
resources like clocks during driver unbind.
Fixes: 881d1ee9fe81 ("spi: add support for mediatek spi-nor controller")
Cc: stable@vger.kernel.org # 5.7
Cc: Chuanhong Guo <gch981213@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260410081757.503099-3-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-mtk-nor.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-mtk-nor.c
+++ b/drivers/spi/spi-mtk-nor.c
@@ -914,7 +914,7 @@ static int mtk_nor_probe(struct platform
pm_runtime_enable(&pdev->dev);
pm_runtime_get_noresume(&pdev->dev);
- ret = devm_spi_register_controller(&pdev->dev, ctlr);
+ ret = spi_register_controller(ctlr);
if (ret < 0)
goto err_probe;
@@ -939,6 +939,8 @@ static void mtk_nor_remove(struct platfo
struct spi_controller *ctlr = dev_get_drvdata(&pdev->dev);
struct mtk_nor *sp = spi_controller_get_devdata(ctlr);
+ spi_unregister_controller(ctlr);
+
pm_runtime_disable(&pdev->dev);
pm_runtime_set_suspended(&pdev->dev);
pm_runtime_dont_use_autosuspend(&pdev->dev);
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 071/188] spi: pl022: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 070/188] spi: mtk-nor: " Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 072/188] spi: ch341: fix devres lifetime Greg Kroah-Hartman
` (121 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Linus Walleij, Johan Hovold,
Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 994b33366be9148240690e3e94bffe17c4d89458 upstream.
Make sure to deregister the controller before releasing underlying
resources like DMA during driver unbind.
Fixes: b43d65f7e818 ("[ARM] 5546/1: ARM PL022 SSP/SPI driver v3")
Cc: stable@vger.kernel.org # 2.6.31
Cc: Linus Walleij <linusw@kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260410081757.503099-9-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-pl022.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-pl022.c
+++ b/drivers/spi/spi-pl022.c
@@ -1957,7 +1957,7 @@ static int pl022_probe(struct amba_devic
/* Register with the SPI framework */
amba_set_drvdata(adev, pl022);
- status = devm_spi_register_controller(&adev->dev, host);
+ status = spi_register_controller(host);
if (status != 0) {
dev_err_probe(&adev->dev, status,
"problem registering spi host\n");
@@ -1998,6 +1998,10 @@ pl022_remove(struct amba_device *adev)
if (!pl022)
return;
+ spi_controller_get(pl022->host);
+
+ spi_unregister_controller(pl022->host);
+
/*
* undo pm_runtime_put() in probe. I assume that we're not
* accessing the primecell here.
@@ -2009,6 +2013,8 @@ pl022_remove(struct amba_device *adev)
pl022_dma_remove(pl022);
amba_release_regions(adev);
+
+ spi_controller_put(pl022->host);
}
#ifdef CONFIG_PM_SLEEP
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 072/188] spi: ch341: fix devres lifetime
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 071/188] spi: pl022: " Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 073/188] spi: sh-hspi: fix controller deregistration Greg Kroah-Hartman
` (120 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johannes Thumshirn, Johan Hovold,
Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit abe572f630bc1f0e77041012ab075869036ede4f upstream.
USB drivers bind to USB interfaces and any device managed resources
should have their lifetime tied to the interface rather than parent USB
device. This avoids issues like memory leaks when drivers are unbound
without their devices being physically disconnected (e.g. on probe
deferral or configuration changes).
Fix the controller and driver data lifetime so that they are released
on driver unbind.
Note that this also makes sure that the SPI controller is placed
correctly under the USB interface in the device tree.
Fixes: 8846739f52af ("spi: add ch341a usb2spi driver")
Cc: stable@vger.kernel.org # 6.11
Cc: Johannes Thumshirn <jth@kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260327104305.1309915-3-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-ch341.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
--- a/drivers/spi/spi-ch341.c
+++ b/drivers/spi/spi-ch341.c
@@ -152,7 +152,7 @@ static int ch341_probe(struct usb_interf
if (ret)
return ret;
- ctrl = devm_spi_alloc_host(&udev->dev, sizeof(struct ch341_spi_dev));
+ ctrl = devm_spi_alloc_host(&intf->dev, sizeof(struct ch341_spi_dev));
if (!ctrl)
return -ENOMEM;
@@ -163,7 +163,7 @@ static int ch341_probe(struct usb_interf
ch341->read_pipe = usb_rcvbulkpipe(udev, usb_endpoint_num(in));
ch341->rx_len = usb_endpoint_maxp(in);
- ch341->rx_buf = devm_kzalloc(&udev->dev, ch341->rx_len, GFP_KERNEL);
+ ch341->rx_buf = devm_kzalloc(&intf->dev, ch341->rx_len, GFP_KERNEL);
if (!ch341->rx_buf)
return -ENOMEM;
@@ -171,8 +171,7 @@ static int ch341_probe(struct usb_interf
if (!ch341->rx_urb)
return -ENOMEM;
- ch341->tx_buf =
- devm_kzalloc(&udev->dev, CH341_PACKET_LENGTH, GFP_KERNEL);
+ ch341->tx_buf = devm_kzalloc(&intf->dev, CH341_PACKET_LENGTH, GFP_KERNEL);
if (!ch341->tx_buf) {
ret = -ENOMEM;
goto err_free_urb;
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 073/188] spi: sh-hspi: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 072/188] spi: ch341: fix devres lifetime Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 074/188] spi: fsl: " Greg Kroah-Hartman
` (119 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Johan Hovold, Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit e63982e6392e45a6ecd68d6c317a081cc8e70143 upstream.
Make sure to deregister the controller before releasing underlying
resources like clocks during driver unbind.
Fixes: 49e599b8595f ("spi: sh-hspi: control spi clock more correctly")
Cc: stable@vger.kernel.org # 3.4
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260410081757.503099-13-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-sh-hspi.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
--- a/drivers/spi/spi-sh-hspi.c
+++ b/drivers/spi/spi-sh-hspi.c
@@ -258,9 +258,9 @@ static int hspi_probe(struct platform_de
ctlr->transfer_one_message = hspi_transfer_one_message;
ctlr->bits_per_word_mask = SPI_BPW_MASK(8);
- ret = devm_spi_register_controller(&pdev->dev, ctlr);
+ ret = spi_register_controller(ctlr);
if (ret < 0) {
- dev_err(&pdev->dev, "devm_spi_register_controller error.\n");
+ dev_err(&pdev->dev, "failed to register controller\n");
goto error2;
}
@@ -280,9 +280,15 @@ static void hspi_remove(struct platform_
{
struct hspi_priv *hspi = platform_get_drvdata(pdev);
+ spi_controller_get(hspi->ctlr);
+
+ spi_unregister_controller(hspi->ctlr);
+
pm_runtime_disable(&pdev->dev);
clk_put(hspi->clk);
+
+ spi_controller_put(hspi->ctlr);
}
static const struct of_device_id hspi_of_match[] = {
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 074/188] spi: fsl: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 073/188] spi: sh-hspi: fix controller deregistration Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 075/188] spi: bcmbca-hsspi: " Greg Kroah-Hartman
` (118 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Heiner Kallweit, Johan Hovold,
Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 9b7abfed4c3754062d1f3ffd452e65a38667f586 upstream.
Make sure to deregister the controller before releasing underlying
resources like DMA during driver unbind.
Fixes: 4178b6b1b595 ("spi: fsl-(e)spi: migrate to using devm_ functions to simplify cleanup")
Cc: stable@vger.kernel.org # 4.3
Cc: Heiner Kallweit <hkallweit1@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260410064749.496888-1-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-fsl-spi.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-fsl-spi.c
+++ b/drivers/spi/spi-fsl-spi.c
@@ -614,7 +614,7 @@ static struct spi_controller *fsl_spi_pr
mpc8xxx_spi_write_reg(®_base->mode, regval);
- ret = devm_spi_register_controller(dev, host);
+ ret = spi_register_controller(host);
if (ret < 0)
goto err_probe;
@@ -705,7 +705,13 @@ static void of_fsl_spi_remove(struct pla
struct spi_controller *host = platform_get_drvdata(ofdev);
struct mpc8xxx_spi *mpc8xxx_spi = spi_controller_get_devdata(host);
+ spi_controller_get(host);
+
+ spi_unregister_controller(host);
+
fsl_spi_cpm_free(mpc8xxx_spi);
+
+ spi_controller_put(host);
}
static struct platform_driver of_fsl_spi_driver = {
@@ -751,7 +757,13 @@ static void plat_mpc8xxx_spi_remove(stru
struct spi_controller *host = platform_get_drvdata(pdev);
struct mpc8xxx_spi *mpc8xxx_spi = spi_controller_get_devdata(host);
+ spi_controller_get(host);
+
+ spi_unregister_controller(host);
+
fsl_spi_cpm_free(mpc8xxx_spi);
+
+ spi_controller_put(host);
}
MODULE_ALIAS("platform:mpc8xxx_spi");
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 075/188] spi: bcmbca-hsspi: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 074/188] spi: fsl: " Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 076/188] spi: coldfire-qspi: " Greg Kroah-Hartman
` (117 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, William Zhang, Johan Hovold,
Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit c3d97c3320b9a1ebbd6119857341be034f7b3efc upstream.
Make sure to deregister the controller before disabling underlying
resources like interrupts during driver unbind to allow SPI drivers to
do I/O during deregistration.
Note that clocks were also disabled before the recent commit
e532e21a246d ("spi: bcm63xx-hsspi: Simplify clock handling with
devm_clk_get_enabled()").
Fixes: a38a2233f23b ("spi: bcmbca-hsspi: Add driver for newer HSSPI controller")
Cc: stable@vger.kernel.org # 6.3: deb269e0394f
Cc: stable@vger.kernel.org # 6.3
Cc: William Zhang <william.zhang@broadcom.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260409120419.388546-8-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-bcmbca-hsspi.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-bcmbca-hsspi.c
+++ b/drivers/spi/spi-bcmbca-hsspi.c
@@ -550,7 +550,7 @@ static int bcmbca_hsspi_probe(struct pla
}
/* register and we are done */
- ret = devm_spi_register_controller(dev, host);
+ ret = spi_register_controller(host);
if (ret)
goto out_sysgroup_disable;
@@ -572,6 +572,8 @@ static void bcmbca_hsspi_remove(struct p
struct spi_controller *host = platform_get_drvdata(pdev);
struct bcmbca_hsspi *bs = spi_controller_get_devdata(host);
+ spi_unregister_controller(host);
+
/* reset the hardware and block queue progress */
__raw_writel(0, bs->regs + HSSPI_INT_MASK_REG);
clk_disable_unprepare(bs->pll_clk);
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 076/188] spi: coldfire-qspi: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 075/188] spi: bcmbca-hsspi: " Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 077/188] spi: npcm-pspi: " Greg Kroah-Hartman
` (116 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Steven King, Johan Hovold,
Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit e7c510e192ff2a1264d999575eea39a506424264 upstream.
Make sure to deregister the controller before disabling underlying
resources like clocks (via runtime pm) during driver unbind.
Fixes: 34b8c6617366 ("spi: Add Freescale/Motorola Coldfire QSPI driver")
Cc: stable@vger.kernel.org # 2.6.34
Cc: Steven King <sfking@fdwdc.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260409120419.388546-11-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-coldfire-qspi.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
--- a/drivers/spi/spi-coldfire-qspi.c
+++ b/drivers/spi/spi-coldfire-qspi.c
@@ -410,9 +410,9 @@ static int mcfqspi_probe(struct platform
platform_set_drvdata(pdev, host);
pm_runtime_enable(&pdev->dev);
- status = devm_spi_register_controller(&pdev->dev, host);
+ status = spi_register_controller(host);
if (status) {
- dev_dbg(&pdev->dev, "devm_spi_register_controller failed\n");
+ dev_dbg(&pdev->dev, "failed to register controller\n");
goto fail1;
}
@@ -436,11 +436,17 @@ static void mcfqspi_remove(struct platfo
struct spi_controller *host = platform_get_drvdata(pdev);
struct mcfqspi *mcfqspi = spi_controller_get_devdata(host);
+ spi_controller_get(host);
+
+ spi_unregister_controller(host);
+
pm_runtime_disable(&pdev->dev);
/* disable the hardware (set the baud rate to 0) */
mcfqspi_wr_qmr(mcfqspi, MCFQSPI_QMR_MSTR);
mcfqspi_cs_teardown(mcfqspi);
+
+ spi_controller_put(host);
}
#ifdef CONFIG_PM_SLEEP
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 077/188] spi: npcm-pspi: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 076/188] spi: coldfire-qspi: " Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 078/188] spi: cavium-thunderx: " Greg Kroah-Hartman
` (115 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tomer Maimon, Johan Hovold,
Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit ebd81199e00e107980bf8c4d2c747ae50158f797 upstream.
Make sure to deregister the controller before disabling underlying
resources like clocks during driver unbind.
Fixes: 2a22f1b30cee ("spi: npcm: add NPCM PSPI controller driver")
Cc: stable@vger.kernel.org # 5.0
Cc: Tomer Maimon <tmaimon77@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260410081757.503099-5-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-npcm-pspi.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-npcm-pspi.c
+++ b/drivers/spi/spi-npcm-pspi.c
@@ -414,7 +414,7 @@ static int npcm_pspi_probe(struct platfo
/* set to default clock rate */
npcm_pspi_set_baudrate(priv, NPCM_PSPI_DEFAULT_CLK);
- ret = devm_spi_register_controller(&pdev->dev, host);
+ ret = spi_register_controller(host);
if (ret)
goto out_disable_clk;
@@ -435,8 +435,14 @@ static void npcm_pspi_remove(struct plat
struct spi_controller *host = platform_get_drvdata(pdev);
struct npcm_pspi *priv = spi_controller_get_devdata(host);
+ spi_controller_get(host);
+
+ spi_unregister_controller(host);
+
npcm_pspi_reset_hw(priv);
clk_disable_unprepare(priv->clk);
+
+ spi_controller_put(host);
}
static const struct of_device_id npcm_pspi_match[] = {
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 078/188] spi: cavium-thunderx: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 077/188] spi: npcm-pspi: " Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 079/188] spi: pic32-sqi: " Greg Kroah-Hartman
` (114 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jan Glauber, Johan Hovold,
Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit dbb6b01267c0c866eaac4019cec19f414beec61d upstream.
Make sure to deregister the controller before disabling it to avoid
hanging or leaking resources associated with the queue when the queue
non-empty.
Fixes: 7347a6c7af8d ("spi: octeon: Add ThunderX driver")
Cc: stable@vger.kernel.org # 4.9
Cc: Jan Glauber <jan.glauber@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260409120419.388546-10-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-cavium-thunderx.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-cavium-thunderx.c
+++ b/drivers/spi/spi-cavium-thunderx.c
@@ -71,7 +71,7 @@ static int thunderx_spi_probe(struct pci
pci_set_drvdata(pdev, host);
- ret = devm_spi_register_controller(dev, host);
+ ret = spi_register_controller(host);
if (ret)
goto error;
@@ -91,8 +91,14 @@ static void thunderx_spi_remove(struct p
if (!p)
return;
+ spi_controller_get(host);
+
+ spi_unregister_controller(host);
+
/* Put everything in a known state. */
writeq(0, p->register_base + OCTEON_SPI_CFG(p));
+
+ spi_controller_put(host);
}
static const struct pci_device_id thunderx_spi_pci_id_table[] = {
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 079/188] spi: pic32-sqi: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 078/188] spi: cavium-thunderx: " Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 080/188] spi: sprd: " Greg Kroah-Hartman
` (113 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Purna Chandra Mandal, Johan Hovold,
Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 420df79d1a618951eb0eb4331df95c9f4f763b8b upstream.
Make sure to deregister the controller before releasing underlying
resources like DMA during driver unbind.
Fixes: 3270ac230f66 ("spi: pic32-sqi: add SPI driver for PIC32 SQI controller.")
Cc: stable@vger.kernel.org # 4.7
Cc: Purna Chandra Mandal <purna.mandal@microchip.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260410081757.503099-8-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-pic32-sqi.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-pic32-sqi.c
+++ b/drivers/spi/spi-pic32-sqi.c
@@ -642,7 +642,7 @@ static int pic32_sqi_probe(struct platfo
host->prepare_transfer_hardware = pic32_sqi_prepare_hardware;
host->unprepare_transfer_hardware = pic32_sqi_unprepare_hardware;
- ret = devm_spi_register_controller(&pdev->dev, host);
+ ret = spi_register_controller(host);
if (ret) {
dev_err(&host->dev, "failed registering spi host\n");
free_irq(sqi->irq, sqi);
@@ -665,9 +665,15 @@ static void pic32_sqi_remove(struct plat
{
struct pic32_sqi *sqi = platform_get_drvdata(pdev);
+ spi_controller_get(sqi->host);
+
+ spi_unregister_controller(sqi->host);
+
/* release resources */
free_irq(sqi->irq, sqi);
ring_desc_ring_free(sqi);
+
+ spi_controller_put(sqi->host);
}
static const struct of_device_id pic32_sqi_of_ids[] = {
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 080/188] spi: sprd: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 079/188] spi: pic32-sqi: " Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 081/188] spi: rspi: " Greg Kroah-Hartman
` (112 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lanqing Liu, Johan Hovold,
Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 123d17dbc5f07059752fa5e616385ca29a8f935a upstream.
Make sure to deregister the controller before disabling underlying
resources like clocks during driver unbind.
Note that the controller is suspended before disabling and releasing
resources since commit de082d866cce ("spi: sprd: Add the SPI irq
function for the SPI DMA mode") which avoids issues like unclocked
accesses but prevents SPI device drivers from doing I/O during
deregistration.
Fixes: e7d973a31c24 ("spi: sprd: Add SPI driver for Spreadtrum SC9860")
Cc: stable@vger.kernel.org # 4.20
Cc: Lanqing Liu <lanqing.liu@spreadtrum.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260410081757.503099-17-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-sprd.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/spi/spi-sprd.c
+++ b/drivers/spi/spi-sprd.c
@@ -978,7 +978,7 @@ static int sprd_spi_probe(struct platfor
goto err_rpm_put;
}
- ret = devm_spi_register_controller(&pdev->dev, sctlr);
+ ret = spi_register_controller(sctlr);
if (ret)
goto err_rpm_put;
@@ -1009,7 +1009,9 @@ static void sprd_spi_remove(struct platf
if (ret < 0)
dev_err(ss->dev, "failed to resume SPI controller\n");
- spi_controller_suspend(sctlr);
+ spi_controller_get(sctlr);
+
+ spi_unregister_controller(sctlr);
if (ret >= 0) {
if (ss->dma.enable)
@@ -1018,6 +1020,8 @@ static void sprd_spi_remove(struct platf
}
pm_runtime_put_noidle(&pdev->dev);
pm_runtime_disable(&pdev->dev);
+
+ spi_controller_put(sctlr);
}
static int __maybe_unused sprd_spi_runtime_suspend(struct device *dev)
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 081/188] spi: rspi: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 080/188] spi: sprd: " Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 082/188] spi: sh-msiof: " Greg Kroah-Hartman
` (111 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jingoo Han, Johan Hovold, Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 9944fa6726afb1e6eb7e2212764e7da0c97f2dcc upstream.
Make sure to deregister the controller before releasing underlying
resources like DMA during driver unbind.
Fixes: 9e03d05eee4c ("spi: rcar: Use devm_spi_register_master()")
Cc: stable@vger.kernel.org # 3.14
Cc: Jingoo Han <jg1.han@samsung.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260410081757.503099-11-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-rspi.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
--- a/drivers/spi/spi-rspi.c
+++ b/drivers/spi/spi-rspi.c
@@ -1171,8 +1171,14 @@ static void rspi_remove(struct platform_
{
struct rspi_data *rspi = platform_get_drvdata(pdev);
+ spi_controller_get(rspi->ctlr);
+
+ spi_unregister_controller(rspi->ctlr);
+
rspi_release_dma(rspi->ctlr);
pm_runtime_disable(&pdev->dev);
+
+ spi_controller_put(rspi->ctlr);
}
static const struct spi_ops rspi_ops = {
@@ -1377,9 +1383,9 @@ static int rspi_probe(struct platform_de
if (ret < 0)
dev_warn(&pdev->dev, "DMA not available, using PIO\n");
- ret = devm_spi_register_controller(&pdev->dev, ctlr);
+ ret = spi_register_controller(ctlr);
if (ret < 0) {
- dev_err(&pdev->dev, "devm_spi_register_controller error.\n");
+ dev_err(&pdev->dev, "failed to register controller\n");
goto error3;
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 082/188] spi: sh-msiof: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 081/188] spi: rspi: " Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 083/188] spi: slave-mt27xx: " Greg Kroah-Hartman
` (110 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven, Johan Hovold,
Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 45170f67a08b912ead6ccc387ba06954d1d4e53a upstream.
Make sure to deregister the controller before releasing underlying
resources like DMA during driver unbind.
Fixes: 1bd6363bc0c6 ("spi: sh-msiof: Use core message handling instead of spi-bitbang")
Cc: stable@vger.kernel.org # 3.15
Cc: Geert Uytterhoeven <geert+renesas@linux-m68k.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260410081757.503099-14-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-sh-msiof.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
--- a/drivers/spi/spi-sh-msiof.c
+++ b/drivers/spi/spi-sh-msiof.c
@@ -1290,9 +1290,9 @@ static int sh_msiof_spi_probe(struct pla
if (ret < 0)
dev_warn(dev, "DMA not available, using PIO\n");
- ret = devm_spi_register_controller(dev, ctlr);
+ ret = spi_register_controller(ctlr);
if (ret < 0) {
- dev_err(dev, "devm_spi_register_controller error.\n");
+ dev_err(dev, "failed to register controller\n");
goto err2;
}
@@ -1310,8 +1310,14 @@ static void sh_msiof_spi_remove(struct p
{
struct sh_msiof_spi_priv *p = platform_get_drvdata(pdev);
+ spi_controller_get(p->ctlr);
+
+ spi_unregister_controller(p->ctlr);
+
sh_msiof_release_dma(p);
pm_runtime_disable(&pdev->dev);
+
+ spi_controller_put(p->ctlr);
}
static const struct platform_device_id spi_driver_ids[] = {
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 083/188] spi: slave-mt27xx: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 082/188] spi: sh-msiof: " Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 084/188] spi: img-spfi: " Greg Kroah-Hartman
` (109 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Leilk Liu, Johan Hovold, Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit ab840cbda4fe6c40e52f6415c47056797c663bb2 upstream.
Make sure to deregister the controller before disabling underlying
resources like clocks (by disabling runtime PM) during driver unbind.
Fixes: 805be7ddf367 ("spi: mediatek: add spi slave for Mediatek MT2712")
Cc: stable@vger.kernel.org # 4.20
Cc: Leilk Liu <leilk.liu@mediatek.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260410081757.503099-16-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-slave-mt27xx.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-slave-mt27xx.c
+++ b/drivers/spi/spi-slave-mt27xx.c
@@ -454,7 +454,7 @@ static int mtk_spi_slave_probe(struct pl
pm_runtime_enable(&pdev->dev);
- ret = devm_spi_register_controller(&pdev->dev, ctlr);
+ ret = spi_register_controller(ctlr);
clk_disable_unprepare(mdata->spi_clk);
if (ret) {
dev_err(&pdev->dev,
@@ -474,7 +474,15 @@ err_put_ctlr:
static void mtk_spi_slave_remove(struct platform_device *pdev)
{
+ struct spi_controller *ctlr = platform_get_drvdata(pdev);
+
+ spi_controller_get(ctlr);
+
+ spi_unregister_controller(ctlr);
+
pm_runtime_disable(&pdev->dev);
+
+ spi_controller_put(ctlr);
}
#ifdef CONFIG_PM_SLEEP
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 084/188] spi: img-spfi: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 083/188] spi: slave-mt27xx: " Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 085/188] spi: mpfs: " Greg Kroah-Hartman
` (108 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrew Bresticker, Johan Hovold,
Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit fc3a83b0d9c16b941c9028f5a8db9541dce4ddf2 upstream.
Make sure to deregister the controller before disabling and releasing
underlying resources like clocks and DMA during driver unbind.
Fixes: deba25800a12 ("spi: Add driver for IMG SPFI controller")
Cc: stable@vger.kernel.org # 3.19
Cc: Andrew Bresticker <abrestic@chromium.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260409120419.388546-16-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-img-spfi.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-img-spfi.c
+++ b/drivers/spi/spi-img-spfi.c
@@ -644,7 +644,7 @@ static int img_spfi_probe(struct platfor
pm_runtime_set_active(spfi->dev);
pm_runtime_enable(spfi->dev);
- ret = devm_spi_register_controller(spfi->dev, host);
+ ret = spi_register_controller(host);
if (ret)
goto disable_pm;
@@ -670,6 +670,10 @@ static void img_spfi_remove(struct platf
struct spi_controller *host = platform_get_drvdata(pdev);
struct img_spfi *spfi = spi_controller_get_devdata(host);
+ spi_controller_get(host);
+
+ spi_unregister_controller(host);
+
if (spfi->tx_ch)
dma_release_channel(spfi->tx_ch);
if (spfi->rx_ch)
@@ -680,6 +684,8 @@ static void img_spfi_remove(struct platf
clk_disable_unprepare(spfi->spfi_clk);
clk_disable_unprepare(spfi->sys_clk);
}
+
+ spi_controller_put(host);
}
#ifdef CONFIG_PM
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 085/188] spi: mpfs: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 084/188] spi: img-spfi: " Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 086/188] spi: imx: fix runtime pm leak on probe deferral Greg Kroah-Hartman
` (107 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Conor Dooley, Johan Hovold,
Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 573c7db8fce91a1b07dd64a260bb44b9e6d05943 upstream.
Make sure to deregister the controller before disabling underlying
resources like interrupts during driver unbind.
Fixes: 9ac8d17694b6 ("spi: add support for microchip fpga spi controllers")
Cc: stable@vger.kernel.org # 6.0
Cc: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://patch.msgid.link/20260409120419.388546-21-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-mpfs.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-mpfs.c
+++ b/drivers/spi/spi-mpfs.c
@@ -575,7 +575,7 @@ static int mpfs_spi_probe(struct platfor
mpfs_spi_init(host, spi);
- ret = devm_spi_register_controller(&pdev->dev, host);
+ ret = spi_register_controller(host);
if (ret) {
mpfs_spi_disable_ints(spi);
mpfs_spi_disable(spi);
@@ -593,6 +593,8 @@ static void mpfs_spi_remove(struct platf
struct spi_controller *host = platform_get_drvdata(pdev);
struct mpfs_spi *spi = spi_controller_get_devdata(host);
+ spi_unregister_controller(host);
+
mpfs_spi_disable_ints(spi);
mpfs_spi_disable(spi);
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 086/188] spi: imx: fix runtime pm leak on probe deferral
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 085/188] spi: mpfs: " Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 087/188] spi: mxic: fix controller deregistration Greg Kroah-Hartman
` (106 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sascha Hauer, Johan Hovold,
Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit a1d50a37d3b1df84f536a982f692371039df4a48 upstream.
Make sure to balance the runtime PM usage count before returning on
probe failure (e.g. probe deferral) so that the controller can be
suspended when a driver is later bound.
Fixes: 43b6bf406cd0 ("spi: imx: fix runtime pm support for !CONFIG_PM")
Cc: stable@vger.kernel.org # 5.10
Cc: Sascha Hauer <s.hauer@pengutronix.de>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260421125632.1537235-1-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-imx.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/spi/spi-imx.c
+++ b/drivers/spi/spi-imx.c
@@ -1948,6 +1948,7 @@ out_register_controller:
out_runtime_pm_put:
pm_runtime_dont_use_autosuspend(spi_imx->dev);
pm_runtime_disable(spi_imx->dev);
+ pm_runtime_put_noidle(spi_imx->dev);
pm_runtime_set_suspended(&pdev->dev);
clk_disable_unprepare(spi_imx->clk_ipg);
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 087/188] spi: mxic: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 086/188] spi: imx: fix runtime pm leak on probe deferral Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 088/188] spi: orion: " Greg Kroah-Hartman
` (105 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mason Yang, Johan Hovold, Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit adbc595e272052181d40ec307a4c5ba98571b0fe upstream.
Make sure to deregister the controller before disabling underlying
resources like clocks (via runtime pm) during driver unbind.
Fixes: b942d80b0a39 ("spi: Add MXIC controller driver")
Cc: stable@vger.kernel.org # 5.0: cc53711b2191
Cc: stable@vger.kernel.org # 5.0
Cc: Mason Yang <masonccyang@mxic.com.tw>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260414134319.978196-6-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-mxic.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-mxic.c
+++ b/drivers/spi/spi-mxic.c
@@ -833,9 +833,10 @@ static void mxic_spi_remove(struct platf
struct spi_controller *host = platform_get_drvdata(pdev);
struct mxic_spi *mxic = spi_controller_get_devdata(host);
+ spi_unregister_controller(host);
+
pm_runtime_disable(&pdev->dev);
mxic_spi_mem_ecc_remove(mxic);
- spi_unregister_controller(host);
}
static const struct of_device_id mxic_spi_of_ids[] = {
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 088/188] spi: orion: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 087/188] spi: mxic: fix controller deregistration Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 089/188] spi: orion: fix runtime pm leak on unbind Greg Kroah-Hartman
` (104 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Johan Hovold, Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 220f4f11104a7f83b71543ef0e48dde1da2bc5d3 upstream.
Make sure to deregister the controller before disabling underlying
resources like clocks during driver unbind.
Fixes: 60cadec9da7b ("spi: new orion_spi driver")
Cc: stable@vger.kernel.org # 2.6.27
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260414134319.978196-7-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-orion.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-orion.c
+++ b/drivers/spi/spi-orion.c
@@ -802,10 +802,15 @@ static void orion_spi_remove(struct plat
struct spi_controller *host = platform_get_drvdata(pdev);
struct orion_spi *spi = spi_controller_get_devdata(host);
+ spi_controller_get(host);
+
+ spi_unregister_controller(host);
+
pm_runtime_get_sync(&pdev->dev);
clk_disable_unprepare(spi->axi_clk);
- spi_unregister_controller(host);
+ spi_controller_put(host);
+
pm_runtime_disable(&pdev->dev);
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 089/188] spi: orion: fix runtime pm leak on unbind
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 088/188] spi: orion: " Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 090/188] spi: orion: fix clock imbalance on registration failure Greg Kroah-Hartman
` (103 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Russell King, Johan Hovold,
Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 97b17dd8266d2e26d9ee3c75a0fa34ecde6944f0 upstream.
Make sure to balance the runtime PM usage count on driver unbind so that
the controller can be suspended when a driver is rebound.
Also restore the autosuspend setting.
This issue was flagged by Sashiko when reviewing a controller
deregistration fix.
Fixes: 5c6786945b4e ("spi: spi-orion: add runtime PM support")
Cc: stable@vger.kernel.org # 3.17
Cc: Russell King <rmk+kernel@arm.linux.org.uk>
Link: https://sashiko.dev/#/patchset/20260414134319.978196-1-johan%40kernel.org?part=6
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260421130211.1537628-2-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-orion.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/spi/spi-orion.c
+++ b/drivers/spi/spi-orion.c
@@ -812,6 +812,9 @@ static void orion_spi_remove(struct plat
spi_controller_put(host);
pm_runtime_disable(&pdev->dev);
+ pm_runtime_put_noidle(&pdev->dev);
+ pm_runtime_set_suspended(&pdev->dev);
+ pm_runtime_dont_use_autosuspend(&pdev->dev);
}
MODULE_ALIAS("platform:" DRIVER_NAME);
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 090/188] spi: orion: fix clock imbalance on registration failure
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 089/188] spi: orion: fix runtime pm leak on unbind Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 091/188] spi: mpc52xx: fix use-after-free " Greg Kroah-Hartman
` (102 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Russell King, Johan Hovold,
Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 443cde0dc59c5d154156ac9f27a7dadef8ebc0c2 upstream.
Make sure that the controller is not runtime suspended before disabling
clocks on probe failure.
Also restore the autosuspend setting.
Fixes: 5c6786945b4e ("spi: spi-orion: add runtime PM support")
Cc: stable@vger.kernel.org # 3.17
Cc: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260421130211.1537628-3-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-orion.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/spi/spi-orion.c
+++ b/drivers/spi/spi-orion.c
@@ -774,6 +774,7 @@ static int orion_spi_probe(struct platfo
pm_runtime_set_active(&pdev->dev);
pm_runtime_use_autosuspend(&pdev->dev);
pm_runtime_set_autosuspend_delay(&pdev->dev, SPI_AUTOSUSPEND_TIMEOUT);
+ pm_runtime_get_noresume(&pdev->dev);
pm_runtime_enable(&pdev->dev);
status = orion_spi_reset(spi);
@@ -785,10 +786,15 @@ static int orion_spi_probe(struct platfo
if (status < 0)
goto out_rel_pm;
+ pm_runtime_put_autosuspend(&pdev->dev);
+
return status;
out_rel_pm:
pm_runtime_disable(&pdev->dev);
+ pm_runtime_put_noidle(&pdev->dev);
+ pm_runtime_set_suspended(&pdev->dev);
+ pm_runtime_dont_use_autosuspend(&pdev->dev);
out_rel_axi_clk:
clk_disable_unprepare(spi->axi_clk);
out:
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 091/188] spi: mpc52xx: fix use-after-free on registration failure
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 090/188] spi: orion: fix clock imbalance on registration failure Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 092/188] spi: mpc52xx: fix controller deregistration Greg Kroah-Hartman
` (101 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Grant Likely, Johan Hovold,
Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit f62c060272b9d7423b1650b844e8e4e7b8f9f925 upstream.
Make sure to disable and free the interrupts in case controller
registration fails to avoid a potential use-after-free and resource
leak.
This issue was flagged by Sashiko when reviewing a controller
deregistration fix.
Fixes: 42bbb70980f3 ("powerpc/5200: Add mpc5200-spi (non-PSC) device driver")
Cc: stable@vger.kernel.org # 2.6.33
Cc: Grant Likely <grant.likely@secretlab.ca>
Link: https://sashiko.dev/#/patchset/20260414134319.978196-1-johan%40kernel.org?part=3
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260421125800.1537361-1-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-mpc52xx.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/spi/spi-mpc52xx.c
+++ b/drivers/spi/spi-mpc52xx.c
@@ -501,6 +501,9 @@ static int mpc52xx_spi_probe(struct plat
err_register:
dev_err(&ms->host->dev, "initialization failed\n");
+ free_irq(ms->irq0, ms);
+ free_irq(ms->irq1, ms);
+ cancel_work_sync(&ms->work);
err_gpio:
while (i-- > 0)
gpiod_put(ms->gpio_cs[i]);
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 092/188] spi: mpc52xx: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 091/188] spi: mpc52xx: fix use-after-free " Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 093/188] spi: mpc52xx: fix use-after-free on unbind Greg Kroah-Hartman
` (100 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Grant Likely, Luotao Fu,
Johan Hovold, Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 0f997fdae819a8c2cc83bd4ff7d935ad76c727c9 upstream.
Make sure to deregister the controller before disabling and releasing
underlying resources like interrupts and gpios during driver unbind.
Fixes: 42bbb70980f3 ("powerpc/5200: Add mpc5200-spi (non-PSC) device driver")
Fixes: b8d4e2ce60b6 ("mpc52xx_spi: add gpio chipselect")
Cc: stable@vger.kernel.org # 2.6.33
Cc: Grant Likely <grant.likely@secretlab.ca>
Cc: Luotao Fu <l.fu@pengutronix.de>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260414134319.978196-4-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-mpc52xx.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-mpc52xx.c
+++ b/drivers/spi/spi-mpc52xx.c
@@ -523,6 +523,8 @@ static void mpc52xx_spi_remove(struct pl
struct mpc52xx_spi *ms = spi_controller_get_devdata(host);
int i;
+ spi_unregister_controller(host);
+
cancel_work_sync(&ms->work);
free_irq(ms->irq0, ms);
free_irq(ms->irq1, ms);
@@ -531,7 +533,6 @@ static void mpc52xx_spi_remove(struct pl
gpiod_put(ms->gpio_cs[i]);
kfree(ms->gpio_cs);
- spi_unregister_controller(host);
iounmap(ms->regs);
spi_controller_put(host);
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 093/188] spi: mpc52xx: fix use-after-free on unbind
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 092/188] spi: mpc52xx: fix controller deregistration Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 094/188] spi: cadence: fix controller deregistration Greg Kroah-Hartman
` (99 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pei Xiao, Johan Hovold, Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 706b3dc2ac7a998c55e14b3fd2e8f934c367e6e0 upstream.
The state machine work is scheduled by the interrupt handler and
therefore needs to be cancelled after disabling interrupts to avoid a
potential use-after-free.
Fixes: 984836621aad ("spi: mpc52xx: Add cancel_work_sync before module remove")
Cc: stable@vger.kernel.org
Cc: Pei Xiao <xiaopei01@kylinos.cn>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260414134319.978196-5-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-mpc52xx.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-mpc52xx.c
+++ b/drivers/spi/spi-mpc52xx.c
@@ -525,10 +525,11 @@ static void mpc52xx_spi_remove(struct pl
spi_unregister_controller(host);
- cancel_work_sync(&ms->work);
free_irq(ms->irq0, ms);
free_irq(ms->irq1, ms);
+ cancel_work_sync(&ms->work);
+
for (i = 0; i < ms->gpio_cs_count; i++)
gpiod_put(ms->gpio_cs[i]);
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 094/188] spi: cadence: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 093/188] spi: mpc52xx: fix use-after-free on unbind Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 095/188] spi: cadence: fix unclocked access on unbind Greg Kroah-Hartman
` (98 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Harini Katakam, Johan Hovold,
Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 666fa7e9ca98e71c880086ca24147ae843f1ed6e upstream.
Make sure to deregister the controller before disabling underlying
resources like clocks during driver unbind.
Fixes: c474b3866546 ("spi: Add driver for Cadence SPI controller")
Cc: stable@vger.kernel.org # 3.16
Cc: Harini Katakam <harinik@xilinx.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260414134319.978196-2-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-cadence.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-cadence.c
+++ b/drivers/spi/spi-cadence.c
@@ -698,6 +698,10 @@ static void cdns_spi_remove(struct platf
struct spi_controller *ctlr = platform_get_drvdata(pdev);
struct cdns_spi *xspi = spi_controller_get_devdata(ctlr);
+ spi_controller_get(ctlr);
+
+ spi_unregister_controller(ctlr);
+
cdns_spi_write(xspi, CDNS_SPI_ER, CDNS_SPI_ER_DISABLE);
if (!spi_controller_is_target(ctlr)) {
@@ -705,7 +709,7 @@ static void cdns_spi_remove(struct platf
pm_runtime_set_suspended(&pdev->dev);
}
- spi_unregister_controller(ctlr);
+ spi_controller_put(ctlr);
}
/**
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 095/188] spi: cadence: fix unclocked access on unbind
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 094/188] spi: cadence: fix controller deregistration Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 096/188] spi: cadence: fix clock imbalance on probe failure Greg Kroah-Hartman
` (97 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shubhrajyoti Datta, Johan Hovold,
Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 5b1689a41f02955c5361944f748a4812a6ff9307 upstream.
Make sure that the controller is runtime resumed before disabling it
during driver unbind to avoid unclocked register access and unbalanced
clock disable.
Also restore the autosuspend setting.
This issue was flagged by Sashiko when reviewing a controller
deregistration fix.
Fixes: d36ccd9f7ea4 ("spi: cadence: Runtime pm adaptation")
Cc: stable@vger.kernel.org # 4.7
Cc: Shubhrajyoti Datta <shubhrajyoti.datta@xilinx.com>
Link: https://sashiko.dev/#/patchset/20260414134319.978196-1-johan%40kernel.org?part=1
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260421123615.1533617-2-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-cadence.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-cadence.c
+++ b/drivers/spi/spi-cadence.c
@@ -697,16 +697,23 @@ static void cdns_spi_remove(struct platf
{
struct spi_controller *ctlr = platform_get_drvdata(pdev);
struct cdns_spi *xspi = spi_controller_get_devdata(ctlr);
+ int ret = 0;
+
+ if (!spi_controller_is_target(ctlr))
+ ret = pm_runtime_get_sync(&pdev->dev);
spi_controller_get(ctlr);
spi_unregister_controller(ctlr);
- cdns_spi_write(xspi, CDNS_SPI_ER, CDNS_SPI_ER_DISABLE);
+ if (ret >= 0)
+ cdns_spi_write(xspi, CDNS_SPI_ER, CDNS_SPI_ER_DISABLE);
if (!spi_controller_is_target(ctlr)) {
pm_runtime_disable(&pdev->dev);
pm_runtime_set_suspended(&pdev->dev);
+ pm_runtime_put_noidle(&pdev->dev);
+ pm_runtime_dont_use_autosuspend(&pdev->dev);
}
spi_controller_put(ctlr);
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 096/188] spi: cadence: fix clock imbalance on probe failure
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 095/188] spi: cadence: fix unclocked access on unbind Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 097/188] drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() Greg Kroah-Hartman
` (96 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shubhrajyoti Datta, Johan Hovold,
Mark Brown
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit ecea4f0e9db2fb6ab4a68a59c5aba0d8f59a9566 upstream.
Make sure that the controller is active before disabling clocks on probe
failure to avoid unbalanced clock disable.
Also drop the usage count before returning (so that the controller can
be suspended after a probe deferral) and restore the autosuspend
setting.
Fixes: d36ccd9f7ea4 ("spi: cadence: Runtime pm adaptation")
Cc: stable@vger.kernel.org # 4.7
Cc: Shubhrajyoti Datta <shubhrajyoti.datta@xilinx.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260421123615.1533617-3-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-cadence.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-cadence.c
+++ b/drivers/spi/spi-cadence.c
@@ -662,7 +662,6 @@ static int cdns_spi_probe(struct platfor
/* Set to default valid value */
ctlr->max_speed_hz = xspi->clk_rate / 4;
xspi->speed_hz = ctlr->max_speed_hz;
- pm_runtime_put_autosuspend(&pdev->dev);
} else {
ctlr->mode_bits |= SPI_NO_CS;
ctlr->target_abort = cdns_target_abort;
@@ -673,12 +672,17 @@ static int cdns_spi_probe(struct platfor
goto clk_dis_all;
}
+ if (!spi_controller_is_target(ctlr))
+ pm_runtime_put_autosuspend(&pdev->dev);
+
return ret;
clk_dis_all:
if (!spi_controller_is_target(ctlr)) {
pm_runtime_disable(&pdev->dev);
pm_runtime_set_suspended(&pdev->dev);
+ pm_runtime_put_noidle(&pdev->dev);
+ pm_runtime_dont_use_autosuspend(&pdev->dev);
}
remove_ctlr:
spi_controller_put(ctlr);
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 097/188] drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata()
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 096/188] spi: cadence: fix clock imbalance on probe failure Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 098/188] drm/imx: parallel-display: Prefer bus format set via legacy "interface-pix-fmt" DT property Greg Kroah-Hartman
` (95 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yasuaki Torimaru, Rob Clark
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yasuaki Torimaru <yasuakitorimaru@gmail.com>
commit 47cbfe2608314b833ad61a65827d8fb363bc2d2d upstream.
msm_ioctl_gem_info_get_metadata() always returns 0 regardless of
errors. When copy_to_user() fails or the user buffer is too small,
the error code stored in ret is ignored because the function
unconditionally returns 0. This causes userspace to believe the
ioctl succeeded when it did not.
Additionally, kmemdup() can return NULL on allocation failure, but
the return value is not checked. This leads to a NULL pointer
dereference in the subsequent copy_to_user() call.
Add the missing NULL check for kmemdup() and return ret instead of 0.
Note that the SET counterpart (msm_ioctl_gem_info_set_metadata)
correctly returns ret.
Fixes: 9902cb999e4e ("drm/msm/gem: Add metadata")
Cc: stable@vger.kernel.org
Signed-off-by: Yasuaki Torimaru <yasuakitorimaru@gmail.com>
Patchwork: https://patchwork.freedesktop.org/patch/714478/
Message-ID: <20260325114635.383241-1-yasuakitorimaru@gmail.com>
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/msm/msm_drv.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/msm/msm_drv.c
+++ b/drivers/gpu/drm/msm/msm_drv.c
@@ -536,6 +536,11 @@ static int msm_ioctl_gem_info_get_metada
len = msm_obj->metadata_size;
buf = kmemdup(msm_obj->metadata, len, GFP_KERNEL);
+ if (!buf) {
+ msm_gem_unlock(obj);
+ return -ENOMEM;
+ }
+
msm_gem_unlock(obj);
if (*metadata_size < len) {
@@ -548,7 +553,7 @@ static int msm_ioctl_gem_info_get_metada
kfree(buf);
- return 0;
+ return ret;
}
static int msm_ioctl_gem_info(struct drm_device *dev, void *data,
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 098/188] drm/imx: parallel-display: Prefer bus format set via legacy "interface-pix-fmt" DT property
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 097/188] drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 099/188] drm/msm: always recover the gpu Greg Kroah-Hartman
` (94 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marek Vasut, Philipp Zabel
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <marex@nabladev.com>
commit cdf26e1462c220629bb79d487263b66f8b679eab upstream.
Prefer bus format set via legacy "interface-pix-fmt" DT property
over panel bus format. This is necessary to retain support for
DTs which configure the IPUv3 parallel output as 24bit DPI, but
connect 18bit DPI panels to it with hardware swizzling.
This used to work up to Linux 6.12, but stopped working in 6.13,
reinstate the behavior to support old DTs.
Cc: stable@vger.kernel.org
Fixes: 5f6e56d3319d ("drm/imx: parallel-display: switch to drm_panel_bridge")
Signed-off-by: Marek Vasut <marex@nabladev.com>
Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Link: https://patch.msgid.link/20260110171510.692666-1-marex@nabladev.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/imx/ipuv3/parallel-display.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/imx/ipuv3/parallel-display.c
+++ b/drivers/gpu/drm/imx/ipuv3/parallel-display.c
@@ -110,8 +110,7 @@ imx_pd_bridge_atomic_get_input_bus_fmts(
output_fmt = imxpd->bus_format ? : MEDIA_BUS_FMT_RGB888_1X24;
/* Now make sure the requested output format is supported. */
- if ((imxpd->bus_format && imxpd->bus_format != output_fmt) ||
- !imx_pd_format_supported(output_fmt)) {
+ if (!imx_pd_format_supported(output_fmt)) {
*num_input_fmts = 0;
return NULL;
}
@@ -121,7 +120,17 @@ imx_pd_bridge_atomic_get_input_bus_fmts(
if (!input_fmts)
return NULL;
- input_fmts[0] = output_fmt;
+ /*
+ * Prefer bus format set via legacy "interface-pix-fmt" DT property
+ * over panel bus format. This is necessary to retain support for
+ * DTs which configure the IPUv3 parallel output as 24bit, but
+ * connect 18bit DPI panels to it with hardware swizzling.
+ */
+ if (imxpd->bus_format && imxpd->bus_format != output_fmt)
+ input_fmts[0] = imxpd->bus_format;
+ else
+ input_fmts[0] = output_fmt;
+
return input_fmts;
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 099/188] drm/msm: always recover the gpu
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 098/188] drm/imx: parallel-display: Prefer bus format set via legacy "interface-pix-fmt" DT property Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 100/188] drm/i915/psr: Init variable to avoid early exit from et alignment loop Greg Kroah-Hartman
` (93 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Anna Maniscalco, Rob Clark
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anna Maniscalco <anna.maniscalco2000@gmail.com>
commit 01a0d6cd7032e9993feea19fadb03ef9d5b488f2 upstream.
Previously, in case there was no more work to do, recover worker
wouldn't trigger recovery and would instead rely on the gpu going to
sleep and then resuming when more work is submitted.
Recover_worker will first increment the fence of the hung ring so, if
there's only one job submitted to a ring and that causes an hang, it
will early out.
There's no guarantee that the gpu will suspend and resume before more
work is submitted and if the gpu is in a hung state it will stay in that
state and probably trigger a timeout again.
Just stop checking and always recover the gpu.
Signed-off-by: Anna Maniscalco <anna.maniscalco2000@gmail.com>
Cc: stable@vger.kernel.org
Patchwork: https://patchwork.freedesktop.org/patch/704066/
Message-ID: <20260210-recovery_suspend_fix-v1-1-00ed9013da04@gmail.com>
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/msm/msm_gpu.c | 42 ++++++++++++++++++++----------------------
1 file changed, 20 insertions(+), 22 deletions(-)
--- a/drivers/gpu/drm/msm/msm_gpu.c
+++ b/drivers/gpu/drm/msm/msm_gpu.c
@@ -548,32 +548,30 @@ static void recover_worker(struct kthrea
msm_update_fence(ring->fctx, fence);
}
- if (msm_gpu_active(gpu)) {
- /* retire completed submits, plus the one that hung: */
- retire_submits(gpu);
+ /* retire completed submits, plus the one that hung: */
+ retire_submits(gpu);
- gpu->funcs->recover(gpu);
+ gpu->funcs->recover(gpu);
- /*
- * Replay all remaining submits starting with highest priority
- * ring
- */
- for (i = 0; i < gpu->nr_rings; i++) {
- struct msm_ringbuffer *ring = gpu->rb[i];
- unsigned long flags;
+ /*
+ * Replay all remaining submits starting with highest priority
+ * ring
+ */
+ for (i = 0; i < gpu->nr_rings; i++) {
+ struct msm_ringbuffer *ring = gpu->rb[i];
+ unsigned long flags;
- spin_lock_irqsave(&ring->submit_lock, flags);
- list_for_each_entry(submit, &ring->submits, node) {
- /*
- * If the submit uses an unusable vm make sure
- * we don't actually run it
- */
- if (to_msm_vm(submit->vm)->unusable)
- submit->nr_cmds = 0;
- gpu->funcs->submit(gpu, submit);
- }
- spin_unlock_irqrestore(&ring->submit_lock, flags);
+ spin_lock_irqsave(&ring->submit_lock, flags);
+ list_for_each_entry(submit, &ring->submits, node) {
+ /*
+ * If the submit uses an unusable vm make sure
+ * we don't actually run it
+ */
+ if (to_msm_vm(submit->vm)->unusable)
+ submit->nr_cmds = 0;
+ gpu->funcs->submit(gpu, submit);
}
+ spin_unlock_irqrestore(&ring->submit_lock, flags);
}
pm_runtime_put(&gpu->pdev->dev);
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 100/188] drm/i915/psr: Init variable to avoid early exit from et alignment loop
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 099/188] drm/msm: always recover the gpu Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 101/188] drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure Greg Kroah-Hartman
` (92 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jouni Högander, Nemesa Garg,
Dan Carpenter, Andi Shyti, Tvrtko Ursulin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jouni Högander <jouni.hogander@intel.com>
commit 314f6179e370988ac00dadf373a4f6166eb3db15 upstream.
Uninitialized boolean variable may cause unwanted exit from et alignment
loop. Fix this by initializing it as false.
Fixes: 1be2fca84f52 ("drm/i915/psr: Repeat Selective Update area alignment")
Cc: <stable@vger.kernel.org> # v6.9+
Signed-off-by: Jouni Högander <jouni.hogander@intel.com>
Reviewed-by: Nemesa Garg <nemesa.garg@intel.com>
Reported-by: Dan Carpenter <error27@gmail.com>
Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
Link: https://patch.msgid.link/20260413112345.88853-1-jouni.hogander@intel.com
(cherry picked from commit 289678a90b8cf81e3514c9d6c667235cd39c7acf)
Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/display/intel_psr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/i915/display/intel_psr.c
+++ b/drivers/gpu/drm/i915/display/intel_psr.c
@@ -2840,7 +2840,7 @@ int intel_psr2_sel_fetch_update(struct i
return ret;
do {
- bool cursor_in_su_area;
+ bool cursor_in_su_area = false;
/*
* Adjust su area to cover cursor fully as necessary
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 101/188] drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 100/188] drm/i915/psr: Init variable to avoid early exit from et alignment loop Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 102/188] drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count Greg Kroah-Hartman
` (91 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Amir Shetaia, Christian König,
Alex Deucher
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Shetaia <Amir.Shetaia@amd.com>
commit ad52d61d82181dbdb7f05826de38352d5e550cc2 upstream.
KFD VRAM allocations set AMDGPU_GEM_CREATE_VRAM_WIPE_ON_RELEASE
but not AMDGPU_GEM_CREATE_VRAM_CLEARED, leaving freshly allocated
VRAM with stale data from prior use observable by compute kernels.
The GEM ioctl path already sets VRAM_CLEARED for all userspace
allocations via amdgpu_gem_create_ioctl() and
amdgpu_mode_dumb_create(). The KFD path was missing this flag,
allowing stale page table remnants to leak into user buffers.
This causes crashes in RCCL P2P transport where non-zero data in
ptrExchange/head/tail fields corrupts the protocol handshake.
Signed-off-by: Amir Shetaia <Amir.Shetaia@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
@@ -1717,7 +1717,8 @@ int amdgpu_amdkfd_gpuvm_alloc_memory_of_
alloc_domain = AMDGPU_GEM_DOMAIN_GTT;
alloc_flags = 0;
} else {
- alloc_flags = AMDGPU_GEM_CREATE_VRAM_WIPE_ON_RELEASE;
+ alloc_flags = AMDGPU_GEM_CREATE_VRAM_WIPE_ON_RELEASE |
+ AMDGPU_GEM_CREATE_VRAM_CLEARED;
alloc_flags |= (flags & KFD_IOC_ALLOC_MEM_FLAGS_PUBLIC) ?
AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED : 0;
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 102/188] drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count.
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 101/188] drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 103/188] drm/amdgpu: gate VM CPU HDP flush on reset lock Greg Kroah-Hartman
` (90 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Deucher, Pratik Vishwakarma,
Ramalingeswara Reddy, Kanala
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ramalingeswara Reddy, Kanala <Kanala.RamalingeswaraReddy@amd.com>
commit 574b3b14f7d1b329fc6e67b79328f0e6f4d4b3d4 upstream.
Define and use regGOLDEN_TSC_COUNT_UPPER_smu_15_0_0 and
regGOLDEN_TSC_COUNT_LOWER_smu_15_0_0 for TSC upper and lower count.
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Pratik Vishwakarma <Pratik.Vishwakarma@amd.com>
Signed-off-by: Ramalingeswara Reddy, Kanala <Kanala.RamalingeswaraReddy@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c | 31 ++++++++++++++++++++++++++-----
1 file changed, 26 insertions(+), 5 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v11_0.c
@@ -64,6 +64,11 @@
#define regPC_CONFIG_CNTL_1 0x194d
#define regPC_CONFIG_CNTL_1_BASE_IDX 1
+#define regGOLDEN_TSC_COUNT_UPPER_smu_15_0_0 0x0030
+#define regGOLDEN_TSC_COUNT_UPPER_smu_15_0_0_BASE_IDX 1
+#define regGOLDEN_TSC_COUNT_LOWER_smu_15_0_0 0x0031
+#define regGOLDEN_TSC_COUNT_LOWER_smu_15_0_0_BASE_IDX 1
+
#define regCP_GFX_MQD_CONTROL_DEFAULT 0x00000100
#define regCP_GFX_HQD_VMID_DEFAULT 0x00000000
#define regCP_GFX_HQD_QUEUE_PRIORITY_DEFAULT 0x00000000
@@ -5174,11 +5179,27 @@ static uint64_t gfx_v11_0_get_gpu_clock_
amdgpu_gfx_off_ctrl(adev, true);
} else {
preempt_disable();
- clock_counter_hi_pre = (uint64_t)RREG32_SOC15(SMUIO, 0, regGOLDEN_TSC_COUNT_UPPER);
- clock_counter_lo = (uint64_t)RREG32_SOC15(SMUIO, 0, regGOLDEN_TSC_COUNT_LOWER);
- clock_counter_hi_after = (uint64_t)RREG32_SOC15(SMUIO, 0, regGOLDEN_TSC_COUNT_UPPER);
- if (clock_counter_hi_pre != clock_counter_hi_after)
- clock_counter_lo = (uint64_t)RREG32_SOC15(SMUIO, 0, regGOLDEN_TSC_COUNT_LOWER);
+ if (amdgpu_ip_version(adev, SMUIO_HWIP, 0) < IP_VERSION(15, 0, 0)) {
+ clock_counter_hi_pre = (uint64_t)RREG32_SOC15(SMUIO, 0,
+ regGOLDEN_TSC_COUNT_UPPER);
+ clock_counter_lo = (uint64_t)RREG32_SOC15(SMUIO, 0,
+ regGOLDEN_TSC_COUNT_LOWER);
+ clock_counter_hi_after = (uint64_t)RREG32_SOC15(SMUIO, 0,
+ regGOLDEN_TSC_COUNT_UPPER);
+ if (clock_counter_hi_pre != clock_counter_hi_after)
+ clock_counter_lo = (uint64_t)RREG32_SOC15(SMUIO, 0,
+ regGOLDEN_TSC_COUNT_LOWER);
+ } else {
+ clock_counter_hi_pre = (uint64_t)RREG32_SOC15(SMUIO, 0,
+ regGOLDEN_TSC_COUNT_UPPER_smu_15_0_0);
+ clock_counter_lo = (uint64_t)RREG32_SOC15(SMUIO, 0,
+ regGOLDEN_TSC_COUNT_LOWER_smu_15_0_0);
+ clock_counter_hi_after = (uint64_t)RREG32_SOC15(SMUIO, 0,
+ regGOLDEN_TSC_COUNT_UPPER_smu_15_0_0);
+ if (clock_counter_hi_pre != clock_counter_hi_after)
+ clock_counter_lo = (uint64_t)RREG32_SOC15(SMUIO, 0,
+ regGOLDEN_TSC_COUNT_LOWER_smu_15_0_0);
+ }
preempt_enable();
}
clock = clock_counter_lo | (clock_counter_hi_after << 32ULL);
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 103/188] drm/amdgpu: gate VM CPU HDP flush on reset lock
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 102/188] drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 104/188] drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x Greg Kroah-Hartman
` (89 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chenglei Xie, Christian König,
Alex Deucher
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chenglei Xie <Chenglei.Xie@amd.com>
commit ddda81c4d7e71e41b1be91d921fd85747eddbd12 upstream.
During GPU reset, the application could still run CPU page table updates. Each commit called
amdgpu_device_flush_hdp(), which on SR-IOV sends work through the KIQ ring.
That can advance sync_seq while the GPU is being reset,
leaving fence writeback out of sync and causing amdgpu_fence_emit_polling()
to time out on later KIQ use.
Fix:
amdgpu_vm_cpu_commit():
Reset will flush HDP anyway, the HDP flush in amdgpu_vm_cpu_commit() can be skipped
when a reset is ongoging.
Take reset_domain->sem with down_read_trylock() before amdgpu_device_flush_hdp().
If the reset path holds the write lock, skip the HDP flush so no HDP-related HW
access (including KIQ) runs during reset; state is re-established after reset.
Signed-off-by: Chenglei Xie <Chenglei.Xie@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_vm_cpu.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_cpu.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_cpu.c
@@ -21,6 +21,8 @@
*/
#include "amdgpu_vm.h"
+#include "amdgpu.h"
+#include "amdgpu_reset.h"
#include "amdgpu_object.h"
#include "amdgpu_trace.h"
@@ -108,11 +110,19 @@ static int amdgpu_vm_cpu_update(struct a
static int amdgpu_vm_cpu_commit(struct amdgpu_vm_update_params *p,
struct dma_fence **fence)
{
+ struct amdgpu_device *adev = p->adev;
+
if (p->needs_flush)
atomic64_inc(&p->vm->tlb_seq);
mb();
- amdgpu_device_flush_hdp(p->adev, NULL);
+ /* A reset flushed the HDP anyway, so that here can be skipped when a reset is ongoing */
+ if (!down_read_trylock(&adev->reset_domain->sem))
+ return 0;
+
+ amdgpu_device_flush_hdp(adev, NULL);
+ up_read(&adev->reset_domain->sem);
+
return 0;
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 104/188] drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 103/188] drm/amdgpu: gate VM CPU HDP flush on reset lock Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 105/188] drm/amdkfd: Add upper bound check for num_of_nodes Greg Kroah-Hartman
` (88 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yang Wang, Alex Deucher
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Wang <kevinyang.wang@amd.com>
commit 504f0098ebd074ac8c0ce3471795d79f68e3d265 upstream.
OverDriveTable.FanMinimumPwm and FeatureCtrlMask.PP_OD_FEATURE_FAN_LEGACY_BIT
have a hard dependency.
Invalid handling of this dependency leads to disabled thermal monitoring
and temperature boundary validation.
v2: squash in typo fix (Yang)
Fixes: 9710b84e2a6a ("drm/amd/pm: add overdrive support on smu v14.0.2/3")
Cc: stable@vger.kernel.org
Signed-off-by: Yang Wang <kevinyang.wang@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c
@@ -2442,6 +2442,7 @@ static int smu_v14_0_2_od_restore_table_
}
od_table->OverDriveTable.FanMode = FAN_MODE_AUTO;
od_table->OverDriveTable.FeatureCtrlMask |= BIT(PP_OD_FEATURE_FAN_CURVE_BIT);
+ od_table->OverDriveTable.FeatureCtrlMask &= ~BIT(PP_OD_FEATURE_FAN_LEGACY_BIT);
break;
case PP_OD_EDIT_FAN_ZERO_RPM_ENABLE:
od_table->OverDriveTable.FanZeroRpmEnable =
@@ -2470,7 +2471,8 @@ static int smu_v14_0_2_od_restore_table_
od_table->OverDriveTable.FanMinimumPwm =
boot_overdrive_table->OverDriveTable.FanMinimumPwm;
od_table->OverDriveTable.FanMode = FAN_MODE_AUTO;
- od_table->OverDriveTable.FeatureCtrlMask |= BIT(PP_OD_FEATURE_FAN_CURVE_BIT);
+ od_table->OverDriveTable.FeatureCtrlMask |= BIT(PP_OD_FEATURE_FAN_LEGACY_BIT);
+ od_table->OverDriveTable.FeatureCtrlMask &= ~BIT(PP_OD_FEATURE_FAN_CURVE_BIT);
break;
default:
dev_info(adev->dev, "Invalid table index: %ld\n", input);
@@ -2640,6 +2642,7 @@ static int smu_v14_0_2_od_edit_dpm_table
od_table->OverDriveTable.FanLinearPwmPoints[input[0]] = input[2];
od_table->OverDriveTable.FanMode = FAN_MODE_MANUAL_LINEAR;
od_table->OverDriveTable.FeatureCtrlMask |= BIT(PP_OD_FEATURE_FAN_CURVE_BIT);
+ od_table->OverDriveTable.FeatureCtrlMask &= ~BIT(PP_OD_FEATURE_FAN_LEGACY_BIT);
break;
case PP_OD_EDIT_ACOUSTIC_LIMIT:
@@ -2709,7 +2712,7 @@ static int smu_v14_0_2_od_edit_dpm_table
break;
case PP_OD_EDIT_FAN_MINIMUM_PWM:
- if (!smu_v14_0_2_is_od_feature_supported(smu, PP_OD_FEATURE_FAN_CURVE_BIT)) {
+ if (!smu_v14_0_2_is_od_feature_supported(smu, PP_OD_FEATURE_FAN_LEGACY_BIT)) {
dev_warn(adev->dev, "Fan curve setting not supported!\n");
return -ENOTSUPP;
}
@@ -2727,7 +2730,8 @@ static int smu_v14_0_2_od_edit_dpm_table
od_table->OverDriveTable.FanMinimumPwm = input[0];
od_table->OverDriveTable.FanMode = FAN_MODE_AUTO;
- od_table->OverDriveTable.FeatureCtrlMask |= BIT(PP_OD_FEATURE_FAN_CURVE_BIT);
+ od_table->OverDriveTable.FeatureCtrlMask |= BIT(PP_OD_FEATURE_FAN_LEGACY_BIT);
+ od_table->OverDriveTable.FeatureCtrlMask &= ~BIT(PP_OD_FEATURE_FAN_CURVE_BIT);
break;
case PP_OD_EDIT_FAN_ZERO_RPM_ENABLE:
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 105/188] drm/amdkfd: Add upper bound check for num_of_nodes
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 104/188] drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 106/188] drm/amdgpu: Add bounds checking to ib_{get,set}_value Greg Kroah-Hartman
` (87 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Harish Kasiviswanathan, Alysa Liu,
Alex Deucher
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alysa Liu <Alysa.Liu@amd.com>
commit 74b73fa56a395d46745e4f245225963e9f8be7f1 upstream.
drm/amdkfd: Add upper bound check for num_of_nodes
in kfd_ioctl_get_process_apertures_new.
Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
Signed-off-by: Alysa Liu <Alysa.Liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 98ff46a5ea090c14d2cdb4f5b993b05d74f3949f)
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 3 +++
drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 1 +
drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 11 +++++++++++
3 files changed, 15 insertions(+)
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -763,6 +763,9 @@ static int kfd_ioctl_get_process_apertur
goto out_unlock;
}
+ if (args->num_of_nodes > kfd_topology_get_num_devices())
+ return -EINVAL;
+
/* Fill in process-aperture information for all available
* nodes, but not more than args->num_of_nodes as that is
* the amount of memory allocated by user
--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
@@ -1175,6 +1175,7 @@ static inline struct kfd_node *kfd_node_
return NULL;
}
int kfd_topology_enum_kfd_devices(uint8_t idx, struct kfd_node **kdev);
+uint32_t kfd_topology_get_num_devices(void);
int kfd_numa_node_to_apic_id(int numa_node_id);
/* Interrupts */
--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
@@ -2295,6 +2295,17 @@ int kfd_topology_remove_device(struct kf
return res;
}
+uint32_t kfd_topology_get_num_devices(void)
+{
+ uint32_t num_devices;
+
+ down_read(&topology_lock);
+ num_devices = sys_props.num_devices;
+ up_read(&topology_lock);
+
+ return num_devices;
+}
+
/* kfd_topology_enum_kfd_devices - Enumerate through all devices in KFD
* topology. If GPU device is found @idx, then valid kfd_dev pointer is
* returned through @kdev
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 106/188] drm/amdgpu: Add bounds checking to ib_{get,set}_value
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 105/188] drm/amdkfd: Add upper bound check for num_of_nodes Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 107/188] drm/amdgpu/vcn4: Prevent OOB reads when parsing IB Greg Kroah-Hartman
` (86 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benjamin Cheng, Christian König,
Ruijing Dong, Alex Deucher
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Cheng <benjamin.cheng@amd.com>
commit 66085e206431ef88ce36f53c1f53d570790ccc9e upstream.
The uvd/vce/vcn code accesses the IB at predefined offsets without
checking that the IB is large enough. Check the bounds here. The caller
is responsible for making sure it can handle arbitrary return values.
Also make the idx a uint32_t to prevent overflows causing the condition
to fail.
Signed-off-by: Benjamin Cheng <benjamin.cheng@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Ruijing Dong <ruijing.dong@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ring.h
@@ -547,15 +547,18 @@ void amdgpu_debugfs_ring_init(struct amd
int amdgpu_ring_init_mqd(struct amdgpu_ring *ring);
-static inline u32 amdgpu_ib_get_value(struct amdgpu_ib *ib, int idx)
+static inline u32 amdgpu_ib_get_value(struct amdgpu_ib *ib, uint32_t idx)
{
- return ib->ptr[idx];
+ if (idx < ib->length_dw)
+ return ib->ptr[idx];
+ return 0;
}
-static inline void amdgpu_ib_set_value(struct amdgpu_ib *ib, int idx,
+static inline void amdgpu_ib_set_value(struct amdgpu_ib *ib, uint32_t idx,
uint32_t value)
{
- ib->ptr[idx] = value;
+ if (idx < ib->length_dw)
+ ib->ptr[idx] = value;
}
int amdgpu_ib_get(struct amdgpu_device *adev, struct amdgpu_vm *vm,
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 107/188] drm/amdgpu/vcn4: Prevent OOB reads when parsing IB
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 106/188] drm/amdgpu: Add bounds checking to ib_{get,set}_value Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 108/188] drm/amdgpu/vce: Prevent partial address patches Greg Kroah-Hartman
` (85 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benjamin Cheng, Christian König,
Ruijing Dong, Alex Deucher
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Cheng <benjamin.cheng@amd.com>
commit 2444eb0ec8283f4a3845eb7febad378476e1ba3c upstream.
Rewrite the IB parsing to use amdgpu_ib_get_value() which handles the
bounds checks.
Signed-off-by: Benjamin Cheng <benjamin.cheng@amd.com>
Acked-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Ruijing Dong <ruijing.dong@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 23 ++++++++++++-----------
1 file changed, 12 insertions(+), 11 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
@@ -1912,9 +1912,10 @@ out:
static int vcn_v4_0_enc_find_ib_param(struct amdgpu_ib *ib, uint32_t id, int start)
{
int i;
+ uint32_t len;
- for (i = start; i < ib->length_dw && ib->ptr[i] >= 8; i += ib->ptr[i] / 4) {
- if (ib->ptr[i + 1] == id)
+ for (i = start; (len = amdgpu_ib_get_value(ib, i)) >= 8; i += len / 4) {
+ if (amdgpu_ib_get_value(ib, i + 1) == id)
return i;
}
return -1;
@@ -1925,8 +1926,6 @@ static int vcn_v4_0_ring_patch_cs_in_pla
struct amdgpu_ib *ib)
{
struct amdgpu_ring *ring = amdgpu_job_ring(job);
- struct amdgpu_vcn_decode_buffer *decode_buffer;
- uint64_t addr;
uint32_t val;
int idx = 0, sidx;
@@ -1937,20 +1936,22 @@ static int vcn_v4_0_ring_patch_cs_in_pla
while ((idx = vcn_v4_0_enc_find_ib_param(ib, RADEON_VCN_ENGINE_INFO, idx)) >= 0) {
val = amdgpu_ib_get_value(ib, idx + 2); /* RADEON_VCN_ENGINE_TYPE */
if (val == RADEON_VCN_ENGINE_TYPE_DECODE) {
- decode_buffer = (struct amdgpu_vcn_decode_buffer *)&ib->ptr[idx + 6];
+ uint32_t valid_buf_flag = amdgpu_ib_get_value(ib, idx + 6);
+ uint64_t msg_buffer_addr;
- if (!(decode_buffer->valid_buf_flag & 0x1))
+ if (!(valid_buf_flag & 0x1))
return 0;
- addr = ((u64)decode_buffer->msg_buffer_address_hi) << 32 |
- decode_buffer->msg_buffer_address_lo;
- return vcn_v4_0_dec_msg(p, job, addr);
+ msg_buffer_addr = ((u64)amdgpu_ib_get_value(ib, idx + 7)) << 32 |
+ amdgpu_ib_get_value(ib, idx + 8);
+ return vcn_v4_0_dec_msg(p, job, msg_buffer_addr);
} else if (val == RADEON_VCN_ENGINE_TYPE_ENCODE) {
sidx = vcn_v4_0_enc_find_ib_param(ib, RENCODE_IB_PARAM_SESSION_INIT, idx);
- if (sidx >= 0 && ib->ptr[sidx + 2] == RENCODE_ENCODE_STANDARD_AV1)
+ if (sidx >= 0 &&
+ amdgpu_ib_get_value(ib, sidx + 2) == RENCODE_ENCODE_STANDARD_AV1)
return vcn_v4_0_limit_sched(p, job);
}
- idx += ib->ptr[idx] / 4;
+ idx += amdgpu_ib_get_value(ib, idx) / 4;
}
return 0;
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 108/188] drm/amdgpu/vce: Prevent partial address patches
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 107/188] drm/amdgpu/vcn4: Prevent OOB reads when parsing IB Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 109/188] drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg Greg Kroah-Hartman
` (84 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Benjamin Cheng, Alex Deucher
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Cheng <benjamin.cheng@amd.com>
commit de2a02cc28d6d5d37db07d00a9a684c754a5fd74 upstream.
In the case that only one of lo/hi is valid, the patching could result
in a bad address written to in FW.
Signed-off-by: Benjamin Cheng <benjamin.cheng@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
@@ -656,6 +656,9 @@ static int amdgpu_vce_cs_reloc(struct am
uint64_t addr;
int r;
+ if (lo >= ib->length_dw || hi >= ib->length_dw)
+ return -EINVAL;
+
if (index == 0xffffffff)
index = 0;
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 109/188] drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 108/188] drm/amdgpu/vce: Prevent partial address patches Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 110/188] drm/amdgpu/vcn3: " Greg Kroah-Hartman
` (83 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benjamin Cheng, Christian König,
Ruijing Dong, Alex Deucher
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Cheng <benjamin.cheng@amd.com>
commit 0a78f2bac1424deb7c9d5e09c6b8e849d8e8b648 upstream.
Check bounds against the end of the BO whenever we access the msg.
Signed-off-by: Benjamin Cheng <benjamin.cheng@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Ruijing Dong <ruijing.dong@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 21 ++++++++++++++++++---
1 file changed, 18 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
@@ -1825,7 +1825,7 @@ static int vcn_v4_0_dec_msg(struct amdgp
{
struct ttm_operation_ctx ctx = { false, false };
struct amdgpu_bo_va_mapping *map;
- uint32_t *msg, num_buffers;
+ uint32_t *msg, num_buffers, len_dw;
struct amdgpu_bo *bo;
uint64_t start, end;
unsigned int i;
@@ -1846,6 +1846,11 @@ static int vcn_v4_0_dec_msg(struct amdgp
return -EINVAL;
}
+ if (end - addr < 16) {
+ DRM_ERROR("VCN messages must be at least 4 DWORDs!\n");
+ return -EINVAL;
+ }
+
bo->flags |= AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED;
amdgpu_bo_placement_from_domain(bo, bo->allowed_domains);
r = ttm_bo_validate(&bo->tbo, &bo->placement, &ctx);
@@ -1862,8 +1867,8 @@ static int vcn_v4_0_dec_msg(struct amdgp
msg = ptr + addr - start;
- /* Check length */
if (msg[1] > end - addr) {
+ DRM_ERROR("VCN message header does not fit in BO!\n");
r = -EINVAL;
goto out;
}
@@ -1871,7 +1876,16 @@ static int vcn_v4_0_dec_msg(struct amdgp
if (msg[3] != RDECODE_MSG_CREATE)
goto out;
+ len_dw = msg[1] / 4;
num_buffers = msg[2];
+
+ /* Verify that all indices fit within the claimed length. Each index is 4 DWORDs */
+ if (num_buffers > len_dw || 6 + num_buffers * 4 > len_dw) {
+ DRM_ERROR("VCN message has too many buffers!\n");
+ r = -EINVAL;
+ goto out;
+ }
+
for (i = 0, msg = &msg[6]; i < num_buffers; ++i, msg += 4) {
uint32_t offset, size, *create;
@@ -1881,7 +1895,8 @@ static int vcn_v4_0_dec_msg(struct amdgp
offset = msg[1];
size = msg[2];
- if (offset + size > end) {
+ if (size < 4 || offset + size > end - addr) {
+ DRM_ERROR("VCN message buffer exceeds BO bounds!\n");
r = -EINVAL;
goto out;
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 110/188] drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 109/188] drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 111/188] drm/amd/display: Change dither policy for 10 bpc output back to dithering Greg Kroah-Hartman
` (82 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benjamin Cheng, Christian König,
Ruijing Dong, Alex Deucher
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Cheng <benjamin.cheng@amd.com>
commit b193019860d61e92da395eae2011f2f6716b182f upstream.
Check bounds against the end of the BO whenever we access the msg.
Signed-off-by: Benjamin Cheng <benjamin.cheng@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Ruijing Dong <ruijing.dong@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 23 +++++++++++++++++++----
1 file changed, 19 insertions(+), 4 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
@@ -1908,7 +1908,7 @@ static int vcn_v3_0_dec_msg(struct amdgp
{
struct ttm_operation_ctx ctx = { false, false };
struct amdgpu_bo_va_mapping *map;
- uint32_t *msg, num_buffers;
+ uint32_t *msg, num_buffers, len_dw;
struct amdgpu_bo *bo;
uint64_t start, end;
unsigned int i;
@@ -1929,6 +1929,11 @@ static int vcn_v3_0_dec_msg(struct amdgp
return -EINVAL;
}
+ if (end - addr < 16) {
+ DRM_ERROR("VCN messages must be at least 4 DWORDs!\n");
+ return -EINVAL;
+ }
+
bo->flags |= AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED;
amdgpu_bo_placement_from_domain(bo, bo->allowed_domains);
r = ttm_bo_validate(&bo->tbo, &bo->placement, &ctx);
@@ -1945,8 +1950,8 @@ static int vcn_v3_0_dec_msg(struct amdgp
msg = ptr + addr - start;
- /* Check length */
if (msg[1] > end - addr) {
+ DRM_ERROR("VCN message header does not fit in BO!\n");
r = -EINVAL;
goto out;
}
@@ -1954,7 +1959,16 @@ static int vcn_v3_0_dec_msg(struct amdgp
if (msg[3] != RDECODE_MSG_CREATE)
goto out;
+ len_dw = msg[1] / 4;
num_buffers = msg[2];
+
+ /* Verify that all indices fit within the claimed length. Each index is 4 DWORDs */
+ if (num_buffers > len_dw || 6 + num_buffers * 4 > len_dw) {
+ DRM_ERROR("VCN message has too many buffers!\n");
+ r = -EINVAL;
+ goto out;
+ }
+
for (i = 0, msg = &msg[6]; i < num_buffers; ++i, msg += 4) {
uint32_t offset, size, *create;
@@ -1964,14 +1978,15 @@ static int vcn_v3_0_dec_msg(struct amdgp
offset = msg[1];
size = msg[2];
- if (offset + size > end) {
+ if (size < 4 || offset + size > end - addr) {
+ DRM_ERROR("VCN message buffer exceeds BO bounds!\n");
r = -EINVAL;
goto out;
}
create = ptr + addr + offset - start;
- /* H246, HEVC and VP9 can run on any instance */
+ /* H264, HEVC and VP9 can run on any instance */
if (create[0] == 0x7 || create[0] == 0x10 || create[0] == 0x11)
continue;
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 111/188] drm/amd/display: Change dither policy for 10 bpc output back to dithering
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 110/188] drm/amdgpu/vcn3: " Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 112/188] drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() Greg Kroah-Hartman
` (81 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mario Kleiner, Aric Cyr, Anthony Koo,
Rodrigo Siqueira, Krunoslav Kovac, Alex Deucher, Harry Wentland
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Kleiner <mario.kleiner.de@gmail.com>
commit d65bfb1782304b03862c8c725fac608015dffd36 upstream.
Commit d5df648ec830 ("drm/amd/display: Change dither policy for 10bpc to
round") degraded display of 12 bpc color precision output to 10 bpc sinks
by switching 10 bpc output from dithering to "truncate to 10 bpc".
I don't find the argumentation in that commit convincing, but the
consequences highly unfortunate, especially for applications that
require effective > 10 bpc precision output of > 10 bpc framebuffers.
The argument wasn't something strong like "there are hardware design
defects or limitations which require us to work around broken dithering
to 10 bpc", or "there are some special use cases which do require
truncation to 10 bpc", but essentially "at some point in the past we
used truncation in Polaris/Vega times and it looks like it got
inadvertently changed for Navi, so let's do that again". I couldn't find
evidence for that in the git commit logs for this. The commit message also
acknowledges that using dithering "...makes some sense for FP16...
...but not for ARGB2101010 surfaces..."
The problem with this is that it makes fp16 surfaces, and especially
rgba16 fixed point surfaces, less useful. These are now well
supported by Mesa 25.3 and later via OpenGL + EGL, Vulkan/WSI, and by
OSS AMDVLK Vulkan/WSI/display, and also by GNOME 50 mutter under Wayland,
and they used to provide more than 10 bpc effective precision at the
output.
Even for 8 or 10 bpc surfaces, the color pipeline behind the framebuffer,
e.g., gamma tables, CTM, can be used for color correction and will
benefit from an effective > 10 bpc output precision via dithering,
retaining some precision that would get lost on the way through the
pipeline, e.g., due to non-linear gamma functions.
Scientific apps rely on this for > 10 bpc display precision. Truncating
to 10 bpc, instead of dithering the pipeline internal 12 bpc precision
down to 10 bpc, causes a serious loss of precision. This also creates the
undesirable and slightly absurd situation that using a cheap monitor
with only 8 bpc input and display panel will yield roughly 12 bpc
precision via dithering from 12 -> 8 bpc, whereas investment into a
more expensive monitor with 10 bpc input and native 10 bpc display will
only yield 10 bpc, even if a fp16 or rgb16 framebuffer and/or a properly
set up color pipeline (gamma tables, CTM's etc. with more than 10 bpc out
precision) would allow effective 12 bpc precision output.
Therefore this patch proposes reverting that commit and going back to
dithering down to 10 bpc, consistent with the behaviour for 6 bpc or 8 bpc
output.
Successfully tested on AMD Polaris DCE 11.2 and Raven Ridge DCN 1.0 with
a native 10 bpc capable monitor, outputting a RGBA16 unorm framebuffer and
measuring resulting color precision with a photometer. No apparent visual
artifacts or problems were observed, and effective precision was measured
to be 12 bpc again, as expected.
Fixes: d5df648ec830 ("drm/amd/display: Change dither policy for 10bpc to round")
Signed-off-by: Mario Kleiner <mario.kleiner.de@gmail.com>
Tested-by: Mario Kleiner <mario.kleiner.de@gmail.com>
Cc: stable@vger.kernel.org
Cc: Aric Cyr <aric.cyr@amd.com>
Cc: Anthony Koo <anthony.koo@amd.com>
Cc: Rodrigo Siqueira <rodrigo.siqueira@amd.com>
Cc: Krunoslav Kovac <krunoslav.kovac@amd.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Reported-by: Mario Kleiner <mario.kleiner.de@gmail.com>
Signed-off-by: Harry Wentland <harry.wentland@amd.com>
Reviewed-by: Harry Wentland <harry.wentland@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c
@@ -4954,7 +4954,7 @@ void resource_build_bit_depth_reduction_
option = DITHER_OPTION_SPATIAL8;
break;
case COLOR_DEPTH_101010:
- option = DITHER_OPTION_TRUN10;
+ option = DITHER_OPTION_SPATIAL10;
break;
default:
option = DITHER_OPTION_DISABLE;
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 112/188] drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 111/188] drm/amd/display: Change dither policy for 10 bpc output back to dithering Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 113/188] drm/appletbdrm: Use kvzalloc for big allocations Greg Kroah-Hartman
` (80 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thomas Zimmermann, Ashutosh Desai
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ashutosh Desai <ashutoshdesai993@gmail.com>
commit 3d4c2268bd7243c3780fe32bf24ff876da272acf upstream.
drm_gem_fb_init_with_funcs() computes sub-sampled plane dimensions
using plain integer division:
unsigned int width = mode_cmd->width / (i ? info->hsub : 1);
unsigned int height = mode_cmd->height / (i ? info->vsub : 1);
However, the ioctl-level framebuffer_check() in drm_framebuffer.c uses
drm_format_info_plane_width/height() which round up dimensions via
DIV_ROUND_UP(). This inconsistency corrupts the subsequent GEM object
size check for certain pixel format and dimension combinations.
For example, with NV12 (vsub=2) and a 1-pixel-tall framebuffer the
GEM size validation path sees height=0 instead of height=1. The
expression (height - 1) then wraps to UINT_MAX as an unsigned int,
causing min_size to overflow and wrap back to a small value. A tiny
GEM object therefore passes the size guard, yet when the GPU accesses
the chroma plane it will read or write memory beyond the object's
bounds.
Fix by replacing the open-coded divisions with drm_format_info_plane_width()
and drm_format_info_plane_height(), which use DIV_ROUND_UP() and match
the calculation already used in framebuffer_check().
Fixes: 4c3dbb2c312c ("drm: Add GEM backed framebuffer library")
Cc: stable@vger.kernel.org # v4.14+
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Ashutosh Desai <ashutoshdesai993@gmail.com>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patch.msgid.link/20260420013637.457751-1-ashutoshdesai993@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_gem_framebuffer_helper.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/drm_gem_framebuffer_helper.c
+++ b/drivers/gpu/drm/drm_gem_framebuffer_helper.c
@@ -171,8 +171,8 @@ int drm_gem_fb_init_with_funcs(struct dr
}
for (i = 0; i < info->num_planes; i++) {
- unsigned int width = mode_cmd->width / (i ? info->hsub : 1);
- unsigned int height = mode_cmd->height / (i ? info->vsub : 1);
+ unsigned int width = drm_format_info_plane_width(info, mode_cmd->width, i);
+ unsigned int height = drm_format_info_plane_height(info, mode_cmd->height, i);
unsigned int min_size;
objs[i] = drm_gem_object_lookup(file, mode_cmd->handles[i]);
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 113/188] drm/appletbdrm: Use kvzalloc for big allocations
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 112/188] drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 114/188] drm/amdkfd: validate SVM ioctl nattr against buffer size Greg Kroah-Hartman
` (79 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, soopyc, Sasha Finkelstein,
Thomas Zimmermann, Aditya Garg
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sasha Finkelstein <k@chaosmail.tech>
commit aaaa684bab1f6d9ecfc49db328facb1771fd0eb2 upstream.
This driver is attached to a ~2000x80 screen, which is a lot more than
a single page. This causes out of memory errors in some rare cases.
Reported-by: soopyc <cassie@soopy.moe>
Closes: https://github.com/t2linux/fedora/issues/51
Signed-off-by: Sasha Finkelstein <k@chaosmail.tech>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Aditya Garg <gargaditya08@live.com>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: 0670c2f56e45 ("drm/tiny: add driver for Apple Touch Bars in x86 Macs")
Cc: <stable@vger.kernel.org> # v6.15+
Link: https://patch.msgid.link/20260420-x86-tb-vmalloc-v1-1-7757ff657223@chaosmail.tech
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/tiny/appletbdrm.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/tiny/appletbdrm.c
+++ b/drivers/gpu/drm/tiny/appletbdrm.c
@@ -353,7 +353,7 @@ static int appletbdrm_primary_plane_help
frames_size +
sizeof(struct appletbdrm_fb_request_footer), 16);
- appletbdrm_state->request = kzalloc(request_size, GFP_KERNEL);
+ appletbdrm_state->request = kvzalloc(request_size, GFP_KERNEL);
if (!appletbdrm_state->request)
return -ENOMEM;
@@ -543,7 +543,7 @@ static void appletbdrm_primary_plane_des
{
struct appletbdrm_plane_state *appletbdrm_state = to_appletbdrm_plane_state(state);
- kfree(appletbdrm_state->request);
+ kvfree(appletbdrm_state->request);
kfree(appletbdrm_state->response);
__drm_gem_destroy_shadow_plane_state(&appletbdrm_state->base);
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 114/188] drm/amdkfd: validate SVM ioctl nattr against buffer size
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 113/188] drm/appletbdrm: Use kvzalloc for big allocations Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 115/188] drm/udl: Increase GET_URB_TIMEOUT Greg Kroah-Hartman
` (78 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Amir Shetaia, Alysa Liu,
Alex Deucher
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alysa Liu <Alysa.Liu@amd.com>
commit 045e0ff208f0838a246c10204105126611b267a1 upstream.
Validate nattr field against the buffer size, preventing
out-of-bounds buffer access via user-controlled attribute count.
Reviewed-by: Amir Shetaia <Amir.Shetaia@amd.com>
Signed-off-by: Alysa Liu <Alysa.Liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 5eca8bfdfa456c3304ca77523718fe24254c172f)
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 26 ++++++++++++++++++++++++--
drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 3 +++
2 files changed, 27 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -25,6 +25,7 @@
#include <linux/err.h>
#include <linux/fs.h>
#include <linux/file.h>
+#include <linux/overflow.h>
#include <linux/sched.h>
#include <linux/slab.h>
#include <linux/uaccess.h>
@@ -1676,6 +1677,16 @@ static int kfd_ioctl_smi_events(struct f
return kfd_smi_event_open(pdd->dev, &args->anon_fd);
}
+static int kfd_ioctl_svm_validate(void *kdata, unsigned int usize)
+{
+ struct kfd_ioctl_svm_args *args = kdata;
+ size_t expected = struct_size(args, attrs, args->nattr);
+
+ if (expected == SIZE_MAX || usize < expected)
+ return -EINVAL;
+ return 0;
+}
+
#if IS_ENABLED(CONFIG_HSA_AMD_SVM)
static int kfd_ioctl_set_xnack_mode(struct file *filep,
@@ -3122,7 +3133,11 @@ out:
#define AMDKFD_IOCTL_DEF(ioctl, _func, _flags) \
[_IOC_NR(ioctl)] = {.cmd = ioctl, .func = _func, .flags = _flags, \
- .cmd_drv = 0, .name = #ioctl}
+ .validate = NULL, .cmd_drv = 0, .name = #ioctl}
+
+#define AMDKFD_IOCTL_DEF_V(ioctl, _func, _validate, _flags) \
+ [_IOC_NR(ioctl)] = {.cmd = ioctl, .func = _func, .flags = _flags, \
+ .validate = _validate, .cmd_drv = 0, .name = #ioctl}
/** Ioctl table */
static const struct amdkfd_ioctl_desc amdkfd_ioctls[] = {
@@ -3219,7 +3234,8 @@ static const struct amdkfd_ioctl_desc am
AMDKFD_IOCTL_DEF(AMDKFD_IOC_SMI_EVENTS,
kfd_ioctl_smi_events, 0),
- AMDKFD_IOCTL_DEF(AMDKFD_IOC_SVM, kfd_ioctl_svm, 0),
+ AMDKFD_IOCTL_DEF_V(AMDKFD_IOC_SVM, kfd_ioctl_svm,
+ kfd_ioctl_svm_validate, 0),
AMDKFD_IOCTL_DEF(AMDKFD_IOC_SET_XNACK_MODE,
kfd_ioctl_set_xnack_mode, 0),
@@ -3341,6 +3357,12 @@ static long kfd_ioctl(struct file *filep
memset(kdata, 0, usize);
}
+ if (ioctl->validate) {
+ retcode = ioctl->validate(kdata, usize);
+ if (retcode)
+ goto err_i1;
+ }
+
retcode = func(filep, process, kdata);
if (cmd & IOC_OUT)
--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
@@ -1036,10 +1036,13 @@ extern struct srcu_struct kfd_processes_
typedef int amdkfd_ioctl_t(struct file *filep, struct kfd_process *p,
void *data);
+typedef int amdkfd_ioctl_validate_t(void *kdata, unsigned int usize);
+
struct amdkfd_ioctl_desc {
unsigned int cmd;
int flags;
amdkfd_ioctl_t *func;
+ amdkfd_ioctl_validate_t *validate;
unsigned int cmd_drv;
const char *name;
};
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 115/188] drm/udl: Increase GET_URB_TIMEOUT
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 114/188] drm/amdkfd: validate SVM ioctl nattr against buffer size Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 116/188] drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure Greg Kroah-Hartman
` (77 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Shixiong Ou, Thomas Zimmermann
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shixiong Ou <oushixiong@kylinos.cn>
commit ac2c996675755c725a0065dbe3e2ebffded9080b upstream.
[WHY]
A situation has occurred where udl_handle_damage() executed successfully
and the kernel log appears normal, but the display fails to show any output.
This is because the call to udl_get_urb() in udl_crtc_helper_atomic_enable()
failed without generating any error message.
[HOW]
1. Increase timeout of getting urb.
2. Add error messages when calling udl_get_urb() failed in
udl_crtc_helper_atomic_enable().
Signed-off-by: Shixiong Ou <oushixiong@kylinos.cn>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: 5320918b9a87 ("drm/udl: initial UDL driver (v4)")
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Cc: <stable@vger.kernel.org> # v3.4+
Link: https://patch.msgid.link/20260424124427.657-1-oushixiong1025@163.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/udl/udl_main.c | 3 +--
drivers/gpu/drm/udl/udl_modeset.c | 5 ++++-
2 files changed, 5 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/udl/udl_main.c
+++ b/drivers/gpu/drm/udl/udl_main.c
@@ -285,13 +285,12 @@ static struct urb *udl_get_urb_locked(st
return unode->urb;
}
-#define GET_URB_TIMEOUT HZ
struct urb *udl_get_urb(struct udl_device *udl)
{
struct urb *urb;
spin_lock_irq(&udl->urbs.lock);
- urb = udl_get_urb_locked(udl, GET_URB_TIMEOUT);
+ urb = udl_get_urb_locked(udl, HZ * 2);
spin_unlock_irq(&udl->urbs.lock);
return urb;
}
--- a/drivers/gpu/drm/udl/udl_modeset.c
+++ b/drivers/gpu/drm/udl/udl_modeset.c
@@ -21,6 +21,7 @@
#include <drm/drm_gem_framebuffer_helper.h>
#include <drm/drm_gem_shmem_helper.h>
#include <drm/drm_modeset_helper_vtables.h>
+#include <drm/drm_print.h>
#include <drm/drm_probe_helper.h>
#include <drm/drm_vblank.h>
@@ -342,8 +343,10 @@ static void udl_crtc_helper_atomic_enabl
return;
urb = udl_get_urb(udl);
- if (!urb)
+ if (!urb) {
+ drm_err_ratelimited(dev, "get urb failed when enabling crtc\n");
goto out;
+ }
buf = (char *)urb->transfer_buffer;
buf = udl_vidreg_lock(buf);
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 116/188] drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 115/188] drm/udl: Increase GET_URB_TIMEOUT Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 117/188] drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked() Greg Kroah-Hartman
` (76 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthew Brost, Shuicheng Lin,
Rodrigo Vivi
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuicheng Lin <shuicheng.lin@intel.com>
commit 93a528f67ce5095bcab46a69839eca97f43dd352 upstream.
When drm_gpuvm_resv_object_alloc() fails, the pre-allocated storage bo
is not freed. Add xe_bo_free(storage) before returning the error.
xe_dma_buf_init_obj() calls xe_bo_init_locked(), which frees the bo on
error. Therefore, xe_dma_buf_init_obj() must also free the bo on its own
error paths. Otherwise, since xe_gem_prime_import() cannot distinguish
whether the failure originated from xe_dma_buf_init_obj() or from
xe_bo_init_locked(), it cannot safely decide whether the bo should be
freed.
Add comments documenting the ownership semantics: on success, ownership
of storage is transferred to the returned drm_gem_object; on failure,
storage is freed before returning.
v2: Add comments to explain the free logic.
Fixes: eb289a5f6cc6 ("drm/xe: Convert xe_dma_buf.c for exhaustive eviction")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4.6
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Link: https://patch.msgid.link/20260408175255.3402838-4-shuicheng.lin@intel.com
Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
(cherry picked from commit 78a6c5f899f22338bbf48b44fb8950409c5a69b9)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/xe/xe_dma_buf.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/xe/xe_dma_buf.c
+++ b/drivers/gpu/drm/xe/xe_dma_buf.c
@@ -227,6 +227,13 @@ struct dma_buf *xe_gem_prime_export(stru
return buf;
}
+/*
+ * Takes ownership of @storage: on success it is transferred to the returned
+ * drm_gem_object; on failure it is freed before returning the error.
+ * This matches the contract of xe_bo_init_locked() which frees @storage on
+ * its error paths, so callers need not (and must not) free @storage after
+ * this call.
+ */
static struct drm_gem_object *
xe_dma_buf_init_obj(struct drm_device *dev, struct xe_bo *storage,
struct dma_buf *dma_buf)
@@ -240,8 +247,10 @@ xe_dma_buf_init_obj(struct drm_device *d
int ret = 0;
dummy_obj = drm_gpuvm_resv_object_alloc(&xe->drm);
- if (!dummy_obj)
+ if (!dummy_obj) {
+ xe_bo_free(storage);
return ERR_PTR(-ENOMEM);
+ }
dummy_obj->resv = resv;
xe_validation_guard(&ctx, &xe->val, &exec, (struct xe_val_flags) {}, ret) {
@@ -250,6 +259,7 @@ xe_dma_buf_init_obj(struct drm_device *d
if (ret)
break;
+ /* xe_bo_init_locked() frees storage on error */
bo = xe_bo_init_locked(xe, storage, NULL, resv, NULL, dma_buf->size,
0, /* Will require 1way or 2way for vm_bind */
ttm_bo_type_sg, XE_BO_FLAG_SYSTEM, &exec);
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 117/188] drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked()
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 116/188] drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 118/188] drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() Greg Kroah-Hartman
` (75 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthew Brost, Shuicheng Lin,
Rodrigo Vivi
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuicheng Lin <shuicheng.lin@intel.com>
commit 1d0adf2fd94fb0c0037c643fadd8f2cf3cffc009 upstream.
When XE_BO_FLAG_GGTT_ALL is set without XE_BO_FLAG_GGTT, the function
returns an error without freeing a caller-provided bo, violating the
documented contract that bo is freed on failure.
Add xe_bo_free(bo) before returning the error.
Fixes: 5a3b0df25d6a ("drm/xe: Allow bo mapping on multiple ggtts")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4.6
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Link: https://patch.msgid.link/20260408175255.3402838-3-shuicheng.lin@intel.com
Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
(cherry picked from commit 3fbd6cf43cac7b60757f3ce3d95195d3843a902c)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/xe/xe_bo.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/xe/xe_bo.c
+++ b/drivers/gpu/drm/xe/xe_bo.c
@@ -2112,8 +2112,10 @@ struct xe_bo *xe_bo_init_locked(struct x
}
/* XE_BO_FLAG_GGTTx requires XE_BO_FLAG_GGTT also be set */
- if ((flags & XE_BO_FLAG_GGTT_ALL) && !(flags & XE_BO_FLAG_GGTT))
+ if ((flags & XE_BO_FLAG_GGTT_ALL) && !(flags & XE_BO_FLAG_GGTT)) {
+ xe_bo_free(bo);
return ERR_PTR(-EINVAL);
+ }
if (flags & (XE_BO_FLAG_VRAM_MASK | XE_BO_FLAG_STOLEN) &&
!(flags & XE_BO_FLAG_IGNORE_MIN_PAGE_SIZE) &&
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 118/188] drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import()
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 117/188] drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked() Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 119/188] drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked() Greg Kroah-Hartman
` (74 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mattheq Brost, Shuicheng Lin,
Rodrigo Vivi
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuicheng Lin <shuicheng.lin@intel.com>
commit 111ab678471bf1f90d078d5513bb086b70596c3c upstream.
When xe_dma_buf_init_obj() fails, the attachment from
dma_buf_dynamic_attach() is not detached. Add dma_buf_detach() before
returning the error. Note: we cannot use goto out_err here because
xe_dma_buf_init_obj() already frees bo on failure, and out_err would
double-free it.
Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4.6
Reviewed-by: Mattheq Brost <matthew.brost@intel.com>
Link: https://patch.msgid.link/20260408175255.3402838-5-shuicheng.lin@intel.com
Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
(cherry picked from commit a828eb185aac41800df8eae4b60501ccc0dbbe51)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/xe/xe_dma_buf.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
--- a/drivers/gpu/drm/xe/xe_dma_buf.c
+++ b/drivers/gpu/drm/xe/xe_dma_buf.c
@@ -347,12 +347,15 @@ struct drm_gem_object *xe_gem_prime_impo
goto out_err;
}
- /* Errors here will take care of freeing the bo. */
+ /*
+ * xe_dma_buf_init_obj() takes ownership of bo on both success
+ * and failure, so we must not touch bo after this call.
+ */
obj = xe_dma_buf_init_obj(dev, bo, dma_buf);
- if (IS_ERR(obj))
+ if (IS_ERR(obj)) {
+ dma_buf_detach(dma_buf, attach);
return obj;
-
-
+ }
get_dma_buf(dma_buf);
obj->import_attach = attach;
return obj;
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 119/188] drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked()
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 118/188] drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 120/188] drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise Greg Kroah-Hartman
` (73 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthew Brost, Shuicheng Lin,
Rodrigo Vivi
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuicheng Lin <shuicheng.lin@intel.com>
commit 09a8f3c1c11977a6e10c167f26dd298790b31c32 upstream.
When type is ttm_bo_type_device and aligned_size != size, the function
returns an error without freeing a caller-provided bo, violating the
documented contract that bo is freed on failure.
Add xe_bo_free(bo) before returning the error.
Fixes: 4e03b584143e ("drm/xe/uapi: Reject bo creation of unaligned size")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4.6
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Link: https://patch.msgid.link/20260408175255.3402838-2-shuicheng.lin@intel.com
Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>
(cherry picked from commit 601c2aa087b6f21014300a3f107a08ee4dde7bdf)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/xe/xe_bo.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/xe/xe_bo.c
+++ b/drivers/gpu/drm/xe/xe_bo.c
@@ -2134,8 +2134,10 @@ struct xe_bo *xe_bo_init_locked(struct x
alignment = SZ_4K >> PAGE_SHIFT;
}
- if (type == ttm_bo_type_device && aligned_size != size)
+ if (type == ttm_bo_type_device && aligned_size != size) {
+ xe_bo_free(bo);
return ERR_PTR(-EINVAL);
+ }
if (!bo) {
bo = xe_bo_alloc();
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 120/188] drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 119/188] drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked() Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 121/188] drm: Set old handle to NULL before prime swap in change_handle Greg Kroah-Hartman
` (72 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shuicheng Lin, Mathew Alwin,
Michal Mrozek, Matthew Brost, Matthew Auld, Jia Yao,
José Roberto de Souza, Rodrigo Vivi
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jia Yao <jia.yao@intel.com>
commit 4e5591c2fc1b30f4ea5e2eab4c3a695acc404e39 upstream.
Add validation in xe_vm_madvise_ioctl() to reject PAT indices with
XE_COH_NONE coherency mode when applied to CPU cached memory.
Using coh_none with CPU cached buffers is a security issue. When the
kernel clears pages before reallocation, the clear operation stays in
CPU cache (dirty). GPU with coh_none can bypass CPU caches and read
stale sensitive data directly from DRAM, potentially leaking data from
previously freed pages of other processes.
This aligns with the existing validation in vm_bind path
(xe_vm_bind_ioctl_validate_bo).
v2(Matthew brost)
- Add fixes
- Move one debug print to better place
v3(Matthew Auld)
- Should be drm/xe/uapi
- More Cc
v4(Shuicheng Lin)
- Fix kmem leak issues by the way
v5
- Remove kmem leak because it has been merged by another patch
v6
- Remove the fix which is not related to current fix
v7
- No change
v8
- Rebase
v9
- Limit the restrictions to iGPU
v10
- No change
Fixes: ada7486c5668 ("drm/xe: Implement madvise ioctl for xe")
Cc: <stable@vger.kernel.org> # v6.18+
Cc: Shuicheng Lin <shuicheng.lin@intel.com>
Cc: Mathew Alwin <alwin.mathew@intel.com>
Cc: Michal Mrozek <michal.mrozek@intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Matthew Auld <matthew.auld@intel.com>
Signed-off-by: Jia Yao <jia.yao@intel.com>
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
Acked-by: Michal Mrozek <michal.mrozek@intel.com>
Acked-by: José Roberto de Souza <jose.souza@intel.com>
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Link: https://patch.msgid.link/20260417055917.2027459-2-jia.yao@intel.com
(cherry picked from commit 016ccdb674b8c899940b3944952c96a6a490d10a)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/xe/xe_vm_madvise.c | 47 +++++++++++++++++++++++++++++++++++++
1 file changed, 47 insertions(+)
--- a/drivers/gpu/drm/xe/xe_vm_madvise.c
+++ b/drivers/gpu/drm/xe/xe_vm_madvise.c
@@ -299,6 +299,45 @@ static bool madvise_args_are_sane(struct
return true;
}
+static bool check_pat_args_are_sane(struct xe_device *xe,
+ struct xe_vmas_in_madvise_range *madvise_range,
+ u16 pat_index)
+{
+ u16 coh_mode = xe_pat_index_get_coh_mode(xe, pat_index);
+ int i;
+
+ /*
+ * Using coh_none with CPU cached buffers is not allowed on iGPU.
+ * On iGPU the GPU shares the LLC with the CPU, so with coh_none
+ * the GPU bypasses CPU caches and reads directly from DRAM,
+ * potentially seeing stale sensitive data from previously freed
+ * pages. On dGPU this restriction does not apply, because the
+ * platform does not provide a non-coherent system memory access
+ * path that would violate the DMA coherency contract.
+ */
+ if (coh_mode != XE_COH_NONE || IS_DGFX(xe))
+ return true;
+
+ for (i = 0; i < madvise_range->num_vmas; i++) {
+ struct xe_vma *vma = madvise_range->vmas[i];
+ struct xe_bo *bo = xe_vma_bo(vma);
+
+ if (bo) {
+ /* BO with WB caching + COH_NONE is not allowed */
+ if (XE_IOCTL_DBG(xe, bo->cpu_caching == DRM_XE_GEM_CPU_CACHING_WB))
+ return false;
+ /* Imported dma-buf without caching info, assume cached */
+ if (XE_IOCTL_DBG(xe, !bo->cpu_caching))
+ return false;
+ } else if (XE_IOCTL_DBG(xe, xe_vma_is_cpu_addr_mirror(vma) ||
+ xe_vma_is_userptr(vma)))
+ /* System memory (userptr/SVM) is always CPU cached */
+ return false;
+ }
+
+ return true;
+}
+
static bool check_bo_args_are_sane(struct xe_vm *vm, struct xe_vma **vmas,
int num_vmas, u32 atomic_val)
{
@@ -384,6 +423,14 @@ int xe_vm_madvise_ioctl(struct drm_devic
if (err || !madvise_range.num_vmas)
goto unlock_vm;
+ if (args->type == DRM_XE_MEM_RANGE_ATTR_PAT) {
+ if (!check_pat_args_are_sane(xe, &madvise_range,
+ args->pat_index.val)) {
+ err = -EINVAL;
+ goto free_vmas;
+ }
+ }
+
if (madvise_range.has_bo_vmas) {
if (args->type == DRM_XE_MEM_RANGE_ATTR_ATOMIC) {
if (!check_bo_args_are_sane(vm, madvise_range.vmas,
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 121/188] drm: Set old handle to NULL before prime swap in change_handle
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 120/188] drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 122/188] drm/radeon: add missing revision check for CI Greg Kroah-Hartman
` (71 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Francis, Puttimet Thammasaeng,
Vitaly Prosyak, Simona Vetter, Christian Koenig, Dave Airlie,
Dave Airlie
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francis, David <David.Francis@amd.com>
commit 5e28b7b94408897e41c63477aabc9e1db439bc8c upstream.
There was a potential race condition in change_handle. The ioctl
briefly had a single object with two idr entries; a concurrent
gem_close could delete the object and remove one of the handles
while leaving the other one dangling, which could subsequently
be dereferenced for a use-after-free.
To fix this, do the same dance that gem_close itself does.
(f6cd7daecff5 drm: Release driver references to handle before making it available again)
First idr_replace the old handle to NULL. Later, if the prime
operations are successful, actually close it.
create_tail required a similar dance to avoid a similar problem.
(bd46cece51a3 drm/gem: Fix race in drm_gem_handle_create_tail())
It idr_allocs the new handle with NULL, then swaps in the correct
object later to avoid races. We don't need to do that here, since
the only operations that could race are drm_prime, and
change_handle holds the prime lock for the entire duration.
v2: cleanups of error paths
Signed-off-by: David Francis <David.Francis@amd.com>
Co-authored-by: Dave Airlie <airlied@gmail.com>
Reported-by: Puttimet Thammasaeng <pwn8official@gmail.com>
Tested-by: Vitaly Prosyak <Vitaly.Prosyak@amd.com>
Cc: Simona Vetter <simona@ffwll.ch>
Cc: stable@vger.kernel.org
Cc: Christian Koenig <Christian.Koenig@amd.com>
Fixes: 53096728b8910 ("drm: Add DRM prime interface to reassign GEM handle")
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_gem.c | 25 ++++++++++++++++++++++++-
1 file changed, 24 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -969,7 +969,7 @@ int drm_gem_change_handle_ioctl(struct d
struct drm_file *file_priv)
{
struct drm_gem_change_handle *args = data;
- struct drm_gem_object *obj;
+ struct drm_gem_object *obj, *idrobj;
int handle, ret;
if (!drm_core_check_feature(dev, DRIVER_GEM))
@@ -992,8 +992,29 @@ int drm_gem_change_handle_ioctl(struct d
mutex_lock(&file_priv->prime.lock);
spin_lock(&file_priv->table_lock);
+
+ /* When create_tail allocs an obj idr, it needs to first alloc as NULL,
+ * then later replace with the correct object. This is not necessary
+ * here, because the only operations that could race are drm_prime
+ * bookkeeping, and we hold the prime lock.
+ */
ret = idr_alloc(&file_priv->object_idr, obj, handle, handle + 1,
GFP_NOWAIT);
+
+ if (ret < 0) {
+ spin_unlock(&file_priv->table_lock);
+ goto out_unlock;
+ }
+
+ idrobj = idr_replace(&file_priv->object_idr, NULL, handle);
+ if (idrobj != obj) {
+ idr_replace(&file_priv->object_idr, idrobj, handle);
+ idr_remove(&file_priv->object_idr, args->new_handle);
+ spin_unlock(&file_priv->table_lock);
+ ret = -ENOENT;
+ goto out_unlock;
+ }
+
spin_unlock(&file_priv->table_lock);
if (ret < 0)
@@ -1005,6 +1026,8 @@ int drm_gem_change_handle_ioctl(struct d
if (ret < 0) {
spin_lock(&file_priv->table_lock);
idr_remove(&file_priv->object_idr, handle);
+ idrobj = idr_replace(&file_priv->object_idr, obj, handle);
+ WARN_ON(idrobj != NULL);
spin_unlock(&file_priv->table_lock);
goto out_unlock;
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 122/188] drm/radeon: add missing revision check for CI
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 121/188] drm: Set old handle to NULL before prime swap in change_handle Greg Kroah-Hartman
@ 2026-05-15 15:48 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 123/188] drm/amdgpu: zero-initialize GART table on allocation Greg Kroah-Hartman
` (70 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:48 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Timur Kristóf, Kent Russell,
Alex Deucher
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 17223816498f7b117d138d18eb0eba63604dc74e upstream.
The memory level workarounds only apply to revision 0 SKUs.
Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/1816
Fixes: 127e056e2a82 ("drm/radeon: fix mclk vddc configuration for cards for hawaii")
Fixes: 21b8a369046f ("drm/radeon: fix dram timing for certain hawaii boards")
Fixes: 90b2fee35cb9 ("drm/radeon: fix dpm mc init for certain hawaii boards")
Reviewed-by: Timur Kristóf <timur.kristof@gmail.com>
Reviewed-by: Kent Russell <kent.russell@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 4d8dcc14311515077062b5740f39f427075de5c9)
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/radeon/ci_dpm.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/radeon/ci_dpm.c
+++ b/drivers/gpu/drm/radeon/ci_dpm.c
@@ -2461,7 +2461,8 @@ static void ci_register_patching_mc_arb(
if (patch &&
((rdev->pdev->device == 0x67B0) ||
- (rdev->pdev->device == 0x67B1))) {
+ (rdev->pdev->device == 0x67B1)) &&
+ (rdev->pdev->revision == 0)) {
if ((memory_clock > 100000) && (memory_clock <= 125000)) {
tmp2 = (((0x31 * engine_clock) / 125000) - 1) & 0xff;
*dram_timimg2 &= ~0x00ff0000;
@@ -3304,7 +3305,8 @@ static int ci_populate_all_memory_levels
pi->smc_state_table.MemoryLevel[0].EnabledForActivity = 1;
if ((dpm_table->mclk_table.count >= 2) &&
- ((rdev->pdev->device == 0x67B0) || (rdev->pdev->device == 0x67B1))) {
+ ((rdev->pdev->device == 0x67B0) || (rdev->pdev->device == 0x67B1)) &&
+ (rdev->pdev->revision == 0)) {
pi->smc_state_table.MemoryLevel[1].MinVddc =
pi->smc_state_table.MemoryLevel[0].MinVddc;
pi->smc_state_table.MemoryLevel[1].MinVddcPhases =
@@ -4493,7 +4495,8 @@ static int ci_register_patching_mc_seq(s
if (patch &&
((rdev->pdev->device == 0x67B0) ||
- (rdev->pdev->device == 0x67B1))) {
+ (rdev->pdev->device == 0x67B1)) &&
+ (rdev->pdev->revision == 0)) {
for (i = 0; i < table->last; i++) {
if (table->last >= SMU7_DISCRETE_MC_REGISTER_ARRAY_SIZE)
return -EINVAL;
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 123/188] drm/amdgpu: zero-initialize GART table on allocation
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2026-05-15 15:48 ` [PATCH 6.18 122/188] drm/radeon: add missing revision check for CI Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 124/188] drm/exynos: remove bridge when component_add fails Greg Kroah-Hartman
` (69 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Felix Kuehling, Philip Yang,
Christian König, Alex Deucher
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philip Yang <Philip.Yang@amd.com>
commit e6c2e6c2e1fa066968a16aca1cb66cd1bdde7741 upstream.
GART TLB is flushed after unmapping but not after mapping. Since
amdgpu_bo_create_kernel() does not zero-initialize the buffer, when a
single PTE is written the TLB may speculatively load other uninitialized
entries from the same cacheline. Those garbage entries can appear valid,
and a subsequent write to another PTE in the same cacheline may cause the
GPU to use a stale garbage PTE from the TLB.
Fix this by calling memset_io() to zero-initialize the GART table with
gart_pte_flags immediately after allocation.
Using AMDGPU_GEM_CREATE_VRAM_CLEARED, SDMA-based clear will not work
since SDMA needs GART to be initialized to work.
Suggested-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Philip Yang <Philip.Yang@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit d9af8263b82b6eaa60c5718e0c6631c5037e4b24)
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c
@@ -262,12 +262,19 @@ void amdgpu_gart_table_ram_free(struct a
*/
int amdgpu_gart_table_vram_alloc(struct amdgpu_device *adev)
{
+ int r;
+
if (adev->gart.bo != NULL)
return 0;
- return amdgpu_bo_create_kernel(adev, adev->gart.table_size, PAGE_SIZE,
- AMDGPU_GEM_DOMAIN_VRAM, &adev->gart.bo,
- NULL, (void *)&adev->gart.ptr);
+ r = amdgpu_bo_create_kernel(adev, adev->gart.table_size, PAGE_SIZE,
+ AMDGPU_GEM_DOMAIN_VRAM, &adev->gart.bo,
+ NULL, (void *)&adev->gart.ptr);
+ if (r)
+ return r;
+
+ memset_io(adev->gart.ptr, adev->gart.gart_pte_flags, adev->gart.table_size);
+ return 0;
}
/**
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 124/188] drm/exynos: remove bridge when component_add fails
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 123/188] drm/amdgpu: zero-initialize GART table on allocation Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 125/188] drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds Greg Kroah-Hartman
` (68 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Osama Abdelkader,
Raphaël Gallais-Pou, Luca Ceresoli
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Osama Abdelkader <osama.abdelkader@gmail.com>
commit 26f6654a9a60eb4d241f42a0ec85412e8821480b upstream.
Use devm_drm_bridge_add() so the bridge is released if probe fails after
registration, and drop the manual drm_bridge_remove() in remove().
Check the return value of devm_drm_bridge_add().
Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
Fixes: 576d72fbfb45 ("drm/exynos: mic: add a bridge at probe")
Cc: stable@vger.kernel.org
Reviewed-by: Raphaël Gallais-Pou <rgallaispou@gmail.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Link: https://patch.msgid.link/20260423200622.325076-2-osama.abdelkader@gmail.com
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/exynos/exynos_drm_mic.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
--- a/drivers/gpu/drm/exynos/exynos_drm_mic.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_mic.c
@@ -423,7 +423,9 @@ static int exynos_mic_probe(struct platf
mic->bridge.of_node = dev->of_node;
- drm_bridge_add(&mic->bridge);
+ ret = devm_drm_bridge_add(dev, &mic->bridge);
+ if (ret)
+ goto err;
pm_runtime_enable(dev);
@@ -443,12 +445,8 @@ err:
static void exynos_mic_remove(struct platform_device *pdev)
{
- struct exynos_mic *mic = platform_get_drvdata(pdev);
-
component_del(&pdev->dev, &exynos_mic_component_ops);
pm_runtime_disable(&pdev->dev);
-
- drm_bridge_remove(&mic->bridge);
}
static const struct of_device_id exynos_mic_of_match[] = {
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 125/188] drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 124/188] drm/exynos: remove bridge when component_add fails Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 126/188] drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ Greg Kroah-Hartman
` (67 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Icenowy Zheng, Neil Armstrong,
Douglas Anderson
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Icenowy Zheng <zhengxingda@iscas.ac.cn>
commit 2d4e80271f784aa0c7b17676e9762c7e8156be1c upstream.
When preparing the panel, it seems that it always expects commands to be
transferred in LP mode. However, the disable function removes the
MIPI_DSI_MODE_LPM flag, and no other function re-adds it.
As the unprepare function contains no DSI commands, re-adding the flag
just after disabling the panel should be safe. Add the code re-adding
the flag after the two commands for disabling the panel are sent.
This fixes screen unblanking (after blanking once) on
mt8188-geralt-ciri-sku1 device.
Cc: stable@vger.kernel.org # 6.11+
Fixes: 0ef94554dc40 ("drm/panel: himax-hx83102: Break out as separate driver")
Signed-off-by: Icenowy Zheng <zhengxingda@iscas.ac.cn>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20260425165751.1716569-1-zhengxingda@iscas.ac.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/panel/panel-himax-hx83102.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/gpu/drm/panel/panel-himax-hx83102.c
+++ b/drivers/gpu/drm/panel/panel-himax-hx83102.c
@@ -850,6 +850,8 @@ static int hx83102_disable(struct drm_pa
mipi_dsi_dcs_set_display_off_multi(&dsi_ctx);
mipi_dsi_dcs_enter_sleep_mode_multi(&dsi_ctx);
+ dsi->mode_flags |= MIPI_DSI_MODE_LPM;
+
mipi_dsi_msleep(&dsi_ctx, 150);
return dsi_ctx.accum_err;
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 126/188] drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 125/188] drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 127/188] drm/bridge: tda998x: Use __be32 for audio port OF property pointer Greg Kroah-Hartman
` (66 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian König, John B. Moore,
Alex Deucher
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: John B. Moore <jbmoore61@gmail.com>
commit 7bbfb2559bcec39d1a4e1182d931a2046112c352 upstream.
Remove the BUG_ON(flags & AMDGPU_FENCE_FLAG_64BIT) assertion from
gfx_v9_0_ring_emit_fence_kiq(). The KIQ hardware supports 64-bit
fence writes; the 32-bit writeback address constraint is an
upper-layer convention, not a hardware limitation. The check serves
no purpose and should not be present.
Found by code inspection while investigating related BUG_ON
assertions in the GFX and compute ring emission paths.
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: John B. Moore <jbmoore61@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 1b1101a46a426bb4328116bb5273c326a2780389)
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 ---
1 file changed, 3 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c
@@ -5640,9 +5640,6 @@ static void gfx_v9_0_ring_emit_fence_kiq
{
struct amdgpu_device *adev = ring->adev;
- /* we only allocate 32bit for each seq wb address */
- BUG_ON(flags & AMDGPU_FENCE_FLAG_64BIT);
-
/* write fence seq to the "addr" */
amdgpu_ring_write(ring, PACKET3(PACKET3_WRITE_DATA, 3));
amdgpu_ring_write(ring, (WRITE_DATA_ENGINE_SEL(0) |
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 127/188] drm/bridge: tda998x: Use __be32 for audio port OF property pointer
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 126/188] drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 128/188] drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds Greg Kroah-Hartman
` (65 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kory Maincent (TI),
Russell King (Oracle), Luca Ceresoli
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kory Maincent (TI) <kory.maincent@bootlin.com>
commit 2a46a9356ba7b1bdd741c8b41e5374edcd960557 upstream.
of_get_property() returns a pointer to big-endian (__be32) data, but
port_data in tda998x_get_audio_ports() was declared as const u32 *,
causing a sparse endianness type mismatch warning. Fix the declaration
to use const __be32 *.
Fixes: 7e567624dc5a4 ("drm/i2c: tda998x: Register ASoC hdmi-codec and add audio DT binding")
Cc: stable@vger.kernel.org
Signed-off-by: Kory Maincent (TI) <kory.maincent@bootlin.com>
Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Link: https://patch.msgid.link/20260428090457.121894-1-kory.maincent@bootlin.com
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/bridge/tda998x_drv.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/bridge/tda998x_drv.c
+++ b/drivers/gpu/drm/bridge/tda998x_drv.c
@@ -1697,7 +1697,7 @@ static const struct drm_bridge_funcs tda
static int tda998x_get_audio_ports(struct tda998x_priv *priv,
struct device_node *np)
{
- const u32 *port_data;
+ const __be32 *port_data;
u32 size;
int i;
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 128/188] drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 127/188] drm/bridge: tda998x: Use __be32 for audio port OF property pointer Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 129/188] drm/amdkfd: Make all TLB-flushes heavy-weight Greg Kroah-Hartman
` (64 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Icenowy Zheng, Neil Armstrong,
Douglas Anderson
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Icenowy Zheng <zhengxingda@iscas.ac.cn>
commit 570cf799e87ae805eacfab3b4ba66676b5fccdb6 upstream.
When preparing the panel, it seems that it always expects commands to be
transferred in LP mode. However, the disable function removes the
MIPI_DSI_MODE_LPM flag, and no other function re-adds it.
As the unprepare function contains no DSI commands, re-adding the flag
just after disabling the panel should be safe. Add the code re-adding
the flag after the two commands for disabling the panel are sent.
This fixes error messages shown in kernel log when unblanking on
mt8183-kukui-kodama-sku32 device.
Cc: stable@vger.kernel.org
Fixes: a869b9db7adf ("drm/panel: support for boe tv101wum-nl6 wuxga dsi video mode panel")
Signed-off-by: Icenowy Zheng <zhengxingda@iscas.ac.cn>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patch.msgid.link/20260503091708.1079962-1-zhengxingda@iscas.ac.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c
+++ b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c
@@ -1324,6 +1324,8 @@ static int boe_panel_disable(struct drm_
mipi_dsi_dcs_set_display_off_multi(&ctx);
mipi_dsi_dcs_enter_sleep_mode_multi(&ctx);
+ boe->dsi->mode_flags |= MIPI_DSI_MODE_LPM;
+
mipi_dsi_msleep(&ctx, 150);
return ctx.accum_err;
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 129/188] drm/amdkfd: Make all TLB-flushes heavy-weight
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 128/188] drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 130/188] drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission Greg Kroah-Hartman
` (63 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Felix Kuehling, Philip Yang,
Alex Deucher
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Kuehling <felix.kuehling@amd.com>
commit 9b4e3495d1bd2469bf94b74930c153c2d534ddb7 upstream.
With only one sequence number we cannot track the need for legacy vs
heavy-weight flushes reliably. Always use heavy-weight.
Signed-off-by: Felix Kuehling <felix.kuehling@amd.com>
Reviewed-by: Philip Yang <philip.yang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit c1a3ff1d327820cd9a52bc1056b98681fc088949)
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 4 ++--
drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 6 +++---
drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 6 +++---
drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 4 ++--
4 files changed, 10 insertions(+), 10 deletions(-)
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -1341,7 +1341,7 @@ static int kfd_ioctl_map_memory_to_gpu(s
peer_pdd = kfd_process_device_data_by_id(p, devices_arr[i]);
if (WARN_ON_ONCE(!peer_pdd))
continue;
- kfd_flush_tlb(peer_pdd, TLB_FLUSH_LEGACY);
+ kfd_flush_tlb(peer_pdd);
}
kfree(devices_arr);
@@ -1436,7 +1436,7 @@ static int kfd_ioctl_unmap_memory_from_g
if (WARN_ON_ONCE(!peer_pdd))
continue;
if (flush_tlb)
- kfd_flush_tlb(peer_pdd, TLB_FLUSH_HEAVYWEIGHT);
+ kfd_flush_tlb(peer_pdd);
/* Remove dma mapping after tlb flush to avoid IO_PAGE_FAULT */
err = amdgpu_amdkfd_gpuvm_dmaunmap_mem(mem, peer_pdd->drm_priv);
--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
@@ -569,7 +569,7 @@ static int allocate_vmid(struct device_q
qpd->vmid,
qpd->page_table_base);
/* invalidate the VM context after pasid and vmid mapping is set up */
- kfd_flush_tlb(qpd_to_pdd(qpd), TLB_FLUSH_LEGACY);
+ kfd_flush_tlb(qpd_to_pdd(qpd));
if (dqm->dev->kfd2kgd->set_scratch_backing_va)
dqm->dev->kfd2kgd->set_scratch_backing_va(dqm->dev->adev,
@@ -607,7 +607,7 @@ static void deallocate_vmid(struct devic
if (flush_texture_cache_nocpsch(q->device, qpd))
dev_err(dev, "Failed to flush TC\n");
- kfd_flush_tlb(qpd_to_pdd(qpd), TLB_FLUSH_LEGACY);
+ kfd_flush_tlb(qpd_to_pdd(qpd));
/* Release the vmid mapping */
set_pasid_vmid_mapping(dqm, 0, qpd->vmid);
@@ -1282,7 +1282,7 @@ static int restore_process_queues_nocpsc
dqm->dev->adev,
qpd->vmid,
qpd->page_table_base);
- kfd_flush_tlb(pdd, TLB_FLUSH_LEGACY);
+ kfd_flush_tlb(pdd);
}
/* Take a safe reference to the mm_struct, which may otherwise
--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
@@ -1533,13 +1533,13 @@ void kfd_signal_reset_event(struct kfd_n
void kfd_signal_poison_consumed_event(struct kfd_node *dev, u32 pasid);
-static inline void kfd_flush_tlb(struct kfd_process_device *pdd,
- enum TLB_FLUSH_TYPE type)
+static inline void kfd_flush_tlb(struct kfd_process_device *pdd)
{
struct amdgpu_device *adev = pdd->dev->adev;
struct amdgpu_vm *vm = drm_priv_to_vm(pdd->drm_priv);
- amdgpu_vm_flush_compute_tlb(adev, vm, type, pdd->dev->xcc_mask);
+ amdgpu_vm_flush_compute_tlb(adev, vm, TLB_FLUSH_HEAVYWEIGHT,
+ pdd->dev->xcc_mask);
}
static inline bool kfd_flush_tlb_after_unmap(struct kfd_dev *dev)
--- a/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_svm.c
@@ -1391,7 +1391,7 @@ svm_range_unmap_from_gpus(struct svm_ran
if (r)
break;
}
- kfd_flush_tlb(pdd, TLB_FLUSH_HEAVYWEIGHT);
+ kfd_flush_tlb(pdd);
}
return r;
@@ -1525,7 +1525,7 @@ svm_range_map_to_gpus(struct svm_range *
}
}
- kfd_flush_tlb(pdd, TLB_FLUSH_LEGACY);
+ kfd_flush_tlb(pdd);
}
return r;
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 130/188] drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (128 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 129/188] drm/amdkfd: Make all TLB-flushes heavy-weight Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 131/188] drm/amdgpu/pm: add missing revision check for CI Greg Kroah-Hartman
` (62 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian König, John B. Moore,
Alex Deucher
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: John B. Moore <jbmoore61@gmail.com>
commit 78d2e624fa073c14970aa097adcf3ea31c157a66 upstream.
sdma_v4_0_ring_emit_fence() contains two BUG_ON(addr & 0x3) assertions
that verify fence writeback addresses are dword-aligned. These
assertions can be reached from unprivileged userspace via crafted
DRM_IOCTL_AMDGPU_CS submissions, causing a fatal kernel panic in a
scheduler worker thread.
Replace both BUG_ON() calls with WARN_ON() to log the condition without
crashing the kernel. A misaligned fence address at this point indicates
a driver bug, but crashing the kernel is never the correct response when
the assertion is reachable from userspace.
The CS IOCTL path is the correct place to filter invalid submissions;
the ring emission callback is too late to do anything about it.
Fixes: 2130f89ced2c ("drm/amdgpu: add SDMA v4.0 implementation (v2)")
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: John B. Moore <jbmoore61@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit b90250bd933afd1ba94d86d6b13821997b22b18e)
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c
@@ -890,7 +890,7 @@ static void sdma_v4_0_ring_emit_fence(st
/* write the fence */
amdgpu_ring_write(ring, SDMA_PKT_HEADER_OP(SDMA_OP_FENCE));
/* zero in first two bits */
- BUG_ON(addr & 0x3);
+ WARN_ON(addr & 0x3);
amdgpu_ring_write(ring, lower_32_bits(addr));
amdgpu_ring_write(ring, upper_32_bits(addr));
amdgpu_ring_write(ring, lower_32_bits(seq));
@@ -900,7 +900,7 @@ static void sdma_v4_0_ring_emit_fence(st
addr += 4;
amdgpu_ring_write(ring, SDMA_PKT_HEADER_OP(SDMA_OP_FENCE));
/* zero in first two bits */
- BUG_ON(addr & 0x3);
+ WARN_ON(addr & 0x3);
amdgpu_ring_write(ring, lower_32_bits(addr));
amdgpu_ring_write(ring, upper_32_bits(addr));
amdgpu_ring_write(ring, upper_32_bits(seq));
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 131/188] drm/amdgpu/pm: add missing revision check for CI
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (129 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 130/188] drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 132/188] drm/amdgpu/pm: align Hawaii mclk workaround with radeon Greg Kroah-Hartman
` (61 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Timur Kristóf, Kent Russell,
Alex Deucher
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 2a561b361b7681509710f3cfc3d95d54c87ac69f upstream.
The ci_populate_all_memory_levels() workaround only
applies to revision 0 SKUs.
Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/1816
Fixes: 9f4b35411cfe ("drm/amd/powerplay: add CI asics support to smumgr (v3)")
Reviewed-by: Timur Kristóf <timur.kristof@gmail.com>
Reviewed-by: Kent Russell <kent.russell@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 1db15ba8f72f400bbad8ae0ce24fafc43429d4bd)
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c
@@ -1326,8 +1326,9 @@ static int ci_populate_all_memory_levels
dev_id = adev->pdev->device;
- if ((dpm_table->mclk_table.count >= 2)
- && ((dev_id == 0x67B0) || (dev_id == 0x67B1))) {
+ if ((dpm_table->mclk_table.count >= 2) &&
+ ((dev_id == 0x67B0) || (dev_id == 0x67B1)) &&
+ (adev->pdev->revision == 0)) {
smu_data->smc_state_table.MemoryLevel[1].MinVddci =
smu_data->smc_state_table.MemoryLevel[0].MinVddci;
smu_data->smc_state_table.MemoryLevel[1].MinMvdd =
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 132/188] drm/amdgpu/pm: align Hawaii mclk workaround with radeon
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (130 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 131/188] drm/amdgpu/pm: add missing revision check for CI Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 133/188] arm64: dts: qcom: lemans: Correct QUP interrupt numbers Greg Kroah-Hartman
` (60 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Timur Kristóf, Kent Russell,
Alex Deucher
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 1987c79b4fe5789dfa14423e78b5c25f6acf3e9d upstream.
Align the hawaii mclk workaround with radeon and windows.
Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/1816
Fixes: 9f4b35411cfe ("drm/amd/powerplay: add CI asics support to smumgr (v3)")
Reviewed-by: Timur Kristóf <timur.kristof@gmail.com>
Reviewed-by: Kent Russell <kent.russell@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 9649528b637f668c5af9f2b83ca4ad8576ae2121)
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/smumgr/ci_smumgr.c
@@ -1329,10 +1329,10 @@ static int ci_populate_all_memory_levels
if ((dpm_table->mclk_table.count >= 2) &&
((dev_id == 0x67B0) || (dev_id == 0x67B1)) &&
(adev->pdev->revision == 0)) {
- smu_data->smc_state_table.MemoryLevel[1].MinVddci =
- smu_data->smc_state_table.MemoryLevel[0].MinVddci;
- smu_data->smc_state_table.MemoryLevel[1].MinMvdd =
- smu_data->smc_state_table.MemoryLevel[0].MinMvdd;
+ smu_data->smc_state_table.MemoryLevel[1].MinVddc =
+ smu_data->smc_state_table.MemoryLevel[0].MinVddc;
+ smu_data->smc_state_table.MemoryLevel[1].MinVddcPhases =
+ smu_data->smc_state_table.MemoryLevel[0].MinVddcPhases;
}
smu_data->smc_state_table.MemoryLevel[0].ActivityLevel = 0x1F;
CONVERT_FROM_HOST_TO_SMC_US(smu_data->smc_state_table.MemoryLevel[0].ActivityLevel);
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 133/188] arm64: dts: qcom: lemans: Correct QUP interrupt numbers
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (131 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 132/188] drm/amdgpu/pm: align Hawaii mclk workaround with radeon Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 134/188] arm64: dts: ti: k3-am62a7-sk: Fix pin name in comment from M19 to N22 Greg Kroah-Hartman
` (59 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Viken Dadhaniya, Dmitry Baryshkov,
Bjorn Andersson
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
commit c5b22c88cc09b180e3a23010b29f4d02ec117a44 upstream.
Fix GIC_SPI interrupt numbers for QUPv3 SE6 nodes on Lemans SoC.
Using incorrect interrupt lines can prevent IRQs from triggering
and break I2C, SPI, and UART operation.
Fixes: 34a407316b7d3 ("arm64: dts: qcom: sa8775p: Populate additional UART DT nodes")
Fixes: 1b2d7ad5ac14d ("arm64: dts: qcom: sa8775p: add missing spi nodes")
Fixes: ee2f5f906d69d ("arm64: dts: qcom: sa8775p: add missing i2c nodes")
Cc: stable@vger.kernel.org
Signed-off-by: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260325-lemans-irq-num-v1-1-a470d544966a@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/qcom/lemans.dtsi | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/arch/arm64/boot/dts/qcom/lemans.dtsi
+++ b/arch/arm64/boot/dts/qcom/lemans.dtsi
@@ -1563,7 +1563,7 @@
reg = <0x0 0x898000 0x0 0x4000>;
#address-cells = <1>;
#size-cells = <0>;
- interrupts = <GIC_SPI 834 IRQ_TYPE_LEVEL_HIGH>;
+ interrupts = <GIC_SPI 833 IRQ_TYPE_LEVEL_HIGH>;
clocks = <&gcc GCC_QUPV3_WRAP2_S6_CLK>;
clock-names = "se";
pinctrl-0 = <&qup_i2c20_default>;
@@ -1590,7 +1590,7 @@
reg = <0x0 0x898000 0x0 0x4000>;
#address-cells = <1>;
#size-cells = <0>;
- interrupts = <GIC_SPI 834 IRQ_TYPE_LEVEL_HIGH>;
+ interrupts = <GIC_SPI 833 IRQ_TYPE_LEVEL_HIGH>;
clocks = <&gcc GCC_QUPV3_WRAP2_S6_CLK>;
clock-names = "se";
pinctrl-0 = <&qup_spi20_default>;
@@ -1615,7 +1615,7 @@
uart20: serial@898000 {
compatible = "qcom,geni-uart";
reg = <0x0 0x00898000 0x0 0x4000>;
- interrupts = <GIC_SPI 834 IRQ_TYPE_LEVEL_HIGH>;
+ interrupts = <GIC_SPI 833 IRQ_TYPE_LEVEL_HIGH>;
clocks = <&gcc GCC_QUPV3_WRAP2_S6_CLK>;
clock-names = "se";
pinctrl-0 = <&qup_uart20_default>;
@@ -2561,7 +2561,7 @@
reg = <0x0 0xa98000 0x0 0x4000>;
#address-cells = <1>;
#size-cells = <0>;
- interrupts = <GIC_SPI 836 IRQ_TYPE_LEVEL_HIGH>;
+ interrupts = <GIC_SPI 835 IRQ_TYPE_LEVEL_HIGH>;
clocks = <&gcc GCC_QUPV3_WRAP1_S6_CLK>;
clock-names = "se";
pinctrl-0 = <&qup_i2c13_default>;
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 134/188] arm64: dts: ti: k3-am62a7-sk: Fix pin name in comment from M19 to N22
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (132 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 133/188] arm64: dts: qcom: lemans: Correct QUP interrupt numbers Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 135/188] sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL Greg Kroah-Hartman
` (58 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Siddharth Vadapalli, Andrew Davis,
Bryan Brattlof, Vignesh Raghavendra
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siddharth Vadapalli <s-vadapalli@ti.com>
commit 6ee0792d83d5c690205c350825a4c30746c0e0a2 upstream.
The pin for GPMC0_CLK.GPIO0_31 at address 0x000F407C is N22 and not M19.
Hence, fix the pin name in the comment to avoid confusion.
Fixes: 8f023012eb4a ("arm64: dts: ti: k3-am62a: Enable UHS mode support for SD cards")
Cc: stable@vger.kernel.org
Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com>
Reviewed-by: Andrew Davis <afd@ti.com>
Reviewed-by: Bryan Brattlof <bb@ti.com>
Link: https://patch.msgid.link/20260309045539.2070793-1-s-vadapalli@ti.com
Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/ti/k3-am62a7-sk.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
+++ b/arch/arm64/boot/dts/ti/k3-am62a7-sk.dts
@@ -394,7 +394,7 @@
vddshv_sdio_pins_default: vddshv-sdio-default-pins {
pinctrl-single,pins = <
- AM62AX_IOPAD(0x07c, PIN_OUTPUT, 7) /* (M19) GPMC0_CLK.GPIO0_31 */
+ AM62AX_IOPAD(0x07c, PIN_OUTPUT, 7) /* (N22) GPMC0_CLK.GPIO0_31 */
>;
};
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 135/188] sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (133 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 134/188] arm64: dts: ti: k3-am62a7-sk: Fix pin name in comment from M19 to N22 Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 136/188] batman-adv: fix integer overflow on buff_pos Greg Kroah-Hartman
` (57 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ben Morris, Xin Long, Jakub Kicinski
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Morris <bmorris@anthropic.com>
commit abb5f36771cc4c05899b34000829a787572a8817 upstream.
The SCTP_SENDALL path in sctp_sendmsg() iterates ep->asocs with
list_for_each_entry_safe(), which caches the next entry in @tmp before
the loop body runs. The body calls sctp_sendmsg_to_asoc(), which may
drop the socket lock inside sctp_wait_for_sndbuf().
While the lock is dropped, another thread can SCTP_SOCKOPT_PEELOFF the
association cached in @tmp, migrating it to a new endpoint via
sctp_sock_migrate() (list_del_init() + list_add_tail() to
newep->asocs), and optionally close the new socket which frees the
association via kfree_rcu(). The cached @tmp can also be freed by a
network ABORT for that association, processed in softirq while the
lock is dropped.
sctp_wait_for_sndbuf() revalidates @asoc (the current entry) on re-lock
via the "sk != asoc->base.sk" and "asoc->base.dead" checks, but nothing
revalidates @tmp. After a successful return, the iterator advances to
the stale @tmp, yielding either a use-after-free (if the peeled socket
was closed) or a list-walk onto the new endpoint's list head (type
confusion of &newep->asocs as a struct sctp_association *).
Both are reachable from CapEff=0; the type-confusion path gives
controlled indirect call via the outqueue.sched->init_sid pointer.
Fix by re-deriving @tmp from @asoc after sctp_sendmsg_to_asoc()
returns. @asoc is known to still be on ep->asocs at that point: the
only callers that list_del an association from ep->asocs are
sctp_association_free() (which sets asoc->base.dead) and
sctp_assoc_migrate() (which changes asoc->base.sk), and
sctp_wait_for_sndbuf() checks both under the lock before any
successful return; a tripped check propagates as err < 0 and the loop
bails before the re-derive.
The SCTP_ABORT path in sctp_sendmsg_check_sflags() returns 0 and the
loop hits 'continue' before sctp_sendmsg_to_asoc() is ever called, so
the @tmp cached by list_for_each_entry_safe() still covers the
lock-held free that ba59fb027307 ("sctp: walk the list of asoc
safely") was added for.
Fixes: 4910280503f3 ("sctp: add support for snd flag SCTP_SENDALL process in sendmsg")
Cc: stable@vger.kernel.org
Signed-off-by: Ben Morris <bmorris@anthropic.com>
Acked-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/20260508001455.3137-1-joycathacker@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sctp/socket.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1985,6 +1985,15 @@ static int sctp_sendmsg(struct sock *sk,
goto out_unlock;
iov_iter_revert(&msg->msg_iter, err);
+
+ /* sctp_sendmsg_to_asoc() may have released the socket
+ * lock (sctp_wait_for_sndbuf), during which other
+ * associations on ep->asocs could have been peeled
+ * off or freed. @asoc itself is revalidated by the
+ * base.dead and base.sk checks in sctp_wait_for_sndbuf,
+ * so re-derive the cached cursor from it.
+ */
+ tmp = list_next_entry(asoc, asocs);
}
goto out_unlock;
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 136/188] batman-adv: fix integer overflow on buff_pos
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (134 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 135/188] sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 137/188] batman-adv: reject new tp_meter sessions during teardown Greg Kroah-Hartman
` (56 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lyes Bourennani, Alexis Pinson,
Sven Eckelmann
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lyes Bourennani <lbourennani@fuzzinglabs.com>
commit 0799e5943611006b346b8813c7daf7dd5aa26bfd upstream.
Fixing an integer overflow present in batadv_iv_ogm_send_to_if. The size
check is done using the int type in batadv_iv_ogm_aggr_packet whereas the
buff_pos variable uses the s16 type. This could lead to an out-of-bound
read.
Cc: stable@vger.kernel.org
Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
Signed-off-by: Lyes Bourennani <lbourennani@fuzzinglabs.com>
Signed-off-by: Alexis Pinson <apinson@fuzzinglabs.com>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/bat_iv_ogm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -335,7 +335,7 @@ static void batadv_iv_ogm_send_to_if(str
struct batadv_priv *bat_priv = netdev_priv(hard_iface->mesh_iface);
const char *fwd_str;
u8 packet_num;
- s16 buff_pos;
+ int buff_pos;
struct batadv_ogm_packet *batadv_ogm_packet;
struct sk_buff *skb;
u8 *packet_pos;
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 137/188] batman-adv: reject new tp_meter sessions during teardown
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (135 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 136/188] batman-adv: fix integer overflow on buff_pos Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 138/188] batman-adv: stop tp_meter sessions during mesh teardown Greg Kroah-Hartman
` (55 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Yuan Tan, Yifan Wu,
Juefei Pu, Xin Liu, Luxing Yin, Jiexun Wang, Ren Wei,
Sven Eckelmann
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiexun Wang <wangjiexun2025@gmail.com>
commit 3243543592425beec83d453793e9d27caa0d8e66 upstream.
Prevent tp_meter from starting new sender or receiver sessions after
mesh_state has left BATADV_MESH_ACTIVE.
Fixes: 33a3bb4a3345 ("batman-adv: throughput meter implementation")
Cc: stable@kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Co-developed-by: Luxing Yin <tr0jan@lzu.edu.cn>
Signed-off-by: Luxing Yin <tr0jan@lzu.edu.cn>
Signed-off-by: Jiexun Wang <wangjiexun2025@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/tp_meter.c | 17 ++++++++++++++++-
1 file changed, 16 insertions(+), 1 deletion(-)
--- a/net/batman-adv/tp_meter.c
+++ b/net/batman-adv/tp_meter.c
@@ -947,6 +947,13 @@ void batadv_tp_start(struct batadv_priv
/* look for an already existing test towards this node */
spin_lock_bh(&bat_priv->tp_list_lock);
+ if (atomic_read(&bat_priv->mesh_state) != BATADV_MESH_ACTIVE) {
+ spin_unlock_bh(&bat_priv->tp_list_lock);
+ batadv_tp_batctl_error_notify(BATADV_TP_REASON_DST_UNREACHABLE,
+ dst, bat_priv, session_cookie);
+ return;
+ }
+
tp_vars = batadv_tp_list_find(bat_priv, dst);
if (tp_vars) {
spin_unlock_bh(&bat_priv->tp_list_lock);
@@ -1329,9 +1336,12 @@ static struct batadv_tp_vars *
batadv_tp_init_recv(struct batadv_priv *bat_priv,
const struct batadv_icmp_tp_packet *icmp)
{
- struct batadv_tp_vars *tp_vars;
+ struct batadv_tp_vars *tp_vars = NULL;
spin_lock_bh(&bat_priv->tp_list_lock);
+ if (atomic_read(&bat_priv->mesh_state) != BATADV_MESH_ACTIVE)
+ goto out_unlock;
+
tp_vars = batadv_tp_list_find_session(bat_priv, icmp->orig,
icmp->session);
if (tp_vars)
@@ -1464,6 +1474,9 @@ void batadv_tp_meter_recv(struct batadv_
{
struct batadv_icmp_tp_packet *icmp;
+ if (atomic_read(&bat_priv->mesh_state) != BATADV_MESH_ACTIVE)
+ goto out;
+
icmp = (struct batadv_icmp_tp_packet *)skb->data;
switch (icmp->subtype) {
@@ -1478,6 +1491,8 @@ void batadv_tp_meter_recv(struct batadv_
"Received unknown TP Metric packet type %u\n",
icmp->subtype);
}
+
+out:
consume_skb(skb);
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 138/188] batman-adv: stop tp_meter sessions during mesh teardown
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (136 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 137/188] batman-adv: reject new tp_meter sessions during teardown Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 139/188] batman-adv: stop caching unowned originator pointers in BAT IV Greg Kroah-Hartman
` (54 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Yuan Tan, Yifan Wu,
Juefei Pu, Xin Liu, Luxing Yin, Jiexun Wang, Ren Wei,
Sven Eckelmann
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiexun Wang <wangjiexun2025@gmail.com>
commit 3d3cf6a7314aca4df0a6dde28ce784a2a30d0166 upstream.
TP meter sessions remain linked on bat_priv->tp_list after the netlink
request has already finished. When the mesh interface is removed,
batadv_mesh_free() currently tears down the mesh without first draining
these sessions.
A running sender thread or a late incoming tp_meter packet can then keep
processing against a mesh instance which is already shutting down.
Synchronize tp_meter with the mesh lifetime by stopping all active
sessions from batadv_mesh_free() and waiting for sender threads to exit
before teardown continues.
Fixes: 33a3bb4a3345 ("batman-adv: throughput meter implementation")
Cc: stable@kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Co-developed-by: Luxing Yin <tr0jan@lzu.edu.cn>
Signed-off-by: Luxing Yin <tr0jan@lzu.edu.cn>
Signed-off-by: Jiexun Wang <wangjiexun2025@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/main.c | 1
net/batman-adv/tp_meter.c | 94 +++++++++++++++++++++++++++++++++++++---------
net/batman-adv/tp_meter.h | 1
net/batman-adv/types.h | 4 +
4 files changed, 82 insertions(+), 18 deletions(-)
--- a/net/batman-adv/main.c
+++ b/net/batman-adv/main.c
@@ -249,6 +249,7 @@ void batadv_mesh_free(struct net_device
atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
batadv_purge_outstanding_packets(bat_priv, NULL);
+ batadv_tp_stop_all(bat_priv);
batadv_gw_node_free(bat_priv);
--- a/net/batman-adv/tp_meter.c
+++ b/net/batman-adv/tp_meter.c
@@ -12,6 +12,7 @@
#include <linux/byteorder/generic.h>
#include <linux/cache.h>
#include <linux/compiler.h>
+#include <linux/completion.h>
#include <linux/container_of.h>
#include <linux/err.h>
#include <linux/etherdevice.h>
@@ -365,23 +366,38 @@ static void batadv_tp_vars_put(struct ba
}
/**
- * batadv_tp_sender_cleanup() - cleanup sender data and drop and timer
- * @bat_priv: the bat priv with all the mesh interface information
- * @tp_vars: the private data of the current TP meter session to cleanup
+ * batadv_tp_list_detach() - remove tp session from mesh session list once
+ * @tp_vars: the private data of the current TP meter session
*/
-static void batadv_tp_sender_cleanup(struct batadv_priv *bat_priv,
- struct batadv_tp_vars *tp_vars)
+static void batadv_tp_list_detach(struct batadv_tp_vars *tp_vars)
{
- cancel_delayed_work(&tp_vars->finish_work);
+ bool detached = false;
spin_lock_bh(&tp_vars->bat_priv->tp_list_lock);
- hlist_del_rcu(&tp_vars->list);
+ if (!hlist_unhashed(&tp_vars->list)) {
+ hlist_del_init_rcu(&tp_vars->list);
+ detached = true;
+ }
spin_unlock_bh(&tp_vars->bat_priv->tp_list_lock);
+ if (!detached)
+ return;
+
+ atomic_dec(&tp_vars->bat_priv->tp_num);
+
/* drop list reference */
batadv_tp_vars_put(tp_vars);
+}
- atomic_dec(&tp_vars->bat_priv->tp_num);
+/**
+ * batadv_tp_sender_cleanup() - cleanup sender data and drop and timer
+ * @tp_vars: the private data of the current TP meter session to cleanup
+ */
+static void batadv_tp_sender_cleanup(struct batadv_tp_vars *tp_vars)
+{
+ cancel_delayed_work_sync(&tp_vars->finish_work);
+
+ batadv_tp_list_detach(tp_vars);
/* kill the timer and remove its reference */
timer_delete_sync(&tp_vars->timer);
@@ -886,7 +902,8 @@ out:
batadv_orig_node_put(orig_node);
batadv_tp_sender_end(bat_priv, tp_vars);
- batadv_tp_sender_cleanup(bat_priv, tp_vars);
+ batadv_tp_sender_cleanup(tp_vars);
+ complete(&tp_vars->finished);
batadv_tp_vars_put(tp_vars);
@@ -918,7 +935,8 @@ static void batadv_tp_start_kthread(stru
batadv_tp_vars_put(tp_vars);
/* cleanup of failed tp meter variables */
- batadv_tp_sender_cleanup(bat_priv, tp_vars);
+ batadv_tp_sender_cleanup(tp_vars);
+ complete(&tp_vars->finished);
return;
}
@@ -1024,6 +1042,7 @@ void batadv_tp_start(struct batadv_priv
tp_vars->start_time = jiffies;
init_waitqueue_head(&tp_vars->more_bytes);
+ init_completion(&tp_vars->finished);
spin_lock_init(&tp_vars->unacked_lock);
INIT_LIST_HEAD(&tp_vars->unacked_list);
@@ -1126,14 +1145,7 @@ static void batadv_tp_receiver_shutdown(
"Shutting down for inactivity (more than %dms) from %pM\n",
BATADV_TP_RECV_TIMEOUT, tp_vars->other_end);
- spin_lock_bh(&tp_vars->bat_priv->tp_list_lock);
- hlist_del_rcu(&tp_vars->list);
- spin_unlock_bh(&tp_vars->bat_priv->tp_list_lock);
-
- /* drop list reference */
- batadv_tp_vars_put(tp_vars);
-
- atomic_dec(&bat_priv->tp_num);
+ batadv_tp_list_detach(tp_vars);
spin_lock_bh(&tp_vars->unacked_lock);
list_for_each_entry_safe(un, safe, &tp_vars->unacked_list, list) {
@@ -1497,6 +1509,52 @@ out:
}
/**
+ * batadv_tp_stop_all() - stop all currently running tp meter sessions
+ * @bat_priv: the bat priv with all the mesh interface information
+ */
+void batadv_tp_stop_all(struct batadv_priv *bat_priv)
+{
+ struct batadv_tp_vars *tp_vars[BATADV_TP_MAX_NUM];
+ struct batadv_tp_vars *tp_var;
+ size_t count = 0;
+ size_t i;
+
+ spin_lock_bh(&bat_priv->tp_list_lock);
+ hlist_for_each_entry(tp_var, &bat_priv->tp_list, list) {
+ if (WARN_ON_ONCE(count >= BATADV_TP_MAX_NUM))
+ break;
+
+ if (!kref_get_unless_zero(&tp_var->refcount))
+ continue;
+
+ tp_vars[count++] = tp_var;
+ }
+ spin_unlock_bh(&bat_priv->tp_list_lock);
+
+ for (i = 0; i < count; i++) {
+ tp_var = tp_vars[i];
+
+ switch (tp_var->role) {
+ case BATADV_TP_SENDER:
+ batadv_tp_sender_shutdown(tp_var,
+ BATADV_TP_REASON_CANCEL);
+ wake_up(&tp_var->more_bytes);
+ wait_for_completion(&tp_var->finished);
+ break;
+ case BATADV_TP_RECEIVER:
+ batadv_tp_list_detach(tp_var);
+ if (timer_shutdown_sync(&tp_var->timer))
+ batadv_tp_vars_put(tp_var);
+ break;
+ }
+
+ batadv_tp_vars_put(tp_var);
+ }
+
+ synchronize_net();
+}
+
+/**
* batadv_tp_meter_init() - initialize global tp_meter structures
*/
void __init batadv_tp_meter_init(void)
--- a/net/batman-adv/tp_meter.h
+++ b/net/batman-adv/tp_meter.h
@@ -17,6 +17,7 @@ void batadv_tp_start(struct batadv_priv
u32 test_length, u32 *cookie);
void batadv_tp_stop(struct batadv_priv *bat_priv, const u8 *dst,
u8 return_value);
+void batadv_tp_stop_all(struct batadv_priv *bat_priv);
void batadv_tp_meter_recv(struct batadv_priv *bat_priv, struct sk_buff *skb);
#endif /* _NET_BATMAN_ADV_TP_METER_H_ */
--- a/net/batman-adv/types.h
+++ b/net/batman-adv/types.h
@@ -14,6 +14,7 @@
#include <linux/average.h>
#include <linux/bitops.h>
#include <linux/compiler.h>
+#include <linux/completion.h>
#include <linux/if.h>
#include <linux/if_ether.h>
#include <linux/kref.h>
@@ -1328,6 +1329,9 @@ struct batadv_tp_vars {
/** @finish_work: work item for the finishing procedure */
struct delayed_work finish_work;
+ /** @finished: completion signaled when a sender thread exits */
+ struct completion finished;
+
/** @test_length: test length in milliseconds */
u32 test_length;
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 139/188] batman-adv: stop caching unowned originator pointers in BAT IV
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (137 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 138/188] batman-adv: stop tp_meter sessions during mesh teardown Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 140/188] batman-adv: bla: prevent use-after-free when deleting claims Greg Kroah-Hartman
` (53 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Yuan Tan, Yifan Wu,
Juefei Pu, Xin Liu, Jiexun Wang, Ren Wei, Sven Eckelmann
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiexun Wang <wangjiexun2025@gmail.com>
commit f03e8583532941b07761c5429de7d50766fa3110 upstream.
BAT IV keeps the last-hop neighbor address in each neigh_node, but some
paths also cache an originator pointer derived from a temporary lookup.
That pointer is not owned by the neigh_node and may no longer refer to a
live originator entry after purge handling runs.
Stop storing the auxiliary originator pointer in the BAT IV neighbor
state. When BAT IV needs the neighbor originator data, resolve it from
the stored neighbor address and drop the reference again after use.
Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
Cc: stable@kernel.org
Reported-by: Yuan Tan <yuantan098@gmail.com>
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Reported-by: Xin Liu <bird@lzu.edu.cn>
Signed-off-by: Jiexun Wang <wangjiexun2025@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
[sven: avoid bonding logic for outgoing OGM]
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/bat_iv_ogm.c | 83 +++++++++++++++++++++++++++++++-------------
1 file changed, 59 insertions(+), 24 deletions(-)
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -173,19 +173,12 @@ free_orig_node_hash:
static struct batadv_neigh_node *
batadv_iv_ogm_neigh_new(struct batadv_hard_iface *hard_iface,
const u8 *neigh_addr,
- struct batadv_orig_node *orig_node,
- struct batadv_orig_node *orig_neigh)
+ struct batadv_orig_node *orig_node)
{
struct batadv_neigh_node *neigh_node;
neigh_node = batadv_neigh_node_get_or_create(orig_node,
hard_iface, neigh_addr);
- if (!neigh_node)
- goto out;
-
- neigh_node->orig_node = orig_neigh;
-
-out:
return neigh_node;
}
@@ -907,6 +900,31 @@ static u8 batadv_iv_orig_ifinfo_sum(stru
}
/**
+ * batadv_iv_ogm_neigh_ifinfo_sum() - Get bcast_own sum for a last-hop neighbor
+ * @bat_priv: the bat priv with all the mesh interface information
+ * @neigh_node: last-hop neighbor of an originator
+ *
+ * Return: Number of replied (rebroadcasted) OGMs for the originator currently
+ * announced by the neighbor. Returns 0 if the neighbor's originator entry is
+ * not available anymore.
+ */
+static u8 batadv_iv_ogm_neigh_ifinfo_sum(struct batadv_priv *bat_priv,
+ const struct batadv_neigh_node *neigh_node)
+{
+ struct batadv_orig_node *orig_neigh;
+ u8 sum;
+
+ orig_neigh = batadv_orig_hash_find(bat_priv, neigh_node->addr);
+ if (!orig_neigh)
+ return 0;
+
+ sum = batadv_iv_orig_ifinfo_sum(orig_neigh, neigh_node->if_incoming);
+ batadv_orig_node_put(orig_neigh);
+
+ return sum;
+}
+
+/**
* batadv_iv_ogm_orig_update() - use OGM to update corresponding data in an
* originator
* @bat_priv: the bat priv with all the mesh interface information
@@ -975,17 +993,9 @@ batadv_iv_ogm_orig_update(struct batadv_
}
if (!neigh_node) {
- struct batadv_orig_node *orig_tmp;
-
- orig_tmp = batadv_iv_ogm_orig_get(bat_priv, ethhdr->h_source);
- if (!orig_tmp)
- goto unlock;
-
neigh_node = batadv_iv_ogm_neigh_new(if_incoming,
ethhdr->h_source,
- orig_node, orig_tmp);
-
- batadv_orig_node_put(orig_tmp);
+ orig_node);
if (!neigh_node)
goto unlock;
} else {
@@ -1037,10 +1047,9 @@ batadv_iv_ogm_orig_update(struct batadv_
*/
if (router_ifinfo &&
neigh_ifinfo->bat_iv.tq_avg == router_ifinfo->bat_iv.tq_avg) {
- sum_orig = batadv_iv_orig_ifinfo_sum(router->orig_node,
- router->if_incoming);
- sum_neigh = batadv_iv_orig_ifinfo_sum(neigh_node->orig_node,
- neigh_node->if_incoming);
+ sum_orig = batadv_iv_ogm_neigh_ifinfo_sum(bat_priv, router);
+ sum_neigh = batadv_iv_ogm_neigh_ifinfo_sum(bat_priv,
+ neigh_node);
if (sum_orig >= sum_neigh)
goto out;
}
@@ -1106,7 +1115,6 @@ static bool batadv_iv_ogm_calc_tq(struct
if (!neigh_node)
neigh_node = batadv_iv_ogm_neigh_new(if_incoming,
orig_neigh_node->orig,
- orig_neigh_node,
orig_neigh_node);
if (!neigh_node)
@@ -1303,6 +1311,32 @@ out:
}
/**
+ * batadv_orig_to_direct_router() - get direct next hop neighbor to an orig address
+ * @bat_priv: the bat priv with all the mesh interface information
+ * @orig_addr: the originator MAC address to search the best next hop router for
+ * @if_outgoing: the interface where the OGM should be sent to
+ *
+ * Return: A neighbor node which is the best router towards the given originator
+ * address. Bonding candidates are ignored.
+ */
+static struct batadv_neigh_node *
+batadv_orig_to_direct_router(struct batadv_priv *bat_priv, u8 *orig_addr,
+ struct batadv_hard_iface *if_outgoing)
+{
+ struct batadv_neigh_node *neigh_node;
+ struct batadv_orig_node *orig_node;
+
+ orig_node = batadv_orig_hash_find(bat_priv, orig_addr);
+ if (!orig_node)
+ return NULL;
+
+ neigh_node = batadv_orig_router_get(orig_node, if_outgoing);
+ batadv_orig_node_put(orig_node);
+
+ return neigh_node;
+}
+
+/**
* batadv_iv_ogm_process_per_outif() - process a batman iv OGM for an outgoing
* interface
* @skb: the skb containing the OGM
@@ -1372,8 +1406,9 @@ batadv_iv_ogm_process_per_outif(const st
router = batadv_orig_router_get(orig_node, if_outgoing);
if (router) {
- router_router = batadv_orig_router_get(router->orig_node,
- if_outgoing);
+ router_router = batadv_orig_to_direct_router(bat_priv,
+ router->addr,
+ if_outgoing);
router_ifinfo = batadv_neigh_ifinfo_get(router, if_outgoing);
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 140/188] batman-adv: bla: prevent use-after-free when deleting claims
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (138 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 139/188] batman-adv: stop caching unowned originator pointers in BAT IV Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 141/188] batman-adv: bla: only purge non-released claims Greg Kroah-Hartman
` (52 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Sven Eckelmann
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit 4ae1709a314060a196981b344610d023ea841e57 upstream.
When batadv_bla_del_backbone_claims() removes all claims for a backbone, it
does this by dropping the link entry in the hash list. This list entry
itself was one of the references which need to be dropped at the same time
via batadv_claim_put().
But the batadv_claim_put() must not be done before the last access to the
claim object in this function. Otherwise the claim might be freed already
by the batadv_claim_release() function before the list entry was dropped.
Cc: stable@kernel.org
Fixes: 23721387c409 ("batman-adv: add basic bridge loop avoidance code")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/bridge_loop_avoidance.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/batman-adv/bridge_loop_avoidance.c
+++ b/net/batman-adv/bridge_loop_avoidance.c
@@ -319,8 +319,8 @@ batadv_bla_del_backbone_claims(struct ba
if (claim->backbone_gw != backbone_gw)
continue;
- batadv_claim_put(claim);
hlist_del_rcu(&claim->hash_entry);
+ batadv_claim_put(claim);
}
spin_unlock_bh(list_lock);
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 141/188] batman-adv: bla: only purge non-released claims
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (139 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 140/188] batman-adv: bla: prevent use-after-free when deleting claims Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 142/188] batman-adv: bla: put backbone reference on failed claim hash insert Greg Kroah-Hartman
` (51 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Sven Eckelmann
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit cf6b604011591865ae39ac82de8978c1120d17af upstream.
When batadv_bla_purge_claims() goes through the list of claims, it is only
traversing the hash list with an rcu_read_lock(). Due to a potential
parallel batadv_claim_put(), it can happen that it encounters a claim which
was actually in the process of being released+freed by
batadv_claim_release(). In this case, backbone_gw is set to NULL before the
delayed RCU kfree is started. Calling batadv_bla_claim_get_backbone_gw() is
then no longer allowed because it would cause a NULL-ptr derefence.
To avoid this, only claims with a valid reference counter must be purged.
All others are already taken care of.
Cc: stable@kernel.org
Fixes: 23721387c409 ("batman-adv: add basic bridge loop avoidance code")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/bridge_loop_avoidance.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/net/batman-adv/bridge_loop_avoidance.c
+++ b/net/batman-adv/bridge_loop_avoidance.c
@@ -1289,6 +1289,13 @@ static void batadv_bla_purge_claims(stru
rcu_read_lock();
hlist_for_each_entry_rcu(claim, head, hash_entry) {
+ /* only purge claims not currently in the process of being released.
+ * Such claims could otherwise have a NULL-ptr backbone_gw set because
+ * they already went through batadv_claim_release()
+ */
+ if (!kref_get_unless_zero(&claim->refcount))
+ continue;
+
backbone_gw = batadv_bla_claim_get_backbone_gw(claim);
if (now)
goto purge_now;
@@ -1314,6 +1321,7 @@ purge_now:
claim->addr, claim->vid);
skip:
batadv_backbone_gw_put(backbone_gw);
+ batadv_claim_put(claim);
}
rcu_read_unlock();
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 142/188] batman-adv: bla: put backbone reference on failed claim hash insert
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (140 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 141/188] batman-adv: bla: only purge non-released claims Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 143/188] sched_ext: Use HK_TYPE_DOMAIN_BOOT to detect isolcpus= domain isolation Greg Kroah-Hartman
` (50 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Sven Eckelmann
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit ba9d20ee9076dac32c371116bacbe72480eb356c upstream.
When batadv_bla_add_claim() fails to insert a new claim into the hash, it
leaked a reference to the backbone_gw for which the claim was intended.
Call batadv_backbone_gw_put() on the error path to release the reference
and avoid leaking the backbone_gw object.
Cc: stable@kernel.org
Fixes: 3db0decf1185 ("batman-adv: Fix non-atomic bla_claim::backbone_gw access")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/bridge_loop_avoidance.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/batman-adv/bridge_loop_avoidance.c
+++ b/net/batman-adv/bridge_loop_avoidance.c
@@ -724,6 +724,7 @@ static void batadv_bla_add_claim(struct
if (unlikely(hash_added != 0)) {
/* only local changes happened. */
+ batadv_backbone_gw_put(backbone_gw);
kfree(claim);
return;
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 143/188] sched_ext: Use HK_TYPE_DOMAIN_BOOT to detect isolcpus= domain isolation
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (141 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 142/188] batman-adv: bla: put backbone reference on failed claim hash insert Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-16 0:48 ` Peter Schneider
2026-05-15 15:49 ` [PATCH 6.18 144/188] io_uring/zcrx: use guards for locking Greg Kroah-Hartman
` (49 subsequent siblings)
192 siblings, 1 reply; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrea Righi, Tejun Heo,
Frederic Weisbecker
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Righi <arighi@nvidia.com>
commit 6ae315d37924435516d697ea7dde0b799a5928e0 upstream.
scx_enable() refuses to attach a BPF scheduler when isolcpus=domain is
in effect by comparing housekeeping_cpumask(HK_TYPE_DOMAIN) against
cpu_possible_mask.
Since commit 27c3a5967f05 ("sched/isolation: Convert housekeeping
cpumasks to rcu pointers"), HK_TYPE_DOMAIN's cpumask is RCU protected
and dereferencing it requires either RCU read lock, the cpu_hotplug
write lock, or the cpuset lock; scx_enable() holds none of these, so
booting with isolcpus=domain and attaching any BPF scheduler triggers
the following lockdep splat:
=============================
WARNING: suspicious RCU usage
-----------------------------
kernel/sched/isolation.c:60 suspicious rcu_dereference_check() usage!
1 lock held by scx_flash/281:
#0: ffffffff8379fce0 (update_mutex){+.+.}-{4:4}, at:
bpf_struct_ops_link_create+0x134/0x1c0
Call Trace:
dump_stack_lvl+0x6f/0xb0
lockdep_rcu_suspicious.cold+0x37/0x70
housekeeping_cpumask+0xcd/0xe0
scx_enable.isra.0+0x17/0x120
bpf_scx_reg+0x5e/0x80
bpf_struct_ops_link_create+0x151/0x1c0
__sys_bpf+0x1e4b/0x33c0
__x64_sys_bpf+0x21/0x30
do_syscall_64+0x117/0xf80
entry_SYSCALL_64_after_hwframe+0x77/0x7f
In addition, commit 03ff73510169 ("cpuset: Update HK_TYPE_DOMAIN cpumask
from cpuset") made HK_TYPE_DOMAIN include cpuset isolated partitions as
well, which means the current check also rejects BPF schedulers when a
cpuset partition is active. That contradicts the original intent of
commit 9f391f94a173 ("sched_ext: Disallow loading BPF scheduler if
isolcpus= domain isolation is in effect"), which explicitly noted that
cpuset partitions are honored through per-task cpumasks and should not
be rejected.
Switch to housekeeping_enabled(HK_TYPE_DOMAIN_BOOT), which reads only
the housekeeping flag bit (no RCU dereference) and reflects exactly the
boot-time isolcpus= configuration that the error message refers to.
Fixes: 27c3a5967f05 ("sched/isolation: Convert housekeeping cpumasks to rcu pointers")
Cc: stable@vger.kernel.org # v7.0+
Signed-off-by: Andrea Righi <arighi@nvidia.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Acked-by: Frederic Weisbecker <frederic@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/ext.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/kernel/sched/ext.c
+++ b/kernel/sched/ext.c
@@ -4906,8 +4906,7 @@ static int scx_enable(struct sched_ext_o
static DEFINE_MUTEX(helper_mutex);
struct scx_enable_cmd cmd;
- if (!cpumask_equal(housekeeping_cpumask(HK_TYPE_DOMAIN),
- cpu_possible_mask)) {
+ if (housekeeping_enabled(HK_TYPE_DOMAIN_BOOT)) {
pr_err("sched_ext: Not compatible with \"isolcpus=\" domain isolation\n");
return -EINVAL;
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 144/188] io_uring/zcrx: use guards for locking
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (142 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 143/188] sched_ext: Use HK_TYPE_DOMAIN_BOOT to detect isolcpus= domain isolation Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 145/188] io_uring/zcrx: warn on freelist violations Greg Kroah-Hartman
` (48 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pavel Begunkov, Jens Axboe,
Harshit Mogalapalli
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Begunkov <asml.silence@gmail.com>
commit 898ad80d1207cbdb22b21bafb6de4adfd7627bd0 upstream.
Convert last several places using manual locking to guards to simplify
the code.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://patch.msgid.link/eb4667cfaf88c559700f6399da9e434889f5b04a.1774261953.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/zcrx.c | 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -696,9 +696,8 @@ static void io_zcrx_return_niov_freelist
{
struct io_zcrx_area *area = io_zcrx_iov_to_area(niov);
- spin_lock_bh(&area->freelist_lock);
+ guard(spinlock_bh)(&area->freelist_lock);
area->freelist[area->free_count++] = net_iov_idx(niov);
- spin_unlock_bh(&area->freelist_lock);
}
static void io_zcrx_return_niov(struct net_iov *niov)
@@ -829,7 +828,8 @@ static void io_zcrx_refill_slow(struct p
{
struct io_zcrx_area *area = ifq->area;
- spin_lock_bh(&area->freelist_lock);
+ guard(spinlock_bh)(&area->freelist_lock);
+
while (area->free_count && pp->alloc.count < PP_ALLOC_CACHE_REFILL) {
struct net_iov *niov = __io_zcrx_get_free_niov(area);
netmem_ref netmem = net_iov_to_netmem(niov);
@@ -838,7 +838,6 @@ static void io_zcrx_refill_slow(struct p
io_zcrx_sync_for_device(pp, niov);
net_mp_netmem_place_in_cache(pp, netmem);
}
- spin_unlock_bh(&area->freelist_lock);
}
static netmem_ref io_pp_zc_alloc_netmems(struct page_pool *pp, gfp_t gfp)
@@ -975,10 +974,10 @@ static struct net_iov *io_alloc_fallback
if (area->mem.is_dmabuf)
return NULL;
- spin_lock_bh(&area->freelist_lock);
- if (area->free_count)
- niov = __io_zcrx_get_free_niov(area);
- spin_unlock_bh(&area->freelist_lock);
+ scoped_guard(spinlock_bh, &area->freelist_lock) {
+ if (area->free_count)
+ niov = __io_zcrx_get_free_niov(area);
+ }
if (niov)
page_pool_fragment_netmem(net_iov_to_netmem(niov), 1);
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 145/188] io_uring/zcrx: warn on freelist violations
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (143 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 144/188] io_uring/zcrx: use guards for locking Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 146/188] LoongArch: KVM: Compile switch.S directly into the kernel Greg Kroah-Hartman
` (47 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kai Aizen, Pavel Begunkov,
Jens Axboe, Harshit Mogalapalli
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Begunkov <asml.silence@gmail.com>
commit 770594e78c3964cf23cf5287f849437cdde9b7d0 upstream.
The freelist is appropriately sized to always be able to take a free
niov, but let's be more defensive and check the invariant with a
warning. That should help to catch any double-free issues.
Suggested-by: Kai Aizen <kai@snailsploit.com>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://patch.msgid.link/2f3cea363b04649755e3b6bb9ab66485a95936d5.1776760901.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/zcrx.c | 2 ++
1 file changed, 2 insertions(+)
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -697,6 +697,8 @@ static void io_zcrx_return_niov_freelist
struct io_zcrx_area *area = io_zcrx_iov_to_area(niov);
guard(spinlock_bh)(&area->freelist_lock);
+ if (WARN_ON_ONCE(area->free_count >= area->nia.num_niovs))
+ return;
area->freelist[area->free_count++] = net_iov_idx(niov);
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 146/188] LoongArch: KVM: Compile switch.S directly into the kernel
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (144 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 145/188] io_uring/zcrx: warn on freelist violations Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 147/188] mm/damon/core: implement damon_kdamond_pid() Greg Kroah-Hartman
` (46 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xianglai Li, Huacai Chen
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xianglai Li <lixianglai@loongson.cn>
commit 5203012fa6045aac4b69d4e7c212e16dcf38ef10 upstream.
If we directly compile the switch.S file into the kernel, the address of
the kvm_exc_entry function will definitely be within the DMW memory area.
Therefore, we will no longer need to perform a copy relocation of the
kvm_exc_entry.
So this patch compiles switch.S directly into the kernel, and then remove
the copy relocation execution logic for the kvm_exc_entry function.
Cc: stable@vger.kernel.org
Signed-off-by: Xianglai Li <lixianglai@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/loongarch/Kbuild | 2 -
arch/loongarch/include/asm/asm-prototypes.h | 20 ++++++++++++++++
arch/loongarch/include/asm/kvm_host.h | 3 --
arch/loongarch/kvm/Makefile | 3 +-
arch/loongarch/kvm/main.c | 35 ++--------------------------
arch/loongarch/kvm/switch.S | 20 ++++++++++++----
6 files changed, 41 insertions(+), 42 deletions(-)
--- a/arch/loongarch/Kbuild
+++ b/arch/loongarch/Kbuild
@@ -3,7 +3,7 @@ obj-y += mm/
obj-y += net/
obj-y += vdso/
-obj-$(CONFIG_KVM) += kvm/
+obj-$(subst m,y,$(CONFIG_KVM)) += kvm/
# for cleaning
subdir- += boot
--- a/arch/loongarch/include/asm/asm-prototypes.h
+++ b/arch/loongarch/include/asm/asm-prototypes.h
@@ -20,3 +20,23 @@ asmlinkage void noinstr __no_stack_prote
struct pt_regs *regs,
int (*fn)(void *),
void *fn_arg);
+
+struct kvm_run;
+struct kvm_vcpu;
+struct loongarch_fpu;
+
+void kvm_exc_entry(void);
+int kvm_enter_guest(struct kvm_run *run, struct kvm_vcpu *vcpu);
+
+void kvm_save_fpu(struct loongarch_fpu *fpu);
+void kvm_restore_fpu(struct loongarch_fpu *fpu);
+
+#ifdef CONFIG_CPU_HAS_LSX
+void kvm_save_lsx(struct loongarch_fpu *fpu);
+void kvm_restore_lsx(struct loongarch_fpu *fpu);
+#endif
+
+#ifdef CONFIG_CPU_HAS_LASX
+void kvm_save_lasx(struct loongarch_fpu *fpu);
+void kvm_restore_lasx(struct loongarch_fpu *fpu);
+#endif
--- a/arch/loongarch/include/asm/kvm_host.h
+++ b/arch/loongarch/include/asm/kvm_host.h
@@ -85,7 +85,6 @@ struct kvm_context {
struct kvm_world_switch {
int (*exc_entry)(void);
int (*enter_guest)(struct kvm_run *run, struct kvm_vcpu *vcpu);
- unsigned long page_order;
};
#define MAX_PGTABLE_LEVELS 4
@@ -339,8 +338,6 @@ void kvm_exc_entry(void);
int kvm_enter_guest(struct kvm_run *run, struct kvm_vcpu *vcpu);
extern unsigned long vpid_mask;
-extern const unsigned long kvm_exception_size;
-extern const unsigned long kvm_enter_guest_size;
extern struct kvm_world_switch *kvm_loongarch_ops;
#define SW_GCSR (1 << 0)
--- a/arch/loongarch/kvm/Makefile
+++ b/arch/loongarch/kvm/Makefile
@@ -7,11 +7,12 @@ include $(srctree)/virt/kvm/Makefile.kvm
obj-$(CONFIG_KVM) += kvm.o
+obj-y += switch.o
+
kvm-y += exit.o
kvm-y += interrupt.o
kvm-y += main.o
kvm-y += mmu.o
-kvm-y += switch.o
kvm-y += timer.o
kvm-y += tlb.o
kvm-y += vcpu.o
--- a/arch/loongarch/kvm/main.c
+++ b/arch/loongarch/kvm/main.c
@@ -340,8 +340,7 @@ void kvm_arch_disable_virtualization_cpu
static int kvm_loongarch_env_init(void)
{
- int cpu, order, ret;
- void *addr;
+ int cpu, ret;
struct kvm_context *context;
vmcs = alloc_percpu(struct kvm_context);
@@ -357,30 +356,8 @@ static int kvm_loongarch_env_init(void)
return -ENOMEM;
}
- /*
- * PGD register is shared between root kernel and kvm hypervisor.
- * So world switch entry should be in DMW area rather than TLB area
- * to avoid page fault reenter.
- *
- * In future if hardware pagetable walking is supported, we won't
- * need to copy world switch code to DMW area.
- */
- order = get_order(kvm_exception_size + kvm_enter_guest_size);
- addr = (void *)__get_free_pages(GFP_KERNEL, order);
- if (!addr) {
- free_percpu(vmcs);
- vmcs = NULL;
- kfree(kvm_loongarch_ops);
- kvm_loongarch_ops = NULL;
- return -ENOMEM;
- }
-
- memcpy(addr, kvm_exc_entry, kvm_exception_size);
- memcpy(addr + kvm_exception_size, kvm_enter_guest, kvm_enter_guest_size);
- flush_icache_range((unsigned long)addr, (unsigned long)addr + kvm_exception_size + kvm_enter_guest_size);
- kvm_loongarch_ops->exc_entry = addr;
- kvm_loongarch_ops->enter_guest = addr + kvm_exception_size;
- kvm_loongarch_ops->page_order = order;
+ kvm_loongarch_ops->exc_entry = (void *)kvm_exc_entry;
+ kvm_loongarch_ops->enter_guest = (void *)kvm_enter_guest;
vpid_mask = read_csr_gstat();
vpid_mask = (vpid_mask & CSR_GSTAT_GIDBIT) >> CSR_GSTAT_GIDBIT_SHIFT;
@@ -414,16 +391,10 @@ static int kvm_loongarch_env_init(void)
static void kvm_loongarch_env_exit(void)
{
- unsigned long addr;
-
if (vmcs)
free_percpu(vmcs);
if (kvm_loongarch_ops) {
- if (kvm_loongarch_ops->exc_entry) {
- addr = (unsigned long)kvm_loongarch_ops->exc_entry;
- free_pages(addr, kvm_loongarch_ops->page_order);
- }
kfree(kvm_loongarch_ops);
}
--- a/arch/loongarch/kvm/switch.S
+++ b/arch/loongarch/kvm/switch.S
@@ -4,9 +4,11 @@
*/
#include <linux/linkage.h>
+#include <linux/kvm_types.h>
#include <asm/asm.h>
#include <asm/asmmacro.h>
#include <asm/loongarch.h>
+#include <asm/page.h>
#include <asm/regdef.h>
#include <asm/unwind_hints.h>
@@ -100,8 +102,13 @@
* - is still in guest mode, such as pgd table/vmid registers etc,
* - will fix with hw page walk enabled in future
* load kvm_vcpu from reserved CSR KVM_VCPU_KS, and save a2 to KVM_TEMP_KS
+ *
+ * PGD register is shared between root kernel and kvm hypervisor.
+ * So world switch entry should be in DMW area rather than TLB area
+ * to avoid page fault re-enter.
*/
.text
+ .p2align PAGE_SHIFT
.cfi_sections .debug_frame
SYM_CODE_START(kvm_exc_entry)
UNWIND_HINT_END_OF_STACK
@@ -190,8 +197,8 @@ ret_to_host:
kvm_restore_host_gpr a2
jr ra
-SYM_INNER_LABEL(kvm_exc_entry_end, SYM_L_LOCAL)
SYM_CODE_END(kvm_exc_entry)
+EXPORT_SYMBOL_GPL(kvm_exc_entry)
/*
* int kvm_enter_guest(struct kvm_run *run, struct kvm_vcpu *vcpu)
@@ -215,8 +222,8 @@ SYM_FUNC_START(kvm_enter_guest)
/* Save kvm_vcpu to kscratch */
csrwr a1, KVM_VCPU_KS
kvm_switch_to_guest
-SYM_INNER_LABEL(kvm_enter_guest_end, SYM_L_LOCAL)
SYM_FUNC_END(kvm_enter_guest)
+EXPORT_SYMBOL_GPL(kvm_enter_guest)
SYM_FUNC_START(kvm_save_fpu)
fpu_save_csr a0 t1
@@ -224,6 +231,7 @@ SYM_FUNC_START(kvm_save_fpu)
fpu_save_cc a0 t1 t2
jr ra
SYM_FUNC_END(kvm_save_fpu)
+EXPORT_SYMBOL_GPL(kvm_save_fpu)
SYM_FUNC_START(kvm_restore_fpu)
fpu_restore_double a0 t1
@@ -231,6 +239,7 @@ SYM_FUNC_START(kvm_restore_fpu)
fpu_restore_cc a0 t1 t2
jr ra
SYM_FUNC_END(kvm_restore_fpu)
+EXPORT_SYMBOL_GPL(kvm_restore_fpu)
#ifdef CONFIG_CPU_HAS_LSX
SYM_FUNC_START(kvm_save_lsx)
@@ -239,6 +248,7 @@ SYM_FUNC_START(kvm_save_lsx)
lsx_save_data a0 t1
jr ra
SYM_FUNC_END(kvm_save_lsx)
+EXPORT_SYMBOL_GPL(kvm_save_lsx)
SYM_FUNC_START(kvm_restore_lsx)
lsx_restore_data a0 t1
@@ -246,6 +256,7 @@ SYM_FUNC_START(kvm_restore_lsx)
fpu_restore_csr a0 t1 t2
jr ra
SYM_FUNC_END(kvm_restore_lsx)
+EXPORT_SYMBOL_GPL(kvm_restore_lsx)
#endif
#ifdef CONFIG_CPU_HAS_LASX
@@ -255,6 +266,7 @@ SYM_FUNC_START(kvm_save_lasx)
lasx_save_data a0 t1
jr ra
SYM_FUNC_END(kvm_save_lasx)
+EXPORT_SYMBOL_GPL(kvm_save_lasx)
SYM_FUNC_START(kvm_restore_lasx)
lasx_restore_data a0 t1
@@ -262,10 +274,8 @@ SYM_FUNC_START(kvm_restore_lasx)
fpu_restore_csr a0 t1 t2
jr ra
SYM_FUNC_END(kvm_restore_lasx)
+EXPORT_SYMBOL_GPL(kvm_restore_lasx)
#endif
- .section ".rodata"
-SYM_DATA(kvm_exception_size, .quad kvm_exc_entry_end - kvm_exc_entry)
-SYM_DATA(kvm_enter_guest_size, .quad kvm_enter_guest_end - kvm_enter_guest)
#ifdef CONFIG_CPU_HAS_LBT
STACK_FRAME_NON_STANDARD kvm_restore_fpu
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 147/188] mm/damon/core: implement damon_kdamond_pid()
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (145 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 146/188] LoongArch: KVM: Compile switch.S directly into the kernel Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 148/188] mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values Greg Kroah-Hartman
` (45 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, SeongJae Park, Andrew Morton
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <sj@kernel.org>
commit 4262c53236977de3ceaa3bf2aefdf772c9b874dd upstream.
Patch series "mm/damon: hide kdamond and kdamond_lock from API callers".
'kdamond' and 'kdamond_lock' fields initially exposed to DAMON API callers
for flexible synchronization and use cases. As DAMON API became somewhat
complicated compared to the early days, Keeping those exposed could only
encourage the API callers to invent more creative but complicated and
difficult-to-debug use cases.
Fortunately DAMON API callers didn't invent that many creative use cases.
There exist only two use cases of 'kdamond' and 'kdamond_lock'. Finding
whether the kdamond is actively running, and getting the pid of the
kdamond. For the first use case, a dedicated API function, namely
'damon_is_running()' is provided, and all DAMON API callers are using the
function for the use case. Hence only the second use case is where the
fields are directly being used by DAMON API callers.
To prevent future invention of complicated and erroneous use cases of the
fields, hide the fields from the API callers. For that, provide new
dedicated DAMON API functions for the remaining use case, namely
damon_kdamond_pid(), migrate DAMON API callers to use the new function,
and mark the fields as private fields.
This patch (of 5):
'kdamond' and 'kdamond_lock' are directly being used by DAMON API callers
for getting the pid of the corresponding kdamond. To discourage invention
of creative but complicated and erroneous new usages of the fields that
require careful synchronization, implement a new API function that can
simply be used without the manual synchronizations.
Link: https://lkml.kernel.org/r/20260115152047.68415-1-sj@kernel.org
Link: https://lkml.kernel.org/r/20260115152047.68415-2-sj@kernel.org
Signed-off-by: SeongJae Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/damon.h | 1 +
mm/damon/core.c | 17 +++++++++++++++++
2 files changed, 18 insertions(+)
--- a/include/linux/damon.h
+++ b/include/linux/damon.h
@@ -949,6 +949,7 @@ bool damon_initialized(void);
int damon_start(struct damon_ctx **ctxs, int nr_ctxs, bool exclusive);
int damon_stop(struct damon_ctx **ctxs, int nr_ctxs);
bool damon_is_running(struct damon_ctx *ctx);
+int damon_kdamond_pid(struct damon_ctx *ctx);
int damon_call(struct damon_ctx *ctx, struct damon_call_control *control);
int damos_walk(struct damon_ctx *ctx, struct damos_walk_control *control);
--- a/mm/damon/core.c
+++ b/mm/damon/core.c
@@ -1437,6 +1437,23 @@ bool damon_is_running(struct damon_ctx *
}
/**
+ * damon_kdamond_pid() - Return pid of a given DAMON context's worker thread.
+ * @ctx: The DAMON context of the question.
+ *
+ * Return: pid if @ctx is running, negative error code otherwise.
+ */
+int damon_kdamond_pid(struct damon_ctx *ctx)
+{
+ int pid = -EINVAL;
+
+ mutex_lock(&ctx->kdamond_lock);
+ if (ctx->kdamond)
+ pid = ctx->kdamond->pid;
+ mutex_unlock(&ctx->kdamond_lock);
+ return pid;
+}
+
+/**
* damon_call() - Invoke a given function on DAMON worker thread (kdamond).
* @ctx: DAMON context to call the function for.
* @control: Control variable of the call request.
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 148/188] mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (146 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 147/188] mm/damon/core: implement damon_kdamond_pid() Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 149/188] mm/damon/reclaim: " Greg Kroah-Hartman
` (44 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Liew Rui Yan, SeongJae Park,
Andrew Morton
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <sj@kernel.org>
commit b98b7ff6025ae82570d4915e083f0cbd8d48b3cf upstream.
DAMON_LRU_SORT updates 'enabled' and 'kdamond_pid' parameter values, which
represents the running status of its kdamond, when the user explicitly
requests start/stop of the kdamond. The kdamond can, however, be stopped
in events other than the explicit user request in the following three
events.
1. ctx->regions_score_histogram allocation failure at beginning of the
execution,
2. damon_commit_ctx() failure due to invalid user input, and
3. damon_commit_ctx() failure due to its internal allocation failures.
Hence, if the kdamond is stopped by the above three events, the values of
the status parameters can be stale. Users could show the stale values and
be confused. This is already bad, but the real consequence is worse.
DAMON_LRU_SORT avoids unnecessary damon_start() and damon_stop() calls
based on the 'enabled' parameter value. And the update of 'enabled'
parameter value depends on the damon_start() and damon_stop() call
results. Hence, once the kdamond has stopped by the unintentional events,
the user cannot restart the kdamond before the system reboot. For
example, the issue can be reproduced via below steps.
# cd /sys/module/damon_lru_sort/parameters
#
# # start DAMON_LRU_SORT
# echo Y > enabled
# ps -ef | grep kdamond
root 806 2 0 17:53 ? 00:00:00 [kdamond.0]
root 808 803 0 17:53 pts/4 00:00:00 grep kdamond
#
# # commit wrong input to stop kdamond withou explicit stop request
# echo 3 > addr_unit
# echo Y > commit_inputs
bash: echo: write error: Invalid argument
#
# # confirm kdamond is stopped
# ps -ef | grep kdamond
root 811 803 0 17:53 pts/4 00:00:00 grep kdamond
#
# # users casn now show stable status
# cat enabled
Y
# cat kdamond_pid
806
#
# # even after fixing the wrong parameter,
# # kdamond cannot be restarted.
# echo 1 > addr_unit
# echo Y > enabled
# ps -ef | grep kdamond
root 815 803 0 17:54 pts/4 00:00:00 grep kdamond
The problem will only rarely happen in real and common setups for the
following reasons. The allocation failures are unlikely in such setups
since those allocations are arguably too small to fail. Also sane users
on real production environments may not commit wrong input parameters.
But once it happens, the consequence is quite bad. And the bug is a bug.
The issue stems from the fact that there are multiple events that can
change the status, and following all the events is challenging.
Dynamically detect and use the fresh status for the parameters when those
are requested.
Link: https://lore.kernel.org/20260419161003.79176-3-sj@kernel.org
Fixes: 40e983cca927 ("mm/damon: introduce DAMON-based LRU-lists Sorting")
Co-developed-by: Liew Rui Yan <aethernet65535@gmail.com>
Signed-off-by: Liew Rui Yan <aethernet65535@gmail.com>
Signed-off-by: SeongJae Park <sj@kernel.org>
Cc: <stable@vger.kernel.org> # 6.0.x
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/damon/lru_sort.c | 83 ++++++++++++++++++++++++++++++++++------------------
1 file changed, 55 insertions(+), 28 deletions(-)
--- a/mm/damon/lru_sort.c
+++ b/mm/damon/lru_sort.c
@@ -118,15 +118,6 @@ module_param(monitor_region_end, ulong,
*/
static unsigned long addr_unit __read_mostly = 1;
-/*
- * PID of the DAMON thread
- *
- * If DAMON_LRU_SORT is enabled, this becomes the PID of the worker thread.
- * Else, -1.
- */
-static int kdamond_pid __read_mostly = -1;
-module_param(kdamond_pid, int, 0400);
-
static struct damos_stat damon_lru_sort_hot_stat;
DEFINE_DAMON_MODULES_DAMOS_STATS_PARAMS(damon_lru_sort_hot_stat,
lru_sort_tried_hot_regions, lru_sorted_hot_regions,
@@ -288,12 +279,8 @@ static int damon_lru_sort_turn(bool on)
{
int err;
- if (!on) {
- err = damon_stop(&ctx, 1);
- if (!err)
- kdamond_pid = -1;
- return err;
- }
+ if (!on)
+ return damon_stop(&ctx, 1);
err = damon_lru_sort_apply_parameters();
if (err)
@@ -302,7 +289,6 @@ static int damon_lru_sort_turn(bool on)
err = damon_start(&ctx, 1, true);
if (err)
return err;
- kdamond_pid = ctx->kdamond->pid;
return damon_call(ctx, &call_control);
}
@@ -330,42 +316,83 @@ module_param_cb(addr_unit, &addr_unit_pa
MODULE_PARM_DESC(addr_unit,
"Scale factor for DAMON_LRU_SORT to ops address conversion (default: 1)");
+static bool damon_lru_sort_enabled(void)
+{
+ if (!ctx)
+ return false;
+ return damon_is_running(ctx);
+}
+
static int damon_lru_sort_enabled_store(const char *val,
const struct kernel_param *kp)
{
- bool is_enabled = enabled;
- bool enable;
int err;
- err = kstrtobool(val, &enable);
+ err = kstrtobool(val, &enabled);
if (err)
return err;
- if (is_enabled == enable)
+ if (damon_lru_sort_enabled() == enabled)
return 0;
/* Called before init function. The function will handle this. */
if (!damon_initialized())
- goto set_param_out;
+ return 0;
- err = damon_lru_sort_turn(enable);
- if (err)
- return err;
+ return damon_lru_sort_turn(enabled);
+}
-set_param_out:
- enabled = enable;
- return err;
+static int damon_lru_sort_enabled_load(char *buffer,
+ const struct kernel_param *kp)
+{
+ return sprintf(buffer, "%c\n", damon_lru_sort_enabled() ? 'Y' : 'N');
}
static const struct kernel_param_ops enabled_param_ops = {
.set = damon_lru_sort_enabled_store,
- .get = param_get_bool,
+ .get = damon_lru_sort_enabled_load,
};
module_param_cb(enabled, &enabled_param_ops, &enabled, 0600);
MODULE_PARM_DESC(enabled,
"Enable or disable DAMON_LRU_SORT (default: disabled)");
+static int damon_lru_sort_kdamond_pid_store(const char *val,
+ const struct kernel_param *kp)
+{
+ /*
+ * kdamond_pid is read-only, but kernel command line could write it.
+ * Do nothing here.
+ */
+ return 0;
+}
+
+static int damon_lru_sort_kdamond_pid_load(char *buffer,
+ const struct kernel_param *kp)
+{
+ int kdamond_pid = -1;
+
+ if (ctx) {
+ kdamond_pid = damon_kdamond_pid(ctx);
+ if (kdamond_pid < 0)
+ kdamond_pid = -1;
+ }
+ return sprintf(buffer, "%d\n", kdamond_pid);
+}
+
+static const struct kernel_param_ops kdamond_pid_param_ops = {
+ .set = damon_lru_sort_kdamond_pid_store,
+ .get = damon_lru_sort_kdamond_pid_load,
+};
+
+/*
+ * PID of the DAMON thread
+ *
+ * If DAMON_LRU_SORT is enabled, this becomes the PID of the worker thread.
+ * Else, -1.
+ */
+module_param_cb(kdamond_pid, &kdamond_pid_param_ops, NULL, 0400);
+
static int __init damon_lru_sort_init(void)
{
int err;
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 149/188] mm/damon/reclaim: detect and use fresh enabled and kdamond_pid values
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (147 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 148/188] mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 150/188] usb: typec: tcpm: reset internal port states on soft reset AMS Greg Kroah-Hartman
` (43 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Liew Rui Yan, SeongJae Park,
Andrew Morton
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <sj@kernel.org>
commit 64a140afa5ed1c6f5ba6d451512cbdbbab1ba339 upstream.
Patch series "mm/damon/modules: detect and use fresh status", v3.
DAMON modules including DAMON_RECLAIM, DAMON_LRU_SORT and DAMON_STAT
commonly expose the kdamond running status via their parameters. Under
certain scenarios including wrong user inputs and memory allocation
failures, those parameter values can be stale. It can confuse users. For
DAMON_RECLAIM and DAMON_LRU_SORT, it even makes the kdamond unable to be
restarted before the system reboot.
The problem comes from the fact that there are multiple events for the
status changes and it is difficult to follow up all the scenarios. Fix
the issue by detecting and using the status on demand, instead of using a
cached status that is difficult to be updated.
Patches 1-3 fix the bugs in DAMON_RECLAIM, DAMON_LRU_SORT and DAMON_STAT
in the order.
This patch (of 3):
DAMON_RECLAIM updates 'enabled' and 'kdamond_pid' parameter values, which
represents the running status of its kdamond, when the user explicitly
requests start/stop of the kdamond. The kdamond can, however, be stopped
in events other than the explicit user request in the following three
events.
1. ctx->regions_score_histogram allocation failure at beginning of the
execution,
2. damon_commit_ctx() failure due to invalid user input, and
3. damon_commit_ctx() failure due to its internal allocation failures.
Hence, if the kdamond is stopped by the above three events, the values of
the status parameters can be stale. Users could show the stale values and
be confused. This is already bad, but the real consequence is worse.
DAMON_RECLAIM avoids unnecessary damon_start() and damon_stop() calls
based on the 'enabled' parameter value. And the update of 'enabled'
parameter value depends on the damon_start() and damon_stop() call
results. Hence, once the kdamond has stopped by the unintentional events,
the user cannot restart the kdamond before the system reboot. For
example, the issue can be reproduced via below steps.
# cd /sys/module/damon_reclaim/parameters
#
# # start DAMON_RECLAIM
# echo Y > enabled
# ps -ef | grep kdamond
root 806 2 0 17:53 ? 00:00:00 [kdamond.0]
root 808 803 0 17:53 pts/4 00:00:00 grep kdamond
#
# # commit wrong input to stop kdamond withou explicit stop request
# echo 3 > addr_unit
# echo Y > commit_inputs
bash: echo: write error: Invalid argument
#
# # confirm kdamond is stopped
# ps -ef | grep kdamond
root 811 803 0 17:53 pts/4 00:00:00 grep kdamond
#
# # users casn now show stable status
# cat enabled
Y
# cat kdamond_pid
806
#
# # even after fixing the wrong parameter,
# # kdamond cannot be restarted.
# echo 1 > addr_unit
# echo Y > enabled
# ps -ef | grep kdamond
root 815 803 0 17:54 pts/4 00:00:00 grep kdamond
The problem will only rarely happen in real and common setups for the
following reasons. The allocation failures are unlikely in such setups
since those allocations are arguably too small to fail. Also sane users
on real production environments may not commit wrong input parameters.
But once it happens, the consequence is quite bad. And the bug is a bug.
The issue stems from the fact that there are multiple events that can
change the status, and following all the events is challenging.
Dynamically detect and use the fresh status for the parameters when those
are requested.
Link: https://lore.kernel.org/20260419161003.79176-1-sj@kernel.org
Link: https://lore.kernel.org/20260419161003.79176-2-sj@kernel.org
Fixes: e035c280f6df ("mm/damon/reclaim: support online inputs update")
Co-developed-by: Liew Rui Yan <aethernet65535@gmail.com>
Signed-off-by: Liew Rui Yan <aethernet65535@gmail.com>
Signed-off-by: SeongJae Park <sj@kernel.org>
Cc: <stable@vger.kernel.org> # 5.19.x
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/damon/reclaim.c | 83 +++++++++++++++++++++++++++++++++++------------------
1 file changed, 55 insertions(+), 28 deletions(-)
--- a/mm/damon/reclaim.c
+++ b/mm/damon/reclaim.c
@@ -144,15 +144,6 @@ static unsigned long addr_unit __read_mo
static bool skip_anon __read_mostly;
module_param(skip_anon, bool, 0600);
-/*
- * PID of the DAMON thread
- *
- * If DAMON_RECLAIM is enabled, this becomes the PID of the worker thread.
- * Else, -1.
- */
-static int kdamond_pid __read_mostly = -1;
-module_param(kdamond_pid, int, 0400);
-
static struct damos_stat damon_reclaim_stat;
DEFINE_DAMON_MODULES_DAMOS_STATS_PARAMS(damon_reclaim_stat,
reclaim_tried_regions, reclaimed_regions, quota_exceeds);
@@ -292,12 +283,8 @@ static int damon_reclaim_turn(bool on)
{
int err;
- if (!on) {
- err = damon_stop(&ctx, 1);
- if (!err)
- kdamond_pid = -1;
- return err;
- }
+ if (!on)
+ return damon_stop(&ctx, 1);
err = damon_reclaim_apply_parameters();
if (err)
@@ -306,7 +293,6 @@ static int damon_reclaim_turn(bool on)
err = damon_start(&ctx, 1, true);
if (err)
return err;
- kdamond_pid = ctx->kdamond->pid;
return damon_call(ctx, &call_control);
}
@@ -334,42 +320,83 @@ module_param_cb(addr_unit, &addr_unit_pa
MODULE_PARM_DESC(addr_unit,
"Scale factor for DAMON_RECLAIM to ops address conversion (default: 1)");
+static bool damon_reclaim_enabled(void)
+{
+ if (!ctx)
+ return false;
+ return damon_is_running(ctx);
+}
+
static int damon_reclaim_enabled_store(const char *val,
const struct kernel_param *kp)
{
- bool is_enabled = enabled;
- bool enable;
int err;
- err = kstrtobool(val, &enable);
+ err = kstrtobool(val, &enabled);
if (err)
return err;
- if (is_enabled == enable)
+ if (damon_reclaim_enabled() == enabled)
return 0;
/* Called before init function. The function will handle this. */
if (!damon_initialized())
- goto set_param_out;
+ return 0;
- err = damon_reclaim_turn(enable);
- if (err)
- return err;
+ return damon_reclaim_turn(enabled);
+}
-set_param_out:
- enabled = enable;
- return err;
+static int damon_reclaim_enabled_load(char *buffer,
+ const struct kernel_param *kp)
+{
+ return sprintf(buffer, "%c\n", damon_reclaim_enabled() ? 'Y' : 'N');
}
static const struct kernel_param_ops enabled_param_ops = {
.set = damon_reclaim_enabled_store,
- .get = param_get_bool,
+ .get = damon_reclaim_enabled_load,
};
module_param_cb(enabled, &enabled_param_ops, &enabled, 0600);
MODULE_PARM_DESC(enabled,
"Enable or disable DAMON_RECLAIM (default: disabled)");
+static int damon_reclaim_kdamond_pid_store(const char *val,
+ const struct kernel_param *kp)
+{
+ /*
+ * kdamond_pid is read-only, but kernel command line could write it.
+ * Do nothing here.
+ */
+ return 0;
+}
+
+static int damon_reclaim_kdamond_pid_load(char *buffer,
+ const struct kernel_param *kp)
+{
+ int kdamond_pid = -1;
+
+ if (ctx) {
+ kdamond_pid = damon_kdamond_pid(ctx);
+ if (kdamond_pid < 0)
+ kdamond_pid = -1;
+ }
+ return sprintf(buffer, "%d\n", kdamond_pid);
+}
+
+static const struct kernel_param_ops kdamond_pid_param_ops = {
+ .set = damon_reclaim_kdamond_pid_store,
+ .get = damon_reclaim_kdamond_pid_load,
+};
+
+/*
+ * PID of the DAMON thread
+ *
+ * If DAMON_RECLAIM is enabled, this becomes the PID of the worker thread.
+ * Else, -1.
+ */
+module_param_cb(kdamond_pid, &kdamond_pid_param_ops, NULL, 0400);
+
static int __init damon_reclaim_init(void)
{
int err;
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 150/188] usb: typec: tcpm: reset internal port states on soft reset AMS
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (148 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 149/188] mm/damon/reclaim: " Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 151/188] mm/damon/core: disallow time-quota setting zero esz Greg Kroah-Hartman
` (42 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Amit Sunil Dhamne, stable,
Badhri Jagan Sridharan, Heikki Krogerus
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amit Sunil Dhamne <amitsd@google.com>
commit 2909f0d4994fb4306bf116df5ccee797791fce2c upstream.
Reset internal port states (such as vdm_sm_running and
explicit_contract) on soft reset AMS as the port needs to negotiate a
new contract. The consequence of leaving the states in as-is cond are as
follows:
* port is in SRC power role and an explicit contract is negotiated
with the port partner (in sink role)
* port partner sends a Soft Reset AMS while VDM State Machine is
running
* port accepts the Soft Reset request and the port advertises src caps
* port partner sends a Request message but since the explicit_contract
and vdm_sm_running are true from previous negotiation, the port ends
up sending Soft Reset instead of Accept msg.
Stub Log:
[ 203.653942] AMS DISCOVER_IDENTITY start
[ 203.653947] PD TX, header: 0x176f
[ 203.655901] PD TX complete, status: 0
[ 203.657470] PD RX, header: 0x124f [1]
[ 203.657477] Rx VDM cmd 0xff008081 type 2 cmd 1 len 1
[ 203.657482] AMS DISCOVER_IDENTITY finished
[ 203.657484] cc:=4
[ 204.155698] PD RX, header: 0x144f [1]
[ 204.155718] Rx VDM cmd 0xeeee8001 type 0 cmd 1 len 1
[ 204.155741] PD TX, header: 0x196f
[ 204.157622] PD TX complete, status: 0
[ 204.160060] PD RX, header: 0x4d [1]
[ 204.160066] state change SRC_READY -> SOFT_RESET [rev2 SOFT_RESET_AMS]
[ 204.160076] PD TX, header: 0x163
[ 204.162486] PD TX complete, status: 0
[ 204.162832] AMS SOFT_RESET_AMS finished
[ 204.162840] cc:=4
[ 204.162891] AMS POWER_NEGOTIATION start
[ 204.162896] state change SOFT_RESET -> AMS_START [rev2 POWER_NEGOTIATION]
[ 204.162908] state change AMS_START -> SRC_SEND_CAPABILITIES [rev2 POWER_NEGOTIATION]
[ 204.162913] PD TX, header: 0x1361
[ 204.165529] PD TX complete, status: 0
[ 204.165571] pending state change SRC_SEND_CAPABILITIES -> SRC_SEND_CAPABILITIES_TIMEOUT @ 60 ms [rev2 POWER_NEGOTIATION]
[ 204.166996] PD RX, header: 0x1242 [1]
[ 204.167009] state change SRC_SEND_CAPABILITIES -> SRC_SOFT_RESET_WAIT_SNK_TX [rev2 POWER_NEGOTIATION]
[ 204.167019] AMS POWER_NEGOTIATION finished
[ 204.167020] cc:=4
[ 204.167083] AMS SOFT_RESET_AMS start
[ 204.167086] state change SRC_SOFT_RESET_WAIT_SNK_TX -> SOFT_RESET_SEND [rev2 SOFT_RESET_AMS]
[ 204.167092] PD TX, header: 0x16d
[ 204.168824] PD TX complete, status: 0
[ 204.168854] pending state change SOFT_RESET_SEND -> HARD_RESET_SEND @ 60 ms [rev2 SOFT_RESET_AMS]
[ 204.171876] PD RX, header: 0x43 [1]
[ 204.171879] AMS SOFT_RESET_AMS finished
This causes COMMON.PROC.PD.11.2 check failure for
TEST.PD.VDM.SRC.2_Rev2Src test on the PD compliance tester.
Signed-off-by: Amit Sunil Dhamne <amitsd@google.com>
Fixes: 8d3a0578ad1a ("usb: typec: tcpm: Respond Wait if VDM state machine is running")
Fixes: f0690a25a140 ("staging: typec: USB Type-C Port Manager (tcpm)")
Cc: stable <stable@kernel.org>
Reviewed-by: Badhri Jagan Sridharan <badhri@google.com>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://patch.msgid.link/20260414-fix-soft-reset-v1-1-01d7cb9764e2@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/typec/tcpm/tcpm.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/typec/tcpm/tcpm.c
+++ b/drivers/usb/typec/tcpm/tcpm.c
@@ -5526,6 +5526,8 @@ static void run_state_machine(struct tcp
usb_power_delivery_unregister_capabilities(port->partner_source_caps);
port->partner_source_caps = NULL;
tcpm_pd_send_control(port, PD_CTRL_ACCEPT, TCPC_TX_SOP);
+ port->vdm_sm_running = false;
+ port->explicit_contract = false;
tcpm_ams_finish(port);
if (port->pwr_role == TYPEC_SOURCE) {
port->upcoming_state = SRC_SEND_CAPABILITIES;
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 151/188] mm/damon/core: disallow time-quota setting zero esz
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (149 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 150/188] usb: typec: tcpm: reset internal port states on soft reset AMS Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 152/188] drm/amdgpu: validate the flush_gpu_tlb_pasid() Greg Kroah-Hartman
` (41 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, SeongJae Park, Andrew Morton
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <sj@kernel.org>
commit 8bbde987c2b84f80da0853f739f0a920386f8b99 upstream.
When the throughput of a DAMOS scheme is very slow, DAMOS time quota can
make the effective size quota smaller than damon_ctx->min_region_sz. In
the case, damos_apply_scheme() will skip applying the action, because the
action is tried at region level, which requires >=min_region_sz size.
That is, the quota is effectively exceeded for the quota charge window.
Because no action will be applied, the total_charged_sz and
total_charged_ns are also not updated. damos_set_effective_quota() will
try to update the effective size quota before starting the next charge
window. However, because the total_charged_sz and total_charged_ns have
not updated, the throughput and effective size quota are also not changed.
Since effective size quota can only be decreased, other effective size
quota update factors including DAMOS quota goals and size quota cannot
make any change, either.
As a result, the scheme is unexpectedly deactivated until the user notices
and mitigates the situation. The users can mitigate this situation by
changing the time quota online or re-install the scheme. While the
mitigation is somewhat straightforward, finding the situation would be
challenging, because DAMON is not providing good observabilities for that.
Even if such observability is provided, doing the additional monitoring
and the mitigation is somewhat cumbersome and not aligned to the intention
of the time quota. The time quota was intended to help reduce the user's
administration overhead.
Fix the problem by setting time quota-modified effective size quota be at
least min_region_sz always.
The issue was discovered [1] by sashiko.
Link: https://lore.kernel.org/20260407003153.79589-1-sj@kernel.org
Link: https://lore.kernel.org/20260405192504.110014-1-sj@kernel.org [1]
Fixes: 1cd243030059 ("mm/damon/schemes: implement time quota")
Signed-off-by: SeongJae Park <sj@kernel.org>
Cc: <stable@vger.kernel.org> # 5.16.x
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/damon/core.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/mm/damon/core.c
+++ b/mm/damon/core.c
@@ -2135,7 +2135,8 @@ static unsigned long damos_quota_score(s
/*
* Called only if quota->ms, or quota->sz are set, or quota->goals is not empty
*/
-static void damos_set_effective_quota(struct damos_quota *quota)
+static void damos_set_effective_quota(struct damos_quota *quota,
+ struct damon_ctx *ctx)
{
unsigned long throughput;
unsigned long esz = ULONG_MAX;
@@ -2161,6 +2162,7 @@ static void damos_set_effective_quota(st
else
throughput = PAGE_SIZE * 1024;
esz = min(throughput * quota->ms, esz);
+ esz = max(ctx->min_sz_region, esz);
}
if (quota->sz && quota->sz < esz)
@@ -2197,7 +2199,7 @@ static void damos_adjust_quota(struct da
/* First charge window */
if (!quota->total_charged_sz && !quota->charged_from) {
quota->charged_from = jiffies;
- damos_set_effective_quota(quota);
+ damos_set_effective_quota(quota, c);
}
/* New charge window starts */
@@ -2211,7 +2213,7 @@ static void damos_adjust_quota(struct da
quota->charged_sz = 0;
if (trace_damos_esz_enabled())
cached_esz = quota->esz;
- damos_set_effective_quota(quota);
+ damos_set_effective_quota(quota, c);
if (trace_damos_esz_enabled() && quota->esz != cached_esz)
damos_trace_esz(c, s, quota);
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 152/188] drm/amdgpu: validate the flush_gpu_tlb_pasid()
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (150 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 151/188] mm/damon/core: disallow time-quota setting zero esz Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 153/188] drm/amdgpu: Fix validating flush_gpu_tlb_pasid() Greg Kroah-Hartman
` (40 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Prike Liang, Christian König,
Alex Deucher
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prike Liang <Prike.Liang@amd.com>
commit f4db9913e4d3dabe9ff3ea6178f2c1bc286012b8 upstream.
Validate flush_gpu_tlb_pasid() availability before flushing tlb.
Signed-off-by: Prike Liang <Prike.Liang@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
@@ -737,6 +737,10 @@ int amdgpu_gmc_flush_gpu_tlb_pasid(struc
return 0;
if (!adev->gmc.flush_pasid_uses_kiq || !ring->sched.ready) {
+
+ if (!adev->gmc.gmc_funcs->flush_gpu_tlb_pasid)
+ return 0;
+
if (adev->gmc.flush_tlb_needs_extra_type_2)
adev->gmc.gmc_funcs->flush_gpu_tlb_pasid(adev, pasid,
2, all_hub,
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 153/188] drm/amdgpu: Fix validating flush_gpu_tlb_pasid()
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (151 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 152/188] drm/amdgpu: validate the flush_gpu_tlb_pasid() Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 154/188] Revert "drm/amdgpu: dont attach the tlb fence for SI" Greg Kroah-Hartman
` (39 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Dan Carpenter,
Timur Kristóf, Prike Liang, Christian König,
Alex Deucher
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Kristóf <timur.kristof@gmail.com>
commit e3a6eff92bbd960b471966d9afccb4d584546d17 upstream.
When a function holds a lock and we return without unlocking it,
it deadlocks the kernel. We should always unlock before returning.
This commit fixes suspend/resume on SI.
Tested on two Tahiti GPUs: FirePro W9000 and R9 280X.
Fixes: f4db9913e4d3 ("drm/amdgpu: validate the flush_gpu_tlb_pasid()")
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/r/202601190121.z9C0uml5-lkp@intel.com/
Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
Signed-off-by: Prike Liang <Prike.Liang@amd.com>
Reviewed-by: Prike Liang <Prike.Liang@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
@@ -738,8 +738,10 @@ int amdgpu_gmc_flush_gpu_tlb_pasid(struc
if (!adev->gmc.flush_pasid_uses_kiq || !ring->sched.ready) {
- if (!adev->gmc.gmc_funcs->flush_gpu_tlb_pasid)
- return 0;
+ if (!adev->gmc.gmc_funcs->flush_gpu_tlb_pasid) {
+ r = 0;
+ goto error_unlock_reset;
+ }
if (adev->gmc.flush_tlb_needs_extra_type_2)
adev->gmc.gmc_funcs->flush_gpu_tlb_pasid(adev, pasid,
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 154/188] Revert "drm/amdgpu: dont attach the tlb fence for SI"
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (152 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 153/188] drm/amdgpu: Fix validating flush_gpu_tlb_pasid() Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 155/188] drm/amdgpu: rework how we handle TLB fences Greg Kroah-Hartman
` (38 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Prike Liang, Christian König,
Alex Deucher
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prike Liang <Prike.Liang@amd.com>
commit 9163fe4d790fb4e16d6b0e23f55b43cddd3d4a65 upstream.
This reverts commit 820b3d376e8a102c6aeab737ec6edebbbb710e04.
It’s better to validate VM TLB flushes in the flush‑TLB backend
rather than in the generic VM layer.
Reverting this patch depends on
commit fa7c231fc2b0 ("drm/amdgpu: validate the flush_gpu_tlb_pasid()")
being present in the tree.
Signed-off-by: Prike Liang <Prike.Liang@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -1066,9 +1066,7 @@ amdgpu_vm_tlb_flush(struct amdgpu_vm_upd
}
/* Prepare a TLB flush fence to be attached to PTs */
- if (!params->unlocked &&
- /* SI doesn't support pasid or KIQ/MES */
- params->adev->family > AMDGPU_FAMILY_SI) {
+ if (!params->unlocked) {
amdgpu_vm_tlb_fence_create(params->adev, vm, fence);
/* Makes sure no PD/PT is freed before the flush */
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 155/188] drm/amdgpu: rework how we handle TLB fences
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (153 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 154/188] Revert "drm/amdgpu: dont attach the tlb fence for SI" Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 156/188] fbcon: Rename struct fbcon_ops to struct fbcon_par Greg Kroah-Hartman
` (37 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian König, Prike Liang,
Alex Deucher
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 69c5fbd2b93b5ced77c6e79afe83371bca84c788 upstream.
Add a new VM flag to indicate whether or not we need
a TLB fence. Userqs (KFD or KGD) require a TLB fence.
A TLB fence is not strictly required for kernel queues,
but it shouldn't hurt. That said, enabling this
unconditionally should be fine, but it seems to tickle
some issues in KIQ/MES. Only enable them for KFD,
or when KGD userq queues are enabled (currently via module
parameter).
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4798
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4749
Fixes: f3854e04b708 ("drm/amdgpu: attach tlb fence to the PTs update")
Cc: Christian König <christian.koenig@amd.com>
Cc: Prike Liang <Prike.Liang@amd.com>
Reviewed-by: Prike Liang <Prike.Liang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 7 ++++++-
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h | 2 ++
2 files changed, 8 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -1066,7 +1066,10 @@ amdgpu_vm_tlb_flush(struct amdgpu_vm_upd
}
/* Prepare a TLB flush fence to be attached to PTs */
- if (!params->unlocked) {
+ /* The check for need_tlb_fence should be dropped once we
+ * sort out the issues with KIQ/MES TLB invalidation timeouts.
+ */
+ if (!params->unlocked && vm->need_tlb_fence) {
amdgpu_vm_tlb_fence_create(params->adev, vm, fence);
/* Makes sure no PD/PT is freed before the flush */
@@ -2584,6 +2587,7 @@ int amdgpu_vm_init(struct amdgpu_device
ttm_lru_bulk_move_init(&vm->lru_bulk_move);
vm->is_compute_context = false;
+ vm->need_tlb_fence = amdgpu_userq_enabled(&adev->ddev);
vm->use_cpu_for_update = !!(adev->vm_manager.vm_update_mode &
AMDGPU_VM_USE_CPU_FOR_GFX);
@@ -2721,6 +2725,7 @@ int amdgpu_vm_make_compute(struct amdgpu
dma_fence_put(vm->last_update);
vm->last_update = dma_fence_get_stub();
vm->is_compute_context = true;
+ vm->need_tlb_fence = true;
unreserve_bo:
amdgpu_bo_unreserve(vm->root.bo);
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.h
@@ -439,6 +439,8 @@ struct amdgpu_vm {
struct ttm_lru_bulk_move lru_bulk_move;
/* Flag to indicate if VM is used for compute */
bool is_compute_context;
+ /* Flag to indicate if VM needs a TLB fence (KFD or KGD) */
+ bool need_tlb_fence;
/* Memory partition number, -1 means any partition */
int8_t mem_id;
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 156/188] fbcon: Rename struct fbcon_ops to struct fbcon_par
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (154 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 155/188] drm/amdgpu: rework how we handle TLB fences Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 157/188] fbcon: Avoid OOB font access if console rotation fails Greg Kroah-Hartman
` (36 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Zimmermann, Sam Ravnborg,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <tzimmermann@suse.de>
[ Upstream commit a6adbbc4c32a016146e117b1e9e5242724a75e10 ]
The type struct fbcon_ops contains fbcon state and callbacks. As the
callbacks will be removed from struct fbcon_ops, rename the data type
to struct fbcon_par. Also rename the variables from ops to par.
The _par postfix ("private access registers") is used throughout the
fbdev subsystem for per-driver state. The fbcon pointer within struct
fb_info is also named fbcon_par. Hence, the new naming fits existing
practice.
v2:
- rename struct fbcon_ops to struct fbcon_par
- fix build for CONFIG_FB_TILEBITTING=n (kernel test robot)
- fix indention
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://lore.kernel.org/r/20250909124616.143365-3-tzimmermann@suse.de
Stable-dep-of: e4ef723d8975 ("fbcon: Avoid OOB font access if console rotation fails")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/core/bitblit.c | 120 ++++-----
drivers/video/fbdev/core/fbcon.c | 419 +++++++++++++++-----------------
drivers/video/fbdev/core/fbcon.h | 6
drivers/video/fbdev/core/fbcon_ccw.c | 146 +++++------
drivers/video/fbdev/core/fbcon_cw.c | 146 +++++------
drivers/video/fbdev/core/fbcon_rotate.c | 40 +--
drivers/video/fbdev/core/fbcon_rotate.h | 6
drivers/video/fbdev/core/fbcon_ud.c | 162 ++++++------
drivers/video/fbdev/core/softcursor.c | 20 -
drivers/video/fbdev/core/tileblit.c | 28 +-
10 files changed, 541 insertions(+), 552 deletions(-)
--- a/drivers/video/fbdev/core/bitblit.c
+++ b/drivers/video/fbdev/core/bitblit.c
@@ -261,10 +261,10 @@ static void bit_cursor(struct vc_data *v
int fg, int bg)
{
struct fb_cursor cursor;
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
unsigned short charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff;
int w = DIV_ROUND_UP(vc->vc_font.width, 8), c;
- int y = real_y(ops->p, vc->state.y);
+ int y = real_y(par->p, vc->state.y);
int attribute, use_sw = vc->vc_cursor_type & CUR_SW;
int err = 1;
char *src;
@@ -278,10 +278,10 @@ static void bit_cursor(struct vc_data *v
attribute = get_attribute(info, c);
src = vc->vc_font.data + ((c & charmask) * (w * vc->vc_font.height));
- if (ops->cursor_state.image.data != src ||
- ops->cursor_reset) {
- ops->cursor_state.image.data = src;
- cursor.set |= FB_CUR_SETIMAGE;
+ if (par->cursor_state.image.data != src ||
+ par->cursor_reset) {
+ par->cursor_state.image.data = src;
+ cursor.set |= FB_CUR_SETIMAGE;
}
if (attribute) {
@@ -290,46 +290,46 @@ static void bit_cursor(struct vc_data *v
dst = kmalloc_array(w, vc->vc_font.height, GFP_ATOMIC);
if (!dst)
return;
- kfree(ops->cursor_data);
- ops->cursor_data = dst;
+ kfree(par->cursor_data);
+ par->cursor_data = dst;
update_attr(dst, src, attribute, vc);
src = dst;
}
- if (ops->cursor_state.image.fg_color != fg ||
- ops->cursor_state.image.bg_color != bg ||
- ops->cursor_reset) {
- ops->cursor_state.image.fg_color = fg;
- ops->cursor_state.image.bg_color = bg;
+ if (par->cursor_state.image.fg_color != fg ||
+ par->cursor_state.image.bg_color != bg ||
+ par->cursor_reset) {
+ par->cursor_state.image.fg_color = fg;
+ par->cursor_state.image.bg_color = bg;
cursor.set |= FB_CUR_SETCMAP;
}
- if ((ops->cursor_state.image.dx != (vc->vc_font.width * vc->state.x)) ||
- (ops->cursor_state.image.dy != (vc->vc_font.height * y)) ||
- ops->cursor_reset) {
- ops->cursor_state.image.dx = vc->vc_font.width * vc->state.x;
- ops->cursor_state.image.dy = vc->vc_font.height * y;
+ if ((par->cursor_state.image.dx != (vc->vc_font.width * vc->state.x)) ||
+ (par->cursor_state.image.dy != (vc->vc_font.height * y)) ||
+ par->cursor_reset) {
+ par->cursor_state.image.dx = vc->vc_font.width * vc->state.x;
+ par->cursor_state.image.dy = vc->vc_font.height * y;
cursor.set |= FB_CUR_SETPOS;
}
- if (ops->cursor_state.image.height != vc->vc_font.height ||
- ops->cursor_state.image.width != vc->vc_font.width ||
- ops->cursor_reset) {
- ops->cursor_state.image.height = vc->vc_font.height;
- ops->cursor_state.image.width = vc->vc_font.width;
+ if (par->cursor_state.image.height != vc->vc_font.height ||
+ par->cursor_state.image.width != vc->vc_font.width ||
+ par->cursor_reset) {
+ par->cursor_state.image.height = vc->vc_font.height;
+ par->cursor_state.image.width = vc->vc_font.width;
cursor.set |= FB_CUR_SETSIZE;
}
- if (ops->cursor_state.hot.x || ops->cursor_state.hot.y ||
- ops->cursor_reset) {
- ops->cursor_state.hot.x = cursor.hot.y = 0;
+ if (par->cursor_state.hot.x || par->cursor_state.hot.y ||
+ par->cursor_reset) {
+ par->cursor_state.hot.x = cursor.hot.y = 0;
cursor.set |= FB_CUR_SETHOT;
}
if (cursor.set & FB_CUR_SETSIZE ||
- vc->vc_cursor_type != ops->p->cursor_shape ||
- ops->cursor_state.mask == NULL ||
- ops->cursor_reset) {
+ vc->vc_cursor_type != par->p->cursor_shape ||
+ par->cursor_state.mask == NULL ||
+ par->cursor_reset) {
char *mask = kmalloc_array(w, vc->vc_font.height, GFP_ATOMIC);
int cur_height, size, i = 0;
u8 msk = 0xff;
@@ -337,13 +337,13 @@ static void bit_cursor(struct vc_data *v
if (!mask)
return;
- kfree(ops->cursor_state.mask);
- ops->cursor_state.mask = mask;
+ kfree(par->cursor_state.mask);
+ par->cursor_state.mask = mask;
- ops->p->cursor_shape = vc->vc_cursor_type;
+ par->p->cursor_shape = vc->vc_cursor_type;
cursor.set |= FB_CUR_SETSHAPE;
- switch (CUR_SIZE(ops->p->cursor_shape)) {
+ switch (CUR_SIZE(par->p->cursor_shape)) {
case CUR_NONE:
cur_height = 0;
break;
@@ -372,19 +372,19 @@ static void bit_cursor(struct vc_data *v
mask[i++] = msk;
}
- ops->cursor_state.enable = enable && !use_sw;
+ par->cursor_state.enable = enable && !use_sw;
cursor.image.data = src;
- cursor.image.fg_color = ops->cursor_state.image.fg_color;
- cursor.image.bg_color = ops->cursor_state.image.bg_color;
- cursor.image.dx = ops->cursor_state.image.dx;
- cursor.image.dy = ops->cursor_state.image.dy;
- cursor.image.height = ops->cursor_state.image.height;
- cursor.image.width = ops->cursor_state.image.width;
- cursor.hot.x = ops->cursor_state.hot.x;
- cursor.hot.y = ops->cursor_state.hot.y;
- cursor.mask = ops->cursor_state.mask;
- cursor.enable = ops->cursor_state.enable;
+ cursor.image.fg_color = par->cursor_state.image.fg_color;
+ cursor.image.bg_color = par->cursor_state.image.bg_color;
+ cursor.image.dx = par->cursor_state.image.dx;
+ cursor.image.dy = par->cursor_state.image.dy;
+ cursor.image.height = par->cursor_state.image.height;
+ cursor.image.width = par->cursor_state.image.width;
+ cursor.hot.x = par->cursor_state.hot.x;
+ cursor.hot.y = par->cursor_state.hot.y;
+ cursor.mask = par->cursor_state.mask;
+ cursor.enable = par->cursor_state.enable;
cursor.image.depth = 1;
cursor.rop = ROP_XOR;
@@ -394,31 +394,31 @@ static void bit_cursor(struct vc_data *v
if (err)
soft_cursor(info, &cursor);
- ops->cursor_reset = 0;
+ par->cursor_reset = 0;
}
static int bit_update_start(struct fb_info *info)
{
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
int err;
- err = fb_pan_display(info, &ops->var);
- ops->var.xoffset = info->var.xoffset;
- ops->var.yoffset = info->var.yoffset;
- ops->var.vmode = info->var.vmode;
+ err = fb_pan_display(info, &par->var);
+ par->var.xoffset = info->var.xoffset;
+ par->var.yoffset = info->var.yoffset;
+ par->var.vmode = info->var.vmode;
return err;
}
-void fbcon_set_bitops(struct fbcon_ops *ops)
+void fbcon_set_bitops(struct fbcon_par *par)
{
- ops->bmove = bit_bmove;
- ops->clear = bit_clear;
- ops->putcs = bit_putcs;
- ops->clear_margins = bit_clear_margins;
- ops->cursor = bit_cursor;
- ops->update_start = bit_update_start;
- ops->rotate_font = NULL;
+ par->bmove = bit_bmove;
+ par->clear = bit_clear;
+ par->putcs = bit_putcs;
+ par->clear_margins = bit_clear_margins;
+ par->cursor = bit_cursor;
+ par->update_start = bit_update_start;
+ par->rotate_font = NULL;
- if (ops->rotate)
- fbcon_set_rotate(ops);
+ if (par->rotate)
+ fbcon_set_rotate(par);
}
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -200,27 +200,27 @@ static struct device *fbcon_device;
#ifdef CONFIG_FRAMEBUFFER_CONSOLE_ROTATION
static inline void fbcon_set_rotation(struct fb_info *info)
{
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
if (!(info->flags & FBINFO_MISC_TILEBLITTING) &&
- ops->p->con_rotate < 4)
- ops->rotate = ops->p->con_rotate;
+ par->p->con_rotate < 4)
+ par->rotate = par->p->con_rotate;
else
- ops->rotate = 0;
+ par->rotate = 0;
}
static void fbcon_rotate(struct fb_info *info, u32 rotate)
{
- struct fbcon_ops *ops= info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
struct fb_info *fb_info;
- if (!ops || ops->currcon == -1)
+ if (!par || par->currcon == -1)
return;
- fb_info = fbcon_info_from_console(ops->currcon);
+ fb_info = fbcon_info_from_console(par->currcon);
if (info == fb_info) {
- struct fbcon_display *p = &fb_display[ops->currcon];
+ struct fbcon_display *p = &fb_display[par->currcon];
if (rotate < 4)
p->con_rotate = rotate;
@@ -233,12 +233,12 @@ static void fbcon_rotate(struct fb_info
static void fbcon_rotate_all(struct fb_info *info, u32 rotate)
{
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
struct vc_data *vc;
struct fbcon_display *p;
int i;
- if (!ops || ops->currcon < 0 || rotate > 3)
+ if (!par || par->currcon < 0 || rotate > 3)
return;
for (i = first_fb_vc; i <= last_fb_vc; i++) {
@@ -256,9 +256,9 @@ static void fbcon_rotate_all(struct fb_i
#else
static inline void fbcon_set_rotation(struct fb_info *info)
{
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
- ops->rotate = FB_ROTATE_UR;
+ par->rotate = FB_ROTATE_UR;
}
static void fbcon_rotate(struct fb_info *info, u32 rotate)
@@ -274,9 +274,9 @@ static void fbcon_rotate_all(struct fb_i
static int fbcon_get_rotate(struct fb_info *info)
{
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
- return (ops) ? ops->rotate : 0;
+ return (par) ? par->rotate : 0;
}
static bool fbcon_skip_panic(struct fb_info *info)
@@ -286,10 +286,10 @@ static bool fbcon_skip_panic(struct fb_i
static inline bool fbcon_is_active(struct vc_data *vc, struct fb_info *info)
{
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
return info->state == FBINFO_STATE_RUNNING &&
- vc->vc_mode == KD_TEXT && !ops->graphics && !fbcon_skip_panic(info);
+ vc->vc_mode == KD_TEXT && !par->graphics && !fbcon_skip_panic(info);
}
static int get_color(struct vc_data *vc, struct fb_info *info,
@@ -371,7 +371,7 @@ static int get_bg_color(struct vc_data *
static void fb_flashcursor(struct work_struct *work)
{
- struct fbcon_ops *ops = container_of(work, struct fbcon_ops, cursor_work.work);
+ struct fbcon_par *par = container_of(work, struct fbcon_par, cursor_work.work);
struct fb_info *info;
struct vc_data *vc = NULL;
int c;
@@ -386,10 +386,10 @@ static void fb_flashcursor(struct work_s
return;
/* protected by console_lock */
- info = ops->info;
+ info = par->info;
- if (ops->currcon != -1)
- vc = vc_cons[ops->currcon].d;
+ if (par->currcon != -1)
+ vc = vc_cons[par->currcon].d;
if (!vc || !con_is_visible(vc) ||
fbcon_info_from_console(vc->vc_num) != info ||
@@ -399,30 +399,30 @@ static void fb_flashcursor(struct work_s
}
c = scr_readw((u16 *) vc->vc_pos);
- enable = ops->cursor_flash && !ops->cursor_state.enable;
- ops->cursor(vc, info, enable,
+ enable = par->cursor_flash && !par->cursor_state.enable;
+ par->cursor(vc, info, enable,
get_fg_color(vc, info, c),
get_bg_color(vc, info, c));
console_unlock();
- queue_delayed_work(system_power_efficient_wq, &ops->cursor_work,
- ops->cur_blink_jiffies);
+ queue_delayed_work(system_power_efficient_wq, &par->cursor_work,
+ par->cur_blink_jiffies);
}
static void fbcon_add_cursor_work(struct fb_info *info)
{
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
if (fbcon_cursor_blink)
- queue_delayed_work(system_power_efficient_wq, &ops->cursor_work,
- ops->cur_blink_jiffies);
+ queue_delayed_work(system_power_efficient_wq, &par->cursor_work,
+ par->cur_blink_jiffies);
}
static void fbcon_del_cursor_work(struct fb_info *info)
{
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
- cancel_delayed_work_sync(&ops->cursor_work);
+ cancel_delayed_work_sync(&par->cursor_work);
}
#ifndef MODULE
@@ -582,7 +582,7 @@ static void fbcon_prepare_logo(struct vc
int cols, int rows, int new_cols, int new_rows)
{
/* Need to make room for the logo */
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
int cnt, erase = vc->vc_video_erase_char, step;
unsigned short *save = NULL, *r, *q;
int logo_height;
@@ -598,7 +598,7 @@ static void fbcon_prepare_logo(struct vc
*/
if (fb_get_color_depth(&info->var, &info->fix) == 1)
erase &= ~0x400;
- logo_height = fb_prepare_logo(info, ops->rotate);
+ logo_height = fb_prepare_logo(info, par->rotate);
logo_lines = DIV_ROUND_UP(logo_height, vc->vc_font.height);
q = (unsigned short *) (vc->vc_origin +
vc->vc_size_row * rows);
@@ -670,15 +670,15 @@ static void fbcon_prepare_logo(struct vc
#ifdef CONFIG_FB_TILEBLITTING
static void set_blitting_type(struct vc_data *vc, struct fb_info *info)
{
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
- ops->p = &fb_display[vc->vc_num];
+ par->p = &fb_display[vc->vc_num];
if ((info->flags & FBINFO_MISC_TILEBLITTING))
fbcon_set_tileops(vc, info);
else {
fbcon_set_rotation(info);
- fbcon_set_bitops(ops);
+ fbcon_set_bitops(par);
}
}
@@ -695,12 +695,12 @@ static int fbcon_invalid_charcount(struc
#else
static void set_blitting_type(struct vc_data *vc, struct fb_info *info)
{
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
info->flags &= ~FBINFO_MISC_TILEBLITTING;
- ops->p = &fb_display[vc->vc_num];
+ par->p = &fb_display[vc->vc_num];
fbcon_set_rotation(info);
- fbcon_set_bitops(ops);
+ fbcon_set_bitops(par);
}
static int fbcon_invalid_charcount(struct fb_info *info, unsigned charcount)
@@ -720,13 +720,13 @@ static void fbcon_release(struct fb_info
module_put(info->fbops->owner);
if (info->fbcon_par) {
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
fbcon_del_cursor_work(info);
- kfree(ops->cursor_state.mask);
- kfree(ops->cursor_data);
- kfree(ops->cursor_src);
- kfree(ops->fontbuffer);
+ kfree(par->cursor_state.mask);
+ kfree(par->cursor_data);
+ kfree(par->cursor_src);
+ kfree(par->fontbuffer);
kfree(info->fbcon_par);
info->fbcon_par = NULL;
}
@@ -734,7 +734,7 @@ static void fbcon_release(struct fb_info
static int fbcon_open(struct fb_info *info)
{
- struct fbcon_ops *ops;
+ struct fbcon_par *par;
if (!try_module_get(info->fbops->owner))
return -ENODEV;
@@ -748,16 +748,16 @@ static int fbcon_open(struct fb_info *in
}
unlock_fb_info(info);
- ops = kzalloc(sizeof(struct fbcon_ops), GFP_KERNEL);
- if (!ops) {
+ par = kzalloc(sizeof(*par), GFP_KERNEL);
+ if (!par) {
fbcon_release(info);
return -ENOMEM;
}
- INIT_DELAYED_WORK(&ops->cursor_work, fb_flashcursor);
- ops->info = info;
- info->fbcon_par = ops;
- ops->cur_blink_jiffies = HZ / 5;
+ INIT_DELAYED_WORK(&par->cursor_work, fb_flashcursor);
+ par->info = info;
+ info->fbcon_par = par;
+ par->cur_blink_jiffies = HZ / 5;
return 0;
}
@@ -804,12 +804,12 @@ static void con2fb_release_oldinfo(struc
static void con2fb_init_display(struct vc_data *vc, struct fb_info *info,
int unit, int show_logo)
{
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
int ret;
- ops->currcon = fg_console;
+ par->currcon = fg_console;
- if (info->fbops->fb_set_par && !ops->initialized) {
+ if (info->fbops->fb_set_par && !par->initialized) {
ret = info->fbops->fb_set_par(info);
if (ret)
@@ -818,8 +818,8 @@ static void con2fb_init_display(struct v
"error code %d\n", ret);
}
- ops->initialized = true;
- ops->graphics = 0;
+ par->initialized = true;
+ par->graphics = 0;
fbcon_set_disp(info, &info->var, unit);
if (show_logo) {
@@ -956,7 +956,7 @@ static const char *fbcon_startup(void)
struct vc_data *vc = vc_cons[fg_console].d;
const struct font_desc *font = NULL;
struct fb_info *info = NULL;
- struct fbcon_ops *ops;
+ struct fbcon_par *par;
int rows, cols;
/*
@@ -976,10 +976,10 @@ static const char *fbcon_startup(void)
if (fbcon_open(info))
return NULL;
- ops = info->fbcon_par;
- ops->currcon = -1;
- ops->graphics = 1;
- ops->cur_rotate = -1;
+ par = info->fbcon_par;
+ par->currcon = -1;
+ par->graphics = 1;
+ par->cur_rotate = -1;
p->con_rotate = initial_rotation;
if (p->con_rotate == -1)
@@ -1002,8 +1002,8 @@ static const char *fbcon_startup(void)
vc->vc_font.charcount = font->charcount;
}
- cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres);
- rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
+ cols = FBCON_SWAP(par->rotate, info->var.xres, info->var.yres);
+ rows = FBCON_SWAP(par->rotate, info->var.yres, info->var.xres);
cols /= vc->vc_font.width;
rows /= vc->vc_font.height;
vc_resize(vc, cols, rows);
@@ -1021,7 +1021,7 @@ static const char *fbcon_startup(void)
static void fbcon_init(struct vc_data *vc, bool init)
{
struct fb_info *info;
- struct fbcon_ops *ops;
+ struct fbcon_par *par;
struct vc_data **default_mode = vc->vc_display_fg;
struct vc_data *svc = *default_mode;
struct fbcon_display *t, *p = &fb_display[vc->vc_num];
@@ -1096,8 +1096,8 @@ static void fbcon_init(struct vc_data *v
if (!*vc->uni_pagedict_loc)
con_copy_unimap(vc, svc);
- ops = info->fbcon_par;
- ops->cur_blink_jiffies = msecs_to_jiffies(vc->vc_cur_blink_ms);
+ par = info->fbcon_par;
+ par->cur_blink_jiffies = msecs_to_jiffies(vc->vc_cur_blink_ms);
p->con_rotate = initial_rotation;
if (p->con_rotate == -1)
@@ -1109,8 +1109,8 @@ static void fbcon_init(struct vc_data *v
cols = vc->vc_cols;
rows = vc->vc_rows;
- new_cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres);
- new_rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
+ new_cols = FBCON_SWAP(par->rotate, info->var.xres, info->var.yres);
+ new_rows = FBCON_SWAP(par->rotate, info->var.yres, info->var.xres);
new_cols /= vc->vc_font.width;
new_rows /= vc->vc_font.height;
@@ -1122,7 +1122,7 @@ static void fbcon_init(struct vc_data *v
* We need to do it in fbcon_init() to prevent screen corruption.
*/
if (con_is_visible(vc) && vc->vc_mode == KD_TEXT) {
- if (info->fbops->fb_set_par && !ops->initialized) {
+ if (info->fbops->fb_set_par && !par->initialized) {
ret = info->fbops->fb_set_par(info);
if (ret)
@@ -1131,10 +1131,10 @@ static void fbcon_init(struct vc_data *v
"error code %d\n", ret);
}
- ops->initialized = true;
+ par->initialized = true;
}
- ops->graphics = 0;
+ par->graphics = 0;
#ifdef CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION
if ((info->flags & FBINFO_HWACCEL_COPYAREA) &&
@@ -1158,12 +1158,12 @@ static void fbcon_init(struct vc_data *v
if (logo)
fbcon_prepare_logo(vc, info, cols, rows, new_cols, new_rows);
- if (ops->rotate_font && ops->rotate_font(info, vc)) {
- ops->rotate = FB_ROTATE_UR;
+ if (par->rotate_font && par->rotate_font(info, vc)) {
+ par->rotate = FB_ROTATE_UR;
set_blitting_type(vc, info);
}
- ops->p = &fb_display[fg_console];
+ par->p = &fb_display[fg_console];
}
static void fbcon_free_font(struct fbcon_display *p)
@@ -1201,7 +1201,7 @@ static void fbcon_deinit(struct vc_data
{
struct fbcon_display *p = &fb_display[vc->vc_num];
struct fb_info *info;
- struct fbcon_ops *ops;
+ struct fbcon_par *par;
int idx;
fbcon_free_font(p);
@@ -1215,15 +1215,15 @@ static void fbcon_deinit(struct vc_data
if (!info)
goto finished;
- ops = info->fbcon_par;
+ par = info->fbcon_par;
- if (!ops)
+ if (!par)
goto finished;
if (con_is_visible(vc))
fbcon_del_cursor_work(info);
- ops->initialized = false;
+ par->initialized = false;
finished:
fbcon_free_font(p);
@@ -1270,7 +1270,7 @@ static void __fbcon_clear(struct vc_data
unsigned int height, unsigned int width)
{
struct fb_info *info = fbcon_info_from_console(vc->vc_num);
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
int fg, bg;
struct fbcon_display *p = &fb_display[vc->vc_num];
u_int y_break;
@@ -1285,7 +1285,7 @@ static void __fbcon_clear(struct vc_data
vc->vc_top = 0;
/*
* If the font dimensions are not an integral of the display
- * dimensions then the ops->clear below won't end up clearing
+ * dimensions then the par->clear below won't end up clearing
* the margins. Call clear_margins here in case the logo
* bitmap stretched into the margin area.
*/
@@ -1299,11 +1299,10 @@ static void __fbcon_clear(struct vc_data
y_break = p->vrows - p->yscroll;
if (sy < y_break && sy + height - 1 >= y_break) {
u_int b = y_break - sy;
- ops->clear(vc, info, real_y(p, sy), sx, b, width, fg, bg);
- ops->clear(vc, info, real_y(p, sy + b), sx, height - b,
- width, fg, bg);
+ par->clear(vc, info, real_y(p, sy), sx, b, width, fg, bg);
+ par->clear(vc, info, real_y(p, sy + b), sx, height - b, width, fg, bg);
} else
- ops->clear(vc, info, real_y(p, sy), sx, height, width, fg, bg);
+ par->clear(vc, info, real_y(p, sy), sx, height, width, fg, bg);
}
static void fbcon_clear(struct vc_data *vc, unsigned int sy, unsigned int sx,
@@ -1317,10 +1316,10 @@ static void fbcon_putcs(struct vc_data *
{
struct fb_info *info = fbcon_info_from_console(vc->vc_num);
struct fbcon_display *p = &fb_display[vc->vc_num];
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
if (fbcon_is_active(vc, info))
- ops->putcs(vc, info, s, count, real_y(p, ypos), xpos,
+ par->putcs(vc, info, s, count, real_y(p, ypos), xpos,
get_fg_color(vc, info, scr_readw(s)),
get_bg_color(vc, info, scr_readw(s)));
}
@@ -1328,19 +1327,19 @@ static void fbcon_putcs(struct vc_data *
static void fbcon_clear_margins(struct vc_data *vc, int bottom_only)
{
struct fb_info *info = fbcon_info_from_console(vc->vc_num);
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
if (fbcon_is_active(vc, info))
- ops->clear_margins(vc, info, margin_color, bottom_only);
+ par->clear_margins(vc, info, margin_color, bottom_only);
}
static void fbcon_cursor(struct vc_data *vc, bool enable)
{
struct fb_info *info = fbcon_info_from_console(vc->vc_num);
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
int c = scr_readw((u16 *) vc->vc_pos);
- ops->cur_blink_jiffies = msecs_to_jiffies(vc->vc_cur_blink_ms);
+ par->cur_blink_jiffies = msecs_to_jiffies(vc->vc_cur_blink_ms);
if (!fbcon_is_active(vc, info) || vc->vc_deccm != 1)
return;
@@ -1350,12 +1349,12 @@ static void fbcon_cursor(struct vc_data
else
fbcon_add_cursor_work(info);
- ops->cursor_flash = enable;
+ par->cursor_flash = enable;
- if (!ops->cursor)
+ if (!par->cursor)
return;
- ops->cursor(vc, info, enable,
+ par->cursor(vc, info, enable,
get_fg_color(vc, info, c),
get_bg_color(vc, info, c));
}
@@ -1370,7 +1369,7 @@ static void fbcon_set_disp(struct fb_inf
struct fbcon_display *p, *t;
struct vc_data **default_mode, *vc;
struct vc_data *svc;
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
int rows, cols;
unsigned long ret = 0;
@@ -1403,7 +1402,7 @@ static void fbcon_set_disp(struct fb_inf
var->yoffset = info->var.yoffset;
var->xoffset = info->var.xoffset;
fb_set_var(info, var);
- ops->var = info->var;
+ par->var = info->var;
vc->vc_can_do_color = (fb_get_color_depth(&info->var, &info->fix)!=1);
vc->vc_complement_mask = vc->vc_can_do_color ? 0x7700 : 0x0800;
if (vc->vc_font.charcount == 256) {
@@ -1419,8 +1418,8 @@ static void fbcon_set_disp(struct fb_inf
if (!*vc->uni_pagedict_loc)
con_copy_unimap(vc, svc);
- cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres);
- rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
+ cols = FBCON_SWAP(par->rotate, info->var.xres, info->var.yres);
+ rows = FBCON_SWAP(par->rotate, info->var.yres, info->var.xres);
cols /= vc->vc_font.width;
rows /= vc->vc_font.height;
ret = vc_resize(vc, cols, rows);
@@ -1432,16 +1431,16 @@ static void fbcon_set_disp(struct fb_inf
static __inline__ void ywrap_up(struct vc_data *vc, int count)
{
struct fb_info *info = fbcon_info_from_console(vc->vc_num);
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
struct fbcon_display *p = &fb_display[vc->vc_num];
p->yscroll += count;
if (p->yscroll >= p->vrows) /* Deal with wrap */
p->yscroll -= p->vrows;
- ops->var.xoffset = 0;
- ops->var.yoffset = p->yscroll * vc->vc_font.height;
- ops->var.vmode |= FB_VMODE_YWRAP;
- ops->update_start(info);
+ par->var.xoffset = 0;
+ par->var.yoffset = p->yscroll * vc->vc_font.height;
+ par->var.vmode |= FB_VMODE_YWRAP;
+ par->update_start(info);
scrollback_max += count;
if (scrollback_max > scrollback_phys_max)
scrollback_max = scrollback_phys_max;
@@ -1451,16 +1450,16 @@ static __inline__ void ywrap_up(struct v
static __inline__ void ywrap_down(struct vc_data *vc, int count)
{
struct fb_info *info = fbcon_info_from_console(vc->vc_num);
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
struct fbcon_display *p = &fb_display[vc->vc_num];
p->yscroll -= count;
if (p->yscroll < 0) /* Deal with wrap */
p->yscroll += p->vrows;
- ops->var.xoffset = 0;
- ops->var.yoffset = p->yscroll * vc->vc_font.height;
- ops->var.vmode |= FB_VMODE_YWRAP;
- ops->update_start(info);
+ par->var.xoffset = 0;
+ par->var.yoffset = p->yscroll * vc->vc_font.height;
+ par->var.vmode |= FB_VMODE_YWRAP;
+ par->update_start(info);
scrollback_max -= count;
if (scrollback_max < 0)
scrollback_max = 0;
@@ -1471,19 +1470,19 @@ static __inline__ void ypan_up(struct vc
{
struct fb_info *info = fbcon_info_from_console(vc->vc_num);
struct fbcon_display *p = &fb_display[vc->vc_num];
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
p->yscroll += count;
if (p->yscroll > p->vrows - vc->vc_rows) {
- ops->bmove(vc, info, p->vrows - vc->vc_rows,
+ par->bmove(vc, info, p->vrows - vc->vc_rows,
0, 0, 0, vc->vc_rows, vc->vc_cols);
p->yscroll -= p->vrows - vc->vc_rows;
}
- ops->var.xoffset = 0;
- ops->var.yoffset = p->yscroll * vc->vc_font.height;
- ops->var.vmode &= ~FB_VMODE_YWRAP;
- ops->update_start(info);
+ par->var.xoffset = 0;
+ par->var.yoffset = p->yscroll * vc->vc_font.height;
+ par->var.vmode &= ~FB_VMODE_YWRAP;
+ par->update_start(info);
fbcon_clear_margins(vc, 1);
scrollback_max += count;
if (scrollback_max > scrollback_phys_max)
@@ -1494,7 +1493,7 @@ static __inline__ void ypan_up(struct vc
static __inline__ void ypan_up_redraw(struct vc_data *vc, int t, int count)
{
struct fb_info *info = fbcon_info_from_console(vc->vc_num);
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
struct fbcon_display *p = &fb_display[vc->vc_num];
p->yscroll += count;
@@ -1504,10 +1503,10 @@ static __inline__ void ypan_up_redraw(st
fbcon_redraw_move(vc, p, t + count, vc->vc_rows - count, t);
}
- ops->var.xoffset = 0;
- ops->var.yoffset = p->yscroll * vc->vc_font.height;
- ops->var.vmode &= ~FB_VMODE_YWRAP;
- ops->update_start(info);
+ par->var.xoffset = 0;
+ par->var.yoffset = p->yscroll * vc->vc_font.height;
+ par->var.vmode &= ~FB_VMODE_YWRAP;
+ par->update_start(info);
fbcon_clear_margins(vc, 1);
scrollback_max += count;
if (scrollback_max > scrollback_phys_max)
@@ -1519,19 +1518,19 @@ static __inline__ void ypan_down(struct
{
struct fb_info *info = fbcon_info_from_console(vc->vc_num);
struct fbcon_display *p = &fb_display[vc->vc_num];
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
p->yscroll -= count;
if (p->yscroll < 0) {
- ops->bmove(vc, info, 0, 0, p->vrows - vc->vc_rows,
+ par->bmove(vc, info, 0, 0, p->vrows - vc->vc_rows,
0, vc->vc_rows, vc->vc_cols);
p->yscroll += p->vrows - vc->vc_rows;
}
- ops->var.xoffset = 0;
- ops->var.yoffset = p->yscroll * vc->vc_font.height;
- ops->var.vmode &= ~FB_VMODE_YWRAP;
- ops->update_start(info);
+ par->var.xoffset = 0;
+ par->var.yoffset = p->yscroll * vc->vc_font.height;
+ par->var.vmode &= ~FB_VMODE_YWRAP;
+ par->update_start(info);
fbcon_clear_margins(vc, 1);
scrollback_max -= count;
if (scrollback_max < 0)
@@ -1542,7 +1541,7 @@ static __inline__ void ypan_down(struct
static __inline__ void ypan_down_redraw(struct vc_data *vc, int t, int count)
{
struct fb_info *info = fbcon_info_from_console(vc->vc_num);
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
struct fbcon_display *p = &fb_display[vc->vc_num];
p->yscroll -= count;
@@ -1552,10 +1551,10 @@ static __inline__ void ypan_down_redraw(
fbcon_redraw_move(vc, p, t, vc->vc_rows - count, t + count);
}
- ops->var.xoffset = 0;
- ops->var.yoffset = p->yscroll * vc->vc_font.height;
- ops->var.vmode &= ~FB_VMODE_YWRAP;
- ops->update_start(info);
+ par->var.xoffset = 0;
+ par->var.yoffset = p->yscroll * vc->vc_font.height;
+ par->var.vmode &= ~FB_VMODE_YWRAP;
+ par->update_start(info);
fbcon_clear_margins(vc, 1);
scrollback_max -= count;
if (scrollback_max < 0)
@@ -1604,7 +1603,7 @@ static void fbcon_redraw_blit(struct vc_
unsigned short *d = (unsigned short *)
(vc->vc_origin + vc->vc_size_row * line);
unsigned short *s = d + offset;
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
while (count--) {
unsigned short *start = s;
@@ -1617,8 +1616,8 @@ static void fbcon_redraw_blit(struct vc_
if (c == scr_readw(d)) {
if (s > start) {
- ops->bmove(vc, info, line + ycount, x,
- line, x, 1, s-start);
+ par->bmove(vc, info, line + ycount, x,
+ line, x, 1, s - start);
x += s - start + 1;
start = s + 1;
} else {
@@ -1633,8 +1632,7 @@ static void fbcon_redraw_blit(struct vc_
d++;
} while (s < le);
if (s > start)
- ops->bmove(vc, info, line + ycount, x, line, x, 1,
- s-start);
+ par->bmove(vc, info, line + ycount, x, line, x, 1, s - start);
console_conditional_schedule();
if (ycount > 0)
line++;
@@ -1705,7 +1703,7 @@ static void fbcon_bmove_rec(struct vc_da
int dy, int dx, int height, int width, u_int y_break)
{
struct fb_info *info = fbcon_info_from_console(vc->vc_num);
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
u_int b;
if (sy < y_break && sy + height > y_break) {
@@ -1739,8 +1737,7 @@ static void fbcon_bmove_rec(struct vc_da
}
return;
}
- ops->bmove(vc, info, real_y(p, sy), sx, real_y(p, dy), dx,
- height, width);
+ par->bmove(vc, info, real_y(p, sy), sx, real_y(p, dy), dx, height, width);
}
static void fbcon_bmove(struct vc_data *vc, int sy, int sx, int dy, int dx,
@@ -1967,15 +1964,13 @@ static void updatescrollmode_accel(struc
struct vc_data *vc)
{
#ifdef CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
int cap = info->flags;
u16 t = 0;
- int ypan = FBCON_SWAP(ops->rotate, info->fix.ypanstep,
- info->fix.xpanstep);
- int ywrap = FBCON_SWAP(ops->rotate, info->fix.ywrapstep, t);
- int yres = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
- int vyres = FBCON_SWAP(ops->rotate, info->var.yres_virtual,
- info->var.xres_virtual);
+ int ypan = FBCON_SWAP(par->rotate, info->fix.ypanstep, info->fix.xpanstep);
+ int ywrap = FBCON_SWAP(par->rotate, info->fix.ywrapstep, t);
+ int yres = FBCON_SWAP(par->rotate, info->var.yres, info->var.xres);
+ int vyres = FBCON_SWAP(par->rotate, info->var.yres_virtual, info->var.xres_virtual);
int good_pan = (cap & FBINFO_HWACCEL_YPAN) &&
divides(ypan, vc->vc_font.height) && vyres > yres;
int good_wrap = (cap & FBINFO_HWACCEL_YWRAP) &&
@@ -2008,11 +2003,10 @@ static void updatescrollmode(struct fbco
struct fb_info *info,
struct vc_data *vc)
{
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
int fh = vc->vc_font.height;
- int yres = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
- int vyres = FBCON_SWAP(ops->rotate, info->var.yres_virtual,
- info->var.xres_virtual);
+ int yres = FBCON_SWAP(par->rotate, info->var.yres, info->var.xres);
+ int vyres = FBCON_SWAP(par->rotate, info->var.yres_virtual, info->var.xres_virtual);
p->vrows = vyres/fh;
if (yres > (fh * (vc->vc_rows + 1)))
@@ -2031,7 +2025,7 @@ static int fbcon_resize(struct vc_data *
unsigned int height, bool from_user)
{
struct fb_info *info = fbcon_info_from_console(vc->vc_num);
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
struct fbcon_display *p = &fb_display[vc->vc_num];
struct fb_var_screeninfo var = info->var;
int x_diff, y_diff, virt_w, virt_h, virt_fw, virt_fh;
@@ -2054,12 +2048,10 @@ static int fbcon_resize(struct vc_data *
return -EINVAL;
}
- virt_w = FBCON_SWAP(ops->rotate, width, height);
- virt_h = FBCON_SWAP(ops->rotate, height, width);
- virt_fw = FBCON_SWAP(ops->rotate, vc->vc_font.width,
- vc->vc_font.height);
- virt_fh = FBCON_SWAP(ops->rotate, vc->vc_font.height,
- vc->vc_font.width);
+ virt_w = FBCON_SWAP(par->rotate, width, height);
+ virt_h = FBCON_SWAP(par->rotate, height, width);
+ virt_fw = FBCON_SWAP(par->rotate, vc->vc_font.width, vc->vc_font.height);
+ virt_fh = FBCON_SWAP(par->rotate, vc->vc_font.height, vc->vc_font.width);
var.xres = virt_w * virt_fw;
var.yres = virt_h * virt_fh;
x_diff = info->var.xres - var.xres;
@@ -2085,7 +2077,7 @@ static int fbcon_resize(struct vc_data *
fb_set_var(info, &var);
}
var_to_display(p, &info->var, info);
- ops->var = info->var;
+ par->var = info->var;
}
updatescrollmode(p, info, vc);
return 0;
@@ -2094,13 +2086,13 @@ static int fbcon_resize(struct vc_data *
static bool fbcon_switch(struct vc_data *vc)
{
struct fb_info *info, *old_info = NULL;
- struct fbcon_ops *ops;
+ struct fbcon_par *par;
struct fbcon_display *p = &fb_display[vc->vc_num];
struct fb_var_screeninfo var;
int i, ret, prev_console;
info = fbcon_info_from_console(vc->vc_num);
- ops = info->fbcon_par;
+ par = info->fbcon_par;
if (logo_shown >= 0) {
struct vc_data *conp2 = vc_cons[logo_shown].d;
@@ -2111,7 +2103,7 @@ static bool fbcon_switch(struct vc_data
logo_shown = FBCON_LOGO_CANSHOW;
}
- prev_console = ops->currcon;
+ prev_console = par->currcon;
if (prev_console != -1)
old_info = fbcon_info_from_console(prev_console);
/*
@@ -2124,9 +2116,9 @@ static bool fbcon_switch(struct vc_data
*/
fbcon_for_each_registered_fb(i) {
if (fbcon_registered_fb[i]->fbcon_par) {
- struct fbcon_ops *o = fbcon_registered_fb[i]->fbcon_par;
+ struct fbcon_par *par = fbcon_registered_fb[i]->fbcon_par;
- o->currcon = vc->vc_num;
+ par->currcon = vc->vc_num;
}
}
memset(&var, 0, sizeof(struct fb_var_screeninfo));
@@ -2140,7 +2132,7 @@ static bool fbcon_switch(struct vc_data
info->var.activate = var.activate;
var.vmode |= info->var.vmode & ~FB_VMODE_MASK;
fb_set_var(info, &var);
- ops->var = info->var;
+ par->var = info->var;
if (old_info != NULL && (old_info != info ||
info->flags & FBINFO_MISC_ALWAYS_SETPAR)) {
@@ -2157,17 +2149,16 @@ static bool fbcon_switch(struct vc_data
fbcon_del_cursor_work(old_info);
}
- if (!fbcon_is_active(vc, info) ||
- ops->blank_state != FB_BLANK_UNBLANK)
+ if (!fbcon_is_active(vc, info) || par->blank_state != FB_BLANK_UNBLANK)
fbcon_del_cursor_work(info);
else
fbcon_add_cursor_work(info);
set_blitting_type(vc, info);
- ops->cursor_reset = 1;
+ par->cursor_reset = 1;
- if (ops->rotate_font && ops->rotate_font(info, vc)) {
- ops->rotate = FB_ROTATE_UR;
+ if (par->rotate_font && par->rotate_font(info, vc)) {
+ par->rotate = FB_ROTATE_UR;
set_blitting_type(vc, info);
}
@@ -2198,8 +2189,8 @@ static bool fbcon_switch(struct vc_data
scrollback_current = 0;
if (fbcon_is_active(vc, info)) {
- ops->var.xoffset = ops->var.yoffset = p->yscroll = 0;
- ops->update_start(info);
+ par->var.xoffset = par->var.yoffset = p->yscroll = 0;
+ par->update_start(info);
}
fbcon_set_palette(vc, color_table);
@@ -2208,7 +2199,7 @@ static bool fbcon_switch(struct vc_data
if (logo_shown == FBCON_LOGO_DRAW) {
logo_shown = fg_console;
- fb_show_logo(info, ops->rotate);
+ fb_show_logo(info, par->rotate);
update_region(vc,
vc->vc_origin + vc->vc_size_row * vc->vc_top,
vc->vc_size_row * (vc->vc_bottom -
@@ -2237,27 +2228,27 @@ static bool fbcon_blank(struct vc_data *
bool mode_switch)
{
struct fb_info *info = fbcon_info_from_console(vc->vc_num);
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
if (mode_switch) {
struct fb_var_screeninfo var = info->var;
- ops->graphics = 1;
+ par->graphics = 1;
if (!blank) {
var.activate = FB_ACTIVATE_NOW | FB_ACTIVATE_FORCE |
FB_ACTIVATE_KD_TEXT;
fb_set_var(info, &var);
- ops->graphics = 0;
- ops->var = info->var;
+ par->graphics = 0;
+ par->var = info->var;
}
}
if (fbcon_is_active(vc, info)) {
- if (ops->blank_state != blank) {
- ops->blank_state = blank;
+ if (par->blank_state != blank) {
+ par->blank_state = blank;
fbcon_cursor(vc, !blank);
- ops->cursor_flash = (!blank);
+ par->cursor_flash = (!blank);
if (fb_blank(info, blank))
fbcon_generic_blank(vc, info, blank);
@@ -2267,8 +2258,7 @@ static bool fbcon_blank(struct vc_data *
update_screen(vc);
}
- if (mode_switch || !fbcon_is_active(vc, info) ||
- ops->blank_state != FB_BLANK_UNBLANK)
+ if (mode_switch || !fbcon_is_active(vc, info) || par->blank_state != FB_BLANK_UNBLANK)
fbcon_del_cursor_work(info);
else
fbcon_add_cursor_work(info);
@@ -2279,10 +2269,10 @@ static bool fbcon_blank(struct vc_data *
static void fbcon_debug_enter(struct vc_data *vc)
{
struct fb_info *info = fbcon_info_from_console(vc->vc_num);
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
- ops->save_graphics = ops->graphics;
- ops->graphics = 0;
+ par->save_graphics = par->graphics;
+ par->graphics = 0;
if (info->fbops->fb_debug_enter)
info->fbops->fb_debug_enter(info);
fbcon_set_palette(vc, color_table);
@@ -2291,9 +2281,9 @@ static void fbcon_debug_enter(struct vc_
static void fbcon_debug_leave(struct vc_data *vc)
{
struct fb_info *info = fbcon_info_from_console(vc->vc_num);
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
- ops->graphics = ops->save_graphics;
+ par->graphics = par->save_graphics;
if (info->fbops->fb_debug_leave)
info->fbops->fb_debug_leave(info);
}
@@ -2428,7 +2418,7 @@ static int fbcon_do_set_font(struct vc_d
const u8 * data, int userfont)
{
struct fb_info *info = fbcon_info_from_console(vc->vc_num);
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
struct fbcon_display *p = &fb_display[vc->vc_num];
int resize, ret, old_userfont, old_width, old_height, old_charcount;
u8 *old_data = vc->vc_font.data;
@@ -2454,8 +2444,8 @@ static int fbcon_do_set_font(struct vc_d
if (resize) {
int cols, rows;
- cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres);
- rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
+ cols = FBCON_SWAP(par->rotate, info->var.xres, info->var.yres);
+ rows = FBCON_SWAP(par->rotate, info->var.yres, info->var.xres);
cols /= w;
rows /= h;
ret = vc_resize(vc, cols, rows);
@@ -2654,11 +2644,11 @@ static void fbcon_invert_region(struct v
void fbcon_suspended(struct fb_info *info)
{
struct vc_data *vc = NULL;
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
- if (!ops || ops->currcon < 0)
+ if (!par || par->currcon < 0)
return;
- vc = vc_cons[ops->currcon].d;
+ vc = vc_cons[par->currcon].d;
/* Clear cursor, restore saved data */
fbcon_cursor(vc, false);
@@ -2667,27 +2657,27 @@ void fbcon_suspended(struct fb_info *inf
void fbcon_resumed(struct fb_info *info)
{
struct vc_data *vc;
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
- if (!ops || ops->currcon < 0)
+ if (!par || par->currcon < 0)
return;
- vc = vc_cons[ops->currcon].d;
+ vc = vc_cons[par->currcon].d;
update_screen(vc);
}
static void fbcon_modechanged(struct fb_info *info)
{
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
struct vc_data *vc;
struct fbcon_display *p;
int rows, cols;
- if (!ops || ops->currcon < 0)
+ if (!par || par->currcon < 0)
return;
- vc = vc_cons[ops->currcon].d;
+ vc = vc_cons[par->currcon].d;
if (vc->vc_mode != KD_TEXT ||
- fbcon_info_from_console(ops->currcon) != info)
+ fbcon_info_from_console(par->currcon) != info)
return;
p = &fb_display[vc->vc_num];
@@ -2695,8 +2685,8 @@ static void fbcon_modechanged(struct fb_
if (con_is_visible(vc)) {
var_to_display(p, &info->var, info);
- cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres);
- rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
+ cols = FBCON_SWAP(par->rotate, info->var.xres, info->var.yres);
+ rows = FBCON_SWAP(par->rotate, info->var.yres, info->var.xres);
cols /= vc->vc_font.width;
rows /= vc->vc_font.height;
vc_resize(vc, cols, rows);
@@ -2705,8 +2695,8 @@ static void fbcon_modechanged(struct fb_
scrollback_current = 0;
if (fbcon_is_active(vc, info)) {
- ops->var.xoffset = ops->var.yoffset = p->yscroll = 0;
- ops->update_start(info);
+ par->var.xoffset = par->var.yoffset = p->yscroll = 0;
+ par->update_start(info);
}
fbcon_set_palette(vc, color_table);
@@ -2716,12 +2706,12 @@ static void fbcon_modechanged(struct fb_
static void fbcon_set_all_vcs(struct fb_info *info)
{
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
struct vc_data *vc;
struct fbcon_display *p;
int i, rows, cols, fg = -1;
- if (!ops || ops->currcon < 0)
+ if (!par || par->currcon < 0)
return;
for (i = first_fb_vc; i <= last_fb_vc; i++) {
@@ -2738,8 +2728,8 @@ static void fbcon_set_all_vcs(struct fb_
p = &fb_display[vc->vc_num];
set_blitting_type(vc, info);
var_to_display(p, &info->var, info);
- cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres);
- rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres);
+ cols = FBCON_SWAP(par->rotate, info->var.xres, info->var.yres);
+ rows = FBCON_SWAP(par->rotate, info->var.yres, info->var.xres);
cols /= vc->vc_font.width;
rows /= vc->vc_font.height;
vc_resize(vc, cols, rows);
@@ -2762,13 +2752,13 @@ EXPORT_SYMBOL(fbcon_update_vcs);
/* let fbcon check if it supports a new screen resolution */
int fbcon_modechange_possible(struct fb_info *info, struct fb_var_screeninfo *var)
{
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
struct vc_data *vc;
unsigned int i;
WARN_CONSOLE_UNLOCKED();
- if (!ops)
+ if (!par)
return 0;
/* prevent setting a screen size which is smaller than font size */
@@ -3066,15 +3056,14 @@ int fbcon_fb_registered(struct fb_info *
void fbcon_fb_blanked(struct fb_info *info, int blank)
{
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
struct vc_data *vc;
- if (!ops || ops->currcon < 0)
+ if (!par || par->currcon < 0)
return;
- vc = vc_cons[ops->currcon].d;
- if (vc->vc_mode != KD_TEXT ||
- fbcon_info_from_console(ops->currcon) != info)
+ vc = vc_cons[par->currcon].d;
+ if (vc->vc_mode != KD_TEXT || fbcon_info_from_console(par->currcon) != info)
return;
if (con_is_visible(vc)) {
@@ -3083,7 +3072,7 @@ void fbcon_fb_blanked(struct fb_info *in
else
do_unblank_screen(0);
}
- ops->blank_state = blank;
+ par->blank_state = blank;
}
void fbcon_new_modelist(struct fb_info *info)
@@ -3273,7 +3262,7 @@ static ssize_t cursor_blink_show(struct
struct device_attribute *attr, char *buf)
{
struct fb_info *info;
- struct fbcon_ops *ops;
+ struct fbcon_par *par;
int idx, blink = -1;
console_lock();
@@ -3283,12 +3272,12 @@ static ssize_t cursor_blink_show(struct
goto err;
info = fbcon_registered_fb[idx];
- ops = info->fbcon_par;
+ par = info->fbcon_par;
- if (!ops)
+ if (!par)
goto err;
- blink = delayed_work_pending(&ops->cursor_work);
+ blink = delayed_work_pending(&par->cursor_work);
err:
console_unlock();
return sysfs_emit(buf, "%d\n", blink);
--- a/drivers/video/fbdev/core/fbcon.h
+++ b/drivers/video/fbdev/core/fbcon.h
@@ -50,7 +50,7 @@ struct fbcon_display {
const struct fb_videomode *mode;
};
-struct fbcon_ops {
+struct fbcon_par {
void (*bmove)(struct vc_data *vc, struct fb_info *info, int sy,
int sx, int dy, int dx, int height, int width);
void (*clear)(struct vc_data *vc, struct fb_info *info, int sy,
@@ -185,7 +185,7 @@ static inline u_short fb_scrollmode(stru
#ifdef CONFIG_FB_TILEBLITTING
extern void fbcon_set_tileops(struct vc_data *vc, struct fb_info *info);
#endif
-extern void fbcon_set_bitops(struct fbcon_ops *ops);
+extern void fbcon_set_bitops(struct fbcon_par *par);
extern int soft_cursor(struct fb_info *info, struct fb_cursor *cursor);
#define FBCON_ATTRIBUTE_UNDERLINE 1
@@ -224,7 +224,7 @@ static inline int get_attribute(struct f
(i == FB_ROTATE_UR || i == FB_ROTATE_UD) ? _r : _v; })
#ifdef CONFIG_FRAMEBUFFER_CONSOLE_ROTATION
-extern void fbcon_set_rotate(struct fbcon_ops *ops);
+extern void fbcon_set_rotate(struct fbcon_par *par);
#else
#define fbcon_set_rotate(x) do {} while(0)
#endif /* CONFIG_FRAMEBUFFER_CONSOLE_ROTATION */
--- a/drivers/video/fbdev/core/fbcon_ccw.c
+++ b/drivers/video/fbdev/core/fbcon_ccw.c
@@ -63,9 +63,9 @@ static void ccw_update_attr(u8 *dst, u8
static void ccw_bmove(struct vc_data *vc, struct fb_info *info, int sy,
int sx, int dy, int dx, int height, int width)
{
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
struct fb_copyarea area;
- u32 vyres = GETVYRES(ops->p, info);
+ u32 vyres = GETVYRES(par->p, info);
area.sx = sy * vc->vc_font.height;
area.sy = vyres - ((sx + width) * vc->vc_font.width);
@@ -80,9 +80,9 @@ static void ccw_bmove(struct vc_data *vc
static void ccw_clear(struct vc_data *vc, struct fb_info *info, int sy,
int sx, int height, int width, int fg, int bg)
{
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
struct fb_fillrect region;
- u32 vyres = GETVYRES(ops->p, info);
+ u32 vyres = GETVYRES(par->p, info);
region.color = bg;
region.dx = sy * vc->vc_font.height;
@@ -99,13 +99,13 @@ static inline void ccw_putcs_aligned(str
u32 d_pitch, u32 s_pitch, u32 cellsize,
struct fb_image *image, u8 *buf, u8 *dst)
{
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
u16 charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff;
u32 idx = (vc->vc_font.height + 7) >> 3;
u8 *src;
while (cnt--) {
- src = ops->fontbuffer + (scr_readw(s--) & charmask)*cellsize;
+ src = par->fontbuffer + (scr_readw(s--) & charmask) * cellsize;
if (attr) {
ccw_update_attr(buf, src, attr, vc);
@@ -130,7 +130,7 @@ static void ccw_putcs(struct vc_data *vc
int fg, int bg)
{
struct fb_image image;
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
u32 width = (vc->vc_font.height + 7)/8;
u32 cellsize = width * vc->vc_font.width;
u32 maxcnt = info->pixmap.size/cellsize;
@@ -139,9 +139,9 @@ static void ccw_putcs(struct vc_data *vc
u32 cnt, pitch, size;
u32 attribute = get_attribute(info, scr_readw(s));
u8 *dst, *buf = NULL;
- u32 vyres = GETVYRES(ops->p, info);
+ u32 vyres = GETVYRES(par->p, info);
- if (!ops->fontbuffer)
+ if (!par->fontbuffer)
return;
image.fg_color = fg;
@@ -221,28 +221,28 @@ static void ccw_cursor(struct vc_data *v
int fg, int bg)
{
struct fb_cursor cursor;
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
unsigned short charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff;
int w = (vc->vc_font.height + 7) >> 3, c;
- int y = real_y(ops->p, vc->state.y);
+ int y = real_y(par->p, vc->state.y);
int attribute, use_sw = vc->vc_cursor_type & CUR_SW;
int err = 1, dx, dy;
char *src;
- u32 vyres = GETVYRES(ops->p, info);
+ u32 vyres = GETVYRES(par->p, info);
- if (!ops->fontbuffer)
+ if (!par->fontbuffer)
return;
cursor.set = 0;
c = scr_readw((u16 *) vc->vc_pos);
attribute = get_attribute(info, c);
- src = ops->fontbuffer + ((c & charmask) * (w * vc->vc_font.width));
+ src = par->fontbuffer + ((c & charmask) * (w * vc->vc_font.width));
- if (ops->cursor_state.image.data != src ||
- ops->cursor_reset) {
- ops->cursor_state.image.data = src;
- cursor.set |= FB_CUR_SETIMAGE;
+ if (par->cursor_state.image.data != src ||
+ par->cursor_reset) {
+ par->cursor_state.image.data = src;
+ cursor.set |= FB_CUR_SETIMAGE;
}
if (attribute) {
@@ -251,49 +251,49 @@ static void ccw_cursor(struct vc_data *v
dst = kmalloc_array(w, vc->vc_font.width, GFP_ATOMIC);
if (!dst)
return;
- kfree(ops->cursor_data);
- ops->cursor_data = dst;
+ kfree(par->cursor_data);
+ par->cursor_data = dst;
ccw_update_attr(dst, src, attribute, vc);
src = dst;
}
- if (ops->cursor_state.image.fg_color != fg ||
- ops->cursor_state.image.bg_color != bg ||
- ops->cursor_reset) {
- ops->cursor_state.image.fg_color = fg;
- ops->cursor_state.image.bg_color = bg;
+ if (par->cursor_state.image.fg_color != fg ||
+ par->cursor_state.image.bg_color != bg ||
+ par->cursor_reset) {
+ par->cursor_state.image.fg_color = fg;
+ par->cursor_state.image.bg_color = bg;
cursor.set |= FB_CUR_SETCMAP;
}
- if (ops->cursor_state.image.height != vc->vc_font.width ||
- ops->cursor_state.image.width != vc->vc_font.height ||
- ops->cursor_reset) {
- ops->cursor_state.image.height = vc->vc_font.width;
- ops->cursor_state.image.width = vc->vc_font.height;
+ if (par->cursor_state.image.height != vc->vc_font.width ||
+ par->cursor_state.image.width != vc->vc_font.height ||
+ par->cursor_reset) {
+ par->cursor_state.image.height = vc->vc_font.width;
+ par->cursor_state.image.width = vc->vc_font.height;
cursor.set |= FB_CUR_SETSIZE;
}
dx = y * vc->vc_font.height;
dy = vyres - ((vc->state.x + 1) * vc->vc_font.width);
- if (ops->cursor_state.image.dx != dx ||
- ops->cursor_state.image.dy != dy ||
- ops->cursor_reset) {
- ops->cursor_state.image.dx = dx;
- ops->cursor_state.image.dy = dy;
+ if (par->cursor_state.image.dx != dx ||
+ par->cursor_state.image.dy != dy ||
+ par->cursor_reset) {
+ par->cursor_state.image.dx = dx;
+ par->cursor_state.image.dy = dy;
cursor.set |= FB_CUR_SETPOS;
}
- if (ops->cursor_state.hot.x || ops->cursor_state.hot.y ||
- ops->cursor_reset) {
- ops->cursor_state.hot.x = cursor.hot.y = 0;
+ if (par->cursor_state.hot.x || par->cursor_state.hot.y ||
+ par->cursor_reset) {
+ par->cursor_state.hot.x = cursor.hot.y = 0;
cursor.set |= FB_CUR_SETHOT;
}
if (cursor.set & FB_CUR_SETSIZE ||
- vc->vc_cursor_type != ops->p->cursor_shape ||
- ops->cursor_state.mask == NULL ||
- ops->cursor_reset) {
+ vc->vc_cursor_type != par->p->cursor_shape ||
+ par->cursor_state.mask == NULL ||
+ par->cursor_reset) {
char *tmp, *mask = kmalloc_array(w, vc->vc_font.width,
GFP_ATOMIC);
int cur_height, size, i = 0;
@@ -309,13 +309,13 @@ static void ccw_cursor(struct vc_data *v
return;
}
- kfree(ops->cursor_state.mask);
- ops->cursor_state.mask = mask;
+ kfree(par->cursor_state.mask);
+ par->cursor_state.mask = mask;
- ops->p->cursor_shape = vc->vc_cursor_type;
+ par->p->cursor_shape = vc->vc_cursor_type;
cursor.set |= FB_CUR_SETSHAPE;
- switch (CUR_SIZE(ops->p->cursor_shape)) {
+ switch (CUR_SIZE(par->p->cursor_shape)) {
case CUR_NONE:
cur_height = 0;
break;
@@ -348,19 +348,19 @@ static void ccw_cursor(struct vc_data *v
kfree(tmp);
}
- ops->cursor_state.enable = enable && !use_sw;
+ par->cursor_state.enable = enable && !use_sw;
cursor.image.data = src;
- cursor.image.fg_color = ops->cursor_state.image.fg_color;
- cursor.image.bg_color = ops->cursor_state.image.bg_color;
- cursor.image.dx = ops->cursor_state.image.dx;
- cursor.image.dy = ops->cursor_state.image.dy;
- cursor.image.height = ops->cursor_state.image.height;
- cursor.image.width = ops->cursor_state.image.width;
- cursor.hot.x = ops->cursor_state.hot.x;
- cursor.hot.y = ops->cursor_state.hot.y;
- cursor.mask = ops->cursor_state.mask;
- cursor.enable = ops->cursor_state.enable;
+ cursor.image.fg_color = par->cursor_state.image.fg_color;
+ cursor.image.bg_color = par->cursor_state.image.bg_color;
+ cursor.image.dx = par->cursor_state.image.dx;
+ cursor.image.dy = par->cursor_state.image.dy;
+ cursor.image.height = par->cursor_state.image.height;
+ cursor.image.width = par->cursor_state.image.width;
+ cursor.hot.x = par->cursor_state.hot.x;
+ cursor.hot.y = par->cursor_state.hot.y;
+ cursor.mask = par->cursor_state.mask;
+ cursor.enable = par->cursor_state.enable;
cursor.image.depth = 1;
cursor.rop = ROP_XOR;
@@ -370,32 +370,32 @@ static void ccw_cursor(struct vc_data *v
if (err)
soft_cursor(info, &cursor);
- ops->cursor_reset = 0;
+ par->cursor_reset = 0;
}
static int ccw_update_start(struct fb_info *info)
{
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
u32 yoffset;
- u32 vyres = GETVYRES(ops->p, info);
+ u32 vyres = GETVYRES(par->p, info);
int err;
- yoffset = (vyres - info->var.yres) - ops->var.xoffset;
- ops->var.xoffset = ops->var.yoffset;
- ops->var.yoffset = yoffset;
- err = fb_pan_display(info, &ops->var);
- ops->var.xoffset = info->var.xoffset;
- ops->var.yoffset = info->var.yoffset;
- ops->var.vmode = info->var.vmode;
+ yoffset = (vyres - info->var.yres) - par->var.xoffset;
+ par->var.xoffset = par->var.yoffset;
+ par->var.yoffset = yoffset;
+ err = fb_pan_display(info, &par->var);
+ par->var.xoffset = info->var.xoffset;
+ par->var.yoffset = info->var.yoffset;
+ par->var.vmode = info->var.vmode;
return err;
}
-void fbcon_rotate_ccw(struct fbcon_ops *ops)
+void fbcon_rotate_ccw(struct fbcon_par *par)
{
- ops->bmove = ccw_bmove;
- ops->clear = ccw_clear;
- ops->putcs = ccw_putcs;
- ops->clear_margins = ccw_clear_margins;
- ops->cursor = ccw_cursor;
- ops->update_start = ccw_update_start;
+ par->bmove = ccw_bmove;
+ par->clear = ccw_clear;
+ par->putcs = ccw_putcs;
+ par->clear_margins = ccw_clear_margins;
+ par->cursor = ccw_cursor;
+ par->update_start = ccw_update_start;
}
--- a/drivers/video/fbdev/core/fbcon_cw.c
+++ b/drivers/video/fbdev/core/fbcon_cw.c
@@ -48,9 +48,9 @@ static void cw_update_attr(u8 *dst, u8 *
static void cw_bmove(struct vc_data *vc, struct fb_info *info, int sy,
int sx, int dy, int dx, int height, int width)
{
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
struct fb_copyarea area;
- u32 vxres = GETVXRES(ops->p, info);
+ u32 vxres = GETVXRES(par->p, info);
area.sx = vxres - ((sy + height) * vc->vc_font.height);
area.sy = sx * vc->vc_font.width;
@@ -65,9 +65,9 @@ static void cw_bmove(struct vc_data *vc,
static void cw_clear(struct vc_data *vc, struct fb_info *info, int sy,
int sx, int height, int width, int fg, int bg)
{
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
struct fb_fillrect region;
- u32 vxres = GETVXRES(ops->p, info);
+ u32 vxres = GETVXRES(par->p, info);
region.color = bg;
region.dx = vxres - ((sy + height) * vc->vc_font.height);
@@ -84,13 +84,13 @@ static inline void cw_putcs_aligned(stru
u32 d_pitch, u32 s_pitch, u32 cellsize,
struct fb_image *image, u8 *buf, u8 *dst)
{
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
u16 charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff;
u32 idx = (vc->vc_font.height + 7) >> 3;
u8 *src;
while (cnt--) {
- src = ops->fontbuffer + (scr_readw(s++) & charmask)*cellsize;
+ src = par->fontbuffer + (scr_readw(s++) & charmask) * cellsize;
if (attr) {
cw_update_attr(buf, src, attr, vc);
@@ -115,7 +115,7 @@ static void cw_putcs(struct vc_data *vc,
int fg, int bg)
{
struct fb_image image;
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
u32 width = (vc->vc_font.height + 7)/8;
u32 cellsize = width * vc->vc_font.width;
u32 maxcnt = info->pixmap.size/cellsize;
@@ -124,9 +124,9 @@ static void cw_putcs(struct vc_data *vc,
u32 cnt, pitch, size;
u32 attribute = get_attribute(info, scr_readw(s));
u8 *dst, *buf = NULL;
- u32 vxres = GETVXRES(ops->p, info);
+ u32 vxres = GETVXRES(par->p, info);
- if (!ops->fontbuffer)
+ if (!par->fontbuffer)
return;
image.fg_color = fg;
@@ -204,28 +204,28 @@ static void cw_cursor(struct vc_data *vc
int fg, int bg)
{
struct fb_cursor cursor;
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
unsigned short charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff;
int w = (vc->vc_font.height + 7) >> 3, c;
- int y = real_y(ops->p, vc->state.y);
+ int y = real_y(par->p, vc->state.y);
int attribute, use_sw = vc->vc_cursor_type & CUR_SW;
int err = 1, dx, dy;
char *src;
- u32 vxres = GETVXRES(ops->p, info);
+ u32 vxres = GETVXRES(par->p, info);
- if (!ops->fontbuffer)
+ if (!par->fontbuffer)
return;
cursor.set = 0;
c = scr_readw((u16 *) vc->vc_pos);
attribute = get_attribute(info, c);
- src = ops->fontbuffer + ((c & charmask) * (w * vc->vc_font.width));
+ src = par->fontbuffer + ((c & charmask) * (w * vc->vc_font.width));
- if (ops->cursor_state.image.data != src ||
- ops->cursor_reset) {
- ops->cursor_state.image.data = src;
- cursor.set |= FB_CUR_SETIMAGE;
+ if (par->cursor_state.image.data != src ||
+ par->cursor_reset) {
+ par->cursor_state.image.data = src;
+ cursor.set |= FB_CUR_SETIMAGE;
}
if (attribute) {
@@ -234,49 +234,49 @@ static void cw_cursor(struct vc_data *vc
dst = kmalloc_array(w, vc->vc_font.width, GFP_ATOMIC);
if (!dst)
return;
- kfree(ops->cursor_data);
- ops->cursor_data = dst;
+ kfree(par->cursor_data);
+ par->cursor_data = dst;
cw_update_attr(dst, src, attribute, vc);
src = dst;
}
- if (ops->cursor_state.image.fg_color != fg ||
- ops->cursor_state.image.bg_color != bg ||
- ops->cursor_reset) {
- ops->cursor_state.image.fg_color = fg;
- ops->cursor_state.image.bg_color = bg;
+ if (par->cursor_state.image.fg_color != fg ||
+ par->cursor_state.image.bg_color != bg ||
+ par->cursor_reset) {
+ par->cursor_state.image.fg_color = fg;
+ par->cursor_state.image.bg_color = bg;
cursor.set |= FB_CUR_SETCMAP;
}
- if (ops->cursor_state.image.height != vc->vc_font.width ||
- ops->cursor_state.image.width != vc->vc_font.height ||
- ops->cursor_reset) {
- ops->cursor_state.image.height = vc->vc_font.width;
- ops->cursor_state.image.width = vc->vc_font.height;
+ if (par->cursor_state.image.height != vc->vc_font.width ||
+ par->cursor_state.image.width != vc->vc_font.height ||
+ par->cursor_reset) {
+ par->cursor_state.image.height = vc->vc_font.width;
+ par->cursor_state.image.width = vc->vc_font.height;
cursor.set |= FB_CUR_SETSIZE;
}
dx = vxres - ((y * vc->vc_font.height) + vc->vc_font.height);
dy = vc->state.x * vc->vc_font.width;
- if (ops->cursor_state.image.dx != dx ||
- ops->cursor_state.image.dy != dy ||
- ops->cursor_reset) {
- ops->cursor_state.image.dx = dx;
- ops->cursor_state.image.dy = dy;
+ if (par->cursor_state.image.dx != dx ||
+ par->cursor_state.image.dy != dy ||
+ par->cursor_reset) {
+ par->cursor_state.image.dx = dx;
+ par->cursor_state.image.dy = dy;
cursor.set |= FB_CUR_SETPOS;
}
- if (ops->cursor_state.hot.x || ops->cursor_state.hot.y ||
- ops->cursor_reset) {
- ops->cursor_state.hot.x = cursor.hot.y = 0;
+ if (par->cursor_state.hot.x || par->cursor_state.hot.y ||
+ par->cursor_reset) {
+ par->cursor_state.hot.x = cursor.hot.y = 0;
cursor.set |= FB_CUR_SETHOT;
}
if (cursor.set & FB_CUR_SETSIZE ||
- vc->vc_cursor_type != ops->p->cursor_shape ||
- ops->cursor_state.mask == NULL ||
- ops->cursor_reset) {
+ vc->vc_cursor_type != par->p->cursor_shape ||
+ par->cursor_state.mask == NULL ||
+ par->cursor_reset) {
char *tmp, *mask = kmalloc_array(w, vc->vc_font.width,
GFP_ATOMIC);
int cur_height, size, i = 0;
@@ -292,13 +292,13 @@ static void cw_cursor(struct vc_data *vc
return;
}
- kfree(ops->cursor_state.mask);
- ops->cursor_state.mask = mask;
+ kfree(par->cursor_state.mask);
+ par->cursor_state.mask = mask;
- ops->p->cursor_shape = vc->vc_cursor_type;
+ par->p->cursor_shape = vc->vc_cursor_type;
cursor.set |= FB_CUR_SETSHAPE;
- switch (CUR_SIZE(ops->p->cursor_shape)) {
+ switch (CUR_SIZE(par->p->cursor_shape)) {
case CUR_NONE:
cur_height = 0;
break;
@@ -331,19 +331,19 @@ static void cw_cursor(struct vc_data *vc
kfree(tmp);
}
- ops->cursor_state.enable = enable && !use_sw;
+ par->cursor_state.enable = enable && !use_sw;
cursor.image.data = src;
- cursor.image.fg_color = ops->cursor_state.image.fg_color;
- cursor.image.bg_color = ops->cursor_state.image.bg_color;
- cursor.image.dx = ops->cursor_state.image.dx;
- cursor.image.dy = ops->cursor_state.image.dy;
- cursor.image.height = ops->cursor_state.image.height;
- cursor.image.width = ops->cursor_state.image.width;
- cursor.hot.x = ops->cursor_state.hot.x;
- cursor.hot.y = ops->cursor_state.hot.y;
- cursor.mask = ops->cursor_state.mask;
- cursor.enable = ops->cursor_state.enable;
+ cursor.image.fg_color = par->cursor_state.image.fg_color;
+ cursor.image.bg_color = par->cursor_state.image.bg_color;
+ cursor.image.dx = par->cursor_state.image.dx;
+ cursor.image.dy = par->cursor_state.image.dy;
+ cursor.image.height = par->cursor_state.image.height;
+ cursor.image.width = par->cursor_state.image.width;
+ cursor.hot.x = par->cursor_state.hot.x;
+ cursor.hot.y = par->cursor_state.hot.y;
+ cursor.mask = par->cursor_state.mask;
+ cursor.enable = par->cursor_state.enable;
cursor.image.depth = 1;
cursor.rop = ROP_XOR;
@@ -353,32 +353,32 @@ static void cw_cursor(struct vc_data *vc
if (err)
soft_cursor(info, &cursor);
- ops->cursor_reset = 0;
+ par->cursor_reset = 0;
}
static int cw_update_start(struct fb_info *info)
{
- struct fbcon_ops *ops = info->fbcon_par;
- u32 vxres = GETVXRES(ops->p, info);
+ struct fbcon_par *par = info->fbcon_par;
+ u32 vxres = GETVXRES(par->p, info);
u32 xoffset;
int err;
- xoffset = vxres - (info->var.xres + ops->var.yoffset);
- ops->var.yoffset = ops->var.xoffset;
- ops->var.xoffset = xoffset;
- err = fb_pan_display(info, &ops->var);
- ops->var.xoffset = info->var.xoffset;
- ops->var.yoffset = info->var.yoffset;
- ops->var.vmode = info->var.vmode;
+ xoffset = vxres - (info->var.xres + par->var.yoffset);
+ par->var.yoffset = par->var.xoffset;
+ par->var.xoffset = xoffset;
+ err = fb_pan_display(info, &par->var);
+ par->var.xoffset = info->var.xoffset;
+ par->var.yoffset = info->var.yoffset;
+ par->var.vmode = info->var.vmode;
return err;
}
-void fbcon_rotate_cw(struct fbcon_ops *ops)
+void fbcon_rotate_cw(struct fbcon_par *par)
{
- ops->bmove = cw_bmove;
- ops->clear = cw_clear;
- ops->putcs = cw_putcs;
- ops->clear_margins = cw_clear_margins;
- ops->cursor = cw_cursor;
- ops->update_start = cw_update_start;
+ par->bmove = cw_bmove;
+ par->clear = cw_clear;
+ par->putcs = cw_putcs;
+ par->clear_margins = cw_clear_margins;
+ par->cursor = cw_cursor;
+ par->update_start = cw_update_start;
}
--- a/drivers/video/fbdev/core/fbcon_rotate.c
+++ b/drivers/video/fbdev/core/fbcon_rotate.c
@@ -20,32 +20,32 @@
static int fbcon_rotate_font(struct fb_info *info, struct vc_data *vc)
{
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
int len, err = 0;
int s_cellsize, d_cellsize, i;
const u8 *src;
u8 *dst;
- if (vc->vc_font.data == ops->fontdata &&
- ops->p->con_rotate == ops->cur_rotate)
+ if (vc->vc_font.data == par->fontdata &&
+ par->p->con_rotate == par->cur_rotate)
goto finished;
- src = ops->fontdata = vc->vc_font.data;
- ops->cur_rotate = ops->p->con_rotate;
+ src = par->fontdata = vc->vc_font.data;
+ par->cur_rotate = par->p->con_rotate;
len = vc->vc_font.charcount;
s_cellsize = ((vc->vc_font.width + 7)/8) *
vc->vc_font.height;
d_cellsize = s_cellsize;
- if (ops->rotate == FB_ROTATE_CW ||
- ops->rotate == FB_ROTATE_CCW)
+ if (par->rotate == FB_ROTATE_CW ||
+ par->rotate == FB_ROTATE_CCW)
d_cellsize = ((vc->vc_font.height + 7)/8) *
vc->vc_font.width;
if (info->fbops->fb_sync)
info->fbops->fb_sync(info);
- if (ops->fd_size < d_cellsize * len) {
+ if (par->fd_size < d_cellsize * len) {
dst = kmalloc_array(len, d_cellsize, GFP_KERNEL);
if (dst == NULL) {
@@ -53,15 +53,15 @@ static int fbcon_rotate_font(struct fb_i
goto finished;
}
- ops->fd_size = d_cellsize * len;
- kfree(ops->fontbuffer);
- ops->fontbuffer = dst;
+ par->fd_size = d_cellsize * len;
+ kfree(par->fontbuffer);
+ par->fontbuffer = dst;
}
- dst = ops->fontbuffer;
- memset(dst, 0, ops->fd_size);
+ dst = par->fontbuffer;
+ memset(dst, 0, par->fd_size);
- switch (ops->rotate) {
+ switch (par->rotate) {
case FB_ROTATE_UD:
for (i = len; i--; ) {
rotate_ud(src, dst, vc->vc_font.width,
@@ -93,19 +93,19 @@ finished:
return err;
}
-void fbcon_set_rotate(struct fbcon_ops *ops)
+void fbcon_set_rotate(struct fbcon_par *par)
{
- ops->rotate_font = fbcon_rotate_font;
+ par->rotate_font = fbcon_rotate_font;
- switch(ops->rotate) {
+ switch (par->rotate) {
case FB_ROTATE_CW:
- fbcon_rotate_cw(ops);
+ fbcon_rotate_cw(par);
break;
case FB_ROTATE_UD:
- fbcon_rotate_ud(ops);
+ fbcon_rotate_ud(par);
break;
case FB_ROTATE_CCW:
- fbcon_rotate_ccw(ops);
+ fbcon_rotate_ccw(par);
break;
}
}
--- a/drivers/video/fbdev/core/fbcon_rotate.h
+++ b/drivers/video/fbdev/core/fbcon_rotate.h
@@ -90,7 +90,7 @@ static inline void rotate_ccw(const char
}
}
-extern void fbcon_rotate_cw(struct fbcon_ops *ops);
-extern void fbcon_rotate_ud(struct fbcon_ops *ops);
-extern void fbcon_rotate_ccw(struct fbcon_ops *ops);
+extern void fbcon_rotate_cw(struct fbcon_par *par);
+extern void fbcon_rotate_ud(struct fbcon_par *par);
+extern void fbcon_rotate_ccw(struct fbcon_par *par);
#endif
--- a/drivers/video/fbdev/core/fbcon_ud.c
+++ b/drivers/video/fbdev/core/fbcon_ud.c
@@ -48,10 +48,10 @@ static void ud_update_attr(u8 *dst, u8 *
static void ud_bmove(struct vc_data *vc, struct fb_info *info, int sy,
int sx, int dy, int dx, int height, int width)
{
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
struct fb_copyarea area;
- u32 vyres = GETVYRES(ops->p, info);
- u32 vxres = GETVXRES(ops->p, info);
+ u32 vyres = GETVYRES(par->p, info);
+ u32 vxres = GETVXRES(par->p, info);
area.sy = vyres - ((sy + height) * vc->vc_font.height);
area.sx = vxres - ((sx + width) * vc->vc_font.width);
@@ -66,10 +66,10 @@ static void ud_bmove(struct vc_data *vc,
static void ud_clear(struct vc_data *vc, struct fb_info *info, int sy,
int sx, int height, int width, int fg, int bg)
{
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
struct fb_fillrect region;
- u32 vyres = GETVYRES(ops->p, info);
- u32 vxres = GETVXRES(ops->p, info);
+ u32 vyres = GETVYRES(par->p, info);
+ u32 vxres = GETVXRES(par->p, info);
region.color = bg;
region.dy = vyres - ((sy + height) * vc->vc_font.height);
@@ -86,13 +86,13 @@ static inline void ud_putcs_aligned(stru
u32 d_pitch, u32 s_pitch, u32 cellsize,
struct fb_image *image, u8 *buf, u8 *dst)
{
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
u16 charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff;
u32 idx = vc->vc_font.width >> 3;
u8 *src;
while (cnt--) {
- src = ops->fontbuffer + (scr_readw(s--) & charmask)*cellsize;
+ src = par->fontbuffer + (scr_readw(s--) & charmask) * cellsize;
if (attr) {
ud_update_attr(buf, src, attr, vc);
@@ -119,7 +119,7 @@ static inline void ud_putcs_unaligned(st
struct fb_image *image, u8 *buf,
u8 *dst)
{
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
u16 charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff;
u32 shift_low = 0, mod = vc->vc_font.width % 8;
u32 shift_high = 8;
@@ -127,7 +127,7 @@ static inline void ud_putcs_unaligned(st
u8 *src;
while (cnt--) {
- src = ops->fontbuffer + (scr_readw(s--) & charmask)*cellsize;
+ src = par->fontbuffer + (scr_readw(s--) & charmask) * cellsize;
if (attr) {
ud_update_attr(buf, src, attr, vc);
@@ -152,7 +152,7 @@ static void ud_putcs(struct vc_data *vc,
int fg, int bg)
{
struct fb_image image;
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
u32 width = (vc->vc_font.width + 7)/8;
u32 cellsize = width * vc->vc_font.height;
u32 maxcnt = info->pixmap.size/cellsize;
@@ -161,10 +161,10 @@ static void ud_putcs(struct vc_data *vc,
u32 mod = vc->vc_font.width % 8, cnt, pitch, size;
u32 attribute = get_attribute(info, scr_readw(s));
u8 *dst, *buf = NULL;
- u32 vyres = GETVYRES(ops->p, info);
- u32 vxres = GETVXRES(ops->p, info);
+ u32 vyres = GETVYRES(par->p, info);
+ u32 vxres = GETVXRES(par->p, info);
- if (!ops->fontbuffer)
+ if (!par->fontbuffer)
return;
image.fg_color = fg;
@@ -251,29 +251,29 @@ static void ud_cursor(struct vc_data *vc
int fg, int bg)
{
struct fb_cursor cursor;
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
unsigned short charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff;
int w = (vc->vc_font.width + 7) >> 3, c;
- int y = real_y(ops->p, vc->state.y);
+ int y = real_y(par->p, vc->state.y);
int attribute, use_sw = vc->vc_cursor_type & CUR_SW;
int err = 1, dx, dy;
char *src;
- u32 vyres = GETVYRES(ops->p, info);
- u32 vxres = GETVXRES(ops->p, info);
+ u32 vyres = GETVYRES(par->p, info);
+ u32 vxres = GETVXRES(par->p, info);
- if (!ops->fontbuffer)
+ if (!par->fontbuffer)
return;
cursor.set = 0;
c = scr_readw((u16 *) vc->vc_pos);
attribute = get_attribute(info, c);
- src = ops->fontbuffer + ((c & charmask) * (w * vc->vc_font.height));
+ src = par->fontbuffer + ((c & charmask) * (w * vc->vc_font.height));
- if (ops->cursor_state.image.data != src ||
- ops->cursor_reset) {
- ops->cursor_state.image.data = src;
- cursor.set |= FB_CUR_SETIMAGE;
+ if (par->cursor_state.image.data != src ||
+ par->cursor_reset) {
+ par->cursor_state.image.data = src;
+ cursor.set |= FB_CUR_SETIMAGE;
}
if (attribute) {
@@ -282,49 +282,49 @@ static void ud_cursor(struct vc_data *vc
dst = kmalloc_array(w, vc->vc_font.height, GFP_ATOMIC);
if (!dst)
return;
- kfree(ops->cursor_data);
- ops->cursor_data = dst;
+ kfree(par->cursor_data);
+ par->cursor_data = dst;
ud_update_attr(dst, src, attribute, vc);
src = dst;
}
- if (ops->cursor_state.image.fg_color != fg ||
- ops->cursor_state.image.bg_color != bg ||
- ops->cursor_reset) {
- ops->cursor_state.image.fg_color = fg;
- ops->cursor_state.image.bg_color = bg;
+ if (par->cursor_state.image.fg_color != fg ||
+ par->cursor_state.image.bg_color != bg ||
+ par->cursor_reset) {
+ par->cursor_state.image.fg_color = fg;
+ par->cursor_state.image.bg_color = bg;
cursor.set |= FB_CUR_SETCMAP;
}
- if (ops->cursor_state.image.height != vc->vc_font.height ||
- ops->cursor_state.image.width != vc->vc_font.width ||
- ops->cursor_reset) {
- ops->cursor_state.image.height = vc->vc_font.height;
- ops->cursor_state.image.width = vc->vc_font.width;
+ if (par->cursor_state.image.height != vc->vc_font.height ||
+ par->cursor_state.image.width != vc->vc_font.width ||
+ par->cursor_reset) {
+ par->cursor_state.image.height = vc->vc_font.height;
+ par->cursor_state.image.width = vc->vc_font.width;
cursor.set |= FB_CUR_SETSIZE;
}
dy = vyres - ((y * vc->vc_font.height) + vc->vc_font.height);
dx = vxres - ((vc->state.x * vc->vc_font.width) + vc->vc_font.width);
- if (ops->cursor_state.image.dx != dx ||
- ops->cursor_state.image.dy != dy ||
- ops->cursor_reset) {
- ops->cursor_state.image.dx = dx;
- ops->cursor_state.image.dy = dy;
+ if (par->cursor_state.image.dx != dx ||
+ par->cursor_state.image.dy != dy ||
+ par->cursor_reset) {
+ par->cursor_state.image.dx = dx;
+ par->cursor_state.image.dy = dy;
cursor.set |= FB_CUR_SETPOS;
}
- if (ops->cursor_state.hot.x || ops->cursor_state.hot.y ||
- ops->cursor_reset) {
- ops->cursor_state.hot.x = cursor.hot.y = 0;
+ if (par->cursor_state.hot.x || par->cursor_state.hot.y ||
+ par->cursor_reset) {
+ par->cursor_state.hot.x = cursor.hot.y = 0;
cursor.set |= FB_CUR_SETHOT;
}
if (cursor.set & FB_CUR_SETSIZE ||
- vc->vc_cursor_type != ops->p->cursor_shape ||
- ops->cursor_state.mask == NULL ||
- ops->cursor_reset) {
+ vc->vc_cursor_type != par->p->cursor_shape ||
+ par->cursor_state.mask == NULL ||
+ par->cursor_reset) {
char *mask = kmalloc_array(w, vc->vc_font.height, GFP_ATOMIC);
int cur_height, size, i = 0;
u8 msk = 0xff;
@@ -332,13 +332,13 @@ static void ud_cursor(struct vc_data *vc
if (!mask)
return;
- kfree(ops->cursor_state.mask);
- ops->cursor_state.mask = mask;
+ kfree(par->cursor_state.mask);
+ par->cursor_state.mask = mask;
- ops->p->cursor_shape = vc->vc_cursor_type;
+ par->p->cursor_shape = vc->vc_cursor_type;
cursor.set |= FB_CUR_SETSHAPE;
- switch (CUR_SIZE(ops->p->cursor_shape)) {
+ switch (CUR_SIZE(par->p->cursor_shape)) {
case CUR_NONE:
cur_height = 0;
break;
@@ -371,19 +371,19 @@ static void ud_cursor(struct vc_data *vc
mask[i++] = ~msk;
}
- ops->cursor_state.enable = enable && !use_sw;
+ par->cursor_state.enable = enable && !use_sw;
cursor.image.data = src;
- cursor.image.fg_color = ops->cursor_state.image.fg_color;
- cursor.image.bg_color = ops->cursor_state.image.bg_color;
- cursor.image.dx = ops->cursor_state.image.dx;
- cursor.image.dy = ops->cursor_state.image.dy;
- cursor.image.height = ops->cursor_state.image.height;
- cursor.image.width = ops->cursor_state.image.width;
- cursor.hot.x = ops->cursor_state.hot.x;
- cursor.hot.y = ops->cursor_state.hot.y;
- cursor.mask = ops->cursor_state.mask;
- cursor.enable = ops->cursor_state.enable;
+ cursor.image.fg_color = par->cursor_state.image.fg_color;
+ cursor.image.bg_color = par->cursor_state.image.bg_color;
+ cursor.image.dx = par->cursor_state.image.dx;
+ cursor.image.dy = par->cursor_state.image.dy;
+ cursor.image.height = par->cursor_state.image.height;
+ cursor.image.width = par->cursor_state.image.width;
+ cursor.hot.x = par->cursor_state.hot.x;
+ cursor.hot.y = par->cursor_state.hot.y;
+ cursor.mask = par->cursor_state.mask;
+ cursor.enable = par->cursor_state.enable;
cursor.image.depth = 1;
cursor.rop = ROP_XOR;
@@ -393,36 +393,36 @@ static void ud_cursor(struct vc_data *vc
if (err)
soft_cursor(info, &cursor);
- ops->cursor_reset = 0;
+ par->cursor_reset = 0;
}
static int ud_update_start(struct fb_info *info)
{
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
int xoffset, yoffset;
- u32 vyres = GETVYRES(ops->p, info);
- u32 vxres = GETVXRES(ops->p, info);
+ u32 vyres = GETVYRES(par->p, info);
+ u32 vxres = GETVXRES(par->p, info);
int err;
- xoffset = vxres - info->var.xres - ops->var.xoffset;
- yoffset = vyres - info->var.yres - ops->var.yoffset;
+ xoffset = vxres - info->var.xres - par->var.xoffset;
+ yoffset = vyres - info->var.yres - par->var.yoffset;
if (yoffset < 0)
yoffset += vyres;
- ops->var.xoffset = xoffset;
- ops->var.yoffset = yoffset;
- err = fb_pan_display(info, &ops->var);
- ops->var.xoffset = info->var.xoffset;
- ops->var.yoffset = info->var.yoffset;
- ops->var.vmode = info->var.vmode;
+ par->var.xoffset = xoffset;
+ par->var.yoffset = yoffset;
+ err = fb_pan_display(info, &par->var);
+ par->var.xoffset = info->var.xoffset;
+ par->var.yoffset = info->var.yoffset;
+ par->var.vmode = info->var.vmode;
return err;
}
-void fbcon_rotate_ud(struct fbcon_ops *ops)
+void fbcon_rotate_ud(struct fbcon_par *par)
{
- ops->bmove = ud_bmove;
- ops->clear = ud_clear;
- ops->putcs = ud_putcs;
- ops->clear_margins = ud_clear_margins;
- ops->cursor = ud_cursor;
- ops->update_start = ud_update_start;
+ par->bmove = ud_bmove;
+ par->clear = ud_clear;
+ par->putcs = ud_putcs;
+ par->clear_margins = ud_clear_margins;
+ par->cursor = ud_cursor;
+ par->update_start = ud_update_start;
}
--- a/drivers/video/fbdev/core/softcursor.c
+++ b/drivers/video/fbdev/core/softcursor.c
@@ -21,7 +21,7 @@
int soft_cursor(struct fb_info *info, struct fb_cursor *cursor)
{
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
unsigned int scan_align = info->pixmap.scan_align - 1;
unsigned int buf_align = info->pixmap.buf_align - 1;
unsigned int i, size, dsize, s_pitch, d_pitch;
@@ -34,19 +34,19 @@ int soft_cursor(struct fb_info *info, st
s_pitch = (cursor->image.width + 7) >> 3;
dsize = s_pitch * cursor->image.height;
- if (dsize + sizeof(struct fb_image) != ops->cursor_size) {
- kfree(ops->cursor_src);
- ops->cursor_size = dsize + sizeof(struct fb_image);
-
- ops->cursor_src = kmalloc(ops->cursor_size, GFP_ATOMIC);
- if (!ops->cursor_src) {
- ops->cursor_size = 0;
+ if (dsize + sizeof(struct fb_image) != par->cursor_size) {
+ kfree(par->cursor_src);
+ par->cursor_size = dsize + sizeof(struct fb_image);
+
+ par->cursor_src = kmalloc(par->cursor_size, GFP_ATOMIC);
+ if (!par->cursor_src) {
+ par->cursor_size = 0;
return -ENOMEM;
}
}
- src = ops->cursor_src + sizeof(struct fb_image);
- image = (struct fb_image *)ops->cursor_src;
+ src = par->cursor_src + sizeof(struct fb_image);
+ image = (struct fb_image *)par->cursor_src;
*image = cursor->image;
d_pitch = (s_pitch + scan_align) & ~scan_align;
--- a/drivers/video/fbdev/core/tileblit.c
+++ b/drivers/video/fbdev/core/tileblit.c
@@ -151,34 +151,34 @@ static void tile_cursor(struct vc_data *
static int tile_update_start(struct fb_info *info)
{
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
int err;
- err = fb_pan_display(info, &ops->var);
- ops->var.xoffset = info->var.xoffset;
- ops->var.yoffset = info->var.yoffset;
- ops->var.vmode = info->var.vmode;
+ err = fb_pan_display(info, &par->var);
+ par->var.xoffset = info->var.xoffset;
+ par->var.yoffset = info->var.yoffset;
+ par->var.vmode = info->var.vmode;
return err;
}
void fbcon_set_tileops(struct vc_data *vc, struct fb_info *info)
{
struct fb_tilemap map;
- struct fbcon_ops *ops = info->fbcon_par;
+ struct fbcon_par *par = info->fbcon_par;
- ops->bmove = tile_bmove;
- ops->clear = tile_clear;
- ops->putcs = tile_putcs;
- ops->clear_margins = tile_clear_margins;
- ops->cursor = tile_cursor;
- ops->update_start = tile_update_start;
+ par->bmove = tile_bmove;
+ par->clear = tile_clear;
+ par->putcs = tile_putcs;
+ par->clear_margins = tile_clear_margins;
+ par->cursor = tile_cursor;
+ par->update_start = tile_update_start;
- if (ops->p) {
+ if (par->p) {
map.width = vc->vc_font.width;
map.height = vc->vc_font.height;
map.depth = 1;
map.length = vc->vc_font.charcount;
- map.data = ops->p->fontdata;
+ map.data = par->p->fontdata;
info->tileops->fb_settile(info, &map);
}
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 157/188] fbcon: Avoid OOB font access if console rotation fails
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (155 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 156/188] fbcon: Rename struct fbcon_ops to struct fbcon_par Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 158/188] block: fix zone write plug removal Greg Kroah-Hartman
` (35 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Zimmermann, Helge Deller,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <tzimmermann@suse.de>
[ Upstream commit e4ef723d8975a2694cc90733a6b888a5e2841842 ]
Clear the font buffer if the reallocation during console rotation fails
in fbcon_rotate_font(). The putcs implementations for the rotated buffer
will return early in this case. See [1] for an example.
Currently, fbcon_rotate_font() keeps the old buffer, which is too small
for the rotated font. Printing to the rotated console with a high-enough
character code will overflow the font buffer.
v2:
- fix typos in commit message
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: 6cc50e1c5b57 ("[PATCH] fbcon: Console Rotation - Add support to rotate font bitmap")
Cc: stable@vger.kernel.org # v2.6.15+
Link: https://elixir.bootlin.com/linux/v6.19/source/drivers/video/fbdev/core/fbcon_ccw.c#L144 # [1]
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/core/fbcon_rotate.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/video/fbdev/core/fbcon_rotate.c
+++ b/drivers/video/fbdev/core/fbcon_rotate.c
@@ -46,6 +46,10 @@ static int fbcon_rotate_font(struct fb_i
info->fbops->fb_sync(info);
if (par->fd_size < d_cellsize * len) {
+ kfree(par->fontbuffer);
+ par->fontbuffer = NULL;
+ par->fd_size = 0;
+
dst = kmalloc_array(len, d_cellsize, GFP_KERNEL);
if (dst == NULL) {
@@ -54,7 +58,6 @@ static int fbcon_rotate_font(struct fb_i
}
par->fd_size = d_cellsize * len;
- kfree(par->fontbuffer);
par->fontbuffer = dst;
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 158/188] block: fix zone write plug removal
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (156 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 157/188] fbcon: Avoid OOB font access if console rotation fails Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 159/188] EDAC/versalnet: Fix device name memory leak Greg Kroah-Hartman
` (34 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Christoph Hellwig,
Johannes Thumshirn, Jens Axboe, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <dlemoal@kernel.org>
[ Upstream commit b7d4ffb510373cc6ecf16022dd0e510a023034fb ]
Commit 7b295187287e ("block: Do not remove zone write plugs still in
use") modified disk_should_remove_zone_wplug() to add a check on the
reference count of a zone write plug to prevent removing zone write
plugs from a disk hash table when the plugs are still being referenced
by BIOs or requests in-flight. However, this check does not take into
account that a BIO completion may happen right after its submission by
a zone write plug BIO work, and before the zone write plug BIO work
releases the zone write plug reference count. This situation leads to
disk_should_remove_zone_wplug() returning false as in this case the zone
write plug reference count is at least equal to 3. If the BIO that
completes in such manner transitioned the zone to the FULL condition,
the zone write plug for the FULL zone will remain in the disk hash
table.
Furthermore, relying on a particular value of a zone write plug
reference count to set the BLK_ZONE_WPLUG_UNHASHED flag is fragile as
reading the atomic reference count and doing a comparison with some
value is not overall atomic at all.
Address these issues by reworking the reference counting of zone write
plugs so that removing plugs from a disk hash table can be done
directly from disk_put_zone_wplug() when the last reference on a plug
is dropped.
To do so, replace the function disk_remove_zone_wplug() with
disk_mark_zone_wplug_dead(). This new function sets the zone write plug
flag BLK_ZONE_WPLUG_DEAD (which replaces BLK_ZONE_WPLUG_UNHASHED) and
drops the initial reference on the zone write plug taken when the plug
was added to the disk hash table. This function is called either for
zones that are empty or full, or directly in the case of a forced plug
removal (e.g. when the disk hash table is being destroyed on disk
removal). With this change, disk_should_remove_zone_wplug() is also
removed.
disk_put_zone_wplug() is modified to call the function
disk_free_zone_wplug() to remove a zone write plug from a disk hash
table and free the plug structure (with a call_rcu()), when the last
reference on a zone write plug is dropped. disk_free_zone_wplug()
always checks that the BLK_ZONE_WPLUG_DEAD flag is set.
In order to avoid having multiple zone write plugs for the same zone in
the disk hash table, disk_get_and_lock_zone_wplug() checked for the
BLK_ZONE_WPLUG_UNHASHED flag. This check is removed and a check for
the new BLK_ZONE_WPLUG_DEAD flag is added to
blk_zone_wplug_handle_write(). With this change, we continue preventing
adding multiple zone write plugs for the same zone and at the same time
re-inforce checks on the user behavior by failing new incoming write
BIOs targeting a zone that is marked as dead. This case can happen only
if the user erroneously issues write BIOs to zones that are full, or to
zones that are currently being reset or finished.
Fixes: 7b295187287e ("block: Do not remove zone write plugs still in use")
Cc: stable@vger.kernel.org
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
[ dropped upstream blk_zone_set_cond() call and disk_zone_wplug_update_cond() context line ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/blk-zoned.c | 147 ++++++++++++++++++++----------------------------------
1 file changed, 56 insertions(+), 91 deletions(-)
--- a/block/blk-zoned.c
+++ b/block/blk-zoned.c
@@ -83,17 +83,17 @@ static inline unsigned int disk_zone_wpl
* being executed or the zone write plug bio list is not empty.
* - BLK_ZONE_WPLUG_NEED_WP_UPDATE: Indicates that we lost track of a zone
* write pointer offset and need to update it.
- * - BLK_ZONE_WPLUG_UNHASHED: Indicates that the zone write plug was removed
- * from the disk hash table and that the initial reference to the zone
- * write plug set when the plug was first added to the hash table has been
- * dropped. This flag is set when a zone is reset, finished or become full,
- * to prevent new references to the zone write plug to be taken for
- * newly incoming BIOs. A zone write plug flagged with this flag will be
- * freed once all remaining references from BIOs or functions are dropped.
+ * - BLK_ZONE_WPLUG_DEAD: Indicates that the zone write plug will be
+ * removed from the disk hash table of zone write plugs when the last
+ * reference on the zone write plug is dropped. If set, this flag also
+ * indicates that the initial extra reference on the zone write plug was
+ * dropped, meaning that the reference count indicates the current number of
+ * active users (code context or BIOs and requests in flight). This flag is
+ * set when a zone is reset, finished or becomes full.
*/
#define BLK_ZONE_WPLUG_PLUGGED (1U << 0)
#define BLK_ZONE_WPLUG_NEED_WP_UPDATE (1U << 1)
-#define BLK_ZONE_WPLUG_UNHASHED (1U << 2)
+#define BLK_ZONE_WPLUG_DEAD (1U << 2)
/**
* blk_zone_cond_str - Return string XXX in BLK_ZONE_COND_XXX.
@@ -467,67 +467,42 @@ static void disk_free_zone_wplug_rcu(str
mempool_free(zwplug, zwplug->disk->zone_wplugs_pool);
}
-static inline void disk_put_zone_wplug(struct blk_zone_wplug *zwplug)
+static void disk_free_zone_wplug(struct blk_zone_wplug *zwplug)
{
- if (refcount_dec_and_test(&zwplug->ref)) {
- WARN_ON_ONCE(!bio_list_empty(&zwplug->bio_list));
- WARN_ON_ONCE(zwplug->flags & BLK_ZONE_WPLUG_PLUGGED);
- WARN_ON_ONCE(!(zwplug->flags & BLK_ZONE_WPLUG_UNHASHED));
-
- call_rcu(&zwplug->rcu_head, disk_free_zone_wplug_rcu);
- }
-}
-
-static inline bool disk_should_remove_zone_wplug(struct gendisk *disk,
- struct blk_zone_wplug *zwplug)
-{
- lockdep_assert_held(&zwplug->lock);
-
- /* If the zone write plug was already removed, we are done. */
- if (zwplug->flags & BLK_ZONE_WPLUG_UNHASHED)
- return false;
+ struct gendisk *disk = zwplug->disk;
+ unsigned long flags;
- /* If the zone write plug is still plugged, it cannot be removed. */
- if (zwplug->flags & BLK_ZONE_WPLUG_PLUGGED)
- return false;
+ WARN_ON_ONCE(!(zwplug->flags & BLK_ZONE_WPLUG_DEAD));
+ WARN_ON_ONCE(zwplug->flags & BLK_ZONE_WPLUG_PLUGGED);
+ WARN_ON_ONCE(!bio_list_empty(&zwplug->bio_list));
- /*
- * Completions of BIOs with blk_zone_write_plug_bio_endio() may
- * happen after handling a request completion with
- * blk_zone_write_plug_finish_request() (e.g. with split BIOs
- * that are chained). In such case, disk_zone_wplug_unplug_bio()
- * should not attempt to remove the zone write plug until all BIO
- * completions are seen. Check by looking at the zone write plug
- * reference count, which is 2 when the plug is unused (one reference
- * taken when the plug was allocated and another reference taken by the
- * caller context).
- */
- if (refcount_read(&zwplug->ref) > 2)
- return false;
+ spin_lock_irqsave(&disk->zone_wplugs_lock, flags);
+ hlist_del_init_rcu(&zwplug->node);
+ atomic_dec(&disk->nr_zone_wplugs);
+ spin_unlock_irqrestore(&disk->zone_wplugs_lock, flags);
- /* We can remove zone write plugs for zones that are empty or full. */
- return !zwplug->wp_offset || disk_zone_wplug_is_full(disk, zwplug);
+ call_rcu(&zwplug->rcu_head, disk_free_zone_wplug_rcu);
}
-static void disk_remove_zone_wplug(struct gendisk *disk,
- struct blk_zone_wplug *zwplug)
+static inline void disk_put_zone_wplug(struct blk_zone_wplug *zwplug)
{
- unsigned long flags;
+ if (refcount_dec_and_test(&zwplug->ref))
+ disk_free_zone_wplug(zwplug);
+}
- /* If the zone write plug was already removed, we have nothing to do. */
- if (zwplug->flags & BLK_ZONE_WPLUG_UNHASHED)
- return;
+/*
+ * Flag the zone write plug as dead and drop the initial reference we got when
+ * the zone write plug was added to the hash table. The zone write plug will be
+ * unhashed when its last reference is dropped.
+ */
+static void disk_mark_zone_wplug_dead(struct blk_zone_wplug *zwplug)
+{
+ lockdep_assert_held(&zwplug->lock);
- /*
- * Mark the zone write plug as unhashed and drop the extra reference we
- * took when the plug was inserted in the hash table.
- */
- zwplug->flags |= BLK_ZONE_WPLUG_UNHASHED;
- spin_lock_irqsave(&disk->zone_wplugs_lock, flags);
- hlist_del_init_rcu(&zwplug->node);
- atomic_dec(&disk->nr_zone_wplugs);
- spin_unlock_irqrestore(&disk->zone_wplugs_lock, flags);
- disk_put_zone_wplug(zwplug);
+ if (!(zwplug->flags & BLK_ZONE_WPLUG_DEAD)) {
+ zwplug->flags |= BLK_ZONE_WPLUG_DEAD;
+ disk_put_zone_wplug(zwplug);
+ }
}
static void blk_zone_wplug_bio_work(struct work_struct *work);
@@ -547,18 +522,7 @@ static struct blk_zone_wplug *disk_get_a
again:
zwplug = disk_get_zone_wplug(disk, sector);
if (zwplug) {
- /*
- * Check that a BIO completion or a zone reset or finish
- * operation has not already removed the zone write plug from
- * the hash table and dropped its reference count. In such case,
- * we need to get a new plug so start over from the beginning.
- */
spin_lock_irqsave(&zwplug->lock, *flags);
- if (zwplug->flags & BLK_ZONE_WPLUG_UNHASHED) {
- spin_unlock_irqrestore(&zwplug->lock, *flags);
- disk_put_zone_wplug(zwplug);
- goto again;
- }
return zwplug;
}
@@ -645,14 +609,8 @@ static void disk_zone_wplug_set_wp_offse
zwplug->flags &= ~BLK_ZONE_WPLUG_NEED_WP_UPDATE;
zwplug->wp_offset = wp_offset;
disk_zone_wplug_abort(zwplug);
-
- /*
- * The zone write plug now has no BIO plugged: remove it from the
- * hash table so that it cannot be seen. The plug will be freed
- * when the last reference is dropped.
- */
- if (disk_should_remove_zone_wplug(disk, zwplug))
- disk_remove_zone_wplug(disk, zwplug);
+ if (!zwplug->wp_offset || disk_zone_wplug_is_full(disk, zwplug))
+ disk_mark_zone_wplug_dead(zwplug);
}
static unsigned int blk_zone_wp_offset(struct blk_zone *zone)
@@ -1068,6 +1026,19 @@ static bool blk_zone_wplug_handle_write(
return true;
}
+ /*
+ * If we got a zone write plug marked as dead, then the user is issuing
+ * writes to a full zone, or without synchronizing with zone reset or
+ * zone finish operations. In such case, fail the BIO to signal this
+ * invalid usage.
+ */
+ if (zwplug->flags & BLK_ZONE_WPLUG_DEAD) {
+ spin_unlock_irqrestore(&zwplug->lock, flags);
+ disk_put_zone_wplug(zwplug);
+ bio_io_error(bio);
+ return true;
+ }
+
/* Indicate that this BIO is being handled using zone write plugging. */
bio_set_flag(bio, BIO_ZONE_WRITE_PLUGGING);
@@ -1136,7 +1107,7 @@ static void blk_zone_wplug_handle_native
disk->disk_name, zwplug->zone_no);
disk_zone_wplug_abort(zwplug);
}
- disk_remove_zone_wplug(disk, zwplug);
+ disk_mark_zone_wplug_dead(zwplug);
spin_unlock_irqrestore(&zwplug->lock, flags);
disk_put_zone_wplug(zwplug);
@@ -1239,14 +1210,8 @@ static void disk_zone_wplug_unplug_bio(s
}
zwplug->flags &= ~BLK_ZONE_WPLUG_PLUGGED;
-
- /*
- * If the zone is full (it was fully written or finished, or empty
- * (it was reset), remove its zone write plug from the hash table.
- */
- if (disk_should_remove_zone_wplug(disk, zwplug))
- disk_remove_zone_wplug(disk, zwplug);
-
+ if (!zwplug->wp_offset || disk_zone_wplug_is_full(disk, zwplug))
+ disk_mark_zone_wplug_dead(zwplug);
spin_unlock_irqrestore(&zwplug->lock, flags);
}
@@ -1457,9 +1422,9 @@ static void disk_destroy_zone_wplugs_has
while (!hlist_empty(&disk->zone_wplugs_hash[i])) {
zwplug = hlist_entry(disk->zone_wplugs_hash[i].first,
struct blk_zone_wplug, node);
- refcount_inc(&zwplug->ref);
- disk_remove_zone_wplug(disk, zwplug);
- disk_put_zone_wplug(zwplug);
+ spin_lock_irq(&zwplug->lock);
+ disk_mark_zone_wplug_dead(zwplug);
+ spin_unlock_irq(&zwplug->lock);
}
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 159/188] EDAC/versalnet: Fix device name memory leak
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (157 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 158/188] block: fix zone write plug removal Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 160/188] papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE() Greg Kroah-Hartman
` (33 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Prasanna Kumar T S M,
Borislav Petkov (AMD), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prasanna Kumar T S M <ptsm@linux.microsoft.com>
[ Upstream commit 8cf5dd235eff6008cb04c3d8064d2acfa90616f1 ]
The device name allocated via kzalloc() in init_one_mc() is assigned to
dev->init_name but never freed on the normal removal path. device_register()
copies init_name and then sets dev->init_name to NULL, so the name pointer
becomes unreachable from the device. Thus leaking memory.
Use a stack-local char array instead of using kzalloc() for name.
Fixes: d5fe2fec6c40 ("EDAC: Add a driver for the AMD Versal NET DDR controller")
Signed-off-by: Prasanna Kumar T S M <ptsm@linux.microsoft.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260401111856.2342975-1-ptsm@linux.microsoft.com
[ adapted fix from `init_one_mc()` helper to the equivalent loop in `init_versalnet()` using literal `32` instead of `MC_NAME_LEN` ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/edac/versalnet_edac.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/edac/versalnet_edac.c
+++ b/drivers/edac/versalnet_edac.c
@@ -765,9 +765,9 @@ static int init_versalnet(struct mc_priv
u32 num_chans, rank, dwidth, config;
struct edac_mc_layer layers[2];
struct mem_ctl_info *mci;
+ char name[32];
struct device *dev;
enum dev_type dt;
- char *name;
int rc, i;
for (i = 0; i < NUM_CONTROLLERS; i++) {
@@ -814,7 +814,6 @@ static int init_versalnet(struct mc_priv
dev = kzalloc(sizeof(*dev), GFP_KERNEL);
dev->release = versal_edac_release;
- name = kmalloc(32, GFP_KERNEL);
sprintf(name, "versal-net-ddrmc5-edac-%d", i);
dev->init_name = name;
rc = device_register(dev);
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 160/188] papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE()
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (158 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 159/188] EDAC/versalnet: Fix device name memory leak Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 161/188] pseries/papr-hvpipe: Fix race with interrupt handler Greg Kroah-Hartman
` (32 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Christian Brauner, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <brauner@kernel.org>
[ Upstream commit 6d3789d347a7af5c4b0b2da3af47b8d9da607ab2 ]
Fixes a UAF for src_info as well.
Link: https://patch.msgid.link/20251123-work-fd-prepare-v4-33-b6efa1706cfd@kernel.org
Signed-off-by: Christian Brauner <brauner@kernel.org>
Stable-dep-of: 7a4f0846ee6c ("pseries/papr-hvpipe: Fix race with interrupt handler")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/platforms/pseries/papr-hvpipe.c | 39 ++++++---------------------
1 file changed, 9 insertions(+), 30 deletions(-)
--- a/arch/powerpc/platforms/pseries/papr-hvpipe.c
+++ b/arch/powerpc/platforms/pseries/papr-hvpipe.c
@@ -484,10 +484,7 @@ static const struct file_operations papr
static int papr_hvpipe_dev_create_handle(u32 srcID)
{
- struct hvpipe_source_info *src_info;
- struct file *file;
- long err;
- int fd;
+ struct hvpipe_source_info *src_info __free(kfree) = NULL;
spin_lock(&hvpipe_src_list_lock);
/*
@@ -511,20 +508,13 @@ static int papr_hvpipe_dev_create_handle
src_info->tsk = current;
init_waitqueue_head(&src_info->recv_wqh);
- fd = get_unused_fd_flags(O_RDONLY | O_CLOEXEC);
- if (fd < 0) {
- err = fd;
- goto free_buf;
- }
-
- file = anon_inode_getfile("[papr-hvpipe]",
- &papr_hvpipe_handle_ops, (void *)src_info,
- O_RDWR);
- if (IS_ERR(file)) {
- err = PTR_ERR(file);
- goto free_fd;
- }
+ FD_PREPARE(fdf, O_RDONLY | O_CLOEXEC,
+ anon_inode_getfile("[papr-hvpipe]", &papr_hvpipe_handle_ops,
+ (void *)src_info, O_RDWR));
+ if (fdf.err)
+ return fdf.err;
+ retain_and_null_ptr(src_info);
spin_lock(&hvpipe_src_list_lock);
/*
* If two processes are executing ioctl() for the same
@@ -533,22 +523,11 @@ static int papr_hvpipe_dev_create_handle
*/
if (hvpipe_find_source(srcID)) {
spin_unlock(&hvpipe_src_list_lock);
- err = -EALREADY;
- goto free_file;
+ return -EALREADY;
}
list_add(&src_info->list, &hvpipe_src_list);
spin_unlock(&hvpipe_src_list_lock);
-
- fd_install(fd, file);
- return fd;
-
-free_file:
- fput(file);
-free_fd:
- put_unused_fd(fd);
-free_buf:
- kfree(src_info);
- return err;
+ return fd_publish(fdf);
}
/*
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 161/188] pseries/papr-hvpipe: Fix race with interrupt handler
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (159 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 160/188] papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE() Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 162/188] spi: uniphier: Simplify clock handling with devm_clk_get_enabled() Greg Kroah-Hartman
` (31 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ritesh Harjani (IBM),
Madhavan Srinivasan, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Ritesh Harjani (IBM)" <ritesh.list@gmail.com>
[ Upstream commit 7a4f0846ee6cc8cf44ae0046ed42e3259d1dd45b ]
While executing ->ioctl handler or ->release handler, if an interrupt
fires on the same cpu, then we can enter into a deadlock.
This patch fixes both these handlers to take spin_lock_irq{save|restore}
versions of the lock to prevent this deadlock.
Cc: stable@vger.kernel.org
Fixes: 814ef095f12c9 ("powerpc/pseries: Add papr-hvpipe char driver for HVPIPE interfaces")
Signed-off-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/e4ed435c44fc191f2eb23c7907ba6f72f193e6aa.1777606826.git.ritesh.list@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/platforms/pseries/papr-hvpipe.c | 20 +++++++++++---------
1 file changed, 11 insertions(+), 9 deletions(-)
--- a/arch/powerpc/platforms/pseries/papr-hvpipe.c
+++ b/arch/powerpc/platforms/pseries/papr-hvpipe.c
@@ -449,13 +449,14 @@ static int papr_hvpipe_handle_release(st
struct file *file)
{
struct hvpipe_source_info *src_info;
+ unsigned long flags;
/*
* Hold the lock, remove source from src_list, reset the
* hvpipe status and release the lock to prevent any race
* with message event IRQ.
*/
- spin_lock(&hvpipe_src_list_lock);
+ spin_lock_irqsave(&hvpipe_src_list_lock, flags);
src_info = file->private_data;
list_del(&src_info->list);
file->private_data = NULL;
@@ -466,10 +467,10 @@ static int papr_hvpipe_handle_release(st
*/
if (src_info->hvpipe_status & HVPIPE_MSG_AVAILABLE) {
src_info->hvpipe_status = 0;
- spin_unlock(&hvpipe_src_list_lock);
+ spin_unlock_irqrestore(&hvpipe_src_list_lock, flags);
hvpipe_rtas_recv_msg(NULL, 0);
} else
- spin_unlock(&hvpipe_src_list_lock);
+ spin_unlock_irqrestore(&hvpipe_src_list_lock, flags);
kfree(src_info);
return 0;
@@ -485,20 +486,21 @@ static const struct file_operations papr
static int papr_hvpipe_dev_create_handle(u32 srcID)
{
struct hvpipe_source_info *src_info __free(kfree) = NULL;
+ unsigned long flags;
- spin_lock(&hvpipe_src_list_lock);
+ spin_lock_irqsave(&hvpipe_src_list_lock, flags);
/*
* Do not allow more than one process communicates with
* each source.
*/
src_info = hvpipe_find_source(srcID);
if (src_info) {
- spin_unlock(&hvpipe_src_list_lock);
+ spin_unlock_irqrestore(&hvpipe_src_list_lock, flags);
pr_err("pid(%d) is already using the source(%d)\n",
src_info->tsk->pid, srcID);
return -EALREADY;
}
- spin_unlock(&hvpipe_src_list_lock);
+ spin_unlock_irqrestore(&hvpipe_src_list_lock, flags);
src_info = kzalloc(sizeof(*src_info), GFP_KERNEL_ACCOUNT);
if (!src_info)
@@ -515,18 +517,18 @@ static int papr_hvpipe_dev_create_handle
return fdf.err;
retain_and_null_ptr(src_info);
- spin_lock(&hvpipe_src_list_lock);
+ spin_lock_irqsave(&hvpipe_src_list_lock, flags);
/*
* If two processes are executing ioctl() for the same
* source ID concurrently, prevent the second process to
* acquire FD.
*/
if (hvpipe_find_source(srcID)) {
- spin_unlock(&hvpipe_src_list_lock);
+ spin_unlock_irqrestore(&hvpipe_src_list_lock, flags);
return -EALREADY;
}
list_add(&src_info->list, &hvpipe_src_list);
- spin_unlock(&hvpipe_src_list_lock);
+ spin_unlock_irqrestore(&hvpipe_src_list_lock, flags);
return fd_publish(fdf);
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 162/188] spi: uniphier: Simplify clock handling with devm_clk_get_enabled()
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (160 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 161/188] pseries/papr-hvpipe: Fix race with interrupt handler Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 163/188] spi: uniphier: fix controller deregistration Greg Kroah-Hartman
` (30 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pei Xiao, Kunihiko Hayashi,
Mark Brown, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pei Xiao <xiaopei01@kylinos.cn>
[ Upstream commit fdca270f8f87cae2eb5b619234b9dd11a863ce6b ]
Replace devm_clk_get() followed by clk_prepare_enable() with
devm_clk_get_enabled() for the clock. This removes the need for
explicit clock enable and disable calls, as the managed API automatically
handles clock disabling on device removal or probe failure.
Remove the now-unnecessary clk_disable_unprepare() calls from the probe
error path and the remove callback. Adjust error labels accordingly.
Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
Reviewed-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
Link: https://patch.msgid.link/b2deeefd4ef1a4bce71116aabfcb7e81400f6d37.1775546948.git.xiaopei01@kylinos.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: 0245435f7772 ("spi: uniphier: fix controller deregistration")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-uniphier.c | 18 ++++--------------
1 file changed, 4 insertions(+), 14 deletions(-)
--- a/drivers/spi/spi-uniphier.c
+++ b/drivers/spi/spi-uniphier.c
@@ -666,28 +666,24 @@ static int uniphier_spi_probe(struct pla
}
priv->base_dma_addr = res->start;
- priv->clk = devm_clk_get(&pdev->dev, NULL);
+ priv->clk = devm_clk_get_enabled(&pdev->dev, NULL);
if (IS_ERR(priv->clk)) {
dev_err(&pdev->dev, "failed to get clock\n");
ret = PTR_ERR(priv->clk);
goto out_host_put;
}
- ret = clk_prepare_enable(priv->clk);
- if (ret)
- goto out_host_put;
-
irq = platform_get_irq(pdev, 0);
if (irq < 0) {
ret = irq;
- goto out_disable_clk;
+ goto out_host_put;
}
ret = devm_request_irq(&pdev->dev, irq, uniphier_spi_handler,
0, "uniphier-spi", priv);
if (ret) {
dev_err(&pdev->dev, "failed to request IRQ\n");
- goto out_disable_clk;
+ goto out_host_put;
}
init_completion(&priv->xfer_done);
@@ -717,7 +713,7 @@ static int uniphier_spi_probe(struct pla
if (IS_ERR_OR_NULL(host->dma_tx)) {
if (PTR_ERR(host->dma_tx) == -EPROBE_DEFER) {
ret = -EPROBE_DEFER;
- goto out_disable_clk;
+ goto out_host_put;
}
host->dma_tx = NULL;
dma_tx_burst = INT_MAX;
@@ -767,9 +763,6 @@ out_release_dma:
host->dma_tx = NULL;
}
-out_disable_clk:
- clk_disable_unprepare(priv->clk);
-
out_host_put:
spi_controller_put(host);
return ret;
@@ -778,14 +771,11 @@ out_host_put:
static void uniphier_spi_remove(struct platform_device *pdev)
{
struct spi_controller *host = platform_get_drvdata(pdev);
- struct uniphier_spi_priv *priv = spi_controller_get_devdata(host);
if (host->dma_tx)
dma_release_channel(host->dma_tx);
if (host->dma_rx)
dma_release_channel(host->dma_rx);
-
- clk_disable_unprepare(priv->clk);
}
static const struct of_device_id uniphier_spi_match[] = {
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 163/188] spi: uniphier: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (161 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 162/188] spi: uniphier: Simplify clock handling with devm_clk_get_enabled() Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 164/188] spi: tegra20-sflash: " Greg Kroah-Hartman
` (29 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Keiji Hayashibara, Johan Hovold,
Mark Brown, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 0245435f777264ac45945ed2f325dd095a41d1af ]
Make sure to deregister the controller before releasing underlying
resources like DMA during driver unbind.
Note that clocks were also disabled before the recent commit
fdca270f8f87 ("spi: uniphier: Simplify clock handling with
devm_clk_get_enabled()").
Fixes: 5ba155a4d4cc ("spi: add SPI controller driver for UniPhier SoC")
Cc: stable@vger.kernel.org # 4.19
Cc: Keiji Hayashibara <hayashibara.keiji@socionext.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260410081757.503099-25-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-uniphier.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-uniphier.c
+++ b/drivers/spi/spi-uniphier.c
@@ -747,7 +747,7 @@ static int uniphier_spi_probe(struct pla
host->max_dma_len = min(dma_tx_burst, dma_rx_burst);
- ret = devm_spi_register_controller(&pdev->dev, host);
+ ret = spi_register_controller(host);
if (ret)
goto out_release_dma;
@@ -772,10 +772,16 @@ static void uniphier_spi_remove(struct p
{
struct spi_controller *host = platform_get_drvdata(pdev);
+ spi_controller_get(host);
+
+ spi_unregister_controller(host);
+
if (host->dma_tx)
dma_release_channel(host->dma_tx);
if (host->dma_rx)
dma_release_channel(host->dma_rx);
+
+ spi_controller_put(host);
}
static const struct of_device_id uniphier_spi_match[] = {
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 164/188] spi: tegra20-sflash: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (162 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 163/188] spi: uniphier: fix controller deregistration Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 165/188] spi: tegra114: " Greg Kroah-Hartman
` (28 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jingoo Han, Johan Hovold, Mark Brown,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit ad7310e983327f939dd6c4e801eab13238992572 ]
Make sure to deregister the controller before disabling underlying
resources like clocks during driver unbind.
Fixes: f12f7318c44a ("spi: tegra20-sflash: use devm_spi_register_master()")
Cc: stable@vger.kernel.org # 3.13
Cc: Jingoo Han <jg1.han@samsung.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260410081757.503099-23-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
[ kept the redundant `host->dev.of_node = pdev->dev.of_node;` line above the registration call ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-tegra20-sflash.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-tegra20-sflash.c
+++ b/drivers/spi/spi-tegra20-sflash.c
@@ -506,7 +506,7 @@ static int tegra_sflash_probe(struct pla
pm_runtime_put(&pdev->dev);
host->dev.of_node = pdev->dev.of_node;
- ret = devm_spi_register_controller(&pdev->dev, host);
+ ret = spi_register_controller(host);
if (ret < 0) {
dev_err(&pdev->dev, "can not register to host err %d\n", ret);
goto exit_pm_disable;
@@ -529,11 +529,17 @@ static void tegra_sflash_remove(struct p
struct spi_controller *host = platform_get_drvdata(pdev);
struct tegra_sflash_data *tsd = spi_controller_get_devdata(host);
+ spi_controller_get(host);
+
+ spi_unregister_controller(host);
+
free_irq(tsd->irq, tsd);
pm_runtime_disable(&pdev->dev);
if (!pm_runtime_status_suspended(&pdev->dev))
tegra_sflash_runtime_suspend(&pdev->dev);
+
+ spi_controller_put(host);
}
#ifdef CONFIG_PM_SLEEP
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 165/188] spi: tegra114: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (163 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 164/188] spi: tegra20-sflash: " Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 166/188] spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() Greg Kroah-Hartman
` (27 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jingoo Han, Johan Hovold, Mark Brown,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit 9c9c27ff2058142d8f800de3186d6864184958de ]
Make sure to deregister the controller before disabling underlying
resources like clocks during driver unbind.
Fixes: 5c8096439600 ("spi: tegra114: use devm_spi_register_master()")
Cc: stable@vger.kernel.org # 3.13
Cc: Jingoo Han <jg1.han@samsung.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260410081757.503099-22-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
[ kept `host->dev.of_node = pdev->dev.of_node;` context line above the `spi_register_controller()` conversion ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-tegra114.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-tegra114.c
+++ b/drivers/spi/spi-tegra114.c
@@ -1416,7 +1416,7 @@ static int tegra_spi_probe(struct platfo
}
host->dev.of_node = pdev->dev.of_node;
- ret = devm_spi_register_controller(&pdev->dev, host);
+ ret = spi_register_controller(host);
if (ret < 0) {
dev_err(&pdev->dev, "can not register to host err %d\n", ret);
goto exit_free_irq;
@@ -1442,6 +1442,10 @@ static void tegra_spi_remove(struct plat
struct spi_controller *host = platform_get_drvdata(pdev);
struct tegra_spi_data *tspi = spi_controller_get_devdata(host);
+ spi_controller_get(host);
+
+ spi_unregister_controller(host);
+
free_irq(tspi->irq, tspi);
if (tspi->tx_dma_chan)
@@ -1453,6 +1457,8 @@ static void tegra_spi_remove(struct plat
pm_runtime_disable(&pdev->dev);
if (!pm_runtime_status_suspended(&pdev->dev))
tegra_spi_runtime_suspend(&pdev->dev);
+
+ spi_controller_put(host);
}
#ifdef CONFIG_PM_SLEEP
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 166/188] spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled()
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (164 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 165/188] spi: tegra114: " Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 167/188] spi: zynq-qspi: fix controller deregistration Greg Kroah-Hartman
` (26 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pei Xiao, Michal Simek, Mark Brown,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pei Xiao <xiaopei01@kylinos.cn>
[ Upstream commit 1f8fd9490e3184e9a2394df2e682901a1d57ce71 ]
Replace devm_clk_get() followed by clk_prepare_enable() with
devm_clk_get_enabled() for both "pclk" and "ref_clk". This removes
the need for explicit clock enable and disable calls, as the managed
API automatically disables the clocks on device removal or probe
failure.
Remove the now-unnecessary clk_disable_unprepare() calls from the
probe error paths and the remove callback. Simplify error handling
by jumping directly to the remove_ctlr label.
Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
Acked-by: Michal Simek <michal.simek@amd.com>
Link: https://patch.msgid.link/24043625f89376da36feca2408f990a85be7ab36.1775555500.git.xiaopei01@kylinos.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: c9c012706c9f ("spi: zynq-qspi: fix controller deregistration")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-zynq-qspi.c | 42 ++++++------------------------------------
1 file changed, 6 insertions(+), 36 deletions(-)
--- a/drivers/spi/spi-zynq-qspi.c
+++ b/drivers/spi/spi-zynq-qspi.c
@@ -381,21 +381,10 @@ static int zynq_qspi_setup_op(struct spi
{
struct spi_controller *ctlr = spi->controller;
struct zynq_qspi *qspi = spi_controller_get_devdata(ctlr);
- int ret;
if (ctlr->busy)
return -EBUSY;
- ret = clk_enable(qspi->refclk);
- if (ret)
- return ret;
-
- ret = clk_enable(qspi->pclk);
- if (ret) {
- clk_disable(qspi->refclk);
- return ret;
- }
-
zynq_qspi_write(qspi, ZYNQ_QSPI_ENABLE_OFFSET,
ZYNQ_QSPI_ENABLE_ENABLE_MASK);
@@ -661,7 +650,7 @@ static int zynq_qspi_probe(struct platfo
goto remove_ctlr;
}
- xqspi->pclk = devm_clk_get(&pdev->dev, "pclk");
+ xqspi->pclk = devm_clk_get_enabled(&pdev->dev, "pclk");
if (IS_ERR(xqspi->pclk)) {
dev_err(&pdev->dev, "pclk clock not found.\n");
ret = PTR_ERR(xqspi->pclk);
@@ -670,36 +659,24 @@ static int zynq_qspi_probe(struct platfo
init_completion(&xqspi->data_completion);
- xqspi->refclk = devm_clk_get(&pdev->dev, "ref_clk");
+ xqspi->refclk = devm_clk_get_enabled(&pdev->dev, "ref_clk");
if (IS_ERR(xqspi->refclk)) {
dev_err(&pdev->dev, "ref_clk clock not found.\n");
ret = PTR_ERR(xqspi->refclk);
goto remove_ctlr;
}
- ret = clk_prepare_enable(xqspi->pclk);
- if (ret) {
- dev_err(&pdev->dev, "Unable to enable APB clock.\n");
- goto remove_ctlr;
- }
-
- ret = clk_prepare_enable(xqspi->refclk);
- if (ret) {
- dev_err(&pdev->dev, "Unable to enable device clock.\n");
- goto clk_dis_pclk;
- }
-
xqspi->irq = platform_get_irq(pdev, 0);
if (xqspi->irq < 0) {
ret = xqspi->irq;
- goto clk_dis_all;
+ goto remove_ctlr;
}
ret = devm_request_irq(&pdev->dev, xqspi->irq, zynq_qspi_irq,
0, pdev->name, xqspi);
if (ret != 0) {
ret = -ENXIO;
dev_err(&pdev->dev, "request_irq failed\n");
- goto clk_dis_all;
+ goto remove_ctlr;
}
ret = of_property_read_u32(np, "num-cs",
@@ -709,7 +686,7 @@ static int zynq_qspi_probe(struct platfo
} else if (num_cs > ZYNQ_QSPI_MAX_NUM_CS) {
ret = -EINVAL;
dev_err(&pdev->dev, "only 2 chip selects are available\n");
- goto clk_dis_all;
+ goto remove_ctlr;
} else {
ctlr->num_chipselect = num_cs;
}
@@ -728,15 +705,11 @@ static int zynq_qspi_probe(struct platfo
ret = devm_spi_register_controller(&pdev->dev, ctlr);
if (ret) {
dev_err(&pdev->dev, "devm_spi_register_controller failed\n");
- goto clk_dis_all;
+ goto remove_ctlr;
}
return ret;
-clk_dis_all:
- clk_disable_unprepare(xqspi->refclk);
-clk_dis_pclk:
- clk_disable_unprepare(xqspi->pclk);
remove_ctlr:
spi_controller_put(ctlr);
@@ -758,9 +731,6 @@ static void zynq_qspi_remove(struct plat
struct zynq_qspi *xqspi = platform_get_drvdata(pdev);
zynq_qspi_write(xqspi, ZYNQ_QSPI_ENABLE_OFFSET, 0);
-
- clk_disable_unprepare(xqspi->refclk);
- clk_disable_unprepare(xqspi->pclk);
}
static const struct of_device_id zynq_qspi_of_match[] = {
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 167/188] spi: zynq-qspi: fix controller deregistration
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (165 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 166/188] spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 168/188] Bluetooth: hci_conn: fix potential UAF in create_big_sync Greg Kroah-Hartman
` (25 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Naga Sureshkumar Relli, Johan Hovold,
Mark Brown, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
[ Upstream commit c9c012706c9fa8ca6d129a9161caf92ab625a3fd ]
Make sure to deregister the controller before disabling it during driver
unbind.
Note that clocks were also disabled before the recent commit
1f8fd9490e31 ("spi: zynq-qspi: Simplify clock handling with
devm_clk_get_enabled()").
Fixes: 67dca5e580f1 ("spi: spi-mem: Add support for Zynq QSPI controller")
Cc: stable@vger.kernel.org # 5.2: 8eb2fd00f65a
Cc: stable@vger.kernel.org # 5.2
Cc: Naga Sureshkumar Relli <naga.sureshkumar.relli@xilinx.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20260410081757.503099-27-johan@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-zynq-qspi.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
--- a/drivers/spi/spi-zynq-qspi.c
+++ b/drivers/spi/spi-zynq-qspi.c
@@ -643,7 +643,7 @@ static int zynq_qspi_probe(struct platfo
xqspi = spi_controller_get_devdata(ctlr);
xqspi->dev = dev;
- platform_set_drvdata(pdev, xqspi);
+ platform_set_drvdata(pdev, ctlr);
xqspi->regs = devm_platform_ioremap_resource(pdev, 0);
if (IS_ERR(xqspi->regs)) {
ret = PTR_ERR(xqspi->regs);
@@ -702,9 +702,9 @@ static int zynq_qspi_probe(struct platfo
/* QSPI controller initializations */
zynq_qspi_init_hw(xqspi, ctlr->num_chipselect);
- ret = devm_spi_register_controller(&pdev->dev, ctlr);
+ ret = spi_register_controller(ctlr);
if (ret) {
- dev_err(&pdev->dev, "devm_spi_register_controller failed\n");
+ dev_err(&pdev->dev, "failed to register controller\n");
goto remove_ctlr;
}
@@ -728,9 +728,16 @@ remove_ctlr:
*/
static void zynq_qspi_remove(struct platform_device *pdev)
{
- struct zynq_qspi *xqspi = platform_get_drvdata(pdev);
+ struct spi_controller *ctlr = platform_get_drvdata(pdev);
+ struct zynq_qspi *xqspi = spi_controller_get_devdata(ctlr);
+
+ spi_controller_get(ctlr);
+
+ spi_unregister_controller(ctlr);
zynq_qspi_write(xqspi, ZYNQ_QSPI_ENABLE_OFFSET, 0);
+
+ spi_controller_put(ctlr);
}
static const struct of_device_id zynq_qspi_of_match[] = {
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 168/188] Bluetooth: hci_conn: fix potential UAF in create_big_sync
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (166 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 167/188] spi: zynq-qspi: fix controller deregistration Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 169/188] sched/ext: Implement cgroup_set_idle() callback Greg Kroah-Hartman
` (24 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luiz Augusto von Dentz,
David Carlier, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Carlier <devnexen@gmail.com>
[ Upstream commit 0beddb0c380bed5f5b8e61ddbe14635bb73d0b41 ]
Add hci_conn_valid() check in create_big_sync() to detect stale
connections before proceeding with BIG creation. Handle the
resulting -ECANCELED in create_big_complete() and re-validate the
connection under hci_dev_lock() before dereferencing, matching the
pattern used by create_le_conn_complete() and create_pa_complete().
Keep the hci_conn object alive across the async boundary by taking
a reference via hci_conn_get() when queueing create_big_sync(), and
dropping it in the completion callback. The refcount and the lock
are complementary: the refcount keeps the object allocated, while
hci_dev_lock() serializes hci_conn_hash_del()'s list_del_rcu() on
hdev->conn_hash, as required by hci_conn_del().
hci_conn_put() is called outside hci_dev_unlock() so the final put
(which resolves to kfree() via bt_link_release) does not run under
hdev->lock, though the release path would be safe either way.
Without this, create_big_complete() would unconditionally
dereference the conn pointer on error, causing a use-after-free
via hci_connect_cfm() and hci_conn_del().
Fixes: eca0ae4aea66 ("Bluetooth: Add initial implementation of BIS connections")
Cc: stable@vger.kernel.org
Co-developed-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: David Carlier <devnexen@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ kept stable's `qos->bcast.out.phy == 0x02` context line instead of upstream's renamed `qos->bcast.out.phys == BIT(1)` ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/hci_conn.c | 19 ++++++++++++++++++-
1 file changed, 18 insertions(+), 1 deletion(-)
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -2113,6 +2113,9 @@ static int create_big_sync(struct hci_de
u32 flags = 0;
int err;
+ if (!hci_conn_valid(hdev, conn))
+ return -ECANCELED;
+
if (qos->bcast.out.phy == 0x02)
flags |= MGMT_ADV_FLAG_SEC_2M;
@@ -2188,11 +2191,24 @@ static void create_big_complete(struct h
bt_dev_dbg(hdev, "conn %p", conn);
+ if (err == -ECANCELED)
+ goto done;
+
+ hci_dev_lock(hdev);
+
+ if (!hci_conn_valid(hdev, conn))
+ goto unlock;
+
if (err) {
bt_dev_err(hdev, "Unable to create BIG: %d", err);
hci_connect_cfm(conn, err);
hci_conn_del(conn);
}
+
+unlock:
+ hci_dev_unlock(hdev);
+done:
+ hci_conn_put(conn);
}
struct hci_conn *hci_bind_bis(struct hci_dev *hdev, bdaddr_t *dst, __u8 sid,
@@ -2309,10 +2325,11 @@ struct hci_conn *hci_connect_bis(struct
BT_BOUND, &data);
/* Queue start periodic advertising and create BIG */
- err = hci_cmd_sync_queue(hdev, create_big_sync, conn,
+ err = hci_cmd_sync_queue(hdev, create_big_sync, hci_conn_get(conn),
create_big_complete);
if (err < 0) {
hci_conn_drop(conn);
+ hci_conn_put(conn);
return ERR_PTR(err);
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 169/188] sched/ext: Implement cgroup_set_idle() callback
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (167 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 168/188] Bluetooth: hci_conn: fix potential UAF in create_big_sync Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 170/188] sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters Greg Kroah-Hartman
` (23 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, zhidao su, Tejun Heo, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: zhidao su <suzhidao@xiaomi.com>
[ Upstream commit 347ed2d566dabb06c7970fff01129c4f59995ed6 ]
Implement the missing cgroup_set_idle() callback that was marked as a
TODO. This allows BPF schedulers to be notified when a cgroup's idle
state changes, enabling them to adjust their scheduling behavior
accordingly.
The implementation follows the same pattern as other cgroup callbacks
like cgroup_set_weight() and cgroup_set_bandwidth(). It checks if the
BPF scheduler has implemented the callback and invokes it with the
appropriate parameters.
Fixes a spelling error in the cgroup_set_bandwidth() documentation.
tj: s/scx_cgroup_rwsem/scx_cgroup_ops_rwsem/ to fix build breakage.
Signed-off-by: zhidao su <soolaugust@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Stable-dep-of: 80afd4c84bc8 ("sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/sched/ext.h | 1 +
kernel/sched/ext.c | 16 +++++++++++++++-
kernel/sched/ext_internal.h | 13 ++++++++++++-
3 files changed, 28 insertions(+), 2 deletions(-)
--- a/include/linux/sched/ext.h
+++ b/include/linux/sched/ext.h
@@ -228,6 +228,7 @@ struct scx_task_group {
u64 bw_period_us;
u64 bw_quota_us;
u64 bw_burst_us;
+ bool idle;
#endif
};
--- a/kernel/sched/ext.c
+++ b/kernel/sched/ext.c
@@ -3118,6 +3118,7 @@ void scx_tg_init(struct task_group *tg)
tg->scx.weight = CGROUP_WEIGHT_DFL;
tg->scx.bw_period_us = default_bw_period_us();
tg->scx.bw_quota_us = RUNTIME_INF;
+ tg->scx.idle = false;
}
int scx_tg_online(struct task_group *tg)
@@ -3266,7 +3267,18 @@ void scx_group_set_weight(struct task_gr
void scx_group_set_idle(struct task_group *tg, bool idle)
{
- /* TODO: Implement ops->cgroup_set_idle() */
+ struct scx_sched *sch = scx_root;
+
+ percpu_down_read(&scx_cgroup_ops_rwsem);
+
+ if (scx_cgroup_enabled && SCX_HAS_OP(sch, cgroup_set_idle))
+ SCX_CALL_OP(sch, SCX_KF_UNLOCKED, cgroup_set_idle, NULL,
+ tg_cgrp(tg), idle);
+
+ /* Update the task group's idle state */
+ tg->scx.idle = idle;
+
+ percpu_up_read(&scx_cgroup_ops_rwsem);
}
void scx_group_set_bandwidth(struct task_group *tg,
@@ -5125,6 +5137,7 @@ static void sched_ext_ops__cgroup_move(s
static void sched_ext_ops__cgroup_cancel_move(struct task_struct *p, struct cgroup *from, struct cgroup *to) {}
static void sched_ext_ops__cgroup_set_weight(struct cgroup *cgrp, u32 weight) {}
static void sched_ext_ops__cgroup_set_bandwidth(struct cgroup *cgrp, u64 period_us, u64 quota_us, u64 burst_us) {}
+static void sched_ext_ops__cgroup_set_idle(struct cgroup *cgrp, bool idle) {}
#endif
static void sched_ext_ops__cpu_online(s32 cpu) {}
static void sched_ext_ops__cpu_offline(s32 cpu) {}
@@ -5163,6 +5176,7 @@ static struct sched_ext_ops __bpf_ops_sc
.cgroup_cancel_move = sched_ext_ops__cgroup_cancel_move,
.cgroup_set_weight = sched_ext_ops__cgroup_set_weight,
.cgroup_set_bandwidth = sched_ext_ops__cgroup_set_bandwidth,
+ .cgroup_set_idle = sched_ext_ops__cgroup_set_idle,
#endif
.cpu_online = sched_ext_ops__cpu_online,
.cpu_offline = sched_ext_ops__cpu_offline,
--- a/kernel/sched/ext_internal.h
+++ b/kernel/sched/ext_internal.h
@@ -697,12 +697,23 @@ struct sched_ext_ops {
* 2_500_000. @cgrp is entitled to 2.5 CPUs. @burst_us can be
* interpreted in the same fashion and specifies how much @cgrp can
* burst temporarily. The specific control mechanism and thus the
- * interpretation of @period_us and burstiness is upto to the BPF
+ * interpretation of @period_us and burstiness is up to the BPF
* scheduler.
*/
void (*cgroup_set_bandwidth)(struct cgroup *cgrp,
u64 period_us, u64 quota_us, u64 burst_us);
+ /**
+ * @cgroup_set_idle: A cgroup's idle state is being changed
+ * @cgrp: cgroup whose idle state is being updated
+ * @idle: whether the cgroup is entering or exiting idle state
+ *
+ * Update @cgrp's idle state to @idle. This callback is invoked when
+ * a cgroup transitions between idle and non-idle states, allowing the
+ * BPF scheduler to adjust its behavior accordingly.
+ */
+ void (*cgroup_set_idle)(struct cgroup *cgrp, bool idle);
+
#endif /* CONFIG_EXT_GROUP_SCHED */
/*
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 170/188] sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (168 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 169/188] sched/ext: Implement cgroup_set_idle() callback Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 171/188] usb: dwc3: Remove of dep->regs Greg Kroah-Hartman
` (22 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris Mason, Tejun Heo, Andrea Righi,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <tj@kernel.org>
[ Upstream commit 80afd4c84bc8f5e80145ce35279f5ce53f6043db ]
scx_group_set_{weight,idle,bandwidth}() cache scx_root before acquiring
scx_cgroup_ops_rwsem, so the pointer can be stale by the time the op runs.
If the loaded scheduler is disabled and freed (via RCU work) and another is
enabled between the naked load and the rwsem acquire, the reader sees
scx_cgroup_enabled=true (the new scheduler's) but dereferences the freed one
- UAF on SCX_HAS_OP(sch, ...) / SCX_CALL_OP(sch, ...).
scx_cgroup_enabled is toggled only under scx_cgroup_ops_rwsem write
(scx_cgroup_{init,exit}), so reading scx_root inside the rwsem read section
correlates @sch with the enabled snapshot.
Fixes: a5bd6ba30b33 ("sched_ext: Use cgroup_lock/unlock() to synchronize against cgroup operations")
Cc: stable@vger.kernel.org # v6.18+
Reported-by: Chris Mason <clm@meta.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Reviewed-by: Andrea Righi <arighi@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/ext.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/kernel/sched/ext.c
+++ b/kernel/sched/ext.c
@@ -3251,9 +3251,10 @@ void scx_cgroup_cancel_attach(struct cgr
void scx_group_set_weight(struct task_group *tg, unsigned long weight)
{
- struct scx_sched *sch = scx_root;
+ struct scx_sched *sch;
percpu_down_read(&scx_cgroup_ops_rwsem);
+ sch = scx_root;
if (scx_cgroup_enabled && SCX_HAS_OP(sch, cgroup_set_weight) &&
tg->scx.weight != weight)
@@ -3267,9 +3268,10 @@ void scx_group_set_weight(struct task_gr
void scx_group_set_idle(struct task_group *tg, bool idle)
{
- struct scx_sched *sch = scx_root;
+ struct scx_sched *sch;
percpu_down_read(&scx_cgroup_ops_rwsem);
+ sch = scx_root;
if (scx_cgroup_enabled && SCX_HAS_OP(sch, cgroup_set_idle))
SCX_CALL_OP(sch, SCX_KF_UNLOCKED, cgroup_set_idle, NULL,
@@ -3284,9 +3286,10 @@ void scx_group_set_idle(struct task_grou
void scx_group_set_bandwidth(struct task_group *tg,
u64 period_us, u64 quota_us, u64 burst_us)
{
- struct scx_sched *sch = scx_root;
+ struct scx_sched *sch;
percpu_down_read(&scx_cgroup_ops_rwsem);
+ sch = scx_root;
if (scx_cgroup_enabled && SCX_HAS_OP(sch, cgroup_set_bandwidth) &&
(tg->scx.bw_period_us != period_us ||
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 171/188] usb: dwc3: Remove of dep->regs
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (169 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 170/188] sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 172/188] usb: dwc3: Add dwc pointer to dwc3_readl/writel Greg Kroah-Hartman
` (21 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Prashanth K, Thinh Nguyen,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prashanth K <prashanth.k@oss.qualcomm.com>
[ Upstream commit abdd1eef04f0cb3b1707cd1fa243d574d5e07024 ]
Remove dep->regs from struct dwc3_ep and reuse dwc->regs instead.
Thus eliminating redundant iomem addresses and making register
access more consistent across the driver.
Signed-off-by: Prashanth K <prashanth.k@oss.qualcomm.com>
Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://patch.msgid.link/20260114100748.2950103-2-prashanth.k@oss.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: aad35f9c926e ("usb: dwc3: Move GUID programming after PHY initialization")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc3/core.h | 10 ++++------
drivers/usb/dwc3/debugfs.c | 12 ++++--------
drivers/usb/dwc3/gadget.c | 12 ++++++------
drivers/usb/dwc3/gadget.h | 2 +-
4 files changed, 15 insertions(+), 21 deletions(-)
--- a/drivers/usb/dwc3/core.h
+++ b/drivers/usb/dwc3/core.h
@@ -165,10 +165,10 @@
#define DWC3_DCFG1 0xc740 /* DWC_usb32 only */
#define DWC3_DEP_BASE(n) (0xc800 + ((n) * 0x10))
-#define DWC3_DEPCMDPAR2 0x00
-#define DWC3_DEPCMDPAR1 0x04
-#define DWC3_DEPCMDPAR0 0x08
-#define DWC3_DEPCMD 0x0c
+#define DWC3_DEPCMDPAR2(n) (DWC3_DEP_BASE(n) + 0x00)
+#define DWC3_DEPCMDPAR1(n) (DWC3_DEP_BASE(n) + 0x04)
+#define DWC3_DEPCMDPAR0(n) (DWC3_DEP_BASE(n) + 0x08)
+#define DWC3_DEPCMD(n) (DWC3_DEP_BASE(n) + 0x0c)
#define DWC3_DEV_IMOD(n) (0xca00 + ((n) * 0x4))
@@ -749,8 +749,6 @@ struct dwc3_ep {
struct list_head pending_list;
struct list_head started_list;
- void __iomem *regs;
-
struct dwc3_trb *trb_pool;
dma_addr_t trb_pool_dma;
struct dwc3 *dwc;
--- a/drivers/usb/dwc3/debugfs.c
+++ b/drivers/usb/dwc3/debugfs.c
@@ -36,23 +36,19 @@
#define dump_ep_register_set(n) \
{ \
.name = "DEPCMDPAR2("__stringify(n)")", \
- .offset = DWC3_DEP_BASE(n) + \
- DWC3_DEPCMDPAR2, \
+ .offset = DWC3_DEPCMDPAR2(n), \
}, \
{ \
.name = "DEPCMDPAR1("__stringify(n)")", \
- .offset = DWC3_DEP_BASE(n) + \
- DWC3_DEPCMDPAR1, \
+ .offset = DWC3_DEPCMDPAR1(n), \
}, \
{ \
.name = "DEPCMDPAR0("__stringify(n)")", \
- .offset = DWC3_DEP_BASE(n) + \
- DWC3_DEPCMDPAR0, \
+ .offset = DWC3_DEPCMDPAR0(n), \
}, \
{ \
.name = "DEPCMD("__stringify(n)")", \
- .offset = DWC3_DEP_BASE(n) + \
- DWC3_DEPCMD, \
+ .offset = DWC3_DEPCMD(n), \
}
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -320,6 +320,7 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_
int cmd_status = 0;
int ret = -EINVAL;
+ u8 epnum = dep->number;
/*
* When operating in USB 2.0 speeds (HS/FS), if GUSB2PHYCFG.ENBLSLPM or
@@ -355,9 +356,9 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_
* improve performance.
*/
if (DWC3_DEPCMD_CMD(cmd) != DWC3_DEPCMD_UPDATETRANSFER) {
- dwc3_writel(dep->regs, DWC3_DEPCMDPAR0, params->param0);
- dwc3_writel(dep->regs, DWC3_DEPCMDPAR1, params->param1);
- dwc3_writel(dep->regs, DWC3_DEPCMDPAR2, params->param2);
+ dwc3_writel(dwc->regs, DWC3_DEPCMDPAR0(epnum), params->param0);
+ dwc3_writel(dwc->regs, DWC3_DEPCMDPAR1(epnum), params->param1);
+ dwc3_writel(dwc->regs, DWC3_DEPCMDPAR2(epnum), params->param2);
}
/*
@@ -381,7 +382,7 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_
else
cmd |= DWC3_DEPCMD_CMDACT;
- dwc3_writel(dep->regs, DWC3_DEPCMD, cmd);
+ dwc3_writel(dwc->regs, DWC3_DEPCMD(epnum), cmd);
if (!(cmd & DWC3_DEPCMD_CMDACT) ||
(DWC3_DEPCMD_CMD(cmd) == DWC3_DEPCMD_ENDTRANSFER &&
@@ -391,7 +392,7 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_
}
do {
- reg = dwc3_readl(dep->regs, DWC3_DEPCMD);
+ reg = dwc3_readl(dwc->regs, DWC3_DEPCMD(epnum));
if (!(reg & DWC3_DEPCMD_CMDACT)) {
cmd_status = DWC3_DEPCMD_STATUS(reg);
@@ -3379,7 +3380,6 @@ static int dwc3_gadget_init_endpoint(str
dep->dwc = dwc;
dep->number = epnum;
dep->direction = direction;
- dep->regs = dwc->regs + DWC3_DEP_BASE(epnum);
dwc->eps[epnum] = dep;
dep->combo_num = 0;
dep->start_cmd_status = 0;
--- a/drivers/usb/dwc3/gadget.h
+++ b/drivers/usb/dwc3/gadget.h
@@ -132,7 +132,7 @@ static inline void dwc3_gadget_ep_get_tr
{
u32 res_id;
- res_id = dwc3_readl(dep->regs, DWC3_DEPCMD);
+ res_id = dwc3_readl(dep->dwc->regs, DWC3_DEPCMD(dep->number));
dep->resource_index = DWC3_DEPCMD_GET_RSC_IDX(res_id);
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 172/188] usb: dwc3: Add dwc pointer to dwc3_readl/writel
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (170 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 171/188] usb: dwc3: Remove of dep->regs Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 173/188] usb: dwc3: Move GUID programming after PHY initialization Greg Kroah-Hartman
` (20 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Prashanth K, Thinh Nguyen,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prashanth K <prashanth.k@oss.qualcomm.com>
[ Upstream commit 9accc68b1cf0a2b220f51d53641128bb32598070 ]
Use dwc pointer in dwc3_readl() dwc3_writel() instead of passing
the dwc->regs. This would help us access the dwc structure and
log the base address in traces. There's no functional changes in
this patch, just refactoring existing APIs.
Signed-off-by: Prashanth K <prashanth.k@oss.qualcomm.com>
Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://patch.msgid.link/20260114100748.2950103-3-prashanth.k@oss.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: aad35f9c926e ("usb: dwc3: Move GUID programming after PHY initialization")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc3/core.c | 194 ++++++++++++++++++++++-----------------------
drivers/usb/dwc3/debugfs.c | 32 +++----
drivers/usb/dwc3/drd.c | 76 ++++++++---------
drivers/usb/dwc3/ep0.c | 20 ++--
drivers/usb/dwc3/gadget.c | 160 ++++++++++++++++++-------------------
drivers/usb/dwc3/gadget.h | 4
drivers/usb/dwc3/io.h | 7 +
drivers/usb/dwc3/ulpi.c | 10 +-
8 files changed, 253 insertions(+), 250 deletions(-)
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -114,23 +114,23 @@ void dwc3_enable_susphy(struct dwc3 *dwc
int i;
for (i = 0; i < dwc->num_usb3_ports; i++) {
- reg = dwc3_readl(dwc->regs, DWC3_GUSB3PIPECTL(i));
+ reg = dwc3_readl(dwc, DWC3_GUSB3PIPECTL(i));
if (enable && !dwc->dis_u3_susphy_quirk)
reg |= DWC3_GUSB3PIPECTL_SUSPHY;
else
reg &= ~DWC3_GUSB3PIPECTL_SUSPHY;
- dwc3_writel(dwc->regs, DWC3_GUSB3PIPECTL(i), reg);
+ dwc3_writel(dwc, DWC3_GUSB3PIPECTL(i), reg);
}
for (i = 0; i < dwc->num_usb2_ports; i++) {
- reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(i));
+ reg = dwc3_readl(dwc, DWC3_GUSB2PHYCFG(i));
if (enable && !dwc->dis_u2_susphy_quirk)
reg |= DWC3_GUSB2PHYCFG_SUSPHY;
else
reg &= ~DWC3_GUSB2PHYCFG_SUSPHY;
- dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(i), reg);
+ dwc3_writel(dwc, DWC3_GUSB2PHYCFG(i), reg);
}
}
@@ -139,7 +139,7 @@ void dwc3_set_prtcap(struct dwc3 *dwc, u
unsigned int hw_mode;
u32 reg;
- reg = dwc3_readl(dwc->regs, DWC3_GCTL);
+ reg = dwc3_readl(dwc, DWC3_GCTL);
/*
* For DRD controllers, GUSB3PIPECTL.SUSPENDENABLE and
@@ -154,7 +154,7 @@ void dwc3_set_prtcap(struct dwc3 *dwc, u
reg &= ~(DWC3_GCTL_PRTCAPDIR(DWC3_GCTL_PRTCAP_OTG));
reg |= DWC3_GCTL_PRTCAPDIR(mode);
- dwc3_writel(dwc->regs, DWC3_GCTL, reg);
+ dwc3_writel(dwc, DWC3_GCTL, reg);
dwc->current_dr_role = mode;
trace_dwc3_set_prtcap(mode);
@@ -214,9 +214,9 @@ static void __dwc3_set_mode(struct work_
if (dwc->current_dr_role && ((DWC3_IP_IS(DWC3) ||
DWC3_VER_IS_PRIOR(DWC31, 190A)) &&
desired_dr_role != DWC3_GCTL_PRTCAP_OTG)) {
- reg = dwc3_readl(dwc->regs, DWC3_GCTL);
+ reg = dwc3_readl(dwc, DWC3_GCTL);
reg |= DWC3_GCTL_CORESOFTRESET;
- dwc3_writel(dwc->regs, DWC3_GCTL, reg);
+ dwc3_writel(dwc, DWC3_GCTL, reg);
/*
* Wait for internal clocks to synchronized. DWC_usb31 and
@@ -226,9 +226,9 @@ static void __dwc3_set_mode(struct work_
*/
msleep(100);
- reg = dwc3_readl(dwc->regs, DWC3_GCTL);
+ reg = dwc3_readl(dwc, DWC3_GCTL);
reg &= ~DWC3_GCTL_CORESOFTRESET;
- dwc3_writel(dwc->regs, DWC3_GCTL, reg);
+ dwc3_writel(dwc, DWC3_GCTL, reg);
}
spin_lock_irqsave(&dwc->lock, flags);
@@ -252,9 +252,9 @@ static void __dwc3_set_mode(struct work_
phy_set_mode(dwc->usb3_generic_phy[i], PHY_MODE_USB_HOST);
if (dwc->dis_split_quirk) {
- reg = dwc3_readl(dwc->regs, DWC3_GUCTL3);
+ reg = dwc3_readl(dwc, DWC3_GUCTL3);
reg |= DWC3_GUCTL3_SPLITDISABLE;
- dwc3_writel(dwc->regs, DWC3_GUCTL3, reg);
+ dwc3_writel(dwc, DWC3_GUCTL3, reg);
}
}
break;
@@ -305,11 +305,11 @@ u32 dwc3_core_fifo_space(struct dwc3_ep
struct dwc3 *dwc = dep->dwc;
u32 reg;
- dwc3_writel(dwc->regs, DWC3_GDBGFIFOSPACE,
- DWC3_GDBGFIFOSPACE_NUM(dep->number) |
- DWC3_GDBGFIFOSPACE_TYPE(type));
+ dwc3_writel(dwc, DWC3_GDBGFIFOSPACE,
+ DWC3_GDBGFIFOSPACE_NUM(dep->number) |
+ DWC3_GDBGFIFOSPACE_TYPE(type));
- reg = dwc3_readl(dwc->regs, DWC3_GDBGFIFOSPACE);
+ reg = dwc3_readl(dwc, DWC3_GDBGFIFOSPACE);
return DWC3_GDBGFIFOSPACE_SPACE_AVAILABLE(reg);
}
@@ -331,7 +331,7 @@ int dwc3_core_soft_reset(struct dwc3 *dw
if (dwc->current_dr_role == DWC3_GCTL_PRTCAP_HOST)
return 0;
- reg = dwc3_readl(dwc->regs, DWC3_DCTL);
+ reg = dwc3_readl(dwc, DWC3_DCTL);
reg |= DWC3_DCTL_CSFTRST;
reg &= ~DWC3_DCTL_RUN_STOP;
dwc3_gadget_dctl_write_safe(dwc, reg);
@@ -346,7 +346,7 @@ int dwc3_core_soft_reset(struct dwc3 *dw
retries = 10;
do {
- reg = dwc3_readl(dwc->regs, DWC3_DCTL);
+ reg = dwc3_readl(dwc, DWC3_DCTL);
if (!(reg & DWC3_DCTL_CSFTRST))
goto done;
@@ -386,12 +386,12 @@ static void dwc3_frame_length_adjustment
if (dwc->fladj == 0)
return;
- reg = dwc3_readl(dwc->regs, DWC3_GFLADJ);
+ reg = dwc3_readl(dwc, DWC3_GFLADJ);
dft = reg & DWC3_GFLADJ_30MHZ_MASK;
if (dft != dwc->fladj) {
reg &= ~DWC3_GFLADJ_30MHZ_MASK;
reg |= DWC3_GFLADJ_30MHZ_SDBND_SEL | dwc->fladj;
- dwc3_writel(dwc->regs, DWC3_GFLADJ, reg);
+ dwc3_writel(dwc, DWC3_GFLADJ, reg);
}
}
@@ -423,10 +423,10 @@ static void dwc3_ref_clk_period(struct d
return;
}
- reg = dwc3_readl(dwc->regs, DWC3_GUCTL);
+ reg = dwc3_readl(dwc, DWC3_GUCTL);
reg &= ~DWC3_GUCTL_REFCLKPER_MASK;
reg |= FIELD_PREP(DWC3_GUCTL_REFCLKPER_MASK, period);
- dwc3_writel(dwc->regs, DWC3_GUCTL, reg);
+ dwc3_writel(dwc, DWC3_GUCTL, reg);
if (DWC3_VER_IS_PRIOR(DWC3, 250A))
return;
@@ -454,7 +454,7 @@ static void dwc3_ref_clk_period(struct d
*/
decr = 480000000 / rate;
- reg = dwc3_readl(dwc->regs, DWC3_GFLADJ);
+ reg = dwc3_readl(dwc, DWC3_GFLADJ);
reg &= ~DWC3_GFLADJ_REFCLK_FLADJ_MASK
& ~DWC3_GFLADJ_240MHZDECR
& ~DWC3_GFLADJ_240MHZDECR_PLS1;
@@ -465,7 +465,7 @@ static void dwc3_ref_clk_period(struct d
if (dwc->gfladj_refclk_lpm_sel)
reg |= DWC3_GFLADJ_REFCLK_LPM_SEL;
- dwc3_writel(dwc->regs, DWC3_GFLADJ, reg);
+ dwc3_writel(dwc, DWC3_GFLADJ, reg);
}
/**
@@ -568,16 +568,16 @@ int dwc3_event_buffers_setup(struct dwc3
evt = dwc->ev_buf;
evt->lpos = 0;
- dwc3_writel(dwc->regs, DWC3_GEVNTADRLO(0),
- lower_32_bits(evt->dma));
- dwc3_writel(dwc->regs, DWC3_GEVNTADRHI(0),
- upper_32_bits(evt->dma));
- dwc3_writel(dwc->regs, DWC3_GEVNTSIZ(0),
- DWC3_GEVNTSIZ_SIZE(evt->length));
+ dwc3_writel(dwc, DWC3_GEVNTADRLO(0),
+ lower_32_bits(evt->dma));
+ dwc3_writel(dwc, DWC3_GEVNTADRHI(0),
+ upper_32_bits(evt->dma));
+ dwc3_writel(dwc, DWC3_GEVNTSIZ(0),
+ DWC3_GEVNTSIZ_SIZE(evt->length));
/* Clear any stale event */
- reg = dwc3_readl(dwc->regs, DWC3_GEVNTCOUNT(0));
- dwc3_writel(dwc->regs, DWC3_GEVNTCOUNT(0), reg);
+ reg = dwc3_readl(dwc, DWC3_GEVNTCOUNT(0));
+ dwc3_writel(dwc, DWC3_GEVNTCOUNT(0), reg);
return 0;
}
@@ -592,7 +592,7 @@ void dwc3_event_buffers_cleanup(struct d
* Exynos platforms may not be able to access event buffer if the
* controller failed to halt on dwc3_core_exit().
*/
- reg = dwc3_readl(dwc->regs, DWC3_DSTS);
+ reg = dwc3_readl(dwc, DWC3_DSTS);
if (!(reg & DWC3_DSTS_DEVCTRLHLT))
return;
@@ -600,14 +600,14 @@ void dwc3_event_buffers_cleanup(struct d
evt->lpos = 0;
- dwc3_writel(dwc->regs, DWC3_GEVNTADRLO(0), 0);
- dwc3_writel(dwc->regs, DWC3_GEVNTADRHI(0), 0);
- dwc3_writel(dwc->regs, DWC3_GEVNTSIZ(0), DWC3_GEVNTSIZ_INTMASK
+ dwc3_writel(dwc, DWC3_GEVNTADRLO(0), 0);
+ dwc3_writel(dwc, DWC3_GEVNTADRHI(0), 0);
+ dwc3_writel(dwc, DWC3_GEVNTSIZ(0), DWC3_GEVNTSIZ_INTMASK
| DWC3_GEVNTSIZ_SIZE(0));
/* Clear any stale event */
- reg = dwc3_readl(dwc->regs, DWC3_GEVNTCOUNT(0));
- dwc3_writel(dwc->regs, DWC3_GEVNTCOUNT(0), reg);
+ reg = dwc3_readl(dwc, DWC3_GEVNTCOUNT(0));
+ dwc3_writel(dwc, DWC3_GEVNTCOUNT(0), reg);
}
static void dwc3_core_num_eps(struct dwc3 *dwc)
@@ -621,18 +621,18 @@ static void dwc3_cache_hwparams(struct d
{
struct dwc3_hwparams *parms = &dwc->hwparams;
- parms->hwparams0 = dwc3_readl(dwc->regs, DWC3_GHWPARAMS0);
- parms->hwparams1 = dwc3_readl(dwc->regs, DWC3_GHWPARAMS1);
- parms->hwparams2 = dwc3_readl(dwc->regs, DWC3_GHWPARAMS2);
- parms->hwparams3 = dwc3_readl(dwc->regs, DWC3_GHWPARAMS3);
- parms->hwparams4 = dwc3_readl(dwc->regs, DWC3_GHWPARAMS4);
- parms->hwparams5 = dwc3_readl(dwc->regs, DWC3_GHWPARAMS5);
- parms->hwparams6 = dwc3_readl(dwc->regs, DWC3_GHWPARAMS6);
- parms->hwparams7 = dwc3_readl(dwc->regs, DWC3_GHWPARAMS7);
- parms->hwparams8 = dwc3_readl(dwc->regs, DWC3_GHWPARAMS8);
+ parms->hwparams0 = dwc3_readl(dwc, DWC3_GHWPARAMS0);
+ parms->hwparams1 = dwc3_readl(dwc, DWC3_GHWPARAMS1);
+ parms->hwparams2 = dwc3_readl(dwc, DWC3_GHWPARAMS2);
+ parms->hwparams3 = dwc3_readl(dwc, DWC3_GHWPARAMS3);
+ parms->hwparams4 = dwc3_readl(dwc, DWC3_GHWPARAMS4);
+ parms->hwparams5 = dwc3_readl(dwc, DWC3_GHWPARAMS5);
+ parms->hwparams6 = dwc3_readl(dwc, DWC3_GHWPARAMS6);
+ parms->hwparams7 = dwc3_readl(dwc, DWC3_GHWPARAMS7);
+ parms->hwparams8 = dwc3_readl(dwc, DWC3_GHWPARAMS8);
if (DWC3_IP_IS(DWC32))
- parms->hwparams9 = dwc3_readl(dwc->regs, DWC3_GHWPARAMS9);
+ parms->hwparams9 = dwc3_readl(dwc, DWC3_GHWPARAMS9);
}
static void dwc3_config_soc_bus(struct dwc3 *dwc)
@@ -640,10 +640,10 @@ static void dwc3_config_soc_bus(struct d
if (dwc->gsbuscfg0_reqinfo != DWC3_GSBUSCFG0_REQINFO_UNSPECIFIED) {
u32 reg;
- reg = dwc3_readl(dwc->regs, DWC3_GSBUSCFG0);
+ reg = dwc3_readl(dwc, DWC3_GSBUSCFG0);
reg &= ~DWC3_GSBUSCFG0_REQINFO(~0);
reg |= DWC3_GSBUSCFG0_REQINFO(dwc->gsbuscfg0_reqinfo);
- dwc3_writel(dwc->regs, DWC3_GSBUSCFG0, reg);
+ dwc3_writel(dwc, DWC3_GSBUSCFG0, reg);
}
}
@@ -667,7 +667,7 @@ static int dwc3_ss_phy_setup(struct dwc3
{
u32 reg;
- reg = dwc3_readl(dwc->regs, DWC3_GUSB3PIPECTL(index));
+ reg = dwc3_readl(dwc, DWC3_GUSB3PIPECTL(index));
/*
* Make sure UX_EXIT_PX is cleared as that causes issues with some
@@ -705,7 +705,7 @@ static int dwc3_ss_phy_setup(struct dwc3
if (dwc->dis_del_phy_power_chg_quirk)
reg &= ~DWC3_GUSB3PIPECTL_DEPOCHANGE;
- dwc3_writel(dwc->regs, DWC3_GUSB3PIPECTL(index), reg);
+ dwc3_writel(dwc, DWC3_GUSB3PIPECTL(index), reg);
return 0;
}
@@ -714,7 +714,7 @@ static int dwc3_hs_phy_setup(struct dwc3
{
u32 reg;
- reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(index));
+ reg = dwc3_readl(dwc, DWC3_GUSB2PHYCFG(index));
/* Select the HS PHY interface */
switch (DWC3_GHWPARAMS3_HSPHY_IFC(dwc->hwparams.hwparams3)) {
@@ -726,7 +726,7 @@ static int dwc3_hs_phy_setup(struct dwc3
} else if (dwc->hsphy_interface &&
!strncmp(dwc->hsphy_interface, "ulpi", 4)) {
reg |= DWC3_GUSB2PHYCFG_ULPI_UTMI;
- dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(index), reg);
+ dwc3_writel(dwc, DWC3_GUSB2PHYCFG(index), reg);
} else {
/* Relying on default value. */
if (!(reg & DWC3_GUSB2PHYCFG_ULPI_UTMI))
@@ -776,7 +776,7 @@ static int dwc3_hs_phy_setup(struct dwc3
if (dwc->ulpi_ext_vbus_drv)
reg |= DWC3_GUSB2PHYCFG_ULPIEXTVBUSDRV;
- dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(index), reg);
+ dwc3_writel(dwc, DWC3_GUSB2PHYCFG(index), reg);
return 0;
}
@@ -989,7 +989,7 @@ static bool dwc3_core_is_valid(struct dw
{
u32 reg;
- reg = dwc3_readl(dwc->regs, DWC3_GSNPSID);
+ reg = dwc3_readl(dwc, DWC3_GSNPSID);
dwc->ip = DWC3_GSNPS_ID(reg);
if (dwc->ip == DWC4_IP)
dwc->ip = DWC32_IP;
@@ -998,8 +998,8 @@ static bool dwc3_core_is_valid(struct dw
if (DWC3_IP_IS(DWC3)) {
dwc->revision = reg;
} else if (DWC3_IP_IS(DWC31) || DWC3_IP_IS(DWC32)) {
- dwc->revision = dwc3_readl(dwc->regs, DWC3_VER_NUMBER);
- dwc->version_type = dwc3_readl(dwc->regs, DWC3_VER_TYPE);
+ dwc->revision = dwc3_readl(dwc, DWC3_VER_NUMBER);
+ dwc->version_type = dwc3_readl(dwc, DWC3_VER_TYPE);
} else {
return false;
}
@@ -1013,7 +1013,7 @@ static void dwc3_core_setup_global_contr
unsigned int hw_mode;
u32 reg;
- reg = dwc3_readl(dwc->regs, DWC3_GCTL);
+ reg = dwc3_readl(dwc, DWC3_GCTL);
reg &= ~DWC3_GCTL_SCALEDOWN_MASK;
hw_mode = DWC3_GHWPARAMS0_MODE(dwc->hwparams.hwparams0);
power_opt = DWC3_GHWPARAMS1_EN_PWROPT(dwc->hwparams.hwparams1);
@@ -1091,7 +1091,7 @@ static void dwc3_core_setup_global_contr
if (DWC3_VER_IS_PRIOR(DWC3, 190A))
reg |= DWC3_GCTL_U2RSTECN;
- dwc3_writel(dwc->regs, DWC3_GCTL, reg);
+ dwc3_writel(dwc, DWC3_GCTL, reg);
}
static int dwc3_core_get_phy(struct dwc3 *dwc);
@@ -1111,7 +1111,7 @@ static void dwc3_set_incr_burst_type(str
int ret;
int i;
- cfg = dwc3_readl(dwc->regs, DWC3_GSBUSCFG0);
+ cfg = dwc3_readl(dwc, DWC3_GSBUSCFG0);
/*
* Handle property "snps,incr-burst-type-adjustment".
@@ -1186,7 +1186,7 @@ static void dwc3_set_incr_burst_type(str
break;
}
- dwc3_writel(dwc->regs, DWC3_GSBUSCFG0, cfg);
+ dwc3_writel(dwc, DWC3_GSBUSCFG0, cfg);
}
static void dwc3_set_power_down_clk_scale(struct dwc3 *dwc)
@@ -1211,12 +1211,12 @@ static void dwc3_set_power_down_clk_scal
* (3x or more) to be within the requirement.
*/
scale = DIV_ROUND_UP(clk_get_rate(dwc->susp_clk), 16000);
- reg = dwc3_readl(dwc->regs, DWC3_GCTL);
+ reg = dwc3_readl(dwc, DWC3_GCTL);
if ((reg & DWC3_GCTL_PWRDNSCALE_MASK) < DWC3_GCTL_PWRDNSCALE(scale) ||
(reg & DWC3_GCTL_PWRDNSCALE_MASK) > DWC3_GCTL_PWRDNSCALE(scale*3)) {
reg &= ~(DWC3_GCTL_PWRDNSCALE_MASK);
reg |= DWC3_GCTL_PWRDNSCALE(scale);
- dwc3_writel(dwc->regs, DWC3_GCTL, reg);
+ dwc3_writel(dwc, DWC3_GCTL, reg);
}
}
@@ -1239,7 +1239,7 @@ static void dwc3_config_threshold(struct
tx_maxburst = dwc->tx_max_burst_prd;
if (rx_thr_num && rx_maxburst) {
- reg = dwc3_readl(dwc->regs, DWC3_GRXTHRCFG);
+ reg = dwc3_readl(dwc, DWC3_GRXTHRCFG);
reg |= DWC31_RXTHRNUMPKTSEL_PRD;
reg &= ~DWC31_RXTHRNUMPKT_PRD(~0);
@@ -1248,11 +1248,11 @@ static void dwc3_config_threshold(struct
reg &= ~DWC31_MAXRXBURSTSIZE_PRD(~0);
reg |= DWC31_MAXRXBURSTSIZE_PRD(rx_maxburst);
- dwc3_writel(dwc->regs, DWC3_GRXTHRCFG, reg);
+ dwc3_writel(dwc, DWC3_GRXTHRCFG, reg);
}
if (tx_thr_num && tx_maxburst) {
- reg = dwc3_readl(dwc->regs, DWC3_GTXTHRCFG);
+ reg = dwc3_readl(dwc, DWC3_GTXTHRCFG);
reg |= DWC31_TXTHRNUMPKTSEL_PRD;
reg &= ~DWC31_TXTHRNUMPKT_PRD(~0);
@@ -1261,7 +1261,7 @@ static void dwc3_config_threshold(struct
reg &= ~DWC31_MAXTXBURSTSIZE_PRD(~0);
reg |= DWC31_MAXTXBURSTSIZE_PRD(tx_maxburst);
- dwc3_writel(dwc->regs, DWC3_GTXTHRCFG, reg);
+ dwc3_writel(dwc, DWC3_GTXTHRCFG, reg);
}
}
@@ -1272,7 +1272,7 @@ static void dwc3_config_threshold(struct
if (DWC3_IP_IS(DWC3)) {
if (rx_thr_num && rx_maxburst) {
- reg = dwc3_readl(dwc->regs, DWC3_GRXTHRCFG);
+ reg = dwc3_readl(dwc, DWC3_GRXTHRCFG);
reg |= DWC3_GRXTHRCFG_PKTCNTSEL;
reg &= ~DWC3_GRXTHRCFG_RXPKTCNT(~0);
@@ -1281,11 +1281,11 @@ static void dwc3_config_threshold(struct
reg &= ~DWC3_GRXTHRCFG_MAXRXBURSTSIZE(~0);
reg |= DWC3_GRXTHRCFG_MAXRXBURSTSIZE(rx_maxburst);
- dwc3_writel(dwc->regs, DWC3_GRXTHRCFG, reg);
+ dwc3_writel(dwc, DWC3_GRXTHRCFG, reg);
}
if (tx_thr_num && tx_maxburst) {
- reg = dwc3_readl(dwc->regs, DWC3_GTXTHRCFG);
+ reg = dwc3_readl(dwc, DWC3_GTXTHRCFG);
reg |= DWC3_GTXTHRCFG_PKTCNTSEL;
reg &= ~DWC3_GTXTHRCFG_TXPKTCNT(~0);
@@ -1294,11 +1294,11 @@ static void dwc3_config_threshold(struct
reg &= ~DWC3_GTXTHRCFG_MAXTXBURSTSIZE(~0);
reg |= DWC3_GTXTHRCFG_MAXTXBURSTSIZE(tx_maxburst);
- dwc3_writel(dwc->regs, DWC3_GTXTHRCFG, reg);
+ dwc3_writel(dwc, DWC3_GTXTHRCFG, reg);
}
} else {
if (rx_thr_num && rx_maxburst) {
- reg = dwc3_readl(dwc->regs, DWC3_GRXTHRCFG);
+ reg = dwc3_readl(dwc, DWC3_GRXTHRCFG);
reg |= DWC31_GRXTHRCFG_PKTCNTSEL;
reg &= ~DWC31_GRXTHRCFG_RXPKTCNT(~0);
@@ -1307,11 +1307,11 @@ static void dwc3_config_threshold(struct
reg &= ~DWC31_GRXTHRCFG_MAXRXBURSTSIZE(~0);
reg |= DWC31_GRXTHRCFG_MAXRXBURSTSIZE(rx_maxburst);
- dwc3_writel(dwc->regs, DWC3_GRXTHRCFG, reg);
+ dwc3_writel(dwc, DWC3_GRXTHRCFG, reg);
}
if (tx_thr_num && tx_maxburst) {
- reg = dwc3_readl(dwc->regs, DWC3_GTXTHRCFG);
+ reg = dwc3_readl(dwc, DWC3_GTXTHRCFG);
reg |= DWC31_GTXTHRCFG_PKTCNTSEL;
reg &= ~DWC31_GTXTHRCFG_TXPKTCNT(~0);
@@ -1320,7 +1320,7 @@ static void dwc3_config_threshold(struct
reg &= ~DWC31_GTXTHRCFG_MAXTXBURSTSIZE(~0);
reg |= DWC31_GTXTHRCFG_MAXTXBURSTSIZE(tx_maxburst);
- dwc3_writel(dwc->regs, DWC3_GTXTHRCFG, reg);
+ dwc3_writel(dwc, DWC3_GTXTHRCFG, reg);
}
}
}
@@ -1343,7 +1343,7 @@ static int dwc3_core_init(struct dwc3 *d
* Write Linux Version Code to our GUID register so it's easy to figure
* out which kernel version a bug was found.
*/
- dwc3_writel(dwc->regs, DWC3_GUID, LINUX_VERSION_CODE);
+ dwc3_writel(dwc, DWC3_GUID, LINUX_VERSION_CODE);
ret = dwc3_phy_setup(dwc);
if (ret)
@@ -1408,9 +1408,9 @@ static int dwc3_core_init(struct dwc3 *d
* DWC_usb31 controller.
*/
if (DWC3_VER_IS_WITHIN(DWC3, 310A, ANY)) {
- reg = dwc3_readl(dwc->regs, DWC3_GUCTL2);
+ reg = dwc3_readl(dwc, DWC3_GUCTL2);
reg |= DWC3_GUCTL2_RST_ACTBITLATER;
- dwc3_writel(dwc->regs, DWC3_GUCTL2, reg);
+ dwc3_writel(dwc, DWC3_GUCTL2, reg);
}
/*
@@ -1423,9 +1423,9 @@ static int dwc3_core_init(struct dwc3 *d
* setting GUCTL2[19] by default; instead, use GUCTL2[19] = 0.
*/
if (DWC3_VER_IS(DWC3, 320A)) {
- reg = dwc3_readl(dwc->regs, DWC3_GUCTL2);
+ reg = dwc3_readl(dwc, DWC3_GUCTL2);
reg &= ~DWC3_GUCTL2_LC_TIMER;
- dwc3_writel(dwc->regs, DWC3_GUCTL2, reg);
+ dwc3_writel(dwc, DWC3_GUCTL2, reg);
}
/*
@@ -1438,13 +1438,13 @@ static int dwc3_core_init(struct dwc3 *d
* legacy ULPI PHYs.
*/
if (dwc->resume_hs_terminations) {
- reg = dwc3_readl(dwc->regs, DWC3_GUCTL1);
+ reg = dwc3_readl(dwc, DWC3_GUCTL1);
reg |= DWC3_GUCTL1_RESUME_OPMODE_HS_HOST;
- dwc3_writel(dwc->regs, DWC3_GUCTL1, reg);
+ dwc3_writel(dwc, DWC3_GUCTL1, reg);
}
if (!DWC3_VER_IS_PRIOR(DWC3, 250A)) {
- reg = dwc3_readl(dwc->regs, DWC3_GUCTL1);
+ reg = dwc3_readl(dwc, DWC3_GUCTL1);
/*
* Enable hardware control of sending remote wakeup
@@ -1479,7 +1479,7 @@ static int dwc3_core_init(struct dwc3 *d
reg &= ~DWC3_GUCTL1_DEV_FORCE_20_CLK_FOR_30_CLK;
}
- dwc3_writel(dwc->regs, DWC3_GUCTL1, reg);
+ dwc3_writel(dwc, DWC3_GUCTL1, reg);
}
dwc3_config_threshold(dwc);
@@ -1494,9 +1494,9 @@ static int dwc3_core_init(struct dwc3 *d
int i;
for (i = 0; i < dwc->num_usb3_ports; i++) {
- reg = dwc3_readl(dwc->regs, DWC3_LLUCTL(i));
+ reg = dwc3_readl(dwc, DWC3_LLUCTL(i));
reg |= DWC3_LLUCTL_FORCE_GEN1;
- dwc3_writel(dwc->regs, DWC3_LLUCTL(i), reg);
+ dwc3_writel(dwc, DWC3_LLUCTL(i), reg);
}
}
@@ -1515,9 +1515,9 @@ static int dwc3_core_init(struct dwc3 *d
* function is available only from version 1.70a.
*/
if (DWC3_VER_IS_WITHIN(DWC31, 170A, 180A)) {
- reg = dwc3_readl(dwc->regs, DWC3_GUCTL3);
+ reg = dwc3_readl(dwc, DWC3_GUCTL3);
reg |= DWC3_GUCTL3_USB20_RETRY_DISABLE;
- dwc3_writel(dwc->regs, DWC3_GUCTL3, reg);
+ dwc3_writel(dwc, DWC3_GUCTL3, reg);
}
return 0;
@@ -2447,9 +2447,9 @@ static int dwc3_suspend_common(struct dw
int ret;
if (!pm_runtime_suspended(dwc->dev) && !PMSG_IS_AUTO(msg)) {
- dwc->susphy_state = (dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0)) &
+ dwc->susphy_state = (dwc3_readl(dwc, DWC3_GUSB2PHYCFG(0)) &
DWC3_GUSB2PHYCFG_SUSPHY) ||
- (dwc3_readl(dwc->regs, DWC3_GUSB3PIPECTL(0)) &
+ (dwc3_readl(dwc, DWC3_GUSB3PIPECTL(0)) &
DWC3_GUSB3PIPECTL_SUSPHY);
/*
* TI AM62 platform requires SUSPHY to be
@@ -2479,10 +2479,10 @@ static int dwc3_suspend_common(struct dw
if (dwc->dis_u2_susphy_quirk ||
dwc->dis_enblslpm_quirk) {
for (i = 0; i < dwc->num_usb2_ports; i++) {
- reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(i));
+ reg = dwc3_readl(dwc, DWC3_GUSB2PHYCFG(i));
reg |= DWC3_GUSB2PHYCFG_ENBLSLPM |
DWC3_GUSB2PHYCFG_SUSPHY;
- dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(i), reg);
+ dwc3_writel(dwc, DWC3_GUSB2PHYCFG(i), reg);
}
/* Give some time for USB2 PHY to suspend */
@@ -2542,14 +2542,14 @@ static int dwc3_resume_common(struct dwc
}
/* Restore GUSB2PHYCFG bits that were modified in suspend */
for (i = 0; i < dwc->num_usb2_ports; i++) {
- reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(i));
+ reg = dwc3_readl(dwc, DWC3_GUSB2PHYCFG(i));
if (dwc->dis_u2_susphy_quirk)
reg &= ~DWC3_GUSB2PHYCFG_SUSPHY;
if (dwc->dis_enblslpm_quirk)
reg &= ~DWC3_GUSB2PHYCFG_ENBLSLPM;
- dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(i), reg);
+ dwc3_writel(dwc, DWC3_GUSB2PHYCFG(i), reg);
}
for (i = 0; i < dwc->num_usb2_ports; i++)
@@ -2732,9 +2732,9 @@ void dwc3_pm_complete(struct dwc3 *dwc)
if (dwc->current_dr_role == DWC3_GCTL_PRTCAP_HOST &&
dwc->dis_split_quirk) {
- reg = dwc3_readl(dwc->regs, DWC3_GUCTL3);
+ reg = dwc3_readl(dwc, DWC3_GUCTL3);
reg |= DWC3_GUCTL3_SPLITDISABLE;
- dwc3_writel(dwc->regs, DWC3_GUCTL3, reg);
+ dwc3_writel(dwc, DWC3_GUCTL3, reg);
}
}
EXPORT_SYMBOL_GPL(dwc3_pm_complete);
--- a/drivers/usb/dwc3/debugfs.c
+++ b/drivers/usb/dwc3/debugfs.c
@@ -296,14 +296,14 @@ static void dwc3_host_lsp(struct seq_fil
reg = DWC3_GDBGLSPMUX_HOSTSELECT(sel);
- dwc3_writel(dwc->regs, DWC3_GDBGLSPMUX, reg);
- val = dwc3_readl(dwc->regs, DWC3_GDBGLSP);
+ dwc3_writel(dwc, DWC3_GDBGLSPMUX, reg);
+ val = dwc3_readl(dwc, DWC3_GDBGLSP);
seq_printf(s, "GDBGLSP[%d] = 0x%08x\n", sel, val);
if (dbc_enabled && sel < 256) {
reg |= DWC3_GDBGLSPMUX_ENDBC;
- dwc3_writel(dwc->regs, DWC3_GDBGLSPMUX, reg);
- val = dwc3_readl(dwc->regs, DWC3_GDBGLSP);
+ dwc3_writel(dwc, DWC3_GDBGLSPMUX, reg);
+ val = dwc3_readl(dwc, DWC3_GDBGLSP);
seq_printf(s, "GDBGLSP_DBC[%d] = 0x%08x\n", sel, val);
}
}
@@ -316,8 +316,8 @@ static void dwc3_gadget_lsp(struct seq_f
for (i = 0; i < 16; i++) {
reg = DWC3_GDBGLSPMUX_DEVSELECT(i);
- dwc3_writel(dwc->regs, DWC3_GDBGLSPMUX, reg);
- reg = dwc3_readl(dwc->regs, DWC3_GDBGLSP);
+ dwc3_writel(dwc, DWC3_GDBGLSPMUX, reg);
+ reg = dwc3_readl(dwc, DWC3_GDBGLSP);
seq_printf(s, "GDBGLSP[%d] = 0x%08x\n", i, reg);
}
}
@@ -335,7 +335,7 @@ static int dwc3_lsp_show(struct seq_file
return ret;
spin_lock_irqsave(&dwc->lock, flags);
- reg = dwc3_readl(dwc->regs, DWC3_GSTS);
+ reg = dwc3_readl(dwc, DWC3_GSTS);
current_mode = DWC3_GSTS_CURMOD(reg);
switch (current_mode) {
@@ -406,7 +406,7 @@ static int dwc3_mode_show(struct seq_fil
return ret;
spin_lock_irqsave(&dwc->lock, flags);
- reg = dwc3_readl(dwc->regs, DWC3_GCTL);
+ reg = dwc3_readl(dwc, DWC3_GCTL);
spin_unlock_irqrestore(&dwc->lock, flags);
mode = DWC3_GCTL_PRTCAP(reg);
@@ -478,7 +478,7 @@ static int dwc3_testmode_show(struct seq
return ret;
spin_lock_irqsave(&dwc->lock, flags);
- reg = dwc3_readl(dwc->regs, DWC3_DCTL);
+ reg = dwc3_readl(dwc, DWC3_DCTL);
reg &= DWC3_DCTL_TSTCTRL_MASK;
reg >>= 1;
spin_unlock_irqrestore(&dwc->lock, flags);
@@ -577,7 +577,7 @@ static int dwc3_link_state_show(struct s
return ret;
spin_lock_irqsave(&dwc->lock, flags);
- reg = dwc3_readl(dwc->regs, DWC3_GSTS);
+ reg = dwc3_readl(dwc, DWC3_GSTS);
if (DWC3_GSTS_CURMOD(reg) != DWC3_GSTS_CURMOD_DEVICE) {
seq_puts(s, "Not available\n");
spin_unlock_irqrestore(&dwc->lock, flags);
@@ -585,7 +585,7 @@ static int dwc3_link_state_show(struct s
return 0;
}
- reg = dwc3_readl(dwc->regs, DWC3_DSTS);
+ reg = dwc3_readl(dwc, DWC3_DSTS);
state = DWC3_DSTS_USBLNKST(reg);
speed = reg & DWC3_DSTS_CONNECTSPD;
@@ -639,14 +639,14 @@ static ssize_t dwc3_link_state_write(str
return ret;
spin_lock_irqsave(&dwc->lock, flags);
- reg = dwc3_readl(dwc->regs, DWC3_GSTS);
+ reg = dwc3_readl(dwc, DWC3_GSTS);
if (DWC3_GSTS_CURMOD(reg) != DWC3_GSTS_CURMOD_DEVICE) {
spin_unlock_irqrestore(&dwc->lock, flags);
pm_runtime_put_sync(dwc->dev);
return -EINVAL;
}
- reg = dwc3_readl(dwc->regs, DWC3_DSTS);
+ reg = dwc3_readl(dwc, DWC3_DSTS);
speed = reg & DWC3_DSTS_CONNECTSPD;
if (speed < DWC3_DSTS_SUPERSPEED &&
@@ -942,10 +942,10 @@ static int dwc3_ep_info_register_show(st
spin_lock_irqsave(&dwc->lock, flags);
reg = DWC3_GDBGLSPMUX_EPSELECT(dep->number);
- dwc3_writel(dwc->regs, DWC3_GDBGLSPMUX, reg);
+ dwc3_writel(dwc, DWC3_GDBGLSPMUX, reg);
- lower_32_bits = dwc3_readl(dwc->regs, DWC3_GDBGEPINFO0);
- upper_32_bits = dwc3_readl(dwc->regs, DWC3_GDBGEPINFO1);
+ lower_32_bits = dwc3_readl(dwc, DWC3_GDBGEPINFO0);
+ upper_32_bits = dwc3_readl(dwc, DWC3_GDBGEPINFO1);
ep_info = ((u64)upper_32_bits << 32) | lower_32_bits;
seq_printf(s, "0x%016llx\n", ep_info);
--- a/drivers/usb/dwc3/drd.c
+++ b/drivers/usb/dwc3/drd.c
@@ -18,25 +18,25 @@
static void dwc3_otg_disable_events(struct dwc3 *dwc, u32 disable_mask)
{
- u32 reg = dwc3_readl(dwc->regs, DWC3_OEVTEN);
+ u32 reg = dwc3_readl(dwc, DWC3_OEVTEN);
reg &= ~(disable_mask);
- dwc3_writel(dwc->regs, DWC3_OEVTEN, reg);
+ dwc3_writel(dwc, DWC3_OEVTEN, reg);
}
static void dwc3_otg_enable_events(struct dwc3 *dwc, u32 enable_mask)
{
- u32 reg = dwc3_readl(dwc->regs, DWC3_OEVTEN);
+ u32 reg = dwc3_readl(dwc, DWC3_OEVTEN);
reg |= (enable_mask);
- dwc3_writel(dwc->regs, DWC3_OEVTEN, reg);
+ dwc3_writel(dwc, DWC3_OEVTEN, reg);
}
static void dwc3_otg_clear_events(struct dwc3 *dwc)
{
- u32 reg = dwc3_readl(dwc->regs, DWC3_OEVT);
+ u32 reg = dwc3_readl(dwc, DWC3_OEVT);
- dwc3_writel(dwc->regs, DWC3_OEVTEN, reg);
+ dwc3_writel(dwc, DWC3_OEVTEN, reg);
}
#define DWC3_OTG_ALL_EVENTS (DWC3_OEVTEN_XHCIRUNSTPSETEN | \
@@ -72,18 +72,18 @@ static irqreturn_t dwc3_otg_irq(int irq,
struct dwc3 *dwc = _dwc;
irqreturn_t ret = IRQ_NONE;
- reg = dwc3_readl(dwc->regs, DWC3_OEVT);
+ reg = dwc3_readl(dwc, DWC3_OEVT);
if (reg) {
/* ignore non OTG events, we can't disable them in OEVTEN */
if (!(reg & DWC3_OTG_ALL_EVENTS)) {
- dwc3_writel(dwc->regs, DWC3_OEVT, reg);
+ dwc3_writel(dwc, DWC3_OEVT, reg);
return IRQ_NONE;
}
if (dwc->current_otg_role == DWC3_OTG_ROLE_HOST &&
!(reg & DWC3_OEVT_DEVICEMODE))
dwc->otg_restart_host = true;
- dwc3_writel(dwc->regs, DWC3_OEVT, reg);
+ dwc3_writel(dwc, DWC3_OEVT, reg);
ret = IRQ_WAKE_THREAD;
}
@@ -100,23 +100,23 @@ static void dwc3_otgregs_init(struct dwc
* the signal outputs sent to the PHY, the OTG FSM logic of the
* core and also the resets to the VBUS filters inside the core.
*/
- reg = dwc3_readl(dwc->regs, DWC3_OCFG);
+ reg = dwc3_readl(dwc, DWC3_OCFG);
reg |= DWC3_OCFG_SFTRSTMASK;
- dwc3_writel(dwc->regs, DWC3_OCFG, reg);
+ dwc3_writel(dwc, DWC3_OCFG, reg);
/* Disable hibernation for simplicity */
- reg = dwc3_readl(dwc->regs, DWC3_GCTL);
+ reg = dwc3_readl(dwc, DWC3_GCTL);
reg &= ~DWC3_GCTL_GBLHIBERNATIONEN;
- dwc3_writel(dwc->regs, DWC3_GCTL, reg);
+ dwc3_writel(dwc, DWC3_GCTL, reg);
/*
* Initialize OTG registers as per
* Figure 11-4 OTG Driver Overall Programming Flow
*/
/* OCFG.SRPCap = 0, OCFG.HNPCap = 0 */
- reg = dwc3_readl(dwc->regs, DWC3_OCFG);
+ reg = dwc3_readl(dwc, DWC3_OCFG);
reg &= ~(DWC3_OCFG_SRPCAP | DWC3_OCFG_HNPCAP);
- dwc3_writel(dwc->regs, DWC3_OCFG, reg);
+ dwc3_writel(dwc, DWC3_OCFG, reg);
/* OEVT = FFFF */
dwc3_otg_clear_events(dwc);
/* OEVTEN = 0 */
@@ -127,11 +127,11 @@ static void dwc3_otgregs_init(struct dwc
* OCTL.PeriMode = 1, OCTL.DevSetHNPEn = 0, OCTL.HstSetHNPEn = 0,
* OCTL.HNPReq = 0
*/
- reg = dwc3_readl(dwc->regs, DWC3_OCTL);
+ reg = dwc3_readl(dwc, DWC3_OCTL);
reg |= DWC3_OCTL_PERIMODE;
reg &= ~(DWC3_OCTL_DEVSETHNPEN | DWC3_OCTL_HSTSETHNPEN |
DWC3_OCTL_HNPREQ);
- dwc3_writel(dwc->regs, DWC3_OCTL, reg);
+ dwc3_writel(dwc, DWC3_OCTL, reg);
}
static int dwc3_otg_get_irq(struct dwc3 *dwc)
@@ -175,9 +175,9 @@ void dwc3_otg_init(struct dwc3 *dwc)
/* GCTL.PrtCapDir=2'b11 */
dwc3_set_prtcap(dwc, DWC3_GCTL_PRTCAP_OTG, true);
/* GUSB2PHYCFG0.SusPHY=0 */
- reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0));
+ reg = dwc3_readl(dwc, DWC3_GUSB2PHYCFG(0));
reg &= ~DWC3_GUSB2PHYCFG_SUSPHY;
- dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), reg);
+ dwc3_writel(dwc, DWC3_GUSB2PHYCFG(0), reg);
/* Initialize OTG registers */
dwc3_otgregs_init(dwc);
@@ -203,17 +203,17 @@ void dwc3_otg_host_init(struct dwc3 *dwc
* OCTL.PeriMode=0, OCTL.TermSelDLPulse = 0,
* OCTL.DevSetHNPEn = 0, OCTL.HstSetHNPEn = 0
*/
- reg = dwc3_readl(dwc->regs, DWC3_OCTL);
+ reg = dwc3_readl(dwc, DWC3_OCTL);
reg &= ~(DWC3_OCTL_PERIMODE | DWC3_OCTL_TERMSELIDPULSE |
DWC3_OCTL_DEVSETHNPEN | DWC3_OCTL_HSTSETHNPEN);
- dwc3_writel(dwc->regs, DWC3_OCTL, reg);
+ dwc3_writel(dwc, DWC3_OCTL, reg);
/*
* OCFG.DisPrtPwrCutoff = 0/1
*/
- reg = dwc3_readl(dwc->regs, DWC3_OCFG);
+ reg = dwc3_readl(dwc, DWC3_OCFG);
reg &= ~DWC3_OCFG_DISPWRCUTTOFF;
- dwc3_writel(dwc->regs, DWC3_OCFG, reg);
+ dwc3_writel(dwc, DWC3_OCFG, reg);
/*
* OCFG.SRPCap = 1, OCFG.HNPCap = GHWPARAMS6.HNP_CAP
@@ -229,15 +229,15 @@ void dwc3_otg_host_init(struct dwc3 *dwc
/* GUSB2PHYCFG.ULPIAutoRes = 1/0, GUSB2PHYCFG.SusPHY = 1 */
if (!dwc->dis_u2_susphy_quirk) {
- reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0));
+ reg = dwc3_readl(dwc, DWC3_GUSB2PHYCFG(0));
reg |= DWC3_GUSB2PHYCFG_SUSPHY;
- dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), reg);
+ dwc3_writel(dwc, DWC3_GUSB2PHYCFG(0), reg);
}
/* Set Port Power to enable VBUS: OCTL.PrtPwrCtl = 1 */
- reg = dwc3_readl(dwc->regs, DWC3_OCTL);
+ reg = dwc3_readl(dwc, DWC3_OCTL);
reg |= DWC3_OCTL_PRTPWRCTL;
- dwc3_writel(dwc->regs, DWC3_OCTL, reg);
+ dwc3_writel(dwc, DWC3_OCTL, reg);
}
/* should be called after Host controller driver is stopped */
@@ -258,9 +258,9 @@ static void dwc3_otg_host_exit(struct dw
*/
/* OCTL.HstSetHNPEn = 0, OCTL.PrtPwrCtl=0 */
- reg = dwc3_readl(dwc->regs, DWC3_OCTL);
+ reg = dwc3_readl(dwc, DWC3_OCTL);
reg &= ~(DWC3_OCTL_HSTSETHNPEN | DWC3_OCTL_PRTPWRCTL);
- dwc3_writel(dwc->regs, DWC3_OCTL, reg);
+ dwc3_writel(dwc, DWC3_OCTL, reg);
}
/* should be called before the gadget controller driver is started */
@@ -274,27 +274,27 @@ static void dwc3_otg_device_init(struct
* OCFG.HNPCap = GHWPARAMS6.HNP_CAP, OCFG.SRPCap = 1
* but we keep them 0 for simple dual-role operation.
*/
- reg = dwc3_readl(dwc->regs, DWC3_OCFG);
+ reg = dwc3_readl(dwc, DWC3_OCFG);
/* OCFG.OTGSftRstMsk = 0/1 */
reg |= DWC3_OCFG_SFTRSTMASK;
- dwc3_writel(dwc->regs, DWC3_OCFG, reg);
+ dwc3_writel(dwc, DWC3_OCFG, reg);
/*
* OCTL.PeriMode = 1
* OCTL.TermSelDLPulse = 0/1, OCTL.HNPReq = 0
* OCTL.DevSetHNPEn = 0, OCTL.HstSetHNPEn = 0
*/
- reg = dwc3_readl(dwc->regs, DWC3_OCTL);
+ reg = dwc3_readl(dwc, DWC3_OCTL);
reg |= DWC3_OCTL_PERIMODE;
reg &= ~(DWC3_OCTL_TERMSELIDPULSE | DWC3_OCTL_HNPREQ |
DWC3_OCTL_DEVSETHNPEN | DWC3_OCTL_HSTSETHNPEN);
- dwc3_writel(dwc->regs, DWC3_OCTL, reg);
+ dwc3_writel(dwc, DWC3_OCTL, reg);
/* OEVTEN.OTGBDevSesVldDetEvntEn = 1 */
dwc3_otg_enable_events(dwc, DWC3_OEVTEN_BDEVSESSVLDDETEN);
/* GUSB2PHYCFG.ULPIAutoRes = 0, GUSB2PHYCFG0.SusPHY = 1 */
if (!dwc->dis_u2_susphy_quirk) {
- reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0));
+ reg = dwc3_readl(dwc, DWC3_GUSB2PHYCFG(0));
reg |= DWC3_GUSB2PHYCFG_SUSPHY;
- dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), reg);
+ dwc3_writel(dwc, DWC3_GUSB2PHYCFG(0), reg);
}
/* GCTL.GblHibernationEn = 0. Already 0. */
}
@@ -319,10 +319,10 @@ static void dwc3_otg_device_exit(struct
DWC3_OEVTEN_BDEVBHOSTENDEN);
/* OCTL.DevSetHNPEn = 0, OCTL.HNPReq = 0, OCTL.PeriMode=1 */
- reg = dwc3_readl(dwc->regs, DWC3_OCTL);
+ reg = dwc3_readl(dwc, DWC3_OCTL);
reg &= ~(DWC3_OCTL_DEVSETHNPEN | DWC3_OCTL_HNPREQ);
reg |= DWC3_OCTL_PERIMODE;
- dwc3_writel(dwc->regs, DWC3_OCTL, reg);
+ dwc3_writel(dwc, DWC3_OCTL, reg);
}
void dwc3_otg_update(struct dwc3 *dwc, bool ignore_idstatus)
@@ -341,7 +341,7 @@ void dwc3_otg_update(struct dwc3 *dwc, b
return;
if (!ignore_idstatus) {
- reg = dwc3_readl(dwc->regs, DWC3_OSTS);
+ reg = dwc3_readl(dwc, DWC3_OSTS);
id = !!(reg & DWC3_OSTS_CONIDSTS);
dwc->desired_otg_role = id ? DWC3_OTG_ROLE_DEVICE :
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -361,7 +361,7 @@ static int dwc3_ep0_handle_status(struct
if ((dwc->speed == DWC3_DSTS_SUPERSPEED) ||
(dwc->speed == DWC3_DSTS_SUPERSPEED_PLUS)) {
- reg = dwc3_readl(dwc->regs, DWC3_DCTL);
+ reg = dwc3_readl(dwc, DWC3_DCTL);
if (reg & DWC3_DCTL_INITU1ENA)
usb_status |= 1 << USB_DEV_STAT_U1_ENABLED;
if (reg & DWC3_DCTL_INITU2ENA)
@@ -417,12 +417,12 @@ static int dwc3_ep0_handle_u1(struct dwc
if (set && dwc->dis_u1_entry_quirk)
return -EINVAL;
- reg = dwc3_readl(dwc->regs, DWC3_DCTL);
+ reg = dwc3_readl(dwc, DWC3_DCTL);
if (set)
reg |= DWC3_DCTL_INITU1ENA;
else
reg &= ~DWC3_DCTL_INITU1ENA;
- dwc3_writel(dwc->regs, DWC3_DCTL, reg);
+ dwc3_writel(dwc, DWC3_DCTL, reg);
return 0;
}
@@ -441,12 +441,12 @@ static int dwc3_ep0_handle_u2(struct dwc
if (set && dwc->dis_u2_entry_quirk)
return -EINVAL;
- reg = dwc3_readl(dwc->regs, DWC3_DCTL);
+ reg = dwc3_readl(dwc, DWC3_DCTL);
if (set)
reg |= DWC3_DCTL_INITU2ENA;
else
reg &= ~DWC3_DCTL_INITU2ENA;
- dwc3_writel(dwc->regs, DWC3_DCTL, reg);
+ dwc3_writel(dwc, DWC3_DCTL, reg);
return 0;
}
@@ -612,10 +612,10 @@ static int dwc3_ep0_set_address(struct d
return -EINVAL;
}
- reg = dwc3_readl(dwc->regs, DWC3_DCFG);
+ reg = dwc3_readl(dwc, DWC3_DCFG);
reg &= ~(DWC3_DCFG_DEVADDR_MASK);
reg |= DWC3_DCFG_DEVADDR(addr);
- dwc3_writel(dwc->regs, DWC3_DCFG, reg);
+ dwc3_writel(dwc, DWC3_DCFG, reg);
if (addr)
usb_gadget_set_state(dwc->gadget, USB_STATE_ADDRESS);
@@ -672,12 +672,12 @@ static int dwc3_ep0_set_config(struct dw
* Enable transition to U1/U2 state when
* nothing is pending from application.
*/
- reg = dwc3_readl(dwc->regs, DWC3_DCTL);
+ reg = dwc3_readl(dwc, DWC3_DCTL);
if (!dwc->dis_u1_entry_quirk)
reg |= DWC3_DCTL_ACCEPTU1ENA;
if (!dwc->dis_u2_entry_quirk)
reg |= DWC3_DCTL_ACCEPTU2ENA;
- dwc3_writel(dwc->regs, DWC3_DCTL, reg);
+ dwc3_writel(dwc, DWC3_DCTL, reg);
}
break;
@@ -717,7 +717,7 @@ static void dwc3_ep0_set_sel_cmpl(struct
dwc->u2sel = le16_to_cpu(timing.u2sel);
dwc->u2pel = le16_to_cpu(timing.u2pel);
- reg = dwc3_readl(dwc->regs, DWC3_DCTL);
+ reg = dwc3_readl(dwc, DWC3_DCTL);
if (reg & DWC3_DCTL_INITU2ENA)
param = dwc->u2pel;
if (reg & DWC3_DCTL_INITU1ENA)
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -42,7 +42,7 @@ int dwc3_gadget_set_test_mode(struct dwc
{
u32 reg;
- reg = dwc3_readl(dwc->regs, DWC3_DCTL);
+ reg = dwc3_readl(dwc, DWC3_DCTL);
reg &= ~DWC3_DCTL_TSTCTRL_MASK;
switch (mode) {
@@ -73,7 +73,7 @@ int dwc3_gadget_get_link_state(struct dw
{
u32 reg;
- reg = dwc3_readl(dwc->regs, DWC3_DSTS);
+ reg = dwc3_readl(dwc, DWC3_DSTS);
return DWC3_DSTS_USBLNKST(reg);
}
@@ -97,7 +97,7 @@ int dwc3_gadget_set_link_state(struct dw
*/
if (!DWC3_VER_IS_PRIOR(DWC3, 194A)) {
while (--retries) {
- reg = dwc3_readl(dwc->regs, DWC3_DSTS);
+ reg = dwc3_readl(dwc, DWC3_DSTS);
if (reg & DWC3_DSTS_DCNRD)
udelay(5);
else
@@ -108,15 +108,15 @@ int dwc3_gadget_set_link_state(struct dw
return -ETIMEDOUT;
}
- reg = dwc3_readl(dwc->regs, DWC3_DCTL);
+ reg = dwc3_readl(dwc, DWC3_DCTL);
reg &= ~DWC3_DCTL_ULSTCHNGREQ_MASK;
/* set no action before sending new link state change */
- dwc3_writel(dwc->regs, DWC3_DCTL, reg);
+ dwc3_writel(dwc, DWC3_DCTL, reg);
/* set requested state */
reg |= DWC3_DCTL_ULSTCHNGREQ(state);
- dwc3_writel(dwc->regs, DWC3_DCTL, reg);
+ dwc3_writel(dwc, DWC3_DCTL, reg);
/*
* The following code is racy when called from dwc3_gadget_wakeup,
@@ -128,7 +128,7 @@ int dwc3_gadget_set_link_state(struct dw
/* wait for a change in DSTS */
retries = 10000;
while (--retries) {
- reg = dwc3_readl(dwc->regs, DWC3_DSTS);
+ reg = dwc3_readl(dwc, DWC3_DSTS);
if (DWC3_DSTS_USBLNKST(reg) == state)
return 0;
@@ -260,11 +260,11 @@ int dwc3_send_gadget_generic_command(str
int ret = 0;
u32 reg;
- dwc3_writel(dwc->regs, DWC3_DGCMDPAR, param);
- dwc3_writel(dwc->regs, DWC3_DGCMD, cmd | DWC3_DGCMD_CMDACT);
+ dwc3_writel(dwc, DWC3_DGCMDPAR, param);
+ dwc3_writel(dwc, DWC3_DGCMD, cmd | DWC3_DGCMD_CMDACT);
do {
- reg = dwc3_readl(dwc->regs, DWC3_DGCMD);
+ reg = dwc3_readl(dwc, DWC3_DGCMD);
if (!(reg & DWC3_DGCMD_CMDACT)) {
status = DWC3_DGCMD_STATUS(reg);
if (status)
@@ -334,7 +334,7 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_
*/
if (dwc->gadget->speed <= USB_SPEED_HIGH ||
DWC3_DEPCMD_CMD(cmd) == DWC3_DEPCMD_ENDTRANSFER) {
- reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0));
+ reg = dwc3_readl(dwc, DWC3_GUSB2PHYCFG(0));
if (unlikely(reg & DWC3_GUSB2PHYCFG_SUSPHY)) {
saved_config |= DWC3_GUSB2PHYCFG_SUSPHY;
reg &= ~DWC3_GUSB2PHYCFG_SUSPHY;
@@ -346,7 +346,7 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_
}
if (saved_config)
- dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), reg);
+ dwc3_writel(dwc, DWC3_GUSB2PHYCFG(0), reg);
}
/*
@@ -356,9 +356,9 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_
* improve performance.
*/
if (DWC3_DEPCMD_CMD(cmd) != DWC3_DEPCMD_UPDATETRANSFER) {
- dwc3_writel(dwc->regs, DWC3_DEPCMDPAR0(epnum), params->param0);
- dwc3_writel(dwc->regs, DWC3_DEPCMDPAR1(epnum), params->param1);
- dwc3_writel(dwc->regs, DWC3_DEPCMDPAR2(epnum), params->param2);
+ dwc3_writel(dwc, DWC3_DEPCMDPAR0(epnum), params->param0);
+ dwc3_writel(dwc, DWC3_DEPCMDPAR1(epnum), params->param1);
+ dwc3_writel(dwc, DWC3_DEPCMDPAR2(epnum), params->param2);
}
/*
@@ -382,7 +382,7 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_
else
cmd |= DWC3_DEPCMD_CMDACT;
- dwc3_writel(dwc->regs, DWC3_DEPCMD(epnum), cmd);
+ dwc3_writel(dwc, DWC3_DEPCMD(epnum), cmd);
if (!(cmd & DWC3_DEPCMD_CMDACT) ||
(DWC3_DEPCMD_CMD(cmd) == DWC3_DEPCMD_ENDTRANSFER &&
@@ -392,7 +392,7 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_
}
do {
- reg = dwc3_readl(dwc->regs, DWC3_DEPCMD(epnum));
+ reg = dwc3_readl(dwc, DWC3_DEPCMD(epnum));
if (!(reg & DWC3_DEPCMD_CMDACT)) {
cmd_status = DWC3_DEPCMD_STATUS(reg);
@@ -448,9 +448,9 @@ skip_status:
mdelay(1);
if (saved_config) {
- reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0));
+ reg = dwc3_readl(dwc, DWC3_GUSB2PHYCFG(0));
reg |= saved_config;
- dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), reg);
+ dwc3_writel(dwc, DWC3_GUSB2PHYCFG(0), reg);
}
return ret;
@@ -727,7 +727,7 @@ static int dwc3_gadget_calc_ram_depth(st
u32 reg;
/* Check if TXFIFOs start at non-zero addr */
- reg = dwc3_readl(dwc->regs, DWC3_GTXFIFOSIZ(0));
+ reg = dwc3_readl(dwc, DWC3_GTXFIFOSIZ(0));
fifo_0_start = DWC3_GTXFIFOSIZ_TXFSTADDR(reg);
ram_depth -= (fifo_0_start >> 16);
@@ -755,7 +755,7 @@ void dwc3_gadget_clear_tx_fifos(struct d
/* Read ep0IN related TXFIFO size */
dep = dwc->eps[1];
- size = dwc3_readl(dwc->regs, DWC3_GTXFIFOSIZ(0));
+ size = dwc3_readl(dwc, DWC3_GTXFIFOSIZ(0));
if (DWC3_IP_IS(DWC3))
fifo_depth = DWC3_GTXFIFOSIZ_TXFDEP(size);
else
@@ -770,10 +770,10 @@ void dwc3_gadget_clear_tx_fifos(struct d
/* Don't change TXFRAMNUM on usb31 version */
size = DWC3_IP_IS(DWC3) ? 0 :
- dwc3_readl(dwc->regs, DWC3_GTXFIFOSIZ(num >> 1)) &
+ dwc3_readl(dwc, DWC3_GTXFIFOSIZ(num >> 1)) &
DWC31_GTXFIFOSIZ_TXFRAMNUM;
- dwc3_writel(dwc->regs, DWC3_GTXFIFOSIZ(num >> 1), size);
+ dwc3_writel(dwc, DWC3_GTXFIFOSIZ(num >> 1), size);
dep->flags &= ~DWC3_EP_TXFIFO_RESIZED;
}
dwc->num_ep_resized = 0;
@@ -876,7 +876,7 @@ static int dwc3_gadget_resize_tx_fifos(s
fifo_size++;
/* Check if TXFIFOs start at non-zero addr */
- tmp = dwc3_readl(dwc->regs, DWC3_GTXFIFOSIZ(0));
+ tmp = dwc3_readl(dwc, DWC3_GTXFIFOSIZ(0));
fifo_0_start = DWC3_GTXFIFOSIZ_TXFSTADDR(tmp);
fifo_size |= (fifo_0_start + (dwc->last_fifo_depth << 16));
@@ -899,7 +899,7 @@ static int dwc3_gadget_resize_tx_fifos(s
return -ENOMEM;
}
- dwc3_writel(dwc->regs, DWC3_GTXFIFOSIZ(dep->number >> 1), fifo_size);
+ dwc3_writel(dwc, DWC3_GTXFIFOSIZ(dep->number >> 1), fifo_size);
dep->flags |= DWC3_EP_TXFIFO_RESIZED;
dwc->num_ep_resized++;
@@ -943,9 +943,9 @@ static int __dwc3_gadget_ep_enable(struc
dep->type = usb_endpoint_type(desc);
dep->flags |= DWC3_EP_ENABLED;
- reg = dwc3_readl(dwc->regs, DWC3_DALEPENA);
+ reg = dwc3_readl(dwc, DWC3_DALEPENA);
reg |= DWC3_DALEPENA_EP(dep->number);
- dwc3_writel(dwc->regs, DWC3_DALEPENA, reg);
+ dwc3_writel(dwc, DWC3_DALEPENA, reg);
dep->trb_dequeue = 0;
dep->trb_enqueue = 0;
@@ -1080,9 +1080,9 @@ static int __dwc3_gadget_ep_disable(stru
if (dep->flags & DWC3_EP_STALL)
__dwc3_gadget_ep_set_halt(dep, 0, false);
- reg = dwc3_readl(dwc->regs, DWC3_DALEPENA);
+ reg = dwc3_readl(dwc, DWC3_DALEPENA);
reg &= ~DWC3_DALEPENA_EP(dep->number);
- dwc3_writel(dwc->regs, DWC3_DALEPENA, reg);
+ dwc3_writel(dwc, DWC3_DALEPENA, reg);
dwc3_remove_requests(dwc, dep, -ESHUTDOWN);
@@ -1743,7 +1743,7 @@ static int __dwc3_gadget_get_frame(struc
{
u32 reg;
- reg = dwc3_readl(dwc->regs, DWC3_DSTS);
+ reg = dwc3_readl(dwc, DWC3_DSTS);
return DWC3_DSTS_SOFFN(reg);
}
@@ -2351,13 +2351,13 @@ static void dwc3_gadget_enable_linksts_e
if (DWC3_VER_IS_PRIOR(DWC3, 250A))
return;
- reg = dwc3_readl(dwc->regs, DWC3_DEVTEN);
+ reg = dwc3_readl(dwc, DWC3_DEVTEN);
if (set)
reg |= DWC3_DEVTEN_ULSTCNGEN;
else
reg &= ~DWC3_DEVTEN_ULSTCNGEN;
- dwc3_writel(dwc->regs, DWC3_DEVTEN, reg);
+ dwc3_writel(dwc, DWC3_DEVTEN, reg);
}
static int dwc3_gadget_get_frame(struct usb_gadget *g)
@@ -2380,7 +2380,7 @@ static int __dwc3_gadget_wakeup(struct d
*
* We can check that via USB Link State bits in DSTS register.
*/
- reg = dwc3_readl(dwc->regs, DWC3_DSTS);
+ reg = dwc3_readl(dwc, DWC3_DSTS);
link_state = DWC3_DSTS_USBLNKST(reg);
@@ -2408,9 +2408,9 @@ static int __dwc3_gadget_wakeup(struct d
/* Recent versions do this automatically */
if (DWC3_VER_IS_PRIOR(DWC3, 194A)) {
/* write zeroes to Link Change Request */
- reg = dwc3_readl(dwc->regs, DWC3_DCTL);
+ reg = dwc3_readl(dwc, DWC3_DCTL);
reg &= ~DWC3_DCTL_ULSTCHNGREQ_MASK;
- dwc3_writel(dwc->regs, DWC3_DCTL, reg);
+ dwc3_writel(dwc, DWC3_DCTL, reg);
}
/*
@@ -2530,7 +2530,7 @@ static void __dwc3_gadget_set_ssp_rate(s
if (ssp_rate == USB_SSP_GEN_UNKNOWN)
ssp_rate = dwc->max_ssp_rate;
- reg = dwc3_readl(dwc->regs, DWC3_DCFG);
+ reg = dwc3_readl(dwc, DWC3_DCFG);
reg &= ~DWC3_DCFG_SPEED_MASK;
reg &= ~DWC3_DCFG_NUMLANES(~0);
@@ -2543,7 +2543,7 @@ static void __dwc3_gadget_set_ssp_rate(s
dwc->max_ssp_rate != USB_SSP_GEN_2x1)
reg |= DWC3_DCFG_NUMLANES(1);
- dwc3_writel(dwc->regs, DWC3_DCFG, reg);
+ dwc3_writel(dwc, DWC3_DCFG, reg);
}
static void __dwc3_gadget_set_speed(struct dwc3 *dwc)
@@ -2561,7 +2561,7 @@ static void __dwc3_gadget_set_speed(stru
return;
}
- reg = dwc3_readl(dwc->regs, DWC3_DCFG);
+ reg = dwc3_readl(dwc, DWC3_DCFG);
reg &= ~(DWC3_DCFG_SPEED_MASK);
/*
@@ -2612,7 +2612,7 @@ static void __dwc3_gadget_set_speed(stru
speed < USB_SPEED_SUPER_PLUS)
reg &= ~DWC3_DCFG_NUMLANES(~0);
- dwc3_writel(dwc->regs, DWC3_DCFG, reg);
+ dwc3_writel(dwc, DWC3_DCFG, reg);
}
static int dwc3_gadget_run_stop(struct dwc3 *dwc, int is_on)
@@ -2637,7 +2637,7 @@ static int dwc3_gadget_run_stop(struct d
* mentioned in the dwc3 programming guide. It has been tested on an
* Exynos platforms.
*/
- reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0));
+ reg = dwc3_readl(dwc, DWC3_GUSB2PHYCFG(0));
if (reg & DWC3_GUSB2PHYCFG_SUSPHY) {
saved_config |= DWC3_GUSB2PHYCFG_SUSPHY;
reg &= ~DWC3_GUSB2PHYCFG_SUSPHY;
@@ -2649,9 +2649,9 @@ static int dwc3_gadget_run_stop(struct d
}
if (saved_config)
- dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), reg);
+ dwc3_writel(dwc, DWC3_GUSB2PHYCFG(0), reg);
- reg = dwc3_readl(dwc->regs, DWC3_DCTL);
+ reg = dwc3_readl(dwc, DWC3_DCTL);
if (is_on) {
if (DWC3_VER_IS_WITHIN(DWC3, ANY, 187A)) {
reg &= ~DWC3_DCTL_TRGTULST_MASK;
@@ -2675,14 +2675,14 @@ static int dwc3_gadget_run_stop(struct d
do {
usleep_range(1000, 2000);
- reg = dwc3_readl(dwc->regs, DWC3_DSTS);
+ reg = dwc3_readl(dwc, DWC3_DSTS);
reg &= DWC3_DSTS_DEVCTRLHLT;
} while (--timeout && !(!is_on ^ !reg));
if (saved_config) {
- reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0));
+ reg = dwc3_readl(dwc, DWC3_GUSB2PHYCFG(0));
reg |= saved_config;
- dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), reg);
+ dwc3_writel(dwc, DWC3_GUSB2PHYCFG(0), reg);
}
if (!timeout)
@@ -2858,13 +2858,13 @@ static void dwc3_gadget_enable_irq(struc
if (!DWC3_VER_IS_PRIOR(DWC3, 230A))
reg |= DWC3_DEVTEN_U3L2L1SUSPEN;
- dwc3_writel(dwc->regs, DWC3_DEVTEN, reg);
+ dwc3_writel(dwc, DWC3_DEVTEN, reg);
}
static void dwc3_gadget_disable_irq(struct dwc3 *dwc)
{
/* mask all interrupts */
- dwc3_writel(dwc->regs, DWC3_DEVTEN, 0x00);
+ dwc3_writel(dwc, DWC3_DEVTEN, 0x00);
}
static irqreturn_t dwc3_interrupt(int irq, void *_dwc);
@@ -2905,10 +2905,10 @@ static void dwc3_gadget_setup_nump(struc
nump = min_t(u32, nump, 16);
/* update NumP */
- reg = dwc3_readl(dwc->regs, DWC3_DCFG);
+ reg = dwc3_readl(dwc, DWC3_DCFG);
reg &= ~DWC3_DCFG_NUMP_MASK;
reg |= nump << DWC3_DCFG_NUMP_SHIFT;
- dwc3_writel(dwc->regs, DWC3_DCFG, reg);
+ dwc3_writel(dwc, DWC3_DCFG, reg);
}
static int __dwc3_gadget_start(struct dwc3 *dwc)
@@ -2922,10 +2922,10 @@ static int __dwc3_gadget_start(struct dw
* the core supports IMOD, disable it.
*/
if (dwc->imod_interval) {
- dwc3_writel(dwc->regs, DWC3_DEV_IMOD(0), dwc->imod_interval);
- dwc3_writel(dwc->regs, DWC3_GEVNTCOUNT(0), DWC3_GEVNTCOUNT_EHB);
+ dwc3_writel(dwc, DWC3_DEV_IMOD(0), dwc->imod_interval);
+ dwc3_writel(dwc, DWC3_GEVNTCOUNT(0), DWC3_GEVNTCOUNT_EHB);
} else if (dwc3_has_imod(dwc)) {
- dwc3_writel(dwc->regs, DWC3_DEV_IMOD(0), 0);
+ dwc3_writel(dwc, DWC3_DEV_IMOD(0), 0);
}
/*
@@ -2935,13 +2935,13 @@ static int __dwc3_gadget_start(struct dw
* This way, we maximize the chances that we'll be able to get several
* bursts of data without going through any sort of endpoint throttling.
*/
- reg = dwc3_readl(dwc->regs, DWC3_GRXTHRCFG);
+ reg = dwc3_readl(dwc, DWC3_GRXTHRCFG);
if (DWC3_IP_IS(DWC3))
reg &= ~DWC3_GRXTHRCFG_PKTCNTSEL;
else
reg &= ~DWC31_GRXTHRCFG_PKTCNTSEL;
- dwc3_writel(dwc->regs, DWC3_GRXTHRCFG, reg);
+ dwc3_writel(dwc, DWC3_GRXTHRCFG, reg);
dwc3_gadget_setup_nump(dwc);
@@ -2952,15 +2952,15 @@ static int __dwc3_gadget_start(struct dw
* ACK with NumP=0 and PP=0 (for IN direction). This slightly improves
* the stream performance.
*/
- reg = dwc3_readl(dwc->regs, DWC3_DCFG);
+ reg = dwc3_readl(dwc, DWC3_DCFG);
reg |= DWC3_DCFG_IGNSTRMPP;
- dwc3_writel(dwc->regs, DWC3_DCFG, reg);
+ dwc3_writel(dwc, DWC3_DCFG, reg);
/* Enable MST by default if the device is capable of MST */
if (DWC3_MST_CAPABLE(&dwc->hwparams)) {
- reg = dwc3_readl(dwc->regs, DWC3_DCFG1);
+ reg = dwc3_readl(dwc, DWC3_DCFG1);
reg &= ~DWC3_DCFG1_DIS_MST_ENH;
- dwc3_writel(dwc->regs, DWC3_DCFG1, reg);
+ dwc3_writel(dwc, DWC3_DCFG1, reg);
}
/* Start with SuperSpeed Default */
@@ -3238,7 +3238,7 @@ static int dwc3_gadget_init_in_endpoint(
/* MDWIDTH is represented in bits, we need it in bytes */
mdwidth /= 8;
- size = dwc3_readl(dwc->regs, DWC3_GTXFIFOSIZ(dep->number >> 1));
+ size = dwc3_readl(dwc, DWC3_GTXFIFOSIZ(dep->number >> 1));
if (DWC3_IP_IS(DWC3))
size = DWC3_GTXFIFOSIZ_TXFDEP(size);
else
@@ -3287,7 +3287,7 @@ static int dwc3_gadget_init_out_endpoint
mdwidth /= 8;
/* All OUT endpoints share a single RxFIFO space */
- size = dwc3_readl(dwc->regs, DWC3_GRXFIFOSIZ(0));
+ size = dwc3_readl(dwc, DWC3_GRXFIFOSIZ(0));
if (DWC3_IP_IS(DWC3))
size = DWC3_GRXFIFOSIZ_RXFDEP(size);
else
@@ -3740,9 +3740,9 @@ out:
return no_started_trb;
}
- reg = dwc3_readl(dwc->regs, DWC3_DCTL);
+ reg = dwc3_readl(dwc, DWC3_DCTL);
reg |= dwc->u1u2;
- dwc3_writel(dwc->regs, DWC3_DCTL, reg);
+ dwc3_writel(dwc, DWC3_DCTL, reg);
dwc->u1u2 = 0;
}
@@ -4072,7 +4072,7 @@ static void dwc3_gadget_disconnect_inter
dwc3_gadget_set_link_state(dwc, DWC3_LINK_STATE_RX_DET);
- reg = dwc3_readl(dwc->regs, DWC3_DCTL);
+ reg = dwc3_readl(dwc, DWC3_DCTL);
reg &= ~DWC3_DCTL_INITU1ENA;
reg &= ~DWC3_DCTL_INITU2ENA;
dwc3_gadget_dctl_write_safe(dwc, reg);
@@ -4161,7 +4161,7 @@ static void dwc3_gadget_reset_interrupt(
dwc3_stop_active_transfers(dwc);
dwc->connected = true;
- reg = dwc3_readl(dwc->regs, DWC3_DCTL);
+ reg = dwc3_readl(dwc, DWC3_DCTL);
reg &= ~DWC3_DCTL_TSTCTRL_MASK;
dwc3_gadget_dctl_write_safe(dwc, reg);
dwc->test_mode = false;
@@ -4170,9 +4170,9 @@ static void dwc3_gadget_reset_interrupt(
dwc3_clear_stall_all_ep(dwc);
/* Reset device address to zero */
- reg = dwc3_readl(dwc->regs, DWC3_DCFG);
+ reg = dwc3_readl(dwc, DWC3_DCFG);
reg &= ~(DWC3_DCFG_DEVADDR_MASK);
- dwc3_writel(dwc->regs, DWC3_DCFG, reg);
+ dwc3_writel(dwc, DWC3_DCFG, reg);
}
static void dwc3_gadget_conndone_interrupt(struct dwc3 *dwc)
@@ -4186,7 +4186,7 @@ static void dwc3_gadget_conndone_interru
if (!dwc->softconnect)
return;
- reg = dwc3_readl(dwc->regs, DWC3_DSTS);
+ reg = dwc3_readl(dwc, DWC3_DSTS);
speed = reg & DWC3_DSTS_CONNECTSPD;
dwc->speed = speed;
@@ -4261,11 +4261,11 @@ static void dwc3_gadget_conndone_interru
!dwc->usb2_gadget_lpm_disable &&
(speed != DWC3_DSTS_SUPERSPEED) &&
(speed != DWC3_DSTS_SUPERSPEED_PLUS)) {
- reg = dwc3_readl(dwc->regs, DWC3_DCFG);
+ reg = dwc3_readl(dwc, DWC3_DCFG);
reg |= DWC3_DCFG_LPM_CAP;
- dwc3_writel(dwc->regs, DWC3_DCFG, reg);
+ dwc3_writel(dwc, DWC3_DCFG, reg);
- reg = dwc3_readl(dwc->regs, DWC3_DCTL);
+ reg = dwc3_readl(dwc, DWC3_DCTL);
reg &= ~(DWC3_DCTL_HIRD_THRES_MASK | DWC3_DCTL_L1_HIBER_EN);
reg |= DWC3_DCTL_HIRD_THRES(dwc->hird_threshold |
@@ -4288,12 +4288,12 @@ static void dwc3_gadget_conndone_interru
dwc3_gadget_dctl_write_safe(dwc, reg);
} else {
if (dwc->usb2_gadget_lpm_disable) {
- reg = dwc3_readl(dwc->regs, DWC3_DCFG);
+ reg = dwc3_readl(dwc, DWC3_DCFG);
reg &= ~DWC3_DCFG_LPM_CAP;
- dwc3_writel(dwc->regs, DWC3_DCFG, reg);
+ dwc3_writel(dwc, DWC3_DCFG, reg);
}
- reg = dwc3_readl(dwc->regs, DWC3_DCTL);
+ reg = dwc3_readl(dwc, DWC3_DCTL);
reg &= ~DWC3_DCTL_HIRD_THRES_MASK;
dwc3_gadget_dctl_write_safe(dwc, reg);
}
@@ -4399,7 +4399,7 @@ static void dwc3_gadget_linksts_change_i
switch (dwc->link_state) {
case DWC3_LINK_STATE_U1:
case DWC3_LINK_STATE_U2:
- reg = dwc3_readl(dwc->regs, DWC3_DCTL);
+ reg = dwc3_readl(dwc, DWC3_DCTL);
u1u2 = reg & (DWC3_DCTL_INITU2ENA
| DWC3_DCTL_ACCEPTU2ENA
| DWC3_DCTL_INITU1ENA
@@ -4556,7 +4556,7 @@ static irqreturn_t dwc3_process_event_bu
ret = IRQ_HANDLED;
/* Unmask interrupt */
- dwc3_writel(dwc->regs, DWC3_GEVNTSIZ(0),
+ dwc3_writel(dwc, DWC3_GEVNTSIZ(0),
DWC3_GEVNTSIZ_SIZE(evt->length));
evt->flags &= ~DWC3_EVENT_PENDING;
@@ -4567,8 +4567,8 @@ static irqreturn_t dwc3_process_event_bu
wmb();
if (dwc->imod_interval) {
- dwc3_writel(dwc->regs, DWC3_GEVNTCOUNT(0), DWC3_GEVNTCOUNT_EHB);
- dwc3_writel(dwc->regs, DWC3_DEV_IMOD(0), dwc->imod_interval);
+ dwc3_writel(dwc, DWC3_GEVNTCOUNT(0), DWC3_GEVNTCOUNT_EHB);
+ dwc3_writel(dwc, DWC3_DEV_IMOD(0), dwc->imod_interval);
}
return ret;
@@ -4617,7 +4617,7 @@ static irqreturn_t dwc3_check_event_buf(
if (evt->flags & DWC3_EVENT_PENDING)
return IRQ_HANDLED;
- count = dwc3_readl(dwc->regs, DWC3_GEVNTCOUNT(0));
+ count = dwc3_readl(dwc, DWC3_GEVNTCOUNT(0));
count &= DWC3_GEVNTCOUNT_MASK;
if (!count)
return IRQ_NONE;
@@ -4632,7 +4632,7 @@ static irqreturn_t dwc3_check_event_buf(
evt->flags |= DWC3_EVENT_PENDING;
/* Mask interrupt */
- dwc3_writel(dwc->regs, DWC3_GEVNTSIZ(0),
+ dwc3_writel(dwc, DWC3_GEVNTSIZ(0),
DWC3_GEVNTSIZ_INTMASK | DWC3_GEVNTSIZ_SIZE(evt->length));
amount = min(count, evt->length - evt->lpos);
@@ -4641,7 +4641,7 @@ static irqreturn_t dwc3_check_event_buf(
if (amount < count)
memcpy(evt->cache, evt->buf, count - amount);
- dwc3_writel(dwc->regs, DWC3_GEVNTCOUNT(0), count);
+ dwc3_writel(dwc, DWC3_GEVNTCOUNT(0), count);
return IRQ_WAKE_THREAD;
}
--- a/drivers/usb/dwc3/gadget.h
+++ b/drivers/usb/dwc3/gadget.h
@@ -132,7 +132,7 @@ static inline void dwc3_gadget_ep_get_tr
{
u32 res_id;
- res_id = dwc3_readl(dep->dwc->regs, DWC3_DEPCMD(dep->number));
+ res_id = dwc3_readl(dep->dwc, DWC3_DEPCMD(dep->number));
dep->resource_index = DWC3_DEPCMD_GET_RSC_IDX(res_id);
}
@@ -147,7 +147,7 @@ static inline void dwc3_gadget_ep_get_tr
static inline void dwc3_gadget_dctl_write_safe(struct dwc3 *dwc, u32 value)
{
value &= ~DWC3_DCTL_ULSTCHNGREQ_MASK;
- dwc3_writel(dwc->regs, DWC3_DCTL, value);
+ dwc3_writel(dwc, DWC3_DCTL, value);
}
#endif /* __DRIVERS_USB_DWC3_GADGET_H */
--- a/drivers/usb/dwc3/io.h
+++ b/drivers/usb/dwc3/io.h
@@ -16,9 +16,10 @@
#include "debug.h"
#include "core.h"
-static inline u32 dwc3_readl(void __iomem *base, u32 offset)
+static inline u32 dwc3_readl(struct dwc3 *dwc, u32 offset)
{
u32 value;
+ void __iomem *base = dwc->regs;
/*
* We requested the mem region starting from the Globals address
@@ -37,8 +38,10 @@ static inline u32 dwc3_readl(void __iome
return value;
}
-static inline void dwc3_writel(void __iomem *base, u32 offset, u32 value)
+static inline void dwc3_writel(struct dwc3 *dwc, u32 offset, u32 value)
{
+ void __iomem *base = dwc->regs;
+
/*
* We requested the mem region starting from the Globals address
* space, see dwc3_probe in core.c.
--- a/drivers/usb/dwc3/ulpi.c
+++ b/drivers/usb/dwc3/ulpi.c
@@ -33,13 +33,13 @@ static int dwc3_ulpi_busyloop(struct dwc
if (read)
ns += DWC3_ULPI_BASE_DELAY;
- reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0));
+ reg = dwc3_readl(dwc, DWC3_GUSB2PHYCFG(0));
if (reg & DWC3_GUSB2PHYCFG_SUSPHY)
usleep_range(1000, 1200);
while (count--) {
ndelay(ns);
- reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYACC(0));
+ reg = dwc3_readl(dwc, DWC3_GUSB2PHYACC(0));
if (reg & DWC3_GUSB2PHYACC_DONE)
return 0;
cpu_relax();
@@ -55,13 +55,13 @@ static int dwc3_ulpi_read(struct device
int ret;
reg = DWC3_GUSB2PHYACC_NEWREGREQ | DWC3_ULPI_ADDR(addr);
- dwc3_writel(dwc->regs, DWC3_GUSB2PHYACC(0), reg);
+ dwc3_writel(dwc, DWC3_GUSB2PHYACC(0), reg);
ret = dwc3_ulpi_busyloop(dwc, addr, true);
if (ret)
return ret;
- reg = dwc3_readl(dwc->regs, DWC3_GUSB2PHYACC(0));
+ reg = dwc3_readl(dwc, DWC3_GUSB2PHYACC(0));
return DWC3_GUSB2PHYACC_DATA(reg);
}
@@ -73,7 +73,7 @@ static int dwc3_ulpi_write(struct device
reg = DWC3_GUSB2PHYACC_NEWREGREQ | DWC3_ULPI_ADDR(addr);
reg |= DWC3_GUSB2PHYACC_WRITE | val;
- dwc3_writel(dwc->regs, DWC3_GUSB2PHYACC(0), reg);
+ dwc3_writel(dwc, DWC3_GUSB2PHYACC(0), reg);
return dwc3_ulpi_busyloop(dwc, addr, false);
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 173/188] usb: dwc3: Move GUID programming after PHY initialization
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (171 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 172/188] usb: dwc3: Add dwc pointer to dwc3_readl/writel Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 174/188] btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type() Greg Kroah-Hartman
` (19 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Pritam Manohar Sutar,
Selvarasu Ganesan, Thinh Nguyen, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Selvarasu Ganesan <selvarasu.g@samsung.com>
[ Upstream commit aad35f9c926ec220b0742af1ada45666ae667956 ]
The Linux Version Code is currently written to the GUID register before
PHY initialization. Certain PHY implementations (such as Synopsys eUSB
PHY performing link_sw_reset) clear the GUID register to its default
value during initialization, causing the kernel version information to
be lost.
Move the GUID register programming to occur after PHY initialization
completes to ensure the Linux version information persists.
Fixes: fa0ea13e9f1c ("usb: dwc3: core: write LINUX_VERSION_CODE to our GUID register")
Cc: stable <stable@kernel.org>
Reported-by: Pritam Manohar Sutar <pritam.sutar@samsung.com>
Signed-off-by: Selvarasu Ganesan <selvarasu.g@samsung.com>
Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://patch.msgid.link/20260417063314.2359-1-selvarasu.g@samsung.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc3/core.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -1339,12 +1339,6 @@ static int dwc3_core_init(struct dwc3 *d
hw_mode = DWC3_GHWPARAMS0_MODE(dwc->hwparams.hwparams0);
- /*
- * Write Linux Version Code to our GUID register so it's easy to figure
- * out which kernel version a bug was found.
- */
- dwc3_writel(dwc, DWC3_GUID, LINUX_VERSION_CODE);
-
ret = dwc3_phy_setup(dwc);
if (ret)
return ret;
@@ -1376,6 +1370,12 @@ static int dwc3_core_init(struct dwc3 *d
if (ret)
goto err_exit_phy;
+ /*
+ * Write Linux Version Code to our GUID register so it's easy to figure
+ * out which kernel version a bug was found.
+ */
+ dwc3_writel(dwc, DWC3_GUID, LINUX_VERSION_CODE);
+
dwc3_core_setup_global_control(dwc);
dwc3_core_num_eps(dwc);
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 174/188] btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type()
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (172 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 173/188] usb: dwc3: Move GUID programming after PHY initialization Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 175/188] btrfs: fix double free in create_space_info_sub_group() error path Greg Kroah-Hartman
` (18 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johannes Thumshirn, Filipe Manana,
David Sterba, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <fdmanana@suse.com>
[ Upstream commit 771af6ff72e0ed0eb8bf97e5ae4fa5094e0c5d1d ]
We don't need it since we can grab fs_info from the given space_info.
So remove the fs_info argument.
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Stable-dep-of: a7449edf9614 ("btrfs: fix double free in create_space_info_sub_group() error path")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/space-info.c | 4 ++--
fs/btrfs/sysfs.c | 5 ++---
fs/btrfs/sysfs.h | 3 +--
3 files changed, 5 insertions(+), 7 deletions(-)
--- a/fs/btrfs/space-info.c
+++ b/fs/btrfs/space-info.c
@@ -275,7 +275,7 @@ static int create_space_info_sub_group(s
sub_group->parent = parent;
sub_group->subgroup_id = id;
- ret = btrfs_sysfs_add_space_info_type(fs_info, sub_group);
+ ret = btrfs_sysfs_add_space_info_type(sub_group);
if (ret) {
kfree(sub_group);
parent->sub_group[index] = NULL;
@@ -309,7 +309,7 @@ static int create_space_info(struct btrf
goto out_free;
}
- ret = btrfs_sysfs_add_space_info_type(info, space_info);
+ ret = btrfs_sysfs_add_space_info_type(space_info);
if (ret)
return ret;
--- a/fs/btrfs/sysfs.c
+++ b/fs/btrfs/sysfs.c
@@ -1981,13 +1981,12 @@ static const char *alloc_name(struct btr
* Create a sysfs entry for a space info type at path
* /sys/fs/btrfs/UUID/allocation/TYPE
*/
-int btrfs_sysfs_add_space_info_type(struct btrfs_fs_info *fs_info,
- struct btrfs_space_info *space_info)
+int btrfs_sysfs_add_space_info_type(struct btrfs_space_info *space_info)
{
int ret;
ret = kobject_init_and_add(&space_info->kobj, &space_info_ktype,
- fs_info->space_info_kobj, "%s",
+ space_info->fs_info->space_info_kobj, "%s",
alloc_name(space_info));
if (ret) {
kobject_put(&space_info->kobj);
--- a/fs/btrfs/sysfs.h
+++ b/fs/btrfs/sysfs.h
@@ -37,8 +37,7 @@ void __cold btrfs_exit_sysfs(void);
int btrfs_sysfs_add_mounted(struct btrfs_fs_info *fs_info);
void btrfs_sysfs_remove_mounted(struct btrfs_fs_info *fs_info);
void btrfs_sysfs_add_block_group_type(struct btrfs_block_group *cache);
-int btrfs_sysfs_add_space_info_type(struct btrfs_fs_info *fs_info,
- struct btrfs_space_info *space_info);
+int btrfs_sysfs_add_space_info_type(struct btrfs_space_info *space_info);
void btrfs_sysfs_remove_space_info(struct btrfs_space_info *space_info);
void btrfs_sysfs_update_devid(struct btrfs_device *device);
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 175/188] btrfs: fix double free in create_space_info_sub_group() error path
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (173 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 174/188] btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type() Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 176/188] btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak Greg Kroah-Hartman
` (17 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qu Wenruo, Guangshuo Li,
David Sterba, Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
[ Upstream commit a7449edf96143f192606ec8647e3167e1ecbd728 ]
When kobject_init_and_add() fails, the call chain is:
create_space_info_sub_group()
-> btrfs_sysfs_add_space_info_type()
-> kobject_init_and_add()
-> failure
-> kobject_put(&sub_group->kobj)
-> space_info_release()
-> kfree(sub_group)
Then control returns to create_space_info_sub_group(), where:
btrfs_sysfs_add_space_info_type() returns error
-> kfree(sub_group)
Thus, sub_group is freed twice.
Keep parent->sub_group[index] = NULL for the failure path, but after
btrfs_sysfs_add_space_info_type() has called kobject_put(), let the
kobject release callback handle the cleanup.
Fixes: f92ee31e031c ("btrfs: introduce btrfs_space_info sub-group")
CC: stable@vger.kernel.org # 6.18+
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/space-info.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/fs/btrfs/space-info.c
+++ b/fs/btrfs/space-info.c
@@ -276,10 +276,8 @@ static int create_space_info_sub_group(s
sub_group->subgroup_id = id;
ret = btrfs_sysfs_add_space_info_type(sub_group);
- if (ret) {
- kfree(sub_group);
+ if (ret)
parent->sub_group[index] = NULL;
- }
return ret;
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 176/188] btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (174 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 175/188] btrfs: fix double free in create_space_info_sub_group() error path Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 177/188] tracing: fprobe: use rhltable for fprobe_ip_table Greg Kroah-Hartman
` (16 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yochai Eisenrich, David Sterba,
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yochai Eisenrich <yochaie@sweet.security>
[ Upstream commit 973e57c726c1f8e77259d1c8e519519f1e9aea77 ]
btrfs_ioctl_space_info() has a TOCTOU race between two passes over the
block group RAID type lists. The first pass counts entries to determine
the allocation size, then the second pass fills the buffer. The
groups_sem rwlock is released between passes, allowing concurrent block
group removal to reduce the entry count.
When the second pass fills fewer entries than the first pass counted,
copy_to_user() copies the full alloc_size bytes including trailing
uninitialized kmalloc bytes to userspace.
Fix by copying only total_spaces entries (the actually-filled count from
the second pass) instead of alloc_size bytes, and switch to kzalloc so
any future copy size mismatch cannot leak heap data.
Fixes: 7fde62bffb57 ("Btrfs: buffer results in the space_info ioctl")
CC: stable@vger.kernel.org # 3.0
Signed-off-by: Yochai Eisenrich <echelonh@gmail.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
[ adapted upstream's `return -EFAULT;` to stable's `ret = -EFAULT;` fall-through to existing `out:` cleanup label ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/ioctl.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -3025,7 +3025,7 @@ static long btrfs_ioctl_space_info(struc
return -ENOMEM;
space_args.total_spaces = 0;
- dest = kmalloc(alloc_size, GFP_KERNEL);
+ dest = kzalloc(alloc_size, GFP_KERNEL);
if (!dest)
return -ENOMEM;
dest_orig = dest;
@@ -3081,7 +3081,8 @@ static long btrfs_ioctl_space_info(struc
user_dest = (struct btrfs_ioctl_space_info __user *)
(arg + sizeof(struct btrfs_ioctl_space_args));
- if (copy_to_user(user_dest, dest_orig, alloc_size))
+ if (copy_to_user(user_dest, dest_orig,
+ space_args.total_spaces * sizeof(*dest_orig)))
ret = -EFAULT;
kfree(dest_orig);
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 177/188] tracing: fprobe: use rhltable for fprobe_ip_table
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (175 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 176/188] btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 178/188] tracing: fprobe: optimization for entry only case Greg Kroah-Hartman
` (15 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Menglong Dong,
Masami Hiramatsu (Google), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Menglong Dong <menglong8.dong@gmail.com>
[ Upstream commit 0de4c70d04a46a3c266547dd4275ce25f623796a ]
For now, all the kernel functions who are hooked by the fprobe will be
added to the hash table "fprobe_ip_table". The key of it is the function
address, and the value of it is "struct fprobe_hlist_node".
The budget of the hash table is FPROBE_IP_TABLE_SIZE, which is 256. And
this means the overhead of the hash table lookup will grow linearly if
the count of the functions in the fprobe more than 256. When we try to
hook all the kernel functions, the overhead will be huge.
Therefore, replace the hash table with rhltable to reduce the overhead.
Link: https://lore.kernel.org/all/20250819031825.55653-1-dongml2@chinatelecom.cn/
Signed-off-by: Menglong Dong <dongml2@chinatelecom.cn>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Stable-dep-of: 845947aca681 ("tracing/fprobe: Remove fprobe from hash in failure path")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/fprobe.h | 3
kernel/trace/fprobe.c | 157 ++++++++++++++++++++++++++++---------------------
2 files changed, 93 insertions(+), 67 deletions(-)
--- a/include/linux/fprobe.h
+++ b/include/linux/fprobe.h
@@ -7,6 +7,7 @@
#include <linux/ftrace.h>
#include <linux/rcupdate.h>
#include <linux/refcount.h>
+#include <linux/rhashtable.h>
#include <linux/slab.h>
struct fprobe;
@@ -26,7 +27,7 @@ typedef void (*fprobe_exit_cb)(struct fp
* @fp: The fprobe which owns this.
*/
struct fprobe_hlist_node {
- struct hlist_node hlist;
+ struct rhlist_head hlist;
unsigned long addr;
struct fprobe *fp;
};
--- a/kernel/trace/fprobe.c
+++ b/kernel/trace/fprobe.c
@@ -11,6 +11,7 @@
#include <linux/kprobes.h>
#include <linux/list.h>
#include <linux/mutex.h>
+#include <linux/rhashtable.h>
#include <linux/slab.h>
#include <linux/sort.h>
@@ -42,60 +43,67 @@
* - RCU hlist traversal under disabling preempt
*/
static struct hlist_head fprobe_table[FPROBE_TABLE_SIZE];
-static struct hlist_head fprobe_ip_table[FPROBE_IP_TABLE_SIZE];
+static struct rhltable fprobe_ip_table;
static DEFINE_MUTEX(fprobe_mutex);
-/*
- * Find first fprobe in the hlist. It will be iterated twice in the entry
- * probe, once for correcting the total required size, the second time is
- * calling back the user handlers.
- * Thus the hlist in the fprobe_table must be sorted and new probe needs to
- * be added *before* the first fprobe.
- */
-static struct fprobe_hlist_node *find_first_fprobe_node(unsigned long ip)
+static u32 fprobe_node_hashfn(const void *data, u32 len, u32 seed)
{
- struct fprobe_hlist_node *node;
- struct hlist_head *head;
+ return hash_ptr(*(unsigned long **)data, 32);
+}
- head = &fprobe_ip_table[hash_ptr((void *)ip, FPROBE_IP_HASH_BITS)];
- hlist_for_each_entry_rcu(node, head, hlist,
- lockdep_is_held(&fprobe_mutex)) {
- if (node->addr == ip)
- return node;
- }
- return NULL;
+static int fprobe_node_cmp(struct rhashtable_compare_arg *arg,
+ const void *ptr)
+{
+ unsigned long key = *(unsigned long *)arg->key;
+ const struct fprobe_hlist_node *n = ptr;
+
+ return n->addr != key;
}
-NOKPROBE_SYMBOL(find_first_fprobe_node);
-/* Node insertion and deletion requires the fprobe_mutex */
-static void insert_fprobe_node(struct fprobe_hlist_node *node)
+static u32 fprobe_node_obj_hashfn(const void *data, u32 len, u32 seed)
{
- unsigned long ip = node->addr;
- struct fprobe_hlist_node *next;
- struct hlist_head *head;
+ const struct fprobe_hlist_node *n = data;
+
+ return hash_ptr((void *)n->addr, 32);
+}
+
+static const struct rhashtable_params fprobe_rht_params = {
+ .head_offset = offsetof(struct fprobe_hlist_node, hlist),
+ .key_offset = offsetof(struct fprobe_hlist_node, addr),
+ .key_len = sizeof_field(struct fprobe_hlist_node, addr),
+ .hashfn = fprobe_node_hashfn,
+ .obj_hashfn = fprobe_node_obj_hashfn,
+ .obj_cmpfn = fprobe_node_cmp,
+ .automatic_shrinking = true,
+};
+/* Node insertion and deletion requires the fprobe_mutex */
+static int insert_fprobe_node(struct fprobe_hlist_node *node)
+{
lockdep_assert_held(&fprobe_mutex);
- next = find_first_fprobe_node(ip);
- if (next) {
- hlist_add_before_rcu(&node->hlist, &next->hlist);
- return;
- }
- head = &fprobe_ip_table[hash_ptr((void *)ip, FPROBE_IP_HASH_BITS)];
- hlist_add_head_rcu(&node->hlist, head);
+ return rhltable_insert(&fprobe_ip_table, &node->hlist, fprobe_rht_params);
}
/* Return true if there are synonims */
static bool delete_fprobe_node(struct fprobe_hlist_node *node)
{
lockdep_assert_held(&fprobe_mutex);
+ bool ret;
/* Avoid double deleting */
if (READ_ONCE(node->fp) != NULL) {
WRITE_ONCE(node->fp, NULL);
- hlist_del_rcu(&node->hlist);
+ rhltable_remove(&fprobe_ip_table, &node->hlist,
+ fprobe_rht_params);
}
- return !!find_first_fprobe_node(node->addr);
+
+ rcu_read_lock();
+ ret = !!rhltable_lookup(&fprobe_ip_table, &node->addr,
+ fprobe_rht_params);
+ rcu_read_unlock();
+
+ return ret;
}
/* Check existence of the fprobe */
@@ -247,9 +255,10 @@ static inline int __fprobe_kprobe_handle
static int fprobe_entry(struct ftrace_graph_ent *trace, struct fgraph_ops *gops,
struct ftrace_regs *fregs)
{
- struct fprobe_hlist_node *node, *first;
unsigned long *fgraph_data = NULL;
unsigned long func = trace->func;
+ struct fprobe_hlist_node *node;
+ struct rhlist_head *head, *pos;
unsigned long ret_ip;
int reserved_words;
struct fprobe *fp;
@@ -258,14 +267,11 @@ static int fprobe_entry(struct ftrace_gr
if (WARN_ON_ONCE(!fregs))
return 0;
- first = node = find_first_fprobe_node(func);
- if (unlikely(!first))
- return 0;
-
+ head = rhltable_lookup(&fprobe_ip_table, &func, fprobe_rht_params);
reserved_words = 0;
- hlist_for_each_entry_from_rcu(node, hlist) {
+ rhl_for_each_entry_rcu(node, pos, head, hlist) {
if (node->addr != func)
- break;
+ continue;
fp = READ_ONCE(node->fp);
if (!fp || !fp->exit_handler)
continue;
@@ -276,13 +282,12 @@ static int fprobe_entry(struct ftrace_gr
reserved_words +=
FPROBE_HEADER_SIZE_IN_LONG + SIZE_IN_LONG(fp->entry_data_size);
}
- node = first;
if (reserved_words) {
fgraph_data = fgraph_reserve_data(gops->idx, reserved_words * sizeof(long));
if (unlikely(!fgraph_data)) {
- hlist_for_each_entry_from_rcu(node, hlist) {
+ rhl_for_each_entry_rcu(node, pos, head, hlist) {
if (node->addr != func)
- break;
+ continue;
fp = READ_ONCE(node->fp);
if (fp && !fprobe_disabled(fp))
fp->nmissed++;
@@ -297,12 +302,12 @@ static int fprobe_entry(struct ftrace_gr
*/
ret_ip = ftrace_regs_get_return_address(fregs);
used = 0;
- hlist_for_each_entry_from_rcu(node, hlist) {
+ rhl_for_each_entry_rcu(node, pos, head, hlist) {
int data_size;
void *data;
if (node->addr != func)
- break;
+ continue;
fp = READ_ONCE(node->fp);
if (!fp || fprobe_disabled(fp))
continue;
@@ -447,25 +452,21 @@ static int fprobe_addr_list_add(struct f
return 0;
}
-static void fprobe_remove_node_in_module(struct module *mod, struct hlist_head *head,
- struct fprobe_addr_list *alist)
+static void fprobe_remove_node_in_module(struct module *mod, struct fprobe_hlist_node *node,
+ struct fprobe_addr_list *alist)
{
- struct fprobe_hlist_node *node;
int ret = 0;
- hlist_for_each_entry_rcu(node, head, hlist,
- lockdep_is_held(&fprobe_mutex)) {
- if (!within_module(node->addr, mod))
- continue;
- if (delete_fprobe_node(node))
- continue;
- /*
- * If failed to update alist, just continue to update hlist.
- * Therefore, at list user handler will not hit anymore.
- */
- if (!ret)
- ret = fprobe_addr_list_add(alist, node->addr);
- }
+ if (!within_module(node->addr, mod))
+ return;
+ if (delete_fprobe_node(node))
+ return;
+ /*
+ * If failed to update alist, just continue to update hlist.
+ * Therefore, at list user handler will not hit anymore.
+ */
+ if (!ret)
+ ret = fprobe_addr_list_add(alist, node->addr);
}
/* Handle module unloading to manage fprobe_ip_table. */
@@ -473,8 +474,9 @@ static int fprobe_module_callback(struct
unsigned long val, void *data)
{
struct fprobe_addr_list alist = {.size = FPROBE_IPS_BATCH_INIT};
+ struct fprobe_hlist_node *node;
+ struct rhashtable_iter iter;
struct module *mod = data;
- int i;
if (val != MODULE_STATE_GOING)
return NOTIFY_DONE;
@@ -485,8 +487,16 @@ static int fprobe_module_callback(struct
return NOTIFY_DONE;
mutex_lock(&fprobe_mutex);
- for (i = 0; i < FPROBE_IP_TABLE_SIZE; i++)
- fprobe_remove_node_in_module(mod, &fprobe_ip_table[i], &alist);
+ rhltable_walk_enter(&fprobe_ip_table, &iter);
+ do {
+ rhashtable_walk_start(&iter);
+
+ while ((node = rhashtable_walk_next(&iter)) && !IS_ERR(node))
+ fprobe_remove_node_in_module(mod, node, &alist);
+
+ rhashtable_walk_stop(&iter);
+ } while (node == ERR_PTR(-EAGAIN));
+ rhashtable_walk_exit(&iter);
if (alist.index > 0)
ftrace_set_filter_ips(&fprobe_graph_ops.ops,
@@ -728,8 +738,16 @@ int register_fprobe_ips(struct fprobe *f
ret = fprobe_graph_add_ips(addrs, num);
if (!ret) {
add_fprobe_hash(fp);
- for (i = 0; i < hlist_array->size; i++)
- insert_fprobe_node(&hlist_array->array[i]);
+ for (i = 0; i < hlist_array->size; i++) {
+ ret = insert_fprobe_node(&hlist_array->array[i]);
+ if (ret)
+ break;
+ }
+ /* fallback on insert error */
+ if (ret) {
+ for (i--; i >= 0; i--)
+ delete_fprobe_node(&hlist_array->array[i]);
+ }
}
if (ret)
@@ -824,3 +842,10 @@ out:
return ret;
}
EXPORT_SYMBOL_GPL(unregister_fprobe);
+
+static int __init fprobe_initcall(void)
+{
+ rhltable_init(&fprobe_ip_table, &fprobe_rht_params);
+ return 0;
+}
+late_initcall(fprobe_initcall);
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 178/188] tracing: fprobe: optimization for entry only case
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (176 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 177/188] tracing: fprobe: use rhltable for fprobe_ip_table Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 179/188] tracing/fprobe: Unregister fprobe even if memory allocation fails Greg Kroah-Hartman
` (14 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Menglong Dong,
Masami Hiramatsu (Google), Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Menglong Dong <menglong8.dong@gmail.com>
[ Upstream commit 2c67dc457bc67367dc8fcd8f471ce2d5bb5f7b2b ]
For now, fgraph is used for the fprobe, even if we need trace the entry
only. However, the performance of ftrace is better than fgraph, and we
can use ftrace_ops for this case.
Then performance of kprobe-multi increases from 54M to 69M. Before this
commit:
$ ./benchs/run_bench_trigger.sh kprobe-multi
kprobe-multi : 54.663 ± 0.493M/s
After this commit:
$ ./benchs/run_bench_trigger.sh kprobe-multi
kprobe-multi : 69.447 ± 0.143M/s
Mitigation is disable during the bench testing above.
Link: https://lore.kernel.org/all/20251015083238.2374294-2-dongml2@chinatelecom.cn/
Signed-off-by: Menglong Dong <dongml2@chinatelecom.cn>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Stable-dep-of: 845947aca681 ("tracing/fprobe: Remove fprobe from hash in failure path")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/fprobe.c | 128 ++++++++++++++++++++++++++++++++++++++++++++++----
1 file changed, 119 insertions(+), 9 deletions(-)
--- a/kernel/trace/fprobe.c
+++ b/kernel/trace/fprobe.c
@@ -252,8 +252,106 @@ static inline int __fprobe_kprobe_handle
return ret;
}
-static int fprobe_entry(struct ftrace_graph_ent *trace, struct fgraph_ops *gops,
- struct ftrace_regs *fregs)
+#ifdef CONFIG_DYNAMIC_FTRACE_WITH_REGS
+/* ftrace_ops callback, this processes fprobes which have only entry_handler. */
+static void fprobe_ftrace_entry(unsigned long ip, unsigned long parent_ip,
+ struct ftrace_ops *ops, struct ftrace_regs *fregs)
+{
+ struct fprobe_hlist_node *node;
+ struct rhlist_head *head, *pos;
+ struct fprobe *fp;
+ int bit;
+
+ bit = ftrace_test_recursion_trylock(ip, parent_ip);
+ if (bit < 0)
+ return;
+
+ /*
+ * ftrace_test_recursion_trylock() disables preemption, but
+ * rhltable_lookup() checks whether rcu_read_lcok is held.
+ * So we take rcu_read_lock() here.
+ */
+ rcu_read_lock();
+ head = rhltable_lookup(&fprobe_ip_table, &ip, fprobe_rht_params);
+
+ rhl_for_each_entry_rcu(node, pos, head, hlist) {
+ if (node->addr != ip)
+ break;
+ fp = READ_ONCE(node->fp);
+ if (unlikely(!fp || fprobe_disabled(fp) || fp->exit_handler))
+ continue;
+
+ if (fprobe_shared_with_kprobes(fp))
+ __fprobe_kprobe_handler(ip, parent_ip, fp, fregs, NULL);
+ else
+ __fprobe_handler(ip, parent_ip, fp, fregs, NULL);
+ }
+ rcu_read_unlock();
+ ftrace_test_recursion_unlock(bit);
+}
+NOKPROBE_SYMBOL(fprobe_ftrace_entry);
+
+static struct ftrace_ops fprobe_ftrace_ops = {
+ .func = fprobe_ftrace_entry,
+ .flags = FTRACE_OPS_FL_SAVE_REGS,
+};
+static int fprobe_ftrace_active;
+
+static int fprobe_ftrace_add_ips(unsigned long *addrs, int num)
+{
+ int ret;
+
+ lockdep_assert_held(&fprobe_mutex);
+
+ ret = ftrace_set_filter_ips(&fprobe_ftrace_ops, addrs, num, 0, 0);
+ if (ret)
+ return ret;
+
+ if (!fprobe_ftrace_active) {
+ ret = register_ftrace_function(&fprobe_ftrace_ops);
+ if (ret) {
+ ftrace_free_filter(&fprobe_ftrace_ops);
+ return ret;
+ }
+ }
+ fprobe_ftrace_active++;
+ return 0;
+}
+
+static void fprobe_ftrace_remove_ips(unsigned long *addrs, int num)
+{
+ lockdep_assert_held(&fprobe_mutex);
+
+ fprobe_ftrace_active--;
+ if (!fprobe_ftrace_active)
+ unregister_ftrace_function(&fprobe_ftrace_ops);
+ if (num)
+ ftrace_set_filter_ips(&fprobe_ftrace_ops, addrs, num, 1, 0);
+}
+
+static bool fprobe_is_ftrace(struct fprobe *fp)
+{
+ return !fp->exit_handler;
+}
+#else
+static int fprobe_ftrace_add_ips(unsigned long *addrs, int num)
+{
+ return -ENOENT;
+}
+
+static void fprobe_ftrace_remove_ips(unsigned long *addrs, int num)
+{
+}
+
+static bool fprobe_is_ftrace(struct fprobe *fp)
+{
+ return false;
+}
+#endif
+
+/* fgraph_ops callback, this processes fprobes which have exit_handler. */
+static int fprobe_fgraph_entry(struct ftrace_graph_ent *trace, struct fgraph_ops *gops,
+ struct ftrace_regs *fregs)
{
unsigned long *fgraph_data = NULL;
unsigned long func = trace->func;
@@ -289,7 +387,7 @@ static int fprobe_entry(struct ftrace_gr
if (node->addr != func)
continue;
fp = READ_ONCE(node->fp);
- if (fp && !fprobe_disabled(fp))
+ if (fp && !fprobe_disabled(fp) && !fprobe_is_ftrace(fp))
fp->nmissed++;
}
return 0;
@@ -309,7 +407,7 @@ static int fprobe_entry(struct ftrace_gr
if (node->addr != func)
continue;
fp = READ_ONCE(node->fp);
- if (!fp || fprobe_disabled(fp))
+ if (unlikely(!fp || fprobe_disabled(fp) || fprobe_is_ftrace(fp)))
continue;
data_size = fp->entry_data_size;
@@ -337,7 +435,7 @@ static int fprobe_entry(struct ftrace_gr
/* If any exit_handler is set, data must be used. */
return used != 0;
}
-NOKPROBE_SYMBOL(fprobe_entry);
+NOKPROBE_SYMBOL(fprobe_fgraph_entry);
static void fprobe_return(struct ftrace_graph_ret *trace,
struct fgraph_ops *gops,
@@ -376,7 +474,7 @@ static void fprobe_return(struct ftrace_
NOKPROBE_SYMBOL(fprobe_return);
static struct fgraph_ops fprobe_graph_ops = {
- .entryfunc = fprobe_entry,
+ .entryfunc = fprobe_fgraph_entry,
.retfunc = fprobe_return,
};
static int fprobe_graph_active;
@@ -498,9 +596,14 @@ static int fprobe_module_callback(struct
} while (node == ERR_PTR(-EAGAIN));
rhashtable_walk_exit(&iter);
- if (alist.index > 0)
+ if (alist.index > 0) {
ftrace_set_filter_ips(&fprobe_graph_ops.ops,
alist.addrs, alist.index, 1, 0);
+#ifdef CONFIG_DYNAMIC_FTRACE_WITH_REGS
+ ftrace_set_filter_ips(&fprobe_ftrace_ops,
+ alist.addrs, alist.index, 1, 0);
+#endif
+ }
mutex_unlock(&fprobe_mutex);
kfree(alist.addrs);
@@ -735,7 +838,11 @@ int register_fprobe_ips(struct fprobe *f
return ret;
hlist_array = fp->hlist_array;
- ret = fprobe_graph_add_ips(addrs, num);
+ if (fprobe_is_ftrace(fp))
+ ret = fprobe_ftrace_add_ips(addrs, num);
+ else
+ ret = fprobe_graph_add_ips(addrs, num);
+
if (!ret) {
add_fprobe_hash(fp);
for (i = 0; i < hlist_array->size; i++) {
@@ -830,7 +937,10 @@ int unregister_fprobe(struct fprobe *fp)
}
del_fprobe_hash(fp);
- fprobe_graph_remove_ips(addrs, count);
+ if (fprobe_is_ftrace(fp))
+ fprobe_ftrace_remove_ips(addrs, count);
+ else
+ fprobe_graph_remove_ips(addrs, count);
kfree_rcu(hlist_array, rcu);
fp->hlist_array = NULL;
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 179/188] tracing/fprobe: Unregister fprobe even if memory allocation fails
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (177 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 178/188] tracing: fprobe: optimization for entry only case Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 180/188] tracing/fprobe: Remove fprobe from hash in failure path Greg Kroah-Hartman
` (13 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Masami Hiramatsu (Google),
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
[ Upstream commit 1aec9e5c3e31ce1e28f914427fb7f90b91d310df ]
unregister_fprobe() can fail under memory pressure because of memory
allocation failure, but this maybe called from module unloading, and
usually there is no way to retry it. Moreover. trace_fprobe does not
check the return value.
To fix this problem, unregister fprobe and fprobe_hash_node even if
working memory allocation fails.
Anyway, if the last fprobe is removed, the filter will be freed.
Link: https://lore.kernel.org/all/177669365629.132053.8433032896213721288.stgit@mhiramat.tok.corp.google.com/
Fixes: 4346ba160409 ("fprobe: Rewrite fprobe on function-graph tracer")
Cc: stable@vger.kernel.org
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Stable-dep-of: 845947aca681 ("tracing/fprobe: Remove fprobe from hash in failure path")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/fprobe.c | 25 +++++++++++++++----------
1 file changed, 15 insertions(+), 10 deletions(-)
--- a/kernel/trace/fprobe.c
+++ b/kernel/trace/fprobe.c
@@ -323,9 +323,10 @@ static void fprobe_ftrace_remove_ips(uns
lockdep_assert_held(&fprobe_mutex);
fprobe_ftrace_active--;
- if (!fprobe_ftrace_active)
+ if (!fprobe_ftrace_active) {
unregister_ftrace_function(&fprobe_ftrace_ops);
- if (num)
+ ftrace_free_filter(&fprobe_ftrace_ops);
+ } else if (num)
ftrace_set_filter_ips(&fprobe_ftrace_ops, addrs, num, 1, 0);
}
@@ -508,10 +509,10 @@ static void fprobe_graph_remove_ips(unsi
fprobe_graph_active--;
/* Q: should we unregister it ? */
- if (!fprobe_graph_active)
+ if (!fprobe_graph_active) {
unregister_ftrace_graph(&fprobe_graph_ops);
-
- if (num)
+ ftrace_free_filter(&fprobe_graph_ops.ops);
+ } else if (num)
ftrace_set_filter_ips(&fprobe_graph_ops.ops, addrs, num, 1, 0);
}
@@ -924,15 +925,19 @@ int unregister_fprobe(struct fprobe *fp)
hlist_array = fp->hlist_array;
addrs = kcalloc(hlist_array->size, sizeof(unsigned long), GFP_KERNEL);
- if (!addrs) {
- ret = -ENOMEM; /* TODO: Fallback to one-by-one loop */
- goto out;
- }
+ /*
+ * This will remove fprobe_hash_node from the hash table even if
+ * memory allocation fails. However, ftrace_ops will not be updated.
+ * Anyway, when the last fprobe is unregistered, ftrace_ops is also
+ * unregistered.
+ */
+ if (!addrs)
+ pr_warn("Failed to allocate working array. ftrace_ops may not sync.\n");
/* Remove non-synonim ips from table and hash */
count = 0;
for (i = 0; i < hlist_array->size; i++) {
- if (!delete_fprobe_node(&hlist_array->array[i]))
+ if (!delete_fprobe_node(&hlist_array->array[i]) && addrs)
addrs[count++] = hlist_array->array[i].addr;
}
del_fprobe_hash(fp);
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 180/188] tracing/fprobe: Remove fprobe from hash in failure path
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (178 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 179/188] tracing/fprobe: Unregister fprobe even if memory allocation fails Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 181/188] batman-adv: tp_meter: fix tp_num leak on kmalloc failure Greg Kroah-Hartman
` (12 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Masami Hiramatsu (Google),
Sasha Levin
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
[ Upstream commit 845947aca6814f5723ed65e556eb5ee09493f05b ]
When register_fprobe_ips() fails, it tries to remove a list of
fprobe_hash_node from fprobe_ip_table, but it missed to remove
fprobe itself from fprobe_table. Moreover, when removing
the fprobe_hash_node which is added to rhltable once, it must
use kfree_rcu() after removing from rhltable.
To fix these issues, this reuses unregister_fprobe() internal
code to rollback the half-way registered fprobe.
Link: https://lore.kernel.org/all/177669366417.132053.17874946321744910456.stgit@mhiramat.tok.corp.google.com/
Fixes: 4346ba160409 ("fprobe: Rewrite fprobe on function-graph tracer")
Cc: stable@vger.kernel.org
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/fprobe.c | 90 ++++++++++++++++++++++++++------------------------
1 file changed, 47 insertions(+), 43 deletions(-)
--- a/kernel/trace/fprobe.c
+++ b/kernel/trace/fprobe.c
@@ -78,20 +78,27 @@ static const struct rhashtable_params fp
};
/* Node insertion and deletion requires the fprobe_mutex */
-static int insert_fprobe_node(struct fprobe_hlist_node *node)
+static int insert_fprobe_node(struct fprobe_hlist_node *node, struct fprobe *fp)
{
+ int ret;
+
lockdep_assert_held(&fprobe_mutex);
- return rhltable_insert(&fprobe_ip_table, &node->hlist, fprobe_rht_params);
+ ret = rhltable_insert(&fprobe_ip_table, &node->hlist, fprobe_rht_params);
+ /* Set the fprobe pointer if insertion was successful. */
+ if (!ret)
+ WRITE_ONCE(node->fp, fp);
+ return ret;
}
/* Return true if there are synonims */
static bool delete_fprobe_node(struct fprobe_hlist_node *node)
{
- lockdep_assert_held(&fprobe_mutex);
bool ret;
- /* Avoid double deleting */
+ lockdep_assert_held(&fprobe_mutex);
+
+ /* Avoid double deleting and non-inserted nodes */
if (READ_ONCE(node->fp) != NULL) {
WRITE_ONCE(node->fp, NULL);
rhltable_remove(&fprobe_ip_table, &node->hlist,
@@ -748,7 +755,6 @@ static int fprobe_init(struct fprobe *fp
fp->hlist_array = hlist_array;
hlist_array->fp = fp;
for (i = 0; i < num; i++) {
- hlist_array->array[i].fp = fp;
addr = ftrace_location(addrs[i]);
if (!addr) {
fprobe_fail_cleanup(fp);
@@ -812,6 +818,8 @@ int register_fprobe(struct fprobe *fp, c
}
EXPORT_SYMBOL_GPL(register_fprobe);
+static int unregister_fprobe_nolock(struct fprobe *fp);
+
/**
* register_fprobe_ips() - Register fprobe to ftrace by address.
* @fp: A fprobe data structure to be registered.
@@ -838,28 +846,25 @@ int register_fprobe_ips(struct fprobe *f
if (ret)
return ret;
- hlist_array = fp->hlist_array;
if (fprobe_is_ftrace(fp))
ret = fprobe_ftrace_add_ips(addrs, num);
else
ret = fprobe_graph_add_ips(addrs, num);
-
- if (!ret) {
- add_fprobe_hash(fp);
- for (i = 0; i < hlist_array->size; i++) {
- ret = insert_fprobe_node(&hlist_array->array[i]);
- if (ret)
- break;
- }
- /* fallback on insert error */
- if (ret) {
- for (i--; i >= 0; i--)
- delete_fprobe_node(&hlist_array->array[i]);
- }
+ if (ret) {
+ fprobe_fail_cleanup(fp);
+ return ret;
}
- if (ret)
- fprobe_fail_cleanup(fp);
+ hlist_array = fp->hlist_array;
+ ret = add_fprobe_hash(fp);
+ for (i = 0; i < hlist_array->size && !ret; i++)
+ ret = insert_fprobe_node(&hlist_array->array[i], fp);
+
+ if (ret) {
+ unregister_fprobe_nolock(fp);
+ /* In error case, wait for clean up safely. */
+ synchronize_rcu();
+ }
return ret;
}
@@ -903,27 +908,12 @@ bool fprobe_is_registered(struct fprobe
return true;
}
-/**
- * unregister_fprobe() - Unregister fprobe.
- * @fp: A fprobe data structure to be unregistered.
- *
- * Unregister fprobe (and remove ftrace hooks from the function entries).
- *
- * Return 0 if @fp is unregistered successfully, -errno if not.
- */
-int unregister_fprobe(struct fprobe *fp)
+static int unregister_fprobe_nolock(struct fprobe *fp)
{
- struct fprobe_hlist *hlist_array;
+ struct fprobe_hlist *hlist_array = fp->hlist_array;
unsigned long *addrs = NULL;
- int ret = 0, i, count;
+ int i, count;
- mutex_lock(&fprobe_mutex);
- if (!fp || !fprobe_registered(fp)) {
- ret = -EINVAL;
- goto out;
- }
-
- hlist_array = fp->hlist_array;
addrs = kcalloc(hlist_array->size, sizeof(unsigned long), GFP_KERNEL);
/*
* This will remove fprobe_hash_node from the hash table even if
@@ -949,12 +939,26 @@ int unregister_fprobe(struct fprobe *fp)
kfree_rcu(hlist_array, rcu);
fp->hlist_array = NULL;
+ kfree(addrs);
-out:
- mutex_unlock(&fprobe_mutex);
+ return 0;
+}
- kfree(addrs);
- return ret;
+/**
+ * unregister_fprobe() - Unregister fprobe.
+ * @fp: A fprobe data structure to be unregistered.
+ *
+ * Unregister fprobe (and remove ftrace hooks from the function entries).
+ *
+ * Return 0 if @fp is unregistered successfully, -errno if not.
+ */
+int unregister_fprobe(struct fprobe *fp)
+{
+ guard(mutex)(&fprobe_mutex);
+ if (!fp || !fprobe_registered(fp))
+ return -EINVAL;
+
+ return unregister_fprobe_nolock(fp);
}
EXPORT_SYMBOL_GPL(unregister_fprobe);
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 181/188] batman-adv: tp_meter: fix tp_num leak on kmalloc failure
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (179 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 180/188] tracing/fprobe: Remove fprobe from hash in failure path Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 182/188] vsock: fix buffer size clamping order Greg Kroah-Hartman
` (11 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Sven Eckelmann
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit ce425dd05d0fe7594930a0fb103634f35ac47bb6 upstream.
When batadv_tp_start() or batadv_tp_init_recv() fail to allocate a new
tp_vars object, the previously incremented bat_priv->tp_num counter is
never decremented. This causes tp_num to drift upward on each allocation
failure. Since only BATADV_TP_MAX_NUM sessions can be started and the count
is never reduced for these failed allocations, it causes to an exhaustion
of throughput meter sessions. In worst case, no new throughput meter
session can be started until the mesh interface is removed.
The error handling must decrement tp_num releasing the lock and aborting
the creation of an throughput meter session
Cc: stable@kernel.org
Fixes: 33a3bb4a3345 ("batman-adv: throughput meter implementation")
[ Context ]
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/batman-adv/tp_meter.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/net/batman-adv/tp_meter.c
+++ b/net/batman-adv/tp_meter.c
@@ -994,6 +994,7 @@ void batadv_tp_start(struct batadv_priv
tp_vars = kmalloc(sizeof(*tp_vars), GFP_ATOMIC);
if (!tp_vars) {
+ atomic_dec(&bat_priv->tp_num);
spin_unlock_bh(&bat_priv->tp_list_lock);
batadv_dbg(BATADV_DBG_TP_METER, bat_priv,
"Meter: %s cannot allocate list elements\n",
@@ -1366,8 +1367,10 @@ batadv_tp_init_recv(struct batadv_priv *
}
tp_vars = kmalloc(sizeof(*tp_vars), GFP_ATOMIC);
- if (!tp_vars)
+ if (!tp_vars) {
+ atomic_dec(&bat_priv->tp_num);
goto out_unlock;
+ }
ether_addr_copy(tp_vars->other_end, icmp->orig);
tp_vars->role = BATADV_TP_RECEIVER;
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 182/188] vsock: fix buffer size clamping order
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (180 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 181/188] batman-adv: tp_meter: fix tp_num leak on kmalloc failure Greg Kroah-Hartman
@ 2026-05-15 15:49 ` Greg Kroah-Hartman
2026-05-15 15:50 ` [PATCH 6.18 183/188] vsock/virtio: fix length and offset in tap skb for split packets Greg Kroah-Hartman
` (10 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:49 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stefano Garzarella, Norbert Szetei,
Jakub Kicinski, Luigi Leonardi
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Norbert Szetei <norbert@doyensec.com>
commit d114bfdc9b76bf93b881e195b7ec957c14227bab upstream.
In vsock_update_buffer_size(), the buffer size was being clamped to the
maximum first, and then to the minimum. If a user sets a minimum buffer
size larger than the maximum, the minimum check overrides the maximum
check, inverting the constraint.
This breaks the intended socket memory boundaries by allowing the
vsk->buffer_size to grow beyond the configured vsk->buffer_max_size.
Fix this by checking the minimum first, and then the maximum. This
ensures the buffer size never exceeds the buffer_max_size.
Fixes: b9f2b0ffde0c ("vsock: handle buffer_size sockopts in the core")
Suggested-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Norbert Szetei <norbert@doyensec.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Link: https://patch.msgid.link/180118C5-8BCF-4A63-A305-4EE53A34AB9C@doyensec.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Cc: Luigi Leonardi <leonardi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/vmw_vsock/af_vsock.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -1846,12 +1846,12 @@ static void vsock_update_buffer_size(str
const struct vsock_transport *transport,
u64 val)
{
- if (val > vsk->buffer_max_size)
- val = vsk->buffer_max_size;
-
if (val < vsk->buffer_min_size)
val = vsk->buffer_min_size;
+ if (val > vsk->buffer_max_size)
+ val = vsk->buffer_max_size;
+
if (val != vsk->buffer_size &&
transport && transport->notify_buffer_size)
transport->notify_buffer_size(vsk, &val);
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 183/188] vsock/virtio: fix length and offset in tap skb for split packets
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (181 preceding siblings ...)
2026-05-15 15:49 ` [PATCH 6.18 182/188] vsock: fix buffer size clamping order Greg Kroah-Hartman
@ 2026-05-15 15:50 ` Greg Kroah-Hartman
2026-05-15 15:50 ` [PATCH 6.18 184/188] vsock/virtio: fix empty payload in tap skb for non-linear buffers Greg Kroah-Hartman
` (9 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stefano Garzarella, Bobby Eshleman,
Arseniy Krasnov, Michael S. Tsirkin, Paolo Abeni, Luigi Leonardi
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefano Garzarella <sgarzare@redhat.com>
commit 5f344d809e015fba3709e5219428c00b8ac5d7df upstream.
virtio_transport_build_skb() builds a new skb to be delivered to the
vsockmon tap device. To build the new skb, it uses the original skb
data length as payload length, but as the comment notes, the original
packet stored in the skb may have been split in multiple packets, so we
need to use the length in the header, which is correctly updated before
the packet is delivered to the tap, and the offset for the data.
This was also similar to what we did before commit 71dc9ec9ac7d
("virtio/vsock: replace virtio_vsock_pkt with sk_buff") where we probably
missed something during the skb conversion.
Also update the comment above, which was left stale by the skb
conversion and still mentioned a buffer pointer that no longer exists.
Fixes: 71dc9ec9ac7d ("virtio/vsock: replace virtio_vsock_pkt with sk_buff")
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com>
Reviewed-by: Arseniy Krasnov <avkrasnov@rulkc.org>
Link: https://patch.msgid.link/20260508164411.261440-2-sgarzare@redhat.com
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Cc: Luigi Leonardi <leonardi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/vmw_vsock/virtio_transport_common.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
--- a/net/vmw_vsock/virtio_transport_common.c
+++ b/net/vmw_vsock/virtio_transport_common.c
@@ -169,12 +169,12 @@ static struct sk_buff *virtio_transport_
struct sk_buff *skb;
size_t payload_len;
- /* A packet could be split to fit the RX buffer, so we can retrieve
- * the payload length from the header and the buffer pointer taking
- * care of the offset in the original packet.
+ /* A packet could be split to fit the RX buffer, so we use
+ * the payload length from the header, which has been updated
+ * by the sender to reflect the fragment size.
*/
pkt_hdr = virtio_vsock_hdr(pkt);
- payload_len = pkt->len;
+ payload_len = le32_to_cpu(pkt_hdr->len);
skb = alloc_skb(sizeof(*hdr) + sizeof(*pkt_hdr) + payload_len,
GFP_ATOMIC);
@@ -222,7 +222,8 @@ static struct sk_buff *virtio_transport_
virtio_transport_copy_nonlinear_skb(pkt, data, payload_len);
} else {
- skb_put_data(skb, pkt->data, payload_len);
+ skb_put_data(skb, pkt->data + VIRTIO_VSOCK_SKB_CB(pkt)->offset,
+ payload_len);
}
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 184/188] vsock/virtio: fix empty payload in tap skb for non-linear buffers
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (182 preceding siblings ...)
2026-05-15 15:50 ` [PATCH 6.18 183/188] vsock/virtio: fix length and offset in tap skb for split packets Greg Kroah-Hartman
@ 2026-05-15 15:50 ` Greg Kroah-Hartman
2026-05-15 15:50 ` [PATCH 6.18 185/188] vsock/virtio: fix potential unbounded skb queue Greg Kroah-Hartman
` (8 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yiqi Sun, Stefano Garzarella,
Bobby Eshleman, Arseniy Krasnov, Michael S. Tsirkin, Paolo Abeni,
Luigi Leonardi
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefano Garzarella <sgarzare@redhat.com>
commit 3a3e3d90cbc79600544536723911657730759af3 upstream.
For non-linear skbs, virtio_transport_build_skb() goes through
virtio_transport_copy_nonlinear_skb() to copy the original payload
in the new skb to be delivered to the vsockmon tap device.
This manually initializes an iov_iter but does not set iov_iter.count.
Since the iov_iter is zero-initialized, the copy length is zero and no
payload is actually copied to the monitor interface, leaving data
un-initialized.
Fix this by removing the linear vs non-linear split and using
skb_copy_datagram_iter() with iov_iter_kvec() for all cases, as
vhost-vsock already does. This handles both linear and non-linear skbs,
properly initializes the iov_iter, and removes the now unused
virtio_transport_copy_nonlinear_skb().
While touching this code, let's also check the return value of
skb_copy_datagram_iter(), even though it's unlikely to fail.
Fixes: 4b0bf10eb077 ("vsock/virtio: non-linear skb handling for tap")
Reported-by: Yiqi Sun <sunyiqixm@gmail.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com>
Reviewed-by: Arseniy Krasnov <avkrasnov@rulkc.org>
Link: https://patch.msgid.link/20260508164411.261440-3-sgarzare@redhat.com
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Cc: Luigi Leonardi <leonardi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/vmw_vsock/virtio_transport_common.c | 40 +++++++++-----------------------
1 file changed, 12 insertions(+), 28 deletions(-)
--- a/net/vmw_vsock/virtio_transport_common.c
+++ b/net/vmw_vsock/virtio_transport_common.c
@@ -139,27 +139,6 @@ static void virtio_transport_init_hdr(st
hdr->fwd_cnt = cpu_to_le32(0);
}
-static void virtio_transport_copy_nonlinear_skb(const struct sk_buff *skb,
- void *dst,
- size_t len)
-{
- struct iov_iter iov_iter = { 0 };
- struct kvec kvec;
- size_t to_copy;
-
- kvec.iov_base = dst;
- kvec.iov_len = len;
-
- iov_iter.iter_type = ITER_KVEC;
- iov_iter.kvec = &kvec;
- iov_iter.nr_segs = 1;
-
- to_copy = min_t(size_t, len, skb->len);
-
- skb_copy_datagram_iter(skb, VIRTIO_VSOCK_SKB_CB(skb)->offset,
- &iov_iter, to_copy);
-}
-
/* Packet capture */
static struct sk_buff *virtio_transport_build_skb(void *opaque)
{
@@ -217,13 +196,18 @@ static struct sk_buff *virtio_transport_
skb_put_data(skb, pkt_hdr, sizeof(*pkt_hdr));
if (payload_len) {
- if (skb_is_nonlinear(pkt)) {
- void *data = skb_put(skb, payload_len);
-
- virtio_transport_copy_nonlinear_skb(pkt, data, payload_len);
- } else {
- skb_put_data(skb, pkt->data + VIRTIO_VSOCK_SKB_CB(pkt)->offset,
- payload_len);
+ struct iov_iter iov_iter;
+ struct kvec kvec;
+ void *data = skb_put(skb, payload_len);
+
+ kvec.iov_base = data;
+ kvec.iov_len = payload_len;
+ iov_iter_kvec(&iov_iter, ITER_DEST, &kvec, 1, payload_len);
+
+ if (skb_copy_datagram_iter(pkt, VIRTIO_VSOCK_SKB_CB(pkt)->offset,
+ &iov_iter, payload_len)) {
+ kfree_skb(skb);
+ return NULL;
}
}
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 185/188] vsock/virtio: fix potential unbounded skb queue
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (183 preceding siblings ...)
2026-05-15 15:50 ` [PATCH 6.18 184/188] vsock/virtio: fix empty payload in tap skb for non-linear buffers Greg Kroah-Hartman
@ 2026-05-15 15:50 ` Greg Kroah-Hartman
2026-05-15 15:50 ` [PATCH 6.18 186/188] vsock/virtio: fix accept queue count leak on transport mismatch Greg Kroah-Hartman
` (7 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Arseniy Krasnov,
Stefan Hajnoczi, Stefano Garzarella, Michael S. Tsirkin,
Jason Wang, Xuan Zhuo, Eugenio Pérez, virtualization,
Jakub Kicinski, Luigi Leonardi
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit 059b7dbd20a6f0c539a45ddff1573cb8946685b5 upstream.
virtio_transport_inc_rx_pkt() checks vvs->rx_bytes + len > vvs->buf_alloc.
virtio_transport_recv_enqueue() skips coalescing for packets
with VIRTIO_VSOCK_SEQ_EOM.
If fed with packets with len == 0 and VIRTIO_VSOCK_SEQ_EOM,
a very large number of packets can be queued
because vvs->rx_bytes stays at 0.
Fix this by estimating the skb metadata size:
(Number of skbs in the queue) * SKB_TRUESIZE(0)
Fixes: 077706165717 ("virtio/vsock: don't use skbuff state to account credit")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Arseniy Krasnov <AVKrasnov@sberdevices.ru>
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Cc: Stefano Garzarella <sgarzare@redhat.com>
Cc: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Jason Wang <jasowang@redhat.com>
Cc: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
Cc: "Eugenio Pérez" <eperezma@redhat.com>
Cc: virtualization@lists.linux.dev
Link: https://patch.msgid.link/20260430122653.554058-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Cc: Luigi Leonardi <leonardi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/vmw_vsock/virtio_transport_common.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/net/vmw_vsock/virtio_transport_common.c
+++ b/net/vmw_vsock/virtio_transport_common.c
@@ -429,7 +429,9 @@ static int virtio_transport_send_pkt_inf
static bool virtio_transport_inc_rx_pkt(struct virtio_vsock_sock *vvs,
u32 len)
{
- if (vvs->buf_used + len > vvs->buf_alloc)
+ u64 skb_overhead = (skb_queue_len(&vvs->rx_queue) + 1) * SKB_TRUESIZE(0);
+
+ if (skb_overhead + vvs->buf_used + len > vvs->buf_alloc)
return false;
vvs->rx_bytes += len;
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 186/188] vsock/virtio: fix accept queue count leak on transport mismatch
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (184 preceding siblings ...)
2026-05-15 15:50 ` [PATCH 6.18 185/188] vsock/virtio: fix potential unbounded skb queue Greg Kroah-Hartman
@ 2026-05-15 15:50 ` Greg Kroah-Hartman
2026-05-15 15:50 ` [PATCH 6.18 187/188] drm/amdgpu/vcn3: Avoid overflow on msg bound check Greg Kroah-Hartman
` (6 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dudu Lu, Bobby Eshleman,
Luigi Leonardi, Stefano Garzarella, Michael S. Tsirkin,
Paolo Abeni
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dudu Lu <phx0fer@gmail.com>
commit 52bcb57a4e8a0865a76c587c2451906342ae1b2d upstream.
virtio_transport_recv_listen() calls sk_acceptq_added() before
vsock_assign_transport(). If vsock_assign_transport() fails or
selects a different transport, the error path returns without
calling sk_acceptq_removed(), permanently incrementing
sk_ack_backlog.
After approximately backlog+1 such failures, sk_acceptq_is_full()
returns true, causing the listener to reject all new connections.
Fix by moving sk_acceptq_added() to after the transport validation,
matching the pattern used by vmci_transport and hyperv_transport.
Fixes: c0cfa2d8a788 ("vsock: add multi-transports support")
Signed-off-by: Dudu Lu <phx0fer@gmail.com>
Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com>
Reviewed-by: Luigi Leonardi <leonardi@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Link: https://patch.msgid.link/20260413131409.19022-1-phx0fer@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Cc: Luigi Leonardi <leonardi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/vmw_vsock/virtio_transport_common.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/net/vmw_vsock/virtio_transport_common.c
+++ b/net/vmw_vsock/virtio_transport_common.c
@@ -1530,8 +1530,6 @@ virtio_transport_recv_listen(struct sock
return -ENOMEM;
}
- sk_acceptq_added(sk);
-
lock_sock_nested(child, SINGLE_DEPTH_NESTING);
child->sk_state = TCP_ESTABLISHED;
@@ -1553,6 +1551,7 @@ virtio_transport_recv_listen(struct sock
return ret;
}
+ sk_acceptq_added(sk);
if (virtio_transport_space_update(child, skb))
child->sk_write_space(child);
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 187/188] drm/amdgpu/vcn3: Avoid overflow on msg bound check
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (185 preceding siblings ...)
2026-05-15 15:50 ` [PATCH 6.18 186/188] vsock/virtio: fix accept queue count leak on transport mismatch Greg Kroah-Hartman
@ 2026-05-15 15:50 ` Greg Kroah-Hartman
2026-05-15 15:50 ` [PATCH 6.18 188/188] drm/amdgpu/vcn4: " Greg Kroah-Hartman
` (5 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, SDL, Benjamin Cheng, Ruijing Dong,
Alex Deucher
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Cheng <benjamin.cheng@amd.com>
commit e6e9faba8100628990cccd13f0f044a648c303cf upstream.
As pointed out by SDL, the previous condition may be vulnerable to
overflow.
Fixes: b193019860d6 ("drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg")
Cc: SDL <sdl@nppct.ru>
Signed-off-by: Benjamin Cheng <benjamin.cheng@amd.com>
Reviewed-by: Ruijing Dong <ruijing.dong@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit db00257ac9e4a51eb2515aaea161a019f7125e10)
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c
@@ -1971,6 +1971,7 @@ static int vcn_v3_0_dec_msg(struct amdgp
for (i = 0, msg = &msg[6]; i < num_buffers; ++i, msg += 4) {
uint32_t offset, size, *create;
+ uint64_t buf_end;
if (msg[0] != RDECODE_MESSAGE_CREATE)
continue;
@@ -1978,7 +1979,8 @@ static int vcn_v3_0_dec_msg(struct amdgp
offset = msg[1];
size = msg[2];
- if (size < 4 || offset + size > end - addr) {
+ if (size < 4 || check_add_overflow(offset, size, &buf_end) ||
+ buf_end > end - addr) {
DRM_ERROR("VCN message buffer exceeds BO bounds!\n");
r = -EINVAL;
goto out;
^ permalink raw reply [flat|nested] 195+ messages in thread
* [PATCH 6.18 188/188] drm/amdgpu/vcn4: Avoid overflow on msg bound check
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (186 preceding siblings ...)
2026-05-15 15:50 ` [PATCH 6.18 187/188] drm/amdgpu/vcn3: Avoid overflow on msg bound check Greg Kroah-Hartman
@ 2026-05-15 15:50 ` Greg Kroah-Hartman
2026-05-15 17:13 ` [PATCH 6.18 000/188] 6.18.32-rc1 review Wentao Guan
` (4 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Greg Kroah-Hartman @ 2026-05-15 15:50 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, SDL, Benjamin Cheng, Ruijing Dong,
Alex Deucher
6.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Cheng <benjamin.cheng@amd.com>
commit 65bce27ea6192320448c30267ffc17ffa094e713 upstream.
As pointed out by SDL, the previous condition may be vulnerable to
overflow.
Fixes: 0a78f2bac142 ("drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg")
Cc: SDL <sdl@nppct.ru>
Signed-off-by: Benjamin Cheng <benjamin.cheng@amd.com>
Reviewed-by: Ruijing Dong <ruijing.dong@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 3c5367d950140d4ec7af830b2268a5a6fdaa3885)
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vcn_v4_0.c
@@ -1888,6 +1888,7 @@ static int vcn_v4_0_dec_msg(struct amdgp
for (i = 0, msg = &msg[6]; i < num_buffers; ++i, msg += 4) {
uint32_t offset, size, *create;
+ uint64_t buf_end;
if (msg[0] != RDECODE_MESSAGE_CREATE)
continue;
@@ -1895,7 +1896,8 @@ static int vcn_v4_0_dec_msg(struct amdgp
offset = msg[1];
size = msg[2];
- if (size < 4 || offset + size > end - addr) {
+ if (size < 4 || check_add_overflow(offset, size, &buf_end) ||
+ buf_end > end - addr) {
DRM_ERROR("VCN message buffer exceeds BO bounds!\n");
r = -EINVAL;
goto out;
^ permalink raw reply [flat|nested] 195+ messages in thread
* Re: [PATCH 6.18 000/188] 6.18.32-rc1 review
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (187 preceding siblings ...)
2026-05-15 15:50 ` [PATCH 6.18 188/188] drm/amdgpu/vcn4: " Greg Kroah-Hartman
@ 2026-05-15 17:13 ` Wentao Guan
2026-05-15 20:24 ` Florian Fainelli
` (3 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Wentao Guan @ 2026-05-15 17:13 UTC (permalink / raw)
To: gregkh
Cc: achill, akpm, broonie, conor, f.fainelli, hargar, jonathanh,
linux-kernel, linux, lkft-triage, patches, patches, pavel,
rwarsow, shuah, sr, stable, sudipm.mukherjee, torvalds,
Wentao Guan
Build failed, you can drop the commit to build ok:
git revert 0253904dd601b15da2983297d64c106a393b3aa3.
Revert "sched_ext: Use HK_TYPE_DOMAIN_BOOT to detect isolcpus= domain isolation"
Tested-by: Wentao Guan <guanwentao@uniontech.com>
BRs
Wentao Guan
defconfigs:
https://gist.github.com/opsiff/a840ae9e3d6857f5b7bacb9cdc49f8e9
Log:
kernel/sched/ext.c: In function ‘scx_enable’:
kernel/sched/ext.c:4924:34: error: ‘HK_TYPE_DOMAIN_BOOT’ undeclared (first use in this function); did you mean ‘HK_TYPE_DOMAIN’?
4924 | if (housekeeping_enabled(HK_TYPE_DOMAIN_BOOT)) {
| ^~~~~~~~~~~~~~~~~~~
| HK_TYPE_DOMAIN
kernel/sched/ext.c:4924:34: note: each undeclared identifier is reported only once for each function it appears in
CC [M] crypto/algif_hash.o
commit 4fca0e550d506e1c95504c2d9247bc92bf621bf6
Author: Frederic Weisbecker <frederic@kernel.org>
Date: Mon May 26 13:06:21 2025 +0200
sched/isolation: Save boot defined domain flags
HK_TYPE_DOMAIN will soon integrate not only boot defined isolcpus= CPUs
but also cpuset isolated partitions.
Housekeeping still needs a way to record what was initially passed
to isolcpus= in order to keep these CPUs isolated after a cpuset
isolated partition is modified or destroyed while containing some of
them.
Create a new HK_TYPE_DOMAIN_BOOT to keep track of those.
Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
Reviewed-by: Phil Auld <pauld@redhat.com>
Reviewed-by: Waiman Long <longman@redhat.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Marco Crivellari <marco.crivellari@suse.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Tejun Heo <tj@kernel.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Waiman Long <longman@redhat.com>
^ permalink raw reply [flat|nested] 195+ messages in thread
* Re: [PATCH 6.18 000/188] 6.18.32-rc1 review
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (188 preceding siblings ...)
2026-05-15 17:13 ` [PATCH 6.18 000/188] 6.18.32-rc1 review Wentao Guan
@ 2026-05-15 20:24 ` Florian Fainelli
2026-05-15 22:13 ` Pavel Machek
` (2 subsequent siblings)
192 siblings, 0 replies; 195+ messages in thread
From: Florian Fainelli @ 2026-05-15 20:24 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, sudipm.mukherjee, rwarsow, conor,
hargar, broonie, achill, sr
On 5/15/26 08:46, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.18.32 release.
> There are 188 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun, 17 May 2026 15:46:37 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.32-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on
BMIPS_GENERIC:
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
--
Florian
^ permalink raw reply [flat|nested] 195+ messages in thread
* Re: [PATCH 6.18 000/188] 6.18.32-rc1 review
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (189 preceding siblings ...)
2026-05-15 20:24 ` Florian Fainelli
@ 2026-05-15 22:13 ` Pavel Machek
2026-05-15 22:45 ` Shuah Khan
2026-05-16 2:04 ` Miguel Ojeda
192 siblings, 0 replies; 195+ messages in thread
From: Pavel Machek @ 2026-05-15 22:13 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
[-- Attachment #1: Type: text/plain, Size: 505 bytes --]
Hi!
> This is the start of the stable review cycle for the 6.18.32 release.
> There are 188 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
CIP testing did not find any problems here:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-6.18.y
Tested-by: Pavel Machek (CIP) <pavel@nabladev.com>
Best regards,
Pavel
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
^ permalink raw reply [flat|nested] 195+ messages in thread
* Re: [PATCH 6.18 000/188] 6.18.32-rc1 review
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (190 preceding siblings ...)
2026-05-15 22:13 ` Pavel Machek
@ 2026-05-15 22:45 ` Shuah Khan
2026-05-16 2:04 ` Miguel Ojeda
192 siblings, 0 replies; 195+ messages in thread
From: Shuah Khan @ 2026-05-15 22:45 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill, sr, Shuah Khan
On 5/15/26 09:46, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.18.32 release.
> There are 188 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun, 17 May 2026 15:46:37 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.18.32-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.18.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Compiled and booted on my test system. No dmesg regressions.
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
thanks,
-- Shuah
^ permalink raw reply [flat|nested] 195+ messages in thread
* Re: [PATCH 6.18 143/188] sched_ext: Use HK_TYPE_DOMAIN_BOOT to detect isolcpus= domain isolation
2026-05-15 15:49 ` [PATCH 6.18 143/188] sched_ext: Use HK_TYPE_DOMAIN_BOOT to detect isolcpus= domain isolation Greg Kroah-Hartman
@ 2026-05-16 0:48 ` Peter Schneider
0 siblings, 0 replies; 195+ messages in thread
From: Peter Schneider @ 2026-05-16 0:48 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, Andrea Righi, Tejun Heo, Frederic Weisbecker
Hi Greg,
Am 15.05.2026 um 17:49 schrieb Greg Kroah-Hartman:
> 6.18-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Andrea Righi <arighi@nvidia.com>
>
> commit 6ae315d37924435516d697ea7dde0b799a5928e0 upstream.
>
> scx_enable() refuses to attach a BPF scheduler when isolcpus=domain is
> in effect by comparing housekeeping_cpumask(HK_TYPE_DOMAIN) against
> cpu_possible_mask.
>
> Since commit 27c3a5967f05 ("sched/isolation: Convert housekeeping
> cpumasks to rcu pointers"), HK_TYPE_DOMAIN's cpumask is RCU protected
> and dereferencing it requires either RCU read lock, the cpu_hotplug
> write lock, or the cpuset lock; scx_enable() holds none of these, so
> booting with isolcpus=domain and attaching any BPF scheduler triggers
> the following lockdep splat:
>
> =============================
> WARNING: suspicious RCU usage
> -----------------------------
> kernel/sched/isolation.c:60 suspicious rcu_dereference_check() usage!
>
> 1 lock held by scx_flash/281:
> #0: ffffffff8379fce0 (update_mutex){+.+.}-{4:4}, at:
> bpf_struct_ops_link_create+0x134/0x1c0
>
> Call Trace:
> dump_stack_lvl+0x6f/0xb0
> lockdep_rcu_suspicious.cold+0x37/0x70
> housekeeping_cpumask+0xcd/0xe0
> scx_enable.isra.0+0x17/0x120
> bpf_scx_reg+0x5e/0x80
> bpf_struct_ops_link_create+0x151/0x1c0
> __sys_bpf+0x1e4b/0x33c0
> __x64_sys_bpf+0x21/0x30
> do_syscall_64+0x117/0xf80
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> In addition, commit 03ff73510169 ("cpuset: Update HK_TYPE_DOMAIN cpumask
> from cpuset") made HK_TYPE_DOMAIN include cpuset isolated partitions as
> well, which means the current check also rejects BPF schedulers when a
> cpuset partition is active. That contradicts the original intent of
> commit 9f391f94a173 ("sched_ext: Disallow loading BPF scheduler if
> isolcpus= domain isolation is in effect"), which explicitly noted that
> cpuset partitions are honored through per-task cpumasks and should not
> be rejected.
>
> Switch to housekeeping_enabled(HK_TYPE_DOMAIN_BOOT), which reads only
> the housekeeping flag bit (no RCU dereference) and reflects exactly the
> boot-time isolcpus= configuration that the error message refers to.
>
> Fixes: 27c3a5967f05 ("sched/isolation: Convert housekeeping cpumasks to rcu pointers")
> Cc: stable@vger.kernel.org # v7.0+
> Signed-off-by: Andrea Righi <arighi@nvidia.com>
> Signed-off-by: Tejun Heo <tj@kernel.org>
> Acked-by: Frederic Weisbecker <frederic@kernel.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
> kernel/sched/ext.c | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
>
> --- a/kernel/sched/ext.c
> +++ b/kernel/sched/ext.c
> @@ -4906,8 +4906,7 @@ static int scx_enable(struct sched_ext_o
> static DEFINE_MUTEX(helper_mutex);
> struct scx_enable_cmd cmd;
>
> - if (!cpumask_equal(housekeeping_cpumask(HK_TYPE_DOMAIN),
> - cpu_possible_mask)) {
> + if (housekeeping_enabled(HK_TYPE_DOMAIN_BOOT)) {
> pr_err("sched_ext: Not compatible with \"isolcpus=\" domain isolation\n");
> return -EINVAL;
> }
>
>
This patch causes a build failure for me:
CC kernel/sched/build_policy.o
In file included from kernel/sched/build_policy.c:62:
kernel/sched/ext.c: In function ‘scx_enable’:
kernel/sched/ext.c:4924:34: error: ‘HK_TYPE_DOMAIN_BOOT’ undeclared (first use in this function); did you mean
‘HK_TYPE_DOMAIN’?
4924 | if (housekeeping_enabled(HK_TYPE_DOMAIN_BOOT)) {
| ^~~~~~~~~~~~~~~~~~~
| HK_TYPE_DOMAIN
kernel/sched/ext.c:4924:34: note: each undeclared identifier is reported only once for each function it appears in
make[4]: *** [scripts/Makefile.build:287: kernel/sched/build_policy.o] Fehler 1
make[3]: *** [scripts/Makefile.build:544: kernel/sched] Fehler 2
make[2]: *** [scripts/Makefile.build:544: kernel] Fehler 2
make[1]: *** [/usr/src/linux-stable-rc/Makefile:2024: .] Fehler 2
make: *** [Makefile:248: __sub-make] Fehler 2
root@linus:/usr/src/linux-stable-rc#
If I revert this patch, the build succeeds, and the kernel boots and seems to work fine without any observable regressions.
Tested-by: Peter Schneider <pschneider1968@googlemail.com>
Beste Grüße,
Peter Schneider
--
Climb the mountain not to plant your flag, but to embrace the challenge,
enjoy the air and behold the view. Climb it so you can see the world,
not so the world can see you. -- David McCullough Jr.
OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244
Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@googlemail.com
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@gmail.com
^ permalink raw reply [flat|nested] 195+ messages in thread
* Re: [PATCH 6.18 000/188] 6.18.32-rc1 review
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
` (191 preceding siblings ...)
2026-05-15 22:45 ` Shuah Khan
@ 2026-05-16 2:04 ` Miguel Ojeda
192 siblings, 0 replies; 195+ messages in thread
From: Miguel Ojeda @ 2026-05-16 2:04 UTC (permalink / raw)
To: gregkh
Cc: achill, akpm, broonie, conor, f.fainelli, hargar, jonathanh,
linux-kernel, linux, lkft-triage, patches, patches, pavel,
rwarsow, shuah, sr, stable, sudipm.mukherjee, torvalds,
Miguel Ojeda, Jiri Kosina, Benjamin Tissoires, linux-input,
Johan Hovold, Nathan Chancellor
On Fri, 15 May 2026 17:46:57 +0200 Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.18.32 release.
> There are 188 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun, 17 May 2026 15:46:37 +0000.
> Anything received after that time might be too late.
Boot-tested under QEMU for Rust x86_64, arm64 and riscv64; built-tested
for loongarch64:
Tested-by: Miguel Ojeda <ojeda@kernel.org>
Via arm32 I see:
drivers/hid/hid-core.c:2050:29: error: format specifies type 'long' but the argument has type 'size_t' (aka 'unsigned int') [-Werror,-Wformat]
2049 | hid_warn_ratelimited(hid, "Event data for report %d is incorrect (%d vs %ld)\n",
| ~~~
| %zu
2050 | report->id, csize, bsize);
| ^~~~~
It is also reproducible in mainline, though. Cc'ing a few folks...
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Benjamin Tissoires <bentiss@kernel.org>
Cc: linux-input@vger.kernel.org
Cc: Johan Hovold <johan@kernel.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Nathan Chancellor <nathan@kernel.org>
Thanks!
Cheers,
Miguel
^ permalink raw reply [flat|nested] 195+ messages in thread
end of thread, other threads:[~2026-05-16 2:04 UTC | newest]
Thread overview: 195+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-15 15:46 [PATCH 6.18 000/188] 6.18.32-rc1 review Greg Kroah-Hartman
2026-05-15 15:46 ` [PATCH 6.18 001/188] HID: playstation: Clamp num_touch_reports Greg Kroah-Hartman
2026-05-15 15:46 ` [PATCH 6.18 002/188] HID: appletb-kbd: fix UAF in inactivity-timer cleanup path Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 003/188] HID: appletb-kbd: run inactivity autodim from workqueues Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 004/188] HID: pass the buffer size to hid_report_raw_event Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 005/188] HID: core: introduce hid_safe_input_report() Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 006/188] HID: pidff: Fix integer overflow in pidff_rescale Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 007/188] media: uvcvideo: Enable VB2_DMABUF for metadata stream Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 008/188] drm/msm/hdmi: Fix wrong CTRL1 register used in writing info frames Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 009/188] media: nxp: imx8-isi: Reduce minimum queued buffers from 2 to 0 Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 010/188] media: renesas: vsp1: Fix NULL pointer deref on module unload Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 011/188] media: renesas: vin: Fix RAW8 (again) Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 012/188] media: i2c: ov8856: free control handler on error in ov8856_init_controls() Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 013/188] media: dt-bindings: rockchip,vdec: Add alternative reg-names order for RK35{76,88} Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 014/188] media: dt-bindings: rockchip,vdec: Mark reg-names required " Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 015/188] media: chips-media: wave5: fix a potential memory leak in wave5_vdi_init() Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 016/188] media: chips-media: wave5: add missing spinlock protection for send_eos_event() Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 017/188] media: chips-media: wave5: add missing spinlock protection for handle_dynamic_resolution_change() Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 018/188] drm/gpusvm: Force unmapping on error in drm_gpusvm_get_pages Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 019/188] spi: bcm63xx: fix controller deregistration Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 020/188] spi: atmel: " Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 021/188] arm64: dts: lx2160a-cex7/lx2162a-sr-som: fix usd-cd & gpio pinmux Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 022/188] staging: media: atomisp: Disallow all private IOCTLs Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 023/188] regulator: mt6357: fix OF node reference imbalance Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 024/188] spi: st-ssc4: fix controller deregistration Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 025/188] regulator: max77650: fix OF node reference imbalance Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 026/188] media: rc: xbox_remote: heed DMA restrictions Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 027/188] media: rc: streamzap: Error handling in probe Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 028/188] media: i2c: imx283: Enter full standby when stopping streaming Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 029/188] regulator: bq257xx: fix OF node reference imbalance Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 030/188] regulator: rk808: " Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 031/188] media: videobuf2: Set vma_flags in vb2_dma_sg_mmap Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 032/188] media: intel/ipu6: fix error pointer dereference Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 033/188] media: i2c: imx283: Fix hang when going from large to small resolution Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 034/188] regulator: act8945a: fix OF node reference imbalance Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 035/188] regulator: s2dos05: " Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 036/188] regulator: bd9571mwv: " Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 037/188] spi: lantiq-ssc: fix controller deregistration Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 038/188] spi: meson-spicc: " Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 039/188] spi: qup: " Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 040/188] spi: at91-usart: " Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 041/188] media: saa7164: add ioremap return checks and cleanups Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 042/188] spi: amlogic-spisg: fix controller deregistration Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 043/188] spi: aspeed-smc: " Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 044/188] platform/x86: hp-wmi: Ignore backlight and FnLock events Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 045/188] vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to copy Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 046/188] arm64: dts: broadcom: bcm2712-d-rpi-5-b: add fixes for pinctrl/pinctrl_aon Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 047/188] arm64: dts: broadcom: bcm2712-d-rpi-5-b: update uart10 interrupt Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 048/188] media: pci: zoran: fix potential memory leak in zoran_probe() Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 049/188] media: dib8000: avoid division by 0 in dib8000_set_dds() Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 050/188] media: i2c: imx412: Assert reset GPIO during probe Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 051/188] media: staging: imx: request mbus_config in csi_start Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 052/188] media: i2c: ov08d10: fix image vertical start setting Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 053/188] media: i2c: ov08d10: fix runtime PM handling in probe Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 054/188] media: omap3isp: drop the use count of v4l2 pipeline Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 055/188] media: iris: fix QCOM_MDT_LOADER dependency Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 056/188] media: iris: Fix use-after-free in iris_release_internal_buffers() Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 057/188] media: qcom: camss: Fix csid clock configuration for sa8775p Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 058/188] media: qcom: camss: Fix csid IRQ offset " Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 059/188] media: qcom: iris: increase H265D_MAX_SLICE to fix H.265 decoding on SC7280 Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 060/188] media: venus: fix QCOM_MDT_LOADER dependency Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 061/188] media: iris: Fix dma_free_attrs() size in iris_hfi_queues_init() Greg Kroah-Hartman
2026-05-15 15:47 ` [PATCH 6.18 062/188] media: qcom: camss: Add missing clocks for VFE lite on sa8775p Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 063/188] spi: mxs: fix controller deregistration Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 064/188] spi: mt65xx: " Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 065/188] spi: dln2: " Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 066/188] spi: s3c64xx: " Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 067/188] spi: fsl-espi: " Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 068/188] spi: omap2-mcspi: " Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 069/188] spi: pic32: " Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 070/188] spi: mtk-nor: " Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 071/188] spi: pl022: " Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 072/188] spi: ch341: fix devres lifetime Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 073/188] spi: sh-hspi: fix controller deregistration Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 074/188] spi: fsl: " Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 075/188] spi: bcmbca-hsspi: " Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 076/188] spi: coldfire-qspi: " Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 077/188] spi: npcm-pspi: " Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 078/188] spi: cavium-thunderx: " Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 079/188] spi: pic32-sqi: " Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 080/188] spi: sprd: " Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 081/188] spi: rspi: " Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 082/188] spi: sh-msiof: " Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 083/188] spi: slave-mt27xx: " Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 084/188] spi: img-spfi: " Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 085/188] spi: mpfs: " Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 086/188] spi: imx: fix runtime pm leak on probe deferral Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 087/188] spi: mxic: fix controller deregistration Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 088/188] spi: orion: " Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 089/188] spi: orion: fix runtime pm leak on unbind Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 090/188] spi: orion: fix clock imbalance on registration failure Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 091/188] spi: mpc52xx: fix use-after-free " Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 092/188] spi: mpc52xx: fix controller deregistration Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 093/188] spi: mpc52xx: fix use-after-free on unbind Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 094/188] spi: cadence: fix controller deregistration Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 095/188] spi: cadence: fix unclocked access on unbind Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 096/188] spi: cadence: fix clock imbalance on probe failure Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 097/188] drm/msm/gem: fix error handling in msm_ioctl_gem_info_get_metadata() Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 098/188] drm/imx: parallel-display: Prefer bus format set via legacy "interface-pix-fmt" DT property Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 099/188] drm/msm: always recover the gpu Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 100/188] drm/i915/psr: Init variable to avoid early exit from et alignment loop Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 101/188] drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 102/188] drm/amdgpu: Use SMUIO 15.0.0 offsets for TSC upper and lower count Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 103/188] drm/amdgpu: gate VM CPU HDP flush on reset lock Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 104/188] drm/amd/pm: fix incorrect FeatureCtrlMask setting on smu v14.0.x Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 105/188] drm/amdkfd: Add upper bound check for num_of_nodes Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 106/188] drm/amdgpu: Add bounds checking to ib_{get,set}_value Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 107/188] drm/amdgpu/vcn4: Prevent OOB reads when parsing IB Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 108/188] drm/amdgpu/vce: Prevent partial address patches Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 109/188] drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 110/188] drm/amdgpu/vcn3: " Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 111/188] drm/amd/display: Change dither policy for 10 bpc output back to dithering Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 112/188] drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 113/188] drm/appletbdrm: Use kvzalloc for big allocations Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 114/188] drm/amdkfd: validate SVM ioctl nattr against buffer size Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 115/188] drm/udl: Increase GET_URB_TIMEOUT Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 116/188] drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 117/188] drm/xe/bo: Fix bo leak on GGTT flag validation in xe_bo_init_locked() Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 118/188] drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 119/188] drm/xe/bo: Fix bo leak on unaligned size validation in xe_bo_init_locked() Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 120/188] drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 121/188] drm: Set old handle to NULL before prime swap in change_handle Greg Kroah-Hartman
2026-05-15 15:48 ` [PATCH 6.18 122/188] drm/radeon: add missing revision check for CI Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 123/188] drm/amdgpu: zero-initialize GART table on allocation Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 124/188] drm/exynos: remove bridge when component_add fails Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 125/188] drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 126/188] drm/amdgpu/gfx9: drop unnecessary 64-bit fence flag check in KIQ Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 127/188] drm/bridge: tda998x: Use __be32 for audio port OF property pointer Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 128/188] drm/panel: boe-tv101wum-nl6: restore MODE_LPM after sending disable cmds Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 129/188] drm/amdkfd: Make all TLB-flushes heavy-weight Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 130/188] drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 131/188] drm/amdgpu/pm: add missing revision check for CI Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 132/188] drm/amdgpu/pm: align Hawaii mclk workaround with radeon Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 133/188] arm64: dts: qcom: lemans: Correct QUP interrupt numbers Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 134/188] arm64: dts: ti: k3-am62a7-sk: Fix pin name in comment from M19 to N22 Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 135/188] sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 136/188] batman-adv: fix integer overflow on buff_pos Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 137/188] batman-adv: reject new tp_meter sessions during teardown Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 138/188] batman-adv: stop tp_meter sessions during mesh teardown Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 139/188] batman-adv: stop caching unowned originator pointers in BAT IV Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 140/188] batman-adv: bla: prevent use-after-free when deleting claims Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 141/188] batman-adv: bla: only purge non-released claims Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 142/188] batman-adv: bla: put backbone reference on failed claim hash insert Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 143/188] sched_ext: Use HK_TYPE_DOMAIN_BOOT to detect isolcpus= domain isolation Greg Kroah-Hartman
2026-05-16 0:48 ` Peter Schneider
2026-05-15 15:49 ` [PATCH 6.18 144/188] io_uring/zcrx: use guards for locking Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 145/188] io_uring/zcrx: warn on freelist violations Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 146/188] LoongArch: KVM: Compile switch.S directly into the kernel Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 147/188] mm/damon/core: implement damon_kdamond_pid() Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 148/188] mm/damon/lru_sort: detect and use fresh enabled and kdamond_pid values Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 149/188] mm/damon/reclaim: " Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 150/188] usb: typec: tcpm: reset internal port states on soft reset AMS Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 151/188] mm/damon/core: disallow time-quota setting zero esz Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 152/188] drm/amdgpu: validate the flush_gpu_tlb_pasid() Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 153/188] drm/amdgpu: Fix validating flush_gpu_tlb_pasid() Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 154/188] Revert "drm/amdgpu: dont attach the tlb fence for SI" Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 155/188] drm/amdgpu: rework how we handle TLB fences Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 156/188] fbcon: Rename struct fbcon_ops to struct fbcon_par Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 157/188] fbcon: Avoid OOB font access if console rotation fails Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 158/188] block: fix zone write plug removal Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 159/188] EDAC/versalnet: Fix device name memory leak Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 160/188] papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE() Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 161/188] pseries/papr-hvpipe: Fix race with interrupt handler Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 162/188] spi: uniphier: Simplify clock handling with devm_clk_get_enabled() Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 163/188] spi: uniphier: fix controller deregistration Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 164/188] spi: tegra20-sflash: " Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 165/188] spi: tegra114: " Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 166/188] spi: zynq-qspi: Simplify clock handling with devm_clk_get_enabled() Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 167/188] spi: zynq-qspi: fix controller deregistration Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 168/188] Bluetooth: hci_conn: fix potential UAF in create_big_sync Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 169/188] sched/ext: Implement cgroup_set_idle() callback Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 170/188] sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 171/188] usb: dwc3: Remove of dep->regs Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 172/188] usb: dwc3: Add dwc pointer to dwc3_readl/writel Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 173/188] usb: dwc3: Move GUID programming after PHY initialization Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 174/188] btrfs: remove fs_info argument from btrfs_sysfs_add_space_info_type() Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 175/188] btrfs: fix double free in create_space_info_sub_group() error path Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 176/188] btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 177/188] tracing: fprobe: use rhltable for fprobe_ip_table Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 178/188] tracing: fprobe: optimization for entry only case Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 179/188] tracing/fprobe: Unregister fprobe even if memory allocation fails Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 180/188] tracing/fprobe: Remove fprobe from hash in failure path Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 181/188] batman-adv: tp_meter: fix tp_num leak on kmalloc failure Greg Kroah-Hartman
2026-05-15 15:49 ` [PATCH 6.18 182/188] vsock: fix buffer size clamping order Greg Kroah-Hartman
2026-05-15 15:50 ` [PATCH 6.18 183/188] vsock/virtio: fix length and offset in tap skb for split packets Greg Kroah-Hartman
2026-05-15 15:50 ` [PATCH 6.18 184/188] vsock/virtio: fix empty payload in tap skb for non-linear buffers Greg Kroah-Hartman
2026-05-15 15:50 ` [PATCH 6.18 185/188] vsock/virtio: fix potential unbounded skb queue Greg Kroah-Hartman
2026-05-15 15:50 ` [PATCH 6.18 186/188] vsock/virtio: fix accept queue count leak on transport mismatch Greg Kroah-Hartman
2026-05-15 15:50 ` [PATCH 6.18 187/188] drm/amdgpu/vcn3: Avoid overflow on msg bound check Greg Kroah-Hartman
2026-05-15 15:50 ` [PATCH 6.18 188/188] drm/amdgpu/vcn4: " Greg Kroah-Hartman
2026-05-15 17:13 ` [PATCH 6.18 000/188] 6.18.32-rc1 review Wentao Guan
2026-05-15 20:24 ` Florian Fainelli
2026-05-15 22:13 ` Pavel Machek
2026-05-15 22:45 ` Shuah Khan
2026-05-16 2:04 ` Miguel Ojeda
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.