* [PATCH 6.16 000/143] 6.16.10-rc1 review
@ 2025-09-30 14:45 Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 001/143] scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE Greg Kroah-Hartman
` (154 more replies)
0 siblings, 155 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill
This is the start of the stable review cycle for the 6.16.10 release.
There are 143 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Thu, 02 Oct 2025 14:37:59 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.16.10-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.16.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 6.16.10-rc1
Jason Gunthorpe <jgg@ziepe.ca>
iommufd: Fix race during abort for file descriptors
Khairul Anuar Romli <khairul.anuar.romli@altera.com>
spi: cadence-qspi: defer runtime support on socfpga if reset bit is enabled
Khairul Anuar Romli <khairul.anuar.romli@altera.com>
spi: cadence-quadspi: Implement refcount to handle unbind during busy
Andrea Righi <arighi@nvidia.com>
sched_ext: idle: Handle migration-disabled tasks in BPF code
Andrea Righi <arighi@nvidia.com>
sched_ext: idle: Make local functions static in ext_idle.c
Johannes Berg <johannes.berg@intel.com>
wifi: iwlwifi: pcie: fix byte count table for some devices
Johannes Berg <johannes.berg@intel.com>
wifi: iwlwifi: fix byte count table for old devices
Thomas Zimmermann <tzimmermann@suse.de>
fbcon: Fix OOB access in font allocation
Samasth Norway Ananda <samasth.norway.ananda@oracle.com>
fbcon: fix integer overflow in fbcon_do_set_font
Akinobu Mita <akinobu.mita@gmail.com>
mm/damon/sysfs: do not ignore callback's return value in damon_sysfs_damon_call()
Jinjiang Tu <tujinjiang@huawei.com>
mm/hugetlb: fix folio is still mapped when deleted
Alexander Popov <alex.popov@linux.com>
x86/Kconfig: Reenable PTDUMP on i386
Thomas Gleixner <tglx@linutronix.de>
x86/topology: Implement topology_is_core_online() to address SMT regression
Alexandre Ghiti <alexghiti@rivosinc.com>
riscv: Use an atomic xchg in pudp_huge_get_and_clear()
Max Kellermann <max.kellermann@ionos.com>
netfs: fix reference leak
Eric Biggers <ebiggers@kernel.org>
kmsan: fix out-of-bounds access to shadow memory
Hans de Goede <hansg@kernel.org>
gpiolib: Extend software-node support to support secondary software-nodes
Jakub Acs <acsjakub@amazon.de>
fs/proc/task_mmu: check p->vec_buf for NULL
Zhen Ni <zhen.ni@easystack.cn>
afs: Fix potential null pointer dereference in afs_put_server
Jason Wang <jasowang@redhat.com>
vhost-net: flush batched before enabling notifications
Michael S. Tsirkin <mst@redhat.com>
Revert "vhost/net: Defer TX queue re-enable until after sendmsg"
Christian Marangi <ansuelsmth@gmail.com>
pinctrl: airoha: fix wrong MDIO function bitmaks
Christian Marangi <ansuelsmth@gmail.com>
pinctrl: airoha: fix wrong PHY LED mux value for LED1 GPIO46
Matthew Schwartz <matthew.schwartz@linux.dev>
drm/amd/display: Only restore backlight after amdgpu_dm_init or dm_resume
Nirmoy Das <nirmoyd@nvidia.com>
drm/ast: Use msleep instead of mdelay for edid read
Thomas Hellström <thomas.hellstrom@linux.intel.com>
drm/xe: Don't copy pinned kernel bos twice on suspend
Josua Mayer <josua@solid-run.com>
arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports
Josua Mayer <josua@solid-run.com>
arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes
Josua Mayer <josua@solid-run.com>
arm64: dts: marvell: cn913x-solidrun: fix sata ports status
Nobuhiro Iwamatsu <iwamatsu@nigauri.org>
ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address
Masami Hiramatsu (Google) <mhiramat@kernel.org>
tracing: fprobe: Fix to remove recorded module addresses from filter
Masami Hiramatsu (Google) <mhiramat@kernel.org>
tracing: fgraph: Protect return handler from recursion loop
Masami Hiramatsu (Google) <mhiramat@kernel.org>
tracing: dynevent: Add a missing lockdown check on dynevent
Eric Biggers <ebiggers@kernel.org>
crypto: af_alg - Fix incorrect boolean values in af_alg_ctx
Lukasz Czapnik <lukasz.czapnik@intel.com>
i40e: improve VF MAC filters accounting
Lukasz Czapnik <lukasz.czapnik@intel.com>
i40e: add mask to apply valid bits for itr_idx
Lukasz Czapnik <lukasz.czapnik@intel.com>
i40e: add max boundary check for VF filters
Lukasz Czapnik <lukasz.czapnik@intel.com>
i40e: fix validation of VF state in get resources
Lukasz Czapnik <lukasz.czapnik@intel.com>
i40e: fix input validation logic for action_meta
Lukasz Czapnik <lukasz.czapnik@intel.com>
i40e: fix idx validation in config queues msg
Lukasz Czapnik <lukasz.czapnik@intel.com>
i40e: fix idx validation in i40e_validate_queue_map
Lukasz Czapnik <lukasz.czapnik@intel.com>
i40e: add validation for ring_len param
Amit Chaudhari <amitchaudhari@mac.com>
HID: asus: add support for missing PX series fn keys
Xinpeng Sun <xinpeng.sun@intel.com>
HID: intel-thc-hid: intel-quickspi: Add WCL Device IDs
Wang Liang <wangliang74@huawei.com>
tracing/osnoise: Fix slab-out-of-bounds in _parse_integer_limit()
Sasha Levin <sashal@kernel.org>
Revert "drm/xe/guc: Enable extended CAT error reporting"
Sasha Levin <sashal@kernel.org>
Revert "drm/xe/guc: Set RCS/CCS yield policy"
Sang-Heon Jeon <ekffu200098@gmail.com>
smb: client: fix wrong index reference in smb2_compound_op()
Daniel Lee <dany97@live.ca>
platform/x86: lg-laptop: Fix WMAB call in fan_mode_store()
Adrián Larumbe <adrian.larumbe@collabora.com>
drm/panthor: Defer scheduler entitiy destruction to queue release
Sebastian Andrzej Siewior <bigeasy@linutronix.de>
futex: Use correct exit on failure from futex_hash_allocate_default()
Melissa Wen <mwen@igalia.com>
drm/amd/display: remove output_tf_change flag
Suraj Kandpal <suraj.kandpal@intel.com>
drm/i915/ddi: Guard reg_val against a INVALID_TRANSCODER
Lucas De Marchi <lucas.demarchi@intel.com>
drm/xe: Fix build with CONFIG_MODULES=n
Michal Wajdeczko <michal.wajdeczko@intel.com>
drm/xe/vf: Don't expose sysfs attributes not applicable for VFs
Ioana Ciornei <ioana.ciornei@nxp.com>
gpio: regmap: fix memory leak of gpio_regmap structure
Sebastian Andrzej Siewior <bigeasy@linutronix.de>
futex: Prevent use-after-free during requeue-PI
Zabelin Nikita <n.zabelin@mt-integration.ru>
drm/gma500: Fix null dereference in hdmi teardown
Dan Carpenter <dan.carpenter@linaro.org>
octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()
Vladimir Oltean <vladimir.oltean@nxp.com>
net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port
Vladimir Oltean <vladimir.oltean@nxp.com>
net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup()
Carolina Jubran <cjubran@nvidia.com>
net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD
Yevgeny Kliteynik <kliteyn@nvidia.com>
net/mlx5: HWS, ignore flow level for multi-dest table
Vlad Dogaru <vdogaru@nvidia.com>
net/mlx5: HWS, remove unused create_dest_array parameter
Moshe Shemesh <moshe@nvidia.com>
net/mlx5: fs, fix UAF in flow counter release
Ido Schimmel <idosch@nvidia.com>
selftests: fib_nexthops: Fix creation of non-FDB nexthops
Ido Schimmel <idosch@nvidia.com>
nexthop: Forbid FDB status change while nexthop is in a group
Jason Baron <jbaron@akamai.com>
net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS
Alok Tiwari <alok.a.tiwari@oracle.com>
bnxt_en: correct offset handling for IPv6 destination address
Jacob Keller <jacob.e.keller@intel.com>
broadcom: fix support for PTP_EXTTS_REQUEST2 ioctl
Jacob Keller <jacob.e.keller@intel.com>
broadcom: fix support for PTP_PEROUT_DUTY_CYCLE
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: MGMT: Fix possible UAFs
Sebastian Andrzej Siewior <bigeasy@linutronix.de>
vhost: Take a reference on the task in struct vhost_task.
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: hci_sync: Fix hci_resume_advertising_sync
Petr Malat <oss@malat.biz>
ethernet: rvu-af: Remove slash from the driver name
Sidraya Jayagond <sidraya@linux.ibm.com>
net/smc: fix warning in smc_rx_splice() when calling get_page()
Wang Liang <wangliang74@huawei.com>
net: tun: Update napi->skb after XDP process
Stéphane Grosjean <stephane.grosjean@hms-networks.com>
can: peak_usb: fix shift-out-of-bounds issue
Vincent Mailhol <mailhol@kernel.org>
can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
Vincent Mailhol <mailhol@kernel.org>
can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow
Vincent Mailhol <mailhol@kernel.org>
can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
Vincent Mailhol <mailhol@kernel.org>
can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow
Sabrina Dubroca <sd@queasysnail.net>
xfrm: fix offloading of cross-family tunnels
Sabrina Dubroca <sd@queasysnail.net>
xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
Leon Hwang <leon.hwang@linux.dev>
selftests/bpf: Skip timer cases when bpf_timer is not supported
Leon Hwang <leon.hwang@linux.dev>
bpf: Reject bpf_timer for PREEMPT_RT
Geert Uytterhoeven <geert+renesas@glider.be>
can: rcar_can: rcar_can_resume(): fix s2ram with PSCI
James Guan <guan_yufei@163.com>
wifi: virt_wifi: Fix page fault on connect
Yifan Zhang <yifan1.zhang@amd.com>
amd/amdkfd: correct mem limit calculation for small APUs
Eric Huang <jinhuieric.huang@amd.com>
drm/amdkfd: fix p2p links bug in topology
Trond Myklebust <trond.myklebust@hammerspace.com>
NFSv4.2: Protect copy offload and clone against 'eof page pollution'
Trond Myklebust <trond.myklebust@hammerspace.com>
NFS: Protect against 'eof page pollution'
Mark Harmstone <mark@harmstone.com>
btrfs: don't allow adding block device of less than 1 MB
Xing Guo <higuoxing@gmail.com>
selftests/fs/mount-notify: Fix compilation failure.
Jiri Olsa <olsajiri@gmail.com>
bpf: Check the helper function is valid in get_helper_proto
Stefan Metzmacher <metze@samba.org>
smb: server: use disable_work_sync in transport_rdma.c
Stefan Metzmacher <metze@samba.org>
smb: server: don't use delayed_work for post_recv_credits_work
Christian Loehle <christian.loehle@arm.com>
cpufreq: Initialize cpufreq-based invariance before subsys
Jihed Chaibi <jihed.chaibi.dev@gmail.com>
ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients
Peng Fan <peng.fan@nxp.com>
arm64: dts: imx8mp: Correct thermal sensor index
Peng Fan <peng.fan@nxp.com>
firmware: imx: Add stub functions for SCMI CPU API
Peng Fan <peng.fan@nxp.com>
firmware: imx: Add stub functions for SCMI LMM API
Peng Fan <peng.fan@nxp.com>
firmware: imx: Add stub functions for SCMI MISC API
Jimmy Hon <honyuenkwun@gmail.com>
arm64: dts: rockchip: Fix the headphone detection on the orangepi 5
Basavaraj Natikar <Basavaraj.Natikar@amd.com>
HID: amd_sfh: Add sync across amd sfh work functions
Sébastien Szymanski <sebastien.szymanski@armadeus.com>
HID: cp2112: fix setter callbacks return value
Or Har-Toov <ohartoov@nvidia.com>
IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions
Aleksander Jan Bajkowski <olek2@wp.pl>
net: sfp: add quirk for FLYPRO copper SFP+ module
qaqland <anguoli@uniontech.com>
ALSA: usb-audio: Add mute TLV for playback volumes on more devices
Cryolitia PukNgae <cryolitia@uniontech.com>
ALSA: usb-audio: move mixer_quirks' min_mute into common quirk
Mario Limonciello (AMD) <superm1@kernel.org>
gpiolib: acpi: Add quirk for ASUS ProArt PX13
noble.yang <noble.yang@comtrue-inc.com>
ALSA: usb-audio: Add DSD support for Comtrue USB Audio device
Antheas Kapenekakis <lkml@antheas.dev>
platform/x86: oxpec: Add support for OneXPlayer X1 Mini Pro (Strix Point)
Balamurugan C <balamurugan.c@intel.com>
ASoC: Intel: sof_rt5682: Add HDMI-In capture with rt5682 support for PTL.
Balamurugan C <balamurugan.c@intel.com>
ASoC: Intel: soc-acpi: Add entry for HDMI_In capture support in PTL match table
Balamurugan C <balamurugan.c@intel.com>
ASoC: Intel: soc-acpi: Add entry for sof_es8336 in PTL match table.
Heikki Krogerus <heikki.krogerus@linux.intel.com>
i2c: designware: Add quirk for Intel Xe
Benoît Monin <benoit.monin@bootlin.com>
mmc: sdhci-cadence: add Mobileye eyeQ support
Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com>
drm/panfrost: Add support for Mali on the MT8370 SoC
Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com>
drm/panfrost: Commonize Mediatek power domain array definitions
Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com>
drm/panfrost: Drop duplicated Mediatek supplies arrays
Chris Morgan <macromorgan@hotmail.com>
net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick
Marc Kleine-Budde <mkl@pengutronix.de>
net: fec: rename struct fec_devinfo fec_imx6x_info -> fec_imx6sx_info
Jiayi Li <lijiayi@kylinos.cn>
usb: core: Add 0x prefix to quirks debug output
Takashi Iwai <tiwai@suse.de>
ALSA: usb-audio: Fix build with CONFIG_INPUT=n
Stefan Binding <sbinding@opensource.cirrus.com>
ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA
Chen Ni <nichen@iscas.ac.cn>
ALSA: usb-audio: Convert comma to semicolon
Kerem Karabay <kekrby@gmail.com>
HID: multitouch: specify that Apple Touch Bar is direct
Kerem Karabay <kekrby@gmail.com>
HID: multitouch: take cls->maxcontacts into account for Apple Touch Bar even without a HID_DG_CONTACTMAX field
Kerem Karabay <kekrby@gmail.com>
HID: multitouch: support getting the tip state from HID_DG_TOUCH fields in Apple Touch Bar
Kerem Karabay <kekrby@gmail.com>
HID: multitouch: Get the contact ID from HID_DG_TRANSDUCER_INDEX fields in case of Apple Touch Bar
Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5
Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks
Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
ALSA: usb-audio: Simplify NULL comparison in mixer_quirks
Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
ALSA: usb-audio: Avoid multiple assignments in mixer_quirks
Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks
Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
ALSA: usb-audio: Fix block comments in mixer_quirks
Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
ALSA: usb-audio: Fix whitespace & blank line issues in mixer_quirks
Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
ALSA: usb-audio: Fix code alignment in mixer_quirks
Takashi Sakamoto <o-takashi@sakamocchi.jp>
firewire: core: fix overlooked update of subsystem ABI version
Alok Tiwari <alok.a.tiwari@oracle.com>
scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE
-------------
Diffstat:
Documentation/admin-guide/laptops/lg-laptop.rst | 4 +-
Makefile | 4 +-
.../dts/intel/socfpga/socfpga_cyclone5_sodia.dts | 6 +-
.../boot/dts/marvell/kirkwood-openrd-client.dts | 2 +-
arch/arm64/boot/dts/freescale/imx8mp.dtsi | 4 +-
arch/arm64/boot/dts/marvell/cn9130-cf.dtsi | 7 +-
arch/arm64/boot/dts/marvell/cn9131-cf-solidwan.dts | 6 +-
arch/arm64/boot/dts/marvell/cn9132-clearfog.dts | 22 +-
arch/arm64/boot/dts/marvell/cn9132-sr-cex7.dtsi | 8 +
.../boot/dts/rockchip/rk3588s-orangepi-5.dtsi | 3 +-
arch/riscv/include/asm/pgtable.h | 17 +
arch/x86/Kconfig | 2 +-
arch/x86/include/asm/topology.h | 10 +
arch/x86/kernel/cpu/topology.c | 13 +
drivers/cpufreq/cpufreq.c | 20 +-
drivers/firewire/core-cdev.c | 2 +-
drivers/gpio/gpio-regmap.c | 2 +-
drivers/gpio/gpiolib-acpi-quirks.c | 14 +
drivers/gpio/gpiolib.c | 21 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 44 +-
drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 3 +-
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 12 +-
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 7 +
drivers/gpu/drm/amd/display/dc/dc.h | 1 -
.../drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 6 +-
.../drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 6 +-
drivers/gpu/drm/ast/ast_dp.c | 2 +-
drivers/gpu/drm/gma500/oaktrail_hdmi.c | 2 +-
drivers/gpu/drm/i915/display/intel_ddi.c | 5 +-
drivers/gpu/drm/panfrost/panfrost_drv.c | 61 ++-
drivers/gpu/drm/panthor/panthor_sched.c | 8 +-
drivers/gpu/drm/xe/abi/guc_actions_abi.h | 5 -
drivers/gpu/drm/xe/abi/guc_klvs_abi.h | 40 --
drivers/gpu/drm/xe/xe_bo_evict.c | 4 +-
drivers/gpu/drm/xe/xe_configfs.c | 2 +-
drivers/gpu/drm/xe/xe_device_sysfs.c | 2 +-
drivers/gpu/drm/xe/xe_gt.c | 3 +-
drivers/gpu/drm/xe/xe_guc.c | 62 +--
drivers/gpu/drm/xe/xe_guc.h | 1 -
drivers/gpu/drm/xe/xe_guc_submit.c | 87 +---
drivers/gpu/drm/xe/xe_guc_submit.h | 2 -
drivers/gpu/drm/xe/xe_uc.c | 4 -
drivers/hid/amd-sfh-hid/amd_sfh_client.c | 12 +-
drivers/hid/amd-sfh-hid/amd_sfh_common.h | 3 +
drivers/hid/amd-sfh-hid/amd_sfh_pcie.c | 4 +
drivers/hid/hid-asus.c | 3 +
drivers/hid/hid-cp2112.c | 10 +-
drivers/hid/hid-multitouch.c | 45 +-
.../intel-thc-hid/intel-quickspi/pci-quickspi.c | 2 +
.../intel-thc-hid/intel-quickspi/quickspi-dev.h | 2 +
drivers/i2c/busses/i2c-designware-platdrv.c | 7 +-
drivers/infiniband/hw/mlx5/devx.c | 1 +
drivers/iommu/iommufd/eventq.c | 9 +-
drivers/iommu/iommufd/main.c | 35 +-
drivers/mmc/host/sdhci-cadence.c | 11 +
drivers/net/can/rcar/rcar_can.c | 8 +-
drivers/net/can/spi/hi311x.c | 1 +
drivers/net/can/sun4i_can.c | 1 +
drivers/net/can/usb/etas_es58x/es58x_core.c | 3 +-
drivers/net/can/usb/mcba_usb.c | 1 +
drivers/net/can/usb/peak_usb/pcan_usb_core.c | 2 +-
drivers/net/dsa/lantiq_gswip.c | 21 +-
drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c | 2 +-
drivers/net/ethernet/freescale/fec_main.c | 4 +-
drivers/net/ethernet/intel/i40e/i40e.h | 3 +-
drivers/net/ethernet/intel/i40e/i40e_main.c | 26 +-
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 110 ++--
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h | 3 +-
drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 3 +-
.../net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 2 +-
drivers/net/ethernet/mellanox/mlx5/core/en_stats.c | 1 +
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 2 +-
drivers/net/ethernet/mellanox/mlx5/core/fs_core.h | 1 +
.../net/ethernet/mellanox/mlx5/core/fs_counters.c | 25 +-
.../mellanox/mlx5/core/steering/hws/action.c | 7 +-
.../mellanox/mlx5/core/steering/hws/fs_hws.c | 18 +-
.../mellanox/mlx5/core/steering/hws/fs_hws_pools.c | 8 +-
.../mellanox/mlx5/core/steering/hws/mlx5hws.h | 7 +-
drivers/net/phy/bcm-phy-ptp.c | 6 +-
drivers/net/phy/sfp.c | 24 +-
drivers/net/tun.c | 3 +
drivers/net/wireless/intel/iwlwifi/pcie/tx.c | 3 +-
drivers/net/wireless/virtual/virt_wifi.c | 4 +-
drivers/pinctrl/mediatek/pinctrl-airoha.c | 31 +-
drivers/platform/x86/lg-laptop.c | 34 +-
drivers/platform/x86/oxpec.c | 7 +
drivers/spi/spi-cadence-quadspi.c | 90 +++-
drivers/ufs/core/ufs-mcq.c | 4 +-
drivers/usb/core/quirks.c | 2 +-
drivers/vhost/net.c | 33 +-
drivers/video/fbdev/core/fbcon.c | 13 +-
fs/afs/server.c | 3 +-
fs/btrfs/volumes.c | 5 +
fs/hugetlbfs/inode.c | 10 +-
fs/netfs/buffered_read.c | 10 +-
fs/netfs/direct_read.c | 7 +-
fs/netfs/direct_write.c | 6 +-
fs/netfs/internal.h | 1 +
fs/netfs/objects.c | 30 +-
fs/netfs/read_pgpriv2.c | 2 +-
fs/netfs/read_single.c | 2 +-
fs/netfs/write_issue.c | 3 +-
fs/nfs/file.c | 33 ++
fs/nfs/inode.c | 9 +-
fs/nfs/internal.h | 2 +
fs/nfs/nfs42proc.c | 33 +-
fs/nfs/nfstrace.h | 1 +
fs/proc/task_mmu.c | 3 +
fs/smb/client/smb2inode.c | 2 +-
fs/smb/server/transport_rdma.c | 22 +-
include/crypto/if_alg.h | 2 +-
include/linux/firmware/imx/sm.h | 47 ++
include/linux/mlx5/fs.h | 2 +
include/net/bluetooth/hci_core.h | 21 +
kernel/bpf/core.c | 5 +-
kernel/bpf/verifier.c | 6 +-
kernel/fork.c | 2 +-
kernel/futex/requeue.c | 6 +-
kernel/sched/ext_idle.c | 52 +-
kernel/sched/ext_idle.h | 7 -
kernel/trace/fgraph.c | 12 +
kernel/trace/fprobe.c | 7 +-
kernel/trace/trace_dynevent.c | 4 +
kernel/trace/trace_osnoise.c | 3 +-
kernel/vhost_task.c | 3 +-
mm/damon/sysfs.c | 4 +-
mm/kmsan/core.c | 10 +-
mm/kmsan/kmsan_test.c | 16 +
net/bluetooth/hci_event.c | 30 +-
net/bluetooth/hci_sync.c | 7 +
net/bluetooth/mgmt.c | 259 +++++++---
net/bluetooth/mgmt_util.c | 46 ++
net/bluetooth/mgmt_util.h | 3 +
net/core/skbuff.c | 2 +-
net/ipv4/nexthop.c | 7 +
net/smc/smc_loopback.c | 14 +-
net/xfrm/xfrm_device.c | 2 +-
net/xfrm/xfrm_state.c | 3 +
sound/pci/hda/patch_realtek.c | 11 +
sound/soc/intel/boards/sof_es8336.c | 10 +
sound/soc/intel/boards/sof_rt5682.c | 7 +
sound/soc/intel/common/soc-acpi-intel-ptl-match.c | 32 ++
sound/usb/mixer_quirks.c | 571 +++++++++++++++------
sound/usb/quirks.c | 24 +-
sound/usb/usbaudio.h | 4 +
.../testing/selftests/bpf/prog_tests/free_timer.c | 4 +
tools/testing/selftests/bpf/prog_tests/timer.c | 4 +
.../testing/selftests/bpf/prog_tests/timer_crash.c | 4 +
.../selftests/bpf/prog_tests/timer_lockup.c | 4 +
tools/testing/selftests/bpf/prog_tests/timer_mim.c | 4 +
.../filesystems/mount-notify/mount-notify_test.c | 17 +-
.../mount-notify/mount-notify_test_ns.c | 18 +-
tools/testing/selftests/net/fib_nexthops.sh | 12 +-
153 files changed, 1833 insertions(+), 852 deletions(-)
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 001/143] scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 002/143] firewire: core: fix overlooked update of subsystem ABI version Greg Kroah-Hartman
` (153 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alok Tiwari, Alim Akhtar,
Manivannan Sadhasivam, Peter Wang, Martin K. Petersen,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <alok.a.tiwari@oracle.com>
[ Upstream commit 5cb782ff3c62c837e4984b6ae9f5d9a423cd5088 ]
Previous checks incorrectly tested the DMA addresses (dma_handle) for
NULL. Since dma_alloc_coherent() returns the CPU (virtual) address, the
NULL check should be performed on the *_base_addr pointer to correctly
detect allocation failures.
Update the checks to validate sqe_base_addr and cqe_base_addr instead of
sqe_dma_addr and cqe_dma_addr.
Fixes: 4682abfae2eb ("scsi: ufs: core: mcq: Allocate memory for MCQ mode")
Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Reviewed-by: Alim Akhtar <alim.akhtar@samsung.com>
Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Peter Wang <peter.wang@mediatek.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ufs/core/ufs-mcq.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/ufs/core/ufs-mcq.c b/drivers/ufs/core/ufs-mcq.c
index 1e50675772feb..cc88aaa106da3 100644
--- a/drivers/ufs/core/ufs-mcq.c
+++ b/drivers/ufs/core/ufs-mcq.c
@@ -243,7 +243,7 @@ int ufshcd_mcq_memory_alloc(struct ufs_hba *hba)
hwq->sqe_base_addr = dmam_alloc_coherent(hba->dev, utrdl_size,
&hwq->sqe_dma_addr,
GFP_KERNEL);
- if (!hwq->sqe_dma_addr) {
+ if (!hwq->sqe_base_addr) {
dev_err(hba->dev, "SQE allocation failed\n");
return -ENOMEM;
}
@@ -252,7 +252,7 @@ int ufshcd_mcq_memory_alloc(struct ufs_hba *hba)
hwq->cqe_base_addr = dmam_alloc_coherent(hba->dev, cqe_size,
&hwq->cqe_dma_addr,
GFP_KERNEL);
- if (!hwq->cqe_dma_addr) {
+ if (!hwq->cqe_base_addr) {
dev_err(hba->dev, "CQE allocation failed\n");
return -ENOMEM;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 002/143] firewire: core: fix overlooked update of subsystem ABI version
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 001/143] scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 003/143] ALSA: usb-audio: Fix code alignment in mixer_quirks Greg Kroah-Hartman
` (152 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Takashi Sakamoto, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
[ Upstream commit 853a57ba263adfecf4430b936d6862bc475b4bb5 ]
In kernel v6.5, several functions were added to the cdev layer. This
required updating the default version of subsystem ABI up to 6, but
this requirement was overlooked.
This commit updates the version accordingly.
Fixes: 6add87e9764d ("firewire: cdev: add new version of ABI to notify time stamp at request/response subaction of transaction#")
Link: https://lore.kernel.org/r/20250920025148.163402-1-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firewire/core-cdev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
index bd04980009a46..6a81c3fd4c860 100644
--- a/drivers/firewire/core-cdev.c
+++ b/drivers/firewire/core-cdev.c
@@ -41,7 +41,7 @@
/*
* ABI version history is documented in linux/firewire-cdev.h.
*/
-#define FW_CDEV_KERNEL_VERSION 5
+#define FW_CDEV_KERNEL_VERSION 6
#define FW_CDEV_VERSION_EVENT_REQUEST2 4
#define FW_CDEV_VERSION_ALLOCATE_REGION_END 4
#define FW_CDEV_VERSION_AUTO_FLUSH_ISO_OVERFLOW 5
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 003/143] ALSA: usb-audio: Fix code alignment in mixer_quirks
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 001/143] scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 002/143] firewire: core: fix overlooked update of subsystem ABI version Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 004/143] ALSA: usb-audio: Fix whitespace & blank line issues " Greg Kroah-Hartman
` (151 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cristian Ciocaltea, Takashi Iwai,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
[ Upstream commit bca638aa737d13749a871d1a0d2ed276501ffc54 ]
Format code to fix all alignment issues reported by checkpatch.pl:
CHECK: Alignment should match open parenthesis
Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20250526-dualsense-alsa-jack-v1-1-1a821463b632@collabora.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/mixer_quirks.c | 250 ++++++++++++++++++++-------------------
1 file changed, 127 insertions(+), 123 deletions(-)
diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index 9530c59b3cf4c..7f1e7a5fe8f0a 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -55,13 +55,13 @@ struct std_mono_table {
* version, we keep it mono for simplicity.
*/
static int snd_create_std_mono_ctl_offset(struct usb_mixer_interface *mixer,
- unsigned int unitid,
- unsigned int control,
- unsigned int cmask,
- int val_type,
- unsigned int idx_off,
- const char *name,
- snd_kcontrol_tlv_rw_t *tlv_callback)
+ unsigned int unitid,
+ unsigned int control,
+ unsigned int cmask,
+ int val_type,
+ unsigned int idx_off,
+ const char *name,
+ snd_kcontrol_tlv_rw_t *tlv_callback)
{
struct usb_mixer_elem_info *cval;
struct snd_kcontrol *kctl;
@@ -108,15 +108,16 @@ static int snd_create_std_mono_ctl_offset(struct usb_mixer_interface *mixer,
}
static int snd_create_std_mono_ctl(struct usb_mixer_interface *mixer,
- unsigned int unitid,
- unsigned int control,
- unsigned int cmask,
- int val_type,
- const char *name,
- snd_kcontrol_tlv_rw_t *tlv_callback)
+ unsigned int unitid,
+ unsigned int control,
+ unsigned int cmask,
+ int val_type,
+ const char *name,
+ snd_kcontrol_tlv_rw_t *tlv_callback)
{
return snd_create_std_mono_ctl_offset(mixer, unitid, control, cmask,
- val_type, 0 /* Offset */, name, tlv_callback);
+ val_type, 0 /* Offset */,
+ name, tlv_callback);
}
/*
@@ -129,7 +130,8 @@ static int snd_create_std_mono_table(struct usb_mixer_interface *mixer,
while (t->name != NULL) {
err = snd_create_std_mono_ctl(mixer, t->unitid, t->control,
- t->cmask, t->val_type, t->name, t->tlv_callback);
+ t->cmask, t->val_type, t->name,
+ t->tlv_callback);
if (err < 0)
return err;
t++;
@@ -214,7 +216,7 @@ static void snd_usb_soundblaster_remote_complete(struct urb *urb)
}
static long snd_usb_sbrc_hwdep_read(struct snd_hwdep *hw, char __user *buf,
- long count, loff_t *offset)
+ long count, loff_t *offset)
{
struct usb_mixer_interface *mixer = hw->private_data;
int err;
@@ -234,7 +236,7 @@ static long snd_usb_sbrc_hwdep_read(struct snd_hwdep *hw, char __user *buf,
}
static __poll_t snd_usb_sbrc_hwdep_poll(struct snd_hwdep *hw, struct file *file,
- poll_table *wait)
+ poll_table *wait)
{
struct usb_mixer_interface *mixer = hw->private_data;
@@ -310,20 +312,20 @@ static int snd_audigy2nx_led_update(struct usb_mixer_interface *mixer,
if (chip->usb_id == USB_ID(0x041e, 0x3042))
err = snd_usb_ctl_msg(chip->dev,
- usb_sndctrlpipe(chip->dev, 0), 0x24,
- USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_OTHER,
- !value, 0, NULL, 0);
+ usb_sndctrlpipe(chip->dev, 0), 0x24,
+ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_OTHER,
+ !value, 0, NULL, 0);
/* USB X-Fi S51 Pro */
if (chip->usb_id == USB_ID(0x041e, 0x30df))
err = snd_usb_ctl_msg(chip->dev,
- usb_sndctrlpipe(chip->dev, 0), 0x24,
- USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_OTHER,
- !value, 0, NULL, 0);
+ usb_sndctrlpipe(chip->dev, 0), 0x24,
+ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_OTHER,
+ !value, 0, NULL, 0);
else
err = snd_usb_ctl_msg(chip->dev,
- usb_sndctrlpipe(chip->dev, 0), 0x24,
- USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_OTHER,
- value, index + 2, NULL, 0);
+ usb_sndctrlpipe(chip->dev, 0), 0x24,
+ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_OTHER,
+ value, index + 2, NULL, 0);
snd_usb_unlock_shutdown(chip);
return err;
}
@@ -481,9 +483,9 @@ static int snd_emu0204_ch_switch_update(struct usb_mixer_interface *mixer,
buf[0] = 0x01;
buf[1] = value ? 0x02 : 0x01;
err = snd_usb_ctl_msg(chip->dev,
- usb_sndctrlpipe(chip->dev, 0), UAC_SET_CUR,
- USB_RECIP_INTERFACE | USB_TYPE_CLASS | USB_DIR_OUT,
- 0x0400, 0x0e00, buf, 2);
+ usb_sndctrlpipe(chip->dev, 0), UAC_SET_CUR,
+ USB_RECIP_INTERFACE | USB_TYPE_CLASS | USB_DIR_OUT,
+ 0x0400, 0x0e00, buf, 2);
snd_usb_unlock_shutdown(chip);
return err;
}
@@ -1021,7 +1023,7 @@ static int snd_nativeinstruments_create_mixer(struct usb_mixer_interface *mixer,
/* M-Audio FastTrack Ultra quirks */
/* FTU Effect switch (also used by C400/C600) */
static int snd_ftu_eff_switch_info(struct snd_kcontrol *kcontrol,
- struct snd_ctl_elem_info *uinfo)
+ struct snd_ctl_elem_info *uinfo)
{
static const char *const texts[8] = {
"Room 1", "Room 2", "Room 3", "Hall 1",
@@ -1055,7 +1057,7 @@ static int snd_ftu_eff_switch_init(struct usb_mixer_interface *mixer,
}
static int snd_ftu_eff_switch_get(struct snd_kcontrol *kctl,
- struct snd_ctl_elem_value *ucontrol)
+ struct snd_ctl_elem_value *ucontrol)
{
ucontrol->value.enumerated.item[0] = kctl->private_value >> 24;
return 0;
@@ -1086,7 +1088,7 @@ static int snd_ftu_eff_switch_update(struct usb_mixer_elem_list *list)
}
static int snd_ftu_eff_switch_put(struct snd_kcontrol *kctl,
- struct snd_ctl_elem_value *ucontrol)
+ struct snd_ctl_elem_value *ucontrol)
{
struct usb_mixer_elem_list *list = snd_kcontrol_chip(kctl);
unsigned int pval = list->kctl->private_value;
@@ -1104,7 +1106,7 @@ static int snd_ftu_eff_switch_put(struct snd_kcontrol *kctl,
}
static int snd_ftu_create_effect_switch(struct usb_mixer_interface *mixer,
- int validx, int bUnitID)
+ int validx, int bUnitID)
{
static struct snd_kcontrol_new template = {
.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
@@ -1143,22 +1145,22 @@ static int snd_ftu_create_volume_ctls(struct usb_mixer_interface *mixer)
for (in = 0; in < 8; in++) {
cmask = BIT(in);
snprintf(name, sizeof(name),
- "AIn%d - Out%d Capture Volume",
- in + 1, out + 1);
+ "AIn%d - Out%d Capture Volume",
+ in + 1, out + 1);
err = snd_create_std_mono_ctl(mixer, id, control,
- cmask, val_type, name,
- &snd_usb_mixer_vol_tlv);
+ cmask, val_type, name,
+ &snd_usb_mixer_vol_tlv);
if (err < 0)
return err;
}
for (in = 8; in < 16; in++) {
cmask = BIT(in);
snprintf(name, sizeof(name),
- "DIn%d - Out%d Playback Volume",
- in - 7, out + 1);
+ "DIn%d - Out%d Playback Volume",
+ in - 7, out + 1);
err = snd_create_std_mono_ctl(mixer, id, control,
- cmask, val_type, name,
- &snd_usb_mixer_vol_tlv);
+ cmask, val_type, name,
+ &snd_usb_mixer_vol_tlv);
if (err < 0)
return err;
}
@@ -1219,10 +1221,10 @@ static int snd_ftu_create_effect_return_ctls(struct usb_mixer_interface *mixer)
for (ch = 0; ch < 4; ++ch) {
cmask = BIT(ch);
snprintf(name, sizeof(name),
- "Effect Return %d Volume", ch + 1);
+ "Effect Return %d Volume", ch + 1);
err = snd_create_std_mono_ctl(mixer, id, control,
- cmask, val_type, name,
- snd_usb_mixer_vol_tlv);
+ cmask, val_type, name,
+ snd_usb_mixer_vol_tlv);
if (err < 0)
return err;
}
@@ -1243,20 +1245,20 @@ static int snd_ftu_create_effect_send_ctls(struct usb_mixer_interface *mixer)
for (ch = 0; ch < 8; ++ch) {
cmask = BIT(ch);
snprintf(name, sizeof(name),
- "Effect Send AIn%d Volume", ch + 1);
+ "Effect Send AIn%d Volume", ch + 1);
err = snd_create_std_mono_ctl(mixer, id, control, cmask,
- val_type, name,
- snd_usb_mixer_vol_tlv);
+ val_type, name,
+ snd_usb_mixer_vol_tlv);
if (err < 0)
return err;
}
for (ch = 8; ch < 16; ++ch) {
cmask = BIT(ch);
snprintf(name, sizeof(name),
- "Effect Send DIn%d Volume", ch - 7);
+ "Effect Send DIn%d Volume", ch - 7);
err = snd_create_std_mono_ctl(mixer, id, control, cmask,
- val_type, name,
- snd_usb_mixer_vol_tlv);
+ val_type, name,
+ snd_usb_mixer_vol_tlv);
if (err < 0)
return err;
}
@@ -1346,19 +1348,19 @@ static int snd_c400_create_vol_ctls(struct usb_mixer_interface *mixer)
for (out = 0; out < num_outs; out++) {
if (chan < num_outs) {
snprintf(name, sizeof(name),
- "PCM%d-Out%d Playback Volume",
- chan + 1, out + 1);
+ "PCM%d-Out%d Playback Volume",
+ chan + 1, out + 1);
} else {
snprintf(name, sizeof(name),
- "In%d-Out%d Playback Volume",
- chan - num_outs + 1, out + 1);
+ "In%d-Out%d Playback Volume",
+ chan - num_outs + 1, out + 1);
}
cmask = (out == 0) ? 0 : BIT(out - 1);
offset = chan * num_outs;
err = snd_create_std_mono_ctl_offset(mixer, id, control,
- cmask, val_type, offset, name,
- &snd_usb_mixer_vol_tlv);
+ cmask, val_type, offset, name,
+ &snd_usb_mixer_vol_tlv);
if (err < 0)
return err;
}
@@ -1377,7 +1379,7 @@ static int snd_c400_create_effect_volume_ctl(struct usb_mixer_interface *mixer)
const unsigned int cmask = 0;
return snd_create_std_mono_ctl(mixer, id, control, cmask, val_type,
- name, snd_usb_mixer_vol_tlv);
+ name, snd_usb_mixer_vol_tlv);
}
/* This control needs a volume quirk, see mixer.c */
@@ -1390,7 +1392,7 @@ static int snd_c400_create_effect_duration_ctl(struct usb_mixer_interface *mixer
const unsigned int cmask = 0;
return snd_create_std_mono_ctl(mixer, id, control, cmask, val_type,
- name, snd_usb_mixer_vol_tlv);
+ name, snd_usb_mixer_vol_tlv);
}
/* This control needs a volume quirk, see mixer.c */
@@ -1403,7 +1405,7 @@ static int snd_c400_create_effect_feedback_ctl(struct usb_mixer_interface *mixer
const unsigned int cmask = 0;
return snd_create_std_mono_ctl(mixer, id, control, cmask, val_type,
- name, NULL);
+ name, NULL);
}
static int snd_c400_create_effect_vol_ctls(struct usb_mixer_interface *mixer)
@@ -1432,18 +1434,18 @@ static int snd_c400_create_effect_vol_ctls(struct usb_mixer_interface *mixer)
for (chan = 0; chan < num_outs + num_ins; chan++) {
if (chan < num_outs) {
snprintf(name, sizeof(name),
- "Effect Send DOut%d",
- chan + 1);
+ "Effect Send DOut%d",
+ chan + 1);
} else {
snprintf(name, sizeof(name),
- "Effect Send AIn%d",
- chan - num_outs + 1);
+ "Effect Send AIn%d",
+ chan - num_outs + 1);
}
cmask = (chan == 0) ? 0 : BIT(chan - 1);
err = snd_create_std_mono_ctl(mixer, id, control,
- cmask, val_type, name,
- &snd_usb_mixer_vol_tlv);
+ cmask, val_type, name,
+ &snd_usb_mixer_vol_tlv);
if (err < 0)
return err;
}
@@ -1478,14 +1480,14 @@ static int snd_c400_create_effect_ret_vol_ctls(struct usb_mixer_interface *mixer
for (chan = 0; chan < num_outs; chan++) {
snprintf(name, sizeof(name),
- "Effect Return %d",
- chan + 1);
+ "Effect Return %d",
+ chan + 1);
cmask = (chan == 0) ? 0 :
BIT(chan + (chan % 2) * num_outs - 1);
err = snd_create_std_mono_ctl_offset(mixer, id, control,
- cmask, val_type, offset, name,
- &snd_usb_mixer_vol_tlv);
+ cmask, val_type, offset, name,
+ &snd_usb_mixer_vol_tlv);
if (err < 0)
return err;
}
@@ -1626,7 +1628,7 @@ static const struct std_mono_table ebox44_table[] = {
*
*/
static int snd_microii_spdif_info(struct snd_kcontrol *kcontrol,
- struct snd_ctl_elem_info *uinfo)
+ struct snd_ctl_elem_info *uinfo)
{
uinfo->type = SNDRV_CTL_ELEM_TYPE_IEC958;
uinfo->count = 1;
@@ -1634,7 +1636,7 @@ static int snd_microii_spdif_info(struct snd_kcontrol *kcontrol,
}
static int snd_microii_spdif_default_get(struct snd_kcontrol *kcontrol,
- struct snd_ctl_elem_value *ucontrol)
+ struct snd_ctl_elem_value *ucontrol)
{
struct usb_mixer_elem_list *list = snd_kcontrol_chip(kcontrol);
struct snd_usb_audio *chip = list->mixer->chip;
@@ -1667,13 +1669,13 @@ static int snd_microii_spdif_default_get(struct snd_kcontrol *kcontrol,
ep = get_endpoint(alts, 0)->bEndpointAddress;
err = snd_usb_ctl_msg(chip->dev,
- usb_rcvctrlpipe(chip->dev, 0),
- UAC_GET_CUR,
- USB_TYPE_CLASS | USB_RECIP_ENDPOINT | USB_DIR_IN,
- UAC_EP_CS_ATTR_SAMPLE_RATE << 8,
- ep,
- data,
- sizeof(data));
+ usb_rcvctrlpipe(chip->dev, 0),
+ UAC_GET_CUR,
+ USB_TYPE_CLASS | USB_RECIP_ENDPOINT | USB_DIR_IN,
+ UAC_EP_CS_ATTR_SAMPLE_RATE << 8,
+ ep,
+ data,
+ sizeof(data));
if (err < 0)
goto end;
@@ -1700,26 +1702,26 @@ static int snd_microii_spdif_default_update(struct usb_mixer_elem_list *list)
reg = ((pval >> 4) & 0xf0) | (pval & 0x0f);
err = snd_usb_ctl_msg(chip->dev,
- usb_sndctrlpipe(chip->dev, 0),
- UAC_SET_CUR,
- USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_OTHER,
- reg,
- 2,
- NULL,
- 0);
+ usb_sndctrlpipe(chip->dev, 0),
+ UAC_SET_CUR,
+ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_OTHER,
+ reg,
+ 2,
+ NULL,
+ 0);
if (err < 0)
goto end;
reg = (pval & IEC958_AES0_NONAUDIO) ? 0xa0 : 0x20;
reg |= (pval >> 12) & 0x0f;
err = snd_usb_ctl_msg(chip->dev,
- usb_sndctrlpipe(chip->dev, 0),
- UAC_SET_CUR,
- USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_OTHER,
- reg,
- 3,
- NULL,
- 0);
+ usb_sndctrlpipe(chip->dev, 0),
+ UAC_SET_CUR,
+ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_OTHER,
+ reg,
+ 3,
+ NULL,
+ 0);
if (err < 0)
goto end;
@@ -1729,7 +1731,7 @@ static int snd_microii_spdif_default_update(struct usb_mixer_elem_list *list)
}
static int snd_microii_spdif_default_put(struct snd_kcontrol *kcontrol,
- struct snd_ctl_elem_value *ucontrol)
+ struct snd_ctl_elem_value *ucontrol)
{
struct usb_mixer_elem_list *list = snd_kcontrol_chip(kcontrol);
unsigned int pval, pval_old;
@@ -1756,7 +1758,7 @@ static int snd_microii_spdif_default_put(struct snd_kcontrol *kcontrol,
}
static int snd_microii_spdif_mask_get(struct snd_kcontrol *kcontrol,
- struct snd_ctl_elem_value *ucontrol)
+ struct snd_ctl_elem_value *ucontrol)
{
ucontrol->value.iec958.status[0] = 0x0f;
ucontrol->value.iec958.status[1] = 0xff;
@@ -1767,7 +1769,7 @@ static int snd_microii_spdif_mask_get(struct snd_kcontrol *kcontrol,
}
static int snd_microii_spdif_switch_get(struct snd_kcontrol *kcontrol,
- struct snd_ctl_elem_value *ucontrol)
+ struct snd_ctl_elem_value *ucontrol)
{
ucontrol->value.integer.value[0] = !(kcontrol->private_value & 0x02);
@@ -1785,20 +1787,20 @@ static int snd_microii_spdif_switch_update(struct usb_mixer_elem_list *list)
return err;
err = snd_usb_ctl_msg(chip->dev,
- usb_sndctrlpipe(chip->dev, 0),
- UAC_SET_CUR,
- USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_OTHER,
- reg,
- 9,
- NULL,
- 0);
+ usb_sndctrlpipe(chip->dev, 0),
+ UAC_SET_CUR,
+ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_OTHER,
+ reg,
+ 9,
+ NULL,
+ 0);
snd_usb_unlock_shutdown(chip);
return err;
}
static int snd_microii_spdif_switch_put(struct snd_kcontrol *kcontrol,
- struct snd_ctl_elem_value *ucontrol)
+ struct snd_ctl_elem_value *ucontrol)
{
struct usb_mixer_elem_list *list = snd_kcontrol_chip(kcontrol);
u8 reg;
@@ -1883,9 +1885,9 @@ static int snd_soundblaster_e1_switch_update(struct usb_mixer_interface *mixer,
if (err < 0)
return err;
err = snd_usb_ctl_msg(chip->dev,
- usb_sndctrlpipe(chip->dev, 0), HID_REQ_SET_REPORT,
- USB_TYPE_CLASS | USB_RECIP_INTERFACE | USB_DIR_OUT,
- 0x0202, 3, buff, 2);
+ usb_sndctrlpipe(chip->dev, 0), HID_REQ_SET_REPORT,
+ USB_TYPE_CLASS | USB_RECIP_INTERFACE | USB_DIR_OUT,
+ 0x0202, 3, buff, 2);
snd_usb_unlock_shutdown(chip);
return err;
}
@@ -3235,7 +3237,7 @@ static int snd_rme_digiface_enum_put(struct snd_kcontrol *kcontrol,
}
static int snd_rme_digiface_current_sync_get(struct snd_kcontrol *kcontrol,
- struct snd_ctl_elem_value *ucontrol)
+ struct snd_ctl_elem_value *ucontrol)
{
int ret = snd_rme_digiface_enum_get(kcontrol, ucontrol);
@@ -3918,7 +3920,7 @@ static const struct snd_djm_device snd_djm_devices[] = {
static int snd_djm_controls_info(struct snd_kcontrol *kctl,
- struct snd_ctl_elem_info *info)
+ struct snd_ctl_elem_info *info)
{
unsigned long private_value = kctl->private_value;
u8 device_idx = (private_value & SND_DJM_DEVICE_MASK) >> SND_DJM_DEVICE_SHIFT;
@@ -3937,8 +3939,8 @@ static int snd_djm_controls_info(struct snd_kcontrol *kctl,
info->value.enumerated.item = noptions - 1;
name = snd_djm_get_label(device_idx,
- ctl->options[info->value.enumerated.item],
- ctl->wIndex);
+ ctl->options[info->value.enumerated.item],
+ ctl->wIndex);
if (!name)
return -EINVAL;
@@ -3950,7 +3952,7 @@ static int snd_djm_controls_info(struct snd_kcontrol *kctl,
}
static int snd_djm_controls_update(struct usb_mixer_interface *mixer,
- u8 device_idx, u8 group, u16 value)
+ u8 device_idx, u8 group, u16 value)
{
int err;
const struct snd_djm_device *device = &snd_djm_devices[device_idx];
@@ -3962,13 +3964,13 @@ static int snd_djm_controls_update(struct usb_mixer_interface *mixer,
if (err)
return err;
- err = snd_usb_ctl_msg(
- mixer->chip->dev, usb_sndctrlpipe(mixer->chip->dev, 0),
- USB_REQ_SET_FEATURE,
- USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
- device->controls[group].options[value],
- device->controls[group].wIndex,
- NULL, 0);
+ err = snd_usb_ctl_msg(mixer->chip->dev,
+ usb_sndctrlpipe(mixer->chip->dev, 0),
+ USB_REQ_SET_FEATURE,
+ USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+ device->controls[group].options[value],
+ device->controls[group].wIndex,
+ NULL, 0);
snd_usb_unlock_shutdown(mixer->chip);
return err;
@@ -4009,7 +4011,7 @@ static int snd_djm_controls_resume(struct usb_mixer_elem_list *list)
}
static int snd_djm_controls_create(struct usb_mixer_interface *mixer,
- const u8 device_idx)
+ const u8 device_idx)
{
int err, i;
u16 value;
@@ -4028,10 +4030,10 @@ static int snd_djm_controls_create(struct usb_mixer_interface *mixer,
for (i = 0; i < device->ncontrols; i++) {
value = device->controls[i].default_value;
knew.name = device->controls[i].name;
- knew.private_value = (
+ knew.private_value =
((unsigned long)device_idx << SND_DJM_DEVICE_SHIFT) |
(i << SND_DJM_GROUP_SHIFT) |
- value);
+ value;
err = snd_djm_controls_update(mixer, device_idx, i, value);
if (err)
return err;
@@ -4098,13 +4100,15 @@ int snd_usb_mixer_apply_create_quirk(struct usb_mixer_interface *mixer)
break;
case USB_ID(0x17cc, 0x1011): /* Traktor Audio 6 */
- err = snd_nativeinstruments_create_mixer(mixer,
+ err = snd_nativeinstruments_create_mixer(/* checkpatch hack */
+ mixer,
snd_nativeinstruments_ta6_mixers,
ARRAY_SIZE(snd_nativeinstruments_ta6_mixers));
break;
case USB_ID(0x17cc, 0x1021): /* Traktor Audio 10 */
- err = snd_nativeinstruments_create_mixer(mixer,
+ err = snd_nativeinstruments_create_mixer(/* checkpatch hack */
+ mixer,
snd_nativeinstruments_ta10_mixers,
ARRAY_SIZE(snd_nativeinstruments_ta10_mixers));
break;
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 004/143] ALSA: usb-audio: Fix whitespace & blank line issues in mixer_quirks
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2025-09-30 14:45 ` [PATCH 6.16 003/143] ALSA: usb-audio: Fix code alignment in mixer_quirks Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 005/143] ALSA: usb-audio: Fix block comments " Greg Kroah-Hartman
` (150 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cristian Ciocaltea, Takashi Iwai,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
[ Upstream commit df6b4dcf2e2c3b4e34c3213a575c92d0c9415d0d ]
Address all whitespace & blank line(s) related issues reported by
checkpatch.pl:
ERROR: trailing whitespace
ERROR: space required after that ',' (ctx:VxV)
WARNING: Missing a blank line after declarations
CHECK: Please use a blank line after function/struct/union/enum declarations
CHECK: Please don't use multiple blank lines
Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20250526-dualsense-alsa-jack-v1-2-1a821463b632@collabora.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/mixer_quirks.c | 26 +++++++++++---------------
1 file changed, 11 insertions(+), 15 deletions(-)
diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index 7f1e7a5fe8f0a..0aad92cb33276 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -287,7 +287,7 @@ static int snd_usb_soundblaster_remote_init(struct usb_mixer_interface *mixer)
mixer->rc_setup_packet->wLength = cpu_to_le16(len);
usb_fill_control_urb(mixer->rc_urb, mixer->chip->dev,
usb_rcvctrlpipe(mixer->chip->dev, 0),
- (u8*)mixer->rc_setup_packet, mixer->rc_buffer, len,
+ (u8 *)mixer->rc_setup_packet, mixer->rc_buffer, len,
snd_usb_soundblaster_remote_complete, mixer);
return 0;
}
@@ -389,7 +389,7 @@ static int snd_audigy2nx_controls_create(struct usb_mixer_interface *mixer)
mixer->chip->usb_id == USB_ID(0x041e, 0x3042) ||
mixer->chip->usb_id == USB_ID(0x041e, 0x30df) ||
mixer->chip->usb_id == USB_ID(0x041e, 0x3048)))
- break;
+ break;
knew = snd_audigy2nx_control;
knew.name = snd_audigy2nx_led_names[i];
@@ -858,6 +858,7 @@ static const struct snd_kcontrol_new snd_mbox1_src_switch = {
static int snd_mbox1_controls_create(struct usb_mixer_interface *mixer)
{
int err;
+
err = add_single_ctl_with_resume(mixer, 0,
snd_mbox1_clk_switch_resume,
&snd_mbox1_clk_switch, NULL);
@@ -871,7 +872,7 @@ static int snd_mbox1_controls_create(struct usb_mixer_interface *mixer)
/* Native Instruments device quirks */
-#define _MAKE_NI_CONTROL(bRequest,wIndex) ((bRequest) << 16 | (wIndex))
+#define _MAKE_NI_CONTROL(bRequest, wIndex) ((bRequest) << 16 | (wIndex))
static int snd_ni_control_init_val(struct usb_mixer_interface *mixer,
struct snd_kcontrol *kctl)
@@ -2183,6 +2184,7 @@ static const u32 snd_rme_rate_table[] = {
256000, 352800, 384000, 400000,
512000, 705600, 768000, 800000
};
+
/* maximum number of items for AES and S/PDIF rates for above table */
#define SND_RME_RATE_IDX_AES_SPDIF_NUM 12
@@ -3271,7 +3273,6 @@ static int snd_rme_digiface_sync_state_get(struct snd_kcontrol *kcontrol,
return 0;
}
-
static int snd_rme_digiface_format_info(struct snd_kcontrol *kcontrol,
struct snd_ctl_elem_info *uinfo)
{
@@ -3283,7 +3284,6 @@ static int snd_rme_digiface_format_info(struct snd_kcontrol *kcontrol,
ARRAY_SIZE(format), format);
}
-
static int snd_rme_digiface_sync_source_info(struct snd_kcontrol *kcontrol,
struct snd_ctl_elem_info *uinfo)
{
@@ -3566,7 +3566,6 @@ static int snd_rme_digiface_controls_create(struct usb_mixer_interface *mixer)
#define SND_DJM_A9_IDX 0x6
#define SND_DJM_V10_IDX 0x7
-
#define SND_DJM_CTL(_name, suffix, _default_value, _windex) { \
.name = _name, \
.options = snd_djm_opts_##suffix, \
@@ -3578,7 +3577,6 @@ static int snd_rme_digiface_controls_create(struct usb_mixer_interface *mixer)
.controls = snd_djm_ctls_##suffix, \
.ncontrols = ARRAY_SIZE(snd_djm_ctls_##suffix) }
-
struct snd_djm_device {
const char *name;
const struct snd_djm_ctl *controls;
@@ -3724,7 +3722,6 @@ static const struct snd_djm_ctl snd_djm_ctls_250mk2[] = {
SND_DJM_CTL("Output 3 Playback Switch", 250mk2_pb3, 2, SND_DJM_WINDEX_PB)
};
-
// DJM-450
static const u16 snd_djm_opts_450_cap1[] = {
0x0103, 0x0100, 0x0106, 0x0107, 0x0108, 0x0109, 0x010d, 0x010a };
@@ -3749,7 +3746,6 @@ static const struct snd_djm_ctl snd_djm_ctls_450[] = {
SND_DJM_CTL("Output 3 Playback Switch", 450_pb3, 2, SND_DJM_WINDEX_PB)
};
-
// DJM-750
static const u16 snd_djm_opts_750_cap1[] = {
0x0101, 0x0103, 0x0106, 0x0107, 0x0108, 0x0109, 0x010a, 0x010f };
@@ -3768,7 +3764,6 @@ static const struct snd_djm_ctl snd_djm_ctls_750[] = {
SND_DJM_CTL("Input 4 Capture Switch", 750_cap4, 0, SND_DJM_WINDEX_CAP)
};
-
// DJM-850
static const u16 snd_djm_opts_850_cap1[] = {
0x0100, 0x0103, 0x0106, 0x0107, 0x0108, 0x0109, 0x010a, 0x010f };
@@ -3787,7 +3782,6 @@ static const struct snd_djm_ctl snd_djm_ctls_850[] = {
SND_DJM_CTL("Input 4 Capture Switch", 850_cap4, 1, SND_DJM_WINDEX_CAP)
};
-
// DJM-900NXS2
static const u16 snd_djm_opts_900nxs2_cap1[] = {
0x0100, 0x0102, 0x0103, 0x0106, 0x0107, 0x0108, 0x0109, 0x010a };
@@ -3825,7 +3819,6 @@ static const u16 snd_djm_opts_750mk2_pb1[] = { 0x0100, 0x0101, 0x0104 };
static const u16 snd_djm_opts_750mk2_pb2[] = { 0x0200, 0x0201, 0x0204 };
static const u16 snd_djm_opts_750mk2_pb3[] = { 0x0300, 0x0301, 0x0304 };
-
static const struct snd_djm_ctl snd_djm_ctls_750mk2[] = {
SND_DJM_CTL("Master Input Level Capture Switch", cap_level, 0, SND_DJM_WINDEX_CAPLVL),
SND_DJM_CTL("Input 1 Capture Switch", 750mk2_cap1, 2, SND_DJM_WINDEX_CAP),
@@ -3838,7 +3831,6 @@ static const struct snd_djm_ctl snd_djm_ctls_750mk2[] = {
SND_DJM_CTL("Output 3 Playback Switch", 750mk2_pb3, 2, SND_DJM_WINDEX_PB)
};
-
// DJM-A9
static const u16 snd_djm_opts_a9_cap_level[] = {
0x0000, 0x0100, 0x0200, 0x0300, 0x0400, 0x0500 };
@@ -3867,29 +3859,35 @@ static const struct snd_djm_ctl snd_djm_ctls_a9[] = {
static const u16 snd_djm_opts_v10_cap_level[] = {
0x0000, 0x0100, 0x0200, 0x0300, 0x0400, 0x0500
};
+
static const u16 snd_djm_opts_v10_cap1[] = {
0x0103,
0x0100, 0x0102, 0x0106, 0x0110, 0x0107,
0x0108, 0x0109, 0x010a, 0x0121, 0x0122
};
+
static const u16 snd_djm_opts_v10_cap2[] = {
0x0200, 0x0202, 0x0206, 0x0210, 0x0207,
0x0208, 0x0209, 0x020a, 0x0221, 0x0222
};
+
static const u16 snd_djm_opts_v10_cap3[] = {
0x0303,
0x0300, 0x0302, 0x0306, 0x0310, 0x0307,
0x0308, 0x0309, 0x030a, 0x0321, 0x0322
};
+
static const u16 snd_djm_opts_v10_cap4[] = {
0x0403,
0x0400, 0x0402, 0x0406, 0x0410, 0x0407,
0x0408, 0x0409, 0x040a, 0x0421, 0x0422
};
+
static const u16 snd_djm_opts_v10_cap5[] = {
0x0500, 0x0502, 0x0506, 0x0510, 0x0507,
0x0508, 0x0509, 0x050a, 0x0521, 0x0522
};
+
static const u16 snd_djm_opts_v10_cap6[] = {
0x0603,
0x0600, 0x0602, 0x0606, 0x0610, 0x0607,
@@ -3918,7 +3916,6 @@ static const struct snd_djm_device snd_djm_devices[] = {
[SND_DJM_V10_IDX] = SND_DJM_DEVICE(v10),
};
-
static int snd_djm_controls_info(struct snd_kcontrol *kctl,
struct snd_ctl_elem_info *info)
{
@@ -4358,4 +4355,3 @@ void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer,
(cval->control == UAC_FU_MUTE || cval->control == UAC_FU_VOLUME))
snd_fix_plt_name(mixer->chip, &kctl->id);
}
-
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 005/143] ALSA: usb-audio: Fix block comments in mixer_quirks
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2025-09-30 14:45 ` [PATCH 6.16 004/143] ALSA: usb-audio: Fix whitespace & blank line issues " Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 006/143] ALSA: usb-audio: Drop unnecessary parentheses " Greg Kroah-Hartman
` (149 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cristian Ciocaltea, Takashi Iwai,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
[ Upstream commit 231225d8a20f8668b4fd6601d54a2fac0e0ab7a5 ]
Address a couple of comment formatting issues indicated by
checkpatch.pl:
WARNING: Block comments use a trailing */ on a separate line
Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20250526-dualsense-alsa-jack-v1-4-1a821463b632@collabora.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/mixer_quirks.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index 0aad92cb33276..c4d79a9ce2baa 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -78,7 +78,8 @@ static int snd_create_std_mono_ctl_offset(struct usb_mixer_interface *mixer,
cval->idx_off = idx_off;
/* get_min_max() is called only for integer volumes later,
- * so provide a short-cut for booleans */
+ * so provide a short-cut for booleans
+ */
cval->min = 0;
cval->max = 1;
cval->res = 0;
@@ -4255,7 +4256,8 @@ static void snd_dragonfly_quirk_db_scale(struct usb_mixer_interface *mixer,
struct snd_kcontrol *kctl)
{
/* Approximation using 10 ranges based on output measurement on hw v1.2.
- * This seems close to the cubic mapping e.g. alsamixer uses. */
+ * This seems close to the cubic mapping e.g. alsamixer uses.
+ */
static const DECLARE_TLV_DB_RANGE(scale,
0, 1, TLV_DB_MINMAX_ITEM(-5300, -4970),
2, 5, TLV_DB_MINMAX_ITEM(-4710, -4160),
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 006/143] ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2025-09-30 14:45 ` [PATCH 6.16 005/143] ALSA: usb-audio: Fix block comments " Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 007/143] ALSA: usb-audio: Avoid multiple assignments " Greg Kroah-Hartman
` (148 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cristian Ciocaltea, Takashi Iwai,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
[ Upstream commit c0495cef8b43ad61efbd4019e3573742e0e63c67 ]
Fix multiple 'CHECK: Unnecessary parentheses around ...' reports from
checkpatch.pl.
Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20250526-dualsense-alsa-jack-v1-5-1a821463b632@collabora.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/mixer_quirks.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index c4d79a9ce2baa..eb245272f123a 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -380,10 +380,10 @@ static int snd_audigy2nx_controls_create(struct usb_mixer_interface *mixer)
struct snd_kcontrol_new knew;
/* USB X-Fi S51 doesn't have a CMSS LED */
- if ((mixer->chip->usb_id == USB_ID(0x041e, 0x3042)) && i == 0)
+ if (mixer->chip->usb_id == USB_ID(0x041e, 0x3042) && i == 0)
continue;
/* USB X-Fi S51 Pro doesn't have one either */
- if ((mixer->chip->usb_id == USB_ID(0x041e, 0x30df)) && i == 0)
+ if (mixer->chip->usb_id == USB_ID(0x041e, 0x30df) && i == 0)
continue;
if (i > 1 && /* Live24ext has 2 LEDs only */
(mixer->chip->usb_id == USB_ID(0x041e, 0x3040) ||
@@ -3955,7 +3955,7 @@ static int snd_djm_controls_update(struct usb_mixer_interface *mixer,
int err;
const struct snd_djm_device *device = &snd_djm_devices[device_idx];
- if ((group >= device->ncontrols) || value >= device->controls[group].noptions)
+ if (group >= device->ncontrols || value >= device->controls[group].noptions)
return -EINVAL;
err = snd_usb_lock_shutdown(mixer->chip);
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 007/143] ALSA: usb-audio: Avoid multiple assignments in mixer_quirks
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2025-09-30 14:45 ` [PATCH 6.16 006/143] ALSA: usb-audio: Drop unnecessary parentheses " Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 008/143] ALSA: usb-audio: Simplify NULL comparison " Greg Kroah-Hartman
` (147 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cristian Ciocaltea, Takashi Iwai,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
[ Upstream commit 03ddd3bdb94df3edb1f2408b57cfb00b3d92a208 ]
Handle report from checkpatch.pl:
CHECK: multiple assignments should be avoided
Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20250526-dualsense-alsa-jack-v1-6-1a821463b632@collabora.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/mixer_quirks.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index eb245272f123a..741a70d0816cc 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -1739,7 +1739,8 @@ static int snd_microii_spdif_default_put(struct snd_kcontrol *kcontrol,
unsigned int pval, pval_old;
int err;
- pval = pval_old = kcontrol->private_value;
+ pval = kcontrol->private_value;
+ pval_old = pval;
pval &= 0xfffff0f0;
pval |= (ucontrol->value.iec958.status[1] & 0x0f) << 8;
pval |= (ucontrol->value.iec958.status[0] & 0x0f);
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 008/143] ALSA: usb-audio: Simplify NULL comparison in mixer_quirks
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2025-09-30 14:45 ` [PATCH 6.16 007/143] ALSA: usb-audio: Avoid multiple assignments " Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 009/143] ALSA: usb-audio: Remove unneeded wmb() " Greg Kroah-Hartman
` (146 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cristian Ciocaltea, Takashi Iwai,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
[ Upstream commit f2d6d660e8fd5f4467e80743f82119201e67fa9c ]
Handle report from checkpatch.pl:
CHECK: Comparison to NULL could be written "t->name"
Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20250526-dualsense-alsa-jack-v1-7-1a821463b632@collabora.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/mixer_quirks.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index 741a70d0816cc..dab6d461cf8cd 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -129,7 +129,7 @@ static int snd_create_std_mono_table(struct usb_mixer_interface *mixer,
{
int err;
- while (t->name != NULL) {
+ while (t->name) {
err = snd_create_std_mono_ctl(mixer, t->unitid, t->control,
t->cmask, t->val_type, t->name,
t->tlv_callback);
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 009/143] ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2025-09-30 14:45 ` [PATCH 6.16 008/143] ALSA: usb-audio: Simplify NULL comparison " Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 010/143] ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 Greg Kroah-Hartman
` (145 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cristian Ciocaltea, Takashi Iwai,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
[ Upstream commit 9cea7425595697802e8d55a322a251999554b8b1 ]
Adding a memory barrier before wake_up() in
snd_usb_soundblaster_remote_complete() is supposed to ensure the write
to mixer->rc_code is visible in wait_event_interruptible() from
snd_usb_sbrc_hwdep_read().
However, this is not really necessary, since wake_up() is just a wrapper
over __wake_up() which already executes a full memory barrier before
accessing the state of the task to be waken up.
Drop the redundant call to wmb() and implicitly fix the checkpatch
complaint:
WARNING: memory barrier without comment
Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20250526-dualsense-alsa-jack-v1-8-1a821463b632@collabora.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/mixer_quirks.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index dab6d461cf8cd..5507340a7723e 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -212,7 +212,6 @@ static void snd_usb_soundblaster_remote_complete(struct urb *urb)
if (code == rc->mute_code)
snd_usb_mixer_notify_id(mixer, rc->mute_mixer_id);
mixer->rc_code = code;
- wmb();
wake_up(&mixer->rc_waitq);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 010/143] ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2025-09-30 14:45 ` [PATCH 6.16 009/143] ALSA: usb-audio: Remove unneeded wmb() " Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 011/143] HID: multitouch: Get the contact ID from HID_DG_TRANSDUCER_INDEX fields in case of Apple Touch Bar Greg Kroah-Hartman
` (144 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cristian Ciocaltea, Takashi Iwai,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
[ Upstream commit 79d561c4ec0497669f19a9550cfb74812f60938b ]
The Sony DualSense wireless controller (PS5) features an internal mono
speaker, but it also provides a 3.5mm jack socket for headphone output
and headset microphone input.
Since this is a UAC1 device, it doesn't advertise any jack detection
capability. However, the controller is able to report HP & MIC insert
events via HID, i.e. through a dedicated input device managed by the
hid-playstation driver.
Add a quirk to create the jack controls for headphone and headset mic,
respectively, and setup an input handler for each of them in order to
intercept the related hotplug events.
Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20250526-dualsense-alsa-jack-v1-9-1a821463b632@collabora.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/mixer_quirks.c | 263 +++++++++++++++++++++++++++++++++++++++
1 file changed, 263 insertions(+)
diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index 5507340a7723e..28842e49700d8 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -17,6 +17,7 @@
#include <linux/bitfield.h>
#include <linux/hid.h>
#include <linux/init.h>
+#include <linux/input.h>
#include <linux/math64.h>
#include <linux/slab.h>
#include <linux/usb.h>
@@ -531,6 +532,263 @@ static int snd_emu0204_controls_create(struct usb_mixer_interface *mixer)
&snd_emu0204_control, NULL);
}
+/*
+ * Sony DualSense controller (PS5) jack detection
+ *
+ * Since this is an UAC 1 device, it doesn't support jack detection.
+ * However, the controller hid-playstation driver reports HP & MIC
+ * insert events through a dedicated input device.
+ */
+
+#define SND_DUALSENSE_JACK_OUT_TERM_ID 3
+#define SND_DUALSENSE_JACK_IN_TERM_ID 4
+
+struct dualsense_mixer_elem_info {
+ struct usb_mixer_elem_info info;
+ struct input_handler ih;
+ struct input_device_id id_table[2];
+ bool connected;
+};
+
+static void snd_dualsense_ih_event(struct input_handle *handle,
+ unsigned int type, unsigned int code,
+ int value)
+{
+ struct dualsense_mixer_elem_info *mei;
+ struct usb_mixer_elem_list *me;
+
+ if (type != EV_SW)
+ return;
+
+ mei = container_of(handle->handler, struct dualsense_mixer_elem_info, ih);
+ me = &mei->info.head;
+
+ if ((me->id == SND_DUALSENSE_JACK_OUT_TERM_ID && code == SW_HEADPHONE_INSERT) ||
+ (me->id == SND_DUALSENSE_JACK_IN_TERM_ID && code == SW_MICROPHONE_INSERT)) {
+ mei->connected = !!value;
+ snd_ctl_notify(me->mixer->chip->card, SNDRV_CTL_EVENT_MASK_VALUE,
+ &me->kctl->id);
+ }
+}
+
+static bool snd_dualsense_ih_match(struct input_handler *handler,
+ struct input_dev *dev)
+{
+ struct dualsense_mixer_elem_info *mei;
+ struct usb_device *snd_dev;
+ char *input_dev_path, *usb_dev_path;
+ size_t usb_dev_path_len;
+ bool match = false;
+
+ mei = container_of(handler, struct dualsense_mixer_elem_info, ih);
+ snd_dev = mei->info.head.mixer->chip->dev;
+
+ input_dev_path = kobject_get_path(&dev->dev.kobj, GFP_KERNEL);
+ if (!input_dev_path) {
+ dev_warn(&snd_dev->dev, "Failed to get input dev path\n");
+ return false;
+ }
+
+ usb_dev_path = kobject_get_path(&snd_dev->dev.kobj, GFP_KERNEL);
+ if (!usb_dev_path) {
+ dev_warn(&snd_dev->dev, "Failed to get USB dev path\n");
+ goto free_paths;
+ }
+
+ /*
+ * Ensure the VID:PID matched input device supposedly owned by the
+ * hid-playstation driver belongs to the actual hardware handled by
+ * the current USB audio device, which implies input_dev_path being
+ * a subpath of usb_dev_path.
+ *
+ * This verification is necessary when there is more than one identical
+ * controller attached to the host system.
+ */
+ usb_dev_path_len = strlen(usb_dev_path);
+ if (usb_dev_path_len >= strlen(input_dev_path))
+ goto free_paths;
+
+ usb_dev_path[usb_dev_path_len] = '/';
+ match = !memcmp(input_dev_path, usb_dev_path, usb_dev_path_len + 1);
+
+free_paths:
+ kfree(input_dev_path);
+ kfree(usb_dev_path);
+
+ return match;
+}
+
+static int snd_dualsense_ih_connect(struct input_handler *handler,
+ struct input_dev *dev,
+ const struct input_device_id *id)
+{
+ struct input_handle *handle;
+ int err;
+
+ handle = kzalloc(sizeof(*handle), GFP_KERNEL);
+ if (!handle)
+ return -ENOMEM;
+
+ handle->dev = dev;
+ handle->handler = handler;
+ handle->name = handler->name;
+
+ err = input_register_handle(handle);
+ if (err)
+ goto err_free;
+
+ err = input_open_device(handle);
+ if (err)
+ goto err_unregister;
+
+ return 0;
+
+err_unregister:
+ input_unregister_handle(handle);
+err_free:
+ kfree(handle);
+ return err;
+}
+
+static void snd_dualsense_ih_disconnect(struct input_handle *handle)
+{
+ input_close_device(handle);
+ input_unregister_handle(handle);
+ kfree(handle);
+}
+
+static void snd_dualsense_ih_start(struct input_handle *handle)
+{
+ struct dualsense_mixer_elem_info *mei;
+ struct usb_mixer_elem_list *me;
+ int status = -1;
+
+ mei = container_of(handle->handler, struct dualsense_mixer_elem_info, ih);
+ me = &mei->info.head;
+
+ if (me->id == SND_DUALSENSE_JACK_OUT_TERM_ID &&
+ test_bit(SW_HEADPHONE_INSERT, handle->dev->swbit))
+ status = test_bit(SW_HEADPHONE_INSERT, handle->dev->sw);
+ else if (me->id == SND_DUALSENSE_JACK_IN_TERM_ID &&
+ test_bit(SW_MICROPHONE_INSERT, handle->dev->swbit))
+ status = test_bit(SW_MICROPHONE_INSERT, handle->dev->sw);
+
+ if (status >= 0) {
+ mei->connected = !!status;
+ snd_ctl_notify(me->mixer->chip->card, SNDRV_CTL_EVENT_MASK_VALUE,
+ &me->kctl->id);
+ }
+}
+
+static int snd_dualsense_jack_get(struct snd_kcontrol *kctl,
+ struct snd_ctl_elem_value *ucontrol)
+{
+ struct dualsense_mixer_elem_info *mei = snd_kcontrol_chip(kctl);
+
+ ucontrol->value.integer.value[0] = mei->connected;
+
+ return 0;
+}
+
+static const struct snd_kcontrol_new snd_dualsense_jack_control = {
+ .iface = SNDRV_CTL_ELEM_IFACE_CARD,
+ .access = SNDRV_CTL_ELEM_ACCESS_READ,
+ .info = snd_ctl_boolean_mono_info,
+ .get = snd_dualsense_jack_get,
+};
+
+static int snd_dualsense_resume_jack(struct usb_mixer_elem_list *list)
+{
+ snd_ctl_notify(list->mixer->chip->card, SNDRV_CTL_EVENT_MASK_VALUE,
+ &list->kctl->id);
+ return 0;
+}
+
+static void snd_dualsense_mixer_elem_free(struct snd_kcontrol *kctl)
+{
+ struct dualsense_mixer_elem_info *mei = snd_kcontrol_chip(kctl);
+
+ if (mei->ih.event)
+ input_unregister_handler(&mei->ih);
+
+ snd_usb_mixer_elem_free(kctl);
+}
+
+static int snd_dualsense_jack_create(struct usb_mixer_interface *mixer,
+ const char *name, bool is_output)
+{
+ struct dualsense_mixer_elem_info *mei;
+ struct input_device_id *idev_id;
+ struct snd_kcontrol *kctl;
+ int err;
+
+ mei = kzalloc(sizeof(*mei), GFP_KERNEL);
+ if (!mei)
+ return -ENOMEM;
+
+ snd_usb_mixer_elem_init_std(&mei->info.head, mixer,
+ is_output ? SND_DUALSENSE_JACK_OUT_TERM_ID :
+ SND_DUALSENSE_JACK_IN_TERM_ID);
+
+ mei->info.head.resume = snd_dualsense_resume_jack;
+ mei->info.val_type = USB_MIXER_BOOLEAN;
+ mei->info.channels = 1;
+ mei->info.min = 0;
+ mei->info.max = 1;
+
+ kctl = snd_ctl_new1(&snd_dualsense_jack_control, mei);
+ if (!kctl) {
+ kfree(mei);
+ return -ENOMEM;
+ }
+
+ strscpy(kctl->id.name, name, sizeof(kctl->id.name));
+ kctl->private_free = snd_dualsense_mixer_elem_free;
+
+ err = snd_usb_mixer_add_control(&mei->info.head, kctl);
+ if (err)
+ return err;
+
+ idev_id = &mei->id_table[0];
+ idev_id->flags = INPUT_DEVICE_ID_MATCH_VENDOR | INPUT_DEVICE_ID_MATCH_PRODUCT |
+ INPUT_DEVICE_ID_MATCH_EVBIT | INPUT_DEVICE_ID_MATCH_SWBIT;
+ idev_id->vendor = USB_ID_VENDOR(mixer->chip->usb_id);
+ idev_id->product = USB_ID_PRODUCT(mixer->chip->usb_id);
+ idev_id->evbit[BIT_WORD(EV_SW)] = BIT_MASK(EV_SW);
+ if (is_output)
+ idev_id->swbit[BIT_WORD(SW_HEADPHONE_INSERT)] = BIT_MASK(SW_HEADPHONE_INSERT);
+ else
+ idev_id->swbit[BIT_WORD(SW_MICROPHONE_INSERT)] = BIT_MASK(SW_MICROPHONE_INSERT);
+
+ mei->ih.event = snd_dualsense_ih_event;
+ mei->ih.match = snd_dualsense_ih_match;
+ mei->ih.connect = snd_dualsense_ih_connect,
+ mei->ih.disconnect = snd_dualsense_ih_disconnect,
+ mei->ih.start = snd_dualsense_ih_start,
+ mei->ih.name = name;
+ mei->ih.id_table = mei->id_table;
+
+ err = input_register_handler(&mei->ih);
+ if (err) {
+ dev_warn(&mixer->chip->dev->dev,
+ "Could not register input handler: %d\n", err);
+ mei->ih.event = NULL;
+ }
+
+ return 0;
+}
+
+static int snd_dualsense_controls_create(struct usb_mixer_interface *mixer)
+{
+ int err;
+
+ err = snd_dualsense_jack_create(mixer, "Headphone Jack", true);
+ if (err < 0)
+ return err;
+
+ return snd_dualsense_jack_create(mixer, "Headset Mic Jack", false);
+}
+
/* ASUS Xonar U1 / U3 controls */
static int snd_xonar_u1_switch_get(struct snd_kcontrol *kcontrol,
@@ -4073,6 +4331,11 @@ int snd_usb_mixer_apply_create_quirk(struct usb_mixer_interface *mixer)
err = snd_emu0204_controls_create(mixer);
break;
+ case USB_ID(0x054c, 0x0ce6): /* Sony DualSense controller (PS5) */
+ case USB_ID(0x054c, 0x0df2): /* Sony DualSense Edge controller (PS5) */
+ err = snd_dualsense_controls_create(mixer);
+ break;
+
case USB_ID(0x0763, 0x2030): /* M-Audio Fast Track C400 */
case USB_ID(0x0763, 0x2031): /* M-Audio Fast Track C400 */
err = snd_c400_create_mixer(mixer);
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 011/143] HID: multitouch: Get the contact ID from HID_DG_TRANSDUCER_INDEX fields in case of Apple Touch Bar
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2025-09-30 14:45 ` [PATCH 6.16 010/143] ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 012/143] HID: multitouch: support getting the tip state from HID_DG_TOUCH fields in " Greg Kroah-Hartman
` (143 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benjamin Tissoires, Kerem Karabay,
Aditya Garg, Jiri Kosina, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kerem Karabay <kekrby@gmail.com>
[ Upstream commit f41d736acc039d86512951f4e874b0f5e666babf ]
In Apple Touch Bar, the contact ID is contained in fields with the
HID_DG_TRANSDUCER_INDEX usage rather than HID_DG_CONTACTID, thus differing
from the HID spec. Add a quirk for the same.
Acked-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Kerem Karabay <kekrby@gmail.com>
Co-developed-by: Aditya Garg <gargaditya08@live.com>
Signed-off-by: Aditya Garg <gargaditya08@live.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-multitouch.c | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 4c22bd2ba1708..c1be2978c0987 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -73,6 +73,7 @@ MODULE_LICENSE("GPL");
#define MT_QUIRK_FORCE_MULTI_INPUT BIT(20)
#define MT_QUIRK_DISABLE_WAKEUP BIT(21)
#define MT_QUIRK_ORIENTATION_INVERT BIT(22)
+#define MT_QUIRK_APPLE_TOUCHBAR BIT(23)
#define MT_INPUTMODE_TOUCHSCREEN 0x02
#define MT_INPUTMODE_TOUCHPAD 0x03
@@ -625,6 +626,7 @@ static struct mt_application *mt_find_application(struct mt_device *td,
static struct mt_report_data *mt_allocate_report_data(struct mt_device *td,
struct hid_report *report)
{
+ struct mt_class *cls = &td->mtclass;
struct mt_report_data *rdata;
struct hid_field *field;
int r, n;
@@ -649,7 +651,11 @@ static struct mt_report_data *mt_allocate_report_data(struct mt_device *td,
if (field->logical == HID_DG_FINGER || td->hdev->group != HID_GROUP_MULTITOUCH_WIN_8) {
for (n = 0; n < field->report_count; n++) {
- if (field->usage[n].hid == HID_DG_CONTACTID) {
+ unsigned int hid = field->usage[n].hid;
+
+ if (hid == HID_DG_CONTACTID ||
+ (cls->quirks & MT_QUIRK_APPLE_TOUCHBAR &&
+ hid == HID_DG_TRANSDUCER_INDEX)) {
rdata->is_mt_collection = true;
break;
}
@@ -827,6 +833,14 @@ static int mt_touch_input_mapping(struct hid_device *hdev, struct hid_input *hi,
EV_KEY, BTN_TOUCH);
MT_STORE_FIELD(tip_state);
return 1;
+ case HID_DG_TRANSDUCER_INDEX:
+ /*
+ * Contact ID in case of Apple Touch Bars is contained
+ * in fields with HID_DG_TRANSDUCER_INDEX usage.
+ */
+ if (!(cls->quirks & MT_QUIRK_APPLE_TOUCHBAR))
+ return 0;
+ fallthrough;
case HID_DG_CONTACTID:
MT_STORE_FIELD(contactid);
app->touches_by_report++;
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 012/143] HID: multitouch: support getting the tip state from HID_DG_TOUCH fields in Apple Touch Bar
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2025-09-30 14:45 ` [PATCH 6.16 011/143] HID: multitouch: Get the contact ID from HID_DG_TRANSDUCER_INDEX fields in case of Apple Touch Bar Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 013/143] HID: multitouch: take cls->maxcontacts into account for Apple Touch Bar even without a HID_DG_CONTACTMAX field Greg Kroah-Hartman
` (142 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benjamin Tissoires, Kerem Karabay,
Aditya Garg, Jiri Kosina, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kerem Karabay <kekrby@gmail.com>
[ Upstream commit e0976a61a543b5e03bc0d08030a0ea036ee3751d ]
In Apple Touch Bar, the tip state is contained in fields with the
HID_DG_TOUCH usage. This feature is gated by a quirk in order to
prevent breaking other devices, see commit c2ef8f21ea8f
("HID: multitouch: add support for trackpads").
Acked-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Kerem Karabay <kekrby@gmail.com>
Co-developed-by: Aditya Garg <gargaditya08@live.com>
Signed-off-by: Aditya Garg <gargaditya08@live.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-multitouch.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index c1be2978c0987..20e0958d0fa9f 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -827,6 +827,17 @@ static int mt_touch_input_mapping(struct hid_device *hdev, struct hid_input *hi,
MT_STORE_FIELD(confidence_state);
return 1;
+ case HID_DG_TOUCH:
+ /*
+ * Legacy devices use TIPSWITCH and not TOUCH.
+ * One special case here is of the Apple Touch Bars.
+ * In these devices, the tip state is contained in
+ * fields with the HID_DG_TOUCH usage.
+ * Let's just ignore this field for other devices.
+ */
+ if (!(cls->quirks & MT_QUIRK_APPLE_TOUCHBAR))
+ return -1;
+ fallthrough;
case HID_DG_TIPSWITCH:
if (field->application != HID_GD_SYSTEM_MULTIAXIS)
input_set_capability(hi->input,
@@ -897,10 +908,6 @@ static int mt_touch_input_mapping(struct hid_device *hdev, struct hid_input *hi,
case HID_DG_CONTACTMAX:
/* contact max are global to the report */
return -1;
- case HID_DG_TOUCH:
- /* Legacy devices use TIPSWITCH and not TOUCH.
- * Let's just ignore this field. */
- return -1;
}
/* let hid-input decide for the others */
return 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 013/143] HID: multitouch: take cls->maxcontacts into account for Apple Touch Bar even without a HID_DG_CONTACTMAX field
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2025-09-30 14:45 ` [PATCH 6.16 012/143] HID: multitouch: support getting the tip state from HID_DG_TOUCH fields in " Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 014/143] HID: multitouch: specify that Apple Touch Bar is direct Greg Kroah-Hartman
` (141 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benjamin Tissoires, Kerem Karabay,
Aditya Garg, Jiri Kosina, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kerem Karabay <kekrby@gmail.com>
[ Upstream commit 7dfe48bdc9d38db46283f2e0281bc1626277b8bf ]
In Apple Touch Bar, the HID_DG_CONTACTMAX is not present, but the maximum
contact count is still greater than the default. Add quirks for the same.
Acked-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Kerem Karabay <kekrby@gmail.com>
Co-developed-by: Aditya Garg <gargaditya08@live.com>
Signed-off-by: Aditya Garg <gargaditya08@live.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-multitouch.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index 20e0958d0fa9f..c9f9f21a6ec6b 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -1335,6 +1335,13 @@ static int mt_touch_input_configured(struct hid_device *hdev,
struct input_dev *input = hi->input;
int ret;
+ /*
+ * HID_DG_CONTACTMAX field is not present on Apple Touch Bars,
+ * but the maximum contact count is greater than the default.
+ */
+ if (cls->quirks & MT_QUIRK_APPLE_TOUCHBAR && cls->maxcontacts)
+ td->maxcontacts = cls->maxcontacts;
+
if (!td->maxcontacts)
td->maxcontacts = MT_DEFAULT_MAXCONTACT;
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 014/143] HID: multitouch: specify that Apple Touch Bar is direct
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2025-09-30 14:45 ` [PATCH 6.16 013/143] HID: multitouch: take cls->maxcontacts into account for Apple Touch Bar even without a HID_DG_CONTACTMAX field Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 015/143] ALSA: usb-audio: Convert comma to semicolon Greg Kroah-Hartman
` (140 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benjamin Tissoires, Kerem Karabay,
Aditya Garg, Jiri Kosina, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kerem Karabay <kekrby@gmail.com>
[ Upstream commit 45ca23c5ee8b2b3074377fecc92fa72aa595f7c9 ]
Currently the driver determines the device type based on the
application, but this value is not reliable on Apple Touch Bar, where
the application is HID_DG_TOUCHPAD even though this device is direct,
so add a quirk for the same.
Acked-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Kerem Karabay <kekrby@gmail.com>
Co-developed-by: Aditya Garg <gargaditya08@live.com>
Signed-off-by: Aditya Garg <gargaditya08@live.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-multitouch.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index c9f9f21a6ec6b..edb8da49d9167 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -1349,6 +1349,13 @@ static int mt_touch_input_configured(struct hid_device *hdev,
if (td->serial_maybe)
mt_post_parse_default_settings(td, app);
+ /*
+ * The application for Apple Touch Bars is HID_DG_TOUCHPAD,
+ * but these devices are direct.
+ */
+ if (cls->quirks & MT_QUIRK_APPLE_TOUCHBAR)
+ app->mt_flags |= INPUT_MT_DIRECT;
+
if (cls->is_indirect)
app->mt_flags |= INPUT_MT_POINTER;
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 015/143] ALSA: usb-audio: Convert comma to semicolon
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2025-09-30 14:45 ` [PATCH 6.16 014/143] HID: multitouch: specify that Apple Touch Bar is direct Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 016/143] ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA Greg Kroah-Hartman
` (139 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chen Ni, Cristian Ciocaltea,
Takashi Iwai, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <nichen@iscas.ac.cn>
[ Upstream commit 9ca30a1b007d5fefb5752428f852a2d8d7219c1c ]
Replace comma between expressions with semicolons.
Using a ',' in place of a ';' can have unintended side effects.
Although that is not the case here, it is seems best to use ';'
unless ',' is intended.
Found by inspection.
No functional change intended.
Compile tested only.
Fixes: 79d561c4ec04 ("ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5")
Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
Reviewed-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
Link: https://patch.msgid.link/20250612060228.1518028-1-nichen@iscas.ac.cn
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/mixer_quirks.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index 28842e49700d8..8cb98b5d31124 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -762,9 +762,9 @@ static int snd_dualsense_jack_create(struct usb_mixer_interface *mixer,
mei->ih.event = snd_dualsense_ih_event;
mei->ih.match = snd_dualsense_ih_match;
- mei->ih.connect = snd_dualsense_ih_connect,
- mei->ih.disconnect = snd_dualsense_ih_disconnect,
- mei->ih.start = snd_dualsense_ih_start,
+ mei->ih.connect = snd_dualsense_ih_connect;
+ mei->ih.disconnect = snd_dualsense_ih_disconnect;
+ mei->ih.start = snd_dualsense_ih_start;
mei->ih.name = name;
mei->ih.id_table = mei->id_table;
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 016/143] ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2025-09-30 14:45 ` [PATCH 6.16 015/143] ALSA: usb-audio: Convert comma to semicolon Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 017/143] ALSA: usb-audio: Fix build with CONFIG_INPUT=n Greg Kroah-Hartman
` (138 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stefan Binding, Takashi Iwai,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Binding <sbinding@opensource.cirrus.com>
[ Upstream commit 84fc8896f0d9d1c075e0e08a416faedbd73907fa ]
Add support for ASUS NUC14LNS.
This NUC uses a single CS35L41 Amp in using Internal Boost with SPI.
To support the Single Amp, a new quirk is required.
Signed-off-by: Stefan Binding <sbinding@opensource.cirrus.com>
Link: https://patch.msgid.link/20250612160029.848104-3-sbinding@opensource.cirrus.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/pci/hda/patch_realtek.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 4819bd332f039..fa28e3e85861c 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -7298,6 +7298,11 @@ static void cs35l41_fixup_spi_two(struct hda_codec *codec, const struct hda_fixu
comp_generic_fixup(codec, action, "spi", "CSC3551", "-%s:00-cs35l41-hda.%d", 2);
}
+static void cs35l41_fixup_spi_one(struct hda_codec *codec, const struct hda_fixup *fix, int action)
+{
+ comp_generic_fixup(codec, action, "spi", "CSC3551", "-%s:00-cs35l41-hda.%d", 1);
+}
+
static void cs35l41_fixup_spi_four(struct hda_codec *codec, const struct hda_fixup *fix, int action)
{
comp_generic_fixup(codec, action, "spi", "CSC3551", "-%s:00-cs35l41-hda.%d", 4);
@@ -7991,6 +7996,7 @@ enum {
ALC287_FIXUP_CS35L41_I2C_2,
ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED,
ALC287_FIXUP_CS35L41_I2C_4,
+ ALC245_FIXUP_CS35L41_SPI_1,
ALC245_FIXUP_CS35L41_SPI_2,
ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED,
ALC245_FIXUP_CS35L41_SPI_4,
@@ -10120,6 +10126,10 @@ static const struct hda_fixup alc269_fixups[] = {
.type = HDA_FIXUP_FUNC,
.v.func = cs35l41_fixup_spi_two,
},
+ [ALC245_FIXUP_CS35L41_SPI_1] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = cs35l41_fixup_spi_one,
+ },
[ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED] = {
.type = HDA_FIXUP_FUNC,
.v.func = cs35l41_fixup_spi_two,
@@ -11099,6 +11109,7 @@ static const struct hda_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x1043, 0x8398, "ASUS P1005", ALC269_FIXUP_STEREO_DMIC),
SND_PCI_QUIRK(0x1043, 0x83ce, "ASUS P1005", ALC269_FIXUP_STEREO_DMIC),
SND_PCI_QUIRK(0x1043, 0x8516, "ASUS X101CH", ALC269_FIXUP_ASUS_X101),
+ SND_PCI_QUIRK(0x1043, 0x88f4, "ASUS NUC14LNS", ALC245_FIXUP_CS35L41_SPI_1),
SND_PCI_QUIRK(0x104d, 0x9073, "Sony VAIO", ALC275_FIXUP_SONY_VAIO_GPIO2),
SND_PCI_QUIRK(0x104d, 0x907b, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ),
SND_PCI_QUIRK(0x104d, 0x9084, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ),
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 017/143] ALSA: usb-audio: Fix build with CONFIG_INPUT=n
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2025-09-30 14:45 ` [PATCH 6.16 016/143] ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 018/143] usb: core: Add 0x prefix to quirks debug output Greg Kroah-Hartman
` (137 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot,
Cristian Ciocaltea, Takashi Iwai, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit d0630a0b80c08530857146e3bf183a7d6b743847 ]
The recent addition of DualSense mixer quirk relies on the input
device handle, and the build can fail if CONFIG_INPUT isn't set.
Put (rather ugly) workarounds to wrap with IS_REACHABLE() for avoiding
the build error.
Fixes: 79d561c4ec04 ("ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202506130733.gnPKw2l3-lkp@intel.com/
Reviewed-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
Link: https://patch.msgid.link/20250613081543.7404-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/mixer_quirks.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index 8cb98b5d31124..6b47b3145d2cf 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -532,6 +532,7 @@ static int snd_emu0204_controls_create(struct usb_mixer_interface *mixer)
&snd_emu0204_control, NULL);
}
+#if IS_REACHABLE(CONFIG_INPUT)
/*
* Sony DualSense controller (PS5) jack detection
*
@@ -788,6 +789,7 @@ static int snd_dualsense_controls_create(struct usb_mixer_interface *mixer)
return snd_dualsense_jack_create(mixer, "Headset Mic Jack", false);
}
+#endif /* IS_REACHABLE(CONFIG_INPUT) */
/* ASUS Xonar U1 / U3 controls */
@@ -4331,10 +4333,12 @@ int snd_usb_mixer_apply_create_quirk(struct usb_mixer_interface *mixer)
err = snd_emu0204_controls_create(mixer);
break;
+#if IS_REACHABLE(CONFIG_INPUT)
case USB_ID(0x054c, 0x0ce6): /* Sony DualSense controller (PS5) */
case USB_ID(0x054c, 0x0df2): /* Sony DualSense Edge controller (PS5) */
err = snd_dualsense_controls_create(mixer);
break;
+#endif /* IS_REACHABLE(CONFIG_INPUT) */
case USB_ID(0x0763, 0x2030): /* M-Audio Fast Track C400 */
case USB_ID(0x0763, 0x2031): /* M-Audio Fast Track C400 */
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 018/143] usb: core: Add 0x prefix to quirks debug output
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2025-09-30 14:45 ` [PATCH 6.16 017/143] ALSA: usb-audio: Fix build with CONFIG_INPUT=n Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 019/143] net: fec: rename struct fec_devinfo fec_imx6x_info -> fec_imx6sx_info Greg Kroah-Hartman
` (136 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiayi Li, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayi Li <lijiayi@kylinos.cn>
[ Upstream commit 47c428fce0b41b15ab321d8ede871f780ccd038f ]
Use "0x%x" format for quirks debug print to clarify it's a hexadecimal
value. Improves readability and consistency with other hex outputs.
Signed-off-by: Jiayi Li <lijiayi@kylinos.cn>
Link: https://lore.kernel.org/r/20250603071045.3243699-1-lijiayi@kylinos.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/core/quirks.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index d6daad39491b7..f5bc538753301 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -737,7 +737,7 @@ void usb_detect_quirks(struct usb_device *udev)
udev->quirks ^= usb_detect_dynamic_quirks(udev);
if (udev->quirks)
- dev_dbg(&udev->dev, "USB quirks for this device: %x\n",
+ dev_dbg(&udev->dev, "USB quirks for this device: 0x%x\n",
udev->quirks);
#ifdef CONFIG_USB_DEFAULT_PERSIST
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 019/143] net: fec: rename struct fec_devinfo fec_imx6x_info -> fec_imx6sx_info
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2025-09-30 14:45 ` [PATCH 6.16 018/143] usb: core: Add 0x prefix to quirks debug output Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 020/143] net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick Greg Kroah-Hartman
` (135 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wei Fang, Frank Li, Andrew Lunn,
Marc Kleine-Budde, Jakub Kicinski, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <mkl@pengutronix.de>
[ Upstream commit 4e8594a88656fa86a9d2b1e72770432470b6dc0c ]
In da722186f654 ("net: fec: set GPR bit on suspend by DT
configuration.") the platform_device_id fec_devtype::driver_data was
converted from holding the quirks to a pointing to struct fec_devinfo.
The struct fec_devinfo holding the information for the i.MX6SX was
named fec_imx6x_info.
Rename fec_imx6x_info to fec_imx6sx_info to align with the SoC's name.
Reviewed-by: Wei Fang <wei.fang@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Link: https://patch.msgid.link/20250618-fec-cleanups-v4-5-c16f9a1af124@pengutronix.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/freescale/fec_main.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 5f15f42070c53..e8b37dfd5cc1d 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -131,7 +131,7 @@ static const struct fec_devinfo fec_mvf600_info = {
FEC_QUIRK_HAS_MDIO_C45,
};
-static const struct fec_devinfo fec_imx6x_info = {
+static const struct fec_devinfo fec_imx6sx_info = {
.quirks = FEC_QUIRK_ENET_MAC | FEC_QUIRK_HAS_GBIT |
FEC_QUIRK_HAS_BUFDESC_EX | FEC_QUIRK_HAS_CSUM |
FEC_QUIRK_HAS_VLAN | FEC_QUIRK_HAS_AVB |
@@ -196,7 +196,7 @@ static const struct of_device_id fec_dt_ids[] = {
{ .compatible = "fsl,imx28-fec", .data = &fec_imx28_info, },
{ .compatible = "fsl,imx6q-fec", .data = &fec_imx6q_info, },
{ .compatible = "fsl,mvf600-fec", .data = &fec_mvf600_info, },
- { .compatible = "fsl,imx6sx-fec", .data = &fec_imx6x_info, },
+ { .compatible = "fsl,imx6sx-fec", .data = &fec_imx6sx_info, },
{ .compatible = "fsl,imx6ul-fec", .data = &fec_imx6ul_info, },
{ .compatible = "fsl,imx8mq-fec", .data = &fec_imx8mq_info, },
{ .compatible = "fsl,imx8qm-fec", .data = &fec_imx8qm_info, },
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 020/143] net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2025-09-30 14:45 ` [PATCH 6.16 019/143] net: fec: rename struct fec_devinfo fec_imx6x_info -> fec_imx6sx_info Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 021/143] drm/panfrost: Drop duplicated Mediatek supplies arrays Greg Kroah-Hartman
` (134 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris Morgan, Jakub Kicinski,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Morgan <macromorgan@hotmail.com>
[ Upstream commit dfec1c14aecee6813f9bafc7b560cc3a31d24079 ]
Add quirk for Potron SFP+ XGSPON ONU Stick (YV SFP+ONT-XGSPON).
This device uses pins 2 and 7 for UART communication, so disable
TX_FAULT and LOS. Additionally as it is an embedded system in an
SFP+ form factor provide it enough time to fully boot before we
attempt to use it.
https://www.potrontec.com/index/index/list/cat_id/2.html#11-83
https://pon.wiki/xgs-pon/ont/potron-technology/x-onu-sfpp/
Signed-off-by: Chris Morgan <macromorgan@hotmail.com>
Link: https://patch.msgid.link/20250617180324.229487-1-macroalpha82@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/phy/sfp.c | 21 ++++++++++++++++++++-
1 file changed, 20 insertions(+), 1 deletion(-)
diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
index 347c1e0e94d95..5347c95d1e772 100644
--- a/drivers/net/phy/sfp.c
+++ b/drivers/net/phy/sfp.c
@@ -361,6 +361,11 @@ static void sfp_fixup_ignore_tx_fault(struct sfp *sfp)
sfp->state_ignore_mask |= SFP_F_TX_FAULT;
}
+static void sfp_fixup_ignore_hw(struct sfp *sfp, unsigned int mask)
+{
+ sfp->state_hw_mask &= ~mask;
+}
+
static void sfp_fixup_nokia(struct sfp *sfp)
{
sfp_fixup_long_startup(sfp);
@@ -409,7 +414,19 @@ static void sfp_fixup_halny_gsfp(struct sfp *sfp)
* these are possibly used for other purposes on this
* module, e.g. a serial port.
*/
- sfp->state_hw_mask &= ~(SFP_F_TX_FAULT | SFP_F_LOS);
+ sfp_fixup_ignore_hw(sfp, SFP_F_TX_FAULT | SFP_F_LOS);
+}
+
+static void sfp_fixup_potron(struct sfp *sfp)
+{
+ /*
+ * The TX_FAULT and LOS pins on this device are used for serial
+ * communication, so ignore them. Additionally, provide extra
+ * time for this device to fully start up.
+ */
+
+ sfp_fixup_long_startup(sfp);
+ sfp_fixup_ignore_hw(sfp, SFP_F_TX_FAULT | SFP_F_LOS);
}
static void sfp_fixup_rollball_cc(struct sfp *sfp)
@@ -512,6 +529,8 @@ static const struct sfp_quirk sfp_quirks[] = {
SFP_QUIRK_F("Walsun", "HXSX-ATRC-1", sfp_fixup_fs_10gt),
SFP_QUIRK_F("Walsun", "HXSX-ATRI-1", sfp_fixup_fs_10gt),
+ SFP_QUIRK_F("YV", "SFP+ONU-XGSPON", sfp_fixup_potron),
+
// OEM SFP-GE-T is a 1000Base-T module with broken TX_FAULT indicator
SFP_QUIRK_F("OEM", "SFP-GE-T", sfp_fixup_ignore_tx_fault),
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 021/143] drm/panfrost: Drop duplicated Mediatek supplies arrays
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2025-09-30 14:45 ` [PATCH 6.16 020/143] net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 022/143] drm/panfrost: Commonize Mediatek power domain array definitions Greg Kroah-Hartman
` (133 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Louis-Alexis Eyraud, Steven Price,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com>
[ Upstream commit 6905b0d9813176087fc0f28bc5e4ee2b86e6ce13 ]
In the panfrost driver, the platform data of several Mediatek SoC
declares and uses custom supplies array definitions
(mediatek_mt8192_supplies, mediatek_mt8183_b_supplies), that are the
same as default_supplies (used by default platform data).
So drop these duplicated definitions and use default_supplies instead.
Also, rename mediatek_mt8183_supplies to a more generic name too
(legacy_supplies).
Signed-off-by: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Signed-off-by: Steven Price <steven.price@arm.com>
Link: https://lore.kernel.org/r/20250509-mt8370-enable-gpu-v6-2-2833888cb1d3@collabora.com
Stable-dep-of: 81645377c231 ("drm/panfrost: Add support for Mali on the MT8370 SoC")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panfrost/panfrost_drv.c | 24 +++++++++++-------------
1 file changed, 11 insertions(+), 13 deletions(-)
diff --git a/drivers/gpu/drm/panfrost/panfrost_drv.c b/drivers/gpu/drm/panfrost/panfrost_drv.c
index f1ec3b02f15a0..7b899a9b2120c 100644
--- a/drivers/gpu/drm/panfrost/panfrost_drv.c
+++ b/drivers/gpu/drm/panfrost/panfrost_drv.c
@@ -797,19 +797,18 @@ static const struct panfrost_compatible amlogic_data = {
* On new devicetrees please use the _b variant with a single and
* coupled regulators instead.
*/
-static const char * const mediatek_mt8183_supplies[] = { "mali", "sram", NULL };
+static const char * const legacy_supplies[] = { "mali", "sram", NULL };
static const char * const mediatek_mt8183_pm_domains[] = { "core0", "core1", "core2" };
static const struct panfrost_compatible mediatek_mt8183_data = {
- .num_supplies = ARRAY_SIZE(mediatek_mt8183_supplies) - 1,
- .supply_names = mediatek_mt8183_supplies,
+ .num_supplies = ARRAY_SIZE(legacy_supplies) - 1,
+ .supply_names = legacy_supplies,
.num_pm_domains = ARRAY_SIZE(mediatek_mt8183_pm_domains),
.pm_domain_names = mediatek_mt8183_pm_domains,
};
-static const char * const mediatek_mt8183_b_supplies[] = { "mali", NULL };
static const struct panfrost_compatible mediatek_mt8183_b_data = {
- .num_supplies = ARRAY_SIZE(mediatek_mt8183_b_supplies) - 1,
- .supply_names = mediatek_mt8183_b_supplies,
+ .num_supplies = ARRAY_SIZE(default_supplies) - 1,
+ .supply_names = default_supplies,
.num_pm_domains = ARRAY_SIZE(mediatek_mt8183_pm_domains),
.pm_domain_names = mediatek_mt8183_pm_domains,
.pm_features = BIT(GPU_PM_CLK_DIS) | BIT(GPU_PM_VREG_OFF),
@@ -817,8 +816,8 @@ static const struct panfrost_compatible mediatek_mt8183_b_data = {
static const char * const mediatek_mt8186_pm_domains[] = { "core0", "core1" };
static const struct panfrost_compatible mediatek_mt8186_data = {
- .num_supplies = ARRAY_SIZE(mediatek_mt8183_b_supplies) - 1,
- .supply_names = mediatek_mt8183_b_supplies,
+ .num_supplies = ARRAY_SIZE(default_supplies) - 1,
+ .supply_names = default_supplies,
.num_pm_domains = ARRAY_SIZE(mediatek_mt8186_pm_domains),
.pm_domain_names = mediatek_mt8186_pm_domains,
.pm_features = BIT(GPU_PM_CLK_DIS) | BIT(GPU_PM_VREG_OFF),
@@ -826,20 +825,19 @@ static const struct panfrost_compatible mediatek_mt8186_data = {
/* MT8188 uses the same power domains and power supplies as MT8183 */
static const struct panfrost_compatible mediatek_mt8188_data = {
- .num_supplies = ARRAY_SIZE(mediatek_mt8183_b_supplies) - 1,
- .supply_names = mediatek_mt8183_b_supplies,
+ .num_supplies = ARRAY_SIZE(default_supplies) - 1,
+ .supply_names = default_supplies,
.num_pm_domains = ARRAY_SIZE(mediatek_mt8183_pm_domains),
.pm_domain_names = mediatek_mt8183_pm_domains,
.pm_features = BIT(GPU_PM_CLK_DIS) | BIT(GPU_PM_VREG_OFF),
.gpu_quirks = BIT(GPU_QUIRK_FORCE_AARCH64_PGTABLE),
};
-static const char * const mediatek_mt8192_supplies[] = { "mali", NULL };
static const char * const mediatek_mt8192_pm_domains[] = { "core0", "core1", "core2",
"core3", "core4" };
static const struct panfrost_compatible mediatek_mt8192_data = {
- .num_supplies = ARRAY_SIZE(mediatek_mt8192_supplies) - 1,
- .supply_names = mediatek_mt8192_supplies,
+ .num_supplies = ARRAY_SIZE(default_supplies) - 1,
+ .supply_names = default_supplies,
.num_pm_domains = ARRAY_SIZE(mediatek_mt8192_pm_domains),
.pm_domain_names = mediatek_mt8192_pm_domains,
.pm_features = BIT(GPU_PM_CLK_DIS) | BIT(GPU_PM_VREG_OFF),
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 022/143] drm/panfrost: Commonize Mediatek power domain array definitions
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2025-09-30 14:45 ` [PATCH 6.16 021/143] drm/panfrost: Drop duplicated Mediatek supplies arrays Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 023/143] drm/panfrost: Add support for Mali on the MT8370 SoC Greg Kroah-Hartman
` (132 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Louis-Alexis Eyraud, Steven Price,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com>
[ Upstream commit bd77b870eb190c9cf5d9b7208625513e99e5be2d ]
In the panfrost driver, the platform data of several Mediatek SoC
declares and uses several different power domains arrays according to
GPU core number present in the SoC:
- mediatek_mt8186_pm_domains (2 cores)
- mediatek_mt8183_pm_domains (3 cores)
- mediatek_mt8192_pm_domains (5 cores)
As they all are fixed arrays, starting with the same entries and the
platform data also has a power domains array length field
(num_pm_domains), they can be replaced by a single array, containing
all entries, if the num_pm_domains field of the platform data is also
set to the matching core number.
So, create a generic power domain array (mediatek_pm_domains) and use
it in the mt8183(b), mt8186, mt8188 and mt8192 platform data instead.
Signed-off-by: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Signed-off-by: Steven Price <steven.price@arm.com>
Link: https://lore.kernel.org/r/20250509-mt8370-enable-gpu-v6-3-2833888cb1d3@collabora.com
Stable-dep-of: 81645377c231 ("drm/panfrost: Add support for Mali on the MT8370 SoC")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panfrost/panfrost_drv.c | 27 +++++++++++--------------
1 file changed, 12 insertions(+), 15 deletions(-)
diff --git a/drivers/gpu/drm/panfrost/panfrost_drv.c b/drivers/gpu/drm/panfrost/panfrost_drv.c
index 7b899a9b2120c..21b28bef84015 100644
--- a/drivers/gpu/drm/panfrost/panfrost_drv.c
+++ b/drivers/gpu/drm/panfrost/panfrost_drv.c
@@ -789,6 +789,8 @@ static const struct panfrost_compatible amlogic_data = {
.vendor_quirk = panfrost_gpu_amlogic_quirk,
};
+static const char * const mediatek_pm_domains[] = { "core0", "core1", "core2",
+ "core3", "core4" };
/*
* The old data with two power supplies for MT8183 is here only to
* keep retro-compatibility with older devicetrees, as DVFS will
@@ -798,48 +800,43 @@ static const struct panfrost_compatible amlogic_data = {
* coupled regulators instead.
*/
static const char * const legacy_supplies[] = { "mali", "sram", NULL };
-static const char * const mediatek_mt8183_pm_domains[] = { "core0", "core1", "core2" };
static const struct panfrost_compatible mediatek_mt8183_data = {
.num_supplies = ARRAY_SIZE(legacy_supplies) - 1,
.supply_names = legacy_supplies,
- .num_pm_domains = ARRAY_SIZE(mediatek_mt8183_pm_domains),
- .pm_domain_names = mediatek_mt8183_pm_domains,
+ .num_pm_domains = 3,
+ .pm_domain_names = mediatek_pm_domains,
};
static const struct panfrost_compatible mediatek_mt8183_b_data = {
.num_supplies = ARRAY_SIZE(default_supplies) - 1,
.supply_names = default_supplies,
- .num_pm_domains = ARRAY_SIZE(mediatek_mt8183_pm_domains),
- .pm_domain_names = mediatek_mt8183_pm_domains,
+ .num_pm_domains = 3,
+ .pm_domain_names = mediatek_pm_domains,
.pm_features = BIT(GPU_PM_CLK_DIS) | BIT(GPU_PM_VREG_OFF),
};
-static const char * const mediatek_mt8186_pm_domains[] = { "core0", "core1" };
static const struct panfrost_compatible mediatek_mt8186_data = {
.num_supplies = ARRAY_SIZE(default_supplies) - 1,
.supply_names = default_supplies,
- .num_pm_domains = ARRAY_SIZE(mediatek_mt8186_pm_domains),
- .pm_domain_names = mediatek_mt8186_pm_domains,
+ .num_pm_domains = 2,
+ .pm_domain_names = mediatek_pm_domains,
.pm_features = BIT(GPU_PM_CLK_DIS) | BIT(GPU_PM_VREG_OFF),
};
-/* MT8188 uses the same power domains and power supplies as MT8183 */
static const struct panfrost_compatible mediatek_mt8188_data = {
.num_supplies = ARRAY_SIZE(default_supplies) - 1,
.supply_names = default_supplies,
- .num_pm_domains = ARRAY_SIZE(mediatek_mt8183_pm_domains),
- .pm_domain_names = mediatek_mt8183_pm_domains,
+ .num_pm_domains = 3,
+ .pm_domain_names = mediatek_pm_domains,
.pm_features = BIT(GPU_PM_CLK_DIS) | BIT(GPU_PM_VREG_OFF),
.gpu_quirks = BIT(GPU_QUIRK_FORCE_AARCH64_PGTABLE),
};
-static const char * const mediatek_mt8192_pm_domains[] = { "core0", "core1", "core2",
- "core3", "core4" };
static const struct panfrost_compatible mediatek_mt8192_data = {
.num_supplies = ARRAY_SIZE(default_supplies) - 1,
.supply_names = default_supplies,
- .num_pm_domains = ARRAY_SIZE(mediatek_mt8192_pm_domains),
- .pm_domain_names = mediatek_mt8192_pm_domains,
+ .num_pm_domains = 5,
+ .pm_domain_names = mediatek_pm_domains,
.pm_features = BIT(GPU_PM_CLK_DIS) | BIT(GPU_PM_VREG_OFF),
.gpu_quirks = BIT(GPU_QUIRK_FORCE_AARCH64_PGTABLE),
};
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 023/143] drm/panfrost: Add support for Mali on the MT8370 SoC
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2025-09-30 14:45 ` [PATCH 6.16 022/143] drm/panfrost: Commonize Mediatek power domain array definitions Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 024/143] mmc: sdhci-cadence: add Mobileye eyeQ support Greg Kroah-Hartman
` (131 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Steven Price,
AngeloGioacchino Del Regno, Louis-Alexis Eyraud, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com>
[ Upstream commit 81645377c231803389ab0f2d09df6622e32dd327 ]
Add a compatible for the MediaTek MT8370 SoC, with an integrated ARM
Mali G57 MC2 GPU (Valhall-JM, dual core), with new platform data for
its support in the panfrost driver.
It uses the same data as MT8186 for the power management features to
describe power supplies, pm_domains and enablement (one regulator, two
power domains) but also sets the FORCE_AARCH64_PGTABLE flag in the GPU
configuration quirks bitfield to enable AARCH64 4K page table format
mode.
As MT8186 and MT8370 SoC have different GPU architecture (Mali G52 2EE
MC2 for MT8186), making them not compatible, and this mode is only
enabled for Mediatek SoC that are Mali G57 based (compatible with
mediatek,mali-mt8188 or mediatek,mali-8192), having specific platform
data allows to set this flag for MT8370 without modifying MT8186
configuration and behaviour.
Reviewed-by: Steven Price <steven.price@arm.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Louis-Alexis Eyraud <louisalexis.eyraud@collabora.com>
Signed-off-by: Steven Price <steven.price@arm.com>
Link: https://lore.kernel.org/r/20250509-mt8370-enable-gpu-v6-4-2833888cb1d3@collabora.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panfrost/panfrost_drv.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/gpu/drm/panfrost/panfrost_drv.c b/drivers/gpu/drm/panfrost/panfrost_drv.c
index 21b28bef84015..07cd67baa81bf 100644
--- a/drivers/gpu/drm/panfrost/panfrost_drv.c
+++ b/drivers/gpu/drm/panfrost/panfrost_drv.c
@@ -841,6 +841,15 @@ static const struct panfrost_compatible mediatek_mt8192_data = {
.gpu_quirks = BIT(GPU_QUIRK_FORCE_AARCH64_PGTABLE),
};
+static const struct panfrost_compatible mediatek_mt8370_data = {
+ .num_supplies = ARRAY_SIZE(default_supplies) - 1,
+ .supply_names = default_supplies,
+ .num_pm_domains = 2,
+ .pm_domain_names = mediatek_pm_domains,
+ .pm_features = BIT(GPU_PM_CLK_DIS) | BIT(GPU_PM_VREG_OFF),
+ .gpu_quirks = BIT(GPU_QUIRK_FORCE_AARCH64_PGTABLE),
+};
+
static const struct of_device_id dt_match[] = {
/* Set first to probe before the generic compatibles */
{ .compatible = "amlogic,meson-gxm-mali",
@@ -863,6 +872,7 @@ static const struct of_device_id dt_match[] = {
{ .compatible = "mediatek,mt8186-mali", .data = &mediatek_mt8186_data },
{ .compatible = "mediatek,mt8188-mali", .data = &mediatek_mt8188_data },
{ .compatible = "mediatek,mt8192-mali", .data = &mediatek_mt8192_data },
+ { .compatible = "mediatek,mt8370-mali", .data = &mediatek_mt8370_data },
{ .compatible = "allwinner,sun50i-h616-mali", .data = &allwinner_h616_data },
{}
};
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 024/143] mmc: sdhci-cadence: add Mobileye eyeQ support
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2025-09-30 14:45 ` [PATCH 6.16 023/143] drm/panfrost: Add support for Mali on the MT8370 SoC Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 025/143] i2c: designware: Add quirk for Intel Xe Greg Kroah-Hartman
` (130 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benoît Monin, Ulf Hansson,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benoît Monin <benoit.monin@bootlin.com>
[ Upstream commit 120ffe250dd95b5089d032f582c5be9e3a04b94b ]
The MMC/SDHCI controller implemented by Mobileye needs the preset value
quirks to configure the clock properly at speed slower than HS200.
It otherwise works as a standard sd4hc controller.
Signed-off-by: Benoît Monin <benoit.monin@bootlin.com>
Link: https://lore.kernel.org/r/e97f409650495791e07484589e1666ead570fa12.1750156323.git.benoit.monin@bootlin.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mmc/host/sdhci-cadence.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/drivers/mmc/host/sdhci-cadence.c b/drivers/mmc/host/sdhci-cadence.c
index a94b297fcf2a3..60ca09780da32 100644
--- a/drivers/mmc/host/sdhci-cadence.c
+++ b/drivers/mmc/host/sdhci-cadence.c
@@ -433,6 +433,13 @@ static const struct sdhci_cdns_drv_data sdhci_elba_drv_data = {
},
};
+static const struct sdhci_cdns_drv_data sdhci_eyeq_drv_data = {
+ .pltfm_data = {
+ .ops = &sdhci_cdns_ops,
+ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN,
+ },
+};
+
static const struct sdhci_cdns_drv_data sdhci_cdns_drv_data = {
.pltfm_data = {
.ops = &sdhci_cdns_ops,
@@ -595,6 +602,10 @@ static const struct of_device_id sdhci_cdns_match[] = {
.compatible = "amd,pensando-elba-sd4hc",
.data = &sdhci_elba_drv_data,
},
+ {
+ .compatible = "mobileye,eyeq-sd4hc",
+ .data = &sdhci_eyeq_drv_data,
+ },
{ .compatible = "cdns,sd4hc" },
{ /* sentinel */ }
};
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 025/143] i2c: designware: Add quirk for Intel Xe
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2025-09-30 14:45 ` [PATCH 6.16 024/143] mmc: sdhci-cadence: add Mobileye eyeQ support Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 026/143] ASoC: Intel: soc-acpi: Add entry for sof_es8336 in PTL match table Greg Kroah-Hartman
` (129 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jarkko Nikula, Michael J. Ruhl,
Heikki Krogerus, Andi Shyti, Rodrigo Vivi, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
[ Upstream commit f6a8e9f3de4567c71ef9f5f13719df69a8b96081 ]
The regmap is coming from the parent also in case of Xe
GPUs. Reusing the Wangxun quirk for that.
Acked-by: Jarkko Nikula <jarkko.nikula@linux.intel.com>
Co-developed-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
Signed-off-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Reviewed-by: Andi Shyti <andi.shyti@kernel.org>
Link: https://lore.kernel.org/r/20250701122252.2590230-3-heikki.krogerus@linux.intel.com
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
[Rodrigo fixed the co-developed tags while merging]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i2c/busses/i2c-designware-platdrv.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
index 879719e91df2a..c1262df02cdb2 100644
--- a/drivers/i2c/busses/i2c-designware-platdrv.c
+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
@@ -101,7 +101,7 @@ static int bt1_i2c_request_regs(struct dw_i2c_dev *dev)
}
#endif
-static int txgbe_i2c_request_regs(struct dw_i2c_dev *dev)
+static int dw_i2c_get_parent_regmap(struct dw_i2c_dev *dev)
{
dev->map = dev_get_regmap(dev->dev->parent, NULL);
if (!dev->map)
@@ -123,12 +123,15 @@ static int dw_i2c_plat_request_regs(struct dw_i2c_dev *dev)
struct platform_device *pdev = to_platform_device(dev->dev);
int ret;
+ if (device_is_compatible(dev->dev, "intel,xe-i2c"))
+ return dw_i2c_get_parent_regmap(dev);
+
switch (dev->flags & MODEL_MASK) {
case MODEL_BAIKAL_BT1:
ret = bt1_i2c_request_regs(dev);
break;
case MODEL_WANGXUN_SP:
- ret = txgbe_i2c_request_regs(dev);
+ ret = dw_i2c_get_parent_regmap(dev);
break;
default:
dev->base = devm_platform_ioremap_resource(pdev, 0);
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 026/143] ASoC: Intel: soc-acpi: Add entry for sof_es8336 in PTL match table.
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2025-09-30 14:45 ` [PATCH 6.16 025/143] i2c: designware: Add quirk for Intel Xe Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 027/143] ASoC: Intel: soc-acpi: Add entry for HDMI_In capture support " Greg Kroah-Hartman
` (128 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Balamurugan C, Liam Girdwood,
Bard Liao, Mark Brown, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Balamurugan C <balamurugan.c@intel.com>
[ Upstream commit 2813f535b5847771d9e56df678c523a7e64f860e ]
Adding ES83x6 I2S codec support for PTL platforms and entry in match table.
Signed-off-by: Balamurugan C <balamurugan.c@intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://patch.msgid.link/20250708080030.1257790-2-yung-chuan.liao@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: 03aa2ed9e187 ("ASoC: Intel: sof_rt5682: Add HDMI-In capture with rt5682 support for PTL.")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/intel/common/soc-acpi-intel-ptl-match.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/sound/soc/intel/common/soc-acpi-intel-ptl-match.c b/sound/soc/intel/common/soc-acpi-intel-ptl-match.c
index eae75f3f0fa40..ff4f2fbf9271d 100644
--- a/sound/soc/intel/common/soc-acpi-intel-ptl-match.c
+++ b/sound/soc/intel/common/soc-acpi-intel-ptl-match.c
@@ -21,6 +21,11 @@ static const struct snd_soc_acpi_codecs ptl_rt5682_rt5682s_hp = {
.codecs = {RT5682_ACPI_HID, RT5682S_ACPI_HID},
};
+static const struct snd_soc_acpi_codecs ptl_essx_83x6 = {
+ .num_codecs = 3,
+ .codecs = { "ESSX8316", "ESSX8326", "ESSX8336"},
+};
+
struct snd_soc_acpi_mach snd_soc_acpi_intel_ptl_machines[] = {
{
.comp_ids = &ptl_rt5682_rt5682s_hp,
@@ -29,6 +34,14 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_ptl_machines[] = {
.tplg_quirk_mask = SND_SOC_ACPI_TPLG_INTEL_AMP_NAME |
SND_SOC_ACPI_TPLG_INTEL_CODEC_NAME,
},
+ {
+ .comp_ids = &ptl_essx_83x6,
+ .drv_name = "sof-essx8336",
+ .sof_tplg_filename = "sof-ptl-es8336", /* the tplg suffix is added at run time */
+ .tplg_quirk_mask = SND_SOC_ACPI_TPLG_INTEL_SSP_NUMBER |
+ SND_SOC_ACPI_TPLG_INTEL_SSP_MSB |
+ SND_SOC_ACPI_TPLG_INTEL_DMIC_NUMBER,
+ },
{},
};
EXPORT_SYMBOL_GPL(snd_soc_acpi_intel_ptl_machines);
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 027/143] ASoC: Intel: soc-acpi: Add entry for HDMI_In capture support in PTL match table
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2025-09-30 14:45 ` [PATCH 6.16 026/143] ASoC: Intel: soc-acpi: Add entry for sof_es8336 in PTL match table Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 028/143] ASoC: Intel: sof_rt5682: Add HDMI-In capture with rt5682 support for PTL Greg Kroah-Hartman
` (127 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Balamurugan C, Liam Girdwood,
Bard Liao, Mark Brown, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Balamurugan C <balamurugan.c@intel.com>
[ Upstream commit fb00ab1f39369e49d25c74f0d41e4c1ec2f12576 ]
Adding HDMI-In capture via I2S feature support in PTL platform.
Signed-off-by: Balamurugan C <balamurugan.c@intel.com>
Reviewed-by: Liam Girdwood <liam.r.girdwood@intel.com>
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://patch.msgid.link/20250708080030.1257790-3-yung-chuan.liao@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: 03aa2ed9e187 ("ASoC: Intel: sof_rt5682: Add HDMI-In capture with rt5682 support for PTL.")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/intel/boards/sof_es8336.c | 10 ++++++++++
sound/soc/intel/common/soc-acpi-intel-ptl-match.c | 12 ++++++++++++
2 files changed, 22 insertions(+)
diff --git a/sound/soc/intel/boards/sof_es8336.c b/sound/soc/intel/boards/sof_es8336.c
index a0b3679b17b42..1211a2b8a2a2c 100644
--- a/sound/soc/intel/boards/sof_es8336.c
+++ b/sound/soc/intel/boards/sof_es8336.c
@@ -826,6 +826,16 @@ static const struct platform_device_id board_ids[] = {
SOF_ES8336_SPEAKERS_EN_GPIO1_QUIRK |
SOF_ES8336_JD_INVERTED),
},
+ {
+ .name = "ptl_es83x6_c1_h02",
+ .driver_data = (kernel_ulong_t)(SOF_ES8336_SSP_CODEC(1) |
+ SOF_NO_OF_HDMI_CAPTURE_SSP(2) |
+ SOF_HDMI_CAPTURE_1_SSP(0) |
+ SOF_HDMI_CAPTURE_2_SSP(2) |
+ SOF_SSP_HDMI_CAPTURE_PRESENT |
+ SOF_ES8336_SPEAKERS_EN_GPIO1_QUIRK |
+ SOF_ES8336_JD_INVERTED),
+ },
{ }
};
MODULE_DEVICE_TABLE(platform, board_ids);
diff --git a/sound/soc/intel/common/soc-acpi-intel-ptl-match.c b/sound/soc/intel/common/soc-acpi-intel-ptl-match.c
index ff4f2fbf9271d..67f1091483dce 100644
--- a/sound/soc/intel/common/soc-acpi-intel-ptl-match.c
+++ b/sound/soc/intel/common/soc-acpi-intel-ptl-match.c
@@ -26,6 +26,11 @@ static const struct snd_soc_acpi_codecs ptl_essx_83x6 = {
.codecs = { "ESSX8316", "ESSX8326", "ESSX8336"},
};
+static const struct snd_soc_acpi_codecs ptl_lt6911_hdmi = {
+ .num_codecs = 1,
+ .codecs = {"INTC10B0"}
+};
+
struct snd_soc_acpi_mach snd_soc_acpi_intel_ptl_machines[] = {
{
.comp_ids = &ptl_rt5682_rt5682s_hp,
@@ -34,6 +39,13 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_ptl_machines[] = {
.tplg_quirk_mask = SND_SOC_ACPI_TPLG_INTEL_AMP_NAME |
SND_SOC_ACPI_TPLG_INTEL_CODEC_NAME,
},
+ {
+ .comp_ids = &ptl_essx_83x6,
+ .drv_name = "ptl_es83x6_c1_h02",
+ .machine_quirk = snd_soc_acpi_codec_list,
+ .quirk_data = &ptl_lt6911_hdmi,
+ .sof_tplg_filename = "sof-ptl-es83x6-ssp1-hdmi-ssp02.tplg",
+ },
{
.comp_ids = &ptl_essx_83x6,
.drv_name = "sof-essx8336",
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 028/143] ASoC: Intel: sof_rt5682: Add HDMI-In capture with rt5682 support for PTL.
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2025-09-30 14:45 ` [PATCH 6.16 027/143] ASoC: Intel: soc-acpi: Add entry for HDMI_In capture support " Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 029/143] platform/x86: oxpec: Add support for OneXPlayer X1 Mini Pro (Strix Point) Greg Kroah-Hartman
` (126 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Balamurugan C, Bard Liao, Mark Brown,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Balamurugan C <balamurugan.c@intel.com>
[ Upstream commit 03aa2ed9e187e42f25b3871b691d535fc19156c4 ]
Added match table entry on ptl machines to support HDMI-In capture
with rt5682 I2S audio codec. also added the respective quirk
configuration in rt5682 machine driver.
Signed-off-by: Balamurugan C <balamurugan.c@intel.com>
Signed-off-by: Bard Liao <yung-chuan.liao@linux.intel.com>
Link: https://patch.msgid.link/20250716082300.1810352-1-yung-chuan.liao@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/intel/boards/sof_rt5682.c | 7 +++++++
sound/soc/intel/common/soc-acpi-intel-ptl-match.c | 7 +++++++
2 files changed, 14 insertions(+)
diff --git a/sound/soc/intel/boards/sof_rt5682.c b/sound/soc/intel/boards/sof_rt5682.c
index f5925bd0a3fc6..4994aaccc583a 100644
--- a/sound/soc/intel/boards/sof_rt5682.c
+++ b/sound/soc/intel/boards/sof_rt5682.c
@@ -892,6 +892,13 @@ static const struct platform_device_id board_ids[] = {
SOF_SSP_PORT_BT_OFFLOAD(2) |
SOF_BT_OFFLOAD_PRESENT),
},
+ {
+ .name = "ptl_rt5682_c1_h02",
+ .driver_data = (kernel_ulong_t)(SOF_RT5682_MCLK_EN |
+ SOF_SSP_PORT_CODEC(1) |
+ /* SSP 0 and SSP 2 are used for HDMI IN */
+ SOF_SSP_MASK_HDMI_CAPTURE(0x5)),
+ },
{ }
};
MODULE_DEVICE_TABLE(platform, board_ids);
diff --git a/sound/soc/intel/common/soc-acpi-intel-ptl-match.c b/sound/soc/intel/common/soc-acpi-intel-ptl-match.c
index 67f1091483dce..d90d8672ab77d 100644
--- a/sound/soc/intel/common/soc-acpi-intel-ptl-match.c
+++ b/sound/soc/intel/common/soc-acpi-intel-ptl-match.c
@@ -32,6 +32,13 @@ static const struct snd_soc_acpi_codecs ptl_lt6911_hdmi = {
};
struct snd_soc_acpi_mach snd_soc_acpi_intel_ptl_machines[] = {
+ {
+ .comp_ids = &ptl_rt5682_rt5682s_hp,
+ .drv_name = "ptl_rt5682_c1_h02",
+ .machine_quirk = snd_soc_acpi_codec_list,
+ .quirk_data = &ptl_lt6911_hdmi,
+ .sof_tplg_filename = "sof-ptl-rt5682-ssp1-hdmi-ssp02.tplg",
+ },
{
.comp_ids = &ptl_rt5682_rt5682s_hp,
.drv_name = "ptl_rt5682_def",
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 029/143] platform/x86: oxpec: Add support for OneXPlayer X1 Mini Pro (Strix Point)
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2025-09-30 14:45 ` [PATCH 6.16 028/143] ASoC: Intel: sof_rt5682: Add HDMI-In capture with rt5682 support for PTL Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 030/143] ALSA: usb-audio: Add DSD support for Comtrue USB Audio device Greg Kroah-Hartman
` (125 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Antheas Kapenekakis,
Ilpo Järvinen, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Antheas Kapenekakis <lkml@antheas.dev>
[ Upstream commit 1798561befd8be1e52feb54f850efcab5a595f43 ]
The OneXPlayer X1 Mini Pro (which is the Strix Point variant of the Mini)
uses the same registers as the X1 Mini, so re-use the quirk.
Signed-off-by: Antheas Kapenekakis <lkml@antheas.dev>
Link: https://lore.kernel.org/r/20250718163305.159232-2-lkml@antheas.dev
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/oxpec.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/platform/x86/oxpec.c b/drivers/platform/x86/oxpec.c
index 9839e8cb82ce4..eb076bb4099be 100644
--- a/drivers/platform/x86/oxpec.c
+++ b/drivers/platform/x86/oxpec.c
@@ -292,6 +292,13 @@ static const struct dmi_system_id dmi_table[] = {
},
.driver_data = (void *)oxp_x1,
},
+ {
+ .matches = {
+ DMI_MATCH(DMI_BOARD_VENDOR, "ONE-NETBOOK"),
+ DMI_EXACT_MATCH(DMI_BOARD_NAME, "ONEXPLAYER X1Mini Pro"),
+ },
+ .driver_data = (void *)oxp_x1,
+ },
{
.matches = {
DMI_MATCH(DMI_BOARD_VENDOR, "ONE-NETBOOK"),
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 030/143] ALSA: usb-audio: Add DSD support for Comtrue USB Audio device
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2025-09-30 14:45 ` [PATCH 6.16 029/143] platform/x86: oxpec: Add support for OneXPlayer X1 Mini Pro (Strix Point) Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 031/143] gpiolib: acpi: Add quirk for ASUS ProArt PX13 Greg Kroah-Hartman
` (124 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, noble.yang, Takashi Iwai,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: noble.yang <noble.yang@comtrue-inc.com>
[ Upstream commit e9df1755485dd90a89656e8a21ec4d71c909fa30 ]
The vendor Comtrue Inc. (0x2fc6) produces USB audio chipsets like
the CT7601 which are capable of Native DSD playback.
This patch adds QUIRK_FLAG_DSD_RAW for Comtrue (VID 0x2fc6), which enables
native DSD playback (DSD_U32_LE) on their USB Audio device. This has been
verified under Ubuntu 25.04 with JRiver.
Signed-off-by: noble.yang <noble.yang@comtrue-inc.com>
Link: https://patch.msgid.link/20250731110614.4070-1-noble228@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/quirks.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index bd24f3a78ea9d..e75b0b1df6eb2 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -2408,6 +2408,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
QUIRK_FLAG_DSD_RAW),
VENDOR_FLG(0x2d87, /* Cayin device */
QUIRK_FLAG_DSD_RAW),
+ VENDOR_FLG(0x2fc6, /* Comture-inc devices */
+ QUIRK_FLAG_DSD_RAW),
VENDOR_FLG(0x3336, /* HEM devices */
QUIRK_FLAG_DSD_RAW),
VENDOR_FLG(0x3353, /* Khadas devices */
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 031/143] gpiolib: acpi: Add quirk for ASUS ProArt PX13
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2025-09-30 14:45 ` [PATCH 6.16 030/143] ALSA: usb-audio: Add DSD support for Comtrue USB Audio device Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 032/143] ALSA: usb-audio: move mixer_quirks min_mute into common quirk Greg Kroah-Hartman
` (123 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Amit Chaudhari,
Mario Limonciello (AMD), Mika Westerberg, Linus Walleij,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello (AMD) <superm1@kernel.org>
[ Upstream commit 23800ad1265f10c2bc6f42154ce4d20e59f2900e ]
The ASUS ProArt PX13 has a spurious wakeup event from the touchpad
a few moments after entering hardware sleep. This can be avoided
by preventing the touchpad from being a wake source.
Add to the wakeup ignore list.
Reported-by: Amit Chaudhari <amitchaudhari@mac.com>
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4482
Tested-by: Amit Chaudhari <amitchaudhari@mac.com>
Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
Reviewed-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Link: https://lore.kernel.org/20250814183430.3887973-1-superm1@kernel.org
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/gpiolib-acpi-quirks.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/drivers/gpio/gpiolib-acpi-quirks.c b/drivers/gpio/gpiolib-acpi-quirks.c
index c13545dce3492..bfb04e67c4bc8 100644
--- a/drivers/gpio/gpiolib-acpi-quirks.c
+++ b/drivers/gpio/gpiolib-acpi-quirks.c
@@ -344,6 +344,20 @@ static const struct dmi_system_id gpiolib_acpi_quirks[] __initconst = {
.ignore_interrupt = "AMDI0030:00@8",
},
},
+ {
+ /*
+ * Spurious wakeups from TP_ATTN# pin
+ * Found in BIOS 5.35
+ * https://gitlab.freedesktop.org/drm/amd/-/issues/4482
+ */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+ DMI_MATCH(DMI_PRODUCT_FAMILY, "ProArt PX13"),
+ },
+ .driver_data = &(struct acpi_gpiolib_dmi_quirk) {
+ .ignore_wake = "ASCP1A00:00@8",
+ },
+ },
{} /* Terminating entry */
};
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 032/143] ALSA: usb-audio: move mixer_quirks min_mute into common quirk
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2025-09-30 14:45 ` [PATCH 6.16 031/143] gpiolib: acpi: Add quirk for ASUS ProArt PX13 Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 033/143] ALSA: usb-audio: Add mute TLV for playback volumes on more devices Greg Kroah-Hartman
` (122 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guoli An, Cryolitia PukNgae,
Takashi Iwai, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cryolitia PukNgae <cryolitia@uniontech.com>
[ Upstream commit 2c3ca8cc55a3afc7a4fa99ed8f5f5d05dd2e65b3 ]
We have found more and more devices that have the same problem, that
the mixer's minimum value is muted. Accroding to pipewire's MR[1]
and Arch Linux wiki[2], this should be a very common problem in USB
audio devices. Move the quirk into common quirk,as a preparation of
more devices' quirk's patch coming on the road[3].
1. https://gitlab.freedesktop.org/pipewire/pipewire/-/merge_requests/2514
2. https://wiki.archlinux.org/index.php?title=PipeWire&oldid=804138#No_sound_from_USB_DAC_until_30%_volume
3. On the road, in the physical sense. We have been buying ton of
these devices for testing the problem.
Tested-by: Guoli An <anguoli@uniontech.com>
Signed-off-by: Cryolitia PukNgae <cryolitia@uniontech.com>
Link: https://patch.msgid.link/20250827-sound-quirk-min-mute-v1-1-4717aa8a4f6a@uniontech.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/mixer_quirks.c | 10 +++-------
sound/usb/quirks.c | 12 ++++++++++--
sound/usb/usbaudio.h | 4 ++++
3 files changed, 17 insertions(+), 9 deletions(-)
diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index 6b47b3145d2cf..3df537fdb9f1c 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -4608,16 +4608,12 @@ void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer,
if (unitid == 7 && cval->control == UAC_FU_VOLUME)
snd_dragonfly_quirk_db_scale(mixer, cval, kctl);
break;
+ }
+
/* lowest playback value is muted on some devices */
- case USB_ID(0x0572, 0x1b09): /* Conexant Systems (Rockwell), Inc. */
- case USB_ID(0x0d8c, 0x000c): /* C-Media */
- case USB_ID(0x0d8c, 0x0014): /* C-Media */
- case USB_ID(0x19f7, 0x0003): /* RODE NT-USB */
- case USB_ID(0x2d99, 0x0026): /* HECATE G2 GAMING HEADSET */
+ if (mixer->chip->quirk_flags & QUIRK_FLAG_MIXER_MIN_MUTE)
if (strstr(kctl->id.name, "Playback"))
cval->min_mute = 1;
- break;
- }
/* ALSA-ify some Plantronics headset control names */
if (USB_ID_VENDOR(mixer->chip->usb_id) == 0x047f &&
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index e75b0b1df6eb2..8bc1e247cdf1a 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -2199,6 +2199,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
QUIRK_FLAG_SET_IFACE_FIRST),
DEVICE_FLG(0x0556, 0x0014, /* Phoenix Audio TMX320VC */
QUIRK_FLAG_GET_SAMPLE_RATE),
+ DEVICE_FLG(0x0572, 0x1b09, /* Conexant Systems (Rockwell), Inc. */
+ QUIRK_FLAG_MIXER_MIN_MUTE),
DEVICE_FLG(0x05a3, 0x9420, /* ELP HD USB Camera */
QUIRK_FLAG_GET_SAMPLE_RATE),
DEVICE_FLG(0x05a7, 0x1020, /* Bose Companion 5 */
@@ -2245,8 +2247,10 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
QUIRK_FLAG_GET_SAMPLE_RATE),
DEVICE_FLG(0x0c45, 0x636b, /* Microdia JP001 USB Camera */
QUIRK_FLAG_GET_SAMPLE_RATE),
- DEVICE_FLG(0x0d8c, 0x0014, /* USB Audio Device */
- QUIRK_FLAG_CTL_MSG_DELAY_1M),
+ DEVICE_FLG(0x0d8c, 0x000c, /* C-Media */
+ QUIRK_FLAG_MIXER_MIN_MUTE),
+ DEVICE_FLG(0x0d8c, 0x0014, /* C-Media */
+ QUIRK_FLAG_CTL_MSG_DELAY_1M | QUIRK_FLAG_MIXER_MIN_MUTE),
DEVICE_FLG(0x0ecb, 0x205c, /* JBL Quantum610 Wireless */
QUIRK_FLAG_FIXED_RATE),
DEVICE_FLG(0x0ecb, 0x2069, /* JBL Quantum810 Wireless */
@@ -2293,6 +2297,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
QUIRK_FLAG_ITF_USB_DSD_DAC | QUIRK_FLAG_CTL_MSG_DELAY),
DEVICE_FLG(0x1901, 0x0191, /* GE B850V3 CP2114 audio interface */
QUIRK_FLAG_GET_SAMPLE_RATE),
+ DEVICE_FLG(0x19f7, 0x0003, /* RODE NT-USB */
+ QUIRK_FLAG_MIXER_MIN_MUTE),
DEVICE_FLG(0x19f7, 0x0035, /* RODE NT-USB+ */
QUIRK_FLAG_GET_SAMPLE_RATE),
DEVICE_FLG(0x1bcf, 0x2281, /* HD Webcam */
@@ -2353,6 +2359,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
QUIRK_FLAG_CTL_MSG_DELAY_1M),
DEVICE_FLG(0x2d95, 0x8021, /* VIVO USB-C-XE710 HEADSET */
QUIRK_FLAG_CTL_MSG_DELAY_1M),
+ DEVICE_FLG(0x2d99, 0x0026, /* HECATE G2 GAMING HEADSET */
+ QUIRK_FLAG_MIXER_MIN_MUTE),
DEVICE_FLG(0x2fc6, 0xf0b7, /* iBasso DC07 Pro */
QUIRK_FLAG_CTL_MSG_DELAY_1M),
DEVICE_FLG(0x30be, 0x0101, /* Schiit Hel */
diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h
index 158ec053dc44d..1ef4d39978df3 100644
--- a/sound/usb/usbaudio.h
+++ b/sound/usb/usbaudio.h
@@ -196,6 +196,9 @@ extern bool snd_usb_skip_validation;
* for the given endpoint.
* QUIRK_FLAG_MIC_RES_16 and QUIRK_FLAG_MIC_RES_384
* Set the fixed resolution for Mic Capture Volume (mostly for webcams)
+ * QUIRK_FLAG_MIXER_MIN_MUTE
+ * Set minimum volume control value as mute for devices where the lowest
+ * playback value represents muted state instead of minimum audible volume
*/
#define QUIRK_FLAG_GET_SAMPLE_RATE (1U << 0)
@@ -222,5 +225,6 @@ extern bool snd_usb_skip_validation;
#define QUIRK_FLAG_FIXED_RATE (1U << 21)
#define QUIRK_FLAG_MIC_RES_16 (1U << 22)
#define QUIRK_FLAG_MIC_RES_384 (1U << 23)
+#define QUIRK_FLAG_MIXER_MIN_MUTE (1U << 24)
#endif /* __USBAUDIO_H */
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 033/143] ALSA: usb-audio: Add mute TLV for playback volumes on more devices
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2025-09-30 14:45 ` [PATCH 6.16 032/143] ALSA: usb-audio: move mixer_quirks min_mute into common quirk Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 034/143] net: sfp: add quirk for FLYPRO copper SFP+ module Greg Kroah-Hartman
` (121 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cryolitia PukNgae, qaqland,
Takashi Iwai, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: qaqland <anguoli@uniontech.com>
[ Upstream commit 2cbe4ac193ed7172cfd825c0cc46ce4a41be4ba1 ]
Applying the quirk of that, the lowest Playback mixer volume setting
mutes the audio output, on more devices.
Suggested-by: Cryolitia PukNgae <cryolitia@uniontech.com>
Signed-off-by: qaqland <anguoli@uniontech.com>
Link: https://patch.msgid.link/20250829-sound_quirk-v1-1-745529b44440@uniontech.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/quirks.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index 8bc1e247cdf1a..766db7d00cbc9 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -2199,6 +2199,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
QUIRK_FLAG_SET_IFACE_FIRST),
DEVICE_FLG(0x0556, 0x0014, /* Phoenix Audio TMX320VC */
QUIRK_FLAG_GET_SAMPLE_RATE),
+ DEVICE_FLG(0x0572, 0x1b08, /* Conexant Systems (Rockwell), Inc. */
+ QUIRK_FLAG_MIXER_MIN_MUTE),
DEVICE_FLG(0x0572, 0x1b09, /* Conexant Systems (Rockwell), Inc. */
QUIRK_FLAG_MIXER_MIN_MUTE),
DEVICE_FLG(0x05a3, 0x9420, /* ELP HD USB Camera */
@@ -2243,6 +2245,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
QUIRK_FLAG_CTL_MSG_DELAY_1M),
DEVICE_FLG(0x0b0e, 0x0349, /* Jabra 550a */
QUIRK_FLAG_CTL_MSG_DELAY_1M),
+ DEVICE_FLG(0x0bda, 0x498a, /* Realtek Semiconductor Corp. */
+ QUIRK_FLAG_MIXER_MIN_MUTE),
DEVICE_FLG(0x0c45, 0x6340, /* Sonix HD USB Camera */
QUIRK_FLAG_GET_SAMPLE_RATE),
DEVICE_FLG(0x0c45, 0x636b, /* Microdia JP001 USB Camera */
@@ -2259,6 +2263,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
QUIRK_FLAG_SHARE_MEDIA_DEVICE | QUIRK_FLAG_ALIGN_TRANSFER),
DEVICE_FLG(0x1101, 0x0003, /* Audioengine D1 */
QUIRK_FLAG_GET_SAMPLE_RATE),
+ DEVICE_FLG(0x12d1, 0x3a07, /* Huawei Technologies Co., Ltd. */
+ QUIRK_FLAG_MIXER_MIN_MUTE),
DEVICE_FLG(0x1224, 0x2a25, /* Jieli Technology USB PHY 2.0 */
QUIRK_FLAG_GET_SAMPLE_RATE | QUIRK_FLAG_MIC_RES_16),
DEVICE_FLG(0x1395, 0x740a, /* Sennheiser DECT */
@@ -2349,6 +2355,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
QUIRK_FLAG_IGNORE_CTL_ERROR),
DEVICE_FLG(0x2912, 0x30c8, /* Audioengine D1 */
QUIRK_FLAG_GET_SAMPLE_RATE),
+ DEVICE_FLG(0x2a70, 0x1881, /* OnePlus Technology (Shenzhen) Co., Ltd. BE02T */
+ QUIRK_FLAG_MIXER_MIN_MUTE),
DEVICE_FLG(0x2b53, 0x0023, /* Fiero SC-01 (firmware v1.0.0 @ 48 kHz) */
QUIRK_FLAG_GENERIC_IMPLICIT_FB),
DEVICE_FLG(0x2b53, 0x0024, /* Fiero SC-01 (firmware v1.0.0 @ 96 kHz) */
@@ -2365,6 +2373,8 @@ static const struct usb_audio_quirk_flags_table quirk_flags_table[] = {
QUIRK_FLAG_CTL_MSG_DELAY_1M),
DEVICE_FLG(0x30be, 0x0101, /* Schiit Hel */
QUIRK_FLAG_IGNORE_CTL_ERROR),
+ DEVICE_FLG(0x339b, 0x3a07, /* Synaptics HONOR USB-C HEADSET */
+ QUIRK_FLAG_MIXER_MIN_MUTE),
DEVICE_FLG(0x413c, 0xa506, /* Dell AE515 sound bar */
QUIRK_FLAG_GET_SAMPLE_RATE),
DEVICE_FLG(0x534d, 0x0021, /* MacroSilicon MS2100/MS2106 */
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 034/143] net: sfp: add quirk for FLYPRO copper SFP+ module
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2025-09-30 14:45 ` [PATCH 6.16 033/143] ALSA: usb-audio: Add mute TLV for playback volumes on more devices Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 035/143] IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions Greg Kroah-Hartman
` (120 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aleksander Jan Bajkowski,
Russell King (Oracle), Jakub Kicinski, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <olek2@wp.pl>
[ Upstream commit ddbf0e78a8b20ec18d314d31336a0230fdc9b394 ]
Add quirk for a copper SFP that identifies itself as "FLYPRO"
"SFP-10GT-CS-30M". It uses RollBall protocol to talk to the PHY.
Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Link: https://patch.msgid.link/20250831105910.3174-1-olek2@wp.pl
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/phy/sfp.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
index 5347c95d1e772..4cd1d6c51dc2a 100644
--- a/drivers/net/phy/sfp.c
+++ b/drivers/net/phy/sfp.c
@@ -492,6 +492,9 @@ static const struct sfp_quirk sfp_quirks[] = {
SFP_QUIRK("ALCATELLUCENT", "3FE46541AA", sfp_quirk_2500basex,
sfp_fixup_nokia),
+ // FLYPRO SFP-10GT-CS-30M uses Rollball protocol to talk to the PHY.
+ SFP_QUIRK_F("FLYPRO", "SFP-10GT-CS-30M", sfp_fixup_rollball),
+
// Fiberstore SFP-10G-T doesn't identify as copper, uses the Rollball
// protocol to talk to the PHY and needs 4 sec wait before probing the
// PHY.
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 035/143] IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2025-09-30 14:45 ` [PATCH 6.16 034/143] net: sfp: add quirk for FLYPRO copper SFP+ module Greg Kroah-Hartman
@ 2025-09-30 14:45 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 036/143] HID: cp2112: fix setter callbacks return value Greg Kroah-Hartman
` (119 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:45 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Or Har-Toov, Edward Srouji,
Leon Romanovsky, Jason Gunthorpe, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Or Har-Toov <ohartoov@nvidia.com>
[ Upstream commit 85fe9f565d2d5af95ac2bbaa5082b8ce62b039f5 ]
Fix a bug where the driver's event subscription logic for SRQ-related
events incorrectly sets obj_type for RMP objects.
When subscribing to SRQ events, get_legacy_obj_type() did not handle
the MLX5_CMD_OP_CREATE_RMP case, which caused obj_type to be 0
(default).
This led to a mismatch between the obj_type used during subscription
(0) and the value used during notification (1, taken from the event's
type field). As a result, event mapping for SRQ objects could fail and
event notification would not be delivered correctly.
This fix adds handling for MLX5_CMD_OP_CREATE_RMP in get_legacy_obj_type,
returning MLX5_EVENT_QUEUE_TYPE_RQ so obj_type is consistent between
subscription and notification.
Fixes: 759738537142 ("IB/mlx5: Enable subscription for device events over DEVX")
Link: https://patch.msgid.link/r/8f1048e3fdd1fde6b90607ce0ed251afaf8a148c.1755088962.git.leon@kernel.org
Signed-off-by: Or Har-Toov <ohartoov@nvidia.com>
Reviewed-by: Edward Srouji <edwards@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/mlx5/devx.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c
index c369fee335621..00727472c8738 100644
--- a/drivers/infiniband/hw/mlx5/devx.c
+++ b/drivers/infiniband/hw/mlx5/devx.c
@@ -233,6 +233,7 @@ static u16 get_legacy_obj_type(u16 opcode)
{
switch (opcode) {
case MLX5_CMD_OP_CREATE_RQ:
+ case MLX5_CMD_OP_CREATE_RMP:
return MLX5_EVENT_QUEUE_TYPE_RQ;
case MLX5_CMD_OP_CREATE_QP:
return MLX5_EVENT_QUEUE_TYPE_QP;
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 036/143] HID: cp2112: fix setter callbacks return value
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2025-09-30 14:45 ` [PATCH 6.16 035/143] IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 037/143] HID: amd_sfh: Add sync across amd sfh work functions Greg Kroah-Hartman
` (118 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sébastien Szymanski,
Bartosz Golaszewski, Jiri Kosina, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
[ Upstream commit 2a5e76b9a0efc44807ff0e6b141649fac65a55ac ]
Since commit 6485543488a6 ("HID: cp2112: use new line value setter
callbacks"), setting a GPIO value always fails with error -EBADE.
That's because the returned value by the setter callbacks is the
returned value by the hid_hw_raw_request() function which is the number of
bytes sent on success or a negative value on error. The function
gpiochip_set() returns -EBADE if the setter callbacks return a value >
0.
Fix this by making the setter callbacks return 0 on success or a negative
value on error.
While at it, use the returned value by cp2112_gpio_set_unlocked() in the
direction_output callback.
Fixes: 6485543488a6 ("HID: cp2112: use new line value setter callbacks")
Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-cp2112.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c
index 234fa82eab079..b5f2b6356f512 100644
--- a/drivers/hid/hid-cp2112.c
+++ b/drivers/hid/hid-cp2112.c
@@ -229,10 +229,12 @@ static int cp2112_gpio_set_unlocked(struct cp2112_device *dev,
ret = hid_hw_raw_request(hdev, CP2112_GPIO_SET, buf,
CP2112_GPIO_SET_LENGTH, HID_FEATURE_REPORT,
HID_REQ_SET_REPORT);
- if (ret < 0)
+ if (ret != CP2112_GPIO_SET_LENGTH) {
hid_err(hdev, "error setting GPIO values: %d\n", ret);
+ return ret < 0 ? ret : -EIO;
+ }
- return ret;
+ return 0;
}
static int cp2112_gpio_set(struct gpio_chip *chip, unsigned int offset,
@@ -309,9 +311,7 @@ static int cp2112_gpio_direction_output(struct gpio_chip *chip,
* Set gpio value when output direction is already set,
* as specified in AN495, Rev. 0.2, cpt. 4.4
*/
- cp2112_gpio_set_unlocked(dev, offset, value);
-
- return 0;
+ return cp2112_gpio_set_unlocked(dev, offset, value);
}
static int cp2112_hid_get(struct hid_device *hdev, unsigned char report_number,
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 037/143] HID: amd_sfh: Add sync across amd sfh work functions
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 036/143] HID: cp2112: fix setter callbacks return value Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 038/143] arm64: dts: rockchip: Fix the headphone detection on the orangepi 5 Greg Kroah-Hartman
` (117 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthew Schwartz, Prakruthi SP,
Akshata MukundShetty, Basavaraj Natikar, Mario Limonciello (AMD),
Jiri Kosina, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
[ Upstream commit bba920e6f803138587248079de47ad3464a396f6 ]
The process of the report is delegated across different work functions.
Hence, add a sync mechanism to protect SFH work data across functions.
Fixes: 4b2c53d93a4b ("SFH:Transport Driver to add support of AMD Sensor Fusion Hub (SFH)")
Reported-by: Matthew Schwartz <matthew.schwartz@linux.dev>
Closes: https://lore.kernel.org/all/a21abca5-4268-449d-95f1-bdd7a25894a5@linux.dev/
Tested-by: Prakruthi SP <Prakruthi.SP@amd.com>
Co-developed-by: Akshata MukundShetty <akshata.mukundshetty@amd.com>
Signed-off-by: Akshata MukundShetty <akshata.mukundshetty@amd.com>
Signed-off-by: Basavaraj Natikar <Basavaraj.Natikar@amd.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/amd-sfh-hid/amd_sfh_client.c | 12 ++++++++++--
drivers/hid/amd-sfh-hid/amd_sfh_common.h | 3 +++
drivers/hid/amd-sfh-hid/amd_sfh_pcie.c | 4 ++++
3 files changed, 17 insertions(+), 2 deletions(-)
diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_client.c b/drivers/hid/amd-sfh-hid/amd_sfh_client.c
index 3438d392920fa..8dae9a7766853 100644
--- a/drivers/hid/amd-sfh-hid/amd_sfh_client.c
+++ b/drivers/hid/amd-sfh-hid/amd_sfh_client.c
@@ -39,8 +39,12 @@ int amd_sfh_get_report(struct hid_device *hid, int report_id, int report_type)
struct amdtp_hid_data *hid_data = hid->driver_data;
struct amdtp_cl_data *cli_data = hid_data->cli_data;
struct request_list *req_list = &cli_data->req_list;
+ struct amd_input_data *in_data = cli_data->in_data;
+ struct amd_mp2_dev *mp2;
int i;
+ mp2 = container_of(in_data, struct amd_mp2_dev, in_data);
+ guard(mutex)(&mp2->lock);
for (i = 0; i < cli_data->num_hid_devices; i++) {
if (cli_data->hid_sensor_hubs[i] == hid) {
struct request_list *new = kzalloc(sizeof(*new), GFP_KERNEL);
@@ -75,6 +79,8 @@ void amd_sfh_work(struct work_struct *work)
u8 report_id, node_type;
u8 report_size = 0;
+ mp2 = container_of(in_data, struct amd_mp2_dev, in_data);
+ guard(mutex)(&mp2->lock);
req_node = list_last_entry(&req_list->list, struct request_list, list);
list_del(&req_node->list);
current_index = req_node->current_index;
@@ -83,7 +89,6 @@ void amd_sfh_work(struct work_struct *work)
node_type = req_node->report_type;
kfree(req_node);
- mp2 = container_of(in_data, struct amd_mp2_dev, in_data);
mp2_ops = mp2->mp2_ops;
if (node_type == HID_FEATURE_REPORT) {
report_size = mp2_ops->get_feat_rep(sensor_index, report_id,
@@ -107,6 +112,8 @@ void amd_sfh_work(struct work_struct *work)
cli_data->cur_hid_dev = current_index;
cli_data->sensor_requested_cnt[current_index] = 0;
amdtp_hid_wakeup(cli_data->hid_sensor_hubs[current_index]);
+ if (!list_empty(&req_list->list))
+ schedule_delayed_work(&cli_data->work, 0);
}
void amd_sfh_work_buffer(struct work_struct *work)
@@ -117,9 +124,10 @@ void amd_sfh_work_buffer(struct work_struct *work)
u8 report_size;
int i;
+ mp2 = container_of(in_data, struct amd_mp2_dev, in_data);
+ guard(mutex)(&mp2->lock);
for (i = 0; i < cli_data->num_hid_devices; i++) {
if (cli_data->sensor_sts[i] == SENSOR_ENABLED) {
- mp2 = container_of(in_data, struct amd_mp2_dev, in_data);
report_size = mp2->mp2_ops->get_in_rep(i, cli_data->sensor_idx[i],
cli_data->report_id[i], in_data);
hid_input_report(cli_data->hid_sensor_hubs[i], HID_INPUT_REPORT,
diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_common.h b/drivers/hid/amd-sfh-hid/amd_sfh_common.h
index f44a3bb2fbd4f..78f830c133e5c 100644
--- a/drivers/hid/amd-sfh-hid/amd_sfh_common.h
+++ b/drivers/hid/amd-sfh-hid/amd_sfh_common.h
@@ -10,6 +10,7 @@
#ifndef AMD_SFH_COMMON_H
#define AMD_SFH_COMMON_H
+#include <linux/mutex.h>
#include <linux/pci.h>
#include "amd_sfh_hid.h"
@@ -59,6 +60,8 @@ struct amd_mp2_dev {
u32 mp2_acs;
struct sfh_dev_status dev_en;
struct work_struct work;
+ /* mp2 to protect data */
+ struct mutex lock;
u8 init_done;
u8 rver;
};
diff --git a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
index 1c1fd63330c93..9a669c18a132f 100644
--- a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
+++ b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c
@@ -462,6 +462,10 @@ static int amd_mp2_pci_probe(struct pci_dev *pdev, const struct pci_device_id *i
if (!privdata->cl_data)
return -ENOMEM;
+ rc = devm_mutex_init(&pdev->dev, &privdata->lock);
+ if (rc)
+ return rc;
+
privdata->sfh1_1_ops = (const struct amd_sfh1_1_ops *)id->driver_data;
if (privdata->sfh1_1_ops) {
if (boot_cpu_data.x86 >= 0x1A)
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 038/143] arm64: dts: rockchip: Fix the headphone detection on the orangepi 5
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 037/143] HID: amd_sfh: Add sync across amd sfh work functions Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 039/143] firmware: imx: Add stub functions for SCMI MISC API Greg Kroah-Hartman
` (116 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jimmy Hon, Heiko Stuebner,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jimmy Hon <honyuenkwun@gmail.com>
[ Upstream commit 0f860eef417df93eb0ae70bbfa8d26cb7e29244d ]
The logic of the headphone detect pin seems to be inverted, with this
change headphones actually output sound when plugged in.
Does not need workaround of using pin-switches to enable output.
Verified by checking /sys/kernel/debug/gpio.
Fixes: ae46756faff8 ("arm64: dts: rockchip: analog audio on Orange Pi 5")
Signed-off-by: Jimmy Hon <honyuenkwun@gmail.com>
Link: https://lore.kernel.org/r/20250904030150.986042-1-honyuenkwun@gmail.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/rockchip/rk3588s-orangepi-5.dtsi | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/rockchip/rk3588s-orangepi-5.dtsi b/arch/arm64/boot/dts/rockchip/rk3588s-orangepi-5.dtsi
index 4fedc50cce8c8..11940c77f2bd0 100644
--- a/arch/arm64/boot/dts/rockchip/rk3588s-orangepi-5.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3588s-orangepi-5.dtsi
@@ -42,9 +42,8 @@
simple-audio-card,bitclock-master = <&masterdai>;
simple-audio-card,format = "i2s";
simple-audio-card,frame-master = <&masterdai>;
- simple-audio-card,hp-det-gpios = <&gpio1 RK_PD5 GPIO_ACTIVE_LOW>;
+ simple-audio-card,hp-det-gpios = <&gpio1 RK_PD5 GPIO_ACTIVE_HIGH>;
simple-audio-card,mclk-fs = <256>;
- simple-audio-card,pin-switches = "Headphones";
simple-audio-card,routing =
"Headphones", "LOUT1",
"Headphones", "ROUT1",
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 039/143] firmware: imx: Add stub functions for SCMI MISC API
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 038/143] arm64: dts: rockchip: Fix the headphone detection on the orangepi 5 Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 040/143] firmware: imx: Add stub functions for SCMI LMM API Greg Kroah-Hartman
` (115 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cristian Marussi, Peng Fan,
Shawn Guo, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <peng.fan@nxp.com>
[ Upstream commit b2461e20fa9ac18b1305bba5bc7e22ebf644ea01 ]
To ensure successful builds when CONFIG_IMX_SCMI_MISC_DRV is not enabled,
this patch adds static inline stub implementations for the following
functions:
- scmi_imx_misc_ctrl_get()
- scmi_imx_misc_ctrl_set()
These stubs return -EOPNOTSUPP to indicate that the functionality is not
supported in the current configuration. This avoids potential build or
link errors in code that conditionally calls these functions based on
feature availability.
This patch also drops the changes in commit 540c830212ed ("firmware: imx:
remove duplicate scmi_imx_misc_ctrl_get()").
The original change aimed to simplify the handling of optional features by
removing conditional stubs. However, the use of conditional stubs is
necessary when CONFIG_IMX_SCMI_MISC_DRV is n, while consumer driver is
set to y.
This is not a matter of preserving legacy patterns, but rather to ensure
that there is no link error whether for module or built-in.
Fixes: 0b4f8a68b292 ("firmware: imx: Add i.MX95 MISC driver")
Reviewed-by: Cristian Marussi <cristian.marussi@arm.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/firmware/imx/sm.h | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/include/linux/firmware/imx/sm.h b/include/linux/firmware/imx/sm.h
index a8a17eeb7d907..67fb1d624d285 100644
--- a/include/linux/firmware/imx/sm.h
+++ b/include/linux/firmware/imx/sm.h
@@ -18,8 +18,20 @@
#define SCMI_IMX_CTRL_SAI4_MCLK 4 /* WAKE SAI4 MCLK */
#define SCMI_IMX_CTRL_SAI5_MCLK 5 /* WAKE SAI5 MCLK */
+#if IS_ENABLED(CONFIG_IMX_SCMI_MISC_DRV)
int scmi_imx_misc_ctrl_get(u32 id, u32 *num, u32 *val);
int scmi_imx_misc_ctrl_set(u32 id, u32 val);
+#else
+static inline int scmi_imx_misc_ctrl_get(u32 id, u32 *num, u32 *val)
+{
+ return -EOPNOTSUPP;
+}
+
+static inline int scmi_imx_misc_ctrl_set(u32 id, u32 val)
+{
+ return -EOPNOTSUPP;
+}
+#endif
int scmi_imx_cpu_start(u32 cpuid, bool start);
int scmi_imx_cpu_started(u32 cpuid, bool *started);
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 040/143] firmware: imx: Add stub functions for SCMI LMM API
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 039/143] firmware: imx: Add stub functions for SCMI MISC API Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 041/143] firmware: imx: Add stub functions for SCMI CPU API Greg Kroah-Hartman
` (114 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cristian Marussi, Peng Fan,
Shawn Guo, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <peng.fan@nxp.com>
[ Upstream commit 3fb91b5c86d0fb5ff6f65c30a4f20193166e22fe ]
To ensure successful builds when CONFIG_IMX_SCMI_LMM_DRV is not enabled,
this patch adds static inline stub implementations for the following
functions:
- scmi_imx_lmm_operation()
- scmi_imx_lmm_info()
- scmi_imx_lmm_reset_vector_set()
These stubs return -EOPNOTSUPP to indicate that the functionality is not
supported in the current configuration. This avoids potential build or
link errors in code that conditionally calls these functions based on
feature availability.
Fixes: 7242bbf418f0 ("firmware: imx: Add i.MX95 SCMI LMM driver")
Reviewed-by: Cristian Marussi <cristian.marussi@arm.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/firmware/imx/sm.h | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/include/linux/firmware/imx/sm.h b/include/linux/firmware/imx/sm.h
index 67fb1d624d285..6e700e455934e 100644
--- a/include/linux/firmware/imx/sm.h
+++ b/include/linux/firmware/imx/sm.h
@@ -48,7 +48,24 @@ enum scmi_imx_lmm_op {
#define SCMI_IMX_LMM_OP_FORCEFUL 0
#define SCMI_IMX_LMM_OP_GRACEFUL BIT(0)
+#if IS_ENABLED(CONFIG_IMX_SCMI_LMM_DRV)
int scmi_imx_lmm_operation(u32 lmid, enum scmi_imx_lmm_op op, u32 flags);
int scmi_imx_lmm_info(u32 lmid, struct scmi_imx_lmm_info *info);
int scmi_imx_lmm_reset_vector_set(u32 lmid, u32 cpuid, u32 flags, u64 vector);
+#else
+static inline int scmi_imx_lmm_operation(u32 lmid, enum scmi_imx_lmm_op op, u32 flags)
+{
+ return -EOPNOTSUPP;
+}
+
+static inline int scmi_imx_lmm_info(u32 lmid, struct scmi_imx_lmm_info *info)
+{
+ return -EOPNOTSUPP;
+}
+
+static inline int scmi_imx_lmm_reset_vector_set(u32 lmid, u32 cpuid, u32 flags, u64 vector)
+{
+ return -EOPNOTSUPP;
+}
+#endif
#endif
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 041/143] firmware: imx: Add stub functions for SCMI CPU API
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 040/143] firmware: imx: Add stub functions for SCMI LMM API Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 042/143] arm64: dts: imx8mp: Correct thermal sensor index Greg Kroah-Hartman
` (113 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Cristian Marussi, Peng Fan,
Shawn Guo, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <peng.fan@nxp.com>
[ Upstream commit 222accf05fc42f68ae02065d9c1542c20315118b ]
To ensure successful builds when CONFIG_IMX_SCMI_CPU_DRV is not enabled,
this patch adds static inline stub implementations for the following
functions:
- scmi_imx_cpu_start()
- scmi_imx_cpu_started()
- scmi_imx_cpu_reset_vector_set()
These stubs return -EOPNOTSUPP to indicate that the functionality is not
supported in the current configuration. This avoids potential build or
link errors in code that conditionally calls these functions based on
feature availability.
Fixes: 1055faa5d660 ("firmware: imx: Add i.MX95 SCMI CPU driver")
Reviewed-by: Cristian Marussi <cristian.marussi@arm.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/firmware/imx/sm.h | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/include/linux/firmware/imx/sm.h b/include/linux/firmware/imx/sm.h
index 6e700e455934e..1817df9aceac8 100644
--- a/include/linux/firmware/imx/sm.h
+++ b/include/linux/firmware/imx/sm.h
@@ -33,10 +33,28 @@ static inline int scmi_imx_misc_ctrl_set(u32 id, u32 val)
}
#endif
+#if IS_ENABLED(CONFIG_IMX_SCMI_CPU_DRV)
int scmi_imx_cpu_start(u32 cpuid, bool start);
int scmi_imx_cpu_started(u32 cpuid, bool *started);
int scmi_imx_cpu_reset_vector_set(u32 cpuid, u64 vector, bool start, bool boot,
bool resume);
+#else
+static inline int scmi_imx_cpu_start(u32 cpuid, bool start)
+{
+ return -EOPNOTSUPP;
+}
+
+static inline int scmi_imx_cpu_started(u32 cpuid, bool *started)
+{
+ return -EOPNOTSUPP;
+}
+
+static inline int scmi_imx_cpu_reset_vector_set(u32 cpuid, u64 vector, bool start,
+ bool boot, bool resume)
+{
+ return -EOPNOTSUPP;
+}
+#endif
enum scmi_imx_lmm_op {
SCMI_IMX_LMM_BOOT,
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 042/143] arm64: dts: imx8mp: Correct thermal sensor index
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 041/143] firmware: imx: Add stub functions for SCMI CPU API Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 043/143] ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients Greg Kroah-Hartman
` (112 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peng Fan, Frank Li, Shawn Guo,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <peng.fan@nxp.com>
[ Upstream commit a50342f976d25aace73ff551845ce89406f48f35 ]
The TMU has two temperature measurement sites located on the chip. The
probe 0 is located inside of the ANAMIX, while the probe 1 is located near
the ARM core. This has been confirmed by checking with HW design team and
checking RTL code.
So correct the {cpu,soc}-thermal sensor index.
Fixes: 30cdd62dce6b ("arm64: dts: imx8mp: Add thermal zones support")
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/freescale/imx8mp.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/freescale/imx8mp.dtsi b/arch/arm64/boot/dts/freescale/imx8mp.dtsi
index 948b88cf5e9df..305c2912e90f7 100644
--- a/arch/arm64/boot/dts/freescale/imx8mp.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mp.dtsi
@@ -298,7 +298,7 @@
cpu-thermal {
polling-delay-passive = <250>;
polling-delay = <2000>;
- thermal-sensors = <&tmu 0>;
+ thermal-sensors = <&tmu 1>;
trips {
cpu_alert0: trip0 {
temperature = <85000>;
@@ -328,7 +328,7 @@
soc-thermal {
polling-delay-passive = <250>;
polling-delay = <2000>;
- thermal-sensors = <&tmu 1>;
+ thermal-sensors = <&tmu 0>;
trips {
soc_alert0: trip0 {
temperature = <85000>;
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 043/143] ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 042/143] arm64: dts: imx8mp: Correct thermal sensor index Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 044/143] cpufreq: Initialize cpufreq-based invariance before subsys Greg Kroah-Hartman
` (111 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jihed Chaibi, Krzysztof Kozlowski,
Gregory CLEMENT, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
[ Upstream commit 29341c6c18b8ad2a9a4a68a61be7e1272d842f21 ]
A previous commit changed the '#sound-dai-cells' property for the
kirkwood audio controller from 1 to 0 in the kirkwood.dtsi file,
but did not update the corresponding 'sound-dai' property in the
kirkwood-openrd-client.dts file.
This created a mismatch, causing a dtbs_check validation error where
the dts provides one cell (<&audio0 0>) while the .dtsi expects zero.
Remove the extraneous cell from the 'sound-dai' property to fix the
schema validation warning and align with the updated binding.
Fixes: e662e70fa419 ("arm: dts: kirkwood: fix error in #sound-dai-cells size")
Signed-off-by: Jihed Chaibi <jihed.chaibi.dev@gmail.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/marvell/kirkwood-openrd-client.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/marvell/kirkwood-openrd-client.dts b/arch/arm/boot/dts/marvell/kirkwood-openrd-client.dts
index d4e0b8150a84c..cf26e2ceaaa07 100644
--- a/arch/arm/boot/dts/marvell/kirkwood-openrd-client.dts
+++ b/arch/arm/boot/dts/marvell/kirkwood-openrd-client.dts
@@ -38,7 +38,7 @@
simple-audio-card,mclk-fs = <256>;
simple-audio-card,cpu {
- sound-dai = <&audio0 0>;
+ sound-dai = <&audio0>;
};
simple-audio-card,codec {
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 044/143] cpufreq: Initialize cpufreq-based invariance before subsys
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 043/143] ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 045/143] smb: server: dont use delayed_work for post_recv_credits_work Greg Kroah-Hartman
` (110 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Loehle, Rafael J. Wysocki,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Loehle <christian.loehle@arm.com>
[ Upstream commit 8ffe28b4e8d8b18cb2f2933410322c24f039d5d6 ]
commit 2a6c72738706 ("cpufreq: Initialize cpufreq-based
frequency-invariance later") postponed the frequency invariance
initialization to avoid disabling it in the error case.
This isn't locking safe, instead move the initialization up before
the subsys interface is registered (which will rebuild the
sched_domains) and add the corresponding disable on the error path.
Observed lockdep without this patch:
[ 0.989686] ======================================================
[ 0.989688] WARNING: possible circular locking dependency detected
[ 0.989690] 6.17.0-rc4-cix-build+ #31 Tainted: G S
[ 0.989691] ------------------------------------------------------
[ 0.989692] swapper/0/1 is trying to acquire lock:
[ 0.989693] ffff800082ada7f8 (sched_energy_mutex){+.+.}-{4:4}, at: rebuild_sched_domains_energy+0x30/0x58
[ 0.989705]
but task is already holding lock:
[ 0.989706] ffff000088c89bc8 (&policy->rwsem){+.+.}-{4:4}, at: cpufreq_online+0x7f8/0xbe0
[ 0.989713]
which lock already depends on the new lock.
Fixes: 2a6c72738706 ("cpufreq: Initialize cpufreq-based frequency-invariance later")
Signed-off-by: Christian Loehle <christian.loehle@arm.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/cpufreq.c | 20 +++++++++++---------
1 file changed, 11 insertions(+), 9 deletions(-)
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 628f5b633b61f..b2da1cda4cebd 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -2956,6 +2956,15 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data)
goto err_null_driver;
}
+ /*
+ * Mark support for the scheduler's frequency invariance engine for
+ * drivers that implement target(), target_index() or fast_switch().
+ */
+ if (!cpufreq_driver->setpolicy) {
+ static_branch_enable_cpuslocked(&cpufreq_freq_invariance);
+ pr_debug("cpufreq: supports frequency invariance\n");
+ }
+
ret = subsys_interface_register(&cpufreq_interface);
if (ret)
goto err_boost_unreg;
@@ -2977,21 +2986,14 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data)
hp_online = ret;
ret = 0;
- /*
- * Mark support for the scheduler's frequency invariance engine for
- * drivers that implement target(), target_index() or fast_switch().
- */
- if (!cpufreq_driver->setpolicy) {
- static_branch_enable_cpuslocked(&cpufreq_freq_invariance);
- pr_debug("supports frequency invariance");
- }
-
pr_debug("driver %s up and running\n", driver_data->name);
goto out;
err_if_unreg:
subsys_interface_unregister(&cpufreq_interface);
err_boost_unreg:
+ if (!cpufreq_driver->setpolicy)
+ static_branch_disable_cpuslocked(&cpufreq_freq_invariance);
remove_boost_sysfs_file();
err_null_driver:
write_lock_irqsave(&cpufreq_driver_lock, flags);
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 045/143] smb: server: dont use delayed_work for post_recv_credits_work
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 044/143] cpufreq: Initialize cpufreq-based invariance before subsys Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 046/143] smb: server: use disable_work_sync in transport_rdma.c Greg Kroah-Hartman
` (109 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Namjae Jeon, Steve French,
Tom Talpey, linux-cifs, samba-technical, Stefan Metzmacher,
Steve French, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Metzmacher <metze@samba.org>
[ Upstream commit 1cde0a74a7a8951b3097417847a458e557be0b5b ]
If we are using a hardcoded delay of 0 there's no point in
using delayed_work it only adds confusion.
The client also uses a normal work_struct and now
it is easier to move it to the common smbdirect_socket.
Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: Steve French <smfrench@gmail.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers")
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/server/transport_rdma.c | 18 ++++++++----------
1 file changed, 8 insertions(+), 10 deletions(-)
diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c
index 6550bd9f002c2..10a6b4ed1a037 100644
--- a/fs/smb/server/transport_rdma.c
+++ b/fs/smb/server/transport_rdma.c
@@ -148,7 +148,7 @@ struct smb_direct_transport {
wait_queue_head_t wait_send_pending;
atomic_t send_pending;
- struct delayed_work post_recv_credits_work;
+ struct work_struct post_recv_credits_work;
struct work_struct send_immediate_work;
struct work_struct disconnect_work;
@@ -367,8 +367,8 @@ static struct smb_direct_transport *alloc_transport(struct rdma_cm_id *cm_id)
spin_lock_init(&t->lock_new_recv_credits);
- INIT_DELAYED_WORK(&t->post_recv_credits_work,
- smb_direct_post_recv_credits);
+ INIT_WORK(&t->post_recv_credits_work,
+ smb_direct_post_recv_credits);
INIT_WORK(&t->send_immediate_work, smb_direct_send_immediate_work);
INIT_WORK(&t->disconnect_work, smb_direct_disconnect_rdma_work);
@@ -400,7 +400,7 @@ static void free_transport(struct smb_direct_transport *t)
atomic_read(&t->send_pending) == 0);
cancel_work_sync(&t->disconnect_work);
- cancel_delayed_work_sync(&t->post_recv_credits_work);
+ cancel_work_sync(&t->post_recv_credits_work);
cancel_work_sync(&t->send_immediate_work);
if (t->qp) {
@@ -615,8 +615,7 @@ static void recv_done(struct ib_cq *cq, struct ib_wc *wc)
wake_up_interruptible(&t->wait_send_credits);
if (is_receive_credit_post_required(receive_credits, avail_recvmsg_count))
- mod_delayed_work(smb_direct_wq,
- &t->post_recv_credits_work, 0);
+ queue_work(smb_direct_wq, &t->post_recv_credits_work);
if (data_length) {
enqueue_reassembly(t, recvmsg, (int)data_length);
@@ -773,8 +772,7 @@ static int smb_direct_read(struct ksmbd_transport *t, char *buf,
st->count_avail_recvmsg += queue_removed;
if (is_receive_credit_post_required(st->recv_credits, st->count_avail_recvmsg)) {
spin_unlock(&st->receive_credit_lock);
- mod_delayed_work(smb_direct_wq,
- &st->post_recv_credits_work, 0);
+ queue_work(smb_direct_wq, &st->post_recv_credits_work);
} else {
spin_unlock(&st->receive_credit_lock);
}
@@ -801,7 +799,7 @@ static int smb_direct_read(struct ksmbd_transport *t, char *buf,
static void smb_direct_post_recv_credits(struct work_struct *work)
{
struct smb_direct_transport *t = container_of(work,
- struct smb_direct_transport, post_recv_credits_work.work);
+ struct smb_direct_transport, post_recv_credits_work);
struct smb_direct_recvmsg *recvmsg;
int receive_credits, credits = 0;
int ret;
@@ -1734,7 +1732,7 @@ static int smb_direct_prepare_negotiation(struct smb_direct_transport *t)
goto out_err;
}
- smb_direct_post_recv_credits(&t->post_recv_credits_work.work);
+ smb_direct_post_recv_credits(&t->post_recv_credits_work);
return 0;
out_err:
put_recvmsg(t, recvmsg);
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 046/143] smb: server: use disable_work_sync in transport_rdma.c
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 045/143] smb: server: dont use delayed_work for post_recv_credits_work Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 047/143] bpf: Check the helper function is valid in get_helper_proto Greg Kroah-Hartman
` (108 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Namjae Jeon, Steve French,
Tom Talpey, linux-cifs, samba-technical, Stefan Metzmacher,
Steve French, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Metzmacher <metze@samba.org>
[ Upstream commit f7f89250175e0a82e99ed66da7012e869c36497d ]
This makes it safer during the disconnect and avoids
requeueing.
It's ok to call disable_work[_sync]() more than once.
Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: Steve French <smfrench@gmail.com>
Cc: Tom Talpey <tom@talpey.com>
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers")
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/server/transport_rdma.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/fs/smb/server/transport_rdma.c b/fs/smb/server/transport_rdma.c
index 10a6b4ed1a037..74dfb6496095d 100644
--- a/fs/smb/server/transport_rdma.c
+++ b/fs/smb/server/transport_rdma.c
@@ -399,9 +399,9 @@ static void free_transport(struct smb_direct_transport *t)
wait_event(t->wait_send_pending,
atomic_read(&t->send_pending) == 0);
- cancel_work_sync(&t->disconnect_work);
- cancel_work_sync(&t->post_recv_credits_work);
- cancel_work_sync(&t->send_immediate_work);
+ disable_work_sync(&t->disconnect_work);
+ disable_work_sync(&t->post_recv_credits_work);
+ disable_work_sync(&t->send_immediate_work);
if (t->qp) {
ib_drain_qp(t->qp);
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 047/143] bpf: Check the helper function is valid in get_helper_proto
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 046/143] smb: server: use disable_work_sync in transport_rdma.c Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 048/143] selftests/fs/mount-notify: Fix compilation failure Greg Kroah-Hartman
` (107 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot,
syzbot+a9ed3d9132939852d0df, Alexei Starovoitov, Jiri Olsa,
Daniel Borkmann, Paul Chaignon, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <olsajiri@gmail.com>
[ Upstream commit e4414b01c1cd9887bbde92f946c1ba94e40d6d64 ]
kernel test robot reported verifier bug [1] where the helper func
pointer could be NULL due to disabled config option.
As Alexei suggested we could check on that in get_helper_proto
directly. Marking tail_call helper func with BPF_PTR_POISON,
because it is unused by design.
[1] https://lore.kernel.org/oe-lkp/202507160818.68358831-lkp@intel.com
Reported-by: kernel test robot <oliver.sang@intel.com>
Reported-by: syzbot+a9ed3d9132939852d0df@syzkaller.appspotmail.com
Suggested-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Paul Chaignon <paul.chaignon@gmail.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20250814200655.945632-1-jolsa@kernel.org
Closes: https://lore.kernel.org/oe-lkp/202507160818.68358831-lkp@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/core.c | 5 ++++-
kernel/bpf/verifier.c | 2 +-
2 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 829f0792d8d83..17e5cf18da1ef 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -3013,7 +3013,10 @@ EXPORT_SYMBOL_GPL(bpf_event_output);
/* Always built-in helper functions. */
const struct bpf_func_proto bpf_tail_call_proto = {
- .func = NULL,
+ /* func is unused for tail_call, we set it to pass the
+ * get_helper_proto check
+ */
+ .func = BPF_PTR_POISON,
.gpl_only = false,
.ret_type = RET_VOID,
.arg1_type = ARG_PTR_TO_CTX,
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 4fd89659750b2..d6782efd25734 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -11206,7 +11206,7 @@ static int get_helper_proto(struct bpf_verifier_env *env, int func_id,
return -EINVAL;
*ptr = env->ops->get_func_proto(func_id, env->prog);
- return *ptr ? 0 : -EINVAL;
+ return *ptr && (*ptr)->func ? 0 : -EINVAL;
}
static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 048/143] selftests/fs/mount-notify: Fix compilation failure.
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 047/143] bpf: Check the helper function is valid in get_helper_proto Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 049/143] btrfs: dont allow adding block device of less than 1 MB Greg Kroah-Hartman
` (106 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xing Guo, Amir Goldstein,
Christian Brauner, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xing Guo <higuoxing@gmail.com>
[ Upstream commit e51bd0e595476c1527bb0b4def095a6fd16b2563 ]
Commit c6d9775c2066 ("selftests/fs/mount-notify: build with tools include
dir") introduces the struct __kernel_fsid_t to decouple dependency with
headers_install. The commit forgets to define a macro for __kernel_fsid_t
and it will cause type re-definition issue.
Signed-off-by: Xing Guo <higuoxing@gmail.com>
Link: https://lore.kernel.org/20250813031647.96411-1-higuoxing@gmail.com
Acked-by: Amir Goldstein <amir73il@gmail.com>
Closes: https://lore.kernel.org/oe-lkp/202508110628.65069d92-lkp@intel.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../mount-notify/mount-notify_test.c | 17 ++++++++---------
.../mount-notify/mount-notify_test_ns.c | 18 ++++++++----------
2 files changed, 16 insertions(+), 19 deletions(-)
diff --git a/tools/testing/selftests/filesystems/mount-notify/mount-notify_test.c b/tools/testing/selftests/filesystems/mount-notify/mount-notify_test.c
index 63ce708d93ed0..e4b7c2b457ee7 100644
--- a/tools/testing/selftests/filesystems/mount-notify/mount-notify_test.c
+++ b/tools/testing/selftests/filesystems/mount-notify/mount-notify_test.c
@@ -2,6 +2,13 @@
// Copyright (c) 2025 Miklos Szeredi <miklos@szeredi.hu>
#define _GNU_SOURCE
+
+// Needed for linux/fanotify.h
+typedef struct {
+ int val[2];
+} __kernel_fsid_t;
+#define __kernel_fsid_t __kernel_fsid_t
+
#include <fcntl.h>
#include <sched.h>
#include <stdio.h>
@@ -10,20 +17,12 @@
#include <sys/mount.h>
#include <unistd.h>
#include <sys/syscall.h>
+#include <sys/fanotify.h>
#include "../../kselftest_harness.h"
#include "../statmount/statmount.h"
#include "../utils.h"
-// Needed for linux/fanotify.h
-#ifndef __kernel_fsid_t
-typedef struct {
- int val[2];
-} __kernel_fsid_t;
-#endif
-
-#include <sys/fanotify.h>
-
static const char root_mntpoint_templ[] = "/tmp/mount-notify_test_root.XXXXXX";
static const int mark_cmds[] = {
diff --git a/tools/testing/selftests/filesystems/mount-notify/mount-notify_test_ns.c b/tools/testing/selftests/filesystems/mount-notify/mount-notify_test_ns.c
index 090a5ca65004a..9f57ca46e3afa 100644
--- a/tools/testing/selftests/filesystems/mount-notify/mount-notify_test_ns.c
+++ b/tools/testing/selftests/filesystems/mount-notify/mount-notify_test_ns.c
@@ -2,6 +2,13 @@
// Copyright (c) 2025 Miklos Szeredi <miklos@szeredi.hu>
#define _GNU_SOURCE
+
+// Needed for linux/fanotify.h
+typedef struct {
+ int val[2];
+} __kernel_fsid_t;
+#define __kernel_fsid_t __kernel_fsid_t
+
#include <fcntl.h>
#include <sched.h>
#include <stdio.h>
@@ -10,21 +17,12 @@
#include <sys/mount.h>
#include <unistd.h>
#include <sys/syscall.h>
+#include <sys/fanotify.h>
#include "../../kselftest_harness.h"
-#include "../../pidfd/pidfd.h"
#include "../statmount/statmount.h"
#include "../utils.h"
-// Needed for linux/fanotify.h
-#ifndef __kernel_fsid_t
-typedef struct {
- int val[2];
-} __kernel_fsid_t;
-#endif
-
-#include <sys/fanotify.h>
-
static const char root_mntpoint_templ[] = "/tmp/mount-notify_test_root.XXXXXX";
static const int mark_types[] = {
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 049/143] btrfs: dont allow adding block device of less than 1 MB
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 048/143] selftests/fs/mount-notify: Fix compilation failure Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 050/143] NFS: Protect against eof page pollution Greg Kroah-Hartman
` (105 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qu Wenruo, Mark Harmstone,
David Sterba, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Harmstone <mark@harmstone.com>
[ Upstream commit 3d1267475b94b3df7a61e4ea6788c7c5d9e473c4 ]
Commit 15ae0410c37a79 ("btrfs-progs: add error handling for
device_get_partition_size_fd_stat()") in btrfs-progs inadvertently
changed it so that if the BLKGETSIZE64 ioctl on a block device returned
a size of 0, this was no longer seen as an error condition.
Unfortunately this is how disconnected NBD devices behave, meaning that
with btrfs-progs 6.16 it's now possible to add a device you can't
remove:
# btrfs device add /dev/nbd0 /root/temp
# btrfs device remove /dev/nbd0 /root/temp
ERROR: error removing device '/dev/nbd0': Invalid argument
This check should always have been done kernel-side anyway, so add a
check in btrfs_init_new_device() that the new device doesn't have a size
less than BTRFS_DEVICE_RANGE_RESERVED (i.e. 1 MB).
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Mark Harmstone <mark@harmstone.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/volumes.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index f475b4b7c4578..817d3ef501ec4 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -2714,6 +2714,11 @@ int btrfs_init_new_device(struct btrfs_fs_info *fs_info, const char *device_path
goto error;
}
+ if (bdev_nr_bytes(file_bdev(bdev_file)) <= BTRFS_DEVICE_RANGE_RESERVED) {
+ ret = -EINVAL;
+ goto error;
+ }
+
if (fs_devices->seeding) {
seeding_dev = true;
down_write(&sb->s_umount);
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 050/143] NFS: Protect against eof page pollution
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 049/143] btrfs: dont allow adding block device of less than 1 MB Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 051/143] NFSv4.2: Protect copy offload and clone " Greg Kroah-Hartman
` (104 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Trond Myklebust, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <trond.myklebust@hammerspace.com>
[ Upstream commit b1817b18ff20e69f5accdccefaf78bf5454bede2 ]
This commit fixes the failing xfstest 'generic/363'.
When the user mmaps() an area that extends beyond the end of file, and
proceeds to write data into the folio that straddles that eof, we're
required to discard that folio data if the user calls some function that
extends the file length.
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/file.c | 33 +++++++++++++++++++++++++++++++++
fs/nfs/inode.c | 9 +++++++--
fs/nfs/internal.h | 2 ++
fs/nfs/nfs42proc.c | 14 +++++++++++---
fs/nfs/nfstrace.h | 1 +
5 files changed, 54 insertions(+), 5 deletions(-)
diff --git a/fs/nfs/file.c b/fs/nfs/file.c
index a16a619fb8c33..8cc39a73faff8 100644
--- a/fs/nfs/file.c
+++ b/fs/nfs/file.c
@@ -28,6 +28,7 @@
#include <linux/mm.h>
#include <linux/pagemap.h>
#include <linux/gfp.h>
+#include <linux/rmap.h>
#include <linux/swap.h>
#include <linux/compaction.h>
@@ -279,6 +280,37 @@ nfs_file_fsync(struct file *file, loff_t start, loff_t end, int datasync)
}
EXPORT_SYMBOL_GPL(nfs_file_fsync);
+void nfs_truncate_last_folio(struct address_space *mapping, loff_t from,
+ loff_t to)
+{
+ struct folio *folio;
+
+ if (from >= to)
+ return;
+
+ folio = filemap_lock_folio(mapping, from >> PAGE_SHIFT);
+ if (IS_ERR(folio))
+ return;
+
+ if (folio_mkclean(folio))
+ folio_mark_dirty(folio);
+
+ if (folio_test_uptodate(folio)) {
+ loff_t fpos = folio_pos(folio);
+ size_t offset = from - fpos;
+ size_t end = folio_size(folio);
+
+ if (to - fpos < end)
+ end = to - fpos;
+ folio_zero_segment(folio, offset, end);
+ trace_nfs_size_truncate_folio(mapping->host, to);
+ }
+
+ folio_unlock(folio);
+ folio_put(folio);
+}
+EXPORT_SYMBOL_GPL(nfs_truncate_last_folio);
+
/*
* Decide whether a read/modify/write cycle may be more efficient
* then a modify/write/read cycle when writing to a page in the
@@ -353,6 +385,7 @@ static int nfs_write_begin(struct file *file, struct address_space *mapping,
dfprintk(PAGECACHE, "NFS: write_begin(%pD2(%lu), %u@%lld)\n",
file, mapping->host->i_ino, len, (long long) pos);
+ nfs_truncate_last_folio(mapping, i_size_read(mapping->host), pos);
fgp |= fgf_set_order(len);
start:
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index a32cc45425e28..f6b448666d419 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -710,6 +710,7 @@ nfs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
{
struct inode *inode = d_inode(dentry);
struct nfs_fattr *fattr;
+ loff_t oldsize = i_size_read(inode);
int error = 0;
nfs_inc_stats(inode, NFSIOS_VFSSETATTR);
@@ -725,7 +726,7 @@ nfs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
if (error)
return error;
- if (attr->ia_size == i_size_read(inode))
+ if (attr->ia_size == oldsize)
attr->ia_valid &= ~ATTR_SIZE;
}
@@ -773,8 +774,12 @@ nfs_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
}
error = NFS_PROTO(inode)->setattr(dentry, fattr, attr);
- if (error == 0)
+ if (error == 0) {
+ if (attr->ia_valid & ATTR_SIZE)
+ nfs_truncate_last_folio(inode->i_mapping, oldsize,
+ attr->ia_size);
error = nfs_refresh_inode(inode, fattr);
+ }
nfs_free_fattr(fattr);
out:
trace_nfs_setattr_exit(inode, error);
diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index 0ef0fc6aba3b3..ae4d039c10d3a 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -438,6 +438,8 @@ int nfs_file_release(struct inode *, struct file *);
int nfs_lock(struct file *, int, struct file_lock *);
int nfs_flock(struct file *, int, struct file_lock *);
int nfs_check_flags(int);
+void nfs_truncate_last_folio(struct address_space *mapping, loff_t from,
+ loff_t to);
/* inode.c */
extern struct workqueue_struct *nfsiod_workqueue;
diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c
index 48ee3d5d89c4a..4b0e35a0d89dd 100644
--- a/fs/nfs/nfs42proc.c
+++ b/fs/nfs/nfs42proc.c
@@ -138,6 +138,7 @@ int nfs42_proc_allocate(struct file *filep, loff_t offset, loff_t len)
.rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_ALLOCATE],
};
struct inode *inode = file_inode(filep);
+ loff_t oldsize = i_size_read(inode);
int err;
if (!nfs_server_capable(inode, NFS_CAP_ALLOCATE))
@@ -146,7 +147,11 @@ int nfs42_proc_allocate(struct file *filep, loff_t offset, loff_t len)
inode_lock(inode);
err = nfs42_proc_fallocate(&msg, filep, offset, len);
- if (err == -EOPNOTSUPP)
+
+ if (err == 0)
+ nfs_truncate_last_folio(inode->i_mapping, oldsize,
+ offset + len);
+ else if (err == -EOPNOTSUPP)
NFS_SERVER(inode)->caps &= ~(NFS_CAP_ALLOCATE |
NFS_CAP_ZERO_RANGE);
@@ -184,6 +189,7 @@ int nfs42_proc_zero_range(struct file *filep, loff_t offset, loff_t len)
.rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_ZERO_RANGE],
};
struct inode *inode = file_inode(filep);
+ loff_t oldsize = i_size_read(inode);
int err;
if (!nfs_server_capable(inode, NFS_CAP_ZERO_RANGE))
@@ -192,9 +198,11 @@ int nfs42_proc_zero_range(struct file *filep, loff_t offset, loff_t len)
inode_lock(inode);
err = nfs42_proc_fallocate(&msg, filep, offset, len);
- if (err == 0)
+ if (err == 0) {
+ nfs_truncate_last_folio(inode->i_mapping, oldsize,
+ offset + len);
truncate_pagecache_range(inode, offset, (offset + len) -1);
- if (err == -EOPNOTSUPP)
+ } else if (err == -EOPNOTSUPP)
NFS_SERVER(inode)->caps &= ~NFS_CAP_ZERO_RANGE;
inode_unlock(inode);
diff --git a/fs/nfs/nfstrace.h b/fs/nfs/nfstrace.h
index 7a058bd8c566e..1e4dc632f1800 100644
--- a/fs/nfs/nfstrace.h
+++ b/fs/nfs/nfstrace.h
@@ -267,6 +267,7 @@ DECLARE_EVENT_CLASS(nfs_update_size_class,
TP_ARGS(inode, new_size))
DEFINE_NFS_UPDATE_SIZE_EVENT(truncate);
+DEFINE_NFS_UPDATE_SIZE_EVENT(truncate_folio);
DEFINE_NFS_UPDATE_SIZE_EVENT(wcc);
DEFINE_NFS_UPDATE_SIZE_EVENT(update);
DEFINE_NFS_UPDATE_SIZE_EVENT(grow);
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 051/143] NFSv4.2: Protect copy offload and clone against eof page pollution
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 050/143] NFS: Protect against eof page pollution Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 052/143] drm/amdkfd: fix p2p links bug in topology Greg Kroah-Hartman
` (103 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Olga Kornievskaia, Trond Myklebust,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <trond.myklebust@hammerspace.com>
[ Upstream commit b2036bb65114c01caf4a1afe553026e081703c8c ]
The NFSv4.2 copy offload and clone functions can also end up extending
the size of the destination file, so they too need to call
nfs_truncate_last_folio().
Reported-by: Olga Kornievskaia <okorniev@redhat.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/nfs42proc.c | 19 +++++++++++++------
1 file changed, 13 insertions(+), 6 deletions(-)
diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c
index 4b0e35a0d89dd..6a0b5871ba3b0 100644
--- a/fs/nfs/nfs42proc.c
+++ b/fs/nfs/nfs42proc.c
@@ -363,22 +363,27 @@ static int process_copy_commit(struct file *dst, loff_t pos_dst,
/**
* nfs42_copy_dest_done - perform inode cache updates after clone/copy offload
- * @inode: pointer to destination inode
+ * @file: pointer to destination file
* @pos: destination offset
* @len: copy length
+ * @oldsize: length of the file prior to clone/copy
*
* Punch a hole in the inode page cache, so that the NFS client will
* know to retrieve new data.
* Update the file size if necessary, and then mark the inode as having
* invalid cached values for change attribute, ctime, mtime and space used.
*/
-static void nfs42_copy_dest_done(struct inode *inode, loff_t pos, loff_t len)
+static void nfs42_copy_dest_done(struct file *file, loff_t pos, loff_t len,
+ loff_t oldsize)
{
+ struct inode *inode = file_inode(file);
+ struct address_space *mapping = file->f_mapping;
loff_t newsize = pos + len;
loff_t end = newsize - 1;
- WARN_ON_ONCE(invalidate_inode_pages2_range(inode->i_mapping,
- pos >> PAGE_SHIFT, end >> PAGE_SHIFT));
+ nfs_truncate_last_folio(mapping, oldsize, pos);
+ WARN_ON_ONCE(invalidate_inode_pages2_range(mapping, pos >> PAGE_SHIFT,
+ end >> PAGE_SHIFT));
spin_lock(&inode->i_lock);
if (newsize > i_size_read(inode))
@@ -411,6 +416,7 @@ static ssize_t _nfs42_proc_copy(struct file *src,
struct nfs_server *src_server = NFS_SERVER(src_inode);
loff_t pos_src = args->src_pos;
loff_t pos_dst = args->dst_pos;
+ loff_t oldsize_dst = i_size_read(dst_inode);
size_t count = args->count;
ssize_t status;
@@ -485,7 +491,7 @@ static ssize_t _nfs42_proc_copy(struct file *src,
goto out;
}
- nfs42_copy_dest_done(dst_inode, pos_dst, res->write_res.count);
+ nfs42_copy_dest_done(dst, pos_dst, res->write_res.count, oldsize_dst);
nfs_invalidate_atime(src_inode);
status = res->write_res.count;
out:
@@ -1252,6 +1258,7 @@ static int _nfs42_proc_clone(struct rpc_message *msg, struct file *src_f,
struct nfs42_clone_res res = {
.server = server,
};
+ loff_t oldsize_dst = i_size_read(dst_inode);
int status;
msg->rpc_argp = &args;
@@ -1286,7 +1293,7 @@ static int _nfs42_proc_clone(struct rpc_message *msg, struct file *src_f,
/* a zero-length count means clone to EOF in src */
if (count == 0 && res.dst_fattr->valid & NFS_ATTR_FATTR_SIZE)
count = nfs_size_to_loff_t(res.dst_fattr->size) - dst_offset;
- nfs42_copy_dest_done(dst_inode, dst_offset, count);
+ nfs42_copy_dest_done(dst_f, dst_offset, count, oldsize_dst);
status = nfs_post_op_update_inode(dst_inode, res.dst_fattr);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 052/143] drm/amdkfd: fix p2p links bug in topology
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 051/143] NFSv4.2: Protect copy offload and clone " Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 053/143] amd/amdkfd: correct mem limit calculation for small APUs Greg Kroah-Hartman
` (102 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Eric Huang, Alex Deucher,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Huang <jinhuieric.huang@amd.com>
[ Upstream commit ce42a3b581a9db10765eb835840b04dbe7972135 ]
When creating p2p links, KFD needs to check XGMI link
with two conditions, hive_id and is_sharing_enabled,
but it is missing to check is_sharing_enabled, so add
it to fix the error.
Signed-off-by: Eric Huang <jinhuieric.huang@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 36cc7d13178d901982da7a122c883861d98da624)
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
index 4ec73f33535eb..720b20e842ba4 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
@@ -1587,7 +1587,8 @@ static int kfd_dev_create_p2p_links(void)
break;
if (!dev->gpu || !dev->gpu->adev ||
(dev->gpu->kfd->hive_id &&
- dev->gpu->kfd->hive_id == new_dev->gpu->kfd->hive_id))
+ dev->gpu->kfd->hive_id == new_dev->gpu->kfd->hive_id &&
+ amdgpu_xgmi_get_is_sharing_enabled(dev->gpu->adev, new_dev->gpu->adev)))
goto next;
/* check if node(s) is/are peer accessible in one direction or bi-direction */
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 053/143] amd/amdkfd: correct mem limit calculation for small APUs
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 052/143] drm/amdkfd: fix p2p links bug in topology Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 054/143] wifi: virt_wifi: Fix page fault on connect Greg Kroah-Hartman
` (101 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yifan Zhang, Mario Limonciello,
Alex Deucher, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yifan Zhang <yifan1.zhang@amd.com>
[ Upstream commit 53503556273a5ead8b75534085e2dcb46e96f883 ]
Current mem limit check leaks some GTT memory (reserved_for_pt
reserved_for_ras + adev->vram_pin_size) for small APUs.
Since carveout VRAM is tunable on APUs, there are three case
regarding the carveout VRAM size relative to GTT:
1. 0 < carveout < gtt
apu_prefer_gtt = true, is_app_apu = false
2. carveout > gtt / 2
apu_prefer_gtt = false, is_app_apu = false
3. 0 = carveout
apu_prefer_gtt = true, is_app_apu = true
It doesn't make sense to check below limitation in case 1
(default case, small carveout) because the values in the below
expression are mixed with carveout and gtt.
adev->kfd.vram_used[xcp_id] + vram_needed >
vram_size - reserved_for_pt - reserved_for_ras -
atomic64_read(&adev->vram_pin_size)
gtt: kfd.vram_used, vram_needed, vram_size
carveout: reserved_for_pt, reserved_for_ras, adev->vram_pin_size
In case 1, vram allocation will go to gtt domain, skip vram check
since ttm_mem_limit check already cover this allocation.
Signed-off-by: Yifan Zhang <yifan1.zhang@amd.com>
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit fa7c99f04f6dd299388e9282812b14e95558ac8e)
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 44 ++++++++++++++-----
1 file changed, 32 insertions(+), 12 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
index 260165bbe3736..b16cce7c22c37 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c
@@ -213,19 +213,35 @@ int amdgpu_amdkfd_reserve_mem_limit(struct amdgpu_device *adev,
spin_lock(&kfd_mem_limit.mem_limit_lock);
if (kfd_mem_limit.system_mem_used + system_mem_needed >
- kfd_mem_limit.max_system_mem_limit)
+ kfd_mem_limit.max_system_mem_limit) {
pr_debug("Set no_system_mem_limit=1 if using shared memory\n");
+ if (!no_system_mem_limit) {
+ ret = -ENOMEM;
+ goto release;
+ }
+ }
- if ((kfd_mem_limit.system_mem_used + system_mem_needed >
- kfd_mem_limit.max_system_mem_limit && !no_system_mem_limit) ||
- (kfd_mem_limit.ttm_mem_used + ttm_mem_needed >
- kfd_mem_limit.max_ttm_mem_limit) ||
- (adev && xcp_id >= 0 && adev->kfd.vram_used[xcp_id] + vram_needed >
- vram_size - reserved_for_pt - reserved_for_ras - atomic64_read(&adev->vram_pin_size))) {
+ if (kfd_mem_limit.ttm_mem_used + ttm_mem_needed >
+ kfd_mem_limit.max_ttm_mem_limit) {
ret = -ENOMEM;
goto release;
}
+ /*if is_app_apu is false and apu_prefer_gtt is true, it is an APU with
+ * carve out < gtt. In that case, VRAM allocation will go to gtt domain, skip
+ * VRAM check since ttm_mem_limit check already cover this allocation
+ */
+
+ if (adev && xcp_id >= 0 && (!adev->apu_prefer_gtt || adev->gmc.is_app_apu)) {
+ uint64_t vram_available =
+ vram_size - reserved_for_pt - reserved_for_ras -
+ atomic64_read(&adev->vram_pin_size);
+ if (adev->kfd.vram_used[xcp_id] + vram_needed > vram_available) {
+ ret = -ENOMEM;
+ goto release;
+ }
+ }
+
/* Update memory accounting by decreasing available system
* memory, TTM memory and GPU memory as computed above
*/
@@ -1626,11 +1642,15 @@ size_t amdgpu_amdkfd_get_available_memory(struct amdgpu_device *adev,
uint64_t vram_available, system_mem_available, ttm_mem_available;
spin_lock(&kfd_mem_limit.mem_limit_lock);
- vram_available = KFD_XCP_MEMORY_SIZE(adev, xcp_id)
- - adev->kfd.vram_used_aligned[xcp_id]
- - atomic64_read(&adev->vram_pin_size)
- - reserved_for_pt
- - reserved_for_ras;
+ if (adev->apu_prefer_gtt && !adev->gmc.is_app_apu)
+ vram_available = KFD_XCP_MEMORY_SIZE(adev, xcp_id)
+ - adev->kfd.vram_used_aligned[xcp_id];
+ else
+ vram_available = KFD_XCP_MEMORY_SIZE(adev, xcp_id)
+ - adev->kfd.vram_used_aligned[xcp_id]
+ - atomic64_read(&adev->vram_pin_size)
+ - reserved_for_pt
+ - reserved_for_ras;
if (adev->apu_prefer_gtt) {
system_mem_available = no_system_mem_limit ?
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 054/143] wifi: virt_wifi: Fix page fault on connect
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 053/143] amd/amdkfd: correct mem limit calculation for small APUs Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 055/143] can: rcar_can: rcar_can_resume(): fix s2ram with PSCI Greg Kroah-Hartman
` (100 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, James Guan, Johannes Berg,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Guan <guan_yufei@163.com>
[ Upstream commit 9c600589e14f5fc01b8be9a5d0ad1f094b8b304b ]
This patch prevents page fault in __cfg80211_connect_result()[1]
when connecting a virt_wifi device, while ensuring that virt_wifi
can connect properly.
[1] https://lore.kernel.org/linux-wireless/20250909063213.1055024-1-guan_yufei@163.com/
Closes: https://lore.kernel.org/linux-wireless/20250909063213.1055024-1-guan_yufei@163.com/
Signed-off-by: James Guan <guan_yufei@163.com>
Link: https://patch.msgid.link/20250910111929.137049-1-guan_yufei@163.com
[remove irrelevant network-manager instructions]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/virtual/virt_wifi.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/virtual/virt_wifi.c b/drivers/net/wireless/virtual/virt_wifi.c
index 1fffeff2190ca..4eae89376feb5 100644
--- a/drivers/net/wireless/virtual/virt_wifi.c
+++ b/drivers/net/wireless/virtual/virt_wifi.c
@@ -277,7 +277,9 @@ static void virt_wifi_connect_complete(struct work_struct *work)
priv->is_connected = true;
/* Schedules an event that acquires the rtnl lock. */
- cfg80211_connect_result(priv->upperdev, requested_bss, NULL, 0, NULL, 0,
+ cfg80211_connect_result(priv->upperdev,
+ priv->is_connected ? fake_router_bssid : NULL,
+ NULL, 0, NULL, 0,
status, GFP_KERNEL);
netif_carrier_on(priv->upperdev);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 055/143] can: rcar_can: rcar_can_resume(): fix s2ram with PSCI
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 054/143] wifi: virt_wifi: Fix page fault on connect Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 056/143] bpf: Reject bpf_timer for PREEMPT_RT Greg Kroah-Hartman
` (99 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven,
Marc Kleine-Budde, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <geert+renesas@glider.be>
[ Upstream commit 5c793afa07da6d2d4595f6c73a2a543a471bb055 ]
On R-Car Gen3 using PSCI, s2ram powers down the SoC. After resume, the
CAN interface no longer works, until it is brought down and up again.
Fix this by calling rcar_can_start() from the PM resume callback, to
fully initialize the controller instead of just restarting it.
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/699b2f7fcb60b31b6f976a37f08ce99c5ffccb31.1755165227.git.geert+renesas@glider.be
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/can/rcar/rcar_can.c | 8 +-------
1 file changed, 1 insertion(+), 7 deletions(-)
diff --git a/drivers/net/can/rcar/rcar_can.c b/drivers/net/can/rcar/rcar_can.c
index 2b7dd359f27b7..8569178b66df7 100644
--- a/drivers/net/can/rcar/rcar_can.c
+++ b/drivers/net/can/rcar/rcar_can.c
@@ -861,7 +861,6 @@ static int __maybe_unused rcar_can_resume(struct device *dev)
{
struct net_device *ndev = dev_get_drvdata(dev);
struct rcar_can_priv *priv = netdev_priv(ndev);
- u16 ctlr;
int err;
if (!netif_running(ndev))
@@ -873,12 +872,7 @@ static int __maybe_unused rcar_can_resume(struct device *dev)
return err;
}
- ctlr = readw(&priv->regs->ctlr);
- ctlr &= ~RCAR_CAN_CTLR_SLPM;
- writew(ctlr, &priv->regs->ctlr);
- ctlr &= ~RCAR_CAN_CTLR_CANM;
- writew(ctlr, &priv->regs->ctlr);
- priv->can.state = CAN_STATE_ERROR_ACTIVE;
+ rcar_can_start(ndev);
netif_device_attach(ndev);
netif_start_queue(ndev);
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 056/143] bpf: Reject bpf_timer for PREEMPT_RT
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 055/143] can: rcar_can: rcar_can_resume(): fix s2ram with PSCI Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 057/143] selftests/bpf: Skip timer cases when bpf_timer is not supported Greg Kroah-Hartman
` (98 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Leon Hwang, Alexei Starovoitov,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Hwang <leon.hwang@linux.dev>
[ Upstream commit e25ddfb388c8b7e5f20e3bf38d627fb485003781 ]
When enable CONFIG_PREEMPT_RT, the kernel will warn when run timer
selftests by './test_progs -t timer':
BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48
In order to avoid such warning, reject bpf_timer in verifier when
PREEMPT_RT is enabled.
Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
Link: https://lore.kernel.org/r/20250910125740.52172-2-leon.hwang@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/verifier.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index d6782efd25734..a6338936085ae 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -8405,6 +8405,10 @@ static int process_timer_func(struct bpf_verifier_env *env, int regno,
verifier_bug(env, "Two map pointers in a timer helper");
return -EFAULT;
}
+ if (IS_ENABLED(CONFIG_PREEMPT_RT)) {
+ verbose(env, "bpf_timer cannot be used for PREEMPT_RT.\n");
+ return -EOPNOTSUPP;
+ }
meta->map_uid = reg->map_uid;
meta->map_ptr = map;
return 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 057/143] selftests/bpf: Skip timer cases when bpf_timer is not supported
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 056/143] bpf: Reject bpf_timer for PREEMPT_RT Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 058/143] xfrm: xfrm_alloc_spi shouldnt use 0 as SPI Greg Kroah-Hartman
` (97 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Leon Hwang, Alexei Starovoitov,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Hwang <leon.hwang@linux.dev>
[ Upstream commit fbdd61c94bcb09b0c0eb0655917bf4193d07aac1 ]
When enable CONFIG_PREEMPT_RT, verifier will reject bpf_timer with
returning -EOPNOTSUPP.
Therefore, skip test cases when errno is EOPNOTSUPP.
cd tools/testing/selftests/bpf
./test_progs -t timer
125 free_timer:SKIP
456 timer:SKIP
457/1 timer_crash/array:SKIP
457/2 timer_crash/hash:SKIP
457 timer_crash:SKIP
458 timer_lockup:SKIP
459 timer_mim:SKIP
Summary: 5/0 PASSED, 6 SKIPPED, 0 FAILED
Signed-off-by: Leon Hwang <leon.hwang@linux.dev>
Link: https://lore.kernel.org/r/20250910125740.52172-3-leon.hwang@linux.dev
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/bpf/prog_tests/free_timer.c | 4 ++++
tools/testing/selftests/bpf/prog_tests/timer.c | 4 ++++
tools/testing/selftests/bpf/prog_tests/timer_crash.c | 4 ++++
tools/testing/selftests/bpf/prog_tests/timer_lockup.c | 4 ++++
tools/testing/selftests/bpf/prog_tests/timer_mim.c | 4 ++++
5 files changed, 20 insertions(+)
diff --git a/tools/testing/selftests/bpf/prog_tests/free_timer.c b/tools/testing/selftests/bpf/prog_tests/free_timer.c
index b7b77a6b29799..0de8facca4c5b 100644
--- a/tools/testing/selftests/bpf/prog_tests/free_timer.c
+++ b/tools/testing/selftests/bpf/prog_tests/free_timer.c
@@ -124,6 +124,10 @@ void test_free_timer(void)
int err;
skel = free_timer__open_and_load();
+ if (!skel && errno == EOPNOTSUPP) {
+ test__skip();
+ return;
+ }
if (!ASSERT_OK_PTR(skel, "open_load"))
return;
diff --git a/tools/testing/selftests/bpf/prog_tests/timer.c b/tools/testing/selftests/bpf/prog_tests/timer.c
index d66687f1ee6a8..56f660ca567ba 100644
--- a/tools/testing/selftests/bpf/prog_tests/timer.c
+++ b/tools/testing/selftests/bpf/prog_tests/timer.c
@@ -86,6 +86,10 @@ void serial_test_timer(void)
int err;
timer_skel = timer__open_and_load();
+ if (!timer_skel && errno == EOPNOTSUPP) {
+ test__skip();
+ return;
+ }
if (!ASSERT_OK_PTR(timer_skel, "timer_skel_load"))
return;
diff --git a/tools/testing/selftests/bpf/prog_tests/timer_crash.c b/tools/testing/selftests/bpf/prog_tests/timer_crash.c
index f74b82305da8c..b841597c8a3a3 100644
--- a/tools/testing/selftests/bpf/prog_tests/timer_crash.c
+++ b/tools/testing/selftests/bpf/prog_tests/timer_crash.c
@@ -12,6 +12,10 @@ static void test_timer_crash_mode(int mode)
struct timer_crash *skel;
skel = timer_crash__open_and_load();
+ if (!skel && errno == EOPNOTSUPP) {
+ test__skip();
+ return;
+ }
if (!ASSERT_OK_PTR(skel, "timer_crash__open_and_load"))
return;
skel->bss->pid = getpid();
diff --git a/tools/testing/selftests/bpf/prog_tests/timer_lockup.c b/tools/testing/selftests/bpf/prog_tests/timer_lockup.c
index 1a2f99596916f..eb303fa1e09af 100644
--- a/tools/testing/selftests/bpf/prog_tests/timer_lockup.c
+++ b/tools/testing/selftests/bpf/prog_tests/timer_lockup.c
@@ -59,6 +59,10 @@ void test_timer_lockup(void)
}
skel = timer_lockup__open_and_load();
+ if (!skel && errno == EOPNOTSUPP) {
+ test__skip();
+ return;
+ }
if (!ASSERT_OK_PTR(skel, "timer_lockup__open_and_load"))
return;
diff --git a/tools/testing/selftests/bpf/prog_tests/timer_mim.c b/tools/testing/selftests/bpf/prog_tests/timer_mim.c
index 9ff7843909e7d..c930c7d7105b9 100644
--- a/tools/testing/selftests/bpf/prog_tests/timer_mim.c
+++ b/tools/testing/selftests/bpf/prog_tests/timer_mim.c
@@ -65,6 +65,10 @@ void serial_test_timer_mim(void)
goto cleanup;
timer_skel = timer_mim__open_and_load();
+ if (!timer_skel && errno == EOPNOTSUPP) {
+ test__skip();
+ return;
+ }
if (!ASSERT_OK_PTR(timer_skel, "timer_skel_load"))
goto cleanup;
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 058/143] xfrm: xfrm_alloc_spi shouldnt use 0 as SPI
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 057/143] selftests/bpf: Skip timer cases when bpf_timer is not supported Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 059/143] xfrm: fix offloading of cross-family tunnels Greg Kroah-Hartman
` (96 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+a25ee9d20d31e483ba7b,
Sabrina Dubroca, Simon Horman, Steffen Klassert, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <sd@queasysnail.net>
[ Upstream commit cd8ae32e4e4652db55bce6b9c79267d8946765a9 ]
x->id.spi == 0 means "no SPI assigned", but since commit
94f39804d891 ("xfrm: Duplicate SPI Handling"), we now create states
and add them to the byspi list with this value.
__xfrm_state_delete doesn't remove those states from the byspi list,
since they shouldn't be there, and this shows up as a UAF the next
time we go through the byspi list.
Reported-by: syzbot+a25ee9d20d31e483ba7b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=a25ee9d20d31e483ba7b
Fixes: 94f39804d891 ("xfrm: Duplicate SPI Handling")
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/xfrm/xfrm_state.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 86337453709ba..4b2eb260f5c2e 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -2578,6 +2578,8 @@ int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high,
for (h = 0; h < range; h++) {
u32 spi = (low == high) ? low : get_random_u32_inclusive(low, high);
+ if (spi == 0)
+ goto next;
newspi = htonl(spi);
spin_lock_bh(&net->xfrm.xfrm_state_lock);
@@ -2593,6 +2595,7 @@ int xfrm_alloc_spi(struct xfrm_state *x, u32 low, u32 high,
xfrm_state_put(x0);
spin_unlock_bh(&net->xfrm.xfrm_state_lock);
+next:
if (signal_pending(current)) {
err = -ERESTARTSYS;
goto unlock;
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 059/143] xfrm: fix offloading of cross-family tunnels
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 058/143] xfrm: xfrm_alloc_spi shouldnt use 0 as SPI Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 060/143] can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow Greg Kroah-Hartman
` (95 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiumei Mu, Sabrina Dubroca,
Leon Romanovsky, Zhu Yanjun, Steffen Klassert, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <sd@queasysnail.net>
[ Upstream commit 91d8a53db2199eefc73ecf3682e0665ea6895696 ]
Xiumei reported a regression in IPsec offload tests over xfrmi, where
the traffic for IPv6 over IPv4 tunnels is processed in SW instead of
going through crypto offload, after commit
cc18f482e8b6 ("xfrm: provide common xdo_dev_offload_ok callback
implementation").
Commit cc18f482e8b6 added a generic version of existing checks
attempting to prevent packets with IPv4 options or IPv6 extension
headers from being sent to HW that doesn't support offloading such
packets. The check mistakenly uses x->props.family (the outer family)
to determine the inner packet's family and verify if
options/extensions are present.
In the case of IPv6 over IPv4, the check compares some of the traffic
class bits to the expected no-options ihl value (5). The original
check was introduced in commit 2ac9cfe78223 ("net/mlx5e: IPSec, Add
Innova IPSec offload TX data path"), and then duplicated in the other
drivers. Before commit cc18f482e8b6, the loose check (ihl > 5) passed
because those traffic class bits were not set to a value that
triggered the no-offload codepath. Packets with options/extension
headers that should have been handled in SW went through the offload
path, and were likely dropped by the NIC or incorrectly
processed. Since commit cc18f482e8b6, the check is now strict (ihl !=
5), and in a basic setup (no traffic class configured), all packets go
through the no-offload codepath.
The commits that introduced the incorrect family checks in each driver
are:
2ac9cfe78223 ("net/mlx5e: IPSec, Add Innova IPSec offload TX data path")
8362ea16f69f ("crypto: chcr - ESN for Inline IPSec Tx")
859a497fe80c ("nfp: implement xfrm callbacks and expose ipsec offload feature to upper layer")
32188be805d0 ("cn10k-ipsec: Allow ipsec crypto offload for skb with SA")
[ixgbe/ixgbevf commits are ignored, as that HW does not support tunnel
mode, thus no cross-family setups are possible]
Fixes: cc18f482e8b6 ("xfrm: provide common xdo_dev_offload_ok callback implementation")
Reported-by: Xiumei Mu <xmu@redhat.com>
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/xfrm/xfrm_device.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/xfrm/xfrm_device.c b/net/xfrm/xfrm_device.c
index c7a1f080d2de3..44b9de6e4e778 100644
--- a/net/xfrm/xfrm_device.c
+++ b/net/xfrm/xfrm_device.c
@@ -438,7 +438,7 @@ bool xfrm_dev_offload_ok(struct sk_buff *skb, struct xfrm_state *x)
check_tunnel_size = x->xso.type == XFRM_DEV_OFFLOAD_PACKET &&
x->props.mode == XFRM_MODE_TUNNEL;
- switch (x->props.family) {
+ switch (x->inner_mode.family) {
case AF_INET:
/* Check for IPv4 options */
if (ip_hdr(skb)->ihl != 5)
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 060/143] can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 059/143] xfrm: fix offloading of cross-family tunnels Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 061/143] can: hi311x: " Greg Kroah-Hartman
` (94 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vincent Mailhol, Marc Kleine-Budde,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Mailhol <mailhol@kernel.org>
[ Upstream commit 38c0abad45b190a30d8284a37264d2127a6ec303 ]
Sending an PF_PACKET allows to bypass the CAN framework logic and to
directly reach the xmit() function of a CAN driver. The only check
which is performed by the PF_PACKET framework is to make sure that
skb->len fits the interface's MTU.
Unfortunately, because the etas_es58x driver does not populate its
net_device_ops->ndo_change_mtu(), it is possible for an attacker to
configure an invalid MTU by doing, for example:
$ ip link set can0 mtu 9999
After doing so, the attacker could open a PF_PACKET socket using the
ETH_P_CANXL protocol:
socket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL));
to inject a malicious CAN XL frames. For example:
struct canxl_frame frame = {
.flags = 0xff,
.len = 2048,
};
The CAN drivers' xmit() function are calling can_dev_dropped_skb() to
check that the skb is valid, unfortunately under above conditions, the
malicious packet is able to go through can_dev_dropped_skb() checks:
1. the skb->protocol is set to ETH_P_CANXL which is valid (the
function does not check the actual device capabilities).
2. the length is a valid CAN XL length.
And so, es58x_start_xmit() receives a CAN XL frame which it is not
able to correctly handle and will thus misinterpret it as a CAN(FD)
frame.
This can result in a buffer overflow. For example, using the es581.4
variant, the frame will be dispatched to es581_4_tx_can_msg(), go
through the last check at the beginning of this function:
if (can_is_canfd_skb(skb))
return -EMSGSIZE;
and reach this line:
memcpy(tx_can_msg->data, cf->data, cf->len);
Here, cf->len corresponds to the flags field of the CAN XL frame. In
our previous example, we set canxl_frame->flags to 0xff. Because the
maximum expected length is 8, a buffer overflow of 247 bytes occurs!
Populate net_device_ops->ndo_change_mtu() to ensure that the
interface's MTU can not be set to anything bigger than CAN_MTU or
CANFD_MTU (depending on the device capabilities). By fixing the root
cause, this prevents the buffer overflow.
Fixes: 8537257874e9 ("can: etas_es58x: add core support for ETAS ES58X CAN USB interfaces")
Signed-off-by: Vincent Mailhol <mailhol@kernel.org>
Link: https://patch.msgid.link/20250918-can-fix-mtu-v1-1-0d1cada9393b@kernel.org
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/can/usb/etas_es58x/es58x_core.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/can/usb/etas_es58x/es58x_core.c b/drivers/net/can/usb/etas_es58x/es58x_core.c
index db1acf6d504cf..adc91873c083f 100644
--- a/drivers/net/can/usb/etas_es58x/es58x_core.c
+++ b/drivers/net/can/usb/etas_es58x/es58x_core.c
@@ -7,7 +7,7 @@
*
* Copyright (c) 2019 Robert Bosch Engineering and Business Solutions. All rights reserved.
* Copyright (c) 2020 ETAS K.K.. All rights reserved.
- * Copyright (c) 2020-2022 Vincent Mailhol <mailhol.vincent@wanadoo.fr>
+ * Copyright (c) 2020-2025 Vincent Mailhol <mailhol@kernel.org>
*/
#include <linux/unaligned.h>
@@ -1977,6 +1977,7 @@ static const struct net_device_ops es58x_netdev_ops = {
.ndo_stop = es58x_stop,
.ndo_start_xmit = es58x_start_xmit,
.ndo_eth_ioctl = can_eth_ioctl_hwts,
+ .ndo_change_mtu = can_change_mtu,
};
static const struct ethtool_ops es58x_ethtool_ops = {
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 061/143] can: hi311x: populate ndo_change_mtu() to prevent buffer overflow
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 060/143] can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 062/143] can: sun4i_can: " Greg Kroah-Hartman
` (93 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vincent Mailhol, Marc Kleine-Budde,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Mailhol <mailhol@kernel.org>
[ Upstream commit ac1c7656fa717f29fac3ea073af63f0b9919ec9a ]
Sending an PF_PACKET allows to bypass the CAN framework logic and to
directly reach the xmit() function of a CAN driver. The only check
which is performed by the PF_PACKET framework is to make sure that
skb->len fits the interface's MTU.
Unfortunately, because the sun4i_can driver does not populate its
net_device_ops->ndo_change_mtu(), it is possible for an attacker to
configure an invalid MTU by doing, for example:
$ ip link set can0 mtu 9999
After doing so, the attacker could open a PF_PACKET socket using the
ETH_P_CANXL protocol:
socket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL))
to inject a malicious CAN XL frames. For example:
struct canxl_frame frame = {
.flags = 0xff,
.len = 2048,
};
The CAN drivers' xmit() function are calling can_dev_dropped_skb() to
check that the skb is valid, unfortunately under above conditions, the
malicious packet is able to go through can_dev_dropped_skb() checks:
1. the skb->protocol is set to ETH_P_CANXL which is valid (the
function does not check the actual device capabilities).
2. the length is a valid CAN XL length.
And so, hi3110_hard_start_xmit() receives a CAN XL frame which it is
not able to correctly handle and will thus misinterpret it as a CAN
frame. The driver will consume frame->len as-is with no further
checks.
This can result in a buffer overflow later on in hi3110_hw_tx() on
this line:
memcpy(buf + HI3110_FIFO_EXT_DATA_OFF,
frame->data, frame->len);
Here, frame->len corresponds to the flags field of the CAN XL frame.
In our previous example, we set canxl_frame->flags to 0xff. Because
the maximum expected length is 8, a buffer overflow of 247 bytes
occurs!
Populate net_device_ops->ndo_change_mtu() to ensure that the
interface's MTU can not be set to anything bigger than CAN_MTU. By
fixing the root cause, this prevents the buffer overflow.
Fixes: 57e83fb9b746 ("can: hi311x: Add Holt HI-311x CAN driver")
Signed-off-by: Vincent Mailhol <mailhol@kernel.org>
Link: https://patch.msgid.link/20250918-can-fix-mtu-v1-2-0d1cada9393b@kernel.org
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/can/spi/hi311x.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/can/spi/hi311x.c b/drivers/net/can/spi/hi311x.c
index 09ae218315d73..6441ff3b41987 100644
--- a/drivers/net/can/spi/hi311x.c
+++ b/drivers/net/can/spi/hi311x.c
@@ -812,6 +812,7 @@ static const struct net_device_ops hi3110_netdev_ops = {
.ndo_open = hi3110_open,
.ndo_stop = hi3110_stop,
.ndo_start_xmit = hi3110_hard_start_xmit,
+ .ndo_change_mtu = can_change_mtu,
};
static const struct ethtool_ops hi3110_ethtool_ops = {
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 062/143] can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 061/143] can: hi311x: " Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 063/143] can: mcba_usb: " Greg Kroah-Hartman
` (92 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vincent Mailhol, Marc Kleine-Budde,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Mailhol <mailhol@kernel.org>
[ Upstream commit 61da0bd4102c459823fbe6b8b43b01fb6ace4a22 ]
Sending an PF_PACKET allows to bypass the CAN framework logic and to
directly reach the xmit() function of a CAN driver. The only check
which is performed by the PF_PACKET framework is to make sure that
skb->len fits the interface's MTU.
Unfortunately, because the sun4i_can driver does not populate its
net_device_ops->ndo_change_mtu(), it is possible for an attacker to
configure an invalid MTU by doing, for example:
$ ip link set can0 mtu 9999
After doing so, the attacker could open a PF_PACKET socket using the
ETH_P_CANXL protocol:
socket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL))
to inject a malicious CAN XL frames. For example:
struct canxl_frame frame = {
.flags = 0xff,
.len = 2048,
};
The CAN drivers' xmit() function are calling can_dev_dropped_skb() to
check that the skb is valid, unfortunately under above conditions, the
malicious packet is able to go through can_dev_dropped_skb() checks:
1. the skb->protocol is set to ETH_P_CANXL which is valid (the
function does not check the actual device capabilities).
2. the length is a valid CAN XL length.
And so, sun4ican_start_xmit() receives a CAN XL frame which it is not
able to correctly handle and will thus misinterpret it as a CAN frame.
This can result in a buffer overflow. The driver will consume cf->len
as-is with no further checks on this line:
dlc = cf->len;
Here, cf->len corresponds to the flags field of the CAN XL frame. In
our previous example, we set canxl_frame->flags to 0xff. Because the
maximum expected length is 8, a buffer overflow of 247 bytes occurs a
couple line below when doing:
for (i = 0; i < dlc; i++)
writel(cf->data[i], priv->base + (dreg + i * 4));
Populate net_device_ops->ndo_change_mtu() to ensure that the
interface's MTU can not be set to anything bigger than CAN_MTU. By
fixing the root cause, this prevents the buffer overflow.
Fixes: 0738eff14d81 ("can: Allwinner A10/A20 CAN Controller support - Kernel module")
Signed-off-by: Vincent Mailhol <mailhol@kernel.org>
Link: https://patch.msgid.link/20250918-can-fix-mtu-v1-3-0d1cada9393b@kernel.org
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/can/sun4i_can.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/can/sun4i_can.c b/drivers/net/can/sun4i_can.c
index 6fcb301ef611d..53bfd873de9bd 100644
--- a/drivers/net/can/sun4i_can.c
+++ b/drivers/net/can/sun4i_can.c
@@ -768,6 +768,7 @@ static const struct net_device_ops sun4ican_netdev_ops = {
.ndo_open = sun4ican_open,
.ndo_stop = sun4ican_close,
.ndo_start_xmit = sun4ican_start_xmit,
+ .ndo_change_mtu = can_change_mtu,
};
static const struct ethtool_ops sun4ican_ethtool_ops = {
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 063/143] can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 062/143] can: sun4i_can: " Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 064/143] can: peak_usb: fix shift-out-of-bounds issue Greg Kroah-Hartman
` (91 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vincent Mailhol, Marc Kleine-Budde,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Mailhol <mailhol@kernel.org>
[ Upstream commit 17c8d794527f01def0d1c8b7dc2d7b8d34fed0e6 ]
Sending an PF_PACKET allows to bypass the CAN framework logic and to
directly reach the xmit() function of a CAN driver. The only check
which is performed by the PF_PACKET framework is to make sure that
skb->len fits the interface's MTU.
Unfortunately, because the mcba_usb driver does not populate its
net_device_ops->ndo_change_mtu(), it is possible for an attacker to
configure an invalid MTU by doing, for example:
$ ip link set can0 mtu 9999
After doing so, the attacker could open a PF_PACKET socket using the
ETH_P_CANXL protocol:
socket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL))
to inject a malicious CAN XL frames. For example:
struct canxl_frame frame = {
.flags = 0xff,
.len = 2048,
};
The CAN drivers' xmit() function are calling can_dev_dropped_skb() to
check that the skb is valid, unfortunately under above conditions, the
malicious packet is able to go through can_dev_dropped_skb() checks:
1. the skb->protocol is set to ETH_P_CANXL which is valid (the
function does not check the actual device capabilities).
2. the length is a valid CAN XL length.
And so, mcba_usb_start_xmit() receives a CAN XL frame which it is not
able to correctly handle and will thus misinterpret it as a CAN frame.
This can result in a buffer overflow. The driver will consume cf->len
as-is with no further checks on these lines:
usb_msg.dlc = cf->len;
memcpy(usb_msg.data, cf->data, usb_msg.dlc);
Here, cf->len corresponds to the flags field of the CAN XL frame. In
our previous example, we set canxl_frame->flags to 0xff. Because the
maximum expected length is 8, a buffer overflow of 247 bytes occurs!
Populate net_device_ops->ndo_change_mtu() to ensure that the
interface's MTU can not be set to anything bigger than CAN_MTU. By
fixing the root cause, this prevents the buffer overflow.
Fixes: 51f3baad7de9 ("can: mcba_usb: Add support for Microchip CAN BUS Analyzer")
Signed-off-by: Vincent Mailhol <mailhol@kernel.org>
Link: https://patch.msgid.link/20250918-can-fix-mtu-v1-4-0d1cada9393b@kernel.org
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/can/usb/mcba_usb.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/can/usb/mcba_usb.c b/drivers/net/can/usb/mcba_usb.c
index 41c0a1c399bf3..1f9b915094e64 100644
--- a/drivers/net/can/usb/mcba_usb.c
+++ b/drivers/net/can/usb/mcba_usb.c
@@ -761,6 +761,7 @@ static const struct net_device_ops mcba_netdev_ops = {
.ndo_open = mcba_usb_open,
.ndo_stop = mcba_usb_close,
.ndo_start_xmit = mcba_usb_start_xmit,
+ .ndo_change_mtu = can_change_mtu,
};
static const struct ethtool_ops mcba_ethtool_ops = {
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 064/143] can: peak_usb: fix shift-out-of-bounds issue
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 063/143] can: mcba_usb: " Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 065/143] net: tun: Update napi->skb after XDP process Greg Kroah-Hartman
` (90 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stéphane Grosjean,
Marc Kleine-Budde, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stéphane Grosjean <stephane.grosjean@hms-networks.com>
[ Upstream commit c443be70aaee42c2d1d251e0329e0a69dd96ae54 ]
Explicitly uses a 64-bit constant when the number of bits used for its
shifting is 32 (which is the case for PC CAN FD interfaces supported by
this driver).
Signed-off-by: Stéphane Grosjean <stephane.grosjean@hms-networks.com>
Link: https://patch.msgid.link/20250918132413.30071-1-stephane.grosjean@free.fr
Reported-by: Marc Kleine-Budde <mkl@pengutronix.de>
Closes: https://lore.kernel.org/20250917-aboriginal-refined-honeybee-82b1aa-mkl@pengutronix.de
Fixes: bb4785551f64 ("can: usb: PEAK-System Technik USB adapters driver core")
[mkl: update subject, apply manually]
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/can/usb/peak_usb/pcan_usb_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
index 117637b9b995b..dd5caa1c302b9 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
@@ -111,7 +111,7 @@ void peak_usb_update_ts_now(struct peak_time_ref *time_ref, u32 ts_now)
u32 delta_ts = time_ref->ts_dev_2 - time_ref->ts_dev_1;
if (time_ref->ts_dev_2 < time_ref->ts_dev_1)
- delta_ts &= (1 << time_ref->adapter->ts_used_bits) - 1;
+ delta_ts &= (1ULL << time_ref->adapter->ts_used_bits) - 1;
time_ref->ts_total += delta_ts;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 065/143] net: tun: Update napi->skb after XDP process
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 064/143] can: peak_usb: fix shift-out-of-bounds issue Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 066/143] net/smc: fix warning in smc_rx_splice() when calling get_page() Greg Kroah-Hartman
` (89 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+64e24275ad95a915a313,
Wang Liang, Willem de Bruijn, Jakub Kicinski, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Liang <wangliang74@huawei.com>
[ Upstream commit 1091860a16a86ccdd77c09f2b21a5f634f5ab9ec ]
The syzbot report a UAF issue:
BUG: KASAN: slab-use-after-free in skb_reset_mac_header include/linux/skbuff.h:3150 [inline]
BUG: KASAN: slab-use-after-free in napi_frags_skb net/core/gro.c:723 [inline]
BUG: KASAN: slab-use-after-free in napi_gro_frags+0x6e/0x1030 net/core/gro.c:758
Read of size 8 at addr ffff88802ef22c18 by task syz.0.17/6079
CPU: 0 UID: 0 PID: 6079 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x240 mm/kasan/report.c:482
kasan_report+0x118/0x150 mm/kasan/report.c:595
skb_reset_mac_header include/linux/skbuff.h:3150 [inline]
napi_frags_skb net/core/gro.c:723 [inline]
napi_gro_frags+0x6e/0x1030 net/core/gro.c:758
tun_get_user+0x28cb/0x3e20 drivers/net/tun.c:1920
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1996
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x5c9/0xb30 fs/read_write.c:686
ksys_write+0x145/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
Allocated by task 6079:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:330 [inline]
__kasan_mempool_unpoison_object+0xa0/0x170 mm/kasan/common.c:558
kasan_mempool_unpoison_object include/linux/kasan.h:388 [inline]
napi_skb_cache_get+0x37b/0x6d0 net/core/skbuff.c:295
__alloc_skb+0x11e/0x2d0 net/core/skbuff.c:657
napi_alloc_skb+0x84/0x7d0 net/core/skbuff.c:811
napi_get_frags+0x69/0x140 net/core/gro.c:673
tun_napi_alloc_frags drivers/net/tun.c:1404 [inline]
tun_get_user+0x77c/0x3e20 drivers/net/tun.c:1784
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1996
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x5c9/0xb30 fs/read_write.c:686
ksys_write+0x145/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 6079:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:243 [inline]
__kasan_slab_free+0x5b/0x80 mm/kasan/common.c:275
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2422 [inline]
slab_free mm/slub.c:4695 [inline]
kmem_cache_free+0x18f/0x400 mm/slub.c:4797
skb_pp_cow_data+0xdd8/0x13e0 net/core/skbuff.c:969
netif_skb_check_for_xdp net/core/dev.c:5390 [inline]
netif_receive_generic_xdp net/core/dev.c:5431 [inline]
do_xdp_generic+0x699/0x11a0 net/core/dev.c:5499
tun_get_user+0x2523/0x3e20 drivers/net/tun.c:1872
tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1996
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x5c9/0xb30 fs/read_write.c:686
ksys_write+0x145/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
After commit e6d5dbdd20aa ("xdp: add multi-buff support for xdp running in
generic mode"), the original skb may be freed in skb_pp_cow_data() when
XDP program was attached, which was allocated in tun_napi_alloc_frags().
However, the napi->skb still point to the original skb, update it after
XDP process.
Reported-by: syzbot+64e24275ad95a915a313@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=64e24275ad95a915a313
Fixes: e6d5dbdd20aa ("xdp: add multi-buff support for xdp running in generic mode")
Signed-off-by: Wang Liang <wangliang74@huawei.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20250917113919.3991267-1-wangliang74@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/tun.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index f8c5e2fd04dfa..0fffa023cb736 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1863,6 +1863,9 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
local_bh_enable();
goto unlock_frags;
}
+
+ if (frags && skb != tfile->napi.skb)
+ tfile->napi.skb = skb;
}
rcu_read_unlock();
local_bh_enable();
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 066/143] net/smc: fix warning in smc_rx_splice() when calling get_page()
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 065/143] net: tun: Update napi->skb after XDP process Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 067/143] ethernet: rvu-af: Remove slash from the driver name Greg Kroah-Hartman
` (88 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mahanta Jambigi, Sidraya Jayagond,
Jakub Kicinski, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sidraya Jayagond <sidraya@linux.ibm.com>
[ Upstream commit a35c04de2565db191726b5741e6b66a35002c652 ]
smc_lo_register_dmb() allocates DMB buffers with kzalloc(), which are
later passed to get_page() in smc_rx_splice(). Since kmalloc memory is
not page-backed, this triggers WARN_ON_ONCE() in get_page() and prevents
holding a refcount on the buffer. This can lead to use-after-free if
the memory is released before splice_to_pipe() completes.
Use folio_alloc() instead, ensuring DMBs are page-backed and safe for
get_page().
WARNING: CPU: 18 PID: 12152 at ./include/linux/mm.h:1330 smc_rx_splice+0xaf8/0xe20 [smc]
CPU: 18 UID: 0 PID: 12152 Comm: smcapp Kdump: loaded Not tainted 6.17.0-rc3-11705-g9cf4672ecfee #10 NONE
Hardware name: IBM 3931 A01 704 (z/VM 7.4.0)
Krnl PSW : 0704e00180000000 000793161032696c (smc_rx_splice+0xafc/0xe20 [smc])
R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 EA:3
Krnl GPRS: 0000000000000000 001cee80007d3001 00077400000000f8 0000000000000005
0000000000000001 001cee80007d3006 0007740000001000 001c000000000000
000000009b0c99e0 0000000000001000 001c0000000000f8 001c000000000000
000003ffcc6f7c88 0007740003e98000 0007931600000005 000792969b2ff7b8
Krnl Code: 0007931610326960: af000000 mc 0,0
0007931610326964: a7f4ff43 brc 15,00079316103267ea
#0007931610326968: af000000 mc 0,0
>000793161032696c: a7f4ff3f brc 15,00079316103267ea
0007931610326970: e320f1000004 lg %r2,256(%r15)
0007931610326976: c0e53fd1b5f5 brasl %r14,000793168fd5d560
000793161032697c: a7f4fbb5 brc 15,00079316103260e6
0007931610326980: b904002b lgr %r2,%r11
Call Trace:
smc_rx_splice+0xafc/0xe20 [smc]
smc_rx_splice+0x756/0xe20 [smc])
smc_rx_recvmsg+0xa74/0xe00 [smc]
smc_splice_read+0x1ce/0x3b0 [smc]
sock_splice_read+0xa2/0xf0
do_splice_read+0x198/0x240
splice_file_to_pipe+0x7e/0x110
do_splice+0x59e/0xde0
__do_splice+0x11a/0x2d0
__s390x_sys_splice+0x140/0x1f0
__do_syscall+0x122/0x280
system_call+0x6e/0x90
Last Breaking-Event-Address:
smc_rx_splice+0x960/0xe20 [smc]
---[ end trace 0000000000000000 ]---
Fixes: f7a22071dbf3 ("net/smc: implement DMB-related operations of loopback-ism")
Reviewed-by: Mahanta Jambigi <mjambigi@linux.ibm.com>
Signed-off-by: Sidraya Jayagond <sidraya@linux.ibm.com>
Link: https://patch.msgid.link/20250917184220.801066-1-sidraya@linux.ibm.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/smc/smc_loopback.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
diff --git a/net/smc/smc_loopback.c b/net/smc/smc_loopback.c
index 3c5f64ca41153..85f0b7853b173 100644
--- a/net/smc/smc_loopback.c
+++ b/net/smc/smc_loopback.c
@@ -56,6 +56,7 @@ static int smc_lo_register_dmb(struct smcd_dev *smcd, struct smcd_dmb *dmb,
{
struct smc_lo_dmb_node *dmb_node, *tmp_node;
struct smc_lo_dev *ldev = smcd->priv;
+ struct folio *folio;
int sba_idx, rc;
/* check space for new dmb */
@@ -74,13 +75,16 @@ static int smc_lo_register_dmb(struct smcd_dev *smcd, struct smcd_dmb *dmb,
dmb_node->sba_idx = sba_idx;
dmb_node->len = dmb->dmb_len;
- dmb_node->cpu_addr = kzalloc(dmb_node->len, GFP_KERNEL |
- __GFP_NOWARN | __GFP_NORETRY |
- __GFP_NOMEMALLOC);
- if (!dmb_node->cpu_addr) {
+
+ /* not critical; fail under memory pressure and fallback to TCP */
+ folio = folio_alloc(GFP_KERNEL | __GFP_NOWARN | __GFP_NOMEMALLOC |
+ __GFP_NORETRY | __GFP_ZERO,
+ get_order(dmb_node->len));
+ if (!folio) {
rc = -ENOMEM;
goto err_node;
}
+ dmb_node->cpu_addr = folio_address(folio);
dmb_node->dma_addr = SMC_DMA_ADDR_INVALID;
refcount_set(&dmb_node->refcnt, 1);
@@ -122,7 +126,7 @@ static void __smc_lo_unregister_dmb(struct smc_lo_dev *ldev,
write_unlock_bh(&ldev->dmb_ht_lock);
clear_bit(dmb_node->sba_idx, ldev->sba_idx_mask);
- kvfree(dmb_node->cpu_addr);
+ folio_put(virt_to_folio(dmb_node->cpu_addr));
kfree(dmb_node);
if (atomic_dec_and_test(&ldev->dmb_cnt))
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 067/143] ethernet: rvu-af: Remove slash from the driver name
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 066/143] net/smc: fix warning in smc_rx_splice() when calling get_page() Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 068/143] Bluetooth: hci_sync: Fix hci_resume_advertising_sync Greg Kroah-Hartman
` (87 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Petr Malat, Simon Horman,
Jakub Kicinski, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Malat <oss@malat.biz>
[ Upstream commit b65678cacc030efd53c38c089fb9b741a2ee34c8 ]
Having a slash in the driver name leads to EIO being returned while
reading /sys/module/rvu_af/drivers content.
Remove DRV_STRING as it's not used anywhere.
Fixes: 91c6945ea1f9 ("octeontx2-af: cn10k: Add RPM MAC support")
Signed-off-by: Petr Malat <oss@malat.biz>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250918152106.1798299-1-oss@malat.biz
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/marvell/octeontx2/af/cgx.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
index 442305463cc0a..21161711c579f 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/cgx.c
@@ -21,8 +21,7 @@
#include "rvu.h"
#include "lmac_common.h"
-#define DRV_NAME "Marvell-CGX/RPM"
-#define DRV_STRING "Marvell CGX/RPM Driver"
+#define DRV_NAME "Marvell-CGX-RPM"
#define CGX_RX_STAT_GLOBAL_INDEX 9
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 068/143] Bluetooth: hci_sync: Fix hci_resume_advertising_sync
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 067/143] ethernet: rvu-af: Remove slash from the driver name Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 069/143] Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue Greg Kroah-Hartman
` (86 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Luiz Augusto von Dentz, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit 1488af7b8b5f9896ea88ee35aa3301713f72737c ]
hci_resume_advertising_sync is suppose to resume all instance paused by
hci_pause_advertising_sync, this logic is used for procedures are only
allowed when not advertising, but instance 0x00 was not being
re-enabled.
Fixes: ad383c2c65a5 ("Bluetooth: hci_sync: Enable advertising when LL privacy is enabled")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/hci_sync.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c
index a25439f1eeac2..7ca544d7791f4 100644
--- a/net/bluetooth/hci_sync.c
+++ b/net/bluetooth/hci_sync.c
@@ -2594,6 +2594,13 @@ static int hci_resume_advertising_sync(struct hci_dev *hdev)
hci_remove_ext_adv_instance_sync(hdev, adv->instance,
NULL);
}
+
+ /* If current advertising instance is set to instance 0x00
+ * then we need to re-enable it.
+ */
+ if (!hdev->cur_adv_instance)
+ err = hci_enable_ext_advertising_sync(hdev,
+ hdev->cur_adv_instance);
} else {
/* Schedule for most recent instance to be restarted and begin
* the software rotation loop
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 069/143] Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 068/143] Bluetooth: hci_sync: Fix hci_resume_advertising_sync Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 070/143] Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync Greg Kroah-Hartman
` (85 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Junvyyang, Tencent Zhuque Lab,
Luiz Augusto von Dentz, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit 2e128683176a56459cef8705fc7c35f438f88abd ]
This fixes the following UAF caused by not properly locking hdev when
processing HCI_EV_NUM_COMP_PKTS:
BUG: KASAN: slab-use-after-free in hci_conn_tx_dequeue+0x1be/0x220 net/bluetooth/hci_conn.c:3036
Read of size 4 at addr ffff8880740f0940 by task kworker/u11:0/54
CPU: 1 UID: 0 PID: 54 Comm: kworker/u11:0 Not tainted 6.16.0-rc7 #3 PREEMPT(full)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
Workqueue: hci1 hci_rx_work
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x230 mm/kasan/report.c:480
kasan_report+0x118/0x150 mm/kasan/report.c:593
hci_conn_tx_dequeue+0x1be/0x220 net/bluetooth/hci_conn.c:3036
hci_num_comp_pkts_evt+0x1c8/0xa50 net/bluetooth/hci_event.c:4404
hci_event_func net/bluetooth/hci_event.c:7477 [inline]
hci_event_packet+0x7e0/0x1200 net/bluetooth/hci_event.c:7531
hci_rx_work+0x46a/0xe80 net/bluetooth/hci_core.c:4070
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16-rc7/arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 54:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4359
kmalloc_noprof include/linux/slab.h:905 [inline]
kzalloc_noprof include/linux/slab.h:1039 [inline]
__hci_conn_add+0x233/0x1b30 net/bluetooth/hci_conn.c:939
le_conn_complete_evt+0x3d6/0x1220 net/bluetooth/hci_event.c:5628
hci_le_enh_conn_complete_evt+0x189/0x470 net/bluetooth/hci_event.c:5794
hci_event_func net/bluetooth/hci_event.c:7474 [inline]
hci_event_packet+0x78c/0x1200 net/bluetooth/hci_event.c:7531
hci_rx_work+0x46a/0xe80 net/bluetooth/hci_core.c:4070
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16-rc7/arch/x86/entry/entry_64.S:245
Freed by task 9572:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x62/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2381 [inline]
slab_free mm/slub.c:4643 [inline]
kfree+0x18e/0x440 mm/slub.c:4842
device_release+0x9c/0x1c0
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x22b/0x480 lib/kobject.c:737
hci_conn_cleanup net/bluetooth/hci_conn.c:175 [inline]
hci_conn_del+0x8ff/0xcb0 net/bluetooth/hci_conn.c:1173
hci_abort_conn_sync+0x5d1/0xdf0 net/bluetooth/hci_sync.c:5689
hci_cmd_sync_work+0x210/0x3a0 net/bluetooth/hci_sync.c:332
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16-rc7/arch/x86/entry/entry_64.S:245
Fixes: 134f4b39df7b ("Bluetooth: add support for skb TX SND/COMPLETION timestamping")
Reported-by: Junvyyang, Tencent Zhuque Lab <zhuque@tencent.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/hci_event.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 090c7ffa51525..d3d9c3cbd9293 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -4391,6 +4391,8 @@ static void hci_num_comp_pkts_evt(struct hci_dev *hdev, void *data,
bt_dev_dbg(hdev, "num %d", ev->num);
+ hci_dev_lock(hdev);
+
for (i = 0; i < ev->num; i++) {
struct hci_comp_pkts_info *info = &ev->handles[i];
struct hci_conn *conn;
@@ -4472,6 +4474,8 @@ static void hci_num_comp_pkts_evt(struct hci_dev *hdev, void *data,
}
queue_work(hdev->workqueue, &hdev->tx_work);
+
+ hci_dev_unlock(hdev);
}
static void hci_mode_change_evt(struct hci_dev *hdev, void *data,
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 070/143] Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 069/143] Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 071/143] vhost: Take a reference on the task in struct vhost_task Greg Kroah-Hartman
` (84 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Junvyyang, Tencent Zhuque Lab,
Luiz Augusto von Dentz, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit 9e622804d57e2d08f0271200606bd1270f75126f ]
This fixes the following UFA in hci_acl_create_conn_sync where a
connection still pending is command submission (conn->state == BT_OPEN)
maybe freed, also since this also can happen with the likes of
hci_le_create_conn_sync fix it as well:
BUG: KASAN: slab-use-after-free in hci_acl_create_conn_sync+0x5ef/0x790 net/bluetooth/hci_sync.c:6861
Write of size 2 at addr ffff88805ffcc038 by task kworker/u11:2/9541
CPU: 1 UID: 0 PID: 9541 Comm: kworker/u11:2 Not tainted 6.16.0-rc7 #3 PREEMPT(full)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
Workqueue: hci3 hci_cmd_sync_work
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x230 mm/kasan/report.c:480
kasan_report+0x118/0x150 mm/kasan/report.c:593
hci_acl_create_conn_sync+0x5ef/0x790 net/bluetooth/hci_sync.c:6861
hci_cmd_sync_work+0x210/0x3a0 net/bluetooth/hci_sync.c:332
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16-rc7/arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 123736:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4359
kmalloc_noprof include/linux/slab.h:905 [inline]
kzalloc_noprof include/linux/slab.h:1039 [inline]
__hci_conn_add+0x233/0x1b30 net/bluetooth/hci_conn.c:939
hci_conn_add_unset net/bluetooth/hci_conn.c:1051 [inline]
hci_connect_acl+0x16c/0x4e0 net/bluetooth/hci_conn.c:1634
pair_device+0x418/0xa70 net/bluetooth/mgmt.c:3556
hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719
hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839
sock_sendmsg_nosec net/socket.c:712 [inline]
__sock_sendmsg+0x219/0x270 net/socket.c:727
sock_write_iter+0x258/0x330 net/socket.c:1131
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x54b/0xa90 fs/read_write.c:686
ksys_write+0x145/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 103680:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x62/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2381 [inline]
slab_free mm/slub.c:4643 [inline]
kfree+0x18e/0x440 mm/slub.c:4842
device_release+0x9c/0x1c0
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x22b/0x480 lib/kobject.c:737
hci_conn_cleanup net/bluetooth/hci_conn.c:175 [inline]
hci_conn_del+0x8ff/0xcb0 net/bluetooth/hci_conn.c:1173
hci_conn_complete_evt+0x3c7/0x1040 net/bluetooth/hci_event.c:3199
hci_event_func net/bluetooth/hci_event.c:7477 [inline]
hci_event_packet+0x7e0/0x1200 net/bluetooth/hci_event.c:7531
hci_rx_work+0x46a/0xe80 net/bluetooth/hci_core.c:4070
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16-rc7/arch/x86/entry/entry_64.S:245
Last potentially related work creation:
kasan_save_stack+0x3e/0x60 mm/kasan/common.c:47
kasan_record_aux_stack+0xbd/0xd0 mm/kasan/generic.c:548
insert_work+0x3d/0x330 kernel/workqueue.c:2183
__queue_work+0xbd9/0xfe0 kernel/workqueue.c:2345
queue_delayed_work_on+0x18b/0x280 kernel/workqueue.c:2561
pairing_complete+0x1e7/0x2b0 net/bluetooth/mgmt.c:3451
pairing_complete_cb+0x1ac/0x230 net/bluetooth/mgmt.c:3487
hci_connect_cfm include/net/bluetooth/hci_core.h:2064 [inline]
hci_conn_failed+0x24d/0x310 net/bluetooth/hci_conn.c:1275
hci_conn_complete_evt+0x3c7/0x1040 net/bluetooth/hci_event.c:3199
hci_event_func net/bluetooth/hci_event.c:7477 [inline]
hci_event_packet+0x7e0/0x1200 net/bluetooth/hci_event.c:7531
hci_rx_work+0x46a/0xe80 net/bluetooth/hci_core.c:4070
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16-rc7/arch/x86/entry/entry_64.S:245
Fixes: aef2aa4fa98e ("Bluetooth: hci_event: Fix creating hci_conn object on error status")
Reported-by: Junvyyang, Tencent Zhuque Lab <zhuque@tencent.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/bluetooth/hci_core.h | 21 +++++++++++++++++++++
net/bluetooth/hci_event.c | 26 +++++++++++++++++++++++---
2 files changed, 44 insertions(+), 3 deletions(-)
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 439bc124ce709..1347ae13dd0a1 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -1245,6 +1245,27 @@ static inline struct hci_conn *hci_conn_hash_lookup_ba(struct hci_dev *hdev,
return NULL;
}
+static inline struct hci_conn *hci_conn_hash_lookup_role(struct hci_dev *hdev,
+ __u8 type, __u8 role,
+ bdaddr_t *ba)
+{
+ struct hci_conn_hash *h = &hdev->conn_hash;
+ struct hci_conn *c;
+
+ rcu_read_lock();
+
+ list_for_each_entry_rcu(c, &h->list, list) {
+ if (c->type == type && c->role == role && !bacmp(&c->dst, ba)) {
+ rcu_read_unlock();
+ return c;
+ }
+ }
+
+ rcu_read_unlock();
+
+ return NULL;
+}
+
static inline struct hci_conn *hci_conn_hash_lookup_le(struct hci_dev *hdev,
bdaddr_t *ba,
__u8 ba_type)
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index d3d9c3cbd9293..2ef5b3004197b 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -3087,8 +3087,18 @@ static void hci_conn_complete_evt(struct hci_dev *hdev, void *data,
hci_dev_lock(hdev);
+ /* Check for existing connection:
+ *
+ * 1. If it doesn't exist then it must be receiver/slave role.
+ * 2. If it does exist confirm that it is connecting/BT_CONNECT in case
+ * of initiator/master role since there could be a collision where
+ * either side is attempting to connect or something like a fuzzing
+ * testing is trying to play tricks to destroy the hcon object before
+ * it even attempts to connect (e.g. hcon->state == BT_OPEN).
+ */
conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
- if (!conn) {
+ if (!conn ||
+ (conn->role == HCI_ROLE_MASTER && conn->state != BT_CONNECT)) {
/* In case of error status and there is no connection pending
* just unlock as there is nothing to cleanup.
*/
@@ -5638,8 +5648,18 @@ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
*/
hci_dev_clear_flag(hdev, HCI_LE_ADV);
- conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
- if (!conn) {
+ /* Check for existing connection:
+ *
+ * 1. If it doesn't exist then use the role to create a new object.
+ * 2. If it does exist confirm that it is connecting/BT_CONNECT in case
+ * of initiator/master role since there could be a collision where
+ * either side is attempting to connect or something like a fuzzing
+ * testing is trying to play tricks to destroy the hcon object before
+ * it even attempts to connect (e.g. hcon->state == BT_OPEN).
+ */
+ conn = hci_conn_hash_lookup_role(hdev, LE_LINK, role, bdaddr);
+ if (!conn ||
+ (conn->role == HCI_ROLE_MASTER && conn->state != BT_CONNECT)) {
/* In case of error status and there is no connection pending
* just unlock as there is nothing to cleanup.
*/
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 071/143] vhost: Take a reference on the task in struct vhost_task.
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 070/143] Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 072/143] Bluetooth: MGMT: Fix possible UAFs Greg Kroah-Hartman
` (83 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sean Christopherson,
Sebastian Andrzej Siewior, Michael S. Tsirkin, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
[ Upstream commit afe16653e05db07d658b55245c7a2e0603f136c0 ]
vhost_task_create() creates a task and keeps a reference to its
task_struct. That task may exit early via a signal and its task_struct
will be released.
A pending vhost_task_wake() will then attempt to wake the task and
access a task_struct which is no longer there.
Acquire a reference on the task_struct while creating the thread and
release the reference while the struct vhost_task itself is removed.
If the task exits early due to a signal, then the vhost_task_wake() will
still access a valid task_struct. The wake is safe and will be skipped
in this case.
Fixes: f9010dbdce911 ("fork, vhost: Use CLONE_THREAD to fix freezer/ps regression")
Reported-by: Sean Christopherson <seanjc@google.com>
Closes: https://lore.kernel.org/all/aKkLEtoDXKxAAWju@google.com/
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Message-Id: <20250918181144.Ygo8BZ-R@linutronix.de>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Tested-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/vhost_task.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/kernel/vhost_task.c b/kernel/vhost_task.c
index 2f844c279a3e0..7f24ccc896c64 100644
--- a/kernel/vhost_task.c
+++ b/kernel/vhost_task.c
@@ -100,6 +100,7 @@ void vhost_task_stop(struct vhost_task *vtsk)
* freeing it below.
*/
wait_for_completion(&vtsk->exited);
+ put_task_struct(vtsk->task);
kfree(vtsk);
}
EXPORT_SYMBOL_GPL(vhost_task_stop);
@@ -148,7 +149,7 @@ struct vhost_task *vhost_task_create(bool (*fn)(void *),
return ERR_PTR(PTR_ERR(tsk));
}
- vtsk->task = tsk;
+ vtsk->task = get_task_struct(tsk);
return vtsk;
}
EXPORT_SYMBOL_GPL(vhost_task_create);
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 072/143] Bluetooth: MGMT: Fix possible UAFs
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 071/143] vhost: Take a reference on the task in struct vhost_task Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 073/143] broadcom: fix support for PTP_PEROUT_DUTY_CYCLE Greg Kroah-Hartman
` (82 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, cen zhang, Luiz Augusto von Dentz,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit 302a1f674c00dd5581ab8e493ef44767c5101aab ]
This attemps to fix possible UAFs caused by struct mgmt_pending being
freed while still being processed like in the following trace, in order
to fix mgmt_pending_valid is introduce and use to check if the
mgmt_pending hasn't been removed from the pending list, on the complete
callbacks it is used to check and in addtion remove the cmd from the list
while holding mgmt_pending_lock to avoid TOCTOU problems since if the cmd
is left on the list it can still be accessed and freed.
BUG: KASAN: slab-use-after-free in mgmt_add_adv_patterns_monitor_sync+0x35/0x50 net/bluetooth/mgmt.c:5223
Read of size 8 at addr ffff8880709d4dc0 by task kworker/u11:0/55
CPU: 0 UID: 0 PID: 55 Comm: kworker/u11:0 Not tainted 6.16.4 #2 PREEMPT(full)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
Workqueue: hci0 hci_cmd_sync_work
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x240 mm/kasan/report.c:482
kasan_report+0x118/0x150 mm/kasan/report.c:595
mgmt_add_adv_patterns_monitor_sync+0x35/0x50 net/bluetooth/mgmt.c:5223
hci_cmd_sync_work+0x210/0x3a0 net/bluetooth/hci_sync.c:332
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3321
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
kthread+0x711/0x8a0 kernel/kthread.c:464
ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16.4/arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 12210:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4364
kmalloc_noprof include/linux/slab.h:905 [inline]
kzalloc_noprof include/linux/slab.h:1039 [inline]
mgmt_pending_new+0x65/0x1e0 net/bluetooth/mgmt_util.c:269
mgmt_pending_add+0x35/0x140 net/bluetooth/mgmt_util.c:296
__add_adv_patterns_monitor+0x130/0x200 net/bluetooth/mgmt.c:5247
add_adv_patterns_monitor+0x214/0x360 net/bluetooth/mgmt.c:5364
hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719
hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839
sock_sendmsg_nosec net/socket.c:714 [inline]
__sock_sendmsg+0x219/0x270 net/socket.c:729
sock_write_iter+0x258/0x330 net/socket.c:1133
new_sync_write fs/read_write.c:593 [inline]
vfs_write+0x5c9/0xb30 fs/read_write.c:686
ksys_write+0x145/0x250 fs/read_write.c:738
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 12221:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x62/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2381 [inline]
slab_free mm/slub.c:4648 [inline]
kfree+0x18e/0x440 mm/slub.c:4847
mgmt_pending_free net/bluetooth/mgmt_util.c:311 [inline]
mgmt_pending_foreach+0x30d/0x380 net/bluetooth/mgmt_util.c:257
__mgmt_power_off+0x169/0x350 net/bluetooth/mgmt.c:9444
hci_dev_close_sync+0x754/0x1330 net/bluetooth/hci_sync.c:5290
hci_dev_do_close net/bluetooth/hci_core.c:501 [inline]
hci_dev_close+0x108/0x200 net/bluetooth/hci_core.c:526
sock_do_ioctl+0xd9/0x300 net/socket.c:1192
sock_ioctl+0x576/0x790 net/socket.c:1313
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Fixes: cf75ad8b41d2 ("Bluetooth: hci_sync: Convert MGMT_SET_POWERED")
Fixes: 2bd1b237616b ("Bluetooth: hci_sync: Convert MGMT_OP_SET_DISCOVERABLE to use cmd_sync")
Fixes: f056a65783cc ("Bluetooth: hci_sync: Convert MGMT_OP_SET_CONNECTABLE to use cmd_sync")
Fixes: 3244845c6307 ("Bluetooth: hci_sync: Convert MGMT_OP_SSP")
Fixes: d81a494c43df ("Bluetooth: hci_sync: Convert MGMT_OP_SET_LE")
Fixes: b338d91703fa ("Bluetooth: Implement support for Mesh")
Fixes: 6f6ff38a1e14 ("Bluetooth: hci_sync: Convert MGMT_OP_SET_LOCAL_NAME")
Fixes: 71efbb08b538 ("Bluetooth: hci_sync: Convert MGMT_OP_SET_PHY_CONFIGURATION")
Fixes: b747a83690c8 ("Bluetooth: hci_sync: Refactor add Adv Monitor")
Fixes: abfeea476c68 ("Bluetooth: hci_sync: Convert MGMT_OP_START_DISCOVERY")
Fixes: 26ac4c56f03f ("Bluetooth: hci_sync: Convert MGMT_OP_SET_ADVERTISING")
Reported-by: cen zhang <zzzccc427@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/mgmt.c | 259 ++++++++++++++++++++++++++------------
net/bluetooth/mgmt_util.c | 46 +++++++
net/bluetooth/mgmt_util.h | 3 +
3 files changed, 231 insertions(+), 77 deletions(-)
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 50634ef5c8b70..225140fcb3d6c 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -1323,8 +1323,7 @@ static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err)
struct mgmt_mode *cp;
/* Make sure cmd still outstanding. */
- if (err == -ECANCELED ||
- cmd != pending_find(MGMT_OP_SET_POWERED, hdev))
+ if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
return;
cp = cmd->param;
@@ -1351,23 +1350,29 @@ static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err)
mgmt_status(err));
}
- mgmt_pending_remove(cmd);
+ mgmt_pending_free(cmd);
}
static int set_powered_sync(struct hci_dev *hdev, void *data)
{
struct mgmt_pending_cmd *cmd = data;
- struct mgmt_mode *cp;
+ struct mgmt_mode cp;
+
+ mutex_lock(&hdev->mgmt_pending_lock);
/* Make sure cmd still outstanding. */
- if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev))
+ if (!__mgmt_pending_listed(hdev, cmd)) {
+ mutex_unlock(&hdev->mgmt_pending_lock);
return -ECANCELED;
+ }
- cp = cmd->param;
+ memcpy(&cp, cmd->param, sizeof(cp));
+
+ mutex_unlock(&hdev->mgmt_pending_lock);
BT_DBG("%s", hdev->name);
- return hci_set_powered_sync(hdev, cp->val);
+ return hci_set_powered_sync(hdev, cp.val);
}
static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data,
@@ -1516,8 +1521,7 @@ static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data,
bt_dev_dbg(hdev, "err %d", err);
/* Make sure cmd still outstanding. */
- if (err == -ECANCELED ||
- cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev))
+ if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
return;
hci_dev_lock(hdev);
@@ -1539,12 +1543,15 @@ static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data,
new_settings(hdev, cmd->sk);
done:
- mgmt_pending_remove(cmd);
+ mgmt_pending_free(cmd);
hci_dev_unlock(hdev);
}
static int set_discoverable_sync(struct hci_dev *hdev, void *data)
{
+ if (!mgmt_pending_listed(hdev, data))
+ return -ECANCELED;
+
BT_DBG("%s", hdev->name);
return hci_update_discoverable_sync(hdev);
@@ -1691,8 +1698,7 @@ static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data,
bt_dev_dbg(hdev, "err %d", err);
/* Make sure cmd still outstanding. */
- if (err == -ECANCELED ||
- cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev))
+ if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
return;
hci_dev_lock(hdev);
@@ -1707,7 +1713,7 @@ static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data,
new_settings(hdev, cmd->sk);
done:
- mgmt_pending_remove(cmd);
+ mgmt_pending_free(cmd);
hci_dev_unlock(hdev);
}
@@ -1743,6 +1749,9 @@ static int set_connectable_update_settings(struct hci_dev *hdev,
static int set_connectable_sync(struct hci_dev *hdev, void *data)
{
+ if (!mgmt_pending_listed(hdev, data))
+ return -ECANCELED;
+
BT_DBG("%s", hdev->name);
return hci_update_connectable_sync(hdev);
@@ -1919,14 +1928,17 @@ static void set_ssp_complete(struct hci_dev *hdev, void *data, int err)
{
struct cmd_lookup match = { NULL, hdev };
struct mgmt_pending_cmd *cmd = data;
- struct mgmt_mode *cp = cmd->param;
- u8 enable = cp->val;
+ struct mgmt_mode *cp;
+ u8 enable;
bool changed;
/* Make sure cmd still outstanding. */
- if (err == -ECANCELED || cmd != pending_find(MGMT_OP_SET_SSP, hdev))
+ if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
return;
+ cp = cmd->param;
+ enable = cp->val;
+
if (err) {
u8 mgmt_err = mgmt_status(err);
@@ -1935,8 +1947,7 @@ static void set_ssp_complete(struct hci_dev *hdev, void *data, int err)
new_settings(hdev, NULL);
}
- mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, true,
- cmd_status_rsp, &mgmt_err);
+ mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err);
return;
}
@@ -1946,7 +1957,7 @@ static void set_ssp_complete(struct hci_dev *hdev, void *data, int err)
changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED);
}
- mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, true, settings_rsp, &match);
+ settings_rsp(cmd, &match);
if (changed)
new_settings(hdev, match.sk);
@@ -1960,14 +1971,25 @@ static void set_ssp_complete(struct hci_dev *hdev, void *data, int err)
static int set_ssp_sync(struct hci_dev *hdev, void *data)
{
struct mgmt_pending_cmd *cmd = data;
- struct mgmt_mode *cp = cmd->param;
+ struct mgmt_mode cp;
bool changed = false;
int err;
- if (cp->val)
+ mutex_lock(&hdev->mgmt_pending_lock);
+
+ if (!__mgmt_pending_listed(hdev, cmd)) {
+ mutex_unlock(&hdev->mgmt_pending_lock);
+ return -ECANCELED;
+ }
+
+ memcpy(&cp, cmd->param, sizeof(cp));
+
+ mutex_unlock(&hdev->mgmt_pending_lock);
+
+ if (cp.val)
changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED);
- err = hci_write_ssp_mode_sync(hdev, cp->val);
+ err = hci_write_ssp_mode_sync(hdev, cp.val);
if (!err && changed)
hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
@@ -2060,32 +2082,50 @@ static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
static void set_le_complete(struct hci_dev *hdev, void *data, int err)
{
+ struct mgmt_pending_cmd *cmd = data;
struct cmd_lookup match = { NULL, hdev };
u8 status = mgmt_status(err);
bt_dev_dbg(hdev, "err %d", err);
- if (status) {
- mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, true, cmd_status_rsp,
- &status);
+ if (err == -ECANCELED || !mgmt_pending_valid(hdev, data))
return;
+
+ if (status) {
+ mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, status);
+ goto done;
}
- mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, true, settings_rsp, &match);
+ settings_rsp(cmd, &match);
new_settings(hdev, match.sk);
if (match.sk)
sock_put(match.sk);
+
+done:
+ mgmt_pending_free(cmd);
}
static int set_le_sync(struct hci_dev *hdev, void *data)
{
struct mgmt_pending_cmd *cmd = data;
- struct mgmt_mode *cp = cmd->param;
- u8 val = !!cp->val;
+ struct mgmt_mode cp;
+ u8 val;
int err;
+ mutex_lock(&hdev->mgmt_pending_lock);
+
+ if (!__mgmt_pending_listed(hdev, cmd)) {
+ mutex_unlock(&hdev->mgmt_pending_lock);
+ return -ECANCELED;
+ }
+
+ memcpy(&cp, cmd->param, sizeof(cp));
+ val = !!cp.val;
+
+ mutex_unlock(&hdev->mgmt_pending_lock);
+
if (!val) {
hci_clear_adv_instance_sync(hdev, NULL, 0x00, true);
@@ -2127,7 +2167,12 @@ static void set_mesh_complete(struct hci_dev *hdev, void *data, int err)
{
struct mgmt_pending_cmd *cmd = data;
u8 status = mgmt_status(err);
- struct sock *sk = cmd->sk;
+ struct sock *sk;
+
+ if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
+ return;
+
+ sk = cmd->sk;
if (status) {
mgmt_pending_foreach(MGMT_OP_SET_MESH_RECEIVER, hdev, true,
@@ -2142,24 +2187,37 @@ static void set_mesh_complete(struct hci_dev *hdev, void *data, int err)
static int set_mesh_sync(struct hci_dev *hdev, void *data)
{
struct mgmt_pending_cmd *cmd = data;
- struct mgmt_cp_set_mesh *cp = cmd->param;
- size_t len = cmd->param_len;
+ struct mgmt_cp_set_mesh cp;
+ size_t len;
+
+ mutex_lock(&hdev->mgmt_pending_lock);
+
+ if (!__mgmt_pending_listed(hdev, cmd)) {
+ mutex_unlock(&hdev->mgmt_pending_lock);
+ return -ECANCELED;
+ }
+
+ memcpy(&cp, cmd->param, sizeof(cp));
+
+ mutex_unlock(&hdev->mgmt_pending_lock);
+
+ len = cmd->param_len;
memset(hdev->mesh_ad_types, 0, sizeof(hdev->mesh_ad_types));
- if (cp->enable)
+ if (cp.enable)
hci_dev_set_flag(hdev, HCI_MESH);
else
hci_dev_clear_flag(hdev, HCI_MESH);
- hdev->le_scan_interval = __le16_to_cpu(cp->period);
- hdev->le_scan_window = __le16_to_cpu(cp->window);
+ hdev->le_scan_interval = __le16_to_cpu(cp.period);
+ hdev->le_scan_window = __le16_to_cpu(cp.window);
- len -= sizeof(*cp);
+ len -= sizeof(cp);
/* If filters don't fit, forward all adv pkts */
if (len <= sizeof(hdev->mesh_ad_types))
- memcpy(hdev->mesh_ad_types, cp->ad_types, len);
+ memcpy(hdev->mesh_ad_types, cp.ad_types, len);
hci_update_passive_scan_sync(hdev);
return 0;
@@ -3867,15 +3925,16 @@ static int name_changed_sync(struct hci_dev *hdev, void *data)
static void set_name_complete(struct hci_dev *hdev, void *data, int err)
{
struct mgmt_pending_cmd *cmd = data;
- struct mgmt_cp_set_local_name *cp = cmd->param;
+ struct mgmt_cp_set_local_name *cp;
u8 status = mgmt_status(err);
bt_dev_dbg(hdev, "err %d", err);
- if (err == -ECANCELED ||
- cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev))
+ if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
return;
+ cp = cmd->param;
+
if (status) {
mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME,
status);
@@ -3887,16 +3946,27 @@ static void set_name_complete(struct hci_dev *hdev, void *data, int err)
hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL);
}
- mgmt_pending_remove(cmd);
+ mgmt_pending_free(cmd);
}
static int set_name_sync(struct hci_dev *hdev, void *data)
{
struct mgmt_pending_cmd *cmd = data;
- struct mgmt_cp_set_local_name *cp = cmd->param;
+ struct mgmt_cp_set_local_name cp;
+
+ mutex_lock(&hdev->mgmt_pending_lock);
+
+ if (!__mgmt_pending_listed(hdev, cmd)) {
+ mutex_unlock(&hdev->mgmt_pending_lock);
+ return -ECANCELED;
+ }
+
+ memcpy(&cp, cmd->param, sizeof(cp));
+
+ mutex_unlock(&hdev->mgmt_pending_lock);
if (lmp_bredr_capable(hdev)) {
- hci_update_name_sync(hdev, cp->name);
+ hci_update_name_sync(hdev, cp.name);
hci_update_eir_sync(hdev);
}
@@ -4048,12 +4118,10 @@ int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip)
static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err)
{
struct mgmt_pending_cmd *cmd = data;
- struct sk_buff *skb = cmd->skb;
+ struct sk_buff *skb;
u8 status = mgmt_status(err);
- if (err == -ECANCELED ||
- cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev))
- return;
+ skb = cmd->skb;
if (!status) {
if (!skb)
@@ -4080,7 +4148,7 @@ static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err)
if (skb && !IS_ERR(skb))
kfree_skb(skb);
- mgmt_pending_remove(cmd);
+ mgmt_pending_free(cmd);
}
static int set_default_phy_sync(struct hci_dev *hdev, void *data)
@@ -4088,7 +4156,9 @@ static int set_default_phy_sync(struct hci_dev *hdev, void *data)
struct mgmt_pending_cmd *cmd = data;
struct mgmt_cp_set_phy_configuration *cp = cmd->param;
struct hci_cp_le_set_default_phy cp_phy;
- u32 selected_phys = __le32_to_cpu(cp->selected_phys);
+ u32 selected_phys;
+
+ selected_phys = __le32_to_cpu(cp->selected_phys);
memset(&cp_phy, 0, sizeof(cp_phy));
@@ -4228,7 +4298,7 @@ static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev,
goto unlock;
}
- cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
+ cmd = mgmt_pending_new(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data,
len);
if (!cmd)
err = -ENOMEM;
@@ -5189,7 +5259,17 @@ static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev,
{
struct mgmt_rp_add_adv_patterns_monitor rp;
struct mgmt_pending_cmd *cmd = data;
- struct adv_monitor *monitor = cmd->user_data;
+ struct adv_monitor *monitor;
+
+ /* This is likely the result of hdev being closed and mgmt_index_removed
+ * is attempting to clean up any pending command so
+ * hci_adv_monitors_clear is about to be called which will take care of
+ * freeing the adv_monitor instances.
+ */
+ if (status == -ECANCELED && !mgmt_pending_valid(hdev, cmd))
+ return;
+
+ monitor = cmd->user_data;
hci_dev_lock(hdev);
@@ -5215,9 +5295,20 @@ static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev,
static int mgmt_add_adv_patterns_monitor_sync(struct hci_dev *hdev, void *data)
{
struct mgmt_pending_cmd *cmd = data;
- struct adv_monitor *monitor = cmd->user_data;
+ struct adv_monitor *mon;
+
+ mutex_lock(&hdev->mgmt_pending_lock);
+
+ if (!__mgmt_pending_listed(hdev, cmd)) {
+ mutex_unlock(&hdev->mgmt_pending_lock);
+ return -ECANCELED;
+ }
+
+ mon = cmd->user_data;
+
+ mutex_unlock(&hdev->mgmt_pending_lock);
- return hci_add_adv_monitor(hdev, monitor);
+ return hci_add_adv_monitor(hdev, mon);
}
static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
@@ -5484,7 +5575,8 @@ static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
status);
}
-static void read_local_oob_data_complete(struct hci_dev *hdev, void *data, int err)
+static void read_local_oob_data_complete(struct hci_dev *hdev, void *data,
+ int err)
{
struct mgmt_rp_read_local_oob_data mgmt_rp;
size_t rp_size = sizeof(mgmt_rp);
@@ -5504,7 +5596,8 @@ static void read_local_oob_data_complete(struct hci_dev *hdev, void *data, int e
bt_dev_dbg(hdev, "status %d", status);
if (status) {
- mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, status);
+ mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA,
+ status);
goto remove;
}
@@ -5786,17 +5879,12 @@ static void start_discovery_complete(struct hci_dev *hdev, void *data, int err)
bt_dev_dbg(hdev, "err %d", err);
- if (err == -ECANCELED)
- return;
-
- if (cmd != pending_find(MGMT_OP_START_DISCOVERY, hdev) &&
- cmd != pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev) &&
- cmd != pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev))
+ if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
return;
mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_status(err),
cmd->param, 1);
- mgmt_pending_remove(cmd);
+ mgmt_pending_free(cmd);
hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED:
DISCOVERY_FINDING);
@@ -5804,6 +5892,9 @@ static void start_discovery_complete(struct hci_dev *hdev, void *data, int err)
static int start_discovery_sync(struct hci_dev *hdev, void *data)
{
+ if (!mgmt_pending_listed(hdev, data))
+ return -ECANCELED;
+
return hci_start_discovery_sync(hdev);
}
@@ -6009,15 +6100,14 @@ static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err)
{
struct mgmt_pending_cmd *cmd = data;
- if (err == -ECANCELED ||
- cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev))
+ if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd))
return;
bt_dev_dbg(hdev, "err %d", err);
mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_status(err),
cmd->param, 1);
- mgmt_pending_remove(cmd);
+ mgmt_pending_free(cmd);
if (!err)
hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
@@ -6025,6 +6115,9 @@ static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err)
static int stop_discovery_sync(struct hci_dev *hdev, void *data)
{
+ if (!mgmt_pending_listed(hdev, data))
+ return -ECANCELED;
+
return hci_stop_discovery_sync(hdev);
}
@@ -6234,14 +6327,18 @@ static void enable_advertising_instance(struct hci_dev *hdev, int err)
static void set_advertising_complete(struct hci_dev *hdev, void *data, int err)
{
+ struct mgmt_pending_cmd *cmd = data;
struct cmd_lookup match = { NULL, hdev };
u8 instance;
struct adv_info *adv_instance;
u8 status = mgmt_status(err);
+ if (err == -ECANCELED || !mgmt_pending_valid(hdev, data))
+ return;
+
if (status) {
- mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, true,
- cmd_status_rsp, &status);
+ mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, status);
+ mgmt_pending_free(cmd);
return;
}
@@ -6250,8 +6347,7 @@ static void set_advertising_complete(struct hci_dev *hdev, void *data, int err)
else
hci_dev_clear_flag(hdev, HCI_ADVERTISING);
- mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, true, settings_rsp,
- &match);
+ settings_rsp(cmd, &match);
new_settings(hdev, match.sk);
@@ -6283,10 +6379,23 @@ static void set_advertising_complete(struct hci_dev *hdev, void *data, int err)
static int set_adv_sync(struct hci_dev *hdev, void *data)
{
struct mgmt_pending_cmd *cmd = data;
- struct mgmt_mode *cp = cmd->param;
- u8 val = !!cp->val;
+ struct mgmt_mode cp;
+ u8 val;
- if (cp->val == 0x02)
+ mutex_lock(&hdev->mgmt_pending_lock);
+
+ if (!__mgmt_pending_listed(hdev, cmd)) {
+ mutex_unlock(&hdev->mgmt_pending_lock);
+ return -ECANCELED;
+ }
+
+ memcpy(&cp, cmd->param, sizeof(cp));
+
+ mutex_unlock(&hdev->mgmt_pending_lock);
+
+ val = !!cp.val;
+
+ if (cp.val == 0x02)
hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
else
hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE);
@@ -8039,10 +8148,6 @@ static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data,
u8 status = mgmt_status(err);
u16 eir_len;
- if (err == -ECANCELED ||
- cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev))
- return;
-
if (!status) {
if (!skb)
status = MGMT_STATUS_FAILED;
@@ -8149,7 +8254,7 @@ static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data,
kfree_skb(skb);
kfree(mgmt_rp);
- mgmt_pending_remove(cmd);
+ mgmt_pending_free(cmd);
}
static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
@@ -8158,7 +8263,7 @@ static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk,
struct mgmt_pending_cmd *cmd;
int err;
- cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
+ cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev,
cp, sizeof(*cp));
if (!cmd)
return -ENOMEM;
diff --git a/net/bluetooth/mgmt_util.c b/net/bluetooth/mgmt_util.c
index a88a07da39473..aa7b5585cb268 100644
--- a/net/bluetooth/mgmt_util.c
+++ b/net/bluetooth/mgmt_util.c
@@ -320,6 +320,52 @@ void mgmt_pending_remove(struct mgmt_pending_cmd *cmd)
mgmt_pending_free(cmd);
}
+bool __mgmt_pending_listed(struct hci_dev *hdev, struct mgmt_pending_cmd *cmd)
+{
+ struct mgmt_pending_cmd *tmp;
+
+ lockdep_assert_held(&hdev->mgmt_pending_lock);
+
+ if (!cmd)
+ return false;
+
+ list_for_each_entry(tmp, &hdev->mgmt_pending, list) {
+ if (cmd == tmp)
+ return true;
+ }
+
+ return false;
+}
+
+bool mgmt_pending_listed(struct hci_dev *hdev, struct mgmt_pending_cmd *cmd)
+{
+ bool listed;
+
+ mutex_lock(&hdev->mgmt_pending_lock);
+ listed = __mgmt_pending_listed(hdev, cmd);
+ mutex_unlock(&hdev->mgmt_pending_lock);
+
+ return listed;
+}
+
+bool mgmt_pending_valid(struct hci_dev *hdev, struct mgmt_pending_cmd *cmd)
+{
+ bool listed;
+
+ if (!cmd)
+ return false;
+
+ mutex_lock(&hdev->mgmt_pending_lock);
+
+ listed = __mgmt_pending_listed(hdev, cmd);
+ if (listed)
+ list_del(&cmd->list);
+
+ mutex_unlock(&hdev->mgmt_pending_lock);
+
+ return listed;
+}
+
void mgmt_mesh_foreach(struct hci_dev *hdev,
void (*cb)(struct mgmt_mesh_tx *mesh_tx, void *data),
void *data, struct sock *sk)
diff --git a/net/bluetooth/mgmt_util.h b/net/bluetooth/mgmt_util.h
index 024e51dd69375..bcba8c9d89528 100644
--- a/net/bluetooth/mgmt_util.h
+++ b/net/bluetooth/mgmt_util.h
@@ -65,6 +65,9 @@ struct mgmt_pending_cmd *mgmt_pending_new(struct sock *sk, u16 opcode,
void *data, u16 len);
void mgmt_pending_free(struct mgmt_pending_cmd *cmd);
void mgmt_pending_remove(struct mgmt_pending_cmd *cmd);
+bool __mgmt_pending_listed(struct hci_dev *hdev, struct mgmt_pending_cmd *cmd);
+bool mgmt_pending_listed(struct hci_dev *hdev, struct mgmt_pending_cmd *cmd);
+bool mgmt_pending_valid(struct hci_dev *hdev, struct mgmt_pending_cmd *cmd);
void mgmt_mesh_foreach(struct hci_dev *hdev,
void (*cb)(struct mgmt_mesh_tx *mesh_tx, void *data),
void *data, struct sock *sk);
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 073/143] broadcom: fix support for PTP_PEROUT_DUTY_CYCLE
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 072/143] Bluetooth: MGMT: Fix possible UAFs Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 074/143] broadcom: fix support for PTP_EXTTS_REQUEST2 ioctl Greg Kroah-Hartman
` (81 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, James Clark, Jacob Keller,
Vadim Fedorenko, Richard Cochran, Kory Maincent, Jakub Kicinski,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Keller <jacob.e.keller@intel.com>
[ Upstream commit 6e6c88d85623dc0c5c3faf185c12bd723efde5ee ]
The bcm_ptp_perout_locked() function has support for handling
PTP_PEROUT_DUTY_CYCLE, but its not listed in the supported_perout_flags.
Attempts to use the duty cycle support will be rejected since commit
d9f3e9ecc456 ("net: ptp: introduce .supported_perout_flags to
ptp_clock_info"), as this flag accidentally missed while doing the
conversion.
Drop the unnecessary supported flags check from the bcm_ptp_perout_locked()
function and correctly set the supported_perout_flags. This fixes use of
the PTP_PEROUT_DUTY_CYCLE support for the broadcom driver.
Reported-by: James Clark <jjc@jclark.com>
Fixes: d9f3e9ecc456 ("net: ptp: introduce .supported_perout_flags to ptp_clock_info")
Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Acked-by: Richard Cochran <richardcochran@gmail.com>
Reviewed-by: Kory Maincent <kory.maincent@bootlin.com>
Tested-by: James Clark <jjc@jclark.com>
Link: https://patch.msgid.link/20250918-jk-fix-bcm-phy-supported-flags-v1-1-747b60407c9c@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/phy/bcm-phy-ptp.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/drivers/net/phy/bcm-phy-ptp.c b/drivers/net/phy/bcm-phy-ptp.c
index eba8b5fb1365f..1cf695ac73cc5 100644
--- a/drivers/net/phy/bcm-phy-ptp.c
+++ b/drivers/net/phy/bcm-phy-ptp.c
@@ -597,10 +597,6 @@ static int bcm_ptp_perout_locked(struct bcm_ptp_private *priv,
period = BCM_MAX_PERIOD_8NS; /* write nonzero value */
- /* Reject unsupported flags */
- if (req->flags & ~PTP_PEROUT_DUTY_CYCLE)
- return -EOPNOTSUPP;
-
if (req->flags & PTP_PEROUT_DUTY_CYCLE)
pulse = ktime_to_ns(ktime_set(req->on.sec, req->on.nsec));
else
@@ -741,6 +737,7 @@ static const struct ptp_clock_info bcm_ptp_clock_info = {
.n_pins = 1,
.n_per_out = 1,
.n_ext_ts = 1,
+ .supported_perout_flags = PTP_PEROUT_DUTY_CYCLE,
};
static void bcm_ptp_txtstamp(struct mii_timestamper *mii_ts,
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 074/143] broadcom: fix support for PTP_EXTTS_REQUEST2 ioctl
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 073/143] broadcom: fix support for PTP_PEROUT_DUTY_CYCLE Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 075/143] bnxt_en: correct offset handling for IPv6 destination address Greg Kroah-Hartman
` (80 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, James Clark, Jacob Keller,
Vadim Fedorenko, Richard Cochran, Kory Maincent, Jakub Kicinski,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Keller <jacob.e.keller@intel.com>
[ Upstream commit 3200fdd4021de1d182fa3b6db5ad936d519f3848 ]
Commit 7c571ac57d9d ("net: ptp: introduce .supported_extts_flags to
ptp_clock_info") modified the PTP core kernel logic to validate the
supported flags for the PTP_EXTTS_REQUEST ioctls, rather than relying on
each individual driver correctly checking its flags.
The bcm_ptp_enable() function implements support for PTP_CLK_REQ_EXTTS, but
does not check the flags, and does not forward the request structure into
bcm_ptp_extts_locked().
When originally converting the bcm-phy-ptp.c code, it was unclear what
edges the hardware actually timestamped. Thus, no flags were initialized in
the .supported_extts_flags field. This results in the kernel automatically
rejecting all userspace requests for the PTP_EXTTS_REQUEST2 ioctl.
This occurs because the PTP_STRICT_FLAGS is always assumed when operating
under PTP_EXTTS_REQUEST2. This has been the case since the flags
introduction by commit 6138e687c7b6 ("ptp: Introduce strict checking of
external time stamp options.").
The bcm-phy-ptp.c logic never properly supported strict flag validation,
as it previously ignored all flags including both PTP_STRICT_FLAGS and the
PTP_FALLING_EDGE and PTP_RISING_EDGE flags.
Reports from users in the field prove that the hardware timestamps the
rising edge. Encode this in the .supported_extts_flags field. This
re-enables support for the PTP_EXTTS_REQUEST2 ioctl.
Reported-by: James Clark <jjc@jclark.com>
Fixes: 7c571ac57d9d ("net: ptp: introduce .supported_extts_flags to ptp_clock_info")
Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Acked-by: Richard Cochran <richardcochran@gmail.com>
Reviewed-by: Kory Maincent <kory.maincent@bootlin.com>
Tested-by: James Clark <jjc@jclark.com>
Link: https://patch.msgid.link/20250918-jk-fix-bcm-phy-supported-flags-v1-2-747b60407c9c@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/phy/bcm-phy-ptp.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/phy/bcm-phy-ptp.c b/drivers/net/phy/bcm-phy-ptp.c
index 1cf695ac73cc5..d3501f8487d96 100644
--- a/drivers/net/phy/bcm-phy-ptp.c
+++ b/drivers/net/phy/bcm-phy-ptp.c
@@ -738,6 +738,7 @@ static const struct ptp_clock_info bcm_ptp_clock_info = {
.n_per_out = 1,
.n_ext_ts = 1,
.supported_perout_flags = PTP_PEROUT_DUTY_CYCLE,
+ .supported_extts_flags = PTP_STRICT_FLAGS | PTP_RISING_EDGE,
};
static void bcm_ptp_txtstamp(struct mii_timestamper *mii_ts,
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 075/143] bnxt_en: correct offset handling for IPv6 destination address
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 074/143] broadcom: fix support for PTP_EXTTS_REQUEST2 ioctl Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 076/143] net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS Greg Kroah-Hartman
` (79 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alok Tiwari, Somnath Kotur,
Jakub Kicinski, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <alok.a.tiwari@oracle.com>
[ Upstream commit 3d3aa9472c6dd0704e9961ed4769caac5b1c8d52 ]
In bnxt_tc_parse_pedit(), the code incorrectly writes IPv6
destination values to the source address field (saddr) when
processing pedit offsets within the destination address range.
This patch corrects the assignment to use daddr instead of saddr,
ensuring that pedit operations on IPv6 destination addresses are
applied correctly.
Fixes: 9b9eb518e338 ("bnxt_en: Add support for NAT(L3/L4 rewrite)")
Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Reviewed-by: Somnath Kotur <somnath.kotur@broadcom.com>
Link: https://patch.msgid.link/20250920121157.351921-1-alok.a.tiwari@oracle.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
index d2ca90407cce7..8057350236c5e 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c
@@ -244,7 +244,7 @@ bnxt_tc_parse_pedit(struct bnxt *bp, struct bnxt_tc_actions *actions,
offset < offset_of_ip6_daddr + 16) {
actions->nat.src_xlate = false;
idx = (offset - offset_of_ip6_daddr) / 4;
- actions->nat.l3.ipv6.saddr.s6_addr32[idx] = htonl(val);
+ actions->nat.l3.ipv6.daddr.s6_addr32[idx] = htonl(val);
} else {
netdev_err(bp->dev,
"%s: IPv6_hdr: Invalid pedit field\n",
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 076/143] net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 075/143] bnxt_en: correct offset handling for IPv6 destination address Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 077/143] nexthop: Forbid FDB status change while nexthop is in a group Greg Kroah-Hartman
` (78 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jason Baron, Eric Dumazet,
Jakub Kicinski, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Baron <jbaron@akamai.com>
[ Upstream commit ca9f9cdc4de97d0221100b11224738416696163c ]
Currently, alloc_skb_with_frags() will only fill (MAX_SKB_FRAGS - 1)
slots. I think it should use all MAX_SKB_FRAGS slots, as callers of
alloc_skb_with_frags() will size their allocation of frags based
on MAX_SKB_FRAGS.
This issue was discovered via a test patch that sets 'order' to 0
in alloc_skb_with_frags(), which effectively tests/simulates high
fragmentation. In this case sendmsg() on unix sockets will fail every
time for large allocations. If the PAGE_SIZE is 4K, then data_len will
request 68K or 17 pages, but alloc_skb_with_frags() can only allocate
64K in this case or 16 pages.
Fixes: 09c2c90705bb ("net: allow alloc_skb_with_frags() to allocate bigger packets")
Signed-off-by: Jason Baron <jbaron@akamai.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20250922191957.2855612-1-jbaron@akamai.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/skbuff.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index d6420b74ea9c6..cb77bb84371bd 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -6667,7 +6667,7 @@ struct sk_buff *alloc_skb_with_frags(unsigned long header_len,
return NULL;
while (data_len) {
- if (nr_frags == MAX_SKB_FRAGS - 1)
+ if (nr_frags == MAX_SKB_FRAGS)
goto failure;
while (order && PAGE_ALIGN(data_len) < (PAGE_SIZE << order))
order--;
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 077/143] nexthop: Forbid FDB status change while nexthop is in a group
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 076/143] net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 078/143] selftests: fib_nexthops: Fix creation of non-FDB nexthops Greg Kroah-Hartman
` (77 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+6596516dd2b635ba2350,
Ido Schimmel, David Ahern, Jakub Kicinski, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <idosch@nvidia.com>
[ Upstream commit 390b3a300d7872cef9588f003b204398be69ce08 ]
The kernel forbids the creation of non-FDB nexthop groups with FDB
nexthops:
# ip nexthop add id 1 via 192.0.2.1 fdb
# ip nexthop add id 2 group 1
Error: Non FDB nexthop group cannot have fdb nexthops.
And vice versa:
# ip nexthop add id 3 via 192.0.2.2 dev dummy1
# ip nexthop add id 4 group 3 fdb
Error: FDB nexthop group can only have fdb nexthops.
However, as long as no routes are pointing to a non-FDB nexthop group,
the kernel allows changing the type of a nexthop from FDB to non-FDB and
vice versa:
# ip nexthop add id 5 via 192.0.2.2 dev dummy1
# ip nexthop add id 6 group 5
# ip nexthop replace id 5 via 192.0.2.2 fdb
# echo $?
0
This configuration is invalid and can result in a NPD [1] since FDB
nexthops are not associated with a nexthop device:
# ip route add 198.51.100.1/32 nhid 6
# ping 198.51.100.1
Fix by preventing nexthop FDB status change while the nexthop is in a
group:
# ip nexthop add id 7 via 192.0.2.2 dev dummy1
# ip nexthop add id 8 group 7
# ip nexthop replace id 7 via 192.0.2.2 fdb
Error: Cannot change nexthop FDB status while in a group.
[1]
BUG: kernel NULL pointer dereference, address: 00000000000003c0
[...]
Oops: Oops: 0000 [#1] SMP
CPU: 6 UID: 0 PID: 367 Comm: ping Not tainted 6.17.0-rc6-virtme-gb65678cacc03 #1 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014
RIP: 0010:fib_lookup_good_nhc+0x1e/0x80
[...]
Call Trace:
<TASK>
fib_table_lookup+0x541/0x650
ip_route_output_key_hash_rcu+0x2ea/0x970
ip_route_output_key_hash+0x55/0x80
__ip4_datagram_connect+0x250/0x330
udp_connect+0x2b/0x60
__sys_connect+0x9c/0xd0
__x64_sys_connect+0x18/0x20
do_syscall_64+0xa4/0x2a0
entry_SYSCALL_64_after_hwframe+0x4b/0x53
Fixes: 38428d68719c ("nexthop: support for fdb ecmp nexthops")
Reported-by: syzbot+6596516dd2b635ba2350@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/68c9a4d2.050a0220.3c6139.0e63.GAE@google.com/
Tested-by: syzbot+6596516dd2b635ba2350@syzkaller.appspotmail.com
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20250921150824.149157-2-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/nexthop.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c
index 4397e89d3123a..423f876d14c6a 100644
--- a/net/ipv4/nexthop.c
+++ b/net/ipv4/nexthop.c
@@ -2400,6 +2400,13 @@ static int replace_nexthop_single(struct net *net, struct nexthop *old,
return -EINVAL;
}
+ if (!list_empty(&old->grp_list) &&
+ rtnl_dereference(new->nh_info)->fdb_nh !=
+ rtnl_dereference(old->nh_info)->fdb_nh) {
+ NL_SET_ERR_MSG(extack, "Cannot change nexthop FDB status while in a group");
+ return -EINVAL;
+ }
+
err = call_nexthop_notifiers(net, NEXTHOP_EVENT_REPLACE, new, extack);
if (err)
return err;
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 078/143] selftests: fib_nexthops: Fix creation of non-FDB nexthops
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 077/143] nexthop: Forbid FDB status change while nexthop is in a group Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 079/143] net/mlx5: fs, fix UAF in flow counter release Greg Kroah-Hartman
` (76 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ido Schimmel, David Ahern,
Jakub Kicinski, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <idosch@nvidia.com>
[ Upstream commit c29913109c70383cdf90b6fc792353e1009f24f5 ]
The test creates non-FDB nexthops without a nexthop device which leads
to the expected failure, but for the wrong reason:
# ./fib_nexthops.sh -t "ipv6_fdb_grp_fcnal ipv4_fdb_grp_fcnal" -v
IPv6 fdb groups functional
--------------------------
[...]
COMMAND: ip -netns me-nRsN3E nexthop add id 63 via 2001:db8:91::4
Error: Device attribute required for non-blackhole and non-fdb nexthops.
COMMAND: ip -netns me-nRsN3E nexthop add id 64 via 2001:db8:91::5
Error: Device attribute required for non-blackhole and non-fdb nexthops.
COMMAND: ip -netns me-nRsN3E nexthop add id 103 group 63/64 fdb
Error: Invalid nexthop id.
TEST: Fdb Nexthop group with non-fdb nexthops [ OK ]
[...]
IPv4 fdb groups functional
--------------------------
[...]
COMMAND: ip -netns me-nRsN3E nexthop add id 14 via 172.16.1.2
Error: Device attribute required for non-blackhole and non-fdb nexthops.
COMMAND: ip -netns me-nRsN3E nexthop add id 15 via 172.16.1.3
Error: Device attribute required for non-blackhole and non-fdb nexthops.
COMMAND: ip -netns me-nRsN3E nexthop add id 103 group 14/15 fdb
Error: Invalid nexthop id.
TEST: Fdb Nexthop group with non-fdb nexthops [ OK ]
COMMAND: ip -netns me-nRsN3E nexthop add id 16 via 172.16.1.2 fdb
COMMAND: ip -netns me-nRsN3E nexthop add id 17 via 172.16.1.3 fdb
COMMAND: ip -netns me-nRsN3E nexthop add id 104 group 14/15
Error: Invalid nexthop id.
TEST: Non-Fdb Nexthop group with fdb nexthops [ OK ]
[...]
COMMAND: ip -netns me-0dlhyd ro add 172.16.0.0/22 nhid 15
Error: Nexthop id does not exist.
TEST: Route add with fdb nexthop [ OK ]
In addition, as can be seen in the above output, a couple of IPv4 test
cases used the non-FDB nexthops (14 and 15) when they intended to use
the FDB nexthops (16 and 17). These test cases only passed because
failure was expected, but they failed for the wrong reason.
Fix the test to create the non-FDB nexthops with a nexthop device and
adjust the IPv4 test cases to use the FDB nexthops instead of the
non-FDB nexthops.
Output after the fix:
# ./fib_nexthops.sh -t "ipv6_fdb_grp_fcnal ipv4_fdb_grp_fcnal" -v
IPv6 fdb groups functional
--------------------------
[...]
COMMAND: ip -netns me-lNzfHP nexthop add id 63 via 2001:db8:91::4 dev veth1
COMMAND: ip -netns me-lNzfHP nexthop add id 64 via 2001:db8:91::5 dev veth1
COMMAND: ip -netns me-lNzfHP nexthop add id 103 group 63/64 fdb
Error: FDB nexthop group can only have fdb nexthops.
TEST: Fdb Nexthop group with non-fdb nexthops [ OK ]
[...]
IPv4 fdb groups functional
--------------------------
[...]
COMMAND: ip -netns me-lNzfHP nexthop add id 14 via 172.16.1.2 dev veth1
COMMAND: ip -netns me-lNzfHP nexthop add id 15 via 172.16.1.3 dev veth1
COMMAND: ip -netns me-lNzfHP nexthop add id 103 group 14/15 fdb
Error: FDB nexthop group can only have fdb nexthops.
TEST: Fdb Nexthop group with non-fdb nexthops [ OK ]
COMMAND: ip -netns me-lNzfHP nexthop add id 16 via 172.16.1.2 fdb
COMMAND: ip -netns me-lNzfHP nexthop add id 17 via 172.16.1.3 fdb
COMMAND: ip -netns me-lNzfHP nexthop add id 104 group 16/17
Error: Non FDB nexthop group cannot have fdb nexthops.
TEST: Non-Fdb Nexthop group with fdb nexthops [ OK ]
[...]
COMMAND: ip -netns me-lNzfHP ro add 172.16.0.0/22 nhid 16
Error: Route cannot point to a fdb nexthop.
TEST: Route add with fdb nexthop [ OK ]
[...]
Tests passed: 30
Tests failed: 0
Tests skipped: 0
Fixes: 0534c5489c11 ("selftests: net: add fdb nexthop tests")
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20250921150824.149157-3-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/net/fib_nexthops.sh | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/tools/testing/selftests/net/fib_nexthops.sh b/tools/testing/selftests/net/fib_nexthops.sh
index b39f748c25722..2ac394c99d018 100755
--- a/tools/testing/selftests/net/fib_nexthops.sh
+++ b/tools/testing/selftests/net/fib_nexthops.sh
@@ -467,8 +467,8 @@ ipv6_fdb_grp_fcnal()
log_test $? 0 "Get Fdb nexthop group by id"
# fdb nexthop group can only contain fdb nexthops
- run_cmd "$IP nexthop add id 63 via 2001:db8:91::4"
- run_cmd "$IP nexthop add id 64 via 2001:db8:91::5"
+ run_cmd "$IP nexthop add id 63 via 2001:db8:91::4 dev veth1"
+ run_cmd "$IP nexthop add id 64 via 2001:db8:91::5 dev veth1"
run_cmd "$IP nexthop add id 103 group 63/64 fdb"
log_test $? 2 "Fdb Nexthop group with non-fdb nexthops"
@@ -547,15 +547,15 @@ ipv4_fdb_grp_fcnal()
log_test $? 0 "Get Fdb nexthop group by id"
# fdb nexthop group can only contain fdb nexthops
- run_cmd "$IP nexthop add id 14 via 172.16.1.2"
- run_cmd "$IP nexthop add id 15 via 172.16.1.3"
+ run_cmd "$IP nexthop add id 14 via 172.16.1.2 dev veth1"
+ run_cmd "$IP nexthop add id 15 via 172.16.1.3 dev veth1"
run_cmd "$IP nexthop add id 103 group 14/15 fdb"
log_test $? 2 "Fdb Nexthop group with non-fdb nexthops"
# Non fdb nexthop group can not contain fdb nexthops
run_cmd "$IP nexthop add id 16 via 172.16.1.2 fdb"
run_cmd "$IP nexthop add id 17 via 172.16.1.3 fdb"
- run_cmd "$IP nexthop add id 104 group 14/15"
+ run_cmd "$IP nexthop add id 104 group 16/17"
log_test $? 2 "Non-Fdb Nexthop group with fdb nexthops"
# fdb nexthop cannot have blackhole
@@ -582,7 +582,7 @@ ipv4_fdb_grp_fcnal()
run_cmd "$BRIDGE fdb add 02:02:00:00:00:14 dev vx10 nhid 12 self"
log_test $? 255 "Fdb mac add with nexthop"
- run_cmd "$IP ro add 172.16.0.0/22 nhid 15"
+ run_cmd "$IP ro add 172.16.0.0/22 nhid 16"
log_test $? 2 "Route add with fdb nexthop"
run_cmd "$IP ro add 172.16.0.0/22 nhid 103"
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 079/143] net/mlx5: fs, fix UAF in flow counter release
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 078/143] selftests: fib_nexthops: Fix creation of non-FDB nexthops Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 080/143] net/mlx5: HWS, remove unused create_dest_array parameter Greg Kroah-Hartman
` (75 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Moshe Shemesh, Yevgeny Kliteynik,
Mark Bloch, Tariq Toukan, Jakub Kicinski, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Moshe Shemesh <moshe@nvidia.com>
[ Upstream commit 6043819e707cefb1c9e59d6e431dcfa735c4f975 ]
Fix a kernel trace [1] caused by releasing an HWS action of a local flow
counter in mlx5_cmd_hws_delete_fte(), where the HWS action refcount and
mutex were not initialized and the counter struct could already be freed
when deleting the rule.
Fix it by adding the missing initializations and adding refcount for the
local flow counter struct.
[1] Kernel log:
Call Trace:
<TASK>
dump_stack_lvl+0x34/0x48
mlx5_fs_put_hws_action.part.0.cold+0x21/0x94 [mlx5_core]
mlx5_fc_put_hws_action+0x96/0xad [mlx5_core]
mlx5_fs_destroy_fs_actions+0x8b/0x152 [mlx5_core]
mlx5_cmd_hws_delete_fte+0x5a/0xa0 [mlx5_core]
del_hw_fte+0x1ce/0x260 [mlx5_core]
mlx5_del_flow_rules+0x12d/0x240 [mlx5_core]
? ttwu_queue_wakelist+0xf4/0x110
mlx5_ib_destroy_flow+0x103/0x1b0 [mlx5_ib]
uverbs_free_flow+0x20/0x50 [ib_uverbs]
destroy_hw_idr_uobject+0x1b/0x50 [ib_uverbs]
uverbs_destroy_uobject+0x34/0x1a0 [ib_uverbs]
uobj_destroy+0x3c/0x80 [ib_uverbs]
ib_uverbs_run_method+0x23e/0x360 [ib_uverbs]
? uverbs_finalize_object+0x60/0x60 [ib_uverbs]
ib_uverbs_cmd_verbs+0x14f/0x2c0 [ib_uverbs]
? do_tty_write+0x1a9/0x270
? file_tty_write.constprop.0+0x98/0xc0
? new_sync_write+0xfc/0x190
ib_uverbs_ioctl+0xd7/0x160 [ib_uverbs]
__x64_sys_ioctl+0x87/0xc0
do_syscall_64+0x59/0x90
Fixes: b581f4266928 ("net/mlx5: fs, manage flow counters HWS action sharing by refcount")
Signed-off-by: Moshe Shemesh <moshe@nvidia.com>
Reviewed-by: Yevgeny Kliteynik <kliteyn@nvidia.com>
Reviewed-by: Mark Bloch <mbloch@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/1758525094-816583-2-git-send-email-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/ethernet/mellanox/mlx5/core/fs_core.c | 2 +-
.../net/ethernet/mellanox/mlx5/core/fs_core.h | 1 +
.../ethernet/mellanox/mlx5/core/fs_counters.c | 25 ++++++++++++++++---
.../mlx5/core/steering/hws/fs_hws_pools.c | 8 +++++-
include/linux/mlx5/fs.h | 2 ++
5 files changed, 33 insertions(+), 5 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index 3b57ef6b3de38..93fb4e861b691 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
@@ -663,7 +663,7 @@ static void del_sw_hw_rule(struct fs_node *node)
BIT(MLX5_SET_FTE_MODIFY_ENABLE_MASK_ACTION) |
BIT(MLX5_SET_FTE_MODIFY_ENABLE_MASK_FLOW_COUNTERS);
fte->act_dests.action.action &= ~MLX5_FLOW_CONTEXT_ACTION_COUNT;
- mlx5_fc_local_destroy(rule->dest_attr.counter);
+ mlx5_fc_local_put(rule->dest_attr.counter);
goto out;
}
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
index 500826229b0be..e6a95b310b555 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h
@@ -343,6 +343,7 @@ struct mlx5_fc {
enum mlx5_fc_type type;
struct mlx5_fc_bulk *bulk;
struct mlx5_fc_cache cache;
+ refcount_t fc_local_refcount;
/* last{packets,bytes} are used for calculating deltas since last reading. */
u64 lastpackets;
u64 lastbytes;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c
index 492775d3d193a..83001eda38842 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_counters.c
@@ -562,17 +562,36 @@ mlx5_fc_local_create(u32 counter_id, u32 offset, u32 bulk_size)
counter->id = counter_id;
fc_bulk->base_id = counter_id - offset;
fc_bulk->fs_bulk.bulk_len = bulk_size;
+ refcount_set(&fc_bulk->hws_data.hws_action_refcount, 0);
+ mutex_init(&fc_bulk->hws_data.lock);
counter->bulk = fc_bulk;
+ refcount_set(&counter->fc_local_refcount, 1);
return counter;
}
EXPORT_SYMBOL(mlx5_fc_local_create);
void mlx5_fc_local_destroy(struct mlx5_fc *counter)
{
- if (!counter || counter->type != MLX5_FC_TYPE_LOCAL)
- return;
-
kfree(counter->bulk);
kfree(counter);
}
EXPORT_SYMBOL(mlx5_fc_local_destroy);
+
+void mlx5_fc_local_get(struct mlx5_fc *counter)
+{
+ if (!counter || counter->type != MLX5_FC_TYPE_LOCAL)
+ return;
+
+ refcount_inc(&counter->fc_local_refcount);
+}
+
+void mlx5_fc_local_put(struct mlx5_fc *counter)
+{
+ if (!counter || counter->type != MLX5_FC_TYPE_LOCAL)
+ return;
+
+ if (!refcount_dec_and_test(&counter->fc_local_refcount))
+ return;
+
+ mlx5_fc_local_destroy(counter);
+}
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws_pools.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws_pools.c
index f1ecdba74e1f4..839d71bd42164 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws_pools.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws_pools.c
@@ -407,15 +407,21 @@ struct mlx5hws_action *mlx5_fc_get_hws_action(struct mlx5hws_context *ctx,
{
struct mlx5_fs_hws_create_action_ctx create_ctx;
struct mlx5_fc_bulk *fc_bulk = counter->bulk;
+ struct mlx5hws_action *hws_action;
create_ctx.hws_ctx = ctx;
create_ctx.id = fc_bulk->base_id;
create_ctx.actions_type = MLX5HWS_ACTION_TYP_CTR;
- return mlx5_fs_get_hws_action(&fc_bulk->hws_data, &create_ctx);
+ mlx5_fc_local_get(counter);
+ hws_action = mlx5_fs_get_hws_action(&fc_bulk->hws_data, &create_ctx);
+ if (!hws_action)
+ mlx5_fc_local_put(counter);
+ return hws_action;
}
void mlx5_fc_put_hws_action(struct mlx5_fc *counter)
{
mlx5_fs_put_hws_action(&counter->bulk->hws_data);
+ mlx5_fc_local_put(counter);
}
diff --git a/include/linux/mlx5/fs.h b/include/linux/mlx5/fs.h
index 939e58c2f3865..fb5f98fcc7269 100644
--- a/include/linux/mlx5/fs.h
+++ b/include/linux/mlx5/fs.h
@@ -308,6 +308,8 @@ struct mlx5_fc *mlx5_fc_create(struct mlx5_core_dev *dev, bool aging);
void mlx5_fc_destroy(struct mlx5_core_dev *dev, struct mlx5_fc *counter);
struct mlx5_fc *mlx5_fc_local_create(u32 counter_id, u32 offset, u32 bulk_size);
void mlx5_fc_local_destroy(struct mlx5_fc *counter);
+void mlx5_fc_local_get(struct mlx5_fc *counter);
+void mlx5_fc_local_put(struct mlx5_fc *counter);
u64 mlx5_fc_query_lastuse(struct mlx5_fc *counter);
void mlx5_fc_query_cached(struct mlx5_fc *counter,
u64 *bytes, u64 *packets, u64 *lastuse);
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 080/143] net/mlx5: HWS, remove unused create_dest_array parameter
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 079/143] net/mlx5: fs, fix UAF in flow counter release Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 081/143] net/mlx5: HWS, ignore flow level for multi-dest table Greg Kroah-Hartman
` (74 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vlad Dogaru, Yevgeny Kliteynik,
Simon Horman, Mark Bloch, Jakub Kicinski, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlad Dogaru <vdogaru@nvidia.com>
[ Upstream commit 60afb51c89414b3d0061226415651f29a7eaf932 ]
`flow_source` is not used anywhere in mlx5hws_action_create_dest_array.
Signed-off-by: Vlad Dogaru <vdogaru@nvidia.com>
Signed-off-by: Yevgeny Kliteynik <kliteyn@nvidia.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Mark Bloch <mbloch@nvidia.com>
Link: https://patch.msgid.link/20250703185431.445571-2-mbloch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: efb877cf27e3 ("net/mlx5: HWS, ignore flow level for multi-dest table")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../mellanox/mlx5/core/steering/hws/action.c | 7 ++-----
.../mellanox/mlx5/core/steering/hws/fs_hws.c | 15 ++++++---------
.../mellanox/mlx5/core/steering/hws/mlx5hws.h | 8 ++------
3 files changed, 10 insertions(+), 20 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c
index 8e4a085f4a2ec..6b36a4a7d895f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c
@@ -1358,12 +1358,9 @@ mlx5hws_action_create_modify_header(struct mlx5hws_context *ctx,
}
struct mlx5hws_action *
-mlx5hws_action_create_dest_array(struct mlx5hws_context *ctx,
- size_t num_dest,
+mlx5hws_action_create_dest_array(struct mlx5hws_context *ctx, size_t num_dest,
struct mlx5hws_action_dest_attr *dests,
- bool ignore_flow_level,
- u32 flow_source,
- u32 flags)
+ bool ignore_flow_level, u32 flags)
{
struct mlx5hws_cmd_set_fte_dest *dest_list = NULL;
struct mlx5hws_cmd_ft_create_attr ft_attr = {0};
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c
index 47e3947e7b512..131e74b2b7743 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c
@@ -572,14 +572,12 @@ static void mlx5_fs_put_dest_action_sampler(struct mlx5_fs_hws_context *fs_ctx,
static struct mlx5hws_action *
mlx5_fs_create_action_dest_array(struct mlx5hws_context *ctx,
struct mlx5hws_action_dest_attr *dests,
- u32 num_of_dests, bool ignore_flow_level,
- u32 flow_source)
+ u32 num_of_dests, bool ignore_flow_level)
{
u32 flags = MLX5HWS_ACTION_FLAG_HWS_FDB | MLX5HWS_ACTION_FLAG_SHARED;
return mlx5hws_action_create_dest_array(ctx, num_of_dests, dests,
- ignore_flow_level,
- flow_source, flags);
+ ignore_flow_level, flags);
}
static struct mlx5hws_action *
@@ -1016,7 +1014,6 @@ static int mlx5_fs_fte_get_hws_actions(struct mlx5_flow_root_namespace *ns,
}
(*ractions)[num_actions++].action = dest_actions->dest;
} else if (num_dest_actions > 1) {
- u32 flow_source = fte->act_dests.flow_context.flow_source;
bool ignore_flow_level;
if (num_actions == MLX5_FLOW_CONTEXT_ACTION_MAX ||
@@ -1026,10 +1023,10 @@ static int mlx5_fs_fte_get_hws_actions(struct mlx5_flow_root_namespace *ns,
}
ignore_flow_level =
!!(fte_action->flags & FLOW_ACT_IGNORE_FLOW_LEVEL);
- tmp_action = mlx5_fs_create_action_dest_array(ctx, dest_actions,
- num_dest_actions,
- ignore_flow_level,
- flow_source);
+ tmp_action =
+ mlx5_fs_create_action_dest_array(ctx, dest_actions,
+ num_dest_actions,
+ ignore_flow_level);
if (!tmp_action) {
err = -EOPNOTSUPP;
goto free_actions;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h
index a2fe2f9e832d2..32d7d75bc6daf 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h
@@ -728,18 +728,14 @@ mlx5hws_action_create_push_vlan(struct mlx5hws_context *ctx, u32 flags);
* @dests: The destination array. Each contains a destination action and can
* have additional actions.
* @ignore_flow_level: Whether to turn on 'ignore_flow_level' for this dest.
- * @flow_source: Source port of the traffic for this actions.
* @flags: Action creation flags (enum mlx5hws_action_flags).
*
* Return: pointer to mlx5hws_action on success NULL otherwise.
*/
struct mlx5hws_action *
-mlx5hws_action_create_dest_array(struct mlx5hws_context *ctx,
- size_t num_dest,
+mlx5hws_action_create_dest_array(struct mlx5hws_context *ctx, size_t num_dest,
struct mlx5hws_action_dest_attr *dests,
- bool ignore_flow_level,
- u32 flow_source,
- u32 flags);
+ bool ignore_flow_level, u32 flags);
/**
* mlx5hws_action_create_insert_header - Create insert header action.
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 081/143] net/mlx5: HWS, ignore flow level for multi-dest table
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 080/143] net/mlx5: HWS, remove unused create_dest_array parameter Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 082/143] net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD Greg Kroah-Hartman
` (73 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yevgeny Kliteynik, Moshe Shemesh,
Mark Bloch, Tariq Toukan, Jakub Kicinski, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yevgeny Kliteynik <kliteyn@nvidia.com>
[ Upstream commit efb877cf27e300e47e1c051f4e8fd80fc42325d5 ]
When HWS creates multi-dest FW table and adds rules to
forward to other tables, ignore the flow level enforcement
in FW, because HWS is responsible for table levels.
This fixes the following error:
mlx5_core 0000:08:00.0: mlx5_cmd_out_err:818:(pid 192306):
SET_FLOW_TABLE_ENTRY(0x936) op_mod(0x0) failed,
status bad parameter(0x3), syndrome (0x6ae84c), err(-22)
Fixes: 504e536d9010 ("net/mlx5: HWS, added actions handling")
Signed-off-by: Yevgeny Kliteynik <kliteyn@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Reviewed-by: Mark Bloch <mbloch@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/1758525094-816583-3-git-send-email-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../ethernet/mellanox/mlx5/core/steering/hws/action.c | 4 ++--
.../ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c | 11 +++--------
.../mellanox/mlx5/core/steering/hws/mlx5hws.h | 3 +--
3 files changed, 6 insertions(+), 12 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c
index 6b36a4a7d895f..fe56b59e24c59 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c
@@ -1360,7 +1360,7 @@ mlx5hws_action_create_modify_header(struct mlx5hws_context *ctx,
struct mlx5hws_action *
mlx5hws_action_create_dest_array(struct mlx5hws_context *ctx, size_t num_dest,
struct mlx5hws_action_dest_attr *dests,
- bool ignore_flow_level, u32 flags)
+ u32 flags)
{
struct mlx5hws_cmd_set_fte_dest *dest_list = NULL;
struct mlx5hws_cmd_ft_create_attr ft_attr = {0};
@@ -1397,7 +1397,7 @@ mlx5hws_action_create_dest_array(struct mlx5hws_context *ctx, size_t num_dest,
MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE;
dest_list[i].destination_id = dests[i].dest->dest_obj.obj_id;
fte_attr.action_flags |= MLX5_FLOW_CONTEXT_ACTION_FWD_DEST;
- fte_attr.ignore_flow_level = ignore_flow_level;
+ fte_attr.ignore_flow_level = 1;
if (dests[i].is_wire_ft)
last_dest_idx = i;
break;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c
index 131e74b2b7743..6a4c4cccd6434 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c
@@ -572,12 +572,12 @@ static void mlx5_fs_put_dest_action_sampler(struct mlx5_fs_hws_context *fs_ctx,
static struct mlx5hws_action *
mlx5_fs_create_action_dest_array(struct mlx5hws_context *ctx,
struct mlx5hws_action_dest_attr *dests,
- u32 num_of_dests, bool ignore_flow_level)
+ u32 num_of_dests)
{
u32 flags = MLX5HWS_ACTION_FLAG_HWS_FDB | MLX5HWS_ACTION_FLAG_SHARED;
return mlx5hws_action_create_dest_array(ctx, num_of_dests, dests,
- ignore_flow_level, flags);
+ flags);
}
static struct mlx5hws_action *
@@ -1014,19 +1014,14 @@ static int mlx5_fs_fte_get_hws_actions(struct mlx5_flow_root_namespace *ns,
}
(*ractions)[num_actions++].action = dest_actions->dest;
} else if (num_dest_actions > 1) {
- bool ignore_flow_level;
-
if (num_actions == MLX5_FLOW_CONTEXT_ACTION_MAX ||
num_fs_actions == MLX5_FLOW_CONTEXT_ACTION_MAX) {
err = -EOPNOTSUPP;
goto free_actions;
}
- ignore_flow_level =
- !!(fte_action->flags & FLOW_ACT_IGNORE_FLOW_LEVEL);
tmp_action =
mlx5_fs_create_action_dest_array(ctx, dest_actions,
- num_dest_actions,
- ignore_flow_level);
+ num_dest_actions);
if (!tmp_action) {
err = -EOPNOTSUPP;
goto free_actions;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h
index 32d7d75bc6daf..e6ba5a2129075 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h
@@ -727,7 +727,6 @@ mlx5hws_action_create_push_vlan(struct mlx5hws_context *ctx, u32 flags);
* @num_dest: The number of dests attributes.
* @dests: The destination array. Each contains a destination action and can
* have additional actions.
- * @ignore_flow_level: Whether to turn on 'ignore_flow_level' for this dest.
* @flags: Action creation flags (enum mlx5hws_action_flags).
*
* Return: pointer to mlx5hws_action on success NULL otherwise.
@@ -735,7 +734,7 @@ mlx5hws_action_create_push_vlan(struct mlx5hws_context *ctx, u32 flags);
struct mlx5hws_action *
mlx5hws_action_create_dest_array(struct mlx5hws_context *ctx, size_t num_dest,
struct mlx5hws_action_dest_attr *dests,
- bool ignore_flow_level, u32 flags);
+ u32 flags);
/**
* mlx5hws_action_create_insert_header - Create insert header action.
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 082/143] net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 081/143] net/mlx5: HWS, ignore flow level for multi-dest table Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 083/143] net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() Greg Kroah-Hartman
` (72 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Carolina Jubran, Dragos Tatulea,
Yael Chemla, Tariq Toukan, Jakub Kicinski, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carolina Jubran <cjubran@nvidia.com>
[ Upstream commit 6d0477d0d067a53c1d48d0aff1fd52e151721871 ]
Include MLX5E_FEC_RS_544_514_INTERLEAVED_QUAD in the FEC RS stats
handling. This addresses a gap introduced when adding support for
200G/lane link modes.
Fixes: 4e343c11efbb ("net/mlx5e: Support FEC settings for 200G per lane link modes")
Signed-off-by: Carolina Jubran <cjubran@nvidia.com>
Reviewed-by: Dragos Tatulea <dtatulea@nvidia.com>
Reviewed-by: Yael Chemla <ychemla@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/1758525094-816583-4-git-send-email-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en_stats.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
index 19664fa7f2171..46d6dd05fb814 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c
@@ -1466,6 +1466,7 @@ static void fec_set_block_stats(struct mlx5e_priv *priv,
case MLX5E_FEC_RS_528_514:
case MLX5E_FEC_RS_544_514:
case MLX5E_FEC_LLRS_272_257_1:
+ case MLX5E_FEC_RS_544_514_INTERLEAVED_QUAD:
fec_set_rs_stats(fec_stats, out);
return;
case MLX5E_FEC_FIRECODE:
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 083/143] net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup()
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 082/143] net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 084/143] net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port Greg Kroah-Hartman
` (71 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladimir Oltean, Daniel Golle,
Paolo Abeni, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <vladimir.oltean@nxp.com>
[ Upstream commit c0054b25e2f1045f47b4954cf13a539e5e6047df ]
A port added to a "single port bridge" operates as standalone, and this
is mutually exclusive to being part of a Linux bridge. In fact,
gswip_port_bridge_join() calls gswip_add_single_port_br() with
add=false, i.e. removes the port from the "single port bridge" to enable
autonomous forwarding.
The blamed commit seems to have incorrectly thought that ds->ops->port_enable()
is called one time per port, during the setup phase of the switch.
However, it is actually called during the ndo_open() implementation of
DSA user ports, which is to say that this sequence of events:
1. ip link set swp0 down
2. ip link add br0 type bridge
3. ip link set swp0 master br0
4. ip link set swp0 up
would cause swp0 to join back the "single port bridge" which step 3 had
just removed it from.
The correct DSA hook for one-time actions per port at switch init time
is ds->ops->port_setup(). This is what seems to match the coder's
intention; also see the comment at the beginning of the file:
* At the initialization the driver allocates one bridge table entry for
~~~~~~~~~~~~~~~~~~~~~
* each switch port which is used when the port is used without an
* explicit bridge.
Fixes: 8206e0ce96b3 ("net: dsa: lantiq: Add VLAN unaware bridge offloading")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Link: https://patch.msgid.link/20250918072142.894692-2-vladimir.oltean@nxp.com
Tested-by: Daniel Golle <daniel@makrotopia.org>
Reviewed-by: Daniel Golle <daniel@makrotopia.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/lantiq_gswip.c | 18 ++++++++++++++----
1 file changed, 14 insertions(+), 4 deletions(-)
diff --git a/drivers/net/dsa/lantiq_gswip.c b/drivers/net/dsa/lantiq_gswip.c
index 6eb3140d40444..d416c072dd28c 100644
--- a/drivers/net/dsa/lantiq_gswip.c
+++ b/drivers/net/dsa/lantiq_gswip.c
@@ -685,18 +685,27 @@ static int gswip_add_single_port_br(struct gswip_priv *priv, int port, bool add)
return 0;
}
-static int gswip_port_enable(struct dsa_switch *ds, int port,
- struct phy_device *phydev)
+static int gswip_port_setup(struct dsa_switch *ds, int port)
{
struct gswip_priv *priv = ds->priv;
int err;
if (!dsa_is_cpu_port(ds, port)) {
- u32 mdio_phy = 0;
-
err = gswip_add_single_port_br(priv, port, true);
if (err)
return err;
+ }
+
+ return 0;
+}
+
+static int gswip_port_enable(struct dsa_switch *ds, int port,
+ struct phy_device *phydev)
+{
+ struct gswip_priv *priv = ds->priv;
+
+ if (!dsa_is_cpu_port(ds, port)) {
+ u32 mdio_phy = 0;
if (phydev)
mdio_phy = phydev->mdio.addr & GSWIP_MDIO_PHY_ADDR_MASK;
@@ -1829,6 +1838,7 @@ static const struct phylink_mac_ops gswip_phylink_mac_ops = {
static const struct dsa_switch_ops gswip_xrx200_switch_ops = {
.get_tag_protocol = gswip_get_tag_protocol,
.setup = gswip_setup,
+ .port_setup = gswip_port_setup,
.port_enable = gswip_port_enable,
.port_disable = gswip_port_disable,
.port_bridge_join = gswip_port_bridge_join,
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 084/143] net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 083/143] net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 085/143] octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() Greg Kroah-Hartman
` (70 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Golle, Vladimir Oltean,
Paolo Abeni, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <vladimir.oltean@nxp.com>
[ Upstream commit 987afe147965ef7a8e7d144ffef0d70af14bb1d4 ]
The blamed commit and others in that patch set started the trend
of reusing existing DSA driver API for a new purpose: calling
ds->ops->port_fdb_add() on the CPU port.
The lantiq_gswip driver was not prepared to handle that, as can be seen
from the many errors that Daniel presents in the logs:
[ 174.050000] gswip 1e108000.switch: port 2 failed to add fa:aa:72:f4:8b:1e vid 1 to fdb: -22
[ 174.060000] gswip 1e108000.switch lan2: entered promiscuous mode
[ 174.070000] gswip 1e108000.switch: port 2 failed to add 00:01:02:03:04:02 vid 0 to fdb: -22
[ 174.090000] gswip 1e108000.switch: port 2 failed to add 00:01:02:03:04:02 vid 1 to fdb: -22
[ 174.090000] gswip 1e108000.switch: port 2 failed to delete fa:aa:72:f4:8b:1e vid 1 from fdb: -2
The errors are because gswip_port_fdb() wants to get a handle to the
bridge that originated these FDB events, to associate it with a FID.
Absolutely honourable purpose, however this only works for user ports.
To get the bridge that generated an FDB entry for the CPU port, one
would need to look at the db.bridge.dev argument. But this was
introduced in commit c26933639b54 ("net: dsa: request drivers to perform
FDB isolation"), first appeared in v5.18, and when the blamed commit was
introduced in v5.14, no such API existed.
So the core DSA feature was introduced way too soon for lantiq_gswip.
Not acting on these host FDB entries and suppressing any errors has no
other negative effect, and practically returns us to not supporting the
host filtering feature at all - peacefully, this time.
Fixes: 10fae4ac89ce ("net: dsa: include bridge addresses which are local in the host fdb list")
Reported-by: Daniel Golle <daniel@makrotopia.org>
Closes: https://lore.kernel.org/netdev/aJfNMLNoi1VOsPrN@pidgin.makrotopia.org/
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Link: https://patch.msgid.link/20250918072142.894692-3-vladimir.oltean@nxp.com
Tested-by: Daniel Golle <daniel@makrotopia.org>
Reviewed-by: Daniel Golle <daniel@makrotopia.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/lantiq_gswip.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/dsa/lantiq_gswip.c b/drivers/net/dsa/lantiq_gswip.c
index d416c072dd28c..84dc6e517acf9 100644
--- a/drivers/net/dsa/lantiq_gswip.c
+++ b/drivers/net/dsa/lantiq_gswip.c
@@ -1368,8 +1368,9 @@ static int gswip_port_fdb(struct dsa_switch *ds, int port,
int i;
int err;
+ /* Operation not supported on the CPU port, don't throw errors */
if (!bridge)
- return -EINVAL;
+ return 0;
for (i = max_ports; i < ARRAY_SIZE(priv->vlans); i++) {
if (priv->vlans[i].bridge == bridge) {
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 085/143] octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 084/143] net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 086/143] drm/gma500: Fix null dereference in hdmi teardown Greg Kroah-Hartman
` (69 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Vadim Fedorenko,
Paolo Abeni, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit d9c70e93ec5988ab07ad2a92d9f9d12867f02c56 ]
This code calls kfree_rcu(new_node, rcu) and then dereferences "new_node"
and then dereferences it on the next line. Two lines later, we take
a mutex so I don't think this is an RCU safe region. Re-order it to do
the dereferences before queuing up the free.
Fixes: 68fbff68dbea ("octeontx2-pf: Add police action for TC flower")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Link: https://patch.msgid.link/aNKCL1jKwK8GRJHh@stanley.mountain
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
index 5f80b23c5335c..26a08d2cfbb1b 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_tc.c
@@ -1326,7 +1326,6 @@ static int otx2_tc_add_flow(struct otx2_nic *nic,
free_leaf:
otx2_tc_del_from_flow_list(flow_cfg, new_node);
- kfree_rcu(new_node, rcu);
if (new_node->is_act_police) {
mutex_lock(&nic->mbox.lock);
@@ -1346,6 +1345,7 @@ static int otx2_tc_add_flow(struct otx2_nic *nic,
mutex_unlock(&nic->mbox.lock);
}
+ kfree_rcu(new_node, rcu);
return rc;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 086/143] drm/gma500: Fix null dereference in hdmi teardown
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 085/143] octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 087/143] futex: Prevent use-after-free during requeue-PI Greg Kroah-Hartman
` (68 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zabelin Nikita, Patrik Jakobsson,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zabelin Nikita <n.zabelin@mt-integration.ru>
[ Upstream commit 352e66900cde63f3dadb142364d3c35170bbaaff ]
pci_set_drvdata sets the value of pdev->driver_data to NULL,
after which the driver_data obtained from the same dev is
dereferenced in oaktrail_hdmi_i2c_exit, and the i2c_dev is
extracted from it. To prevent this, swap these calls.
Found by Linux Verification Center (linuxtesting.org) with Svacer.
Fixes: 1b082ccf5901 ("gma500: Add Oaktrail support")
Signed-off-by: Zabelin Nikita <n.zabelin@mt-integration.ru>
Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
Link: https://lore.kernel.org/r/20250918150703.2562604-1-n.zabelin@mt-integration.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/gma500/oaktrail_hdmi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/gma500/oaktrail_hdmi.c b/drivers/gpu/drm/gma500/oaktrail_hdmi.c
index 1cf3943691277..c0feca58511df 100644
--- a/drivers/gpu/drm/gma500/oaktrail_hdmi.c
+++ b/drivers/gpu/drm/gma500/oaktrail_hdmi.c
@@ -726,8 +726,8 @@ void oaktrail_hdmi_teardown(struct drm_device *dev)
if (hdmi_dev) {
pdev = hdmi_dev->dev;
- pci_set_drvdata(pdev, NULL);
oaktrail_hdmi_i2c_exit(pdev);
+ pci_set_drvdata(pdev, NULL);
iounmap(hdmi_dev->regs);
kfree(hdmi_dev);
pci_dev_put(pdev);
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 087/143] futex: Prevent use-after-free during requeue-PI
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 086/143] drm/gma500: Fix null dereference in hdmi teardown Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 088/143] gpio: regmap: fix memory leak of gpio_regmap structure Greg Kroah-Hartman
` (67 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+034246a838a10d181e78,
Sebastian Andrzej Siewior, Thomas Gleixner, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
[ Upstream commit b549113738e8c751b613118032a724b772aa83f2 ]
syzbot managed to trigger the following race:
T1 T2
futex_wait_requeue_pi()
futex_do_wait()
schedule()
futex_requeue()
futex_proxy_trylock_atomic()
futex_requeue_pi_prepare()
requeue_pi_wake_futex()
futex_requeue_pi_complete()
/* preempt */
* timeout/ signal wakes T1 *
futex_requeue_pi_wakeup_sync() // Q_REQUEUE_PI_LOCKED
futex_hash_put()
// back to userland, on stack futex_q is garbage
/* back */
wake_up_state(q->task, TASK_NORMAL);
In this scenario futex_wait_requeue_pi() is able to leave without using
futex_q::lock_ptr for synchronization.
This can be prevented by reading futex_q::task before updating the
futex_q::requeue_state. A reference on the task_struct is not needed
because requeue_pi_wake_futex() is invoked with a spinlock_t held which
implies a RCU read section.
Even if T1 terminates immediately after, the task_struct will remain valid
during T2's wake_up_state(). A READ_ONCE on futex_q::task before
futex_requeue_pi_complete() is enough because it ensures that the variable
is read before the state is updated.
Read futex_q::task before updating the requeue state, use it for the
following wakeup.
Fixes: 07d91ef510fb1 ("futex: Prevent requeue_pi() lock nesting issue on RT")
Reported-by: syzbot+034246a838a10d181e78@syzkaller.appspotmail.com
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Closes: https://lore.kernel.org/all/68b75989.050a0220.3db4df.01dd.GAE@google.com/
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/futex/requeue.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/kernel/futex/requeue.c b/kernel/futex/requeue.c
index c716a66f86929..d818b4d47f1ba 100644
--- a/kernel/futex/requeue.c
+++ b/kernel/futex/requeue.c
@@ -230,8 +230,9 @@ static inline
void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key,
struct futex_hash_bucket *hb)
{
- q->key = *key;
+ struct task_struct *task;
+ q->key = *key;
__futex_unqueue(q);
WARN_ON(!q->rt_waiter);
@@ -243,10 +244,11 @@ void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key,
futex_hash_get(hb);
q->drop_hb_ref = true;
q->lock_ptr = &hb->lock;
+ task = READ_ONCE(q->task);
/* Signal locked state to the waiter */
futex_requeue_pi_complete(q, 1);
- wake_up_state(q->task, TASK_NORMAL);
+ wake_up_state(task, TASK_NORMAL);
}
/**
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 088/143] gpio: regmap: fix memory leak of gpio_regmap structure
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 087/143] futex: Prevent use-after-free during requeue-PI Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 089/143] drm/xe/vf: Dont expose sysfs attributes not applicable for VFs Greg Kroah-Hartman
` (66 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ioana Ciornei, Michael Walle,
Bartosz Golaszewski, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ioana Ciornei <ioana.ciornei@nxp.com>
[ Upstream commit 3bd44edd6c55828fd4e11cb0efce5b7160bfa2de ]
The gpio_regmap structure is leaked on the error path. Fix this by
jumping to the appropriate kfree instead of returning directly.
Fixes: db305161880a ("gpio: regmap: Allow ngpio to be read from the property")
Signed-off-by: Ioana Ciornei <ioana.ciornei@nxp.com>
Suggested-by: Michael Walle <mwalle@kernel.org>
Reviewed-by: Michael Walle <mwalle@kernel.org>
Link: https://lore.kernel.org/r/20250922142427.3310221-7-ioana.ciornei@nxp.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/gpio-regmap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpio/gpio-regmap.c b/drivers/gpio/gpio-regmap.c
index 87c4225784cfa..b3b84a404485e 100644
--- a/drivers/gpio/gpio-regmap.c
+++ b/drivers/gpio/gpio-regmap.c
@@ -274,7 +274,7 @@ struct gpio_regmap *gpio_regmap_register(const struct gpio_regmap_config *config
if (!chip->ngpio) {
ret = gpiochip_get_ngpios(chip, chip->parent);
if (ret)
- return ERR_PTR(ret);
+ goto err_free_gpio;
}
/* if not set, assume there is only one register */
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 089/143] drm/xe/vf: Dont expose sysfs attributes not applicable for VFs
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 088/143] gpio: regmap: fix memory leak of gpio_regmap structure Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 090/143] drm/xe: Fix build with CONFIG_MODULES=n Greg Kroah-Hartman
` (65 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michal Wajdeczko, Lucas De Marchi,
Lukasz Laguna, Raag Jadav, Rodrigo Vivi, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Wajdeczko <michal.wajdeczko@intel.com>
[ Upstream commit 500dad428e5b0de4c1bdfa893822a6e06ddad0b5 ]
VFs can't read BMG_PCIE_CAP(0x138340) register nor access PCODE
(already guarded by the info.skip_pcode flag) so we shouldn't
expose attributes that require any of them to avoid errors like:
[] xe 0000:03:00.1: [drm] Tile0: GT0: VF is trying to read an \
inaccessible register 0x138340+0x0
[] RIP: 0010:xe_gt_sriov_vf_read32+0x6c2/0x9a0 [xe]
[] Call Trace:
[] xe_mmio_read32+0x110/0x280 [xe]
[] auto_link_downgrade_capable_show+0x2e/0x70 [xe]
[] dev_attr_show+0x1a/0x70
[] sysfs_kf_seq_show+0xaa/0x120
[] kernfs_seq_show+0x41/0x60
Fixes: 0e414bf7ad01 ("drm/xe: Expose PCIe link downgrade attributes")
Fixes: cdc36b66cd41 ("drm/xe: Expose fan control and voltage regulator version")
Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Cc: Lucas De Marchi <lucas.demarchi@intel.com>
Cc: Lukasz Laguna <lukasz.laguna@intel.com>
Reviewed-by: Raag Jadav <raag.jadav@intel.com>
Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
Link: https://lore.kernel.org/r/20250916170029.3313-2-michal.wajdeczko@intel.com
(cherry picked from commit a2d6223d224f333f705ed8495bf8bebfbc585c35)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/xe/xe_device_sysfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/xe/xe_device_sysfs.c b/drivers/gpu/drm/xe/xe_device_sysfs.c
index b9440f8c781e3..652da4d294c0b 100644
--- a/drivers/gpu/drm/xe/xe_device_sysfs.c
+++ b/drivers/gpu/drm/xe/xe_device_sysfs.c
@@ -166,7 +166,7 @@ int xe_device_sysfs_init(struct xe_device *xe)
return ret;
}
- if (xe->info.platform == XE_BATTLEMAGE) {
+ if (xe->info.platform == XE_BATTLEMAGE && !IS_SRIOV_VF(xe)) {
ret = sysfs_create_files(&dev->kobj, auto_link_downgrade_attrs);
if (ret)
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 090/143] drm/xe: Fix build with CONFIG_MODULES=n
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 089/143] drm/xe/vf: Dont expose sysfs attributes not applicable for VFs Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 091/143] drm/i915/ddi: Guard reg_val against a INVALID_TRANSCODER Greg Kroah-Hartman
` (64 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Riana Tauro, kernel test robot,
Balasubramani Vivekanandan, Lucas De Marchi, Rodrigo Vivi,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lucas De Marchi <lucas.demarchi@intel.com>
[ Upstream commit b67e7422d229dead0dddaad7e7c05558f24d552f ]
When building with CONFIG_MODULES=n, the __exit functions are dropped.
However our init functions may call them for error handling, so they are
not good candidates for the exit sections.
Fix this error reported by 0day:
ld.lld: error: relocation refers to a symbol in a discarded section: xe_configfs_exit
>>> defined in vmlinux.a(drivers/gpu/drm/xe/xe_configfs.o)
>>> referenced by xe_module.c
>>> drivers/gpu/drm/xe/xe_module.o:(init_funcs) in archive vmlinux.a
This is the only exit function using __exit. Drop it to fix the build.
Cc: Riana Tauro <riana.tauro@intel.com>
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202506092221.1FmUQmI8-lkp@intel.com/
Fixes: 16280ded45fb ("drm/xe: Add configfs to enable survivability mode")
Reviewed-by: Balasubramani Vivekanandan <balasubramani.vivekanandan@intel.com>
Link: https://lore.kernel.org/r/20250912-fix-nomodule-build-v1-1-d11b70a92516@intel.com
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
(cherry picked from commit d9b2623319fa20c2206754284291817488329648)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/xe/xe_configfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/xe/xe_configfs.c b/drivers/gpu/drm/xe/xe_configfs.c
index 9a2b96b111ef5..2b591ed055612 100644
--- a/drivers/gpu/drm/xe/xe_configfs.c
+++ b/drivers/gpu/drm/xe/xe_configfs.c
@@ -244,7 +244,7 @@ int __init xe_configfs_init(void)
return 0;
}
-void __exit xe_configfs_exit(void)
+void xe_configfs_exit(void)
{
configfs_unregister_subsystem(&xe_configfs);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 091/143] drm/i915/ddi: Guard reg_val against a INVALID_TRANSCODER
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 090/143] drm/xe: Fix build with CONFIG_MODULES=n Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 092/143] drm/amd/display: remove output_tf_change flag Greg Kroah-Hartman
` (63 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Suraj Kandpal, Jani Nikula,
Tvrtko Ursulin, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suraj Kandpal <suraj.kandpal@intel.com>
[ Upstream commit 7f97a0a871d9532f2e1a5ee7d16d0e364215bcac ]
Currently we check if the encoder is INVALID or -1 and throw a
WARN_ON but we still end up writing the temp value which will
overflow and corrupt the whole programmed value.
--v2
-Assign a bogus transcoder to master in case we get a INVALID
TRANSCODER [Jani]
Fixes: 6671c367a9bea ("drm/i915/tgl: Select master transcoder for MST stream")
Signed-off-by: Suraj Kandpal <suraj.kandpal@intel.com>
Reviewed-by: Jani Nikula <jani.nikula@intel.com>
Link: https://lore.kernel.org/r/20250908042208.1011144-1-suraj.kandpal@intel.com
(cherry picked from commit c8e8e9ab14a6ea926641d161768e1e3ef286a853)
Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/i915/display/intel_ddi.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/i915/display/intel_ddi.c b/drivers/gpu/drm/i915/display/intel_ddi.c
index d58f8fc373265..55b8bfcf364ae 100644
--- a/drivers/gpu/drm/i915/display/intel_ddi.c
+++ b/drivers/gpu/drm/i915/display/intel_ddi.c
@@ -593,8 +593,9 @@ intel_ddi_transcoder_func_reg_val_get(struct intel_encoder *encoder,
enum transcoder master;
master = crtc_state->mst_master_transcoder;
- drm_WARN_ON(display->drm,
- master == INVALID_TRANSCODER);
+ if (drm_WARN_ON(display->drm,
+ master == INVALID_TRANSCODER))
+ master = TRANSCODER_A;
temp |= TRANS_DDI_MST_TRANSPORT_SELECT(master);
}
} else {
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 092/143] drm/amd/display: remove output_tf_change flag
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 091/143] drm/i915/ddi: Guard reg_val against a INVALID_TRANSCODER Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 093/143] futex: Use correct exit on failure from futex_hash_allocate_default() Greg Kroah-Hartman
` (62 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Melissa Wen, Alex Hung, Alex Deucher,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Melissa Wen <mwen@igalia.com>
[ Upstream commit 41b1f9fcba62b06195e625bb88c1031102892439 ]
Remove this flag as the driver stopped managing it individually since
commit a4056c2a6344 ("drm/amd/display: use HW hdr mult for brightness
boost"). After some back and forth it was reintroduced as a condition to
`set_output_transfer_func()` in [1]. Without direct management, this
flag only changes value when all surface update flags are set true on
UPDATE_TYPE_FULL with no output TF status meaning.
Fixes: bb622e0c0044 ("drm/amd/display: program output tf when required") [1]
Signed-off-by: Melissa Wen <mwen@igalia.com>
Reviewed-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 752e6f283ec59ae007aa15a93d5a4b2eefa8cec9)
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/dc.h | 1 -
drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c | 6 ++----
drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c | 6 ++----
3 files changed, 4 insertions(+), 9 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/dc.h b/drivers/gpu/drm/amd/display/dc/dc.h
index 7dfbfb18593c1..f037f2d83400b 100644
--- a/drivers/gpu/drm/amd/display/dc/dc.h
+++ b/drivers/gpu/drm/amd/display/dc/dc.h
@@ -1292,7 +1292,6 @@ union surface_update_flags {
uint32_t in_transfer_func_change:1;
uint32_t input_csc_change:1;
uint32_t coeff_reduction_change:1;
- uint32_t output_tf_change:1;
uint32_t pixel_format_change:1;
uint32_t plane_size_change:1;
uint32_t gamut_remap_change:1;
diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
index 454e362ff096a..c0127d8b5b396 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn20/dcn20_hwseq.c
@@ -1990,10 +1990,8 @@ static void dcn20_program_pipe(
* updating on slave planes
*/
if (pipe_ctx->update_flags.bits.enable ||
- pipe_ctx->update_flags.bits.plane_changed ||
- pipe_ctx->stream->update_flags.bits.out_tf ||
- (pipe_ctx->plane_state &&
- pipe_ctx->plane_state->update_flags.bits.output_tf_change))
+ pipe_ctx->update_flags.bits.plane_changed ||
+ pipe_ctx->stream->update_flags.bits.out_tf)
hws->funcs.set_output_transfer_func(dc, pipe_ctx, pipe_ctx->stream);
/* If the pipe has been enabled or has a different opp, we
diff --git a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
index c4177a9a662fa..c68d01f378602 100644
--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
+++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn401/dcn401_hwseq.c
@@ -2289,10 +2289,8 @@ void dcn401_program_pipe(
* updating on slave planes
*/
if (pipe_ctx->update_flags.bits.enable ||
- pipe_ctx->update_flags.bits.plane_changed ||
- pipe_ctx->stream->update_flags.bits.out_tf ||
- (pipe_ctx->plane_state &&
- pipe_ctx->plane_state->update_flags.bits.output_tf_change))
+ pipe_ctx->update_flags.bits.plane_changed ||
+ pipe_ctx->stream->update_flags.bits.out_tf)
hws->funcs.set_output_transfer_func(dc, pipe_ctx, pipe_ctx->stream);
/* If the pipe has been enabled or has a different opp, we
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 093/143] futex: Use correct exit on failure from futex_hash_allocate_default()
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 092/143] drm/amd/display: remove output_tf_change flag Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 094/143] drm/panthor: Defer scheduler entitiy destruction to queue release Greg Kroah-Hartman
` (61 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+80cb3cc5c14fad191a10,
Sebastian Andrzej Siewior, Thomas Gleixner,
Steven Rostedt (Google), Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
[ Upstream commit 4ec3c15462b9f44562f45723a92e2807746ba7d1 ]
copy_process() uses the wrong error exit path from futex_hash_allocate_default().
After exiting from futex_hash_allocate_default(), neither tasklist_lock
nor siglock has been acquired. The exit label bad_fork_core_free unlocks
both of these locks which is wrong.
The next exit label, bad_fork_cancel_cgroup, is the correct exit.
sched_cgroup_fork() did not allocate any resources that need to freed.
Use bad_fork_cancel_cgroup on error exit from futex_hash_allocate_default().
Fixes: 7c4f75a21f636 ("futex: Allow automatic allocation of process wide futex hash")
Reported-by: syzbot+80cb3cc5c14fad191a10@syzkaller.appspotmail.com
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Closes: https://lore.kernel.org/all/68cb1cbd.050a0220.2ff435.0599.GAE@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/fork.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/fork.c b/kernel/fork.c
index 1ee8eb11f38ba..0cbc174da76ac 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -2289,7 +2289,7 @@ __latent_entropy struct task_struct *copy_process(
if (need_futex_hash_allocate_default(clone_flags)) {
retval = futex_hash_allocate_default();
if (retval)
- goto bad_fork_core_free;
+ goto bad_fork_cancel_cgroup;
/*
* If we fail beyond this point we don't free the allocated
* futex hash map. We assume that another thread will be created
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 094/143] drm/panthor: Defer scheduler entitiy destruction to queue release
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 093/143] futex: Use correct exit on failure from futex_hash_allocate_default() Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 095/143] platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() Greg Kroah-Hartman
` (60 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrián Larumbe, Steven Price,
Boris Brezillon, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrián Larumbe <adrian.larumbe@collabora.com>
[ Upstream commit 7d9c3442b02ab7dd3c44e20095a178fd57d2eccb ]
Commit de8548813824 ("drm/panthor: Add the scheduler logical block")
handled destruction of a group's queues' drm scheduler entities early
into the group destruction procedure.
However, that races with the group submit ioctl, because by the time
entities are destroyed (through the group destroy ioctl), the submission
procedure might've already obtained a group handle, and therefore the
ability to push jobs into entities. This is met with a DRM error message
within the drm scheduler core as a situation that should never occur.
Fix by deferring drm scheduler entity destruction to queue release time.
Fixes: de8548813824 ("drm/panthor: Add the scheduler logical block")
Signed-off-by: Adrián Larumbe <adrian.larumbe@collabora.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>
Signed-off-by: Steven Price <steven.price@arm.com>
Link: https://lore.kernel.org/r/20250919164436.531930-1-adrian.larumbe@collabora.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panthor/panthor_sched.c | 8 +-------
1 file changed, 1 insertion(+), 7 deletions(-)
diff --git a/drivers/gpu/drm/panthor/panthor_sched.c b/drivers/gpu/drm/panthor/panthor_sched.c
index 43ee57728de54..e927d80d6a2af 100644
--- a/drivers/gpu/drm/panthor/panthor_sched.c
+++ b/drivers/gpu/drm/panthor/panthor_sched.c
@@ -886,8 +886,7 @@ static void group_free_queue(struct panthor_group *group, struct panthor_queue *
if (IS_ERR_OR_NULL(queue))
return;
- if (queue->entity.fence_context)
- drm_sched_entity_destroy(&queue->entity);
+ drm_sched_entity_destroy(&queue->entity);
if (queue->scheduler.ops)
drm_sched_fini(&queue->scheduler);
@@ -3558,11 +3557,6 @@ int panthor_group_destroy(struct panthor_file *pfile, u32 group_handle)
if (!group)
return -EINVAL;
- for (u32 i = 0; i < group->queue_count; i++) {
- if (group->queues[i])
- drm_sched_entity_destroy(&group->queues[i]->entity);
- }
-
mutex_lock(&sched->reset.lock);
mutex_lock(&sched->lock);
group->destroyed = true;
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 095/143] platform/x86: lg-laptop: Fix WMAB call in fan_mode_store()
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 094/143] drm/panthor: Defer scheduler entitiy destruction to queue release Greg Kroah-Hartman
@ 2025-09-30 14:46 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 096/143] smb: client: fix wrong index reference in smb2_compound_op() Greg Kroah-Hartman
` (59 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:46 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Lee, Ilpo Järvinen,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Lee <dany97@live.ca>
[ Upstream commit 3ed17349f18774c24505b0c21dfbd3cc4f126518 ]
When WMAB is called to set the fan mode, the new mode is read from either
bits 0-1 or bits 4-5 (depending on the value of some other EC register).
Thus when WMAB is called with bits 4-5 zeroed and called again with
bits 0-1 zeroed, the second call undoes the effect of the first call.
This causes writes to /sys/devices/platform/lg-laptop/fan_mode to have
no effect (and causes reads to always report a status of zero).
Fix this by calling WMAB once, with the mode set in bits 0,1 and 4,5.
When the fan mode is returned from WMAB it always has this form, so
there is no need to preserve the other bits. As a bonus, the driver
now supports the "Performance" fan mode seen in the LG-provided Windows
control app, which provides less aggressive CPU throttling but louder
fan noise and shorter battery life.
Also, correct the documentation to reflect that 0 corresponds to the
default mode (what the Windows app calls "Optimal") and 1 corresponds
to the silent mode.
Fixes: dbf0c5a6b1f8 ("platform/x86: Add LG Gram laptop special features driver")
Link: https://bugzilla.kernel.org/show_bug.cgi?id=204913#c4
Signed-off-by: Daniel Lee <dany97@live.ca>
Link: https://patch.msgid.link/MN2PR06MB55989CB10E91C8DA00EE868DDC1CA@MN2PR06MB5598.namprd06.prod.outlook.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../admin-guide/laptops/lg-laptop.rst | 4 +--
drivers/platform/x86/lg-laptop.c | 34 ++++++++-----------
2 files changed, 16 insertions(+), 22 deletions(-)
diff --git a/Documentation/admin-guide/laptops/lg-laptop.rst b/Documentation/admin-guide/laptops/lg-laptop.rst
index 67fd6932cef4f..c4dd534f91edd 100644
--- a/Documentation/admin-guide/laptops/lg-laptop.rst
+++ b/Documentation/admin-guide/laptops/lg-laptop.rst
@@ -48,8 +48,8 @@ This value is reset to 100 when the kernel boots.
Fan mode
--------
-Writing 1/0 to /sys/devices/platform/lg-laptop/fan_mode disables/enables
-the fan silent mode.
+Writing 0/1/2 to /sys/devices/platform/lg-laptop/fan_mode sets fan mode to
+Optimal/Silent/Performance respectively.
USB charge
diff --git a/drivers/platform/x86/lg-laptop.c b/drivers/platform/x86/lg-laptop.c
index 4b57102c7f627..6af6cf477c5b5 100644
--- a/drivers/platform/x86/lg-laptop.c
+++ b/drivers/platform/x86/lg-laptop.c
@@ -8,6 +8,7 @@
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <linux/acpi.h>
+#include <linux/bitfield.h>
#include <linux/bits.h>
#include <linux/device.h>
#include <linux/dev_printk.h>
@@ -75,6 +76,9 @@ MODULE_PARM_DESC(fw_debug, "Enable printing of firmware debug messages");
#define WMBB_USB_CHARGE 0x10B
#define WMBB_BATT_LIMIT 0x10C
+#define FAN_MODE_LOWER GENMASK(1, 0)
+#define FAN_MODE_UPPER GENMASK(5, 4)
+
#define PLATFORM_NAME "lg-laptop"
MODULE_ALIAS("wmi:" WMI_EVENT_GUID0);
@@ -274,29 +278,19 @@ static ssize_t fan_mode_store(struct device *dev,
struct device_attribute *attr,
const char *buffer, size_t count)
{
- bool value;
+ unsigned long value;
union acpi_object *r;
- u32 m;
int ret;
- ret = kstrtobool(buffer, &value);
+ ret = kstrtoul(buffer, 10, &value);
if (ret)
return ret;
+ if (value >= 3)
+ return -EINVAL;
- r = lg_wmab(dev, WM_FAN_MODE, WM_GET, 0);
- if (!r)
- return -EIO;
-
- if (r->type != ACPI_TYPE_INTEGER) {
- kfree(r);
- return -EIO;
- }
-
- m = r->integer.value;
- kfree(r);
- r = lg_wmab(dev, WM_FAN_MODE, WM_SET, (m & 0xffffff0f) | (value << 4));
- kfree(r);
- r = lg_wmab(dev, WM_FAN_MODE, WM_SET, (m & 0xfffffff0) | value);
+ r = lg_wmab(dev, WM_FAN_MODE, WM_SET,
+ FIELD_PREP(FAN_MODE_LOWER, value) |
+ FIELD_PREP(FAN_MODE_UPPER, value));
kfree(r);
return count;
@@ -305,7 +299,7 @@ static ssize_t fan_mode_store(struct device *dev,
static ssize_t fan_mode_show(struct device *dev,
struct device_attribute *attr, char *buffer)
{
- unsigned int status;
+ unsigned int mode;
union acpi_object *r;
r = lg_wmab(dev, WM_FAN_MODE, WM_GET, 0);
@@ -317,10 +311,10 @@ static ssize_t fan_mode_show(struct device *dev,
return -EIO;
}
- status = r->integer.value & 0x01;
+ mode = FIELD_GET(FAN_MODE_LOWER, r->integer.value);
kfree(r);
- return sysfs_emit(buffer, "%d\n", status);
+ return sysfs_emit(buffer, "%d\n", mode);
}
static ssize_t usb_charge_store(struct device *dev,
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 096/143] smb: client: fix wrong index reference in smb2_compound_op()
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2025-09-30 14:46 ` [PATCH 6.16 095/143] platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 097/143] Revert "drm/xe/guc: Set RCS/CCS yield policy" Greg Kroah-Hartman
` (58 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paulo Alcantara (Red Hat),
Sang-Heon Jeon, Steve French, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sang-Heon Jeon <ekffu200098@gmail.com>
[ Upstream commit fbe2dc6a9c7318f7263f5e4d50f6272b931c5756 ]
In smb2_compound_op(), the loop that processes each command's response
uses wrong indices when accessing response bufferes.
This incorrect indexing leads to improper handling of command results.
Also, if incorrectly computed index is greather than or equal to
MAX_COMPOUND, it can cause out-of-bounds accesses.
Fixes: 3681c74d342d ("smb: client: handle lack of EA support in smb2_query_path_info()") # 6.14
Reviewed-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/smb/client/smb2inode.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c
index 86cad8ee8e6f3..ac3ce183bd59a 100644
--- a/fs/smb/client/smb2inode.c
+++ b/fs/smb/client/smb2inode.c
@@ -687,7 +687,7 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon,
}
for (i = 0; i < num_cmds; i++) {
- char *buf = rsp_iov[i + i].iov_base;
+ char *buf = rsp_iov[i + 1].iov_base;
if (buf && resp_buftype[i + 1] != CIFS_NO_BUFFER)
rc = server->ops->map_error(buf, false);
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 097/143] Revert "drm/xe/guc: Set RCS/CCS yield policy"
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 096/143] smb: client: fix wrong index reference in smb2_compound_op() Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 098/143] Revert "drm/xe/guc: Enable extended CAT error reporting" Greg Kroah-Hartman
` (57 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Iyán Méndez Veiga,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
This reverts commit dd1a415dcfd5984bf83abd804c3cd9e0ff9dde30.
Reported-by: Iyán Méndez Veiga <me@iyanmv.com>
Link: https://lore.kernel.org/stable/aNlW7ekiC0dNPxU3@laps/T/#t
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/xe/abi/guc_actions_abi.h | 1 -
drivers/gpu/drm/xe/abi/guc_klvs_abi.h | 25 ---------
drivers/gpu/drm/xe/xe_gt.c | 3 +-
drivers/gpu/drm/xe/xe_guc.c | 6 ++-
drivers/gpu/drm/xe/xe_guc_submit.c | 66 ------------------------
drivers/gpu/drm/xe/xe_guc_submit.h | 2 -
6 files changed, 5 insertions(+), 98 deletions(-)
diff --git a/drivers/gpu/drm/xe/abi/guc_actions_abi.h b/drivers/gpu/drm/xe/abi/guc_actions_abi.h
index 4d9896e14649c..b55d4cfb483a1 100644
--- a/drivers/gpu/drm/xe/abi/guc_actions_abi.h
+++ b/drivers/gpu/drm/xe/abi/guc_actions_abi.h
@@ -117,7 +117,6 @@ enum xe_guc_action {
XE_GUC_ACTION_ENTER_S_STATE = 0x501,
XE_GUC_ACTION_EXIT_S_STATE = 0x502,
XE_GUC_ACTION_GLOBAL_SCHED_POLICY_CHANGE = 0x506,
- XE_GUC_ACTION_UPDATE_SCHEDULING_POLICIES_KLV = 0x509,
XE_GUC_ACTION_SCHED_CONTEXT = 0x1000,
XE_GUC_ACTION_SCHED_CONTEXT_MODE_SET = 0x1001,
XE_GUC_ACTION_SCHED_CONTEXT_MODE_DONE = 0x1002,
diff --git a/drivers/gpu/drm/xe/abi/guc_klvs_abi.h b/drivers/gpu/drm/xe/abi/guc_klvs_abi.h
index 89034bc97ec5a..5b2502bec2dcc 100644
--- a/drivers/gpu/drm/xe/abi/guc_klvs_abi.h
+++ b/drivers/gpu/drm/xe/abi/guc_klvs_abi.h
@@ -17,7 +17,6 @@
* | 0 | 31:16 | **KEY** - KLV key identifier |
* | | | - `GuC Self Config KLVs`_ |
* | | | - `GuC Opt In Feature KLVs`_ |
- * | | | - `GuC Scheduling Policies KLVs`_ |
* | | | - `GuC VGT Policy KLVs`_ |
* | | | - `GuC VF Configuration KLVs`_ |
* | | | |
@@ -140,30 +139,6 @@ enum {
#define GUC_KLV_OPT_IN_FEATURE_EXT_CAT_ERR_TYPE_KEY 0x4001
#define GUC_KLV_OPT_IN_FEATURE_EXT_CAT_ERR_TYPE_LEN 0u
-/**
- * DOC: GuC Scheduling Policies KLVs
- *
- * `GuC KLV`_ keys available for use with UPDATE_SCHEDULING_POLICIES_KLV.
- *
- * _`GUC_KLV_SCHEDULING_POLICIES_RENDER_COMPUTE_YIELD` : 0x1001
- * Some platforms do not allow concurrent execution of RCS and CCS
- * workloads from different address spaces. By default, the GuC prioritizes
- * RCS submissions over CCS ones, which can lead to CCS workloads being
- * significantly (or completely) starved of execution time. This KLV allows
- * the driver to specify a quantum (in ms) and a ratio (percentage value
- * between 0 and 100), and the GuC will prioritize the CCS for that
- * percentage of each quantum. For example, specifying 100ms and 30% will
- * make the GuC prioritize the CCS for 30ms of every 100ms.
- * Note that this does not necessarly mean that RCS and CCS engines will
- * only be active for their percentage of the quantum, as the restriction
- * only kicks in if both classes are fully busy with non-compatible address
- * spaces; i.e., if one engine is idle or running the same address space,
- * a pending job on the other engine will still be submitted to the HW no
- * matter what the ratio is
- */
-#define GUC_KLV_SCHEDULING_POLICIES_RENDER_COMPUTE_YIELD_KEY 0x1001
-#define GUC_KLV_SCHEDULING_POLICIES_RENDER_COMPUTE_YIELD_LEN 2u
-
/**
* DOC: GuC VGT Policy KLVs
*
diff --git a/drivers/gpu/drm/xe/xe_gt.c b/drivers/gpu/drm/xe/xe_gt.c
index eaf7569a7c1d1..e3517ce2e18c1 100644
--- a/drivers/gpu/drm/xe/xe_gt.c
+++ b/drivers/gpu/drm/xe/xe_gt.c
@@ -41,7 +41,6 @@
#include "xe_gt_topology.h"
#include "xe_guc_exec_queue_types.h"
#include "xe_guc_pc.h"
-#include "xe_guc_submit.h"
#include "xe_hw_fence.h"
#include "xe_hw_engine_class_sysfs.h"
#include "xe_irq.h"
@@ -98,7 +97,7 @@ void xe_gt_sanitize(struct xe_gt *gt)
* FIXME: if xe_uc_sanitize is called here, on TGL driver will not
* reload
*/
- xe_guc_submit_disable(>->uc.guc);
+ gt->uc.guc.submission_state.enabled = false;
}
static void xe_gt_enable_host_l2_vram(struct xe_gt *gt)
diff --git a/drivers/gpu/drm/xe/xe_guc.c b/drivers/gpu/drm/xe/xe_guc.c
index b9d21fdaad48b..2efc0298e1a4c 100644
--- a/drivers/gpu/drm/xe/xe_guc.c
+++ b/drivers/gpu/drm/xe/xe_guc.c
@@ -825,7 +825,9 @@ int xe_guc_post_load_init(struct xe_guc *guc)
return ret;
}
- return xe_guc_submit_enable(guc);
+ guc->submission_state.enabled = true;
+
+ return 0;
}
int xe_guc_reset(struct xe_guc *guc)
@@ -1519,7 +1521,7 @@ void xe_guc_sanitize(struct xe_guc *guc)
{
xe_uc_fw_sanitize(&guc->fw);
xe_guc_ct_disable(&guc->ct);
- xe_guc_submit_disable(guc);
+ guc->submission_state.enabled = false;
}
int xe_guc_reset_prepare(struct xe_guc *guc)
diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c
index 18ddbb7b98a15..e670dcb0f0932 100644
--- a/drivers/gpu/drm/xe/xe_guc_submit.c
+++ b/drivers/gpu/drm/xe/xe_guc_submit.c
@@ -32,7 +32,6 @@
#include "xe_guc_ct.h"
#include "xe_guc_exec_queue_types.h"
#include "xe_guc_id_mgr.h"
-#include "xe_guc_klv_helpers.h"
#include "xe_guc_submit_types.h"
#include "xe_hw_engine.h"
#include "xe_hw_fence.h"
@@ -317,71 +316,6 @@ int xe_guc_submit_init(struct xe_guc *guc, unsigned int num_ids)
return drmm_add_action_or_reset(&xe->drm, guc_submit_fini, guc);
}
-/*
- * Given that we want to guarantee enough RCS throughput to avoid missing
- * frames, we set the yield policy to 20% of each 80ms interval.
- */
-#define RC_YIELD_DURATION 80 /* in ms */
-#define RC_YIELD_RATIO 20 /* in percent */
-static u32 *emit_render_compute_yield_klv(u32 *emit)
-{
- *emit++ = PREP_GUC_KLV_TAG(SCHEDULING_POLICIES_RENDER_COMPUTE_YIELD);
- *emit++ = RC_YIELD_DURATION;
- *emit++ = RC_YIELD_RATIO;
-
- return emit;
-}
-
-#define SCHEDULING_POLICY_MAX_DWORDS 16
-static int guc_init_global_schedule_policy(struct xe_guc *guc)
-{
- u32 data[SCHEDULING_POLICY_MAX_DWORDS];
- u32 *emit = data;
- u32 count = 0;
- int ret;
-
- if (GUC_SUBMIT_VER(guc) < MAKE_GUC_VER(1, 1, 0))
- return 0;
-
- *emit++ = XE_GUC_ACTION_UPDATE_SCHEDULING_POLICIES_KLV;
-
- if (CCS_MASK(guc_to_gt(guc)))
- emit = emit_render_compute_yield_klv(emit);
-
- count = emit - data;
- if (count > 1) {
- xe_assert(guc_to_xe(guc), count <= SCHEDULING_POLICY_MAX_DWORDS);
-
- ret = xe_guc_ct_send_block(&guc->ct, data, count);
- if (ret < 0) {
- xe_gt_err(guc_to_gt(guc),
- "failed to enable GuC sheduling policies: %pe\n",
- ERR_PTR(ret));
- return ret;
- }
- }
-
- return 0;
-}
-
-int xe_guc_submit_enable(struct xe_guc *guc)
-{
- int ret;
-
- ret = guc_init_global_schedule_policy(guc);
- if (ret)
- return ret;
-
- guc->submission_state.enabled = true;
-
- return 0;
-}
-
-void xe_guc_submit_disable(struct xe_guc *guc)
-{
- guc->submission_state.enabled = false;
-}
-
static void __release_guc_id(struct xe_guc *guc, struct xe_exec_queue *q, u32 xa_count)
{
int i;
diff --git a/drivers/gpu/drm/xe/xe_guc_submit.h b/drivers/gpu/drm/xe/xe_guc_submit.h
index 0d126b807c104..9b71a986c6ca6 100644
--- a/drivers/gpu/drm/xe/xe_guc_submit.h
+++ b/drivers/gpu/drm/xe/xe_guc_submit.h
@@ -13,8 +13,6 @@ struct xe_exec_queue;
struct xe_guc;
int xe_guc_submit_init(struct xe_guc *guc, unsigned int num_ids);
-int xe_guc_submit_enable(struct xe_guc *guc);
-void xe_guc_submit_disable(struct xe_guc *guc);
int xe_guc_submit_reset_prepare(struct xe_guc *guc);
void xe_guc_submit_reset_wait(struct xe_guc *guc);
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 098/143] Revert "drm/xe/guc: Enable extended CAT error reporting"
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 097/143] Revert "drm/xe/guc: Set RCS/CCS yield policy" Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 099/143] tracing/osnoise: Fix slab-out-of-bounds in _parse_integer_limit() Greg Kroah-Hartman
` (56 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Iyán Méndez Veiga,
Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
This reverts commit a7ffcea8631af91479cab10aa7fbfd0722f01d9a.
Reported-by: Iyán Méndez Veiga <me@iyanmv.com>
Link: https://lore.kernel.org/stable/aNlW7ekiC0dNPxU3@laps/T/#t
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/xe/abi/guc_actions_abi.h | 4 --
drivers/gpu/drm/xe/abi/guc_klvs_abi.h | 15 -------
drivers/gpu/drm/xe/xe_guc.c | 56 ------------------------
drivers/gpu/drm/xe/xe_guc.h | 1 -
drivers/gpu/drm/xe/xe_guc_submit.c | 21 ++-------
drivers/gpu/drm/xe/xe_uc.c | 4 --
6 files changed, 3 insertions(+), 98 deletions(-)
diff --git a/drivers/gpu/drm/xe/abi/guc_actions_abi.h b/drivers/gpu/drm/xe/abi/guc_actions_abi.h
index b55d4cfb483a1..448afb86e05c7 100644
--- a/drivers/gpu/drm/xe/abi/guc_actions_abi.h
+++ b/drivers/gpu/drm/xe/abi/guc_actions_abi.h
@@ -142,7 +142,6 @@ enum xe_guc_action {
XE_GUC_ACTION_SET_ENG_UTIL_BUFF = 0x550A,
XE_GUC_ACTION_SET_DEVICE_ENGINE_ACTIVITY_BUFFER = 0x550C,
XE_GUC_ACTION_SET_FUNCTION_ENGINE_ACTIVITY_BUFFER = 0x550D,
- XE_GUC_ACTION_OPT_IN_FEATURE_KLV = 0x550E,
XE_GUC_ACTION_NOTIFY_MEMORY_CAT_ERROR = 0x6000,
XE_GUC_ACTION_REPORT_PAGE_FAULT_REQ_DESC = 0x6002,
XE_GUC_ACTION_PAGE_FAULT_RES_DESC = 0x6003,
@@ -241,7 +240,4 @@ enum xe_guc_g2g_type {
#define XE_G2G_DEREGISTER_TILE REG_GENMASK(15, 12)
#define XE_G2G_DEREGISTER_TYPE REG_GENMASK(11, 8)
-/* invalid type for XE_GUC_ACTION_NOTIFY_MEMORY_CAT_ERROR */
-#define XE_GUC_CAT_ERR_TYPE_INVALID 0xdeadbeef
-
#endif
diff --git a/drivers/gpu/drm/xe/abi/guc_klvs_abi.h b/drivers/gpu/drm/xe/abi/guc_klvs_abi.h
index 5b2502bec2dcc..7de8f827281fc 100644
--- a/drivers/gpu/drm/xe/abi/guc_klvs_abi.h
+++ b/drivers/gpu/drm/xe/abi/guc_klvs_abi.h
@@ -16,7 +16,6 @@
* +===+=======+==============================================================+
* | 0 | 31:16 | **KEY** - KLV key identifier |
* | | | - `GuC Self Config KLVs`_ |
- * | | | - `GuC Opt In Feature KLVs`_ |
* | | | - `GuC VGT Policy KLVs`_ |
* | | | - `GuC VF Configuration KLVs`_ |
* | | | |
@@ -125,20 +124,6 @@ enum {
GUC_CONTEXT_POLICIES_KLV_NUM_IDS = 5,
};
-/**
- * DOC: GuC Opt In Feature KLVs
- *
- * `GuC KLV`_ keys available for use with OPT_IN_FEATURE_KLV
- *
- * _`GUC_KLV_OPT_IN_FEATURE_EXT_CAT_ERR_TYPE` : 0x4001
- * Adds an extra dword to the XE_GUC_ACTION_NOTIFY_MEMORY_CAT_ERROR G2H
- * containing the type of the CAT error. On HW that does not support
- * reporting the CAT error type, the extra dword is set to 0xdeadbeef.
- */
-
-#define GUC_KLV_OPT_IN_FEATURE_EXT_CAT_ERR_TYPE_KEY 0x4001
-#define GUC_KLV_OPT_IN_FEATURE_EXT_CAT_ERR_TYPE_LEN 0u
-
/**
* DOC: GuC VGT Policy KLVs
*
diff --git a/drivers/gpu/drm/xe/xe_guc.c b/drivers/gpu/drm/xe/xe_guc.c
index 2efc0298e1a4c..bac5471a1a780 100644
--- a/drivers/gpu/drm/xe/xe_guc.c
+++ b/drivers/gpu/drm/xe/xe_guc.c
@@ -29,7 +29,6 @@
#include "xe_guc_db_mgr.h"
#include "xe_guc_engine_activity.h"
#include "xe_guc_hwconfig.h"
-#include "xe_guc_klv_helpers.h"
#include "xe_guc_log.h"
#include "xe_guc_pc.h"
#include "xe_guc_relay.h"
@@ -571,57 +570,6 @@ static int guc_g2g_start(struct xe_guc *guc)
return err;
}
-static int __guc_opt_in_features_enable(struct xe_guc *guc, u64 addr, u32 num_dwords)
-{
- u32 action[] = {
- XE_GUC_ACTION_OPT_IN_FEATURE_KLV,
- lower_32_bits(addr),
- upper_32_bits(addr),
- num_dwords
- };
-
- return xe_guc_ct_send_block(&guc->ct, action, ARRAY_SIZE(action));
-}
-
-#define OPT_IN_MAX_DWORDS 16
-int xe_guc_opt_in_features_enable(struct xe_guc *guc)
-{
- struct xe_device *xe = guc_to_xe(guc);
- CLASS(xe_guc_buf, buf)(&guc->buf, OPT_IN_MAX_DWORDS);
- u32 count = 0;
- u32 *klvs;
- int ret;
-
- if (!xe_guc_buf_is_valid(buf))
- return -ENOBUFS;
-
- klvs = xe_guc_buf_cpu_ptr(buf);
-
- /*
- * The extra CAT error type opt-in was added in GuC v70.17.0, which maps
- * to compatibility version v1.7.0.
- * Note that the GuC allows enabling this KLV even on platforms that do
- * not support the extra type; in such case the returned type variable
- * will be set to a known invalid value which we can check against.
- */
- if (GUC_SUBMIT_VER(guc) >= MAKE_GUC_VER(1, 7, 0))
- klvs[count++] = PREP_GUC_KLV_TAG(OPT_IN_FEATURE_EXT_CAT_ERR_TYPE);
-
- if (count) {
- xe_assert(xe, count <= OPT_IN_MAX_DWORDS);
-
- ret = __guc_opt_in_features_enable(guc, xe_guc_buf_flush(buf), count);
- if (ret < 0) {
- xe_gt_err(guc_to_gt(guc),
- "failed to enable GuC opt-in features: %pe\n",
- ERR_PTR(ret));
- return ret;
- }
- }
-
- return 0;
-}
-
static void guc_fini_hw(void *arg)
{
struct xe_guc *guc = arg;
@@ -815,10 +763,6 @@ int xe_guc_post_load_init(struct xe_guc *guc)
xe_guc_ads_populate_post_load(&guc->ads);
- ret = xe_guc_opt_in_features_enable(guc);
- if (ret)
- return ret;
-
if (xe_guc_g2g_wanted(guc_to_xe(guc))) {
ret = guc_g2g_start(guc);
if (ret)
diff --git a/drivers/gpu/drm/xe/xe_guc.h b/drivers/gpu/drm/xe/xe_guc.h
index 4a66575f017d2..58338be445585 100644
--- a/drivers/gpu/drm/xe/xe_guc.h
+++ b/drivers/gpu/drm/xe/xe_guc.h
@@ -33,7 +33,6 @@ int xe_guc_reset(struct xe_guc *guc);
int xe_guc_upload(struct xe_guc *guc);
int xe_guc_min_load_for_hwconfig(struct xe_guc *guc);
int xe_guc_enable_communication(struct xe_guc *guc);
-int xe_guc_opt_in_features_enable(struct xe_guc *guc);
int xe_guc_suspend(struct xe_guc *guc);
void xe_guc_notify(struct xe_guc *guc);
int xe_guc_auth_huc(struct xe_guc *guc, u32 rsa_addr);
diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c
index e670dcb0f0932..45a21af126927 100644
--- a/drivers/gpu/drm/xe/xe_guc_submit.c
+++ b/drivers/gpu/drm/xe/xe_guc_submit.c
@@ -2088,16 +2088,12 @@ int xe_guc_exec_queue_memory_cat_error_handler(struct xe_guc *guc, u32 *msg,
struct xe_gt *gt = guc_to_gt(guc);
struct xe_exec_queue *q;
u32 guc_id;
- u32 type = XE_GUC_CAT_ERR_TYPE_INVALID;
- if (unlikely(!len || len > 2))
+ if (unlikely(len < 1))
return -EPROTO;
guc_id = msg[0];
- if (len == 2)
- type = msg[1];
-
if (guc_id == GUC_ID_UNKNOWN) {
/*
* GuC uses GUC_ID_UNKNOWN if it can not map the CAT fault to any PF/VF
@@ -2111,19 +2107,8 @@ int xe_guc_exec_queue_memory_cat_error_handler(struct xe_guc *guc, u32 *msg,
if (unlikely(!q))
return -EPROTO;
- /*
- * The type is HW-defined and changes based on platform, so we don't
- * decode it in the kernel and only check if it is valid.
- * See bspec 54047 and 72187 for details.
- */
- if (type != XE_GUC_CAT_ERR_TYPE_INVALID)
- xe_gt_dbg(gt,
- "Engine memory CAT error [%u]: class=%s, logical_mask: 0x%x, guc_id=%d",
- type, xe_hw_engine_class_to_str(q->class), q->logical_mask, guc_id);
- else
- xe_gt_dbg(gt,
- "Engine memory CAT error: class=%s, logical_mask: 0x%x, guc_id=%d",
- xe_hw_engine_class_to_str(q->class), q->logical_mask, guc_id);
+ xe_gt_dbg(gt, "Engine memory cat error: engine_class=%s, logical_mask: 0x%x, guc_id=%d",
+ xe_hw_engine_class_to_str(q->class), q->logical_mask, guc_id);
trace_xe_exec_queue_memory_cat_error(q);
diff --git a/drivers/gpu/drm/xe/xe_uc.c b/drivers/gpu/drm/xe/xe_uc.c
index 5c45b0f072a4c..3a8751a8b92dd 100644
--- a/drivers/gpu/drm/xe/xe_uc.c
+++ b/drivers/gpu/drm/xe/xe_uc.c
@@ -165,10 +165,6 @@ static int vf_uc_init_hw(struct xe_uc *uc)
uc->guc.submission_state.enabled = true;
- err = xe_guc_opt_in_features_enable(&uc->guc);
- if (err)
- return err;
-
err = xe_gt_record_default_lrcs(uc_to_gt(uc));
if (err)
return err;
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 099/143] tracing/osnoise: Fix slab-out-of-bounds in _parse_integer_limit()
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 098/143] Revert "drm/xe/guc: Enable extended CAT error reporting" Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 100/143] HID: intel-thc-hid: intel-quickspi: Add WCL Device IDs Greg Kroah-Hartman
` (55 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, mhiramat, mathieu.desnoyers, tglozar,
Wang Liang, Steven Rostedt (Google), Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Liang <wangliang74@huawei.com>
[ Upstream commit a2501032de0d1bc7971b2e43c03da534ac10ee9b ]
When config osnoise cpus by write() syscall, the following KASAN splat may
be observed:
BUG: KASAN: slab-out-of-bounds in _parse_integer_limit+0x103/0x130
Read of size 1 at addr ffff88810121e3a1 by task test/447
CPU: 1 UID: 0 PID: 447 Comm: test Not tainted 6.17.0-rc6-dirty #288 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x55/0x70
print_report+0xcb/0x610
kasan_report+0xb8/0xf0
_parse_integer_limit+0x103/0x130
bitmap_parselist+0x16d/0x6f0
osnoise_cpus_write+0x116/0x2d0
vfs_write+0x21e/0xcc0
ksys_write+0xee/0x1c0
do_syscall_64+0xa8/0x2a0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
This issue can be reproduced by below code:
const char *cpulist = "1";
int fd=open("/sys/kernel/debug/tracing/osnoise/cpus", O_WRONLY);
write(fd, cpulist, strlen(cpulist));
Function bitmap_parselist() was called to parse cpulist, it require that
the parameter 'buf' must be terminated with a '\0' or '\n'. Fix this issue
by adding a '\0' to 'buf' in osnoise_cpus_write().
Cc: <mhiramat@kernel.org>
Cc: <mathieu.desnoyers@efficios.com>
Cc: <tglozar@redhat.com>
Link: https://lore.kernel.org/20250916063948.3154627-1-wangliang74@huawei.com
Fixes: 17f89102fe23 ("tracing/osnoise: Allow arbitrarily long CPU string")
Signed-off-by: Wang Liang <wangliang74@huawei.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/trace_osnoise.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/kernel/trace/trace_osnoise.c b/kernel/trace/trace_osnoise.c
index 337bc0eb5d71b..dc734867f0fc4 100644
--- a/kernel/trace/trace_osnoise.c
+++ b/kernel/trace/trace_osnoise.c
@@ -2325,12 +2325,13 @@ osnoise_cpus_write(struct file *filp, const char __user *ubuf, size_t count,
if (count < 1)
return 0;
- buf = kmalloc(count, GFP_KERNEL);
+ buf = kmalloc(count + 1, GFP_KERNEL);
if (!buf)
return -ENOMEM;
if (copy_from_user(buf, ubuf, count))
return -EFAULT;
+ buf[count] = '\0';
if (!zalloc_cpumask_var(&osnoise_cpumask_new, GFP_KERNEL))
return -ENOMEM;
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 100/143] HID: intel-thc-hid: intel-quickspi: Add WCL Device IDs
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 099/143] tracing/osnoise: Fix slab-out-of-bounds in _parse_integer_limit() Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 101/143] HID: asus: add support for missing PX series fn keys Greg Kroah-Hartman
` (54 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xinpeng Sun, Even Xu, Jiri Kosina
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xinpeng Sun <xinpeng.sun@intel.com>
commit cc54ed51c761728f6933cca889b684ed7fbaaf07 upstream.
Add THC SPI WildcatLake device IDs.
Signed-off-by: Xinpeng Sun <xinpeng.sun@intel.com>
Reviewed-by: Even Xu <even.xu@intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c | 2 ++
drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h | 2 ++
2 files changed, 4 insertions(+)
--- a/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
+++ b/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
@@ -961,6 +961,8 @@ static const struct pci_device_id quicks
{PCI_DEVICE_DATA(INTEL, THC_PTL_H_DEVICE_ID_SPI_PORT2, &ptl), },
{PCI_DEVICE_DATA(INTEL, THC_PTL_U_DEVICE_ID_SPI_PORT1, &ptl), },
{PCI_DEVICE_DATA(INTEL, THC_PTL_U_DEVICE_ID_SPI_PORT2, &ptl), },
+ {PCI_DEVICE_DATA(INTEL, THC_WCL_DEVICE_ID_SPI_PORT1, &ptl), },
+ {PCI_DEVICE_DATA(INTEL, THC_WCL_DEVICE_ID_SPI_PORT2, &ptl), },
{}
};
MODULE_DEVICE_TABLE(pci, quickspi_pci_tbl);
--- a/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h
+++ b/drivers/hid/intel-thc-hid/intel-quickspi/quickspi-dev.h
@@ -19,6 +19,8 @@
#define PCI_DEVICE_ID_INTEL_THC_PTL_H_DEVICE_ID_SPI_PORT2 0xE34B
#define PCI_DEVICE_ID_INTEL_THC_PTL_U_DEVICE_ID_SPI_PORT1 0xE449
#define PCI_DEVICE_ID_INTEL_THC_PTL_U_DEVICE_ID_SPI_PORT2 0xE44B
+#define PCI_DEVICE_ID_INTEL_THC_WCL_DEVICE_ID_SPI_PORT1 0x4D49
+#define PCI_DEVICE_ID_INTEL_THC_WCL_DEVICE_ID_SPI_PORT2 0x4D4B
/* HIDSPI special ACPI parameters DSM methods */
#define ACPI_QUICKSPI_REVISION_NUM 2
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 101/143] HID: asus: add support for missing PX series fn keys
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 100/143] HID: intel-thc-hid: intel-quickspi: Add WCL Device IDs Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 102/143] i40e: add validation for ring_len param Greg Kroah-Hartman
` (53 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Amit Chaudhari, Jiri Kosina
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amit Chaudhari <amitchaudhari@mac.com>
commit 831f70a5b93bd2d9e858ced2c12fab5766ede5e7 upstream.
Add support for missing hotkey keycodes affecting Asus PX13 and PX16 families
so userspace can use them.
Signed-off-by: Amit Chaudhari <amitchaudhari@mac.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-asus.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/hid/hid-asus.c
+++ b/drivers/hid/hid-asus.c
@@ -974,7 +974,10 @@ static int asus_input_mapping(struct hid
case 0xc4: asus_map_key_clear(KEY_KBDILLUMUP); break;
case 0xc5: asus_map_key_clear(KEY_KBDILLUMDOWN); break;
case 0xc7: asus_map_key_clear(KEY_KBDILLUMTOGGLE); break;
+ case 0x4e: asus_map_key_clear(KEY_FN_ESC); break;
+ case 0x7e: asus_map_key_clear(KEY_EMOJI_PICKER); break;
+ case 0x8b: asus_map_key_clear(KEY_PROG1); break; /* ProArt Creator Hub key */
case 0x6b: asus_map_key_clear(KEY_F21); break; /* ASUS touchpad toggle */
case 0x38: asus_map_key_clear(KEY_PROG1); break; /* ROG key */
case 0xba: asus_map_key_clear(KEY_PROG2); break; /* Fn+C ASUS Splendid */
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 102/143] i40e: add validation for ring_len param
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 101/143] HID: asus: add support for missing PX series fn keys Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 103/143] i40e: fix idx validation in i40e_validate_queue_map Greg Kroah-Hartman
` (52 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lukasz Czapnik, Aleksandr Loktionov,
Przemek Kitszel, Simon Horman, Rafal Romanowski, Tony Nguyen
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukasz Czapnik <lukasz.czapnik@intel.com>
commit 55d225670def06b01af2e7a5e0446fbe946289e8 upstream.
The `ring_len` parameter provided by the virtual function (VF)
is assigned directly to the hardware memory context (HMC) without
any validation.
To address this, introduce an upper boundary check for both Tx and Rx
queue lengths. The maximum number of descriptors supported by the
hardware is 8k-32.
Additionally, enforce alignment constraints: Tx rings must be a multiple
of 8, and Rx rings must be a multiple of 32.
Fixes: 5c3c48ac6bf5 ("i40e: implement virtual device interface")
Cc: stable@vger.kernel.org
Signed-off-by: Lukasz Czapnik <lukasz.czapnik@intel.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -653,6 +653,13 @@ static int i40e_config_vsi_tx_queue(stru
/* only set the required fields */
tx_ctx.base = info->dma_ring_addr / 128;
+
+ /* ring_len has to be multiple of 8 */
+ if (!IS_ALIGNED(info->ring_len, 8) ||
+ info->ring_len > I40E_MAX_NUM_DESCRIPTORS_XL710) {
+ ret = -EINVAL;
+ goto error_context;
+ }
tx_ctx.qlen = info->ring_len;
tx_ctx.rdylist = le16_to_cpu(vsi->info.qs_handle[0]);
tx_ctx.rdylist_act = 0;
@@ -716,6 +723,13 @@ static int i40e_config_vsi_rx_queue(stru
/* only set the required fields */
rx_ctx.base = info->dma_ring_addr / 128;
+
+ /* ring_len has to be multiple of 32 */
+ if (!IS_ALIGNED(info->ring_len, 32) ||
+ info->ring_len > I40E_MAX_NUM_DESCRIPTORS_XL710) {
+ ret = -EINVAL;
+ goto error_param;
+ }
rx_ctx.qlen = info->ring_len;
if (info->splithdr_enabled) {
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 103/143] i40e: fix idx validation in i40e_validate_queue_map
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 102/143] i40e: add validation for ring_len param Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 104/143] i40e: fix idx validation in config queues msg Greg Kroah-Hartman
` (51 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lukasz Czapnik, Aleksandr Loktionov,
Przemek Kitszel, Simon Horman, Tony Nguyen, Kamakshi Nellore
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukasz Czapnik <lukasz.czapnik@intel.com>
commit aa68d3c3ac8d1dcec40d52ae27e39f6d32207009 upstream.
Ensure idx is within range of active/initialized TCs when iterating over
vf->ch[idx] in i40e_validate_queue_map().
Fixes: c27eac48160d ("i40e: Enable ADq and create queue channel/s on VF")
Cc: stable@vger.kernel.org
Signed-off-by: Lukasz Czapnik <lukasz.czapnik@intel.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Tested-by: Kamakshi Nellore <nellorex.kamakshi@intel.com> (A Contingent Worker at Intel)
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -2469,8 +2469,10 @@ static int i40e_validate_queue_map(struc
u16 vsi_queue_id, queue_id;
for_each_set_bit(vsi_queue_id, &queuemap, I40E_MAX_VSI_QP) {
- if (vf->adq_enabled) {
- vsi_id = vf->ch[vsi_queue_id / I40E_MAX_VF_VSI].vsi_id;
+ u16 idx = vsi_queue_id / I40E_MAX_VF_VSI;
+
+ if (vf->adq_enabled && idx < vf->num_tc) {
+ vsi_id = vf->ch[idx].vsi_id;
queue_id = (vsi_queue_id % I40E_DEFAULT_QUEUES_PER_VF);
} else {
queue_id = vsi_queue_id;
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 104/143] i40e: fix idx validation in config queues msg
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 103/143] i40e: fix idx validation in i40e_validate_queue_map Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 105/143] i40e: fix input validation logic for action_meta Greg Kroah-Hartman
` (50 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lukasz Czapnik, Aleksandr Loktionov,
Przemek Kitszel, Simon Horman, Tony Nguyen, Kamakshi Nellore
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukasz Czapnik <lukasz.czapnik@intel.com>
commit f1ad24c5abe1eaef69158bac1405a74b3c365115 upstream.
Ensure idx is within range of active/initialized TCs when iterating over
vf->ch[idx] in i40e_vc_config_queues_msg().
Fixes: c27eac48160d ("i40e: Enable ADq and create queue channel/s on VF")
Cc: stable@vger.kernel.org
Signed-off-by: Lukasz Czapnik <lukasz.czapnik@intel.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Tested-by: Kamakshi Nellore <nellorex.kamakshi@intel.com> (A Contingent Worker at Intel)
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -2398,7 +2398,7 @@ static int i40e_vc_config_queues_msg(str
}
if (vf->adq_enabled) {
- if (idx >= ARRAY_SIZE(vf->ch)) {
+ if (idx >= vf->num_tc) {
aq_ret = -ENODEV;
goto error_param;
}
@@ -2419,7 +2419,7 @@ static int i40e_vc_config_queues_msg(str
* to its appropriate VSIs based on TC mapping
*/
if (vf->adq_enabled) {
- if (idx >= ARRAY_SIZE(vf->ch)) {
+ if (idx >= vf->num_tc) {
aq_ret = -ENODEV;
goto error_param;
}
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 105/143] i40e: fix input validation logic for action_meta
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 104/143] i40e: fix idx validation in config queues msg Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 106/143] i40e: fix validation of VF state in get resources Greg Kroah-Hartman
` (49 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lukasz Czapnik, Aleksandr Loktionov,
Przemek Kitszel, Simon Horman, Rafal Romanowski, Tony Nguyen
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukasz Czapnik <lukasz.czapnik@intel.com>
commit 9739d5830497812b0bdeaee356ddefbe60830b88 upstream.
Fix condition to check 'greater or equal' to prevent OOB dereference.
Fixes: e284fc280473 ("i40e: Add and delete cloud filter")
Cc: stable@vger.kernel.org
Signed-off-by: Lukasz Czapnik <lukasz.czapnik@intel.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -3605,7 +3605,7 @@ static int i40e_validate_cloud_filter(st
/* action_meta is TC number here to which the filter is applied */
if (!tc_filter->action_meta ||
- tc_filter->action_meta > vf->num_tc) {
+ tc_filter->action_meta >= vf->num_tc) {
dev_info(&pf->pdev->dev, "VF %d: Invalid TC number %u\n",
vf->vf_id, tc_filter->action_meta);
goto err;
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 106/143] i40e: fix validation of VF state in get resources
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 105/143] i40e: fix input validation logic for action_meta Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 107/143] i40e: add max boundary check for VF filters Greg Kroah-Hartman
` (48 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lukasz Czapnik, Aleksandr Loktionov,
Przemek Kitszel, Simon Horman, Rafal Romanowski, Tony Nguyen
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukasz Czapnik <lukasz.czapnik@intel.com>
commit 877b7e6ffc23766448236e8732254534c518ba42 upstream.
VF state I40E_VF_STATE_ACTIVE is not the only state in which
VF is actually active so it should not be used to determine
if a VF is allowed to obtain resources.
Use I40E_VF_STATE_RESOURCES_LOADED that is set only in
i40e_vc_get_vf_resources_msg() and cleared during reset.
Fixes: 61125b8be85d ("i40e: Fix failed opcode appearing if handling messages from VF")
Cc: stable@vger.kernel.org
Signed-off-by: Lukasz Czapnik <lukasz.czapnik@intel.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 7 ++++++-
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h | 3 ++-
2 files changed, 8 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -1467,6 +1467,7 @@ static void i40e_trigger_vf_reset(struct
* functions that may still be running at this point.
*/
clear_bit(I40E_VF_STATE_INIT, &vf->vf_states);
+ clear_bit(I40E_VF_STATE_RESOURCES_LOADED, &vf->vf_states);
/* In the case of a VFLR, the HW has already reset the VF and we
* just need to clean up, so don't hit the VFRTRIG register.
@@ -2133,7 +2134,10 @@ static int i40e_vc_get_vf_resources_msg(
size_t len = 0;
int ret;
- if (!i40e_sync_vf_state(vf, I40E_VF_STATE_INIT)) {
+ i40e_sync_vf_state(vf, I40E_VF_STATE_INIT);
+
+ if (!test_bit(I40E_VF_STATE_INIT, &vf->vf_states) ||
+ test_bit(I40E_VF_STATE_RESOURCES_LOADED, &vf->vf_states)) {
aq_ret = -EINVAL;
goto err;
}
@@ -2236,6 +2240,7 @@ static int i40e_vc_get_vf_resources_msg(
vf->default_lan_addr.addr);
}
set_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states);
+ set_bit(I40E_VF_STATE_RESOURCES_LOADED, &vf->vf_states);
err:
/* send the response back to the VF */
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.h
@@ -41,7 +41,8 @@ enum i40e_vf_states {
I40E_VF_STATE_MC_PROMISC,
I40E_VF_STATE_UC_PROMISC,
I40E_VF_STATE_PRE_ENABLE,
- I40E_VF_STATE_RESETTING
+ I40E_VF_STATE_RESETTING,
+ I40E_VF_STATE_RESOURCES_LOADED,
};
/* VF capabilities */
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 107/143] i40e: add max boundary check for VF filters
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 106/143] i40e: fix validation of VF state in get resources Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 108/143] i40e: add mask to apply valid bits for itr_idx Greg Kroah-Hartman
` (47 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lukasz Czapnik, Aleksandr Loktionov,
Przemek Kitszel, Simon Horman, Rafal Romanowski, Tony Nguyen
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukasz Czapnik <lukasz.czapnik@intel.com>
commit cb79fa7118c150c3c76a327894bb2eb878c02619 upstream.
There is no check for max filters that VF can request. Add it.
Fixes: e284fc280473 ("i40e: Add and delete cloud filter")
Cc: stable@vger.kernel.org
Signed-off-by: Lukasz Czapnik <lukasz.czapnik@intel.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -3908,6 +3908,8 @@ err:
aq_ret);
}
+#define I40E_MAX_VF_CLOUD_FILTER 0xFF00
+
/**
* i40e_vc_add_cloud_filter
* @vf: pointer to the VF info
@@ -3947,6 +3949,14 @@ static int i40e_vc_add_cloud_filter(stru
goto err_out;
}
+ if (vf->num_cloud_filters >= I40E_MAX_VF_CLOUD_FILTER) {
+ dev_warn(&pf->pdev->dev,
+ "VF %d: Max number of filters reached, can't apply cloud filter\n",
+ vf->vf_id);
+ aq_ret = -ENOSPC;
+ goto err_out;
+ }
+
cfilter = kzalloc(sizeof(*cfilter), GFP_KERNEL);
if (!cfilter) {
aq_ret = -ENOMEM;
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 108/143] i40e: add mask to apply valid bits for itr_idx
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 107/143] i40e: add max boundary check for VF filters Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 109/143] i40e: improve VF MAC filters accounting Greg Kroah-Hartman
` (46 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lukasz Czapnik, Aleksandr Loktionov,
Przemek Kitszel, Simon Horman, Rafal Romanowski, Tony Nguyen
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukasz Czapnik <lukasz.czapnik@intel.com>
commit eac04428abe9f9cb203ffae4600791ea1d24eb18 upstream.
The ITR index (itr_idx) is only 2 bits wide. When constructing the
register value for QINT_RQCTL, all fields are ORed together. Without
masking, higher bits from itr_idx may overwrite adjacent fields in the
register.
Apply I40E_QINT_RQCTL_ITR_INDX_MASK to ensure only the intended bits are
set.
Fixes: 5c3c48ac6bf5 ("i40e: implement virtual device interface")
Cc: stable@vger.kernel.org
Signed-off-by: Lukasz Czapnik <lukasz.czapnik@intel.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -448,7 +448,7 @@ static void i40e_config_irq_link_list(st
(qtype << I40E_QINT_RQCTL_NEXTQ_TYPE_SHIFT) |
(pf_queue_id << I40E_QINT_RQCTL_NEXTQ_INDX_SHIFT) |
BIT(I40E_QINT_RQCTL_CAUSE_ENA_SHIFT) |
- (itr_idx << I40E_QINT_RQCTL_ITR_INDX_SHIFT);
+ FIELD_PREP(I40E_QINT_RQCTL_ITR_INDX_MASK, itr_idx);
wr32(hw, reg_idx, reg);
}
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 109/143] i40e: improve VF MAC filters accounting
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 108/143] i40e: add mask to apply valid bits for itr_idx Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 110/143] crypto: af_alg - Fix incorrect boolean values in af_alg_ctx Greg Kroah-Hartman
` (45 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lukasz Czapnik, Aleksandr Loktionov,
Przemek Kitszel, Simon Horman, Rafal Romanowski, Tony Nguyen
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukasz Czapnik <lukasz.czapnik@intel.com>
commit b99dd77076bd3fddac6f7f1cbfa081c38fde17f5 upstream.
When adding new VM MAC, driver checks only *active* filters in
vsi->mac_filter_hash. Each MAC, even in non-active state is using resources.
To determine number of MACs VM uses, count VSI filters in *any* state.
Add i40e_count_all_filters() to simply count all filters, and rename
i40e_count_filters() to i40e_count_active_filters() to avoid ambiguity.
Fixes: cfb1d572c986 ("i40e: Add ensurance of MacVlan resources for every trusted VF")
Cc: stable@vger.kernel.org
Signed-off-by: Lukasz Czapnik <lukasz.czapnik@intel.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/i40e/i40e.h | 3
drivers/net/ethernet/intel/i40e/i40e_main.c | 26 +++++++-
drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 65 ++++++++-------------
3 files changed, 50 insertions(+), 44 deletions(-)
--- a/drivers/net/ethernet/intel/i40e/i40e.h
+++ b/drivers/net/ethernet/intel/i40e/i40e.h
@@ -1277,7 +1277,8 @@ struct i40e_mac_filter *i40e_add_mac_fil
const u8 *macaddr);
int i40e_del_mac_filter(struct i40e_vsi *vsi, const u8 *macaddr);
bool i40e_is_vsi_in_vlan(struct i40e_vsi *vsi);
-int i40e_count_filters(struct i40e_vsi *vsi);
+int i40e_count_all_filters(struct i40e_vsi *vsi);
+int i40e_count_active_filters(struct i40e_vsi *vsi);
struct i40e_mac_filter *i40e_find_mac(struct i40e_vsi *vsi, const u8 *macaddr);
void i40e_vlan_stripping_enable(struct i40e_vsi *vsi);
static inline bool i40e_is_sw_dcb(struct i40e_pf *pf)
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -1241,12 +1241,30 @@ void i40e_update_stats(struct i40e_vsi *
}
/**
- * i40e_count_filters - counts VSI mac filters
+ * i40e_count_all_filters - counts VSI MAC filters
* @vsi: the VSI to be searched
*
- * Returns count of mac filters
- **/
-int i40e_count_filters(struct i40e_vsi *vsi)
+ * Return: count of MAC filters in any state.
+ */
+int i40e_count_all_filters(struct i40e_vsi *vsi)
+{
+ struct i40e_mac_filter *f;
+ struct hlist_node *h;
+ int bkt, cnt = 0;
+
+ hash_for_each_safe(vsi->mac_filter_hash, bkt, h, f, hlist)
+ cnt++;
+
+ return cnt;
+}
+
+/**
+ * i40e_count_active_filters - counts VSI MAC filters
+ * @vsi: the VSI to be searched
+ *
+ * Return: count of active MAC filters.
+ */
+int i40e_count_active_filters(struct i40e_vsi *vsi)
{
struct i40e_mac_filter *f;
struct hlist_node *h;
--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
@@ -2865,24 +2865,6 @@ error_param:
(u8 *)&stats, sizeof(stats));
}
-/**
- * i40e_can_vf_change_mac
- * @vf: pointer to the VF info
- *
- * Return true if the VF is allowed to change its MAC filters, false otherwise
- */
-static bool i40e_can_vf_change_mac(struct i40e_vf *vf)
-{
- /* If the VF MAC address has been set administratively (via the
- * ndo_set_vf_mac command), then deny permission to the VF to
- * add/delete unicast MAC addresses, unless the VF is trusted
- */
- if (vf->pf_set_mac && !vf->trusted)
- return false;
-
- return true;
-}
-
#define I40E_MAX_MACVLAN_PER_HW 3072
#define I40E_MAX_MACVLAN_PER_PF(num_ports) (I40E_MAX_MACVLAN_PER_HW / \
(num_ports))
@@ -2921,8 +2903,10 @@ static inline int i40e_check_vf_permissi
struct i40e_pf *pf = vf->pf;
struct i40e_vsi *vsi = pf->vsi[vf->lan_vsi_idx];
struct i40e_hw *hw = &pf->hw;
- int mac2add_cnt = 0;
- int i;
+ int i, mac_add_max, mac_add_cnt = 0;
+ bool vf_trusted;
+
+ vf_trusted = test_bit(I40E_VIRTCHNL_VF_CAP_PRIVILEGE, &vf->vf_caps);
for (i = 0; i < al->num_elements; i++) {
struct i40e_mac_filter *f;
@@ -2942,9 +2926,8 @@ static inline int i40e_check_vf_permissi
* The VF may request to set the MAC address filter already
* assigned to it so do not return an error in that case.
*/
- if (!i40e_can_vf_change_mac(vf) &&
- !is_multicast_ether_addr(addr) &&
- !ether_addr_equal(addr, vf->default_lan_addr.addr)) {
+ if (!vf_trusted && !is_multicast_ether_addr(addr) &&
+ vf->pf_set_mac && !ether_addr_equal(addr, vf->default_lan_addr.addr)) {
dev_err(&pf->pdev->dev,
"VF attempting to override administratively set MAC address, bring down and up the VF interface to resume normal operation\n");
return -EPERM;
@@ -2953,29 +2936,33 @@ static inline int i40e_check_vf_permissi
/*count filters that really will be added*/
f = i40e_find_mac(vsi, addr);
if (!f)
- ++mac2add_cnt;
+ ++mac_add_cnt;
}
/* If this VF is not privileged, then we can't add more than a limited
- * number of addresses. Check to make sure that the additions do not
- * push us over the limit.
- */
- if (!test_bit(I40E_VIRTCHNL_VF_CAP_PRIVILEGE, &vf->vf_caps)) {
- if ((i40e_count_filters(vsi) + mac2add_cnt) >
- I40E_VC_MAX_MAC_ADDR_PER_VF) {
- dev_err(&pf->pdev->dev,
- "Cannot add more MAC addresses, VF is not trusted, switch the VF to trusted to add more functionality\n");
- return -EPERM;
- }
- /* If this VF is trusted, it can use more resources than untrusted.
+ * number of addresses.
+ *
+ * If this VF is trusted, it can use more resources than untrusted.
* However to ensure that every trusted VF has appropriate number of
* resources, divide whole pool of resources per port and then across
* all VFs.
*/
- } else {
- if ((i40e_count_filters(vsi) + mac2add_cnt) >
- I40E_VC_MAX_MACVLAN_PER_TRUSTED_VF(pf->num_alloc_vfs,
- hw->num_ports)) {
+ if (!vf_trusted)
+ mac_add_max = I40E_VC_MAX_MAC_ADDR_PER_VF;
+ else
+ mac_add_max = I40E_VC_MAX_MACVLAN_PER_TRUSTED_VF(pf->num_alloc_vfs, hw->num_ports);
+
+ /* VF can replace all its filters in one step, in this case mac_add_max
+ * will be added as active and another mac_add_max will be in
+ * a to-be-removed state. Account for that.
+ */
+ if ((i40e_count_active_filters(vsi) + mac_add_cnt) > mac_add_max ||
+ (i40e_count_all_filters(vsi) + mac_add_cnt) > 2 * mac_add_max) {
+ if (!vf_trusted) {
+ dev_err(&pf->pdev->dev,
+ "Cannot add more MAC addresses, VF is not trusted, switch the VF to trusted to add more functionality\n");
+ return -EPERM;
+ } else {
dev_err(&pf->pdev->dev,
"Cannot add more MAC addresses, trusted VF exhausted it's resources\n");
return -EPERM;
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 110/143] crypto: af_alg - Fix incorrect boolean values in af_alg_ctx
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 109/143] i40e: improve VF MAC filters accounting Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 111/143] tracing: dynevent: Add a missing lockdown check on dynevent Greg Kroah-Hartman
` (44 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Eric Biggers, Linus Torvalds
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@kernel.org>
commit d0ca0df179c4b21e2a6c4a4fb637aa8fa14575cb upstream.
Commit 1b34cbbf4f01 ("crypto: af_alg - Disallow concurrent writes in
af_alg_sendmsg") changed some fields from bool to 1-bit bitfields of
type u32.
However, some assignments to these fields, specifically 'more' and
'merge', assign values greater than 1. These relied on C's implicit
conversion to bool, such that zero becomes false and nonzero becomes
true.
With a 1-bit bitfields of type u32 instead, mod 2 of the value is taken
instead, resulting in 0 being assigned in some cases when 1 was intended.
Fix this by restoring the bool type.
Fixes: 1b34cbbf4f01 ("crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg")
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/crypto/if_alg.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/include/crypto/if_alg.h
+++ b/include/crypto/if_alg.h
@@ -152,7 +152,7 @@ struct af_alg_ctx {
size_t used;
atomic_t rcvused;
- u32 more:1,
+ bool more:1,
merge:1,
enc:1,
write:1,
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 111/143] tracing: dynevent: Add a missing lockdown check on dynevent
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 110/143] crypto: af_alg - Fix incorrect boolean values in af_alg_ctx Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 112/143] tracing: fgraph: Protect return handler from recursion loop Greg Kroah-Hartman
` (43 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Masami Hiramatsu (Google)
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
commit 456c32e3c4316654f95f9d49c12cbecfb77d5660 upstream.
Since dynamic_events interface on tracefs is compatible with
kprobe_events and uprobe_events, it should also check the lockdown
status and reject if it is set.
Link: https://lore.kernel.org/all/175824455687.45175.3734166065458520748.stgit@devnote2/
Fixes: 17911ff38aa5 ("tracing: Add locked_down checks to the open calls of files created for tracefs")
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace_dynevent.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/kernel/trace/trace_dynevent.c
+++ b/kernel/trace/trace_dynevent.c
@@ -230,6 +230,10 @@ static int dyn_event_open(struct inode *
{
int ret;
+ ret = security_locked_down(LOCKDOWN_TRACEFS);
+ if (ret)
+ return ret;
+
ret = tracing_check_open_get_tr(NULL);
if (ret)
return ret;
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 112/143] tracing: fgraph: Protect return handler from recursion loop
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 111/143] tracing: dynevent: Add a missing lockdown check on dynevent Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 113/143] tracing: fprobe: Fix to remove recorded module addresses from filter Greg Kroah-Hartman
` (42 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Menglong Dong, Peter Zijlstra,
Masami Hiramatsu (Google), Jiri Olsa, Steven Rostedt (Google)
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
commit 0db0934e7f9bb624ed98a665890dbe249f65b8fd upstream.
function_graph_enter_regs() prevents itself from recursion by
ftrace_test_recursion_trylock(), but __ftrace_return_to_handler(),
which is called at the exit, does not prevent such recursion.
Therefore, while it can prevent recursive calls from
fgraph_ops::entryfunc(), it is not able to prevent recursive calls
to fgraph from fgraph_ops::retfunc(), resulting in a recursive loop.
This can lead an unexpected recursion bug reported by Menglong.
is_endbr() is called in __ftrace_return_to_handler -> fprobe_return
-> kprobe_multi_link_exit_handler -> is_endbr.
To fix this issue, acquire ftrace_test_recursion_trylock() in the
__ftrace_return_to_handler() after unwind the shadow stack to mark
this section must prevent recursive call of fgraph inside user-defined
fgraph_ops::retfunc().
This is essentially a fix to commit 4346ba160409 ("fprobe: Rewrite
fprobe on function-graph tracer"), because before that fgraph was
only used from the function graph tracer. Fprobe allowed user to run
any callbacks from fgraph after that commit.
Reported-by: Menglong Dong <menglong8.dong@gmail.com>
Closes: https://lore.kernel.org/all/20250918120939.1706585-1-dongml2@chinatelecom.cn/
Fixes: 4346ba160409 ("fprobe: Rewrite fprobe on function-graph tracer")
Cc: stable@vger.kernel.org
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://lore.kernel.org/175852292275.307379.9040117316112640553.stgit@devnote2
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Tested-by: Menglong Dong <menglong8.dong@gmail.com>
Acked-by: Menglong Dong <menglong8.dong@gmail.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/fgraph.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/kernel/trace/fgraph.c
+++ b/kernel/trace/fgraph.c
@@ -815,6 +815,7 @@ __ftrace_return_to_handler(struct ftrace
unsigned long bitmap;
unsigned long ret;
int offset;
+ int bit;
int i;
ret_stack = ftrace_pop_return_trace(&trace, &ret, frame_pointer, &offset);
@@ -829,6 +830,15 @@ __ftrace_return_to_handler(struct ftrace
if (fregs)
ftrace_regs_set_instruction_pointer(fregs, ret);
+ bit = ftrace_test_recursion_trylock(trace.func, ret);
+ /*
+ * This can fail because ftrace_test_recursion_trylock() allows one nest
+ * call. If we are already in a nested call, then we don't probe this and
+ * just return the original return address.
+ */
+ if (unlikely(bit < 0))
+ goto out;
+
#ifdef CONFIG_FUNCTION_GRAPH_RETVAL
trace.retval = ftrace_regs_get_return_value(fregs);
#endif
@@ -852,6 +862,8 @@ __ftrace_return_to_handler(struct ftrace
}
}
+ ftrace_test_recursion_unlock(bit);
+out:
/*
* The ftrace_graph_return() may still access the current
* ret_stack structure, we need to make sure the update of
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 113/143] tracing: fprobe: Fix to remove recorded module addresses from filter
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 112/143] tracing: fgraph: Protect return handler from recursion loop Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 114/143] ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address Greg Kroah-Hartman
` (41 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Masami Hiramatsu (Google),
Menglong Dong
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
commit c539feff3c8f8c86213eee2b237410714712c326 upstream.
Even if there is a memory allocation failure in fprobe_addr_list_add(),
there is a partial list of module addresses. So remove the recorded
addresses from filter if exists.
This also removes the redundant ret local variable.
Fixes: a3dc2983ca7b ("tracing: fprobe: Cleanup fprobe hash when module unloading")
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Cc: stable@vger.kernel.org
Reviewed-by: Menglong Dong <menglong8.dong@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/fprobe.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/kernel/trace/fprobe.c b/kernel/trace/fprobe.c
index c8034dfc1070..5a807d62e76d 100644
--- a/kernel/trace/fprobe.c
+++ b/kernel/trace/fprobe.c
@@ -428,8 +428,9 @@ static int fprobe_addr_list_add(struct fprobe_addr_list *alist, unsigned long ad
{
unsigned long *addrs;
- if (alist->index >= alist->size)
- return -ENOMEM;
+ /* Previously we failed to expand the list. */
+ if (alist->index == alist->size)
+ return -ENOSPC;
alist->addrs[alist->index++] = addr;
if (alist->index < alist->size)
@@ -489,7 +490,7 @@ static int fprobe_module_callback(struct notifier_block *nb,
for (i = 0; i < FPROBE_IP_TABLE_SIZE; i++)
fprobe_remove_node_in_module(mod, &fprobe_ip_table[i], &alist);
- if (alist.index < alist.size && alist.index > 0)
+ if (alist.index > 0)
ftrace_set_filter_ips(&fprobe_graph_ops.ops,
alist.addrs, alist.index, 1, 0);
mutex_unlock(&fprobe_mutex);
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 114/143] ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 113/143] tracing: fprobe: Fix to remove recorded module addresses from filter Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 115/143] arm64: dts: marvell: cn913x-solidrun: fix sata ports status Greg Kroah-Hartman
` (40 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Nobuhiro Iwamatsu, Dinh Nguyen
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nobuhiro Iwamatsu <iwamatsu@nigauri.org>
commit ea9da67e2add7bd5f1e4b38dc2404480e711f4d8 upstream.
On SoCFPGA/Sodia board, mdio bus cannot be probed, so the PHY cannot be
found and the network device does not work.
```
stmmaceth ff702000.ethernet eth0: __stmmac_open: Cannot attach to PHY (error: -19)
```
To probe the mdio bus, add "snps,dwmac-mdio" as compatible string of the
mdio bus. Also the PHY address connected to this board is 4. Therefore,
change to 4.
Cc: stable@vger.kernel.org # 6.3+
Signed-off-by: Nobuhiro Iwamatsu <iwamatsu@nigauri.org>
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/intel/socfpga/socfpga_cyclone5_sodia.dts | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/arch/arm/boot/dts/intel/socfpga/socfpga_cyclone5_sodia.dts
+++ b/arch/arm/boot/dts/intel/socfpga/socfpga_cyclone5_sodia.dts
@@ -66,8 +66,10 @@
mdio0 {
#address-cells = <1>;
#size-cells = <0>;
- phy0: ethernet-phy@0 {
- reg = <0>;
+ compatible = "snps,dwmac-mdio";
+
+ phy0: ethernet-phy@4 {
+ reg = <4>;
rxd0-skew-ps = <0>;
rxd1-skew-ps = <0>;
rxd2-skew-ps = <0>;
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 115/143] arm64: dts: marvell: cn913x-solidrun: fix sata ports status
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 114/143] ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 116/143] arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes Greg Kroah-Hartman
` (39 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josua Mayer, Gregory CLEMENT
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josua Mayer <josua@solid-run.com>
commit d3021e6aa11fecdafa85038a037c04d5bfeda9d5 upstream.
Commit "arm64: dts: marvell: only enable complete sata nodes" changed
armada-cp11x.dtsi disabling all sata ports status by default.
The author missed some dts which relied on the dtsi enabling all ports,
and just disabled unused ones instead.
Update dts for SolidRun cn913x based boards to enable the available
ports, rather than disabling the unvavailable one.
Further according to dt bindings the serdes phys are to be specified in
the port node, not the controller node.
Move those phys properties accordingly in clearfog base/pro/solidwan.
Fixes: 30023876aef4 ("arm64: dts: marvell: only enable complete sata nodes")
Cc: stable@vger.kernel.org
Signed-off-by: Josua Mayer <josua@solid-run.com>
Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/marvell/cn9130-cf.dtsi | 7 ++++---
arch/arm64/boot/dts/marvell/cn9131-cf-solidwan.dts | 6 ++++--
arch/arm64/boot/dts/marvell/cn9132-clearfog.dts | 6 ++----
3 files changed, 10 insertions(+), 9 deletions(-)
diff --git a/arch/arm64/boot/dts/marvell/cn9130-cf.dtsi b/arch/arm64/boot/dts/marvell/cn9130-cf.dtsi
index ad0ab34b6602..bd42bfbe408b 100644
--- a/arch/arm64/boot/dts/marvell/cn9130-cf.dtsi
+++ b/arch/arm64/boot/dts/marvell/cn9130-cf.dtsi
@@ -152,11 +152,12 @@ expander0_pins: cp0-expander0-pins {
/* SRDS #0 - SATA on M.2 connector */
&cp0_sata0 {
- phys = <&cp0_comphy0 1>;
status = "okay";
- /* only port 1 is available */
- /delete-node/ sata-port@0;
+ sata-port@1 {
+ phys = <&cp0_comphy0 1>;
+ status = "okay";
+ };
};
/* microSD */
diff --git a/arch/arm64/boot/dts/marvell/cn9131-cf-solidwan.dts b/arch/arm64/boot/dts/marvell/cn9131-cf-solidwan.dts
index 47234d0858dd..338853d3b179 100644
--- a/arch/arm64/boot/dts/marvell/cn9131-cf-solidwan.dts
+++ b/arch/arm64/boot/dts/marvell/cn9131-cf-solidwan.dts
@@ -563,11 +563,13 @@ &cp1_rtc {
/* SRDS #1 - SATA on M.2 (J44) */
&cp1_sata0 {
- phys = <&cp1_comphy1 0>;
status = "okay";
/* only port 0 is available */
- /delete-node/ sata-port@1;
+ sata-port@0 {
+ phys = <&cp1_comphy1 0>;
+ status = "okay";
+ };
};
&cp1_syscon0 {
diff --git a/arch/arm64/boot/dts/marvell/cn9132-clearfog.dts b/arch/arm64/boot/dts/marvell/cn9132-clearfog.dts
index 0f53745a6fa0..115c55d73786 100644
--- a/arch/arm64/boot/dts/marvell/cn9132-clearfog.dts
+++ b/arch/arm64/boot/dts/marvell/cn9132-clearfog.dts
@@ -512,10 +512,9 @@ &cp1_sata0 {
status = "okay";
/* only port 1 is available */
- /delete-node/ sata-port@0;
-
sata-port@1 {
phys = <&cp1_comphy3 1>;
+ status = "okay";
};
};
@@ -631,9 +630,8 @@ &cp2_sata0 {
status = "okay";
/* only port 1 is available */
- /delete-node/ sata-port@0;
-
sata-port@1 {
+ status = "okay";
phys = <&cp2_comphy3 1>;
};
};
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 116/143] arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 115/143] arm64: dts: marvell: cn913x-solidrun: fix sata ports status Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 117/143] arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports Greg Kroah-Hartman
` (38 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josua Mayer, Gregory CLEMENT
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josua Mayer <josua@solid-run.com>
commit 48b51799a5461707705454568453618cdd7307f4 upstream.
Similar to MacchiatoBIN the high-speed modes are unstable on the CN9132
CEX-7 module, leading to failed transactions under normal use.
Disable all high-speed modes including UHS.
Additionally add no-sdio and non-removable properties as appropriate for
eMMC.
Fixes: e9ff907f4076 ("arm64: dts: add description for solidrun cn9132 cex7 module and clearfog board")
Cc: stable@vger.kernel.org
Signed-off-by: Josua Mayer <josua@solid-run.com>
Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/marvell/cn9132-sr-cex7.dtsi | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/arch/arm64/boot/dts/marvell/cn9132-sr-cex7.dtsi
+++ b/arch/arm64/boot/dts/marvell/cn9132-sr-cex7.dtsi
@@ -137,6 +137,14 @@
pinctrl-0 = <&ap_mmc0_pins>;
pinctrl-names = "default";
vqmmc-supply = <&v_1_8>;
+ /*
+ * Not stable in HS modes - phy needs "more calibration", so disable
+ * UHS (by preventing voltage switch), SDR104, SDR50 and DDR50 modes.
+ */
+ no-1-8-v;
+ no-sd;
+ no-sdio;
+ non-removable;
status = "okay";
};
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 117/143] arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 116/143] arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 118/143] drm/xe: Dont copy pinned kernel bos twice on suspend Greg Kroah-Hartman
` (37 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josua Mayer, Gregory CLEMENT
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josua Mayer <josua@solid-run.com>
commit 794a066688038df46c01e177cc6faebded0acba4 upstream.
The mvebu-comphy driver does not currently know how to pass correct
lane-count to ATF while configuring the serdes lanes.
This causes the system to hard reset during reconfiguration, if a pci
card is present and has established a link during bootloader.
Remove the comphy handles from the respective pci nodes to avoid runtime
reconfiguration, relying solely on bootloader configuration - while
avoiding the hard reset.
When bootloader has configured the lanes correctly, the pci ports are
functional under Linux.
This issue may be addressed in the comphy driver at a future point.
Fixes: e9ff907f4076 ("arm64: dts: add description for solidrun cn9132 cex7 module and clearfog board")
Cc: stable@vger.kernel.org
Signed-off-by: Josua Mayer <josua@solid-run.com>
Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/marvell/cn9132-clearfog.dts | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
--- a/arch/arm64/boot/dts/marvell/cn9132-clearfog.dts
+++ b/arch/arm64/boot/dts/marvell/cn9132-clearfog.dts
@@ -413,7 +413,13 @@
/* SRDS #0,#1,#2,#3 - PCIe */
&cp0_pcie0 {
num-lanes = <4>;
- phys = <&cp0_comphy0 0>, <&cp0_comphy1 0>, <&cp0_comphy2 0>, <&cp0_comphy3 0>;
+ /*
+ * The mvebu-comphy driver does not currently know how to pass correct
+ * lane-count to ATF while configuring the serdes lanes.
+ * Rely on bootloader configuration only.
+ *
+ * phys = <&cp0_comphy0 0>, <&cp0_comphy1 0>, <&cp0_comphy2 0>, <&cp0_comphy3 0>;
+ */
status = "okay";
};
@@ -475,7 +481,13 @@
/* SRDS #0,#1 - PCIe */
&cp1_pcie0 {
num-lanes = <2>;
- phys = <&cp1_comphy0 0>, <&cp1_comphy1 0>;
+ /*
+ * The mvebu-comphy driver does not currently know how to pass correct
+ * lane-count to ATF while configuring the serdes lanes.
+ * Rely on bootloader configuration only.
+ *
+ * phys = <&cp1_comphy0 0>, <&cp1_comphy1 0>;
+ */
status = "okay";
};
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 118/143] drm/xe: Dont copy pinned kernel bos twice on suspend
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 117/143] arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 119/143] drm/ast: Use msleep instead of mdelay for edid read Greg Kroah-Hartman
` (36 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthew Auld, Thomas Hellström,
Rodrigo Vivi
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Hellström <thomas.hellstrom@linux.intel.com>
commit 77c8ede611c6a70a95f7b15648551d0121b40d6c upstream.
We were copying the bo content the bos on the list
"xe->pinned.late.kernel_bo_present" twice on suspend.
Presumingly the intent is to copy the pinned external bos on
the first pass.
This is harmless since we (currently) should have no pinned
external bos needing copy since
a) exernal system bos don't have compressed content,
b) We do not (yet) allow pinning of VRAM bos.
Still, fix this up so that we copy pinned external bos on
the first pass. We're about to allow bos pinned in VRAM.
Fixes: c6a4d46ec1d7 ("drm/xe: evict user memory in PM notifier")
Cc: Matthew Auld <matthew.auld@intel.com>
Cc: <stable@vger.kernel.org> # v6.16+
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
Link: https://lore.kernel.org/r/20250918092207.54472-2-thomas.hellstrom@linux.intel.com
(cherry picked from commit 9e69bafece43dcefec864f00b3ec7e088aa7fcbc)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/xe/xe_bo_evict.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/xe/xe_bo_evict.c b/drivers/gpu/drm/xe/xe_bo_evict.c
index 7484ce55a303..d5dbc51e8612 100644
--- a/drivers/gpu/drm/xe/xe_bo_evict.c
+++ b/drivers/gpu/drm/xe/xe_bo_evict.c
@@ -158,8 +158,8 @@ int xe_bo_evict_all(struct xe_device *xe)
if (ret)
return ret;
- ret = xe_bo_apply_to_pinned(xe, &xe->pinned.late.kernel_bo_present,
- &xe->pinned.late.evicted, xe_bo_evict_pinned);
+ ret = xe_bo_apply_to_pinned(xe, &xe->pinned.late.external,
+ &xe->pinned.late.external, xe_bo_evict_pinned);
if (!ret)
ret = xe_bo_apply_to_pinned(xe, &xe->pinned.late.kernel_bo_present,
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 119/143] drm/ast: Use msleep instead of mdelay for edid read
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 118/143] drm/xe: Dont copy pinned kernel bos twice on suspend Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 120/143] drm/amd/display: Only restore backlight after amdgpu_dm_init or dm_resume Greg Kroah-Hartman
` (35 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nirmoy Das, Thomas Zimmermann,
KuoHsiang Chou, Dave Airlie, Jocelyn Falempe, dri-devel,
"Carol L Soto csoto@nvidia.com" <mailto
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nirmoy Das <nirmoyd@nvidia.com>
commit c7c31f8dc54aa3c9b2c994b5f1ff7e740a654e97 upstream.
The busy-waiting in `mdelay()` can cause CPU stalls and kernel timeouts
during boot.
Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Tested-by: Carol L Soto csoto@nvidia.com<mailto:csoto@nvidia.com>
Fixes: 594e9c04b586 ("drm/ast: Create the driver for ASPEED proprietory Display-Port")
Cc: KuoHsiang Chou <kuohsiang_chou@aspeedtech.com>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Dave Airlie <airlied@redhat.com>
Cc: Jocelyn Falempe <jfalempe@redhat.com>
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v5.19+
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://lore.kernel.org/r/20250917194346.2905522-1-nirmoyd@nvidia.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/ast/ast_dp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/ast/ast_dp.c
+++ b/drivers/gpu/drm/ast/ast_dp.c
@@ -134,7 +134,7 @@ static int ast_astdp_read_edid_block(voi
* 3. The Delays are often longer a lot when system resume from S3/S4.
*/
if (j)
- mdelay(j + 1);
+ msleep(j + 1);
/* Wait for EDID offset to show up in mirror register */
vgacrd7 = ast_get_index_reg(ast, AST_IO_VGACRI, 0xd7);
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 120/143] drm/amd/display: Only restore backlight after amdgpu_dm_init or dm_resume
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 119/143] drm/ast: Use msleep instead of mdelay for edid read Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 121/143] pinctrl: airoha: fix wrong PHY LED mux value for LED1 GPIO46 Greg Kroah-Hartman
` (34 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthew Schwartz, Mario Limonciello,
Alex Deucher
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Schwartz <matthew.schwartz@linux.dev>
commit 44b0fed0a5947f54fd14255cd0766df952267bc5 upstream.
On clients that utilize AMD_PRIVATE_COLOR properties for HDR support,
brightness sliders can include a hardware controlled portion and a
gamma-based portion. This is the case on the Steam Deck OLED when using
gamescope with Steam as a client.
When a user sets a brightness level while HDR is active, the gamma-based
portion and/or hardware portion are adjusted to achieve the desired
brightness. However, when a modeset takes place while the gamma-based
portion is in-use, restoring the hardware brightness level overrides the
user's overall brightness level and results in a mismatch between what
the slider reports and the display's current brightness.
To avoid overriding gamma-based brightness, only restore HW backlight
level after boot or resume. This ensures that the backlight level is
set correctly after the DC layer resets it while avoiding interference
with subsequent modesets.
Fixes: 7875afafba84 ("drm/amd/display: Fix brightness level not retained over reboot")
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4551
Signed-off-by: Matthew Schwartz <matthew.schwartz@linux.dev>
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit a490c8d77d500b5981e739be3d59c60cfe382536)
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 12 ++++++++----
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 7 +++++++
2 files changed, 15 insertions(+), 4 deletions(-)
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -2035,6 +2035,8 @@ static int amdgpu_dm_init(struct amdgpu_
dc_hardware_init(adev->dm.dc);
+ adev->dm.restore_backlight = true;
+
adev->dm.hpd_rx_offload_wq = hpd_rx_irq_create_workqueue(adev);
if (!adev->dm.hpd_rx_offload_wq) {
drm_err(adev_to_drm(adev), "amdgpu: failed to create hpd rx offload workqueue.\n");
@@ -3396,6 +3398,7 @@ static int dm_resume(struct amdgpu_ip_bl
dc_set_power_state(dm->dc, DC_ACPI_CM_POWER_STATE_D0);
dc_resume(dm->dc);
+ adev->dm.restore_backlight = true;
amdgpu_dm_irq_resume_early(adev);
@@ -9801,7 +9804,6 @@ static void amdgpu_dm_commit_streams(str
bool mode_set_reset_required = false;
u32 i;
struct dc_commit_streams_params params = {dc_state->streams, dc_state->stream_count};
- bool set_backlight_level = false;
/* Disable writeback */
for_each_old_connector_in_state(state, connector, old_con_state, i) {
@@ -9921,7 +9923,6 @@ static void amdgpu_dm_commit_streams(str
acrtc->hw_mode = new_crtc_state->mode;
crtc->hwmode = new_crtc_state->mode;
mode_set_reset_required = true;
- set_backlight_level = true;
} else if (modereset_required(new_crtc_state)) {
drm_dbg_atomic(dev,
"Atomic commit: RESET. crtc id %d:[%p]\n",
@@ -9978,13 +9979,16 @@ static void amdgpu_dm_commit_streams(str
* to fix a flicker issue.
* It will cause the dm->actual_brightness is not the current panel brightness
* level. (the dm->brightness is the correct panel level)
- * So we set the backlight level with dm->brightness value after set mode
+ * So we set the backlight level with dm->brightness value after initial
+ * set mode. Use restore_backlight flag to avoid setting backlight level
+ * for every subsequent mode set.
*/
- if (set_backlight_level) {
+ if (dm->restore_backlight) {
for (i = 0; i < dm->num_of_edps; i++) {
if (dm->backlight_dev[i])
amdgpu_dm_backlight_set_level(dm, i, dm->brightness[i]);
}
+ dm->restore_backlight = false;
}
}
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
@@ -611,6 +611,13 @@ struct amdgpu_display_manager {
u32 actual_brightness[AMDGPU_DM_MAX_NUM_EDP];
/**
+ * @restore_backlight:
+ *
+ * Flag to indicate whether to restore backlight after modeset.
+ */
+ bool restore_backlight;
+
+ /**
* @aux_hpd_discon_quirk:
*
* quirk for hpd discon while aux is on-going.
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 121/143] pinctrl: airoha: fix wrong PHY LED mux value for LED1 GPIO46
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 120/143] drm/amd/display: Only restore backlight after amdgpu_dm_init or dm_resume Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 122/143] pinctrl: airoha: fix wrong MDIO function bitmaks Greg Kroah-Hartman
` (33 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Marangi, Lorenzo Bianconi,
Linus Walleij
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Marangi <ansuelsmth@gmail.com>
commit 6f9674aa69ad0178ca8fc6995942ba9848c324f4 upstream.
In all the MUX value for LED1 GPIO46 there is a Copy-Paste error where
the MUX value is set to LED0_MODE_MASK instead of LED1_MODE_MASK.
This wasn't notice as there were no board that made use of the
secondary PHY LED but looking at the internal Documentation the actual
value should be LED1_MODE_MASK similar to the other GPIO entry.
Fix the wrong value to apply the correct MUX configuration.
Cc: stable@vger.kernel.org
Fixes: 1c8ace2d0725 ("pinctrl: airoha: Add support for EN7581 SoC")
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pinctrl/mediatek/pinctrl-airoha.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/drivers/pinctrl/mediatek/pinctrl-airoha.c b/drivers/pinctrl/mediatek/pinctrl-airoha.c
index 1b2f132d76f0..ee5b9bab4552 100644
--- a/drivers/pinctrl/mediatek/pinctrl-airoha.c
+++ b/drivers/pinctrl/mediatek/pinctrl-airoha.c
@@ -1752,8 +1752,8 @@ static const struct airoha_pinctrl_func_group phy1_led1_func_group[] = {
.regmap[0] = {
AIROHA_FUNC_MUX,
REG_GPIO_2ND_I2C_MODE,
- GPIO_LAN3_LED0_MODE_MASK,
- GPIO_LAN3_LED0_MODE_MASK
+ GPIO_LAN3_LED1_MODE_MASK,
+ GPIO_LAN3_LED1_MODE_MASK
},
.regmap[1] = {
AIROHA_FUNC_MUX,
@@ -1816,8 +1816,8 @@ static const struct airoha_pinctrl_func_group phy2_led1_func_group[] = {
.regmap[0] = {
AIROHA_FUNC_MUX,
REG_GPIO_2ND_I2C_MODE,
- GPIO_LAN3_LED0_MODE_MASK,
- GPIO_LAN3_LED0_MODE_MASK
+ GPIO_LAN3_LED1_MODE_MASK,
+ GPIO_LAN3_LED1_MODE_MASK
},
.regmap[1] = {
AIROHA_FUNC_MUX,
@@ -1880,8 +1880,8 @@ static const struct airoha_pinctrl_func_group phy3_led1_func_group[] = {
.regmap[0] = {
AIROHA_FUNC_MUX,
REG_GPIO_2ND_I2C_MODE,
- GPIO_LAN3_LED0_MODE_MASK,
- GPIO_LAN3_LED0_MODE_MASK
+ GPIO_LAN3_LED1_MODE_MASK,
+ GPIO_LAN3_LED1_MODE_MASK
},
.regmap[1] = {
AIROHA_FUNC_MUX,
@@ -1944,8 +1944,8 @@ static const struct airoha_pinctrl_func_group phy4_led1_func_group[] = {
.regmap[0] = {
AIROHA_FUNC_MUX,
REG_GPIO_2ND_I2C_MODE,
- GPIO_LAN3_LED0_MODE_MASK,
- GPIO_LAN3_LED0_MODE_MASK
+ GPIO_LAN3_LED1_MODE_MASK,
+ GPIO_LAN3_LED1_MODE_MASK
},
.regmap[1] = {
AIROHA_FUNC_MUX,
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 122/143] pinctrl: airoha: fix wrong MDIO function bitmaks
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 121/143] pinctrl: airoha: fix wrong PHY LED mux value for LED1 GPIO46 Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 123/143] Revert "vhost/net: Defer TX queue re-enable until after sendmsg" Greg Kroah-Hartman
` (32 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Marangi, Benjamin Larsson,
Linus Walleij
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Marangi <ansuelsmth@gmail.com>
commit a061e739d36220c002da8b2429d5f16f637eb59a upstream.
With further testing with an attached Aeonsemi it was discovered that
the pinctrl MDIO function applied the wrong bitmask. The error was
probably caused by the confusing documentation related to these bits.
Inspecting what the bootloader actually configure, the SGMII_MDIO_MODE
is never actually set but instead it's set force enable to the 2 GPIO
(gpio 1-2) for MDC and MDIO pin.
The usage of GPIO might be confusing but this is just to instruct the
SoC to not mess with those 2 PIN and as Benjamin reported it's also an
Errata of 7581. The FORCE_GPIO_EN doesn't set them as GPIO function
(that is configured by a different register) but it's really to actually
""enable"" those lines.
Normally the SoC should autodetect this by HW but it seems AN7581 have
problem with this and require this workaround to force enable the 2 pin.
Applying this configuration permits correct functionality of any
externally attached PHY.
Cc: stable@vger.kernel.org
Fixes: 1c8ace2d0725 ("pinctrl: airoha: Add support for EN7581 SoC")
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Acked-by: Benjamin Larsson <benjamin.larsson@genexis.eu>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pinctrl/mediatek/pinctrl-airoha.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
diff --git a/drivers/pinctrl/mediatek/pinctrl-airoha.c b/drivers/pinctrl/mediatek/pinctrl-airoha.c
index ee5b9bab4552..b405dfa20891 100644
--- a/drivers/pinctrl/mediatek/pinctrl-airoha.c
+++ b/drivers/pinctrl/mediatek/pinctrl-airoha.c
@@ -108,6 +108,9 @@
#define JTAG_UDI_EN_MASK BIT(4)
#define JTAG_DFD_EN_MASK BIT(3)
+#define REG_FORCE_GPIO_EN 0x0228
+#define FORCE_GPIO_EN(n) BIT(n)
+
/* LED MAP */
#define REG_LAN_LED0_MAPPING 0x027c
#define REG_LAN_LED1_MAPPING 0x0280
@@ -718,17 +721,17 @@ static const struct airoha_pinctrl_func_group mdio_func_group[] = {
{
.name = "mdio",
.regmap[0] = {
- AIROHA_FUNC_MUX,
- REG_GPIO_PON_MODE,
- GPIO_SGMII_MDIO_MODE_MASK,
- GPIO_SGMII_MDIO_MODE_MASK
- },
- .regmap[1] = {
AIROHA_FUNC_MUX,
REG_GPIO_2ND_I2C_MODE,
GPIO_MDC_IO_MASTER_MODE_MODE,
GPIO_MDC_IO_MASTER_MODE_MODE
},
+ .regmap[1] = {
+ AIROHA_FUNC_MUX,
+ REG_FORCE_GPIO_EN,
+ FORCE_GPIO_EN(1) | FORCE_GPIO_EN(2),
+ FORCE_GPIO_EN(1) | FORCE_GPIO_EN(2)
+ },
.regmap_size = 2,
},
};
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 123/143] Revert "vhost/net: Defer TX queue re-enable until after sendmsg"
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 122/143] pinctrl: airoha: fix wrong MDIO function bitmaks Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 124/143] vhost-net: flush batched before enabling notifications Greg Kroah-Hartman
` (31 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jon Kohler, Jason Wang,
Michael S. Tsirkin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael S. Tsirkin <mst@redhat.com>
commit 4174152771bf0d014d58f7d7e148bb0c8830fe53 upstream.
This reverts commit 8c2e6b26ffe243be1e78f5a4bfb1a857d6e6f6d6. It tries
to defer the notification enabling by moving the logic out of the loop
after the vhost_tx_batch() when nothing new is spotted. This will
bring side effects as the new logic would be reused for several other
error conditions.
One example is the IOTLB: when there's an IOTLB miss, get_tx_bufs()
might return -EAGAIN and exit the loop and see there's still available
buffers, so it will queue the tx work again until userspace feed the
IOTLB entry correctly. This will slowdown the tx processing and
trigger the TX watchdog in the guest as reported in
https://lkml.org/lkml/2025/9/10/1596.
To fix, revert the change. A follow up patch will bring the performance
back in a safe way.
Reported-by: Jon Kohler <jon@nutanix.com>
Cc: stable@vger.kernel.org
Fixes: 8c2e6b26ffe2 ("vhost/net: Defer TX queue re-enable until after sendmsg")
Signed-off-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20250917063045.2042-2-jasowang@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/vhost/net.c | 30 +++++++++---------------------
1 file changed, 9 insertions(+), 21 deletions(-)
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -760,10 +760,10 @@ static void handle_tx_copy(struct vhost_
int err;
int sent_pkts = 0;
bool sock_can_batch = (sock->sk->sk_sndbuf == INT_MAX);
- bool busyloop_intr;
do {
- busyloop_intr = false;
+ bool busyloop_intr = false;
+
if (nvq->done_idx == VHOST_NET_BATCH)
vhost_tx_batch(net, nvq, sock, &msg);
@@ -774,10 +774,13 @@ static void handle_tx_copy(struct vhost_
break;
/* Nothing new? Wait for eventfd to tell us they refilled. */
if (head == vq->num) {
- /* Kicks are disabled at this point, break loop and
- * process any remaining batched packets. Queue will
- * be re-enabled afterwards.
- */
+ if (unlikely(busyloop_intr)) {
+ vhost_poll_queue(&vq->poll);
+ } else if (unlikely(vhost_enable_notify(&net->dev,
+ vq))) {
+ vhost_disable_notify(&net->dev, vq);
+ continue;
+ }
break;
}
@@ -827,22 +830,7 @@ done:
++nvq->done_idx;
} while (likely(!vhost_exceeds_weight(vq, ++sent_pkts, total_len)));
- /* Kicks are still disabled, dispatch any remaining batched msgs. */
vhost_tx_batch(net, nvq, sock, &msg);
-
- if (unlikely(busyloop_intr))
- /* If interrupted while doing busy polling, requeue the
- * handler to be fair handle_rx as well as other tasks
- * waiting on cpu.
- */
- vhost_poll_queue(&vq->poll);
- else
- /* All of our work has been completed; however, before
- * leaving the TX handler, do one last check for work,
- * and requeue handler if necessary. If there is no work,
- * queue will be reenabled.
- */
- vhost_net_busy_poll_try_queue(net, vq);
}
static void handle_tx_zerocopy(struct vhost_net *net, struct socket *sock)
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 124/143] vhost-net: flush batched before enabling notifications
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 123/143] Revert "vhost/net: Defer TX queue re-enable until after sendmsg" Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 125/143] afs: Fix potential null pointer dereference in afs_put_server Greg Kroah-Hartman
` (30 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jon Kohler, Jason Wang,
Michael S. Tsirkin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Wang <jasowang@redhat.com>
commit e430451613c7a27beeadd00d707bcf7ceec6328e upstream.
Commit 8c2e6b26ffe2 ("vhost/net: Defer TX queue re-enable until after
sendmsg") tries to defer the notification enabling by moving the logic
out of the loop after the vhost_tx_batch() when nothing new is spotted.
This caused unexpected side effects as the new logic is reused for
several other error conditions.
A previous patch reverted 8c2e6b26ffe2. Now, bring the performance
back up by flushing batched buffers before enabling notifications.
Reported-by: Jon Kohler <jon@nutanix.com>
Cc: stable@vger.kernel.org
Fixes: 8c2e6b26ffe2 ("vhost/net: Defer TX queue re-enable until after sendmsg")
Signed-off-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20250917063045.2042-3-jasowang@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/vhost/net.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -774,6 +774,11 @@ static void handle_tx_copy(struct vhost_
break;
/* Nothing new? Wait for eventfd to tell us they refilled. */
if (head == vq->num) {
+ /* Flush batched packets to handle pending RX
+ * work (if busyloop_intr is set) and to avoid
+ * unnecessary virtqueue kicks.
+ */
+ vhost_tx_batch(net, nvq, sock, &msg);
if (unlikely(busyloop_intr)) {
vhost_poll_queue(&vq->poll);
} else if (unlikely(vhost_enable_notify(&net->dev,
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 125/143] afs: Fix potential null pointer dereference in afs_put_server
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 124/143] vhost-net: flush batched before enabling notifications Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 126/143] fs/proc/task_mmu: check p->vec_buf for NULL Greg Kroah-Hartman
` (29 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhen Ni, David Howells,
Jeffrey Altman, Christian Brauner
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhen Ni <zhen.ni@easystack.cn>
commit 9158c6bb245113d4966df9b2ba602197a379412e upstream.
afs_put_server() accessed server->debug_id before the NULL check, which
could lead to a null pointer dereference. Move the debug_id assignment,
ensuring we never dereference a NULL server pointer.
Fixes: 2757a4dc1849 ("afs: Fix access after dec in put functions")
Cc: stable@vger.kernel.org
Signed-off-by: Zhen Ni <zhen.ni@easystack.cn>
Acked-by: David Howells <dhowells@redhat.com>
Reviewed-by: Jeffrey Altman <jaltman@auristor.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/afs/server.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/afs/server.c
+++ b/fs/afs/server.c
@@ -331,13 +331,14 @@ struct afs_server *afs_use_server(struct
void afs_put_server(struct afs_net *net, struct afs_server *server,
enum afs_server_trace reason)
{
- unsigned int a, debug_id = server->debug_id;
+ unsigned int a, debug_id;
bool zero;
int r;
if (!server)
return;
+ debug_id = server->debug_id;
a = atomic_read(&server->active);
zero = __refcount_dec_and_test(&server->ref, &r);
trace_afs_server(debug_id, r - 1, a, reason);
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 126/143] fs/proc/task_mmu: check p->vec_buf for NULL
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 125/143] afs: Fix potential null pointer dereference in afs_put_server Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 127/143] gpiolib: Extend software-node support to support secondary software-nodes Greg Kroah-Hartman
` (28 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jakub Acs, Muhammad Usama Anjum,
David Hildenbrand, Vlastimil Babka, Lorenzo Stoakes, Jinjiang Tu,
Suren Baghdasaryan, Penglei Jiang, Mark Brown, Baolin Wang,
Ryan Roberts, Andrei Vagin, Michał Mirosław,
Stephen Rothwell, Andrew Morton
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Acs <acsjakub@amazon.de>
commit 28aa29986dde79e8466bc87569141291053833f5 upstream.
When the PAGEMAP_SCAN ioctl is invoked with vec_len = 0 reaches
pagemap_scan_backout_range(), kernel panics with null-ptr-deref:
[ 44.936808] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI
[ 44.937797] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
[ 44.938391] CPU: 1 UID: 0 PID: 2480 Comm: reproducer Not tainted 6.17.0-rc6 #22 PREEMPT(none)
[ 44.939062] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 44.939935] RIP: 0010:pagemap_scan_thp_entry.isra.0+0x741/0xa80
<snip registers, unreliable trace>
[ 44.946828] Call Trace:
[ 44.947030] <TASK>
[ 44.949219] pagemap_scan_pmd_entry+0xec/0xfa0
[ 44.952593] walk_pmd_range.isra.0+0x302/0x910
[ 44.954069] walk_pud_range.isra.0+0x419/0x790
[ 44.954427] walk_p4d_range+0x41e/0x620
[ 44.954743] walk_pgd_range+0x31e/0x630
[ 44.955057] __walk_page_range+0x160/0x670
[ 44.956883] walk_page_range_mm+0x408/0x980
[ 44.958677] walk_page_range+0x66/0x90
[ 44.958984] do_pagemap_scan+0x28d/0x9c0
[ 44.961833] do_pagemap_cmd+0x59/0x80
[ 44.962484] __x64_sys_ioctl+0x18d/0x210
[ 44.962804] do_syscall_64+0x5b/0x290
[ 44.963111] entry_SYSCALL_64_after_hwframe+0x76/0x7e
vec_len = 0 in pagemap_scan_init_bounce_buffer() means no buffers are
allocated and p->vec_buf remains set to NULL.
This breaks an assumption made later in pagemap_scan_backout_range(), that
page_region is always allocated for p->vec_buf_index.
Fix it by explicitly checking p->vec_buf for NULL before dereferencing.
Other sites that might run into same deref-issue are already (directly or
transitively) protected by checking p->vec_buf.
Note:
>From PAGEMAP_SCAN man page, it seems vec_len = 0 is valid when no output
is requested and it's only the side effects caller is interested in,
hence it passes check in pagemap_scan_get_args().
This issue was found by syzkaller.
Link: https://lkml.kernel.org/r/20250922082206.6889-1-acsjakub@amazon.de
Fixes: 52526ca7fdb9 ("fs/proc/task_mmu: implement IOCTL to get and optionally clear info about PTEs")
Signed-off-by: Jakub Acs <acsjakub@amazon.de>
Reviewed-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
Acked-by: David Hildenbrand <david@redhat.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Jinjiang Tu <tujinjiang@huawei.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Penglei Jiang <superman.xpt@gmail.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Andrei Vagin <avagin@gmail.com>
Cc: "Michał Mirosław" <mirq-linux@rere.qmqm.pl>
Cc: Stephen Rothwell <sfr@canb.auug.org.au>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/proc/task_mmu.c | 3 +++
1 file changed, 3 insertions(+)
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -2286,6 +2286,9 @@ static void pagemap_scan_backout_range(s
{
struct page_region *cur_buf = &p->vec_buf[p->vec_buf_index];
+ if (!p->vec_buf)
+ return;
+
if (cur_buf->start != addr)
cur_buf->end = addr;
else
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 127/143] gpiolib: Extend software-node support to support secondary software-nodes
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 126/143] fs/proc/task_mmu: check p->vec_buf for NULL Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 128/143] kmsan: fix out-of-bounds access to shadow memory Greg Kroah-Hartman
` (27 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans de Goede, Dmitry Torokhov,
Bartosz Golaszewski
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hansg@kernel.org>
commit c6ccc4dde17676dfe617b9a37bd9ba19a8fc87ee upstream.
When a software-node gets added to a device which already has another
fwnode as primary node it will become the secondary fwnode for that
device.
Currently if a software-node with GPIO properties ends up as the secondary
fwnode then gpiod_find_by_fwnode() will fail to find the GPIOs.
Add a new gpiod_fwnode_lookup() helper which falls back to calling
gpiod_find_by_fwnode() with the secondary fwnode if the GPIO was not
found in the primary fwnode.
Fixes: e7f9ff5dc90c ("gpiolib: add support for software nodes")
Cc: stable@vger.kernel.org
Signed-off-by: Hans de Goede <hansg@kernel.org>
Reviewed-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Link: https://lore.kernel.org/r/20250920200955.20403-1-hansg@kernel.org
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpio/gpiolib.c | 21 +++++++++++++++++++--
1 file changed, 19 insertions(+), 2 deletions(-)
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -4605,6 +4605,23 @@ static struct gpio_desc *gpiod_find_by_f
return desc;
}
+static struct gpio_desc *gpiod_fwnode_lookup(struct fwnode_handle *fwnode,
+ struct device *consumer,
+ const char *con_id,
+ unsigned int idx,
+ enum gpiod_flags *flags,
+ unsigned long *lookupflags)
+{
+ struct gpio_desc *desc;
+
+ desc = gpiod_find_by_fwnode(fwnode, consumer, con_id, idx, flags, lookupflags);
+ if (gpiod_not_found(desc) && !IS_ERR_OR_NULL(fwnode))
+ desc = gpiod_find_by_fwnode(fwnode->secondary, consumer, con_id,
+ idx, flags, lookupflags);
+
+ return desc;
+}
+
struct gpio_desc *gpiod_find_and_request(struct device *consumer,
struct fwnode_handle *fwnode,
const char *con_id,
@@ -4623,8 +4640,8 @@ struct gpio_desc *gpiod_find_and_request
int ret = 0;
scoped_guard(srcu, &gpio_devices_srcu) {
- desc = gpiod_find_by_fwnode(fwnode, consumer, con_id, idx,
- &flags, &lookupflags);
+ desc = gpiod_fwnode_lookup(fwnode, consumer, con_id, idx,
+ &flags, &lookupflags);
if (gpiod_not_found(desc) && platform_lookup_allowed) {
/*
* Either we are not using DT or ACPI, or their lookup
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 128/143] kmsan: fix out-of-bounds access to shadow memory
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 127/143] gpiolib: Extend software-node support to support secondary software-nodes Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 129/143] netfs: fix reference leak Greg Kroah-Hartman
` (26 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Biggers, Alexander Potapenko,
Dmitriy Vyukov, Marco Elver, Andrew Morton
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@kernel.org>
commit 85e1ff61060a765d91ee62dc5606d4d547d9d105 upstream.
Running sha224_kunit on a KMSAN-enabled kernel results in a crash in
kmsan_internal_set_shadow_origin():
BUG: unable to handle page fault for address: ffffbc3840291000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 1810067 P4D 1810067 PUD 192d067 PMD 3c17067 PTE 0
Oops: 0000 [#1] SMP NOPTI
CPU: 0 UID: 0 PID: 81 Comm: kunit_try_catch Tainted: G N 6.17.0-rc3 #10 PREEMPT(voluntary)
Tainted: [N]=TEST
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
RIP: 0010:kmsan_internal_set_shadow_origin+0x91/0x100
[...]
Call Trace:
<TASK>
__msan_memset+0xee/0x1a0
sha224_final+0x9e/0x350
test_hash_buffer_overruns+0x46f/0x5f0
? kmsan_get_shadow_origin_ptr+0x46/0xa0
? __pfx_test_hash_buffer_overruns+0x10/0x10
kunit_try_run_case+0x198/0xa00
This occurs when memset() is called on a buffer that is not 4-byte aligned
and extends to the end of a guard page, i.e. the next page is unmapped.
The bug is that the loop at the end of kmsan_internal_set_shadow_origin()
accesses the wrong shadow memory bytes when the address is not 4-byte
aligned. Since each 4 bytes are associated with an origin, it rounds the
address and size so that it can access all the origins that contain the
buffer. However, when it checks the corresponding shadow bytes for a
particular origin, it incorrectly uses the original unrounded shadow
address. This results in reads from shadow memory beyond the end of the
buffer's shadow memory, which crashes when that memory is not mapped.
To fix this, correctly align the shadow address before accessing the 4
shadow bytes corresponding to each origin.
Link: https://lkml.kernel.org/r/20250911195858.394235-1-ebiggers@kernel.org
Fixes: 2ef3cec44c60 ("kmsan: do not wipe out origin when doing partial unpoisoning")
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Tested-by: Alexander Potapenko <glider@google.com>
Reviewed-by: Alexander Potapenko <glider@google.com>
Cc: Dmitriy Vyukov <dvyukov@google.com>
Cc: Marco Elver <elver@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/kmsan/core.c | 10 +++++++---
mm/kmsan/kmsan_test.c | 16 ++++++++++++++++
2 files changed, 23 insertions(+), 3 deletions(-)
--- a/mm/kmsan/core.c
+++ b/mm/kmsan/core.c
@@ -195,7 +195,8 @@ void kmsan_internal_set_shadow_origin(vo
u32 origin, bool checked)
{
u64 address = (u64)addr;
- u32 *shadow_start, *origin_start;
+ void *shadow_start;
+ u32 *aligned_shadow, *origin_start;
size_t pad = 0;
KMSAN_WARN_ON(!kmsan_metadata_is_contiguous(addr, size));
@@ -214,9 +215,12 @@ void kmsan_internal_set_shadow_origin(vo
}
__memset(shadow_start, b, size);
- if (!IS_ALIGNED(address, KMSAN_ORIGIN_SIZE)) {
+ if (IS_ALIGNED(address, KMSAN_ORIGIN_SIZE)) {
+ aligned_shadow = shadow_start;
+ } else {
pad = address % KMSAN_ORIGIN_SIZE;
address -= pad;
+ aligned_shadow = shadow_start - pad;
size += pad;
}
size = ALIGN(size, KMSAN_ORIGIN_SIZE);
@@ -230,7 +234,7 @@ void kmsan_internal_set_shadow_origin(vo
* corresponding shadow slot is zero.
*/
for (int i = 0; i < size / KMSAN_ORIGIN_SIZE; i++) {
- if (origin || !shadow_start[i])
+ if (origin || !aligned_shadow[i])
origin_start[i] = origin;
}
}
--- a/mm/kmsan/kmsan_test.c
+++ b/mm/kmsan/kmsan_test.c
@@ -556,6 +556,21 @@ DEFINE_TEST_MEMSETXX(16)
DEFINE_TEST_MEMSETXX(32)
DEFINE_TEST_MEMSETXX(64)
+/* Test case: ensure that KMSAN does not access shadow memory out of bounds. */
+static void test_memset_on_guarded_buffer(struct kunit *test)
+{
+ void *buf = vmalloc(PAGE_SIZE);
+
+ kunit_info(test,
+ "memset() on ends of guarded buffer should not crash\n");
+
+ for (size_t size = 0; size <= 128; size++) {
+ memset(buf, 0xff, size);
+ memset(buf + PAGE_SIZE - size, 0xff, size);
+ }
+ vfree(buf);
+}
+
static noinline void fibonacci(int *array, int size, int start)
{
if (start < 2 || (start == size))
@@ -677,6 +692,7 @@ static struct kunit_case kmsan_test_case
KUNIT_CASE(test_memset16),
KUNIT_CASE(test_memset32),
KUNIT_CASE(test_memset64),
+ KUNIT_CASE(test_memset_on_guarded_buffer),
KUNIT_CASE(test_long_origin_chain),
KUNIT_CASE(test_stackdepot_roundtrip),
KUNIT_CASE(test_unpoison_memory),
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 129/143] netfs: fix reference leak
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 128/143] kmsan: fix out-of-bounds access to shadow memory Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 130/143] riscv: Use an atomic xchg in pudp_huge_get_and_clear() Greg Kroah-Hartman
` (25 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Max Kellermann, David Howells,
Paulo Alcantara, netfs, linux-fsdevel, Christian Brauner
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Kellermann <max.kellermann@ionos.com>
commit 4d428dca252c858bfac691c31fa95d26cd008706 upstream.
Commit 20d72b00ca81 ("netfs: Fix the request's work item to not
require a ref") modified netfs_alloc_request() to initialize the
reference counter to 2 instead of 1. The rationale was that the
requet's "work" would release the second reference after completion
(via netfs_{read,write}_collection_worker()). That works most of the
time if all goes well.
However, it leaks this additional reference if the request is released
before the I/O operation has been submitted: the error code path only
decrements the reference counter once and the work item will never be
queued because there will never be a completion.
This has caused outages of our whole server cluster today because
tasks were blocked in netfs_wait_for_outstanding_io(), leading to
deadlocks in Ceph (another bug that I will address soon in another
patch). This was caused by a netfs_pgpriv2_begin_copy_to_cache() call
which failed in fscache_begin_write_operation(). The leaked
netfs_io_request was never completed, leaving `netfs_inode.io_count`
with a positive value forever.
All of this is super-fragile code. Finding out which code paths will
lead to an eventual completion and which do not is hard to see:
- Some functions like netfs_create_write_req() allocate a request, but
will never submit any I/O.
- netfs_unbuffered_read_iter_locked() calls netfs_unbuffered_read()
and then netfs_put_request(); however, netfs_unbuffered_read() can
also fail early before submitting the I/O request, therefore another
netfs_put_request() call must be added there.
A rule of thumb is that functions that return a `netfs_io_request` do
not submit I/O, and all of their callers must be checked.
For my taste, the whole netfs code needs an overhaul to make reference
counting easier to understand and less fragile & obscure. But to fix
this bug here and now and produce a patch that is adequate for a
stable backport, I tried a minimal approach that quickly frees the
request object upon early failure.
I decided against adding a second netfs_put_request() each time
because that would cause code duplication which obscures the code
further. Instead, I added the function netfs_put_failed_request()
which frees such a failed request synchronously under the assumption
that the reference count is exactly 2 (as initially set by
netfs_alloc_request() and never touched), verified by a
WARN_ON_ONCE(). It then deinitializes the request object (without
going through the "cleanup_work" indirection) and frees the allocation
(with RCU protection to protect against concurrent access by
netfs_requests_seq_start()).
All code paths that fail early have been changed to call
netfs_put_failed_request() instead of netfs_put_request().
Additionally, I have added a netfs_put_request() call to
netfs_unbuffered_read() as explained above because the
netfs_put_failed_request() approach does not work there.
Fixes: 20d72b00ca81 ("netfs: Fix the request's work item to not require a ref")
Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Paulo Alcantara <pc@manguebit.org>
cc: netfs@lists.linux.dev
cc: linux-fsdevel@vger.kernel.org
cc: stable@vger.kernel.org
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/netfs/buffered_read.c | 10 +++++-----
fs/netfs/direct_read.c | 7 ++++++-
fs/netfs/direct_write.c | 6 +++++-
fs/netfs/internal.h | 1 +
fs/netfs/objects.c | 30 +++++++++++++++++++++++++++---
fs/netfs/read_pgpriv2.c | 2 +-
fs/netfs/read_single.c | 2 +-
fs/netfs/write_issue.c | 3 +--
8 files changed, 47 insertions(+), 14 deletions(-)
diff --git a/fs/netfs/buffered_read.c b/fs/netfs/buffered_read.c
index 18b3dc74c70e..37ab6f28b5ad 100644
--- a/fs/netfs/buffered_read.c
+++ b/fs/netfs/buffered_read.c
@@ -369,7 +369,7 @@ void netfs_readahead(struct readahead_control *ractl)
return netfs_put_request(rreq, netfs_rreq_trace_put_return);
cleanup_free:
- return netfs_put_request(rreq, netfs_rreq_trace_put_failed);
+ return netfs_put_failed_request(rreq);
}
EXPORT_SYMBOL(netfs_readahead);
@@ -472,7 +472,7 @@ static int netfs_read_gaps(struct file *file, struct folio *folio)
return ret < 0 ? ret : 0;
discard:
- netfs_put_request(rreq, netfs_rreq_trace_put_discard);
+ netfs_put_failed_request(rreq);
alloc_error:
folio_unlock(folio);
return ret;
@@ -532,7 +532,7 @@ int netfs_read_folio(struct file *file, struct folio *folio)
return ret < 0 ? ret : 0;
discard:
- netfs_put_request(rreq, netfs_rreq_trace_put_discard);
+ netfs_put_failed_request(rreq);
alloc_error:
folio_unlock(folio);
return ret;
@@ -699,7 +699,7 @@ int netfs_write_begin(struct netfs_inode *ctx,
return 0;
error_put:
- netfs_put_request(rreq, netfs_rreq_trace_put_failed);
+ netfs_put_failed_request(rreq);
error:
if (folio) {
folio_unlock(folio);
@@ -754,7 +754,7 @@ int netfs_prefetch_for_write(struct file *file, struct folio *folio,
return ret < 0 ? ret : 0;
error_put:
- netfs_put_request(rreq, netfs_rreq_trace_put_discard);
+ netfs_put_failed_request(rreq);
error:
_leave(" = %d", ret);
return ret;
diff --git a/fs/netfs/direct_read.c b/fs/netfs/direct_read.c
index a05e13472baf..a498ee8d6674 100644
--- a/fs/netfs/direct_read.c
+++ b/fs/netfs/direct_read.c
@@ -131,6 +131,7 @@ static ssize_t netfs_unbuffered_read(struct netfs_io_request *rreq, bool sync)
if (rreq->len == 0) {
pr_err("Zero-sized read [R=%x]\n", rreq->debug_id);
+ netfs_put_request(rreq, netfs_rreq_trace_put_discard);
return -EIO;
}
@@ -205,7 +206,7 @@ ssize_t netfs_unbuffered_read_iter_locked(struct kiocb *iocb, struct iov_iter *i
if (user_backed_iter(iter)) {
ret = netfs_extract_user_iter(iter, rreq->len, &rreq->buffer.iter, 0);
if (ret < 0)
- goto out;
+ goto error_put;
rreq->direct_bv = (struct bio_vec *)rreq->buffer.iter.bvec;
rreq->direct_bv_count = ret;
rreq->direct_bv_unpin = iov_iter_extract_will_pin(iter);
@@ -238,6 +239,10 @@ ssize_t netfs_unbuffered_read_iter_locked(struct kiocb *iocb, struct iov_iter *i
if (ret > 0)
orig_count -= ret;
return ret;
+
+error_put:
+ netfs_put_failed_request(rreq);
+ return ret;
}
EXPORT_SYMBOL(netfs_unbuffered_read_iter_locked);
diff --git a/fs/netfs/direct_write.c b/fs/netfs/direct_write.c
index a16660ab7f83..a9d1c3b2c084 100644
--- a/fs/netfs/direct_write.c
+++ b/fs/netfs/direct_write.c
@@ -57,7 +57,7 @@ ssize_t netfs_unbuffered_write_iter_locked(struct kiocb *iocb, struct iov_iter *
n = netfs_extract_user_iter(iter, len, &wreq->buffer.iter, 0);
if (n < 0) {
ret = n;
- goto out;
+ goto error_put;
}
wreq->direct_bv = (struct bio_vec *)wreq->buffer.iter.bvec;
wreq->direct_bv_count = n;
@@ -101,6 +101,10 @@ ssize_t netfs_unbuffered_write_iter_locked(struct kiocb *iocb, struct iov_iter *
out:
netfs_put_request(wreq, netfs_rreq_trace_put_return);
return ret;
+
+error_put:
+ netfs_put_failed_request(wreq);
+ return ret;
}
EXPORT_SYMBOL(netfs_unbuffered_write_iter_locked);
diff --git a/fs/netfs/internal.h b/fs/netfs/internal.h
index d4f16fefd965..4319611f5354 100644
--- a/fs/netfs/internal.h
+++ b/fs/netfs/internal.h
@@ -87,6 +87,7 @@ struct netfs_io_request *netfs_alloc_request(struct address_space *mapping,
void netfs_get_request(struct netfs_io_request *rreq, enum netfs_rreq_ref_trace what);
void netfs_clear_subrequests(struct netfs_io_request *rreq);
void netfs_put_request(struct netfs_io_request *rreq, enum netfs_rreq_ref_trace what);
+void netfs_put_failed_request(struct netfs_io_request *rreq);
struct netfs_io_subrequest *netfs_alloc_subrequest(struct netfs_io_request *rreq);
static inline void netfs_see_request(struct netfs_io_request *rreq,
diff --git a/fs/netfs/objects.c b/fs/netfs/objects.c
index e8c99738b5bb..40a1c7d6f6e0 100644
--- a/fs/netfs/objects.c
+++ b/fs/netfs/objects.c
@@ -116,10 +116,8 @@ static void netfs_free_request_rcu(struct rcu_head *rcu)
netfs_stat_d(&netfs_n_rh_rreq);
}
-static void netfs_free_request(struct work_struct *work)
+static void netfs_deinit_request(struct netfs_io_request *rreq)
{
- struct netfs_io_request *rreq =
- container_of(work, struct netfs_io_request, cleanup_work);
struct netfs_inode *ictx = netfs_inode(rreq->inode);
unsigned int i;
@@ -149,6 +147,14 @@ static void netfs_free_request(struct work_struct *work)
if (atomic_dec_and_test(&ictx->io_count))
wake_up_var(&ictx->io_count);
+}
+
+static void netfs_free_request(struct work_struct *work)
+{
+ struct netfs_io_request *rreq =
+ container_of(work, struct netfs_io_request, cleanup_work);
+
+ netfs_deinit_request(rreq);
call_rcu(&rreq->rcu, netfs_free_request_rcu);
}
@@ -167,6 +173,24 @@ void netfs_put_request(struct netfs_io_request *rreq, enum netfs_rreq_ref_trace
}
}
+/*
+ * Free a request (synchronously) that was just allocated but has
+ * failed before it could be submitted.
+ */
+void netfs_put_failed_request(struct netfs_io_request *rreq)
+{
+ int r = refcount_read(&rreq->ref);
+
+ /* new requests have two references (see
+ * netfs_alloc_request(), and this function is only allowed on
+ * new request objects
+ */
+ WARN_ON_ONCE(r != 2);
+
+ trace_netfs_rreq_ref(rreq->debug_id, r, netfs_rreq_trace_put_failed);
+ netfs_free_request(&rreq->cleanup_work);
+}
+
/*
* Allocate and partially initialise an I/O request structure.
*/
diff --git a/fs/netfs/read_pgpriv2.c b/fs/netfs/read_pgpriv2.c
index 8097bc069c1d..a1489aa29f78 100644
--- a/fs/netfs/read_pgpriv2.c
+++ b/fs/netfs/read_pgpriv2.c
@@ -118,7 +118,7 @@ static struct netfs_io_request *netfs_pgpriv2_begin_copy_to_cache(
return creq;
cancel_put:
- netfs_put_request(creq, netfs_rreq_trace_put_return);
+ netfs_put_failed_request(creq);
cancel:
rreq->copy_to_cache = ERR_PTR(-ENOBUFS);
clear_bit(NETFS_RREQ_FOLIO_COPY_TO_CACHE, &rreq->flags);
diff --git a/fs/netfs/read_single.c b/fs/netfs/read_single.c
index fa622a6cd56d..5c0dc4efc792 100644
--- a/fs/netfs/read_single.c
+++ b/fs/netfs/read_single.c
@@ -189,7 +189,7 @@ ssize_t netfs_read_single(struct inode *inode, struct file *file, struct iov_ite
return ret;
cleanup_free:
- netfs_put_request(rreq, netfs_rreq_trace_put_failed);
+ netfs_put_failed_request(rreq);
return ret;
}
EXPORT_SYMBOL(netfs_read_single);
diff --git a/fs/netfs/write_issue.c b/fs/netfs/write_issue.c
index 0584cba1a043..dd8743bc8d7f 100644
--- a/fs/netfs/write_issue.c
+++ b/fs/netfs/write_issue.c
@@ -133,8 +133,7 @@ struct netfs_io_request *netfs_create_write_req(struct address_space *mapping,
return wreq;
nomem:
- wreq->error = -ENOMEM;
- netfs_put_request(wreq, netfs_rreq_trace_put_failed);
+ netfs_put_failed_request(wreq);
return ERR_PTR(-ENOMEM);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 130/143] riscv: Use an atomic xchg in pudp_huge_get_and_clear()
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (128 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 129/143] netfs: fix reference leak Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 131/143] x86/topology: Implement topology_is_core_online() to address SMT regression Greg Kroah-Hartman
` (24 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alexandre Ghiti, Paul Walmsley
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandre Ghiti <alexghiti@rivosinc.com>
commit 546e42c8c6d9498d5eac14bf2aca0383a11b145a upstream.
Make sure we return the right pud value and not a value that could
have been overwritten in between by a different core.
Fixes: c3cc2a4a3a23 ("riscv: Add support for PUD THP")
Cc: stable@vger.kernel.org
Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com>
Link: https://lore.kernel.org/r/20250814-dev-alex-thp_pud_xchg-v1-1-b4704dfae206@rivosinc.com
[pjw@kernel.org: use xchg rather than atomic_long_xchg; avoid atomic op for !CONFIG_SMP like x86]
Signed-off-by: Paul Walmsley <pjw@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/include/asm/pgtable.h | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
--- a/arch/riscv/include/asm/pgtable.h
+++ b/arch/riscv/include/asm/pgtable.h
@@ -964,6 +964,23 @@ static inline int pudp_test_and_clear_yo
return ptep_test_and_clear_young(vma, address, (pte_t *)pudp);
}
+#define __HAVE_ARCH_PUDP_HUGE_GET_AND_CLEAR
+static inline pud_t pudp_huge_get_and_clear(struct mm_struct *mm,
+ unsigned long address, pud_t *pudp)
+{
+#ifdef CONFIG_SMP
+ pud_t pud = __pud(xchg(&pudp->pud, 0));
+#else
+ pud_t pud = *pudp;
+
+ pud_clear(pudp);
+#endif
+
+ page_table_check_pud_clear(mm, pud);
+
+ return pud;
+}
+
static inline int pud_young(pud_t pud)
{
return pte_young(pud_pte(pud));
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 131/143] x86/topology: Implement topology_is_core_online() to address SMT regression
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (129 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 130/143] riscv: Use an atomic xchg in pudp_huge_get_and_clear() Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 132/143] x86/Kconfig: Reenable PTDUMP on i386 Greg Kroah-Hartman
` (23 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Loehle, Thomas Gleixner,
Borislav Petkov (AMD), Rafael J. Wysocki (Intel)
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit 2066f00e5b2dc061fb6d8c88fadaebc97f11feaa upstream.
Christian reported that commit a430c11f4015 ("intel_idle: Rescan "dead" SMT
siblings during initialization") broke the use case in which both 'nosmt'
and 'maxcpus' are on the kernel command line because it onlines primary
threads, which were offline due to the maxcpus limit.
The initially proposed fix to skip primary threads in the loop is
inconsistent. While it prevents the primary thread to be onlined, it then
onlines the corresponding hyperthread(s), which does not really make sense.
The CPU iterator in cpuhp_smt_enable() contains a check which excludes all
threads of a core, when the primary thread is offline. The default
implementation is a NOOP and therefore not effective on x86.
Implement topology_is_core_online() on x86 to address this issue. This
makes the behaviour consistent between x86 and PowerPC.
Fixes: a430c11f4015 ("intel_idle: Rescan "dead" SMT siblings during initialization")
Fixes: f694481b1d31 ("ACPI: processor: Rescan "dead" SMT siblings during initialization")
Closes: https://lore.kernel.org/linux-pm/724616a2-6374-4ba3-8ce3-ea9c45e2ae3b@arm.com/
Reported-by: Christian Loehle <christian.loehle@arm.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Rafael J. Wysocki (Intel) <rafael@kernel.org>
Tested-by: Christian Loehle <christian.loehle@arm.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/12740505.O9o76ZdvQC@rafael.j.wysocki
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/topology.h | 10 ++++++++++
arch/x86/kernel/cpu/topology.c | 13 +++++++++++++
2 files changed, 23 insertions(+)
diff --git a/arch/x86/include/asm/topology.h b/arch/x86/include/asm/topology.h
index 6c79ee7c0957..21041898157a 100644
--- a/arch/x86/include/asm/topology.h
+++ b/arch/x86/include/asm/topology.h
@@ -231,6 +231,16 @@ static inline bool topology_is_primary_thread(unsigned int cpu)
}
#define topology_is_primary_thread topology_is_primary_thread
+int topology_get_primary_thread(unsigned int cpu);
+
+static inline bool topology_is_core_online(unsigned int cpu)
+{
+ int pcpu = topology_get_primary_thread(cpu);
+
+ return pcpu >= 0 ? cpu_online(pcpu) : false;
+}
+#define topology_is_core_online topology_is_core_online
+
#else /* CONFIG_SMP */
static inline int topology_phys_to_logical_pkg(unsigned int pkg) { return 0; }
static inline int topology_max_smt_threads(void) { return 1; }
diff --git a/arch/x86/kernel/cpu/topology.c b/arch/x86/kernel/cpu/topology.c
index e35ccdc84910..6073a16628f9 100644
--- a/arch/x86/kernel/cpu/topology.c
+++ b/arch/x86/kernel/cpu/topology.c
@@ -372,6 +372,19 @@ unsigned int topology_unit_count(u32 apicid, enum x86_topology_domains which_uni
return topo_unit_count(lvlid, at_level, apic_maps[which_units].map);
}
+#ifdef CONFIG_SMP
+int topology_get_primary_thread(unsigned int cpu)
+{
+ u32 apic_id = cpuid_to_apicid[cpu];
+
+ /*
+ * Get the core domain level APIC id, which is the primary thread
+ * and return the CPU number assigned to it.
+ */
+ return topo_lookup_cpuid(topo_apicid(apic_id, TOPO_CORE_DOMAIN));
+}
+#endif
+
#ifdef CONFIG_ACPI_HOTPLUG_CPU
/**
* topology_hotplug_apic - Handle a physical hotplugged APIC after boot
--
2.51.0
^ permalink raw reply related [flat|nested] 156+ messages in thread
* [PATCH 6.16 132/143] x86/Kconfig: Reenable PTDUMP on i386
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (130 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 131/143] x86/topology: Implement topology_is_core_online() to address SMT regression Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 133/143] mm/hugetlb: fix folio is still mapped when deleted Greg Kroah-Hartman
` (22 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alexander Popov,
Borislav Petkov (AMD)
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Popov <alex.popov@linux.com>
commit 4f115596133fa168bac06bb34c6efd8f4d84c22e upstream.
The commit
f9aad622006bd64c ("mm: rename GENERIC_PTDUMP and PTDUMP_CORE")
has broken PTDUMP and the Kconfig options that use it on ARCH=i386, including
CONFIG_DEBUG_WX.
CONFIG_GENERIC_PTDUMP was renamed into CONFIG_ARCH_HAS_PTDUMP, but it was
mistakenly moved from "config X86" to "config X86_64". That made PTDUMP
unavailable for i386.
Move CONFIG_ARCH_HAS_PTDUMP back to "config X86" to fix it.
[ bp: Massage commit message. ]
Fixes: f9aad622006bd64c ("mm: rename GENERIC_PTDUMP and PTDUMP_CORE")
Signed-off-by: Alexander Popov <alex.popov@linux.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -26,7 +26,6 @@ config X86_64
depends on 64BIT
# Options that are inherently 64-bit kernel only:
select ARCH_HAS_GIGANTIC_PAGE
- select ARCH_HAS_PTDUMP
select ARCH_SUPPORTS_MSEAL_SYSTEM_MAPPINGS
select ARCH_SUPPORTS_INT128 if CC_HAS_INT128
select ARCH_SUPPORTS_PER_VMA_LOCK
@@ -101,6 +100,7 @@ config X86
select ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE
select ARCH_HAS_PMEM_API if X86_64
select ARCH_HAS_PREEMPT_LAZY
+ select ARCH_HAS_PTDUMP
select ARCH_HAS_PTE_DEVMAP if X86_64
select ARCH_HAS_PTE_SPECIAL
select ARCH_HAS_HW_PTE_YOUNG
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 133/143] mm/hugetlb: fix folio is still mapped when deleted
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (131 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 132/143] x86/Kconfig: Reenable PTDUMP on i386 Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 134/143] mm/damon/sysfs: do not ignore callbacks return value in damon_sysfs_damon_call() Greg Kroah-Hartman
` (21 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jinjiang Tu, David Hildenbrand,
Kefeng Wang, Matthew Wilcox (Oracle), Muchun Song, Oscar Salvador,
Andrew Morton
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjiang Tu <tujinjiang@huawei.com>
commit 7b7387650dcf2881fd8bb55bcf3c8bd6c9542dd7 upstream.
Migration may be raced with fallocating hole. remove_inode_single_folio
will unmap the folio if the folio is still mapped. However, it's called
without folio lock. If the folio is migrated and the mapped pte has been
converted to migration entry, folio_mapped() returns false, and won't
unmap it. Due to extra refcount held by remove_inode_single_folio,
migration fails, restores migration entry to normal pte, and the folio is
mapped again. As a result, we triggered BUG in filemap_unaccount_folio.
The log is as follows:
BUG: Bad page cache in process hugetlb pfn:156c00
page: refcount:515 mapcount:0 mapping:0000000099fef6e1 index:0x0 pfn:0x156c00
head: order:9 mapcount:1 entire_mapcount:1 nr_pages_mapped:0 pincount:0
aops:hugetlbfs_aops ino:dcc dentry name(?):"my_hugepage_file"
flags: 0x17ffffc00000c1(locked|waiters|head|node=0|zone=2|lastcpupid=0x1fffff)
page_type: f4(hugetlb)
page dumped because: still mapped when deleted
CPU: 1 UID: 0 PID: 395 Comm: hugetlb Not tainted 6.17.0-rc5-00044-g7aac71907bde-dirty #484 NONE
Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015
Call Trace:
<TASK>
dump_stack_lvl+0x4f/0x70
filemap_unaccount_folio+0xc4/0x1c0
__filemap_remove_folio+0x38/0x1c0
filemap_remove_folio+0x41/0xd0
remove_inode_hugepages+0x142/0x250
hugetlbfs_fallocate+0x471/0x5a0
vfs_fallocate+0x149/0x380
Hold folio lock before checking if the folio is mapped to avold race with
migration.
Link: https://lkml.kernel.org/r/20250912074139.3575005-1-tujinjiang@huawei.com
Fixes: 4aae8d1c051e ("mm/hugetlbfs: unmap pages if page fault raced with hole punch")
Signed-off-by: Jinjiang Tu <tujinjiang@huawei.com>
Cc: David Hildenbrand <david@redhat.com>
Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/hugetlbfs/inode.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -520,14 +520,16 @@ static bool remove_inode_single_folio(st
/*
* If folio is mapped, it was faulted in after being
- * unmapped in caller. Unmap (again) while holding
- * the fault mutex. The mutex will prevent faults
- * until we finish removing the folio.
+ * unmapped in caller or hugetlb_vmdelete_list() skips
+ * unmapping it due to fail to grab lock. Unmap (again)
+ * while holding the fault mutex. The mutex will prevent
+ * faults until we finish removing the folio. Hold folio
+ * lock to guarantee no concurrent migration.
*/
+ folio_lock(folio);
if (unlikely(folio_mapped(folio)))
hugetlb_unmap_file_folio(h, mapping, folio, index);
- folio_lock(folio);
/*
* We must remove the folio from page cache before removing
* the region/ reserve map (hugetlb_unreserve_pages). In
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 134/143] mm/damon/sysfs: do not ignore callbacks return value in damon_sysfs_damon_call()
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (132 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 133/143] mm/hugetlb: fix folio is still mapped when deleted Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 135/143] fbcon: fix integer overflow in fbcon_do_set_font Greg Kroah-Hartman
` (20 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Akinobu Mita, SeongJae Park,
Andrew Morton
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akinobu Mita <akinobu.mita@gmail.com>
commit 06195ee967d06ead757f9291bbaf1a0b30fa10b8 upstream.
The callback return value is ignored in damon_sysfs_damon_call(), which
means that it is not possible to detect invalid user input when writing
commands such as 'commit' to
/sys/kernel/mm/damon/admin/kdamonds/<K>/state. Fix it.
Link: https://lkml.kernel.org/r/20250920132546.5822-1-akinobu.mita@gmail.com
Fixes: f64539dcdb87 ("mm/damon/sysfs: use damon_call() for update_schemes_stats")
Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Reviewed-by: SeongJae Park <sj@kernel.org>
Cc: <stable@vger.kernel.org> [6.14+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/damon/sysfs.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/mm/damon/sysfs.c
+++ b/mm/damon/sysfs.c
@@ -1576,12 +1576,14 @@ static int damon_sysfs_damon_call(int (*
struct damon_sysfs_kdamond *kdamond)
{
struct damon_call_control call_control = {};
+ int err;
if (!kdamond->damon_ctx)
return -EINVAL;
call_control.fn = fn;
call_control.data = kdamond;
- return damon_call(kdamond->damon_ctx, &call_control);
+ err = damon_call(kdamond->damon_ctx, &call_control);
+ return err ? err : call_control.return_code;
}
struct damon_sysfs_schemes_walk_data {
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 135/143] fbcon: fix integer overflow in fbcon_do_set_font
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (133 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 134/143] mm/damon/sysfs: do not ignore callbacks return value in damon_sysfs_damon_call() Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 136/143] fbcon: Fix OOB access in font allocation Greg Kroah-Hartman
` (19 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Samasth Norway Ananda,
Thomas Zimmermann, George Kennedy, syzbot+38a3699c7eaf165b97a6,
Simona Vetter, Helge Deller, Ville Syrjälä,
Sam Ravnborg, Qianqiang Liu, Shixiong Ou, Kees Cook
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samasth Norway Ananda <samasth.norway.ananda@oracle.com>
commit 1a194e6c8e1ee745e914b0b7f50fa86c89ed13fe upstream.
Fix integer overflow vulnerabilities in fbcon_do_set_font() where font
size calculations could overflow when handling user-controlled font
parameters.
The vulnerabilities occur when:
1. CALC_FONTSZ(h, pitch, charcount) performs h * pith * charcount
multiplication with user-controlled values that can overflow.
2. FONT_EXTRA_WORDS * sizeof(int) + size addition can also overflow
3. This results in smaller allocations than expected, leading to buffer
overflows during font data copying.
Add explicit overflow checking using check_mul_overflow() and
check_add_overflow() kernel helpers to safety validate all size
calculations before allocation.
Signed-off-by: Samasth Norway Ananda <samasth.norway.ananda@oracle.com>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: 39b3cffb8cf3 ("fbcon: prevent user font height or width change from causing potential out-of-bounds access")
Cc: George Kennedy <george.kennedy@oracle.com>
Cc: stable <stable@vger.kernel.org>
Cc: syzbot+38a3699c7eaf165b97a6@syzkaller.appspotmail.com
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Simona Vetter <simona@ffwll.ch>
Cc: Helge Deller <deller@gmx.de>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: "Ville Syrjälä" <ville.syrjala@linux.intel.com>
Cc: Sam Ravnborg <sam@ravnborg.org>
Cc: Qianqiang Liu <qianqiang.liu@163.com>
Cc: Shixiong Ou <oushixiong@kylinos.cn>
Cc: Kees Cook <kees@kernel.org>
Cc: <stable@vger.kernel.org> # v5.9+
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://lore.kernel.org/r/20250912170023.3931881-1-samasth.norway.ananda@oracle.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/core/fbcon.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -2518,9 +2518,16 @@ static int fbcon_set_font(struct vc_data
if (fbcon_invalid_charcount(info, charcount))
return -EINVAL;
- size = CALC_FONTSZ(h, pitch, charcount);
+ /* Check for integer overflow in font size calculation */
+ if (check_mul_overflow(h, pitch, &size) ||
+ check_mul_overflow(size, charcount, &size))
+ return -EINVAL;
+
+ /* Check for overflow in allocation size calculation */
+ if (check_add_overflow(FONT_EXTRA_WORDS * sizeof(int), size, &size))
+ return -EINVAL;
- new_data = kmalloc(FONT_EXTRA_WORDS * sizeof(int) + size, GFP_USER);
+ new_data = kmalloc(size, GFP_USER);
if (!new_data)
return -ENOMEM;
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 136/143] fbcon: Fix OOB access in font allocation
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (134 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 135/143] fbcon: fix integer overflow in fbcon_do_set_font Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 137/143] wifi: iwlwifi: fix byte count table for old devices Greg Kroah-Hartman
` (18 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Zimmermann, Jani Nikula,
Samasth Norway Ananda, George Kennedy, Simona Vetter,
Helge Deller, Ville Syrjälä, Sam Ravnborg,
Qianqiang Liu, Shixiong Ou, Kees Cook, Zsolt Kajtar,
Lucas De Marchi
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <tzimmermann@suse.de>
commit 9b2f5ef00e852f8e8902a4d4f73aeedc60220c12 upstream.
Commit 1a194e6c8e1e ("fbcon: fix integer overflow in fbcon_do_set_font")
introduced an out-of-bounds access by storing data and allocation sizes
in the same variable. Restore the old size calculation and use the new
variable 'alloc_size' for the allocation.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: 1a194e6c8e1e ("fbcon: fix integer overflow in fbcon_do_set_font")
Reported-by: Jani Nikula <jani.nikula@linux.intel.com>
Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15020
Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6201
Cc: Samasth Norway Ananda <samasth.norway.ananda@oracle.com>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: George Kennedy <george.kennedy@oracle.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Simona Vetter <simona@ffwll.ch>
Cc: Helge Deller <deller@gmx.de>
Cc: "Ville Syrjälä" <ville.syrjala@linux.intel.com>
Cc: Sam Ravnborg <sam@ravnborg.org>
Cc: Qianqiang Liu <qianqiang.liu@163.com>
Cc: Shixiong Ou <oushixiong@kylinos.cn>
Cc: Kees Cook <kees@kernel.org>
Cc: <stable@vger.kernel.org> # v5.9+
Cc: Zsolt Kajtar <soci@c64.rulez.org>
Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
Reviewed-by: Qianqiang Liu <qianqiang.liu@163.com>
Link: https://lore.kernel.org/r/20250922134619.257684-1-tzimmermann@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/core/fbcon.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -2491,7 +2491,7 @@ static int fbcon_set_font(struct vc_data
unsigned charcount = font->charcount;
int w = font->width;
int h = font->height;
- int size;
+ int size, alloc_size;
int i, csum;
u8 *new_data, *data = font->data;
int pitch = PITCH(font->width);
@@ -2524,10 +2524,10 @@ static int fbcon_set_font(struct vc_data
return -EINVAL;
/* Check for overflow in allocation size calculation */
- if (check_add_overflow(FONT_EXTRA_WORDS * sizeof(int), size, &size))
+ if (check_add_overflow(FONT_EXTRA_WORDS * sizeof(int), size, &alloc_size))
return -EINVAL;
- new_data = kmalloc(size, GFP_USER);
+ new_data = kmalloc(alloc_size, GFP_USER);
if (!new_data)
return -ENOMEM;
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 137/143] wifi: iwlwifi: fix byte count table for old devices
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (135 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 136/143] fbcon: Fix OOB access in font allocation Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 138/143] wifi: iwlwifi: pcie: fix byte count table for some devices Greg Kroah-Hartman
` (17 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johannes Berg, Emmanuel Grumbach,
Miri Korenblit
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
commit 586e3cb33ba6890054b95aa0ade0a165890efabd upstream.
For devices handled by iwldvm, bc_table_dword was never set, but I missed
that during the removal thereof. Change the logic to not treat the byte
count table as dwords for devices older than 9000 series to fix that.
Fixes: 6570ea227826 ("wifi: iwlwifi: remove bc_table_dword transport config")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20250828095500.eccd7d3939f1.Ibaffa06d0b3aa5f35a9451d94af34de208b8a2bc@changeid
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/intel/iwlwifi/pcie/tx.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
@@ -2093,7 +2093,8 @@ static void iwl_txq_gen1_update_byte_cnt
break;
}
- if (trans->mac_cfg->device_family < IWL_DEVICE_FAMILY_AX210)
+ if (trans->mac_cfg->device_family >= IWL_DEVICE_FAMILY_9000 &&
+ trans->mac_cfg->device_family < IWL_DEVICE_FAMILY_AX210)
len = DIV_ROUND_UP(len, 4);
if (WARN_ON(len > 0xFFF || write_ptr >= TFD_QUEUE_SIZE_MAX))
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 138/143] wifi: iwlwifi: pcie: fix byte count table for some devices
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (136 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 137/143] wifi: iwlwifi: fix byte count table for old devices Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 139/143] sched_ext: idle: Make local functions static in ext_idle.c Greg Kroah-Hartman
` (16 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Wang, Johannes Berg,
Miri Korenblit
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
commit a38108a23ab558b834d71d542d32c05ab0fb64d4 upstream.
In my previous fix for this condition, I erroneously listed 9000
instead of 7000 family, when 7000/8000 were already using iwlmvm.
Thus the condition ended up wrong, causing the issue I had fixed
for older devices to suddenly appear on 7000/8000 family devices.
Correct the condition accordingly.
Reported-by: David Wang <00107082@163.com>
Closes: https://lore.kernel.org/r/20250909165811.10729-1-00107082@163.com/
Fixes: 586e3cb33ba6 ("wifi: iwlwifi: fix byte count table for old devices")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20250915102743.777aaafbcc6c.I84404edfdfbf400501f6fb06def5b86c501da198@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/intel/iwlwifi/pcie/tx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx.c
@@ -2093,7 +2093,7 @@ static void iwl_txq_gen1_update_byte_cnt
break;
}
- if (trans->mac_cfg->device_family >= IWL_DEVICE_FAMILY_9000 &&
+ if (trans->mac_cfg->device_family >= IWL_DEVICE_FAMILY_7000 &&
trans->mac_cfg->device_family < IWL_DEVICE_FAMILY_AX210)
len = DIV_ROUND_UP(len, 4);
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 139/143] sched_ext: idle: Make local functions static in ext_idle.c
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (137 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 138/143] wifi: iwlwifi: pcie: fix byte count table for some devices Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 140/143] sched_ext: idle: Handle migration-disabled tasks in BPF code Greg Kroah-Hartman
` (15 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Andrea Righi, Tejun Heo
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Righi <arighi@nvidia.com>
commit 353656eb84fef8ffece3b1be4345cbacbbb5267f upstream.
Functions that are only used within ext_idle.c can be marked as static
to limit their scope.
No functional changes.
Signed-off-by: Andrea Righi <arighi@nvidia.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/ext_idle.c | 24 +++++++++++++++++-------
kernel/sched/ext_idle.h | 7 -------
2 files changed, 17 insertions(+), 14 deletions(-)
--- a/kernel/sched/ext_idle.c
+++ b/kernel/sched/ext_idle.c
@@ -75,7 +75,7 @@ static int scx_cpu_node_if_enabled(int c
return cpu_to_node(cpu);
}
-bool scx_idle_test_and_clear_cpu(int cpu)
+static bool scx_idle_test_and_clear_cpu(int cpu)
{
int node = scx_cpu_node_if_enabled(cpu);
struct cpumask *idle_cpus = idle_cpumask(node)->cpu;
@@ -198,7 +198,7 @@ pick_idle_cpu_from_online_nodes(const st
/*
* Find an idle CPU in the system, starting from @node.
*/
-s32 scx_pick_idle_cpu(const struct cpumask *cpus_allowed, int node, u64 flags)
+static s32 scx_pick_idle_cpu(const struct cpumask *cpus_allowed, int node, u64 flags)
{
s32 cpu;
@@ -794,6 +794,16 @@ static void reset_idle_masks(struct sche
cpumask_and(idle_cpumask(node)->smt, cpu_online_mask, node_mask);
}
}
+#else /* !CONFIG_SMP */
+static bool scx_idle_test_and_clear_cpu(int cpu)
+{
+ return -EBUSY;
+}
+
+static s32 scx_pick_idle_cpu(const struct cpumask *cpus_allowed, int node, u64 flags)
+{
+ return -EBUSY;
+}
#endif /* CONFIG_SMP */
void scx_idle_enable(struct sched_ext_ops *ops)
@@ -860,8 +870,8 @@ static bool check_builtin_idle_enabled(v
return false;
}
-s32 select_cpu_from_kfunc(struct task_struct *p, s32 prev_cpu, u64 wake_flags,
- const struct cpumask *allowed, u64 flags)
+static s32 select_cpu_from_kfunc(struct task_struct *p, s32 prev_cpu, u64 wake_flags,
+ const struct cpumask *allowed, u64 flags)
{
struct rq *rq;
struct rq_flags rf;
@@ -1125,10 +1135,10 @@ __bpf_kfunc bool scx_bpf_test_and_clear_
if (!check_builtin_idle_enabled())
return false;
- if (kf_cpu_valid(cpu, NULL))
- return scx_idle_test_and_clear_cpu(cpu);
- else
+ if (!kf_cpu_valid(cpu, NULL))
return false;
+
+ return scx_idle_test_and_clear_cpu(cpu);
}
/**
--- a/kernel/sched/ext_idle.h
+++ b/kernel/sched/ext_idle.h
@@ -15,16 +15,9 @@ struct sched_ext_ops;
#ifdef CONFIG_SMP
void scx_idle_update_selcpu_topology(struct sched_ext_ops *ops);
void scx_idle_init_masks(void);
-bool scx_idle_test_and_clear_cpu(int cpu);
-s32 scx_pick_idle_cpu(const struct cpumask *cpus_allowed, int node, u64 flags);
#else /* !CONFIG_SMP */
static inline void scx_idle_update_selcpu_topology(struct sched_ext_ops *ops) {}
static inline void scx_idle_init_masks(void) {}
-static inline bool scx_idle_test_and_clear_cpu(int cpu) { return false; }
-static inline s32 scx_pick_idle_cpu(const struct cpumask *cpus_allowed, int node, u64 flags)
-{
- return -EBUSY;
-}
#endif /* CONFIG_SMP */
s32 scx_select_cpu_dfl(struct task_struct *p, s32 prev_cpu, u64 wake_flags,
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 140/143] sched_ext: idle: Handle migration-disabled tasks in BPF code
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (138 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 139/143] sched_ext: idle: Make local functions static in ext_idle.c Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 141/143] spi: cadence-quadspi: Implement refcount to handle unbind during busy Greg Kroah-Hartman
` (14 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Andrea Righi, Changwoo Min,
Tejun Heo
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Righi <arighi@nvidia.com>
commit 55ed11b181c43d81ce03b50209e4e7c4a14ba099 upstream.
When scx_bpf_select_cpu_dfl()/and() kfuncs are invoked outside of
ops.select_cpu() we can't rely on @p->migration_disabled to determine if
migration is disabled for the task @p.
In fact, migration is always disabled for the current task while running
BPF code: __bpf_prog_enter() disables migration and __bpf_prog_exit()
re-enables it.
To handle this, when @p->migration_disabled == 1, check whether @p is
the current task. If so, migration was not disabled before entering the
callback, otherwise migration was disabled.
This ensures correct idle CPU selection in all cases. The behavior of
ops.select_cpu() remains unchanged, because this callback is never
invoked for the current task and migration-disabled tasks are always
excluded.
Example: without this change scx_bpf_select_cpu_and() called from
ops.enqueue() always returns -EBUSY; with this change applied, it
correctly returns idle CPUs.
Fixes: 06efc9fe0b8de ("sched_ext: idle: Handle migration-disabled tasks in idle selection")
Cc: stable@vger.kernel.org # v6.16+
Signed-off-by: Andrea Righi <arighi@nvidia.com>
Acked-by: Changwoo Min <changwoo@igalia.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/ext_idle.c | 28 +++++++++++++++++++++++++++-
1 file changed, 27 insertions(+), 1 deletion(-)
--- a/kernel/sched/ext_idle.c
+++ b/kernel/sched/ext_idle.c
@@ -870,6 +870,32 @@ static bool check_builtin_idle_enabled(v
return false;
}
+/*
+ * Determine whether @p is a migration-disabled task in the context of BPF
+ * code.
+ *
+ * We can't simply check whether @p->migration_disabled is set in a
+ * sched_ext callback, because migration is always disabled for the current
+ * task while running BPF code.
+ *
+ * The prolog (__bpf_prog_enter) and epilog (__bpf_prog_exit) respectively
+ * disable and re-enable migration. For this reason, the current task
+ * inside a sched_ext callback is always a migration-disabled task.
+ *
+ * Therefore, when @p->migration_disabled == 1, check whether @p is the
+ * current task or not: if it is, then migration was not disabled before
+ * entering the callback, otherwise migration was disabled.
+ *
+ * Returns true if @p is migration-disabled, false otherwise.
+ */
+static bool is_bpf_migration_disabled(const struct task_struct *p)
+{
+ if (p->migration_disabled == 1)
+ return p != current;
+ else
+ return p->migration_disabled;
+}
+
static s32 select_cpu_from_kfunc(struct task_struct *p, s32 prev_cpu, u64 wake_flags,
const struct cpumask *allowed, u64 flags)
{
@@ -913,7 +939,7 @@ static s32 select_cpu_from_kfunc(struct
* selection optimizations and simply check whether the previously
* used CPU is idle and within the allowed cpumask.
*/
- if (p->nr_cpus_allowed == 1 || is_migration_disabled(p)) {
+ if (p->nr_cpus_allowed == 1 || is_bpf_migration_disabled(p)) {
if (cpumask_test_cpu(prev_cpu, allowed ?: p->cpus_ptr) &&
scx_idle_test_and_clear_cpu(prev_cpu))
cpu = prev_cpu;
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 141/143] spi: cadence-quadspi: Implement refcount to handle unbind during busy
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (139 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 140/143] sched_ext: idle: Handle migration-disabled tasks in BPF code Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 142/143] spi: cadence-qspi: defer runtime support on socfpga if reset bit is enabled Greg Kroah-Hartman
` (13 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Khairul Anuar Romli, Matthew Gerlach,
Niravkumar L Rabara, Mark Brown, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Khairul Anuar Romli <khairul.anuar.romli@altera.com>
[ Upstream commit 7446284023e8ef694fb392348185349c773eefb3 ]
driver support indirect read and indirect write operation with
assumption no force device removal(unbind) operation. However
force device removal(removal) is still available to root superuser.
Unbinding driver during operation causes kernel crash. This changes
ensure driver able to handle such operation for indirect read and
indirect write by implementing refcount to track attached devices
to the controller and gracefully wait and until attached devices
remove operation completed before proceed with removal operation.
Signed-off-by: Khairul Anuar Romli <khairul.anuar.romli@altera.com>
Reviewed-by: Matthew Gerlach <matthew.gerlach@altera.com>
Reviewed-by: Niravkumar L Rabara <nirav.rabara@altera.com>
Link: https://patch.msgid.link/8704fd6bd2ff4d37bba4a0eacf5eba3ba001079e.1756168074.git.khairul.anuar.romli@altera.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: 30dbc1c8d50f ("spi: cadence-qspi: defer runtime support on socfpga if reset bit is enabled")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-cadence-quadspi.c | 33 +++++++++++++++++++++++++++++++++
1 file changed, 33 insertions(+)
--- a/drivers/spi/spi-cadence-quadspi.c
+++ b/drivers/spi/spi-cadence-quadspi.c
@@ -108,6 +108,8 @@ struct cqspi_st {
bool is_jh7110; /* Flag for StarFive JH7110 SoC */
bool disable_stig_mode;
+ refcount_t refcount;
+ refcount_t inflight_ops;
const struct cqspi_driver_platdata *ddata;
};
@@ -735,6 +737,9 @@ static int cqspi_indirect_read_execute(s
u8 *rxbuf_end = rxbuf + n_rx;
int ret = 0;
+ if (!refcount_read(&cqspi->refcount))
+ return -ENODEV;
+
writel(from_addr, reg_base + CQSPI_REG_INDIRECTRDSTARTADDR);
writel(remaining, reg_base + CQSPI_REG_INDIRECTRDBYTES);
@@ -1071,6 +1076,9 @@ static int cqspi_indirect_write_execute(
unsigned int write_bytes;
int ret;
+ if (!refcount_read(&cqspi->refcount))
+ return -ENODEV;
+
writel(to_addr, reg_base + CQSPI_REG_INDIRECTWRSTARTADDR);
writel(remaining, reg_base + CQSPI_REG_INDIRECTWRBYTES);
@@ -1461,12 +1469,26 @@ static int cqspi_exec_mem_op(struct spi_
struct cqspi_st *cqspi = spi_controller_get_devdata(mem->spi->controller);
struct device *dev = &cqspi->pdev->dev;
+ if (refcount_read(&cqspi->inflight_ops) == 0)
+ return -ENODEV;
+
ret = pm_runtime_resume_and_get(dev);
if (ret) {
dev_err(&mem->spi->dev, "resume failed with %d\n", ret);
return ret;
}
+ if (!refcount_read(&cqspi->refcount))
+ return -EBUSY;
+
+ refcount_inc(&cqspi->inflight_ops);
+
+ if (!refcount_read(&cqspi->refcount)) {
+ if (refcount_read(&cqspi->inflight_ops))
+ refcount_dec(&cqspi->inflight_ops);
+ return -EBUSY;
+ }
+
ret = cqspi_mem_process(mem, op);
pm_runtime_mark_last_busy(dev);
@@ -1475,6 +1497,9 @@ static int cqspi_exec_mem_op(struct spi_
if (ret)
dev_err(&mem->spi->dev, "operation failed with %d\n", ret);
+ if (refcount_read(&cqspi->inflight_ops) > 1)
+ refcount_dec(&cqspi->inflight_ops);
+
return ret;
}
@@ -1926,6 +1951,9 @@ static int cqspi_probe(struct platform_d
}
}
+ refcount_set(&cqspi->refcount, 1);
+ refcount_set(&cqspi->inflight_ops, 1);
+
ret = devm_request_irq(dev, irq, cqspi_irq_handler, 0,
pdev->name, cqspi);
if (ret) {
@@ -1989,6 +2017,11 @@ static void cqspi_remove(struct platform
{
struct cqspi_st *cqspi = platform_get_drvdata(pdev);
+ refcount_set(&cqspi->refcount, 0);
+
+ if (!refcount_dec_and_test(&cqspi->inflight_ops))
+ cqspi_wait_idle(cqspi);
+
spi_unregister_controller(cqspi->host);
cqspi_controller_enable(cqspi, 0);
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 142/143] spi: cadence-qspi: defer runtime support on socfpga if reset bit is enabled
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (140 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 141/143] spi: cadence-quadspi: Implement refcount to handle unbind during busy Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 143/143] iommufd: Fix race during abort for file descriptors Greg Kroah-Hartman
` (12 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Khairul Anuar Romli,
Adrian Ng Ho Yin, Niravkumar L Rabara, Matthew Gerlach,
Mark Brown, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Khairul Anuar Romli <khairul.anuar.romli@altera.com>
[ Upstream commit 30dbc1c8d50f13c1581b49abe46fe89f393eacbf ]
Enabling runtime PM allows the kernel to gate clocks and power to idle
devices. On SoCFPGA, a warm reset does not fully reinitialize these
domains.This leaves devices suspended and powered down, preventing U-Boot
or the kernel from reusing them after a warm reset, which breaks the boot
process.
Fixes: 4892b374c9b7 ("mtd: spi-nor: cadence-quadspi: Add runtime PM support")
CC: stable@vger.kernel.org # 6.12+
Signed-off-by: Khairul Anuar Romli <khairul.anuar.romli@altera.com>
Signed-off-by: Adrian Ng Ho Yin <adrianhoyin.ng@altera.com>
Reviewed-by: Niravkumar L Rabara <nirav.rabara@altera.com>
Reviewed-by: Matthew Gerlach <matthew.gerlach@altera.com>
Link: https://patch.msgid.link/910aad68ba5d948919a7b90fa85a2fadb687229b.1757491372.git.khairul.anuar.romli@altera.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-cadence-quadspi.c | 57 +++++++++++++++++++++++++-------------
1 file changed, 38 insertions(+), 19 deletions(-)
--- a/drivers/spi/spi-cadence-quadspi.c
+++ b/drivers/spi/spi-cadence-quadspi.c
@@ -46,6 +46,7 @@ static_assert(CQSPI_MAX_CHIPSELECT <= SP
#define CQSPI_DMA_SET_MASK BIT(7)
#define CQSPI_SUPPORT_DEVICE_RESET BIT(8)
#define CQSPI_DISABLE_STIG_MODE BIT(9)
+#define CQSPI_DISABLE_RUNTIME_PM BIT(10)
/* Capabilities */
#define CQSPI_SUPPORTS_OCTAL BIT(0)
@@ -1468,14 +1469,17 @@ static int cqspi_exec_mem_op(struct spi_
int ret;
struct cqspi_st *cqspi = spi_controller_get_devdata(mem->spi->controller);
struct device *dev = &cqspi->pdev->dev;
+ const struct cqspi_driver_platdata *ddata = of_device_get_match_data(dev);
if (refcount_read(&cqspi->inflight_ops) == 0)
return -ENODEV;
- ret = pm_runtime_resume_and_get(dev);
- if (ret) {
- dev_err(&mem->spi->dev, "resume failed with %d\n", ret);
- return ret;
+ if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM))) {
+ ret = pm_runtime_resume_and_get(dev);
+ if (ret) {
+ dev_err(&mem->spi->dev, "resume failed with %d\n", ret);
+ return ret;
+ }
}
if (!refcount_read(&cqspi->refcount))
@@ -1491,8 +1495,10 @@ static int cqspi_exec_mem_op(struct spi_
ret = cqspi_mem_process(mem, op);
- pm_runtime_mark_last_busy(dev);
- pm_runtime_put_autosuspend(dev);
+ if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM))) {
+ pm_runtime_mark_last_busy(dev);
+ pm_runtime_put_autosuspend(dev);
+ }
if (ret)
dev_err(&mem->spi->dev, "operation failed with %d\n", ret);
@@ -1986,11 +1992,12 @@ static int cqspi_probe(struct platform_d
goto probe_setup_failed;
}
- pm_runtime_enable(dev);
-
- pm_runtime_set_autosuspend_delay(dev, CQSPI_AUTOSUSPEND_TIMEOUT);
- pm_runtime_use_autosuspend(dev);
- pm_runtime_get_noresume(dev);
+ if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM))) {
+ pm_runtime_enable(dev);
+ pm_runtime_set_autosuspend_delay(dev, CQSPI_AUTOSUSPEND_TIMEOUT);
+ pm_runtime_use_autosuspend(dev);
+ pm_runtime_get_noresume(dev);
+ }
ret = spi_register_controller(host);
if (ret) {
@@ -1998,13 +2005,17 @@ static int cqspi_probe(struct platform_d
goto probe_setup_failed;
}
- pm_runtime_mark_last_busy(dev);
- pm_runtime_put_autosuspend(dev);
+ if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM))) {
+ pm_runtime_put_autosuspend(dev);
+ pm_runtime_mark_last_busy(dev);
+ pm_runtime_put_autosuspend(dev);
+ }
return 0;
probe_setup_failed:
cqspi_controller_enable(cqspi, 0);
- pm_runtime_disable(dev);
+ if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM)))
+ pm_runtime_disable(dev);
probe_reset_failed:
if (cqspi->is_jh7110)
cqspi_jh7110_disable_clk(pdev, cqspi);
@@ -2015,7 +2026,11 @@ probe_clk_failed:
static void cqspi_remove(struct platform_device *pdev)
{
+ const struct cqspi_driver_platdata *ddata;
struct cqspi_st *cqspi = platform_get_drvdata(pdev);
+ struct device *dev = &pdev->dev;
+
+ ddata = of_device_get_match_data(dev);
refcount_set(&cqspi->refcount, 0);
@@ -2028,14 +2043,17 @@ static void cqspi_remove(struct platform
if (cqspi->rx_chan)
dma_release_channel(cqspi->rx_chan);
- if (pm_runtime_get_sync(&pdev->dev) >= 0)
- clk_disable(cqspi->clk);
+ if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM)))
+ if (pm_runtime_get_sync(&pdev->dev) >= 0)
+ clk_disable(cqspi->clk);
if (cqspi->is_jh7110)
cqspi_jh7110_disable_clk(pdev, cqspi);
- pm_runtime_put_sync(&pdev->dev);
- pm_runtime_disable(&pdev->dev);
+ if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM))) {
+ pm_runtime_put_sync(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
+ }
}
static int cqspi_runtime_suspend(struct device *dev)
@@ -2114,7 +2132,8 @@ static const struct cqspi_driver_platdat
.quirks = CQSPI_DISABLE_DAC_MODE
| CQSPI_NO_SUPPORT_WR_COMPLETION
| CQSPI_SLOW_SRAM
- | CQSPI_DISABLE_STIG_MODE,
+ | CQSPI_DISABLE_STIG_MODE
+ | CQSPI_DISABLE_RUNTIME_PM,
};
static const struct cqspi_driver_platdata versal_ospi = {
^ permalink raw reply [flat|nested] 156+ messages in thread
* [PATCH 6.16 143/143] iommufd: Fix race during abort for file descriptors
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (141 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 142/143] spi: cadence-qspi: defer runtime support on socfpga if reset bit is enabled Greg Kroah-Hartman
@ 2025-09-30 14:47 ` Greg Kroah-Hartman
2025-09-30 18:48 ` 6.16.10-rc1 review Brett A C Sheffield
` (11 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Greg Kroah-Hartman @ 2025-09-30 14:47 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nicolin Chen, Nirmoy Das, Kevin Tian,
syzbot+80620e2d0d0a33b09f93, Jason Gunthorpe, Sasha Levin
6.16-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <jgg@nvidia.com>
[ Upstream commit 4e034bf045b12852a24d5d33f2451850818ba0c1 ]
fput() doesn't actually call file_operations release() synchronously, it
puts the file on a work queue and it will be released eventually.
This is normally fine, except for iommufd the file and the iommufd_object
are tied to gether. The file has the object as it's private_data and holds
a users refcount, while the object is expected to remain alive as long as
the file is.
When the allocation of a new object aborts before installing the file it
will fput() the file and then go on to immediately kfree() the obj. This
causes a UAF once the workqueue completes the fput() and tries to
decrement the users refcount.
Fix this by putting the core code in charge of the file lifetime, and call
__fput_sync() during abort to ensure that release() is called before
kfree. __fput_sync() is a bit too tricky to open code in all the object
implementations. Instead the objects tell the core code where the file
pointer is and the core will take care of the life cycle.
If the object is successfully allocated then the file will hold a users
refcount and the iommufd_object cannot be destroyed.
It is worth noting that close(); ioctl(IOMMU_DESTROY); doesn't have an
issue because close() is already using a synchronous version of fput().
The UAF looks like this:
BUG: KASAN: slab-use-after-free in iommufd_eventq_fops_release+0x45/0xc0 drivers/iommu/iommufd/eventq.c:376
Write of size 4 at addr ffff888059c97804 by task syz.0.46/6164
CPU: 0 UID: 0 PID: 6164 Comm: syz.0.46 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xcd/0x630 mm/kasan/report.c:482
kasan_report+0xe0/0x110 mm/kasan/report.c:595
check_region_inline mm/kasan/generic.c:183 [inline]
kasan_check_range+0x100/0x1b0 mm/kasan/generic.c:189
instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline]
__refcount_dec include/linux/refcount.h:455 [inline]
refcount_dec include/linux/refcount.h:476 [inline]
iommufd_eventq_fops_release+0x45/0xc0 drivers/iommu/iommufd/eventq.c:376
__fput+0x402/0xb70 fs/file_table.c:468
task_work_run+0x14d/0x240 kernel/task_work.c:227
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:43
exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
do_syscall_64+0x41c/0x4c0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Link: https://patch.msgid.link/r/1-v1-02cd136829df+31-iommufd_syz_fput_jgg@nvidia.com
Cc: stable@vger.kernel.org
Fixes: 07838f7fd529 ("iommufd: Add iommufd fault object")
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Reviewed-by: Nirmoy Das <nirmoyd@nvidia.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
Reported-by: syzbot+80620e2d0d0a33b09f93@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/r/68c8583d.050a0220.2ff435.03a2.GAE@google.com
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
[ Adjust context ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/iommufd/eventq.c | 9 ++-------
drivers/iommu/iommufd/main.c | 35 ++++++++++++++++++++++++++++++++---
2 files changed, 34 insertions(+), 10 deletions(-)
--- a/drivers/iommu/iommufd/eventq.c
+++ b/drivers/iommu/iommufd/eventq.c
@@ -393,12 +393,12 @@ static int iommufd_eventq_init(struct io
const struct file_operations *fops)
{
struct file *filep;
- int fdno;
spin_lock_init(&eventq->lock);
INIT_LIST_HEAD(&eventq->deliver);
init_waitqueue_head(&eventq->wait_queue);
+ /* The filep is fput() by the core code during failure */
filep = anon_inode_getfile(name, fops, eventq, O_RDWR);
if (IS_ERR(filep))
return PTR_ERR(filep);
@@ -408,10 +408,7 @@ static int iommufd_eventq_init(struct io
eventq->filep = filep;
refcount_inc(&eventq->obj.users);
- fdno = get_unused_fd_flags(O_CLOEXEC);
- if (fdno < 0)
- fput(filep);
- return fdno;
+ return get_unused_fd_flags(O_CLOEXEC);
}
static const struct file_operations iommufd_fault_fops =
@@ -455,7 +452,6 @@ int iommufd_fault_alloc(struct iommufd_u
return 0;
out_put_fdno:
put_unused_fd(fdno);
- fput(fault->common.filep);
out_abort:
iommufd_object_abort_and_destroy(ucmd->ictx, &fault->common.obj);
@@ -542,7 +538,6 @@ int iommufd_veventq_alloc(struct iommufd
out_put_fdno:
put_unused_fd(fdno);
- fput(veventq->common.filep);
out_abort:
iommufd_object_abort_and_destroy(ucmd->ictx, &veventq->common.obj);
out_unlock_veventqs:
--- a/drivers/iommu/iommufd/main.c
+++ b/drivers/iommu/iommufd/main.c
@@ -23,6 +23,7 @@
#include "iommufd_test.h"
struct iommufd_object_ops {
+ size_t file_offset;
void (*destroy)(struct iommufd_object *obj);
void (*abort)(struct iommufd_object *obj);
};
@@ -71,10 +72,30 @@ void iommufd_object_abort(struct iommufd
void iommufd_object_abort_and_destroy(struct iommufd_ctx *ictx,
struct iommufd_object *obj)
{
- if (iommufd_object_ops[obj->type].abort)
- iommufd_object_ops[obj->type].abort(obj);
+ const struct iommufd_object_ops *ops = &iommufd_object_ops[obj->type];
+
+ if (ops->file_offset) {
+ struct file **filep = ((void *)obj) + ops->file_offset;
+
+ /*
+ * A file should hold a users refcount while the file is open
+ * and put it back in its release. The file should hold a
+ * pointer to obj in their private data. Normal fput() is
+ * deferred to a workqueue and can get out of order with the
+ * following kfree(obj). Using the sync version ensures the
+ * release happens immediately. During abort we require the file
+ * refcount is one at this point - meaning the object alloc
+ * function cannot do anything to allow another thread to take a
+ * refcount prior to a guaranteed success.
+ */
+ if (*filep)
+ __fput_sync(*filep);
+ }
+
+ if (ops->abort)
+ ops->abort(obj);
else
- iommufd_object_ops[obj->type].destroy(obj);
+ ops->destroy(obj);
iommufd_object_abort(ictx, obj);
}
@@ -493,6 +514,12 @@ void iommufd_ctx_put(struct iommufd_ctx
}
EXPORT_SYMBOL_NS_GPL(iommufd_ctx_put, "IOMMUFD");
+#define IOMMUFD_FILE_OFFSET(_struct, _filep, _obj) \
+ .file_offset = (offsetof(_struct, _filep) + \
+ BUILD_BUG_ON_ZERO(!__same_type( \
+ struct file *, ((_struct *)NULL)->_filep)) + \
+ BUILD_BUG_ON_ZERO(offsetof(_struct, _obj)))
+
static const struct iommufd_object_ops iommufd_object_ops[] = {
[IOMMUFD_OBJ_ACCESS] = {
.destroy = iommufd_access_destroy_object,
@@ -502,6 +529,7 @@ static const struct iommufd_object_ops i
},
[IOMMUFD_OBJ_FAULT] = {
.destroy = iommufd_fault_destroy,
+ IOMMUFD_FILE_OFFSET(struct iommufd_fault, common.filep, common.obj),
},
[IOMMUFD_OBJ_HWPT_PAGING] = {
.destroy = iommufd_hwpt_paging_destroy,
@@ -520,6 +548,7 @@ static const struct iommufd_object_ops i
[IOMMUFD_OBJ_VEVENTQ] = {
.destroy = iommufd_veventq_destroy,
.abort = iommufd_veventq_abort,
+ IOMMUFD_FILE_OFFSET(struct iommufd_veventq, common.filep, common.obj),
},
[IOMMUFD_OBJ_VIOMMU] = {
.destroy = iommufd_viommu_destroy,
^ permalink raw reply [flat|nested] 156+ messages in thread
* Re: 6.16.10-rc1 review
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (142 preceding siblings ...)
2025-09-30 14:47 ` [PATCH 6.16 143/143] iommufd: Fix race during abort for file descriptors Greg Kroah-Hartman
@ 2025-09-30 18:48 ` Brett A C Sheffield
2025-09-30 19:16 ` [PATCH 6.16 000/143] " Florian Fainelli
` (10 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Brett A C Sheffield @ 2025-09-30 18:48 UTC (permalink / raw)
To: gregkh
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill,
Brett A C Sheffield
# Librecast Test Results
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast
CPU/kernel: Linux auntie 6.16.10-rc1-ge1acc616e91a #91 SMP PREEMPT_DYNAMIC Tue Sep 30 15:12:29 -00 2025 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux
Tested-by: Brett A C Sheffield <bacs@librecast.net>
^ permalink raw reply [flat|nested] 156+ messages in thread
* Re: [PATCH 6.16 000/143] 6.16.10-rc1 review
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (143 preceding siblings ...)
2025-09-30 18:48 ` 6.16.10-rc1 review Brett A C Sheffield
@ 2025-09-30 19:16 ` Florian Fainelli
2025-09-30 21:10 ` Peter Schneider
` (9 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Florian Fainelli @ 2025-09-30 19:16 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, sudipm.mukherjee, rwarsow, conor,
hargar, broonie, achill
On 9/30/25 07:45, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.16.10 release.
> There are 143 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 02 Oct 2025 14:37:59 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.16.10-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.16.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on
BMIPS_GENERIC:
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
--
Florian
^ permalink raw reply [flat|nested] 156+ messages in thread
* Re: [PATCH 6.16 000/143] 6.16.10-rc1 review
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (144 preceding siblings ...)
2025-09-30 19:16 ` [PATCH 6.16 000/143] " Florian Fainelli
@ 2025-09-30 21:10 ` Peter Schneider
2025-10-01 2:45 ` Ron Economos
` (8 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Peter Schneider @ 2025-09-30 21:10 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill
Am 30.09.2025 um 16:45 schrieb Greg Kroah-Hartman:
> This is the start of the stable review cycle for the 6.16.10 release.
> There are 143 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg oddities or regressions found.
Tested-by: Peter Schneider <pschneider1968@googlemail.com>
Beste Grüße,
Peter Schneider
--
Climb the mountain not to plant your flag, but to embrace the challenge,
enjoy the air and behold the view. Climb it so you can see the world,
not so the world can see you. -- David McCullough Jr.
OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244
Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@googlemail.com
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@gmail.com
^ permalink raw reply [flat|nested] 156+ messages in thread
* Re: [PATCH 6.16 000/143] 6.16.10-rc1 review
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (145 preceding siblings ...)
2025-09-30 21:10 ` Peter Schneider
@ 2025-10-01 2:45 ` Ron Economos
2025-10-01 7:01 ` Dileep malepu
` (7 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Ron Economos @ 2025-10-01 2:45 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill
On 9/30/25 07:45, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.16.10 release.
> There are 143 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 02 Oct 2025 14:37:59 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.16.10-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.16.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Tested-by: Ron Economos <re@w6rz.net>
^ permalink raw reply [flat|nested] 156+ messages in thread
* Re: [PATCH 6.16 000/143] 6.16.10-rc1 review
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (146 preceding siblings ...)
2025-10-01 2:45 ` Ron Economos
@ 2025-10-01 7:01 ` Dileep malepu
2025-10-01 8:49 ` Naresh Kamboju
` (6 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Dileep malepu @ 2025-10-01 7:01 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill
On Tue, Sep 30, 2025 at 8:34 PM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.16.10 release.
> There are 143 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 02 Oct 2025 14:37:59 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.16.10-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.16.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
> -------------
Build and boot tested 6.16.10-rc1 using qemu-x86_64. The kernel was
successfully built and booted in a virtualized environment without
issues.
Build
kernel: 6.16.10-rc1
git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git commit: e1acc616e91adfbab433eb599e00d88f0bcdb07f
Tested-by: Dileep Malepu <dileep.debian@gmail.com>
Best regards
Dileep Malepu.
^ permalink raw reply [flat|nested] 156+ messages in thread
* Re: [PATCH 6.16 000/143] 6.16.10-rc1 review
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (147 preceding siblings ...)
2025-10-01 7:01 ` Dileep malepu
@ 2025-10-01 8:49 ` Naresh Kamboju
2025-10-01 9:12 ` Jon Hunter
` (5 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Naresh Kamboju @ 2025-10-01 8:49 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill
On Tue, 30 Sept 2025 at 20:31, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.16.10 release.
> There are 143 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 02 Oct 2025 14:37:59 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.16.10-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.16.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
## Build
* kernel: 6.16.10-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git commit: e1acc616e91adfbab433eb599e00d88f0bcdb07f
* git describe: v6.16.9-144-ge1acc616e91a
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.16.y/build/v6.16.9-144-ge1acc616e91a
## Test Regressions (compared to v6.16.8-150-gfef8d1e3eca6)
## Metric Regressions (compared to v6.16.8-150-gfef8d1e3eca6)
## Test Fixes (compared to v6.16.8-150-gfef8d1e3eca6)
## Metric Fixes (compared to v6.16.8-150-gfef8d1e3eca6)
## Test result summary
total: 351365, pass: 323894, fail: 6740, skip: 20731, xfail: 0
## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 139 total, 138 passed, 1 failed
* arm64: 57 total, 56 passed, 1 failed
* i386: 18 total, 18 passed, 0 failed
* mips: 34 total, 27 passed, 7 failed
* parisc: 4 total, 4 passed, 0 failed
* powerpc: 40 total, 39 passed, 1 failed
* riscv: 25 total, 25 passed, 0 failed
* s390: 22 total, 22 passed, 0 failed
* sh: 5 total, 5 passed, 0 failed
* sparc: 4 total, 3 passed, 1 failed
* x86_64: 49 total, 47 passed, 2 failed
## Test suites summary
* boot
* commands
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-efivarfs
* kselftest-exec
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-kcmp
* kselftest-kvm
* kselftest-livepatch
* kselftest-membarrier
* kselftest-memfd
* kselftest-mincore
* kselftest-mm
* kselftest-mqueue
* kselftest-net
* kselftest-net-mptcp
* kselftest-openat2
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-rust
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-tc-testing
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user_events
* kselftest-vDSO
* kselftest-x86
* kunit
* kvm-unit-tests
* lava
* libgpiod
* libhugetlbfs
* log-parser-boot
* log-parser-build-clang
* log-parser-build-gcc
* log-parser-test
* ltp-capability
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-hugetlb
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* modules
* perf
* rcutorture
* rt-tests-cyclicdeadline
* rt-tests-pi-stress
* rt-tests-pmqtest
* rt-tests-rt-migrate-test
* rt-tests-signaltest
--
Linaro LKFT
https://lkft.linaro.org
^ permalink raw reply [flat|nested] 156+ messages in thread
* Re: [PATCH 6.16 000/143] 6.16.10-rc1 review
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (148 preceding siblings ...)
2025-10-01 8:49 ` Naresh Kamboju
@ 2025-10-01 9:12 ` Jon Hunter
2025-10-01 10:13 ` Mark Brown
` (4 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Jon Hunter @ 2025-10-01 9:12 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill,
linux-tegra, stable
On Tue, 30 Sep 2025 16:45:24 +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.16.10 release.
> There are 143 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 02 Oct 2025 14:37:59 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.16.10-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.16.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
All tests passing for Tegra ...
Test results for stable-v6.16:
10 builds: 10 pass, 0 fail
28 boots: 28 pass, 0 fail
120 tests: 120 pass, 0 fail
Linux version: 6.16.10-rc1-ge1acc616e91a
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra186-p3509-0000+p3636-0001, tegra194-p2972-0000,
tegra194-p3509-0000+p3668-0000, tegra20-ventana,
tegra210-p2371-2180, tegra210-p3450-0000,
tegra30-cardhu-a04
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Jon
^ permalink raw reply [flat|nested] 156+ messages in thread
* Re: [PATCH 6.16 000/143] 6.16.10-rc1 review
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (149 preceding siblings ...)
2025-10-01 9:12 ` Jon Hunter
@ 2025-10-01 10:13 ` Mark Brown
2025-10-01 12:07 ` Takeshi Ogasawara
` (3 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Mark Brown @ 2025-10-01 10:13 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, achill
[-- Attachment #1: Type: text/plain, Size: 346 bytes --]
On Tue, Sep 30, 2025 at 04:45:24PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.16.10 release.
> There are 143 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
Tested-by: Mark Brown <broonie@kernel.org>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 156+ messages in thread
* Re: [PATCH 6.16 000/143] 6.16.10-rc1 review
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (150 preceding siblings ...)
2025-10-01 10:13 ` Mark Brown
@ 2025-10-01 12:07 ` Takeshi Ogasawara
2025-10-01 13:46 ` Justin Forbes
` (2 subsequent siblings)
154 siblings, 0 replies; 156+ messages in thread
From: Takeshi Ogasawara @ 2025-10-01 12:07 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill
Hi Greg
On Wed, Oct 1, 2025 at 12:02 AM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.16.10 release.
> There are 143 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 02 Oct 2025 14:37:59 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.16.10-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.16.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
6.16.10-rc1 tested.
Build successfully completed.
Boot successfully completed.
No dmesg regressions.
Video output normal.
Sound output normal.
Lenovo ThinkPad X1 Carbon Gen10(Intel i7-1260P(x86_64) arch linux)
[ 0.000000] Linux version 6.16.10-rc1rv-ge1acc616e91a
(takeshi@ThinkPadX1Gen10J0764) (gcc (GCC) 15.2.1 20250813, GNU ld (GNU
Binutils) 2.45.0) #1 SMP PREEMPT_DYNAMIC Wed Oct 1 20:37:04 JST 2025
Thanks
Tested-by: Takeshi Ogasawara <takeshi.ogasawara@futuring-girl.com>
^ permalink raw reply [flat|nested] 156+ messages in thread
* Re: [PATCH 6.16 000/143] 6.16.10-rc1 review
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (151 preceding siblings ...)
2025-10-01 12:07 ` Takeshi Ogasawara
@ 2025-10-01 13:46 ` Justin Forbes
2025-10-01 16:02 ` Shuah Khan
2025-10-01 17:49 ` Miguel Ojeda
154 siblings, 0 replies; 156+ messages in thread
From: Justin Forbes @ 2025-10-01 13:46 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill
On Tue, Sep 30, 2025 at 04:45:24PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.16.10 release.
> There are 143 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 02 Oct 2025 14:37:59 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.16.10-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.16.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Tested rc1 against the Fedora build system (aarch64, ppc64le, s390x,
x86_64), and boot tested x86_64. No regressions noted.
Tested-by: Justin M. Forbes <jforbes@fedoraproject.org>
^ permalink raw reply [flat|nested] 156+ messages in thread
* Re: [PATCH 6.16 000/143] 6.16.10-rc1 review
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (152 preceding siblings ...)
2025-10-01 13:46 ` Justin Forbes
@ 2025-10-01 16:02 ` Shuah Khan
2025-10-01 17:49 ` Miguel Ojeda
154 siblings, 0 replies; 156+ messages in thread
From: Shuah Khan @ 2025-10-01 16:02 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill, Shuah Khan
On 9/30/25 08:45, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.16.10 release.
> There are 143 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 02 Oct 2025 14:37:59 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.16.10-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.16.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Compiled and booted on my test system. No dmesg regressions.
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
thanks,
-- Shuah
^ permalink raw reply [flat|nested] 156+ messages in thread
* Re: [PATCH 6.16 000/143] 6.16.10-rc1 review
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
` (153 preceding siblings ...)
2025-10-01 16:02 ` Shuah Khan
@ 2025-10-01 17:49 ` Miguel Ojeda
154 siblings, 0 replies; 156+ messages in thread
From: Miguel Ojeda @ 2025-10-01 17:49 UTC (permalink / raw)
To: gregkh
Cc: achill, akpm, broonie, conor, f.fainelli, hargar, jonathanh,
linux-kernel, linux, lkft-triage, patches, patches, pavel,
rwarsow, shuah, stable, sudipm.mukherjee, torvalds, Miguel Ojeda
On Tue, 30 Sep 2025 16:45:24 +0200 Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.16.10 release.
> There are 143 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 02 Oct 2025 14:37:59 +0000.
> Anything received after that time might be too late.
Boot-tested under QEMU for Rust x86_64, arm64 and riscv64; built-tested
for arm and loongarch64:
Tested-by: Miguel Ojeda <ojeda@kernel.org>
Thanks!
Cheers,
Miguel
^ permalink raw reply [flat|nested] 156+ messages in thread
end of thread, other threads:[~2025-10-01 17:49 UTC | newest]
Thread overview: 156+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-09-30 14:45 [PATCH 6.16 000/143] 6.16.10-rc1 review Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 001/143] scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 002/143] firewire: core: fix overlooked update of subsystem ABI version Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 003/143] ALSA: usb-audio: Fix code alignment in mixer_quirks Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 004/143] ALSA: usb-audio: Fix whitespace & blank line issues " Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 005/143] ALSA: usb-audio: Fix block comments " Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 006/143] ALSA: usb-audio: Drop unnecessary parentheses " Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 007/143] ALSA: usb-audio: Avoid multiple assignments " Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 008/143] ALSA: usb-audio: Simplify NULL comparison " Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 009/143] ALSA: usb-audio: Remove unneeded wmb() " Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 010/143] ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 011/143] HID: multitouch: Get the contact ID from HID_DG_TRANSDUCER_INDEX fields in case of Apple Touch Bar Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 012/143] HID: multitouch: support getting the tip state from HID_DG_TOUCH fields in " Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 013/143] HID: multitouch: take cls->maxcontacts into account for Apple Touch Bar even without a HID_DG_CONTACTMAX field Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 014/143] HID: multitouch: specify that Apple Touch Bar is direct Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 015/143] ALSA: usb-audio: Convert comma to semicolon Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 016/143] ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 017/143] ALSA: usb-audio: Fix build with CONFIG_INPUT=n Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 018/143] usb: core: Add 0x prefix to quirks debug output Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 019/143] net: fec: rename struct fec_devinfo fec_imx6x_info -> fec_imx6sx_info Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 020/143] net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 021/143] drm/panfrost: Drop duplicated Mediatek supplies arrays Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 022/143] drm/panfrost: Commonize Mediatek power domain array definitions Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 023/143] drm/panfrost: Add support for Mali on the MT8370 SoC Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 024/143] mmc: sdhci-cadence: add Mobileye eyeQ support Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 025/143] i2c: designware: Add quirk for Intel Xe Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 026/143] ASoC: Intel: soc-acpi: Add entry for sof_es8336 in PTL match table Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 027/143] ASoC: Intel: soc-acpi: Add entry for HDMI_In capture support " Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 028/143] ASoC: Intel: sof_rt5682: Add HDMI-In capture with rt5682 support for PTL Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 029/143] platform/x86: oxpec: Add support for OneXPlayer X1 Mini Pro (Strix Point) Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 030/143] ALSA: usb-audio: Add DSD support for Comtrue USB Audio device Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 031/143] gpiolib: acpi: Add quirk for ASUS ProArt PX13 Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 032/143] ALSA: usb-audio: move mixer_quirks min_mute into common quirk Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 033/143] ALSA: usb-audio: Add mute TLV for playback volumes on more devices Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 034/143] net: sfp: add quirk for FLYPRO copper SFP+ module Greg Kroah-Hartman
2025-09-30 14:45 ` [PATCH 6.16 035/143] IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 036/143] HID: cp2112: fix setter callbacks return value Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 037/143] HID: amd_sfh: Add sync across amd sfh work functions Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 038/143] arm64: dts: rockchip: Fix the headphone detection on the orangepi 5 Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 039/143] firmware: imx: Add stub functions for SCMI MISC API Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 040/143] firmware: imx: Add stub functions for SCMI LMM API Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 041/143] firmware: imx: Add stub functions for SCMI CPU API Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 042/143] arm64: dts: imx8mp: Correct thermal sensor index Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 043/143] ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 044/143] cpufreq: Initialize cpufreq-based invariance before subsys Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 045/143] smb: server: dont use delayed_work for post_recv_credits_work Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 046/143] smb: server: use disable_work_sync in transport_rdma.c Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 047/143] bpf: Check the helper function is valid in get_helper_proto Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 048/143] selftests/fs/mount-notify: Fix compilation failure Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 049/143] btrfs: dont allow adding block device of less than 1 MB Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 050/143] NFS: Protect against eof page pollution Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 051/143] NFSv4.2: Protect copy offload and clone " Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 052/143] drm/amdkfd: fix p2p links bug in topology Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 053/143] amd/amdkfd: correct mem limit calculation for small APUs Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 054/143] wifi: virt_wifi: Fix page fault on connect Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 055/143] can: rcar_can: rcar_can_resume(): fix s2ram with PSCI Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 056/143] bpf: Reject bpf_timer for PREEMPT_RT Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 057/143] selftests/bpf: Skip timer cases when bpf_timer is not supported Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 058/143] xfrm: xfrm_alloc_spi shouldnt use 0 as SPI Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 059/143] xfrm: fix offloading of cross-family tunnels Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 060/143] can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 061/143] can: hi311x: " Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 062/143] can: sun4i_can: " Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 063/143] can: mcba_usb: " Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 064/143] can: peak_usb: fix shift-out-of-bounds issue Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 065/143] net: tun: Update napi->skb after XDP process Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 066/143] net/smc: fix warning in smc_rx_splice() when calling get_page() Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 067/143] ethernet: rvu-af: Remove slash from the driver name Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 068/143] Bluetooth: hci_sync: Fix hci_resume_advertising_sync Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 069/143] Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 070/143] Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 071/143] vhost: Take a reference on the task in struct vhost_task Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 072/143] Bluetooth: MGMT: Fix possible UAFs Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 073/143] broadcom: fix support for PTP_PEROUT_DUTY_CYCLE Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 074/143] broadcom: fix support for PTP_EXTTS_REQUEST2 ioctl Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 075/143] bnxt_en: correct offset handling for IPv6 destination address Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 076/143] net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 077/143] nexthop: Forbid FDB status change while nexthop is in a group Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 078/143] selftests: fib_nexthops: Fix creation of non-FDB nexthops Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 079/143] net/mlx5: fs, fix UAF in flow counter release Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 080/143] net/mlx5: HWS, remove unused create_dest_array parameter Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 081/143] net/mlx5: HWS, ignore flow level for multi-dest table Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 082/143] net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 083/143] net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 084/143] net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 085/143] octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 086/143] drm/gma500: Fix null dereference in hdmi teardown Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 087/143] futex: Prevent use-after-free during requeue-PI Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 088/143] gpio: regmap: fix memory leak of gpio_regmap structure Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 089/143] drm/xe/vf: Dont expose sysfs attributes not applicable for VFs Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 090/143] drm/xe: Fix build with CONFIG_MODULES=n Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 091/143] drm/i915/ddi: Guard reg_val against a INVALID_TRANSCODER Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 092/143] drm/amd/display: remove output_tf_change flag Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 093/143] futex: Use correct exit on failure from futex_hash_allocate_default() Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 094/143] drm/panthor: Defer scheduler entitiy destruction to queue release Greg Kroah-Hartman
2025-09-30 14:46 ` [PATCH 6.16 095/143] platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 096/143] smb: client: fix wrong index reference in smb2_compound_op() Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 097/143] Revert "drm/xe/guc: Set RCS/CCS yield policy" Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 098/143] Revert "drm/xe/guc: Enable extended CAT error reporting" Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 099/143] tracing/osnoise: Fix slab-out-of-bounds in _parse_integer_limit() Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 100/143] HID: intel-thc-hid: intel-quickspi: Add WCL Device IDs Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 101/143] HID: asus: add support for missing PX series fn keys Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 102/143] i40e: add validation for ring_len param Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 103/143] i40e: fix idx validation in i40e_validate_queue_map Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 104/143] i40e: fix idx validation in config queues msg Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 105/143] i40e: fix input validation logic for action_meta Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 106/143] i40e: fix validation of VF state in get resources Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 107/143] i40e: add max boundary check for VF filters Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 108/143] i40e: add mask to apply valid bits for itr_idx Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 109/143] i40e: improve VF MAC filters accounting Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 110/143] crypto: af_alg - Fix incorrect boolean values in af_alg_ctx Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 111/143] tracing: dynevent: Add a missing lockdown check on dynevent Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 112/143] tracing: fgraph: Protect return handler from recursion loop Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 113/143] tracing: fprobe: Fix to remove recorded module addresses from filter Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 114/143] ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 115/143] arm64: dts: marvell: cn913x-solidrun: fix sata ports status Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 116/143] arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 117/143] arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 118/143] drm/xe: Dont copy pinned kernel bos twice on suspend Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 119/143] drm/ast: Use msleep instead of mdelay for edid read Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 120/143] drm/amd/display: Only restore backlight after amdgpu_dm_init or dm_resume Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 121/143] pinctrl: airoha: fix wrong PHY LED mux value for LED1 GPIO46 Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 122/143] pinctrl: airoha: fix wrong MDIO function bitmaks Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 123/143] Revert "vhost/net: Defer TX queue re-enable until after sendmsg" Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 124/143] vhost-net: flush batched before enabling notifications Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 125/143] afs: Fix potential null pointer dereference in afs_put_server Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 126/143] fs/proc/task_mmu: check p->vec_buf for NULL Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 127/143] gpiolib: Extend software-node support to support secondary software-nodes Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 128/143] kmsan: fix out-of-bounds access to shadow memory Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 129/143] netfs: fix reference leak Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 130/143] riscv: Use an atomic xchg in pudp_huge_get_and_clear() Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 131/143] x86/topology: Implement topology_is_core_online() to address SMT regression Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 132/143] x86/Kconfig: Reenable PTDUMP on i386 Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 133/143] mm/hugetlb: fix folio is still mapped when deleted Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 134/143] mm/damon/sysfs: do not ignore callbacks return value in damon_sysfs_damon_call() Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 135/143] fbcon: fix integer overflow in fbcon_do_set_font Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 136/143] fbcon: Fix OOB access in font allocation Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 137/143] wifi: iwlwifi: fix byte count table for old devices Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 138/143] wifi: iwlwifi: pcie: fix byte count table for some devices Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 139/143] sched_ext: idle: Make local functions static in ext_idle.c Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 140/143] sched_ext: idle: Handle migration-disabled tasks in BPF code Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 141/143] spi: cadence-quadspi: Implement refcount to handle unbind during busy Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 142/143] spi: cadence-qspi: defer runtime support on socfpga if reset bit is enabled Greg Kroah-Hartman
2025-09-30 14:47 ` [PATCH 6.16 143/143] iommufd: Fix race during abort for file descriptors Greg Kroah-Hartman
2025-09-30 18:48 ` 6.16.10-rc1 review Brett A C Sheffield
2025-09-30 19:16 ` [PATCH 6.16 000/143] " Florian Fainelli
2025-09-30 21:10 ` Peter Schneider
2025-10-01 2:45 ` Ron Economos
2025-10-01 7:01 ` Dileep malepu
2025-10-01 8:49 ` Naresh Kamboju
2025-10-01 9:12 ` Jon Hunter
2025-10-01 10:13 ` Mark Brown
2025-10-01 12:07 ` Takeshi Ogasawara
2025-10-01 13:46 ` Justin Forbes
2025-10-01 16:02 ` Shuah Khan
2025-10-01 17:49 ` Miguel Ojeda
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).